1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // This table is a dump of system call numbers -> function names on an XP 6 // system. These numbers change between kernel versions, so it's likely they 7 // will have to be regenerated for your system. See the idarub script. 8 9 // Define a global map used for resolving a syscall number to name. 10 // Call CreateSyscallMap() to create a return a std::map<int, const char*> 11 // which maps from a system call number to its function name. 12 13 #ifndef TRACELINE_SYSCALL_MAP_H_ 14 #define TRACELINE_SYSCALL_MAP_H_ 15 16 #include <map> 17 18 // TODO(deanm): Right now these tables are manually extracted and hardcoded 19 // here. It would be great (but possibly difficult) to do it on startup. We 20 // should at least checksum the DLLs to make sure they match. 21 22 std::map<int, const char*> CreateSyscallMap() { 23 std::map<int, const char*> table; 24 if (1) { // XP table. 25 table[0] = "ntdll.dll!NtAcceptConnectPort"; 26 table[1] = "ntdll.dll!NtAccessCheck"; 27 table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm"; 28 table[3] = "ntdll.dll!NtAccessCheckByType"; 29 table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm"; 30 table[5] = "ntdll.dll!NtAccessCheckByTypeResultList"; 31 table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm"; 32 table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle"; 33 table[8] = "ntdll.dll!NtAddAtom"; 34 table[9] = "ntdll.dll!ZwAddBootEntry"; 35 table[10] = "ntdll.dll!ZwAdjustGroupsToken"; 36 table[11] = "ntdll.dll!ZwAdjustPrivilegesToken"; 37 table[12] = "ntdll.dll!NtAlertResumeThread"; 38 table[13] = "ntdll.dll!NtAlertThread"; 39 table[14] = "ntdll.dll!ZwAllocateLocallyUniqueId"; 40 table[15] = "ntdll.dll!NtAllocateUserPhysicalPages"; 41 table[16] = "ntdll.dll!NtAllocateUuids"; 42 table[17] = "ntdll.dll!NtAllocateVirtualMemory"; 43 table[18] = "ntdll.dll!ZwAreMappedFilesTheSame"; 44 table[19] = "ntdll.dll!ZwAssignProcessToJobObject"; 45 table[20] = "ntdll.dll!ZwCallbackReturn"; 46 table[21] = "ntdll.dll!NtCancelDeviceWakeupRequest"; 47 table[22] = "ntdll.dll!ZwCancelIoFile"; 48 table[23] = "ntdll.dll!ZwCancelTimer"; 49 table[24] = "ntdll.dll!NtClearEvent"; 50 table[25] = "ntdll.dll!NtClose"; 51 table[26] = "ntdll.dll!ZwCloseObjectAuditAlarm"; 52 table[27] = "ntdll.dll!NtCompactKeys"; 53 table[28] = "ntdll.dll!ZwCompareTokens"; 54 table[29] = "ntdll.dll!NtCompleteConnectPort"; 55 table[30] = "ntdll.dll!ZwCompressKey"; 56 table[31] = "ntdll.dll!NtConnectPort"; 57 table[32] = "ntdll.dll!ZwContinue"; 58 table[33] = "ntdll.dll!ZwCreateDebugObject"; 59 table[34] = "ntdll.dll!ZwCreateDirectoryObject"; 60 table[35] = "ntdll.dll!NtCreateEvent"; 61 table[36] = "ntdll.dll!NtCreateEventPair"; 62 table[37] = "ntdll.dll!NtCreateFile"; 63 table[38] = "ntdll.dll!NtCreateIoCompletion"; 64 table[39] = "ntdll.dll!ZwCreateJobObject"; 65 table[40] = "ntdll.dll!NtCreateJobSet"; 66 table[41] = "ntdll.dll!ZwCreateKey"; 67 table[42] = "ntdll.dll!ZwCreateMailslotFile"; 68 table[43] = "ntdll.dll!ZwCreateMutant"; 69 table[44] = "ntdll.dll!ZwCreateNamedPipeFile"; 70 table[45] = "ntdll.dll!NtCreatePagingFile"; 71 table[46] = "ntdll.dll!ZwCreatePort"; 72 table[47] = "ntdll.dll!ZwCreateProcess"; 73 table[48] = "ntdll.dll!ZwCreateProcessEx"; 74 table[49] = "ntdll.dll!ZwCreateProfile"; 75 table[50] = "ntdll.dll!NtCreateSection"; 76 table[51] = "ntdll.dll!NtCreateSemaphore"; 77 table[52] = "ntdll.dll!ZwCreateSymbolicLinkObject"; 78 table[53] = "ntdll.dll!NtCreateThread"; 79 table[54] = "ntdll.dll!ZwCreateTimer"; 80 table[55] = "ntdll.dll!NtCreateToken"; 81 table[56] = "ntdll.dll!ZwCreateWaitablePort"; 82 table[57] = "ntdll.dll!NtDebugActiveProcess"; 83 table[58] = "ntdll.dll!ZwDebugContinue"; 84 table[59] = "ntdll.dll!ZwDelayExecution"; 85 table[60] = "ntdll.dll!ZwDeleteAtom"; 86 table[61] = "ntdll.dll!NtDeleteBootEntry"; 87 table[62] = "ntdll.dll!NtDeleteFile"; 88 table[63] = "ntdll.dll!ZwDeleteKey"; 89 table[64] = "ntdll.dll!NtDeleteObjectAuditAlarm"; 90 table[65] = "ntdll.dll!NtDeleteValueKey"; 91 table[66] = "ntdll.dll!ZwDeviceIoControlFile"; 92 table[67] = "ntdll.dll!NtDisplayString"; 93 table[68] = "ntdll.dll!ZwDuplicateObject"; 94 table[69] = "ntdll.dll!NtDuplicateToken"; 95 table[70] = "ntdll.dll!ZwEnumerateBootEntries"; 96 table[71] = "ntdll.dll!ZwEnumerateKey"; 97 table[72] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx"; 98 table[73] = "ntdll.dll!NtEnumerateValueKey"; 99 table[74] = "ntdll.dll!ZwExtendSection"; 100 table[75] = "ntdll.dll!NtFilterToken"; 101 table[76] = "ntdll.dll!NtFindAtom"; 102 table[77] = "ntdll.dll!ZwFlushBuffersFile"; 103 table[78] = "ntdll.dll!ZwFlushInstructionCache"; 104 table[79] = "ntdll.dll!NtFlushKey"; 105 table[80] = "ntdll.dll!ZwFlushVirtualMemory"; 106 table[81] = "ntdll.dll!NtFlushWriteBuffer"; 107 table[82] = "ntdll.dll!NtFreeUserPhysicalPages"; 108 table[83] = "ntdll.dll!NtFreeVirtualMemory"; 109 table[84] = "ntdll.dll!NtFsControlFile"; 110 table[85] = "ntdll.dll!NtGetContextThread"; 111 table[86] = "ntdll.dll!NtGetDevicePowerState"; 112 table[87] = "ntdll.dll!ZwGetPlugPlayEvent"; 113 table[88] = "ntdll.dll!NtGetWriteWatch"; 114 table[89] = "ntdll.dll!NtImpersonateAnonymousToken"; 115 table[90] = "ntdll.dll!ZwImpersonateClientOfPort"; 116 table[91] = "ntdll.dll!ZwImpersonateThread"; 117 table[92] = "ntdll.dll!ZwInitializeRegistry"; 118 table[93] = "ntdll.dll!NtInitiatePowerAction"; 119 table[94] = "ntdll.dll!ZwIsProcessInJob"; 120 table[95] = "ntdll.dll!NtIsSystemResumeAutomatic"; 121 table[96] = "ntdll.dll!ZwListenPort"; 122 table[97] = "ntdll.dll!NtLoadDriver"; 123 table[98] = "ntdll.dll!NtLoadKey"; 124 table[99] = "ntdll.dll!NtLoadKey2"; 125 table[100] = "ntdll.dll!NtLockFile"; 126 table[101] = "ntdll.dll!ZwLockProductActivationKeys"; 127 table[102] = "ntdll.dll!NtLockRegistryKey"; 128 table[103] = "ntdll.dll!ZwLockVirtualMemory"; 129 table[104] = "ntdll.dll!ZwMakePermanentObject"; 130 table[105] = "ntdll.dll!NtMakeTemporaryObject"; 131 table[106] = "ntdll.dll!NtMapUserPhysicalPages"; 132 table[107] = "ntdll.dll!ZwMapUserPhysicalPagesScatter"; 133 table[108] = "ntdll.dll!ZwMapViewOfSection"; 134 table[109] = "ntdll.dll!NtModifyBootEntry"; 135 table[110] = "ntdll.dll!NtNotifyChangeDirectoryFile"; 136 table[111] = "ntdll.dll!NtNotifyChangeKey"; 137 table[112] = "ntdll.dll!NtNotifyChangeMultipleKeys"; 138 table[113] = "ntdll.dll!ZwOpenDirectoryObject"; 139 table[114] = "ntdll.dll!NtOpenEvent"; 140 table[115] = "ntdll.dll!NtOpenEventPair"; 141 table[116] = "ntdll.dll!NtOpenFile"; 142 table[117] = "ntdll.dll!ZwOpenIoCompletion"; 143 table[118] = "ntdll.dll!ZwOpenJobObject"; 144 table[119] = "ntdll.dll!ZwOpenKey"; 145 table[120] = "ntdll.dll!NtOpenMutant"; 146 table[121] = "ntdll.dll!ZwOpenObjectAuditAlarm"; 147 table[122] = "ntdll.dll!ZwOpenProcess"; 148 table[123] = "ntdll.dll!ZwOpenProcessToken"; 149 table[124] = "ntdll.dll!ZwOpenProcessTokenEx"; 150 table[125] = "ntdll.dll!NtOpenSection"; 151 table[126] = "ntdll.dll!NtOpenSemaphore"; 152 table[127] = "ntdll.dll!NtOpenSymbolicLinkObject"; 153 table[128] = "ntdll.dll!ZwOpenThread"; 154 table[129] = "ntdll.dll!NtOpenThreadToken"; 155 table[130] = "ntdll.dll!NtOpenThreadTokenEx"; 156 table[131] = "ntdll.dll!ZwOpenTimer"; 157 table[132] = "ntdll.dll!NtPlugPlayControl"; 158 table[133] = "ntdll.dll!ZwPowerInformation"; 159 table[134] = "ntdll.dll!ZwPrivilegeCheck"; 160 table[135] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm"; 161 table[136] = "ntdll.dll!NtPrivilegedServiceAuditAlarm"; 162 table[137] = "ntdll.dll!ZwProtectVirtualMemory"; 163 table[138] = "ntdll.dll!ZwPulseEvent"; 164 table[139] = "ntdll.dll!ZwQueryAttributesFile"; 165 table[140] = "ntdll.dll!ZwQueryBootEntryOrder"; 166 table[141] = "ntdll.dll!ZwQueryBootOptions"; 167 table[142] = "ntdll.dll!NtQueryDebugFilterState"; 168 table[143] = "ntdll.dll!NtQueryDefaultLocale"; 169 table[144] = "ntdll.dll!ZwQueryDefaultUILanguage"; 170 table[145] = "ntdll.dll!ZwQueryDirectoryFile"; 171 table[146] = "ntdll.dll!ZwQueryDirectoryObject"; 172 table[147] = "ntdll.dll!ZwQueryEaFile"; 173 table[148] = "ntdll.dll!NtQueryEvent"; 174 table[149] = "ntdll.dll!ZwQueryFullAttributesFile"; 175 table[150] = "ntdll.dll!NtQueryInformationAtom"; 176 table[151] = "ntdll.dll!ZwQueryInformationFile"; 177 table[152] = "ntdll.dll!ZwQueryInformationJobObject"; 178 table[153] = "ntdll.dll!ZwQueryInformationPort"; 179 table[154] = "ntdll.dll!ZwQueryInformationProcess"; 180 table[155] = "ntdll.dll!NtQueryInformationThread"; 181 table[156] = "ntdll.dll!ZwQueryInformationToken"; 182 table[157] = "ntdll.dll!NtQueryInstallUILanguage"; 183 table[158] = "ntdll.dll!NtQueryIntervalProfile"; 184 table[159] = "ntdll.dll!NtQueryIoCompletion"; 185 table[160] = "ntdll.dll!ZwQueryKey"; 186 table[161] = "ntdll.dll!NtQueryMultipleValueKey"; 187 table[162] = "ntdll.dll!NtQueryMutant"; 188 table[163] = "ntdll.dll!NtQueryObject"; 189 table[164] = "ntdll.dll!NtQueryOpenSubKeys"; 190 table[165] = "ntdll.dll!NtQueryPerformanceCounter"; 191 table[166] = "ntdll.dll!ZwQueryQuotaInformationFile"; 192 table[167] = "ntdll.dll!ZwQuerySection"; 193 table[168] = "ntdll.dll!NtQuerySecurityObject"; 194 table[169] = "ntdll.dll!ZwQuerySemaphore"; 195 table[170] = "ntdll.dll!ZwQuerySymbolicLinkObject"; 196 table[171] = "ntdll.dll!ZwQuerySystemEnvironmentValue"; 197 table[172] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx"; 198 table[173] = "ntdll.dll!NtQuerySystemInformation"; 199 table[174] = "ntdll.dll!NtQuerySystemTime"; 200 table[175] = "ntdll.dll!ZwQueryTimer"; 201 table[176] = "ntdll.dll!NtQueryTimerResolution"; 202 table[177] = "ntdll.dll!ZwQueryValueKey"; 203 table[178] = "ntdll.dll!NtQueryVirtualMemory"; 204 table[179] = "ntdll.dll!NtQueryVolumeInformationFile"; 205 table[180] = "ntdll.dll!NtQueueApcThread"; 206 table[181] = "ntdll.dll!ZwRaiseException"; 207 table[182] = "ntdll.dll!ZwRaiseHardError"; 208 table[183] = "ntdll.dll!NtReadFile"; 209 table[184] = "ntdll.dll!NtReadFileScatter"; 210 table[185] = "ntdll.dll!ZwReadRequestData"; 211 table[186] = "ntdll.dll!NtReadVirtualMemory"; 212 table[187] = "ntdll.dll!ZwRegisterThreadTerminatePort"; 213 table[188] = "ntdll.dll!ZwReleaseMutant"; 214 table[189] = "ntdll.dll!NtReleaseSemaphore"; 215 table[190] = "ntdll.dll!ZwRemoveIoCompletion"; 216 table[191] = "ntdll.dll!ZwRemoveProcessDebug"; 217 table[192] = "ntdll.dll!ZwRenameKey"; 218 table[193] = "ntdll.dll!ZwReplaceKey"; 219 table[194] = "ntdll.dll!ZwReplyPort"; 220 table[195] = "ntdll.dll!NtReplyWaitReceivePort"; 221 table[196] = "ntdll.dll!NtReplyWaitReceivePortEx"; 222 table[197] = "ntdll.dll!NtReplyWaitReplyPort"; 223 table[198] = "ntdll.dll!ZwRequestDeviceWakeup"; 224 table[199] = "ntdll.dll!ZwRequestPort"; 225 table[200] = "ntdll.dll!NtRequestWaitReplyPort"; 226 table[201] = "ntdll.dll!ZwRequestWakeupLatency"; 227 table[202] = "ntdll.dll!NtResetEvent"; 228 table[203] = "ntdll.dll!ZwResetWriteWatch"; 229 table[204] = "ntdll.dll!NtRestoreKey"; 230 table[205] = "ntdll.dll!ZwResumeProcess"; 231 table[206] = "ntdll.dll!ZwResumeThread"; 232 table[207] = "ntdll.dll!NtSaveKey"; 233 table[208] = "ntdll.dll!NtSaveKeyEx"; 234 table[209] = "ntdll.dll!NtSaveMergedKeys"; 235 table[210] = "ntdll.dll!NtSecureConnectPort"; 236 table[211] = "ntdll.dll!ZwSetBootEntryOrder"; 237 table[212] = "ntdll.dll!ZwSetBootOptions"; 238 table[213] = "ntdll.dll!ZwSetContextThread"; 239 table[214] = "ntdll.dll!NtSetDebugFilterState"; 240 table[215] = "ntdll.dll!NtSetDefaultHardErrorPort"; 241 table[216] = "ntdll.dll!NtSetDefaultLocale"; 242 table[217] = "ntdll.dll!ZwSetDefaultUILanguage"; 243 table[218] = "ntdll.dll!ZwSetEaFile"; 244 table[219] = "ntdll.dll!NtSetEvent"; 245 table[220] = "ntdll.dll!NtSetEventBoostPriority"; 246 table[221] = "ntdll.dll!NtSetHighEventPair"; 247 table[222] = "ntdll.dll!NtSetHighWaitLowEventPair"; 248 table[223] = "ntdll.dll!ZwSetInformationDebugObject"; 249 table[224] = "ntdll.dll!ZwSetInformationFile"; 250 table[225] = "ntdll.dll!ZwSetInformationJobObject"; 251 table[226] = "ntdll.dll!ZwSetInformationKey"; 252 table[227] = "ntdll.dll!ZwSetInformationObject"; 253 table[228] = "ntdll.dll!ZwSetInformationProcess"; 254 table[229] = "ntdll.dll!ZwSetInformationThread"; 255 table[230] = "ntdll.dll!ZwSetInformationToken"; 256 table[231] = "ntdll.dll!NtSetIntervalProfile"; 257 table[232] = "ntdll.dll!NtSetIoCompletion"; 258 table[233] = "ntdll.dll!ZwSetLdtEntries"; 259 table[234] = "ntdll.dll!ZwSetLowEventPair"; 260 table[235] = "ntdll.dll!ZwSetLowWaitHighEventPair"; 261 table[236] = "ntdll.dll!ZwSetQuotaInformationFile"; 262 table[237] = "ntdll.dll!NtSetSecurityObject"; 263 table[238] = "ntdll.dll!ZwSetSystemEnvironmentValue"; 264 table[239] = "ntdll.dll!ZwSetSystemEnvironmentValueEx"; 265 table[240] = "ntdll.dll!ZwSetSystemInformation"; 266 table[241] = "ntdll.dll!ZwSetSystemPowerState"; 267 table[242] = "ntdll.dll!ZwSetSystemTime"; 268 table[243] = "ntdll.dll!ZwSetThreadExecutionState"; 269 table[244] = "ntdll.dll!ZwSetTimer"; 270 table[245] = "ntdll.dll!NtSetTimerResolution"; 271 table[246] = "ntdll.dll!ZwSetUuidSeed"; 272 table[247] = "ntdll.dll!ZwSetValueKey"; 273 table[248] = "ntdll.dll!NtSetVolumeInformationFile"; 274 table[249] = "ntdll.dll!ZwShutdownSystem"; 275 table[250] = "ntdll.dll!ZwSignalAndWaitForSingleObject"; 276 table[251] = "ntdll.dll!NtStartProfile"; 277 table[252] = "ntdll.dll!ZwStopProfile"; 278 table[253] = "ntdll.dll!ZwSuspendProcess"; 279 table[254] = "ntdll.dll!ZwSuspendThread"; 280 table[255] = "ntdll.dll!NtSystemDebugControl"; 281 table[256] = "ntdll.dll!ZwTerminateJobObject"; 282 table[257] = "ntdll.dll!ZwTerminateProcess"; 283 table[258] = "ntdll.dll!ZwTerminateThread"; 284 table[259] = "ntdll.dll!NtTestAlert"; 285 table[260] = "ntdll.dll!NtTraceEvent"; 286 table[261] = "ntdll.dll!NtTranslateFilePath"; 287 table[262] = "ntdll.dll!ZwUnloadDriver"; 288 table[263] = "ntdll.dll!NtUnloadKey"; 289 table[264] = "ntdll.dll!ZwUnloadKeyEx"; 290 table[265] = "ntdll.dll!ZwUnlockFile"; 291 table[266] = "ntdll.dll!NtUnlockVirtualMemory"; 292 table[267] = "ntdll.dll!NtUnmapViewOfSection"; 293 table[268] = "ntdll.dll!NtVdmControl"; 294 table[269] = "ntdll.dll!NtWaitForDebugEvent"; 295 table[270] = "ntdll.dll!NtWaitForMultipleObjects"; 296 table[271] = "ntdll.dll!ZwWaitForSingleObject"; 297 table[272] = "ntdll.dll!ZwWaitHighEventPair"; 298 table[273] = "ntdll.dll!NtWaitLowEventPair"; 299 table[274] = "ntdll.dll!NtWriteFile"; 300 table[275] = "ntdll.dll!NtWriteFileGather"; 301 table[276] = "ntdll.dll!NtWriteRequestData"; 302 table[277] = "ntdll.dll!NtWriteVirtualMemory"; 303 table[278] = "ntdll.dll!ZwYieldExecution"; 304 table[279] = "ntdll.dll!ZwCreateKeyedEvent"; 305 table[280] = "ntdll.dll!NtOpenKeyedEvent"; 306 table[281] = "ntdll.dll!NtReleaseKeyedEvent"; 307 table[282] = "ntdll.dll!NtWaitForKeyedEvent"; 308 table[283] = "ntdll.dll!ZwQueryPortInformationProcess"; 309 table[4096] = "gdi32.dll!NtGdiAbortDoc"; 310 table[4097] = "gdi32.dll!NtGdiAbortPath"; 311 table[4098] = "gdi32.dll!NtGdiAddFontResourceW"; 312 table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC"; 313 table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx"; 314 table[4101] = "gdi32.dll!NtGdiRemoveMergeFont"; 315 table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC"; 316 table[4103] = "gdi32.dll!NtGdiAlphaBlend"; 317 table[4104] = "gdi32.dll!NtGdiAngleArc"; 318 table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts"; 319 table[4106] = "gdi32.dll!NtGdiFontIsLinked"; 320 table[4107] = "gdi32.dll!NtGdiArcInternal"; 321 table[4108] = "gdi32.dll!NtGdiBeginPath"; 322 table[4109] = "gdi32.dll!NtGdiBitBlt"; 323 table[4110] = "gdi32.dll!NtGdiCancelDC"; 324 table[4111] = "gdi32.dll!NtGdiCheckBitmapBits"; 325 table[4112] = "gdi32.dll!NtGdiCloseFigure"; 326 table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes"; 327 table[4114] = "gdi32.dll!NtGdiClearBrushAttributes"; 328 table[4115] = "gdi32.dll!NtGdiColorCorrectPalette"; 329 table[4116] = "gdi32.dll!NtGdiCombineRgn"; 330 table[4117] = "gdi32.dll!CombineTransform"; 331 table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients"; 332 table[4119] = "gdi32.dll!NtGdiConsoleTextOut"; 333 table[4120] = "gdi32.dll!NtGdiConvertMetafileRect"; 334 table[4121] = "gdi32.dll!NtGdiCreateBitmap"; 335 table[4122] = "gdi32.dll!NtGdiCreateClientObj"; 336 table[4123] = "gdi32.dll!NtGdiCreateColorSpace"; 337 table[4124] = "gdi32.dll!NtGdiCreateColorTransform"; 338 table[4125] = "gdi32.dll!NtGdiCreateCompatibleBitmap"; 339 table[4126] = "gdi32.dll!NtGdiCreateCompatibleDC"; 340 table[4127] = "gdi32.dll!NtGdiCreateDIBBrush"; 341 table[4128] = "gdi32.dll!NtGdiCreateDIBitmapInternal"; 342 table[4129] = "gdi32.dll!NtGdiCreateDIBSection"; 343 table[4130] = "gdi32.dll!NtGdiCreateEllipticRgn"; 344 table[4131] = "gdi32.dll!NtGdiCreateHalftonePalette"; 345 table[4132] = "gdi32.dll!NtGdiCreateHatchBrushInternal"; 346 table[4133] = "gdi32.dll!NtGdiCreateMetafileDC"; 347 table[4134] = "gdi32.dll!NtGdiCreatePaletteInternal"; 348 table[4135] = "gdi32.dll!NtGdiCreatePatternBrushInternal"; 349 table[4136] = "gdi32.dll!CreatePen"; 350 table[4137] = "gdi32.dll!NtGdiCreateRectRgn"; 351 table[4138] = "gdi32.dll!CreateRoundRectRgn"; 352 table[4139] = "gdi32.dll!NtGdiCreateServerMetaFile"; 353 table[4140] = "gdi32.dll!NtGdiCreateSolidBrush"; 354 table[4141] = "gdi32.dll!NtGdiD3dContextCreate"; 355 table[4142] = "gdi32.dll!NtGdiD3dContextDestroy"; 356 table[4143] = "gdi32.dll!NtGdiD3dContextDestroyAll"; 357 table[4144] = "gdi32.dll!NtGdiD3dValidateTextureStageState"; 358 table[4145] = "gdi32.dll!NtGdiD3dDrawPrimitives2"; 359 table[4146] = "gdi32.dll!NtGdiDdGetDriverState"; 360 table[4147] = "gdi32.dll!NtGdiDdAddAttachedSurface"; 361 table[4148] = "gdi32.dll!NtGdiDdAlphaBlt"; 362 table[4149] = "gdi32.dll!NtGdiDdAttachSurface"; 363 table[4150] = "gdi32.dll!NtGdiDdBeginMoCompFrame"; 364 table[4151] = "gdi32.dll!NtGdiDdBlt"; 365 table[4152] = "gdi32.dll!NtGdiDdCanCreateSurface"; 366 table[4153] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer"; 367 table[4154] = "gdi32.dll!NtGdiDdColorControl"; 368 table[4155] = "gdi32.dll!NtGdiDdCreateDirectDrawObject"; 369 table[4156] = "gdi32.dll!NtGdiDdCreateSurface"; 370 table[4157] = "gdi32.dll!NtGdiDdCreateD3DBuffer"; 371 table[4158] = "gdi32.dll!NtGdiDdCreateMoComp"; 372 table[4159] = "gdi32.dll!NtGdiDdCreateSurfaceObject"; 373 table[4160] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject"; 374 table[4161] = "gdi32.dll!NtGdiDdDeleteSurfaceObject"; 375 table[4162] = "gdi32.dll!NtGdiDdDestroyMoComp"; 376 table[4163] = "gdi32.dll!NtGdiDdDestroySurface"; 377 table[4164] = "gdi32.dll!NtGdiDdDestroyD3DBuffer"; 378 table[4165] = "gdi32.dll!NtGdiDdEndMoCompFrame"; 379 table[4166] = "gdi32.dll!NtGdiDdFlip"; 380 table[4167] = "gdi32.dll!NtGdiDdFlipToGDISurface"; 381 table[4168] = "gdi32.dll!NtGdiDdGetAvailDriverMemory"; 382 table[4169] = "gdi32.dll!NtGdiDdGetBltStatus"; 383 table[4170] = "gdi32.dll!NtGdiDdGetDC"; 384 table[4171] = "gdi32.dll!NtGdiDdGetDriverInfo"; 385 table[4172] = "gdi32.dll!NtGdiDdGetDxHandle"; 386 table[4173] = "gdi32.dll!NtGdiDdGetFlipStatus"; 387 table[4174] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo"; 388 table[4175] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo"; 389 table[4176] = "gdi32.dll!NtGdiDdGetMoCompGuids"; 390 table[4177] = "gdi32.dll!NtGdiDdGetMoCompFormats"; 391 table[4178] = "gdi32.dll!NtGdiDdGetScanLine"; 392 table[4179] = "gdi32.dll!NtGdiDdLock"; 393 table[4180] = "gdi32.dll!NtGdiDdLockD3D"; 394 table[4181] = "gdi32.dll!NtGdiDdQueryDirectDrawObject"; 395 table[4182] = "gdi32.dll!NtGdiDdQueryMoCompStatus"; 396 table[4183] = "gdi32.dll!NtGdiDdReenableDirectDrawObject"; 397 table[4184] = "gdi32.dll!NtGdiDdReleaseDC"; 398 table[4185] = "gdi32.dll!NtGdiDdRenderMoComp"; 399 table[4186] = "gdi32.dll!NtGdiDdResetVisrgn"; 400 table[4187] = "gdi32.dll!NtGdiDdSetColorKey"; 401 table[4188] = "gdi32.dll!NtGdiDdSetExclusiveMode"; 402 table[4189] = "gdi32.dll!NtGdiDdSetGammaRamp"; 403 table[4190] = "gdi32.dll!NtGdiDdCreateSurfaceEx"; 404 table[4191] = "gdi32.dll!NtGdiDdSetOverlayPosition"; 405 table[4192] = "gdi32.dll!NtGdiDdUnattachSurface"; 406 table[4193] = "gdi32.dll!NtGdiDdUnlock"; 407 table[4194] = "gdi32.dll!NtGdiDdUnlockD3D"; 408 table[4195] = "gdi32.dll!NtGdiDdUpdateOverlay"; 409 table[4196] = "gdi32.dll!NtGdiDdWaitForVerticalBlank"; 410 table[4197] = "gdi32.dll!NtGdiDvpCanCreateVideoPort"; 411 table[4198] = "gdi32.dll!NtGdiDvpColorControl"; 412 table[4199] = "gdi32.dll!NtGdiDvpCreateVideoPort"; 413 table[4200] = "gdi32.dll!NtGdiDvpDestroyVideoPort"; 414 table[4201] = "gdi32.dll!NtGdiDvpFlipVideoPort"; 415 table[4202] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth"; 416 table[4203] = "gdi32.dll!NtGdiDvpGetVideoPortField"; 417 table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus"; 418 table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats"; 419 table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortLine"; 420 table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats"; 421 table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo"; 422 table[4209] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus"; 423 table[4210] = "gdi32.dll!NtGdiDvpUpdateVideoPort"; 424 table[4211] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync"; 425 table[4212] = "gdi32.dll!NtGdiDvpAcquireNotification"; 426 table[4213] = "gdi32.dll!NtGdiDvpReleaseNotification"; 427 table[4214] = "gdi32.dll!NtGdiDxgGenericThunk"; 428 table[4215] = "gdi32.dll!NtGdiDeleteClientObj"; 429 table[4216] = "gdi32.dll!NtGdiDeleteColorSpace"; 430 table[4217] = "gdi32.dll!NtGdiDeleteColorTransform"; 431 table[4218] = "gdi32.dll!DeleteObject"; 432 table[4219] = "gdi32.dll!NtGdiDescribePixelFormat"; 433 table[4220] = "gdi32.dll!NtGdiGetPerBandInfo"; 434 table[4221] = "gdi32.dll!NtGdiDoBanding"; 435 table[4222] = "gdi32.dll!NtGdiDoPalette"; 436 table[4223] = "gdi32.dll!NtGdiDrawEscape"; 437 table[4224] = "gdi32.dll!NtGdiEllipse"; 438 table[4225] = "gdi32.dll!NtGdiEnableEudc"; 439 table[4226] = "gdi32.dll!NtGdiEndDoc"; 440 table[4227] = "gdi32.dll!NtGdiEndPage"; 441 table[4228] = "gdi32.dll!NtGdiEndPath"; 442 table[4229] = "gdi32.dll!NtGdiEnumFontChunk"; 443 table[4230] = "gdi32.dll!NtGdiEnumFontClose"; 444 table[4231] = "gdi32.dll!NtGdiEnumFontOpen"; 445 table[4232] = "gdi32.dll!NtGdiEnumObjects"; 446 table[4233] = "gdi32.dll!NtGdiEqualRgn"; 447 table[4234] = "gdi32.dll!NtGdiEudcLoadUnloadLink"; 448 table[4235] = "gdi32.dll!NtGdiExcludeClipRect"; 449 table[4236] = "gdi32.dll!NtGdiExtCreatePen"; 450 table[4237] = "gdi32.dll!NtGdiExtCreateRegion"; 451 table[4238] = "gdi32.dll!NtGdiExtEscape"; 452 table[4239] = "gdi32.dll!NtGdiExtFloodFill"; 453 table[4240] = "gdi32.dll!NtGdiExtGetObjectW"; 454 table[4241] = "gdi32.dll!ExtSelectClipRgn"; 455 table[4242] = "gdi32.dll!NtGdiExtTextOutW"; 456 table[4243] = "gdi32.dll!NtGdiFillPath"; 457 table[4244] = "gdi32.dll!NtGdiFillRgn"; 458 table[4245] = "gdi32.dll!NtGdiFlattenPath"; 459 table[4247] = "gdi32.dll!NtGdiFlush"; 460 table[4248] = "gdi32.dll!NtGdiForceUFIMapping"; 461 table[4249] = "gdi32.dll!NtGdiFrameRgn"; 462 table[4250] = "gdi32.dll!NtGdiFullscreenControl"; 463 table[4251] = "gdi32.dll!NtGdiGetAndSetDCDword"; 464 table[4252] = "gdi32.dll!GetClipBox"; 465 table[4253] = "gdi32.dll!GetBitmapBits"; 466 table[4254] = "gdi32.dll!NtGdiGetBitmapDimension"; 467 table[4255] = "gdi32.dll!NtGdiGetBoundsRect"; 468 table[4256] = "gdi32.dll!NtGdiGetCharABCWidthsW"; 469 table[4257] = "gdi32.dll!NtGdiGetCharacterPlacementW"; 470 table[4258] = "gdi32.dll!NtGdiGetCharSet"; 471 table[4259] = "gdi32.dll!NtGdiGetCharWidthW"; 472 table[4260] = "gdi32.dll!NtGdiGetCharWidthInfo"; 473 table[4261] = "gdi32.dll!NtGdiGetColorAdjustment"; 474 table[4263] = "gdi32.dll!NtGdiGetDCDword"; 475 table[4264] = "gdi32.dll!NtGdiGetDCforBitmap"; 476 table[4265] = "gdi32.dll!NtGdiGetDCObject"; 477 table[4266] = "gdi32.dll!NtGdiGetDCPoint"; 478 table[4267] = "gdi32.dll!NtGdiGetDeviceCaps"; 479 table[4268] = "gdi32.dll!NtGdiGetDeviceGammaRamp"; 480 table[4269] = "gdi32.dll!NtGdiGetDeviceCapsAll"; 481 table[4270] = "gdi32.dll!NtGdiGetDIBitsInternal"; 482 table[4271] = "gdi32.dll!NtGdiGetETM"; 483 table[4272] = "gdi32.dll!NtGdiGetEudcTimeStampEx"; 484 table[4273] = "gdi32.dll!GetFontData"; 485 table[4274] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW"; 486 table[4275] = "gdi32.dll!NtGdiGetGlyphIndicesW"; 487 table[4276] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal"; 488 table[4277] = "gdi32.dll!NtGdiGetGlyphOutline"; 489 table[4278] = "gdi32.dll!NtGdiGetKerningPairs"; 490 table[4279] = "gdi32.dll!NtGdiGetLinkedUFIs"; 491 table[4280] = "gdi32.dll!GetMiterLimit"; 492 table[4281] = "gdi32.dll!NtGdiGetMonitorID"; 493 table[4282] = "gdi32.dll!GetNearestColor"; 494 table[4283] = "gdi32.dll!NtGdiGetNearestPaletteIndex"; 495 table[4284] = "gdi32.dll!NtGdiGetObjectBitmapHandle"; 496 table[4285] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW"; 497 table[4286] = "gdi32.dll!NtGdiGetPath"; 498 table[4287] = "gdi32.dll!NtGdiGetPixel"; 499 table[4288] = "gdi32.dll!NtGdiGetRandomRgn"; 500 table[4289] = "gdi32.dll!GetRasterizerCaps"; 501 table[4290] = "gdi32.dll!NtGdiGetRealizationInfo"; 502 table[4291] = "gdi32.dll!GetRegionData"; 503 table[4292] = "gdi32.dll!NtGdiGetRgnBox"; 504 table[4293] = "gdi32.dll!NtGdiGetServerMetaFileBits"; 505 table[4294] = "gdi32.dll!NtGdiGetSpoolMessage"; 506 table[4296] = "gdi32.dll!NtGdiGetStockObject"; 507 table[4297] = "gdi32.dll!NtGdiGetStringBitmapW"; 508 table[4298] = "gdi32.dll!GetSystemPaletteUse"; 509 table[4299] = "gdi32.dll!NtGdiGetTextCharsetInfo"; 510 table[4300] = "gdi32.dll!NtGdiGetTextExtent"; 511 table[4301] = "gdi32.dll!NtGdiGetTextExtentExW"; 512 table[4302] = "gdi32.dll!NtGdiGetTextFaceW"; 513 table[4303] = "gdi32.dll!NtGdiGetTextMetricsW"; 514 table[4304] = "gdi32.dll!NtGdiGetTransform"; 515 table[4305] = "gdi32.dll!NtGdiGetUFI"; 516 table[4306] = "gdi32.dll!NtGdiGetEmbUFI"; 517 table[4307] = "gdi32.dll!NtGdiGetUFIPathname"; 518 table[4308] = "gdi32.dll!NtGdiGetEmbedFonts"; 519 table[4309] = "gdi32.dll!NtGdiChangeGhostFont"; 520 table[4310] = "gdi32.dll!NtGdiAddEmbFontToDC"; 521 table[4311] = "gdi32.dll!NtGdiGetFontUnicodeRanges"; 522 table[4312] = "gdi32.dll!NtGdiGetWidthTable"; 523 table[4313] = "gdi32.dll!NtGdiGradientFill"; 524 table[4314] = "gdi32.dll!NtGdiHfontCreate"; 525 table[4315] = "gdi32.dll!NtGdiIcmBrushInfo"; 526 table[4316] = "gdi32.dll!NtGdiInit"; 527 table[4317] = "gdi32.dll!NtGdiInitSpool"; 528 table[4318] = "gdi32.dll!NtGdiIntersectClipRect"; 529 table[4319] = "gdi32.dll!NtGdiInvertRgn"; 530 table[4320] = "gdi32.dll!NtGdiLineTo"; 531 table[4321] = "gdi32.dll!NtGdiMakeFontDir"; 532 table[4322] = "gdi32.dll!NtGdiMakeInfoDC"; 533 table[4323] = "gdi32.dll!NtGdiMaskBlt"; 534 table[4324] = "gdi32.dll!NtGdiModifyWorldTransform"; 535 table[4325] = "gdi32.dll!NtGdiMonoBitmap"; 536 table[4327] = "gdi32.dll!NtGdiOffsetClipRgn"; 537 table[4328] = "gdi32.dll!NtGdiOffsetRgn"; 538 table[4329] = "gdi32.dll!NtGdiOpenDCW"; 539 table[4330] = "gdi32.dll!NtGdiPatBlt"; 540 table[4331] = "gdi32.dll!NtGdiPolyPatBlt"; 541 table[4332] = "gdi32.dll!NtGdiPathToRegion"; 542 table[4333] = "gdi32.dll!NtGdiPlgBlt"; 543 table[4334] = "gdi32.dll!NtGdiPolyDraw"; 544 table[4335] = "gdi32.dll!NtGdiPolyPolyDraw"; 545 table[4336] = "gdi32.dll!NtGdiPolyTextOutW"; 546 table[4337] = "gdi32.dll!NtGdiPtInRegion"; 547 table[4338] = "gdi32.dll!NtGdiPtVisible"; 548 table[4339] = "gdi32.dll!NtGdiQueryFonts"; 549 table[4340] = "gdi32.dll!NtGdiQueryFontAssocInfo"; 550 table[4341] = "gdi32.dll!NtGdiRectangle"; 551 table[4342] = "gdi32.dll!NtGdiRectInRegion"; 552 table[4343] = "gdi32.dll!RectVisible"; 553 table[4344] = "gdi32.dll!NtGdiRemoveFontResourceW"; 554 table[4345] = "gdi32.dll!NtGdiRemoveFontMemResourceEx"; 555 table[4346] = "gdi32.dll!NtGdiResetDC"; 556 table[4347] = "gdi32.dll!NtGdiResizePalette"; 557 table[4348] = "gdi32.dll!NtGdiRestoreDC"; 558 table[4349] = "gdi32.dll!NtGdiRoundRect"; 559 table[4350] = "gdi32.dll!NtGdiSaveDC"; 560 table[4351] = "gdi32.dll!NtGdiScaleViewportExtEx"; 561 table[4352] = "gdi32.dll!NtGdiScaleWindowExtEx"; 562 table[4353] = "gdi32.dll!NtGdiSelectBitmap"; 563 table[4355] = "gdi32.dll!NtGdiSelectClipPath"; 564 table[4356] = "gdi32.dll!NtGdiSelectFont"; 565 table[4357] = "gdi32.dll!NtGdiSelectPen"; 566 table[4358] = "gdi32.dll!NtGdiSetBitmapAttributes"; 567 table[4359] = "gdi32.dll!SetBitmapBits"; 568 table[4360] = "gdi32.dll!NtGdiSetBitmapDimension"; 569 table[4361] = "gdi32.dll!NtGdiSetBoundsRect"; 570 table[4362] = "gdi32.dll!NtGdiSetBrushAttributes"; 571 table[4363] = "gdi32.dll!NtGdiSetBrushOrg"; 572 table[4364] = "gdi32.dll!NtGdiSetColorAdjustment"; 573 table[4365] = "gdi32.dll!NtGdiSetColorSpace"; 574 table[4366] = "gdi32.dll!NtGdiSetDeviceGammaRamp"; 575 table[4367] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal"; 576 table[4368] = "gdi32.dll!NtGdiSetFontEnumeration"; 577 table[4369] = "gdi32.dll!NtGdiSetFontXform"; 578 table[4370] = "gdi32.dll!NtGdiSetIcmMode"; 579 table[4371] = "gdi32.dll!NtGdiSetLinkedUFIs"; 580 table[4372] = "gdi32.dll!NtGdiSetMagicColors"; 581 table[4373] = "gdi32.dll!NtGdiSetMetaRgn"; 582 table[4374] = "gdi32.dll!NtGdiSetMiterLimit"; 583 table[4375] = "gdi32.dll!NtGdiGetDeviceWidth"; 584 table[4376] = "gdi32.dll!NtGdiMirrorWindowOrg"; 585 table[4377] = "gdi32.dll!NtGdiSetLayout"; 586 table[4378] = "gdi32.dll!NtGdiSetPixel"; 587 table[4379] = "gdi32.dll!NtGdiSetPixelFormat"; 588 table[4380] = "gdi32.dll!NtGdiSetRectRgn"; 589 table[4381] = "gdi32.dll!NtGdiSetSystemPaletteUse"; 590 table[4383] = "gdi32.dll!NtGdiSetupPublicCFONT"; 591 table[4384] = "gdi32.dll!NtGdiSetVirtualResolution"; 592 table[4385] = "gdi32.dll!NtGdiSetSizeDevice"; 593 table[4386] = "gdi32.dll!NtGdiStartDoc"; 594 table[4387] = "gdi32.dll!NtGdiStartPage"; 595 table[4388] = "gdi32.dll!NtGdiStretchBlt"; 596 table[4389] = "gdi32.dll!NtGdiStretchDIBitsInternal"; 597 table[4390] = "gdi32.dll!NtGdiStrokeAndFillPath"; 598 table[4391] = "gdi32.dll!NtGdiStrokePath"; 599 table[4392] = "gdi32.dll!NtGdiSwapBuffers"; 600 table[4393] = "gdi32.dll!NtGdiTransformPoints"; 601 table[4394] = "gdi32.dll!NtGdiTransparentBlt"; 602 table[4395] = "gdi32.dll!NtGdiUnloadPrinterDriver"; 603 table[4397] = "gdi32.dll!NtGdiUnrealizeObject"; 604 table[4398] = "gdi32.dll!NtGdiUpdateColors"; 605 table[4399] = "gdi32.dll!NtGdiWidenPath"; 606 table[4400] = "user32.dll!NtUserActivateKeyboardLayout"; 607 table[4401] = "user32.dll!NtUserAlterWindowStyle"; 608 table[4402] = "imm32.dll!NtUserAssociateInputContext"; 609 table[4403] = "user32.dll!NtUserAttachThreadInput"; 610 table[4404] = "user32.dll!NtUserBeginPaint"; 611 table[4405] = "user32.dll!NtUserBitBltSysBmp"; 612 table[4406] = "user32.dll!NtUserBlockInput"; 613 table[4407] = "imm32.dll!NtUserBuildHimcList"; 614 table[4408] = "user32.dll!NtUserBuildHwndList"; 615 table[4409] = "user32.dll!NtUserBuildNameList"; 616 table[4410] = "user32.dll!NtUserBuildPropList"; 617 table[4411] = "user32.dll!NtUserCallHwnd"; 618 table[4412] = "user32.dll!NtUserCallHwndLock"; 619 table[4413] = "user32.dll!NtUserCallHwndOpt"; 620 table[4414] = "user32.dll!NtUserCallHwndParam"; 621 table[4415] = "user32.dll!NtUserCallHwndParamLock"; 622 table[4416] = "user32.dll!NtUserCallMsgFilter"; 623 table[4417] = "user32.dll!NtUserCallNextHookEx"; 624 table[4418] = "user32.dll!NtUserCallNoParam"; 625 table[4419] = "imm32.dll!NtUserCallOneParam"; 626 table[4419] = "user32.dll!NtUserCallOneParam"; 627 table[4420] = "user32.dll!NtUserCallTwoParam"; 628 table[4421] = "user32.dll!NtUserChangeClipboardChain"; 629 table[4422] = "user32.dll!NtUserChangeDisplaySettings"; 630 table[4424] = "user32.dll!NtUserCheckMenuItem"; 631 table[4425] = "user32.dll!NtUserChildWindowFromPointEx"; 632 table[4426] = "user32.dll!NtUserClipCursor"; 633 table[4427] = "user32.dll!NtUserCloseClipboard"; 634 table[4428] = "user32.dll!NtUserCloseDesktop"; 635 table[4429] = "user32.dll!NtUserCloseWindowStation"; 636 table[4431] = "user32.dll!NtUserConvertMemHandle"; 637 table[4432] = "user32.dll!NtUserCopyAcceleratorTable"; 638 table[4433] = "user32.dll!NtUserCountClipboardFormats"; 639 table[4434] = "user32.dll!NtUserCreateAcceleratorTable"; 640 table[4435] = "user32.dll!NtUserCreateCaret"; 641 table[4436] = "user32.dll!NtUserCreateDesktop"; 642 table[4437] = "imm32.dll!NtUserCreateInputContext"; 643 table[4438] = "user32.dll!NtUserCreateLocalMemHandle"; 644 table[4439] = "user32.dll!NtUserCreateWindowEx"; 645 table[4440] = "user32.dll!NtUserCreateWindowStation"; 646 table[4441] = "user32.dll!NtUserDdeGetQualityOfService"; 647 table[4442] = "user32.dll!NtUserDdeInitialize"; 648 table[4443] = "user32.dll!NtUserDdeSetQualityOfService"; 649 table[4444] = "user32.dll!NtUserDeferWindowPos"; 650 table[4445] = "user32.dll!NtUserDefSetText"; 651 table[4446] = "user32.dll!NtUserDeleteMenu"; 652 table[4447] = "user32.dll!DestroyAcceleratorTable"; 653 table[4448] = "user32.dll!NtUserDestroyCursor"; 654 table[4449] = "imm32.dll!NtUserDestroyInputContext"; 655 table[4450] = "user32.dll!NtUserDestroyMenu"; 656 table[4451] = "user32.dll!NtUserDestroyWindow"; 657 table[4452] = "imm32.dll!NtUserDisableThreadIme"; 658 table[4453] = "user32.dll!NtUserDispatchMessage"; 659 table[4454] = "user32.dll!NtUserDragDetect"; 660 table[4455] = "user32.dll!NtUserDragObject"; 661 table[4456] = "user32.dll!NtUserDrawAnimatedRects"; 662 table[4457] = "user32.dll!NtUserDrawCaption"; 663 table[4458] = "user32.dll!NtUserDrawCaptionTemp"; 664 table[4459] = "user32.dll!NtUserDrawIconEx"; 665 table[4460] = "user32.dll!NtUserDrawMenuBarTemp"; 666 table[4461] = "user32.dll!NtUserEmptyClipboard"; 667 table[4462] = "user32.dll!NtUserEnableMenuItem"; 668 table[4463] = "user32.dll!NtUserEnableScrollBar"; 669 table[4464] = "user32.dll!NtUserEndDeferWindowPosEx"; 670 table[4465] = "user32.dll!NtUserEndMenu"; 671 table[4466] = "user32.dll!NtUserEndPaint"; 672 table[4467] = "user32.dll!NtUserEnumDisplayDevices"; 673 table[4468] = "user32.dll!NtUserEnumDisplayMonitors"; 674 table[4469] = "user32.dll!NtUserEnumDisplaySettings"; 675 table[4470] = "user32.dll!NtUserEvent"; 676 table[4471] = "user32.dll!NtUserExcludeUpdateRgn"; 677 table[4472] = "user32.dll!NtUserFillWindow"; 678 table[4473] = "user32.dll!NtUserFindExistingCursorIcon"; 679 table[4474] = "user32.dll!NtUserFindWindowEx"; 680 table[4475] = "user32.dll!NtUserFlashWindowEx"; 681 table[4476] = "user32.dll!NtUserGetAltTabInfo"; 682 table[4477] = "user32.dll!NtUserGetAncestor"; 683 table[4478] = "imm32.dll!NtUserGetAppImeLevel"; 684 table[4479] = "user32.dll!GetAsyncKeyState"; 685 table[4480] = "user32.dll!NtUserGetAtomName"; 686 table[4481] = "user32.dll!NtUserGetCaretBlinkTime"; 687 table[4482] = "user32.dll!NtUserGetCaretPos"; 688 table[4483] = "user32.dll!NtUserGetClassInfo"; 689 table[4484] = "user32.dll!NtUserGetClassName"; 690 table[4485] = "user32.dll!NtUserGetClipboardData"; 691 table[4486] = "user32.dll!NtUserGetClipboardFormatName"; 692 table[4487] = "user32.dll!NtUserGetClipboardOwner"; 693 table[4488] = "user32.dll!NtUserGetClipboardSequenceNumber"; 694 table[4489] = "user32.dll!NtUserGetClipboardViewer"; 695 table[4490] = "user32.dll!NtUserGetClipCursor"; 696 table[4491] = "user32.dll!NtUserGetComboBoxInfo"; 697 table[4492] = "user32.dll!NtUserGetControlBrush"; 698 table[4493] = "user32.dll!NtUserGetControlColor"; 699 table[4494] = "user32.dll!NtUserGetCPD"; 700 table[4495] = "user32.dll!NtUserGetCursorFrameInfo"; 701 table[4496] = "user32.dll!NtUserGetCursorInfo"; 702 table[4497] = "user32.dll!NtUserGetDC"; 703 table[4498] = "user32.dll!NtUserGetDCEx"; 704 table[4499] = "user32.dll!NtUserGetDoubleClickTime"; 705 table[4500] = "user32.dll!NtUserGetForegroundWindow"; 706 table[4501] = "user32.dll!NtUserGetGuiResources"; 707 table[4502] = "user32.dll!NtUserGetGUIThreadInfo"; 708 table[4503] = "user32.dll!NtUserGetIconInfo"; 709 table[4504] = "user32.dll!NtUserGetIconSize"; 710 table[4505] = "imm32.dll!NtUserGetImeHotKey"; 711 table[4505] = "user32.dll!NtUserGetImeHotKey"; 712 table[4506] = "imm32.dll!NtUserGetImeInfoEx"; 713 table[4507] = "user32.dll!NtUserGetInternalWindowPos"; 714 table[4508] = "user32.dll!NtUserGetKeyboardLayoutList"; 715 table[4509] = "user32.dll!NtUserGetKeyboardLayoutName"; 716 table[4510] = "user32.dll!NtUserGetKeyboardState"; 717 table[4511] = "user32.dll!NtUserGetKeyNameText"; 718 table[4512] = "user32.dll!NtUserGetKeyState"; 719 table[4513] = "user32.dll!NtUserGetListBoxInfo"; 720 table[4514] = "user32.dll!NtUserGetMenuBarInfo"; 721 table[4515] = "user32.dll!NtUserGetMenuIndex"; 722 table[4516] = "user32.dll!NtUserGetMenuItemRect"; 723 table[4517] = "user32.dll!NtUserGetMessage"; 724 table[4518] = "user32.dll!NtUserGetMouseMovePointsEx"; 725 table[4519] = "user32.dll!NtUserGetObjectInformation"; 726 table[4520] = "user32.dll!NtUserGetOpenClipboardWindow"; 727 table[4521] = "user32.dll!NtUserGetPriorityClipboardFormat"; 728 table[4522] = "user32.dll!NtUserGetProcessWindowStation"; 729 table[4523] = "user32.dll!NtUserGetRawInputBuffer"; 730 table[4524] = "user32.dll!NtUserGetRawInputData"; 731 table[4525] = "user32.dll!NtUserGetRawInputDeviceInfo"; 732 table[4526] = "user32.dll!NtUserGetRawInputDeviceList"; 733 table[4527] = "user32.dll!NtUserGetRegisteredRawInputDevices"; 734 table[4528] = "user32.dll!NtUserGetScrollBarInfo"; 735 table[4529] = "user32.dll!NtUserGetSystemMenu"; 736 table[4530] = "user32.dll!NtUserGetThreadDesktop"; 737 table[4531] = "imm32.dll!NtUserGetThreadState"; 738 table[4531] = "user32.dll!NtUserGetThreadState"; 739 table[4532] = "user32.dll!NtUserGetTitleBarInfo"; 740 table[4533] = "user32.dll!GetUpdateRect"; 741 table[4534] = "user32.dll!GetUpdateRgn"; 742 table[4535] = "user32.dll!NtUserGetWindowDC"; 743 table[4536] = "user32.dll!NtUserGetWindowPlacement"; 744 table[4537] = "user32.dll!NtUserGetWOWClass"; 745 table[4539] = "user32.dll!NtUserHideCaret"; 746 table[4540] = "user32.dll!NtUserHiliteMenuItem"; 747 table[4541] = "user32.dll!NtUserImpersonateDdeClientWindow"; 748 table[4543] = "user32.dll!NtUserInitializeClientPfnArrays"; 749 table[4544] = "user32.dll!NtUserInitTask"; 750 table[4545] = "user32.dll!NtUserInternalGetWindowText"; 751 table[4546] = "user32.dll!NtUserInvalidateRect"; 752 table[4547] = "user32.dll!NtUserInvalidateRgn"; 753 table[4548] = "user32.dll!NtUserIsClipboardFormatAvailable"; 754 table[4549] = "user32.dll!NtUserKillTimer"; 755 table[4550] = "user32.dll!NtUserLoadKeyboardLayoutEx"; 756 table[4551] = "user32.dll!NtUserLockWindowStation"; 757 table[4552] = "user32.dll!NtUserLockWindowUpdate"; 758 table[4553] = "user32.dll!NtUserLockWorkStation"; 759 table[4554] = "user32.dll!NtUserMapVirtualKeyEx"; 760 table[4555] = "user32.dll!NtUserMenuItemFromPoint"; 761 table[4556] = "user32.dll!NtUserMessageCall"; 762 table[4557] = "user32.dll!NtUserMinMaximize"; 763 table[4558] = "user32.dll!NtUserMNDragLeave"; 764 table[4559] = "user32.dll!NtUserMNDragOver"; 765 table[4560] = "user32.dll!NtUserModifyUserStartupInfoFlags"; 766 table[4561] = "user32.dll!NtUserMoveWindow"; 767 table[4562] = "imm32.dll!NtUserNotifyIMEStatus"; 768 table[4562] = "user32.dll!NtUserNotifyIMEStatus"; 769 table[4564] = "user32.dll!NtUserNotifyWinEvent"; 770 table[4565] = "user32.dll!NtUserOpenClipboard"; 771 table[4566] = "user32.dll!NtUserOpenDesktop"; 772 table[4567] = "user32.dll!NtUserOpenInputDesktop"; 773 table[4568] = "user32.dll!NtUserOpenWindowStation"; 774 table[4569] = "user32.dll!NtUserPaintDesktop"; 775 table[4570] = "user32.dll!PeekMessageW"; 776 table[4571] = "user32.dll!NtUserPostMessage"; 777 table[4572] = "user32.dll!NtUserPostThreadMessage"; 778 table[4573] = "user32.dll!NtUserPrintWindow"; 779 table[4574] = "user32.dll!NtUserProcessConnect"; 780 table[4576] = "imm32.dll!NtUserQueryInputContext"; 781 table[4577] = "user32.dll!NtUserQuerySendMessage"; 782 table[4578] = "user32.dll!NtUserQueryUserCounters"; 783 table[4579] = "imm32.dll!NtUserQueryWindow"; 784 table[4579] = "user32.dll!NtUserQueryWindow"; 785 table[4580] = "user32.dll!NtUserRealChildWindowFromPoint"; 786 table[4581] = "user32.dll!NtUserRealInternalGetMessage"; 787 table[4582] = "user32.dll!NtUserRealWaitMessageEx"; 788 table[4583] = "user32.dll!NtUserRedrawWindow"; 789 table[4584] = "user32.dll!NtUserRegisterClassExWOW"; 790 table[4585] = "user32.dll!NtUserRegisterUserApiHook"; 791 table[4586] = "user32.dll!NtUserRegisterHotKey"; 792 table[4587] = "user32.dll!NtUserRegisterRawInputDevices"; 793 table[4588] = "user32.dll!NtUserRegisterTasklist"; 794 table[4589] = "user32.dll!NtUserRegisterWindowMessage"; 795 table[4590] = "user32.dll!NtUserRemoveMenu"; 796 table[4591] = "user32.dll!NtUserRemoveProp"; 797 table[4593] = "user32.dll!NtUserResolveDesktopForWOW"; 798 table[4594] = "user32.dll!NtUserSBGetParms"; 799 table[4595] = "user32.dll!ScrollDC"; 800 table[4596] = "user32.dll!NtUserScrollWindowEx"; 801 table[4597] = "gdi32.dll!NtUserSelectPalette"; 802 table[4598] = "user32.dll!NtUserSendInput"; 803 table[4599] = "user32.dll!NtUserSetActiveWindow"; 804 table[4600] = "imm32.dll!NtUserSetAppImeLevel"; 805 table[4601] = "user32.dll!NtUserSetCapture"; 806 table[4602] = "user32.dll!NtUserSetClassLong"; 807 table[4603] = "user32.dll!NtUserSetClassWord"; 808 table[4604] = "user32.dll!NtUserSetClipboardData"; 809 table[4605] = "user32.dll!NtUserSetClipboardViewer"; 810 table[4606] = "user32.dll!NtUserSetConsoleReserveKeys"; 811 table[4607] = "user32.dll!NtUserSetCursor"; 812 table[4608] = "user32.dll!NtUserSetCursorContents"; 813 table[4609] = "user32.dll!NtUserSetCursorIconData"; 814 table[4610] = "user32.dll!NtUserSetDbgTag"; 815 table[4611] = "user32.dll!NtUserSetFocus"; 816 table[4612] = "user32.dll!NtUserSetImeHotKey"; 817 table[4613] = "imm32.dll!NtUserSetImeInfoEx"; 818 table[4614] = "user32.dll!NtUserSetImeOwnerWindow"; 819 table[4616] = "user32.dll!NtUserSetInformationThread"; 820 table[4617] = "user32.dll!NtUserSetInternalWindowPos"; 821 table[4618] = "user32.dll!NtUserSetKeyboardState"; 822 table[4619] = "user32.dll!NtUserSetLogonNotifyWindow"; 823 table[4620] = "user32.dll!NtUserSetMenu"; 824 table[4621] = "user32.dll!NtUserSetMenuContextHelpId"; 825 table[4622] = "user32.dll!NtUserSetMenuDefaultItem"; 826 table[4623] = "user32.dll!NtUserSetMenuFlagRtoL"; 827 table[4624] = "user32.dll!NtUserSetObjectInformation"; 828 table[4625] = "user32.dll!NtUserSetParent"; 829 table[4626] = "user32.dll!NtUserSetProcessWindowStation"; 830 table[4627] = "user32.dll!NtUserSetProp"; 831 table[4628] = "user32.dll!NtUserSetRipFlags"; 832 table[4629] = "user32.dll!NtUserSetScrollInfo"; 833 table[4630] = "user32.dll!NtUserSetShellWindowEx"; 834 table[4631] = "user32.dll!NtUserSetSysColors"; 835 table[4632] = "user32.dll!NtUserSetSystemCursor"; 836 table[4633] = "user32.dll!NtUserSetSystemMenu"; 837 table[4634] = "user32.dll!NtUserSetSystemTimer"; 838 table[4635] = "user32.dll!NtUserSetThreadDesktop"; 839 table[4636] = "imm32.dll!NtUserSetThreadLayoutHandles"; 840 table[4637] = "user32.dll!NtUserSetThreadState"; 841 table[4638] = "user32.dll!NtUserSetTimer"; 842 table[4639] = "user32.dll!NtUserSetWindowFNID"; 843 table[4640] = "user32.dll!NtUserSetWindowLong"; 844 table[4641] = "user32.dll!NtUserSetWindowPlacement"; 845 table[4642] = "user32.dll!NtUserSetWindowPos"; 846 table[4643] = "user32.dll!NtUserSetWindowRgn"; 847 table[4644] = "user32.dll!NtUserSetWindowsHookAW"; 848 table[4645] = "user32.dll!NtUserSetWindowsHookEx"; 849 table[4646] = "user32.dll!NtUserSetWindowStationUser"; 850 table[4647] = "user32.dll!NtUserSetWindowWord"; 851 table[4648] = "user32.dll!NtUserSetWinEventHook"; 852 table[4649] = "user32.dll!NtUserShowCaret"; 853 table[4650] = "user32.dll!NtUserShowScrollBar"; 854 table[4651] = "user32.dll!NtUserShowWindow"; 855 table[4652] = "user32.dll!NtUserShowWindowAsync"; 856 table[4654] = "user32.dll!NtUserSwitchDesktop"; 857 table[4655] = "user32.dll!NtUserSystemParametersInfo"; 858 table[4657] = "user32.dll!NtUserThunkedMenuInfo"; 859 table[4658] = "user32.dll!NtUserThunkedMenuItemInfo"; 860 table[4659] = "user32.dll!NtUserToUnicodeEx"; 861 table[4660] = "user32.dll!NtUserTrackMouseEvent"; 862 table[4661] = "user32.dll!NtUserTrackPopupMenuEx"; 863 table[4662] = "user32.dll!NtUserCalcMenuBar"; 864 table[4663] = "user32.dll!NtUserPaintMenuBar"; 865 table[4664] = "user32.dll!TranslateAcceleratorA"; 866 table[4665] = "user32.dll!NtUserTranslateMessage"; 867 table[4666] = "user32.dll!NtUserUnhookWindowsHookEx"; 868 table[4667] = "user32.dll!NtUserUnhookWinEvent"; 869 table[4668] = "user32.dll!NtUserUnloadKeyboardLayout"; 870 table[4669] = "user32.dll!NtUserUnlockWindowStation"; 871 table[4670] = "user32.dll!NtUserUnregisterClass"; 872 table[4671] = "user32.dll!NtUserUnregisterUserApiHook"; 873 table[4672] = "user32.dll!NtUserUnregisterHotKey"; 874 table[4673] = "imm32.dll!NtUserUpdateInputContext"; 875 table[4673] = "user32.dll!NtUserUpdateInputContext"; 876 table[4674] = "user32.dll!NtUserUpdateInstance"; 877 table[4675] = "user32.dll!NtUserUpdateLayeredWindow"; 878 table[4676] = "user32.dll!NtUserGetLayeredWindowAttributes"; 879 table[4677] = "user32.dll!NtUserSetLayeredWindowAttributes"; 880 table[4678] = "user32.dll!NtUserUpdatePerUserSystemParameters"; 881 table[4679] = "user32.dll!NtUserUserHandleGrantAccess"; 882 table[4680] = "imm32.dll!NtUserValidateHandleSecure"; 883 table[4680] = "user32.dll!NtUserValidateHandleSecure"; 884 table[4681] = "user32.dll!NtUserValidateRect"; 885 table[4682] = "user32.dll!NtUserValidateTimerCallback"; 886 table[4683] = "user32.dll!NtUserVkKeyScanEx"; 887 table[4684] = "user32.dll!NtUserWaitForInputIdle"; 888 table[4685] = "user32.dll!NtUserWaitForMsgAndEvent"; 889 table[4686] = "user32.dll!NtUserWaitMessage"; 890 table[4687] = "user32.dll!NtUserWin32PoolAllocationStats"; 891 table[4688] = "user32.dll!NtUserWindowFromPoint"; 892 table[4689] = "user32.dll!NtUserYieldTask"; 893 table[4695] = "gdi32.dll!NtGdiEngAssociateSurface"; 894 table[4696] = "gdi32.dll!NtGdiEngCreateBitmap"; 895 table[4697] = "gdi32.dll!NtGdiEngCreateDeviceSurface"; 896 table[4698] = "gdi32.dll!NtGdiEngCreateDeviceBitmap"; 897 table[4699] = "gdi32.dll!NtGdiEngCreatePalette"; 898 table[4700] = "gdi32.dll!NtGdiEngComputeGlyphSet"; 899 table[4701] = "gdi32.dll!NtGdiEngCopyBits"; 900 table[4702] = "gdi32.dll!NtGdiEngDeletePalette"; 901 table[4703] = "gdi32.dll!NtGdiEngDeleteSurface"; 902 table[4704] = "gdi32.dll!NtGdiEngEraseSurface"; 903 table[4705] = "gdi32.dll!NtGdiEngUnlockSurface"; 904 table[4706] = "gdi32.dll!NtGdiEngLockSurface"; 905 table[4707] = "gdi32.dll!NtGdiEngBitBlt"; 906 table[4708] = "gdi32.dll!NtGdiEngStretchBlt"; 907 table[4709] = "gdi32.dll!NtGdiEngPlgBlt"; 908 table[4710] = "gdi32.dll!NtGdiEngMarkBandingSurface"; 909 table[4711] = "gdi32.dll!NtGdiEngStrokePath"; 910 table[4712] = "gdi32.dll!NtGdiEngFillPath"; 911 table[4713] = "gdi32.dll!NtGdiEngStrokeAndFillPath"; 912 table[4714] = "gdi32.dll!NtGdiEngPaint"; 913 table[4715] = "gdi32.dll!NtGdiEngLineTo"; 914 table[4716] = "gdi32.dll!NtGdiEngAlphaBlend"; 915 table[4717] = "gdi32.dll!NtGdiEngGradientFill"; 916 table[4718] = "gdi32.dll!NtGdiEngTransparentBlt"; 917 table[4719] = "gdi32.dll!NtGdiEngTextOut"; 918 table[4720] = "gdi32.dll!NtGdiEngStretchBltROP"; 919 table[4721] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette"; 920 table[4722] = "gdi32.dll!NtGdiXLATEOBJ_iXlate"; 921 table[4723] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform"; 922 table[4724] = "gdi32.dll!NtGdiCLIPOBJ_bEnum"; 923 table[4725] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart"; 924 table[4726] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath"; 925 table[4727] = "gdi32.dll!NtGdiEngDeletePath"; 926 table[4728] = "gdi32.dll!NtGdiEngCreateClip"; 927 table[4729] = "gdi32.dll!NtGdiEngDeleteClip"; 928 table[4730] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor"; 929 table[4731] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush"; 930 table[4732] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush"; 931 table[4733] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform"; 932 table[4734] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform"; 933 table[4735] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform"; 934 table[4736] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo"; 935 table[4737] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform"; 936 table[4738] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs"; 937 table[4739] = "gdi32.dll!NtGdiFONTOBJ_pifi"; 938 table[4740] = "gdi32.dll!NtGdiFONTOBJ_pfdg"; 939 table[4741] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs"; 940 table[4742] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile"; 941 table[4743] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles"; 942 table[4744] = "gdi32.dll!NtGdiSTROBJ_bEnum"; 943 table[4745] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly"; 944 table[4746] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths"; 945 table[4747] = "gdi32.dll!NtGdiSTROBJ_vEnumStart"; 946 table[4748] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage"; 947 table[4749] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds"; 948 table[4750] = "gdi32.dll!NtGdiPATHOBJ_bEnum"; 949 table[4751] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart"; 950 table[4752] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines"; 951 table[4753] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines"; 952 table[4754] = "gdi32.dll!NtGdiGetDhpdev"; 953 table[4755] = "gdi32.dll!NtGdiEngCheckAbort"; 954 table[4756] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette"; 955 table[4757] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette"; 956 table[4758] = "gdi32.dll!NtGdiUpdateTransform"; 957 table[4759] = "gdi32.dll!NtGdiSetPUMPDOBJ"; 958 table[4760] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush"; 959 table[4761] = "gdi32.dll!NtGdiUMPDEngFreeUserMem"; 960 table[4762] = "gdi32.dll!NtGdiDrawStream"; 961 } else { // Vista table. 962 table[4272] = "gdi32.dll!NtGdiGetDeviceCaps"; 963 table[4220] = "gdi32.dll!NtGdiDeleteObjectApp"; 964 table[4249] = "gdi32.dll!NtGdiFlush"; 965 table[4120] = "gdi32.dll!NtGdiConsoleTextOut"; 966 table[4825] = "gdi32.dll!NtGdiDdDDIEscape"; 967 table[4299] = "gdi32.dll!GetRgnBox"; 968 table[4828] = "gdi32.dll!NtGdiDdDDIGetPresentHistory"; 969 table[4835] = "gdi32.dll!NtGdiDdDDIGetDeviceState"; 970 table[4850] = "gdi32.dll!NtGdiDdDDICheckExclusiveOwnership"; 971 table[4849] = "gdi32.dll!NtGdiDdDDICheckMonitorPowerState"; 972 table[4833] = "gdi32.dll!NtGdiDdDDIWaitForVerticalBlankEvent"; 973 table[4298] = "gdi32.dll!GetRegionData"; 974 table[4796] = "gdi32.dll!NtGdiDwmGetDirtyRgn"; 975 table[4820] = "gdi32.dll!NtGdiDdDDIRender"; 976 table[4819] = "gdi32.dll!NtGdiDdDDIPresent"; 977 table[4815] = "gdi32.dll!NtGdiDdDDIUnlock"; 978 table[4814] = "gdi32.dll!NtGdiDdDDILock"; 979 table[4240] = "gdi32.dll!NtGdiExtCreateRegion"; 980 table[4339] = "gdi32.dll!NtGdiPolyPatBlt"; 981 table[4361] = "gdi32.dll!NtGdiSelectBitmap"; 982 table[4127] = "gdi32.dll!NtGdiCreateCompatibleDC"; 983 table[4142] = "gdi32.dll!NtGdiCreateSolidBrush"; 984 table[4122] = "gdi32.dll!CreateBitmap"; 985 table[4303] = "gdi32.dll!CreateBitmap"; 986 table[4348] = "gdi32.dll!NtGdiQueryFontAssocInfo"; 987 table[4126] = "gdi32.dll!NtGdiCreateCompatibleBitmap"; 988 table[4109] = "gdi32.dll!NtGdiBitBlt"; 989 table[4243] = "gdi32.dll!NtGdiExtGetObjectW"; 990 table[4270] = "gdi32.dll!NtGdiGetDCObject"; 991 table[4620] = "gdi32.dll!NtUserSelectPalette"; 992 table[4338] = "gdi32.dll!NtGdiPatBlt"; 993 table[4275] = "gdi32.dll!NtGdiGetDIBitsInternal"; 994 table[4398] = "gdi32.dll!NtGdiStretchDIBitsInternal"; 995 table[4130] = "gdi32.dll!NtGdiCreateDIBSection"; 996 table[4356] = "gdi32.dll!NtGdiRestoreDC"; 997 table[4358] = "gdi32.dll!NtGdiSaveDC"; 998 table[4103] = "gdi32.dll!NtGdiAlphaBlend"; 999 table[4349] = "gdi32.dll!NtGdiRectangle"; 1000 table[4295] = "gdi32.dll!NtGdiGetRandomRgn"; 1001 table[4244] = "gdi32.dll!NtGdiExtSelectClipRgn"; 1002 table[4268] = "gdi32.dll!NtGdiGetDCDword"; 1003 table[4245] = "gdi32.dll!NtGdiExtTextOutW"; 1004 table[4254] = "gdi32.dll!GetClipBox"; 1005 table[4397] = "gdi32.dll!NtGdiStretchBlt"; 1006 table[4331] = "gdi32.dll!NtGdiMaskBlt"; 1007 table[4324] = "gdi32.dll!NtGdiInit"; 1008 table[4262] = "gdi32.dll!NtGdiGetCharSet"; 1009 table[4336] = "gdi32.dll!NtGdiOffsetRgn"; 1010 table[4326] = "gdi32.dll!NtGdiIntersectClipRect"; 1011 table[4795] = "gdi32.dll!NtGdiDrawStream"; 1012 table[4364] = "gdi32.dll!NtGdiSelectFont"; 1013 table[4116] = "gdi32.dll!NtGdiCombineRgn"; 1014 table[4238] = "gdi32.dll!NtGdiExcludeClipRect"; 1015 table[4802] = "gdi32.dll!NtGdiDdDDISetAllocationPriority"; 1016 table[4798] = "gdi32.dll!NtGdiDdDDICreateAllocation"; 1017 table[4801] = "gdi32.dll!NtGdiDdDDIDestroyAllocation"; 1018 table[4797] = "gdi32.dll!NtGdiDwmGetSurfaceData"; 1019 table[4140] = "gdi32.dll!CreateRoundRectRgn"; 1020 table[4840] = "gdi32.dll!NtGdiDdDDISetProcessSchedulingPriorityClass"; 1021 table[4307] = "gdi32.dll!NtGdiGetTextCharsetInfo"; 1022 table[4351] = "gdi32.dll!RectVisible"; 1023 table[4139] = "gdi32.dll!NtGdiCreateRectRgn"; 1024 table[4369] = "gdi32.dll!NtGdiSetBoundsRect"; 1025 table[4257] = "gdi32.dll!NtGdiGetBoundsRect"; 1026 table[4309] = "gdi32.dll!NtGdiGetTextExtentExW"; 1027 table[4402] = "gdi32.dll!NtGdiTransformPoints"; 1028 table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients"; 1029 table[4337] = "gdi32.dll!NtGdiOpenDCW"; 1030 table[4813] = "gdi32.dll!NtGdiDdDDIQueryAdapterInfo"; 1031 table[4822] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromHdc"; 1032 table[4816] = "gdi32.dll!NtGdiDdDDIGetDisplayModeList"; 1033 table[4823] = "gdi32.dll!NtGdiDdDDICloseAdapter"; 1034 table[4804] = "gdi32.dll!NtGdiDdDDICreateDevice"; 1035 table[4806] = "gdi32.dll!NtGdiDdDDICreateContext"; 1036 table[4271] = "gdi32.dll!NtGdiGetDCPoint"; 1037 table[4225] = "gdi32.dll!NtGdiDoPalette"; 1038 table[4288] = "gdi32.dll!GetNearestColor"; 1039 table[4129] = "gdi32.dll!NtGdiCreateDIBitmapInternal"; 1040 table[4322] = "gdi32.dll!NtGdiHfontCreate"; 1041 table[4137] = "gdi32.dll!NtGdiCreatePatternBrushInternal"; 1042 table[4136] = "gdi32.dll!NtGdiCreatePaletteInternal"; 1043 table[4132] = "gdi32.dll!NtGdiCreateHalftonePalette"; 1044 table[4375] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal"; 1045 table[4269] = "gdi32.dll!NtGdiGetDCforBitmap"; 1046 table[4392] = "gdi32.dll!NtGdiSetupPublicCFONT"; 1047 table[4836] = "gdi32.dll!NtGdiDdDDICreateDCFromMemory"; 1048 table[4264] = "gdi32.dll!NtGdiGetCharWidthInfo"; 1049 table[4367] = "gdi32.dll!SetBitmapBits"; 1050 table[4255] = "gdi32.dll!GetBitmapBits"; 1051 table[4311] = "gdi32.dll!NtGdiGetTextMetricsW"; 1052 table[4297] = "gdi32.dll!NtGdiGetRealizationInfo"; 1053 table[4310] = "gdi32.dll!NtGdiGetTextFaceW"; 1054 table[4292] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW"; 1055 table[4280] = "gdi32.dll!NtGdiGetGlyphIndicesW"; 1056 table[4320] = "gdi32.dll!NtGdiGetWidthTable"; 1057 table[4234] = "gdi32.dll!NtGdiEnumFontOpen"; 1058 table[4233] = "gdi32.dll!NtGdiEnumFontClose"; 1059 table[4232] = "gdi32.dll!NtGdiEnumFontChunk"; 1060 table[4260] = "gdi32.dll!NtGdiGetCharABCWidthsW"; 1061 table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts"; 1062 table[4278] = "gdi32.dll!NtGdiGetFontData"; 1063 table[4106] = "gdi32.dll!NtGdiFontIsLinked"; 1064 table[4332] = "gdi32.dll!NtGdiModifyWorldTransform"; 1065 table[4312] = "gdi32.dll!NtGdiGetTransform"; 1066 table[4321] = "gdi32.dll!NtGdiGradientFill"; 1067 table[4294] = "gdi32.dll!NtGdiGetPixel"; 1068 table[4403] = "gdi32.dll!NtGdiTransparentBlt"; 1069 table[4319] = "gdi32.dll!NtGdiGetFontUnicodeRanges"; 1070 table[4817] = "gdi32.dll!NtGdiDdDDISetDisplayMode"; 1071 table[4827] = "gdi32.dll!NtGdiDdDDISetVidPnSourceOwner"; 1072 table[4273] = "gdi32.dll!NtGdiGetDeviceGammaRamp"; 1073 table[4374] = "gdi32.dll!NtGdiSetDeviceGammaRamp"; 1074 table[4366] = "gdi32.dll!NtGdiSetBitmapAttributes"; 1075 table[4098] = "gdi32.dll!NtGdiAddFontResourceW"; 1076 table[4376] = "gdi32.dll!NtGdiSetFontEnumeration"; 1077 table[4228] = "gdi32.dll!NtGdiEnableEudc"; 1078 table[4343] = "gdi32.dll!NtGdiPolyPolyDraw"; 1079 table[4328] = "gdi32.dll!NtGdiLineTo"; 1080 table[4138] = "gdi32.dll!NtGdiCreatePen"; 1081 table[4236] = "gdi32.dll!EqualRgn"; 1082 table[4805] = "gdi32.dll!NtGdiDdDDIDestroyDevice"; 1083 table[4807] = "gdi32.dll!NtGdiDdDDIDestroyContext"; 1084 table[4799] = "gdi32.dll!NtGdiDdDDIQueryResourceInfo"; 1085 table[4800] = "gdi32.dll!NtGdiDdDDIOpenResource"; 1086 table[4838] = "gdi32.dll!NtGdiDdDDISetContextSchedulingPriority"; 1087 table[4263] = "gdi32.dll!NtGdiGetCharWidthW"; 1088 table[4837] = "gdi32.dll!NtGdiDdDDIDestroyDCFromMemory"; 1089 table[4803] = "gdi32.dll!NtGdiDdDDIQueryAllocationResidency"; 1090 table[4824] = "gdi32.dll!NtGdiDdDDIGetSharedPrimaryHandle"; 1091 table[4385] = "gdi32.dll!NtGdiSetLayout"; 1092 table[4371] = "gdi32.dll!NtGdiSetBrushOrg"; 1093 table[4157] = "gdi32.dll!NtGdiDdCreateDirectDrawObject"; 1094 table[4128] = "gdi32.dll!NtGdiCreateDIBBrush"; 1095 table[4387] = "gdi32.dll!NtGdiSetPixel"; 1096 table[4345] = "gdi32.dll!PtInRegion"; 1097 table[4821] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromDeviceName"; 1098 table[4253] = "gdi32.dll!NtGdiGetAndSetDCDword"; 1099 table[4274] = "gdi32.dll!NtGdiGetDeviceCapsAll"; 1100 table[4247] = "gdi32.dll!NtGdiFillRgn"; 1101 table[4289] = "gdi32.dll!GetNearestPaletteIndex"; 1102 table[4378] = "gdi32.dll!NtGdiSetIcmMode"; 1103 table[4327] = "gdi32.dll!NtGdiInvertRgn"; 1104 table[4792] = "gdi32.dll!NtGdiSetPUMPDOBJ"; 1105 table[4735] = "gdi32.dll!NtGdiEngDeletePalette"; 1106 table[4732] = "gdi32.dll!NtGdiEngCreatePalette"; 1107 table[4241] = "gdi32.dll!NtGdiExtEscape"; 1108 table[4217] = "gdi32.dll!NtGdiDeleteClientObj"; 1109 table[4123] = "gdi32.dll!NtGdiCreateClientObj"; 1110 table[4354] = "gdi32.dll!NtGdiResetDC"; 1111 table[4235] = "gdi32.dll!NtGdiEnumObjects"; 1112 table[4135] = "gdi32.dll!NtGdiCreateOPMProtectedOutputs"; 1113 table[4222] = "gdi32.dll!NtGdiDestroyOPMProtectedOutput"; 1114 table[4258] = "gdi32.dll!NtGdiGetCertificate"; 1115 table[4259] = "gdi32.dll!NtGdiGetCertificateSize"; 1116 table[4291] = "gdi32.dll!NtGdiGetOPMRandomNumber"; 1117 table[4305] = "gdi32.dll!NtGdiGetSuggestedOPMProtectedOutputArraySize"; 1118 table[4386] = "gdi32.dll!NtGdiSetOPMSigningKeyAndSequenceNumbers"; 1119 table[4844] = "gdi32.dll!NtGdiDdDDISetQueuedLimit"; 1120 table[4341] = "gdi32.dll!NtGdiPlgBlt"; 1121 table[4117] = "gdi32.dll!CombineTransform"; 1122 table[4134] = "gdi32.dll!NtGdiCreateMetafileDC"; 1123 table[4393] = "gdi32.dll!NtGdiSetVirtualResolution"; 1124 table[4394] = "gdi32.dll!NtGdiSetSizeDevice"; 1125 table[4381] = "gdi32.dll!NtGdiSetMetaRgn"; 1126 table[4382] = "gdi32.dll!NtGdiSetMiterLimit"; 1127 table[4377] = "gdi32.dll!NtGdiSetFontXform"; 1128 table[4333] = "gdi32.dll!NtGdiMonoBitmap"; 1129 table[4768] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform"; 1130 table[4770] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform"; 1131 table[4239] = "gdi32.dll!NtGdiExtCreatePen"; 1132 table[4286] = "gdi32.dll!GetMiterLimit"; 1133 table[4290] = "gdi32.dll!NtGdiGetObjectBitmapHandle"; 1134 table[4287] = "gdi32.dll!NtGdiGetMonitorID"; 1135 table[4284] = "gdi32.dll!NtGdiGetKerningPairs"; 1136 table[4357] = "gdi32.dll!NtGdiRoundRect"; 1137 table[4242] = "gdi32.dll!NtGdiExtFloodFill"; 1138 table[4306] = "gdi32.dll!GetSystemPaletteUse"; 1139 table[4096] = "gdi32.dll!NtGdiAbortDoc"; 1140 table[4097] = "gdi32.dll!NtGdiAbortPath"; 1141 table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC"; 1142 table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx"; 1143 table[4101] = "gdi32.dll!NtGdiRemoveMergeFont"; 1144 table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC"; 1145 table[4104] = "gdi32.dll!NtGdiAngleArc"; 1146 table[4107] = "gdi32.dll!NtGdiArcInternal"; 1147 table[4108] = "gdi32.dll!NtGdiBeginPath"; 1148 table[4110] = "gdi32.dll!NtGdiCancelDC"; 1149 table[4111] = "gdi32.dll!NtGdiCheckBitmapBits"; 1150 table[4112] = "gdi32.dll!NtGdiCloseFigure"; 1151 table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes"; 1152 table[4114] = "gdi32.dll!NtGdiClearBrushAttributes"; 1153 table[4115] = "gdi32.dll!NtGdiColorCorrectPalette"; 1154 table[4119] = "gdi32.dll!NtGdiConfigureOPMProtectedOutput"; 1155 table[4121] = "gdi32.dll!NtGdiConvertMetafileRect"; 1156 table[4124] = "gdi32.dll!NtGdiCreateColorSpace"; 1157 table[4125] = "gdi32.dll!NtGdiCreateColorTransform"; 1158 table[4131] = "gdi32.dll!NtGdiCreateEllipticRgn"; 1159 table[4133] = "gdi32.dll!NtGdiCreateHatchBrushInternal"; 1160 table[4141] = "gdi32.dll!NtGdiCreateServerMetaFile"; 1161 table[4143] = "gdi32.dll!NtGdiD3dContextCreate"; 1162 table[4144] = "gdi32.dll!NtGdiD3dContextDestroy"; 1163 table[4145] = "gdi32.dll!NtGdiD3dContextDestroyAll"; 1164 table[4146] = "gdi32.dll!NtGdiD3dValidateTextureStageState"; 1165 table[4147] = "gdi32.dll!NtGdiD3dDrawPrimitives2"; 1166 table[4148] = "gdi32.dll!NtGdiDdGetDriverState"; 1167 table[4149] = "gdi32.dll!NtGdiDdAddAttachedSurface"; 1168 table[4150] = "gdi32.dll!NtGdiDdAlphaBlt"; 1169 table[4151] = "gdi32.dll!NtGdiDdAttachSurface"; 1170 table[4152] = "gdi32.dll!NtGdiDdBeginMoCompFrame"; 1171 table[4153] = "gdi32.dll!NtGdiDdBlt"; 1172 table[4154] = "gdi32.dll!NtGdiDdCanCreateSurface"; 1173 table[4155] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer"; 1174 table[4156] = "gdi32.dll!NtGdiDdColorControl"; 1175 table[4158] = "gdi32.dll!NtGdiDdCreateSurface"; 1176 table[4159] = "gdi32.dll!NtGdiDdCreateD3DBuffer"; 1177 table[4160] = "gdi32.dll!NtGdiDdCreateMoComp"; 1178 table[4161] = "gdi32.dll!NtGdiDdCreateSurfaceObject"; 1179 table[4162] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject"; 1180 table[4163] = "gdi32.dll!NtGdiDdDeleteSurfaceObject"; 1181 table[4164] = "gdi32.dll!NtGdiDdDestroyMoComp"; 1182 table[4165] = "gdi32.dll!NtGdiDdDestroySurface"; 1183 table[4166] = "gdi32.dll!NtGdiDdDestroyD3DBuffer"; 1184 table[4167] = "gdi32.dll!NtGdiDdEndMoCompFrame"; 1185 table[4168] = "gdi32.dll!NtGdiDdFlip"; 1186 table[4169] = "gdi32.dll!NtGdiDdFlipToGDISurface"; 1187 table[4170] = "gdi32.dll!NtGdiDdGetAvailDriverMemory"; 1188 table[4171] = "gdi32.dll!NtGdiDdGetBltStatus"; 1189 table[4172] = "gdi32.dll!NtGdiDdGetDC"; 1190 table[4173] = "gdi32.dll!NtGdiDdGetDriverInfo"; 1191 table[4174] = "gdi32.dll!NtGdiDdGetDxHandle"; 1192 table[4175] = "gdi32.dll!NtGdiDdGetFlipStatus"; 1193 table[4176] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo"; 1194 table[4177] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo"; 1195 table[4178] = "gdi32.dll!NtGdiDdGetMoCompGuids"; 1196 table[4179] = "gdi32.dll!NtGdiDdGetMoCompFormats"; 1197 table[4180] = "gdi32.dll!NtGdiDdGetScanLine"; 1198 table[4181] = "gdi32.dll!NtGdiDdLock"; 1199 table[4182] = "gdi32.dll!NtGdiDdLockD3D"; 1200 table[4183] = "gdi32.dll!NtGdiDdQueryDirectDrawObject"; 1201 table[4184] = "gdi32.dll!NtGdiDdQueryMoCompStatus"; 1202 table[4185] = "gdi32.dll!NtGdiDdReenableDirectDrawObject"; 1203 table[4186] = "gdi32.dll!NtGdiDdReleaseDC"; 1204 table[4187] = "gdi32.dll!NtGdiDdRenderMoComp"; 1205 table[4188] = "gdi32.dll!NtGdiDdResetVisrgn"; 1206 table[4189] = "gdi32.dll!NtGdiDdSetColorKey"; 1207 table[4190] = "gdi32.dll!NtGdiDdSetExclusiveMode"; 1208 table[4191] = "gdi32.dll!NtGdiDdSetGammaRamp"; 1209 table[4192] = "gdi32.dll!NtGdiDdCreateSurfaceEx"; 1210 table[4193] = "gdi32.dll!NtGdiDdSetOverlayPosition"; 1211 table[4194] = "gdi32.dll!NtGdiDdUnattachSurface"; 1212 table[4195] = "gdi32.dll!NtGdiDdUnlock"; 1213 table[4196] = "gdi32.dll!NtGdiDdUnlockD3D"; 1214 table[4197] = "gdi32.dll!NtGdiDdUpdateOverlay"; 1215 table[4198] = "gdi32.dll!NtGdiDdWaitForVerticalBlank"; 1216 table[4199] = "gdi32.dll!NtGdiDvpCanCreateVideoPort"; 1217 table[4200] = "gdi32.dll!NtGdiDvpColorControl"; 1218 table[4201] = "gdi32.dll!NtGdiDvpCreateVideoPort"; 1219 table[4202] = "gdi32.dll!NtGdiDvpDestroyVideoPort"; 1220 table[4203] = "gdi32.dll!NtGdiDvpFlipVideoPort"; 1221 table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth"; 1222 table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortField"; 1223 table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus"; 1224 table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats"; 1225 table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortLine"; 1226 table[4209] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats"; 1227 table[4210] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo"; 1228 table[4211] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus"; 1229 table[4212] = "gdi32.dll!NtGdiDvpUpdateVideoPort"; 1230 table[4213] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync"; 1231 table[4214] = "gdi32.dll!NtGdiDvpAcquireNotification"; 1232 table[4215] = "gdi32.dll!NtGdiDvpReleaseNotification"; 1233 table[4216] = "gdi32.dll!NtGdiDxgGenericThunk"; 1234 table[4218] = "gdi32.dll!NtGdiDeleteColorSpace"; 1235 table[4219] = "gdi32.dll!NtGdiDeleteColorTransform"; 1236 table[4221] = "gdi32.dll!NtGdiDescribePixelFormat"; 1237 table[4223] = "gdi32.dll!NtGdiGetPerBandInfo"; 1238 table[4224] = "gdi32.dll!NtGdiDoBanding"; 1239 table[4226] = "gdi32.dll!NtGdiDrawEscape"; 1240 table[4227] = "gdi32.dll!NtGdiEllipse"; 1241 table[4229] = "gdi32.dll!NtGdiEndDoc"; 1242 table[4230] = "gdi32.dll!NtGdiEndPage"; 1243 table[4231] = "gdi32.dll!NtGdiEndPath"; 1244 table[4237] = "gdi32.dll!NtGdiEudcLoadUnloadLink"; 1245 table[4246] = "gdi32.dll!NtGdiFillPath"; 1246 table[4248] = "gdi32.dll!NtGdiFlattenPath"; 1247 table[4250] = "gdi32.dll!NtGdiForceUFIMapping"; 1248 table[4251] = "gdi32.dll!NtGdiFrameRgn"; 1249 table[4252] = "gdi32.dll!NtGdiFullscreenControl"; 1250 table[4256] = "gdi32.dll!NtGdiGetBitmapDimension"; 1251 table[4261] = "gdi32.dll!NtGdiGetCharacterPlacementW"; 1252 table[4265] = "gdi32.dll!NtGdiGetColorAdjustment"; 1253 table[4267] = "gdi32.dll!NtGdiGetCOPPCompatibleOPMInformation"; 1254 table[4276] = "gdi32.dll!NtGdiGetETM"; 1255 table[4277] = "gdi32.dll!NtGdiGetEudcTimeStampEx"; 1256 table[4279] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW"; 1257 table[4281] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal"; 1258 table[4282] = "gdi32.dll!NtGdiGetGlyphOutline"; 1259 table[4283] = "gdi32.dll!NtGdiGetOPMInformation"; 1260 table[4285] = "gdi32.dll!NtGdiGetLinkedUFIs"; 1261 table[4293] = "gdi32.dll!NtGdiGetPath"; 1262 table[4296] = "gdi32.dll!NtGdiGetRasterizerCaps"; 1263 table[4300] = "gdi32.dll!NtGdiGetServerMetaFileBits"; 1264 table[4301] = "gdi32.dll!NtGdiGetSpoolMessage"; 1265 table[4304] = "gdi32.dll!NtGdiGetStringBitmapW"; 1266 table[4308] = "gdi32.dll!NtGdiGetTextExtent"; 1267 table[4313] = "gdi32.dll!NtGdiGetUFI"; 1268 table[4314] = "gdi32.dll!NtGdiGetEmbUFI"; 1269 table[4315] = "gdi32.dll!NtGdiGetUFIPathname"; 1270 table[4316] = "gdi32.dll!NtGdiGetEmbedFonts"; 1271 table[4317] = "gdi32.dll!NtGdiChangeGhostFont"; 1272 table[4318] = "gdi32.dll!NtGdiAddEmbFontToDC"; 1273 table[4323] = "gdi32.dll!NtGdiIcmBrushInfo"; 1274 table[4325] = "gdi32.dll!NtGdiInitSpool"; 1275 table[4329] = "gdi32.dll!NtGdiMakeFontDir"; 1276 table[4330] = "gdi32.dll!NtGdiMakeInfoDC"; 1277 table[4335] = "gdi32.dll!NtGdiOffsetClipRgn"; 1278 table[4340] = "gdi32.dll!NtGdiPathToRegion"; 1279 table[4342] = "gdi32.dll!NtGdiPolyDraw"; 1280 table[4344] = "gdi32.dll!NtGdiPolyTextOutW"; 1281 table[4346] = "gdi32.dll!NtGdiPtVisible"; 1282 table[4347] = "gdi32.dll!NtGdiQueryFonts"; 1283 table[4350] = "gdi32.dll!NtGdiRectInRegion"; 1284 table[4352] = "gdi32.dll!NtGdiRemoveFontResourceW"; 1285 table[4353] = "gdi32.dll!NtGdiRemoveFontMemResourceEx"; 1286 table[4355] = "gdi32.dll!NtGdiResizePalette"; 1287 table[4359] = "gdi32.dll!NtGdiScaleViewportExtEx"; 1288 table[4360] = "gdi32.dll!NtGdiScaleWindowExtEx"; 1289 table[4363] = "gdi32.dll!NtGdiSelectClipPath"; 1290 table[4365] = "gdi32.dll!NtGdiSelectPen"; 1291 table[4368] = "gdi32.dll!NtGdiSetBitmapDimension"; 1292 table[4370] = "gdi32.dll!NtGdiSetBrushAttributes"; 1293 table[4372] = "gdi32.dll!NtGdiSetColorAdjustment"; 1294 table[4373] = "gdi32.dll!NtGdiSetColorSpace"; 1295 table[4379] = "gdi32.dll!NtGdiSetLinkedUFIs"; 1296 table[4380] = "gdi32.dll!NtGdiSetMagicColors"; 1297 table[4383] = "gdi32.dll!NtGdiGetDeviceWidth"; 1298 table[4384] = "gdi32.dll!NtGdiMirrorWindowOrg"; 1299 table[4388] = "gdi32.dll!NtGdiSetPixelFormat"; 1300 table[4389] = "gdi32.dll!NtGdiSetRectRgn"; 1301 table[4390] = "gdi32.dll!NtGdiSetSystemPaletteUse"; 1302 table[4395] = "gdi32.dll!NtGdiStartDoc"; 1303 table[4396] = "gdi32.dll!NtGdiStartPage"; 1304 table[4399] = "gdi32.dll!NtGdiStrokeAndFillPath"; 1305 table[4400] = "gdi32.dll!NtGdiStrokePath"; 1306 table[4401] = "gdi32.dll!NtGdiSwapBuffers"; 1307 table[4404] = "gdi32.dll!NtGdiUnloadPrinterDriver"; 1308 table[4406] = "gdi32.dll!NtGdiUnrealizeObject"; 1309 table[4407] = "gdi32.dll!NtGdiUpdateColors"; 1310 table[4408] = "gdi32.dll!NtGdiWidenPath"; 1311 table[4728] = "gdi32.dll!NtGdiEngAssociateSurface"; 1312 table[4729] = "gdi32.dll!NtGdiEngCreateBitmap"; 1313 table[4730] = "gdi32.dll!NtGdiEngCreateDeviceSurface"; 1314 table[4731] = "gdi32.dll!NtGdiEngCreateDeviceBitmap"; 1315 table[4733] = "gdi32.dll!NtGdiEngComputeGlyphSet"; 1316 table[4734] = "gdi32.dll!NtGdiEngCopyBits"; 1317 table[4736] = "gdi32.dll!NtGdiEngDeleteSurface"; 1318 table[4737] = "gdi32.dll!NtGdiEngEraseSurface"; 1319 table[4738] = "gdi32.dll!NtGdiEngUnlockSurface"; 1320 table[4739] = "gdi32.dll!NtGdiEngLockSurface"; 1321 table[4740] = "gdi32.dll!NtGdiEngBitBlt"; 1322 table[4741] = "gdi32.dll!NtGdiEngStretchBlt"; 1323 table[4742] = "gdi32.dll!NtGdiEngPlgBlt"; 1324 table[4743] = "gdi32.dll!NtGdiEngMarkBandingSurface"; 1325 table[4744] = "gdi32.dll!NtGdiEngStrokePath"; 1326 table[4745] = "gdi32.dll!NtGdiEngFillPath"; 1327 table[4746] = "gdi32.dll!NtGdiEngStrokeAndFillPath"; 1328 table[4747] = "gdi32.dll!NtGdiEngPaint"; 1329 table[4748] = "gdi32.dll!NtGdiEngLineTo"; 1330 table[4749] = "gdi32.dll!NtGdiEngAlphaBlend"; 1331 table[4750] = "gdi32.dll!NtGdiEngGradientFill"; 1332 table[4751] = "gdi32.dll!NtGdiEngTransparentBlt"; 1333 table[4752] = "gdi32.dll!NtGdiEngTextOut"; 1334 table[4753] = "gdi32.dll!NtGdiEngStretchBltROP"; 1335 table[4754] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette"; 1336 table[4755] = "gdi32.dll!NtGdiXLATEOBJ_iXlate"; 1337 table[4756] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform"; 1338 table[4757] = "gdi32.dll!NtGdiCLIPOBJ_bEnum"; 1339 table[4758] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart"; 1340 table[4759] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath"; 1341 table[4760] = "gdi32.dll!NtGdiEngDeletePath"; 1342 table[4761] = "gdi32.dll!NtGdiEngCreateClip"; 1343 table[4762] = "gdi32.dll!NtGdiEngDeleteClip"; 1344 table[4763] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor"; 1345 table[4764] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush"; 1346 table[4765] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush"; 1347 table[4766] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform"; 1348 table[4767] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform"; 1349 table[4769] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo"; 1350 table[4771] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs"; 1351 table[4772] = "gdi32.dll!NtGdiFONTOBJ_pifi"; 1352 table[4773] = "gdi32.dll!NtGdiFONTOBJ_pfdg"; 1353 table[4774] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs"; 1354 table[4775] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile"; 1355 table[4776] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles"; 1356 table[4777] = "gdi32.dll!NtGdiSTROBJ_bEnum"; 1357 table[4778] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly"; 1358 table[4779] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths"; 1359 table[4780] = "gdi32.dll!NtGdiSTROBJ_vEnumStart"; 1360 table[4781] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage"; 1361 table[4782] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds"; 1362 table[4783] = "gdi32.dll!NtGdiPATHOBJ_bEnum"; 1363 table[4784] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart"; 1364 table[4785] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines"; 1365 table[4786] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines"; 1366 table[4787] = "gdi32.dll!NtGdiGetDhpdev"; 1367 table[4788] = "gdi32.dll!NtGdiEngCheckAbort"; 1368 table[4789] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette"; 1369 table[4790] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette"; 1370 table[4791] = "gdi32.dll!NtGdiUpdateTransform"; 1371 table[4793] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush"; 1372 table[4794] = "gdi32.dll!NtGdiUMPDEngFreeUserMem"; 1373 table[4808] = "gdi32.dll!NtGdiDdDDICreateSynchronizationObject"; 1374 table[4809] = "gdi32.dll!NtGdiDdDDIDestroySynchronizationObject"; 1375 table[4810] = "gdi32.dll!NtGdiDdDDIWaitForSynchronizationObject"; 1376 table[4811] = "gdi32.dll!NtGdiDdDDISignalSynchronizationObject"; 1377 table[4812] = "gdi32.dll!NtGdiDdDDIGetRuntimeData"; 1378 table[4818] = "gdi32.dll!NtGdiDdDDIGetMultisampleMethodList"; 1379 table[4826] = "gdi32.dll!NtGdiDdDDIQueryStatistics"; 1380 table[4829] = "gdi32.dll!NtGdiDdDDICreateOverlay"; 1381 table[4830] = "gdi32.dll!NtGdiDdDDIUpdateOverlay"; 1382 table[4831] = "gdi32.dll!NtGdiDdDDIFlipOverlay"; 1383 table[4832] = "gdi32.dll!NtGdiDdDDIDestroyOverlay"; 1384 table[4834] = "gdi32.dll!NtGdiDdDDISetGammaRamp"; 1385 table[4839] = "gdi32.dll!NtGdiDdDDIGetContextSchedulingPriority"; 1386 table[4841] = "gdi32.dll!NtGdiDdDDIGetProcessSchedulingPriorityClass"; 1387 table[4842] = "gdi32.dll!NtGdiDdDDIReleaseProcessVidPnSourceOwners"; 1388 table[4843] = "gdi32.dll!NtGdiDdDDIGetScanLine"; 1389 table[4845] = "gdi32.dll!NtGdiDdDDIPollDisplayChildren"; 1390 table[4846] = "gdi32.dll!NtGdiDdDDIInvalidateActiveVidPn"; 1391 table[4847] = "gdi32.dll!NtGdiDdDDICheckOcclusion"; 1392 table[4848] = "gdi32.dll!NtGdiDdDDIWaitForIdle"; 1393 table[4851] = "gdi32.dll!NtGdiDdDDISetDisplayPrivateDriverFormat"; 1394 table[4852] = "gdi32.dll!NtGdiDdDDISharedPrimaryLockNotification"; 1395 table[4853] = "gdi32.dll!NtGdiDdDDISharedPrimaryUnLockNotification"; 1396 table[4856] = "gdi32.dll!NtGdiGetNumberOfPhysicalMonitors"; 1397 table[4857] = "gdi32.dll!NtGdiGetPhysicalMonitors"; 1398 table[4858] = "gdi32.dll!NtGdiGetPhysicalMonitorDescription"; 1399 table[4859] = "gdi32.dll!NtGdiDestroyPhysicalMonitor"; 1400 table[4860] = "gdi32.dll!NtGdiDDCCIGetVCPFeature"; 1401 table[4861] = "gdi32.dll!NtGdiDDCCISetVCPFeature"; 1402 table[4862] = "gdi32.dll!NtGdiDDCCISaveCurrentSettings"; 1403 table[4863] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesStringLength"; 1404 table[4864] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesString"; 1405 table[4865] = "gdi32.dll!NtGdiDDCCIGetTimingReport"; 1406 table[0] = "ntdll.dll!NtAcceptConnectPort"; 1407 table[1] = "ntdll.dll!NtAccessCheck"; 1408 table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm"; 1409 table[3] = "ntdll.dll!NtAccessCheckByType"; 1410 table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm"; 1411 table[5] = "ntdll.dll!NtAccessCheckByTypeResultList"; 1412 table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm"; 1413 table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle"; 1414 table[8] = "ntdll.dll!NtAddAtom"; 1415 table[9] = "ntdll.dll!ZwAddBootEntry"; 1416 table[10] = "ntdll.dll!NtAddDriverEntry"; 1417 table[11] = "ntdll.dll!ZwAdjustGroupsToken"; 1418 table[12] = "ntdll.dll!ZwAdjustPrivilegesToken"; 1419 table[13] = "ntdll.dll!NtAlertResumeThread"; 1420 table[14] = "ntdll.dll!NtAlertThread"; 1421 table[15] = "ntdll.dll!ZwAllocateLocallyUniqueId"; 1422 table[16] = "ntdll.dll!NtAllocateUserPhysicalPages"; 1423 table[17] = "ntdll.dll!NtAllocateUuids"; 1424 table[18] = "ntdll.dll!NtAllocateVirtualMemory"; 1425 table[19] = "ntdll.dll!NtAlpcAcceptConnectPort"; 1426 table[20] = "ntdll.dll!ZwAlpcCancelMessage"; 1427 table[21] = "ntdll.dll!ZwAlpcConnectPort"; 1428 table[22] = "ntdll.dll!ZwAlpcCreatePort"; 1429 table[23] = "ntdll.dll!NtAlpcCreatePortSection"; 1430 table[24] = "ntdll.dll!ZwAlpcCreateResourceReserve"; 1431 table[25] = "ntdll.dll!ZwAlpcCreateSectionView"; 1432 table[26] = "ntdll.dll!ZwAlpcCreateSecurityContext"; 1433 table[27] = "ntdll.dll!ZwAlpcDeletePortSection"; 1434 table[28] = "ntdll.dll!NtAlpcDeleteResourceReserve"; 1435 table[29] = "ntdll.dll!NtAlpcDeleteSectionView"; 1436 table[30] = "ntdll.dll!NtAlpcDeleteSecurityContext"; 1437 table[31] = "ntdll.dll!NtAlpcDisconnectPort"; 1438 table[32] = "ntdll.dll!ZwAlpcImpersonateClientOfPort"; 1439 table[33] = "ntdll.dll!ZwAlpcOpenSenderProcess"; 1440 table[34] = "ntdll.dll!ZwAlpcOpenSenderThread"; 1441 table[35] = "ntdll.dll!ZwAlpcQueryInformation"; 1442 table[36] = "ntdll.dll!ZwAlpcQueryInformationMessage"; 1443 table[37] = "ntdll.dll!NtAlpcRevokeSecurityContext"; 1444 table[38] = "ntdll.dll!NtAlpcSendWaitReceivePort"; 1445 table[39] = "ntdll.dll!NtAlpcSetInformation"; 1446 table[40] = "ntdll.dll!NtApphelpCacheControl"; 1447 table[41] = "ntdll.dll!ZwAreMappedFilesTheSame"; 1448 table[42] = "ntdll.dll!ZwAssignProcessToJobObject"; 1449 table[43] = "ntdll.dll!ZwCallbackReturn"; 1450 table[44] = "ntdll.dll!NtCancelDeviceWakeupRequest"; 1451 table[45] = "ntdll.dll!ZwCancelIoFile"; 1452 table[46] = "ntdll.dll!ZwCancelTimer"; 1453 table[47] = "ntdll.dll!NtClearEvent"; 1454 table[48] = "ntdll.dll!NtClose"; 1455 table[49] = "ntdll.dll!ZwCloseObjectAuditAlarm"; 1456 table[50] = "ntdll.dll!NtCompactKeys"; 1457 table[51] = "ntdll.dll!ZwCompareTokens"; 1458 table[52] = "ntdll.dll!NtCompleteConnectPort"; 1459 table[53] = "ntdll.dll!ZwCompressKey"; 1460 table[54] = "ntdll.dll!NtConnectPort"; 1461 table[55] = "ntdll.dll!ZwContinue"; 1462 table[56] = "ntdll.dll!ZwCreateDebugObject"; 1463 table[57] = "ntdll.dll!ZwCreateDirectoryObject"; 1464 table[58] = "ntdll.dll!NtCreateEvent"; 1465 table[59] = "ntdll.dll!NtCreateEventPair"; 1466 table[60] = "ntdll.dll!NtCreateFile"; 1467 table[61] = "ntdll.dll!NtCreateIoCompletion"; 1468 table[62] = "ntdll.dll!ZwCreateJobObject"; 1469 table[63] = "ntdll.dll!NtCreateJobSet"; 1470 table[64] = "ntdll.dll!ZwCreateKey"; 1471 table[65] = "ntdll.dll!NtCreateKeyTransacted"; 1472 table[66] = "ntdll.dll!ZwCreateMailslotFile"; 1473 table[67] = "ntdll.dll!ZwCreateMutant"; 1474 table[68] = "ntdll.dll!ZwCreateNamedPipeFile"; 1475 table[69] = "ntdll.dll!NtCreatePrivateNamespace"; 1476 table[70] = "ntdll.dll!NtCreatePagingFile"; 1477 table[71] = "ntdll.dll!ZwCreatePort"; 1478 table[72] = "ntdll.dll!ZwCreateProcess"; 1479 table[73] = "ntdll.dll!ZwCreateProcessEx"; 1480 table[74] = "ntdll.dll!ZwCreateProfile"; 1481 table[75] = "ntdll.dll!NtCreateSection"; 1482 table[76] = "ntdll.dll!NtCreateSemaphore"; 1483 table[77] = "ntdll.dll!ZwCreateSymbolicLinkObject"; 1484 table[78] = "ntdll.dll!NtCreateThread"; 1485 table[79] = "ntdll.dll!ZwCreateTimer"; 1486 table[80] = "ntdll.dll!NtCreateToken"; 1487 table[81] = "ntdll.dll!NtCreateTransaction"; 1488 table[82] = "ntdll.dll!ZwOpenTransaction"; 1489 table[83] = "ntdll.dll!ZwQueryInformationTransaction"; 1490 table[84] = "ntdll.dll!NtQueryInformationTransactionManager"; 1491 table[85] = "ntdll.dll!NtPrePrepareEnlistment"; 1492 table[86] = "ntdll.dll!ZwPrepareEnlistment"; 1493 table[87] = "ntdll.dll!NtCommitEnlistment"; 1494 table[88] = "ntdll.dll!ZwReadOnlyEnlistment"; 1495 table[89] = "ntdll.dll!ZwRollbackComplete"; 1496 table[90] = "ntdll.dll!NtRollbackEnlistment"; 1497 table[91] = "ntdll.dll!NtCommitTransaction"; 1498 table[92] = "ntdll.dll!NtRollbackTransaction"; 1499 table[93] = "ntdll.dll!ZwPrePrepareComplete"; 1500 table[94] = "ntdll.dll!NtPrepareComplete"; 1501 table[95] = "ntdll.dll!ZwCommitComplete"; 1502 table[96] = "ntdll.dll!ZwSinglePhaseReject"; 1503 table[97] = "ntdll.dll!ZwSetInformationTransaction"; 1504 table[98] = "ntdll.dll!ZwSetInformationTransactionManager"; 1505 table[99] = "ntdll.dll!ZwSetInformationResourceManager"; 1506 table[100] = "ntdll.dll!ZwCreateTransactionManager"; 1507 table[101] = "ntdll.dll!ZwOpenTransactionManager"; 1508 table[102] = "ntdll.dll!NtRenameTransactionManager"; 1509 table[103] = "ntdll.dll!NtRollforwardTransactionManager"; 1510 table[104] = "ntdll.dll!NtRecoverEnlistment"; 1511 table[105] = "ntdll.dll!NtRecoverResourceManager"; 1512 table[106] = "ntdll.dll!ZwRecoverTransactionManager"; 1513 table[107] = "ntdll.dll!ZwCreateResourceManager"; 1514 table[108] = "ntdll.dll!ZwOpenResourceManager"; 1515 table[109] = "ntdll.dll!ZwGetNotificationResourceManager"; 1516 table[110] = "ntdll.dll!ZwQueryInformationResourceManager"; 1517 table[111] = "ntdll.dll!ZwCreateEnlistment"; 1518 table[112] = "ntdll.dll!ZwOpenEnlistment"; 1519 table[113] = "ntdll.dll!NtSetInformationEnlistment"; 1520 table[114] = "ntdll.dll!ZwQueryInformationEnlistment"; 1521 table[115] = "ntdll.dll!ZwCreateWaitablePort"; 1522 table[116] = "ntdll.dll!NtDebugActiveProcess"; 1523 table[117] = "ntdll.dll!ZwDebugContinue"; 1524 table[118] = "ntdll.dll!ZwDelayExecution"; 1525 table[119] = "ntdll.dll!ZwDeleteAtom"; 1526 table[120] = "ntdll.dll!NtDeleteBootEntry"; 1527 table[121] = "ntdll.dll!ZwDeleteDriverEntry"; 1528 table[122] = "ntdll.dll!NtDeleteFile"; 1529 table[123] = "ntdll.dll!ZwDeleteKey"; 1530 table[124] = "ntdll.dll!NtDeletePrivateNamespace"; 1531 table[125] = "ntdll.dll!NtDeleteObjectAuditAlarm"; 1532 table[126] = "ntdll.dll!NtDeleteValueKey"; 1533 table[127] = "ntdll.dll!ZwDeviceIoControlFile"; 1534 table[128] = "ntdll.dll!NtDisplayString"; 1535 table[129] = "ntdll.dll!ZwDuplicateObject"; 1536 table[130] = "ntdll.dll!NtDuplicateToken"; 1537 table[131] = "ntdll.dll!ZwEnumerateBootEntries"; 1538 table[132] = "ntdll.dll!NtEnumerateDriverEntries"; 1539 table[133] = "ntdll.dll!ZwEnumerateKey"; 1540 table[134] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx"; 1541 table[135] = "ntdll.dll!ZwEnumerateTransactionObject"; 1542 table[136] = "ntdll.dll!NtEnumerateValueKey"; 1543 table[137] = "ntdll.dll!ZwExtendSection"; 1544 table[138] = "ntdll.dll!NtFilterToken"; 1545 table[139] = "ntdll.dll!NtFindAtom"; 1546 table[140] = "ntdll.dll!ZwFlushBuffersFile"; 1547 table[141] = "ntdll.dll!ZwFlushInstructionCache"; 1548 table[142] = "ntdll.dll!NtFlushKey"; 1549 table[143] = "ntdll.dll!ZwFlushProcessWriteBuffers"; 1550 table[144] = "ntdll.dll!ZwFlushVirtualMemory"; 1551 table[145] = "ntdll.dll!NtFlushWriteBuffer"; 1552 table[146] = "ntdll.dll!NtFreeUserPhysicalPages"; 1553 table[147] = "ntdll.dll!NtFreeVirtualMemory"; 1554 table[148] = "ntdll.dll!NtFreezeRegistry"; 1555 table[149] = "ntdll.dll!ZwFreezeTransactions"; 1556 table[150] = "ntdll.dll!NtFsControlFile"; 1557 table[151] = "ntdll.dll!NtGetContextThread"; 1558 table[152] = "ntdll.dll!NtGetDevicePowerState"; 1559 table[153] = "ntdll.dll!NtGetNlsSectionPtr"; 1560 table[154] = "ntdll.dll!ZwGetPlugPlayEvent"; 1561 table[155] = "ntdll.dll!NtGetWriteWatch"; 1562 table[156] = "ntdll.dll!NtImpersonateAnonymousToken"; 1563 table[157] = "ntdll.dll!ZwImpersonateClientOfPort"; 1564 table[158] = "ntdll.dll!ZwImpersonateThread"; 1565 table[159] = "ntdll.dll!ZwInitializeNlsFiles"; 1566 table[160] = "ntdll.dll!ZwInitializeRegistry"; 1567 table[161] = "ntdll.dll!NtInitiatePowerAction"; 1568 table[162] = "ntdll.dll!ZwIsProcessInJob"; 1569 table[163] = "ntdll.dll!NtIsSystemResumeAutomatic"; 1570 table[164] = "ntdll.dll!ZwListenPort"; 1571 table[165] = "ntdll.dll!NtLoadDriver"; 1572 table[166] = "ntdll.dll!NtLoadKey"; 1573 table[167] = "ntdll.dll!NtLoadKey2"; 1574 table[168] = "ntdll.dll!NtLoadKeyEx"; 1575 table[169] = "ntdll.dll!NtLockFile"; 1576 table[170] = "ntdll.dll!ZwLockProductActivationKeys"; 1577 table[171] = "ntdll.dll!NtLockRegistryKey"; 1578 table[172] = "ntdll.dll!ZwLockVirtualMemory"; 1579 table[173] = "ntdll.dll!ZwMakePermanentObject"; 1580 table[174] = "ntdll.dll!NtMakeTemporaryObject"; 1581 table[175] = "ntdll.dll!NtMapUserPhysicalPages"; 1582 table[176] = "ntdll.dll!ZwMapUserPhysicalPagesScatter"; 1583 table[177] = "ntdll.dll!ZwMapViewOfSection"; 1584 table[178] = "ntdll.dll!NtModifyBootEntry"; 1585 table[179] = "ntdll.dll!ZwModifyDriverEntry"; 1586 table[180] = "ntdll.dll!NtNotifyChangeDirectoryFile"; 1587 table[181] = "ntdll.dll!NtNotifyChangeKey"; 1588 table[182] = "ntdll.dll!NtNotifyChangeMultipleKeys"; 1589 table[183] = "ntdll.dll!ZwOpenDirectoryObject"; 1590 table[184] = "ntdll.dll!NtOpenEvent"; 1591 table[185] = "ntdll.dll!NtOpenEventPair"; 1592 table[186] = "ntdll.dll!NtOpenFile"; 1593 table[187] = "ntdll.dll!ZwOpenIoCompletion"; 1594 table[188] = "ntdll.dll!ZwOpenJobObject"; 1595 table[189] = "ntdll.dll!ZwOpenKey"; 1596 table[190] = "ntdll.dll!NtOpenKeyTransacted"; 1597 table[191] = "ntdll.dll!NtOpenMutant"; 1598 table[192] = "ntdll.dll!NtOpenPrivateNamespace"; 1599 table[193] = "ntdll.dll!ZwOpenObjectAuditAlarm"; 1600 table[194] = "ntdll.dll!ZwOpenProcess"; 1601 table[195] = "ntdll.dll!ZwOpenProcessToken"; 1602 table[196] = "ntdll.dll!ZwOpenProcessTokenEx"; 1603 table[197] = "ntdll.dll!NtOpenSection"; 1604 table[198] = "ntdll.dll!NtOpenSemaphore"; 1605 table[199] = "ntdll.dll!NtOpenSession"; 1606 table[200] = "ntdll.dll!NtOpenSymbolicLinkObject"; 1607 table[201] = "ntdll.dll!ZwOpenThread"; 1608 table[202] = "ntdll.dll!NtOpenThreadToken"; 1609 table[203] = "ntdll.dll!NtOpenThreadTokenEx"; 1610 table[204] = "ntdll.dll!ZwOpenTimer"; 1611 table[205] = "ntdll.dll!NtPlugPlayControl"; 1612 table[206] = "ntdll.dll!ZwPowerInformation"; 1613 table[207] = "ntdll.dll!ZwPrivilegeCheck"; 1614 table[208] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm"; 1615 table[209] = "ntdll.dll!NtPrivilegedServiceAuditAlarm"; 1616 table[210] = "ntdll.dll!ZwProtectVirtualMemory"; 1617 table[211] = "ntdll.dll!ZwPulseEvent"; 1618 table[212] = "ntdll.dll!ZwQueryAttributesFile"; 1619 table[213] = "ntdll.dll!ZwQueryBootEntryOrder"; 1620 table[214] = "ntdll.dll!ZwQueryBootOptions"; 1621 table[215] = "ntdll.dll!NtQueryDebugFilterState"; 1622 table[216] = "ntdll.dll!NtQueryDefaultLocale"; 1623 table[217] = "ntdll.dll!ZwQueryDefaultUILanguage"; 1624 table[218] = "ntdll.dll!ZwQueryDirectoryFile"; 1625 table[219] = "ntdll.dll!ZwQueryDirectoryObject"; 1626 table[220] = "ntdll.dll!NtQueryDriverEntryOrder"; 1627 table[221] = "ntdll.dll!ZwQueryEaFile"; 1628 table[222] = "ntdll.dll!NtQueryEvent"; 1629 table[223] = "ntdll.dll!ZwQueryFullAttributesFile"; 1630 table[224] = "ntdll.dll!NtQueryInformationAtom"; 1631 table[225] = "ntdll.dll!ZwQueryInformationFile"; 1632 table[226] = "ntdll.dll!ZwQueryInformationJobObject"; 1633 table[227] = "ntdll.dll!ZwQueryInformationPort"; 1634 table[228] = "ntdll.dll!ZwQueryInformationProcess"; 1635 table[229] = "ntdll.dll!NtQueryInformationThread"; 1636 table[230] = "ntdll.dll!ZwQueryInformationToken"; 1637 table[231] = "ntdll.dll!NtQueryInstallUILanguage"; 1638 table[232] = "ntdll.dll!NtQueryIntervalProfile"; 1639 table[233] = "ntdll.dll!NtQueryIoCompletion"; 1640 table[234] = "ntdll.dll!ZwQueryKey"; 1641 table[235] = "ntdll.dll!NtQueryMultipleValueKey"; 1642 table[236] = "ntdll.dll!NtQueryMutant"; 1643 table[237] = "ntdll.dll!NtQueryObject"; 1644 table[238] = "ntdll.dll!NtQueryOpenSubKeys"; 1645 table[239] = "ntdll.dll!NtQueryOpenSubKeysEx"; 1646 table[240] = "ntdll.dll!NtQueryPerformanceCounter"; 1647 table[241] = "ntdll.dll!ZwQueryQuotaInformationFile"; 1648 table[242] = "ntdll.dll!ZwQuerySection"; 1649 table[243] = "ntdll.dll!NtQuerySecurityObject"; 1650 table[244] = "ntdll.dll!ZwQuerySemaphore"; 1651 table[245] = "ntdll.dll!ZwQuerySymbolicLinkObject"; 1652 table[246] = "ntdll.dll!ZwQuerySystemEnvironmentValue"; 1653 table[247] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx"; 1654 table[248] = "ntdll.dll!NtQuerySystemInformation"; 1655 table[249] = "ntdll.dll!NtQuerySystemTime"; 1656 table[250] = "ntdll.dll!ZwQueryTimer"; 1657 table[251] = "ntdll.dll!NtQueryTimerResolution"; 1658 table[252] = "ntdll.dll!ZwQueryValueKey"; 1659 table[253] = "ntdll.dll!NtQueryVirtualMemory"; 1660 table[254] = "ntdll.dll!NtQueryVolumeInformationFile"; 1661 table[255] = "ntdll.dll!NtQueueApcThread"; 1662 table[256] = "ntdll.dll!ZwRaiseException"; 1663 table[257] = "ntdll.dll!ZwRaiseHardError"; 1664 table[258] = "ntdll.dll!NtReadFile"; 1665 table[259] = "ntdll.dll!NtReadFileScatter"; 1666 table[260] = "ntdll.dll!ZwReadRequestData"; 1667 table[261] = "ntdll.dll!NtReadVirtualMemory"; 1668 table[262] = "ntdll.dll!ZwRegisterThreadTerminatePort"; 1669 table[263] = "ntdll.dll!ZwReleaseMutant"; 1670 table[264] = "ntdll.dll!NtReleaseSemaphore"; 1671 table[265] = "ntdll.dll!ZwRemoveIoCompletion"; 1672 table[266] = "ntdll.dll!ZwRemoveProcessDebug"; 1673 table[267] = "ntdll.dll!ZwRenameKey"; 1674 table[268] = "ntdll.dll!ZwReplaceKey"; 1675 table[269] = "ntdll.dll!NtReplacePartitionUnit"; 1676 table[270] = "ntdll.dll!ZwReplyPort"; 1677 table[271] = "ntdll.dll!NtReplyWaitReceivePort"; 1678 table[272] = "ntdll.dll!NtReplyWaitReceivePortEx"; 1679 table[273] = "ntdll.dll!NtReplyWaitReplyPort"; 1680 table[274] = "ntdll.dll!ZwRequestDeviceWakeup"; 1681 table[275] = "ntdll.dll!ZwRequestPort"; 1682 table[276] = "ntdll.dll!NtRequestWaitReplyPort"; 1683 table[277] = "ntdll.dll!ZwRequestWakeupLatency"; 1684 table[278] = "ntdll.dll!NtResetEvent"; 1685 table[279] = "ntdll.dll!ZwResetWriteWatch"; 1686 table[280] = "ntdll.dll!NtRestoreKey"; 1687 table[281] = "ntdll.dll!ZwResumeProcess"; 1688 table[282] = "ntdll.dll!ZwResumeThread"; 1689 table[283] = "ntdll.dll!NtSaveKey"; 1690 table[284] = "ntdll.dll!NtSaveKeyEx"; 1691 table[285] = "ntdll.dll!NtSaveMergedKeys"; 1692 table[286] = "ntdll.dll!NtSecureConnectPort"; 1693 table[287] = "ntdll.dll!ZwSetBootEntryOrder"; 1694 table[288] = "ntdll.dll!ZwSetBootOptions"; 1695 table[289] = "ntdll.dll!ZwSetContextThread"; 1696 table[290] = "ntdll.dll!NtSetDebugFilterState"; 1697 table[291] = "ntdll.dll!NtSetDefaultHardErrorPort"; 1698 table[292] = "ntdll.dll!NtSetDefaultLocale"; 1699 table[293] = "ntdll.dll!ZwSetDefaultUILanguage"; 1700 table[294] = "ntdll.dll!NtSetDriverEntryOrder"; 1701 table[295] = "ntdll.dll!ZwSetEaFile"; 1702 table[296] = "ntdll.dll!NtSetEvent"; 1703 table[297] = "ntdll.dll!NtSetEventBoostPriority"; 1704 table[298] = "ntdll.dll!NtSetHighEventPair"; 1705 table[299] = "ntdll.dll!NtSetHighWaitLowEventPair"; 1706 table[300] = "ntdll.dll!ZwSetInformationDebugObject"; 1707 table[301] = "ntdll.dll!ZwSetInformationFile"; 1708 table[302] = "ntdll.dll!ZwSetInformationJobObject"; 1709 table[303] = "ntdll.dll!ZwSetInformationKey"; 1710 table[304] = "ntdll.dll!ZwSetInformationObject"; 1711 table[305] = "ntdll.dll!ZwSetInformationProcess"; 1712 table[306] = "ntdll.dll!ZwSetInformationThread"; 1713 table[307] = "ntdll.dll!ZwSetInformationToken"; 1714 table[308] = "ntdll.dll!NtSetIntervalProfile"; 1715 table[309] = "ntdll.dll!NtSetIoCompletion"; 1716 table[310] = "ntdll.dll!ZwSetLdtEntries"; 1717 table[311] = "ntdll.dll!ZwSetLowEventPair"; 1718 table[312] = "ntdll.dll!ZwSetLowWaitHighEventPair"; 1719 table[313] = "ntdll.dll!ZwSetQuotaInformationFile"; 1720 table[314] = "ntdll.dll!NtSetSecurityObject"; 1721 table[315] = "ntdll.dll!ZwSetSystemEnvironmentValue"; 1722 table[316] = "ntdll.dll!ZwSetSystemEnvironmentValueEx"; 1723 table[317] = "ntdll.dll!ZwSetSystemInformation"; 1724 table[318] = "ntdll.dll!ZwSetSystemPowerState"; 1725 table[319] = "ntdll.dll!ZwSetSystemTime"; 1726 table[320] = "ntdll.dll!ZwSetThreadExecutionState"; 1727 table[321] = "ntdll.dll!ZwSetTimer"; 1728 table[322] = "ntdll.dll!NtSetTimerResolution"; 1729 table[323] = "ntdll.dll!ZwSetUuidSeed"; 1730 table[324] = "ntdll.dll!ZwSetValueKey"; 1731 table[325] = "ntdll.dll!NtSetVolumeInformationFile"; 1732 table[326] = "ntdll.dll!ZwShutdownSystem"; 1733 table[327] = "ntdll.dll!ZwSignalAndWaitForSingleObject"; 1734 table[328] = "ntdll.dll!NtStartProfile"; 1735 table[329] = "ntdll.dll!ZwStopProfile"; 1736 table[330] = "ntdll.dll!ZwSuspendProcess"; 1737 table[331] = "ntdll.dll!ZwSuspendThread"; 1738 table[332] = "ntdll.dll!NtSystemDebugControl"; 1739 table[333] = "ntdll.dll!ZwTerminateJobObject"; 1740 table[334] = "ntdll.dll!ZwTerminateProcess"; 1741 table[335] = "ntdll.dll!ZwTerminateThread"; 1742 table[336] = "ntdll.dll!NtTestAlert"; 1743 table[337] = "ntdll.dll!ZwThawRegistry"; 1744 table[338] = "ntdll.dll!NtThawTransactions"; 1745 table[339] = "ntdll.dll!NtTraceEvent"; 1746 table[340] = "ntdll.dll!ZwTraceControl"; 1747 table[341] = "ntdll.dll!NtTranslateFilePath"; 1748 table[342] = "ntdll.dll!ZwUnloadDriver"; 1749 table[343] = "ntdll.dll!NtUnloadKey"; 1750 table[344] = "ntdll.dll!ZwUnloadKey2"; 1751 table[345] = "ntdll.dll!ZwUnloadKeyEx"; 1752 table[346] = "ntdll.dll!ZwUnlockFile"; 1753 table[347] = "ntdll.dll!NtUnlockVirtualMemory"; 1754 table[348] = "ntdll.dll!NtUnmapViewOfSection"; 1755 table[349] = "ntdll.dll!NtVdmControl"; 1756 table[350] = "ntdll.dll!NtWaitForDebugEvent"; 1757 table[351] = "ntdll.dll!NtWaitForMultipleObjects"; 1758 table[352] = "ntdll.dll!ZwWaitForSingleObject"; 1759 table[353] = "ntdll.dll!ZwWaitHighEventPair"; 1760 table[354] = "ntdll.dll!NtWaitLowEventPair"; 1761 table[355] = "ntdll.dll!NtWriteFile"; 1762 table[356] = "ntdll.dll!NtWriteFileGather"; 1763 table[357] = "ntdll.dll!NtWriteRequestData"; 1764 table[358] = "ntdll.dll!NtWriteVirtualMemory"; 1765 table[359] = "ntdll.dll!ZwYieldExecution"; 1766 table[360] = "ntdll.dll!ZwCreateKeyedEvent"; 1767 table[361] = "ntdll.dll!NtOpenKeyedEvent"; 1768 table[362] = "ntdll.dll!NtReleaseKeyedEvent"; 1769 table[363] = "ntdll.dll!NtWaitForKeyedEvent"; 1770 table[364] = "ntdll.dll!ZwQueryPortInformationProcess"; 1771 table[365] = "ntdll.dll!NtGetCurrentProcessorNumber"; 1772 table[366] = "ntdll.dll!NtWaitForMultipleObjects32"; 1773 table[367] = "ntdll.dll!ZwGetNextProcess"; 1774 table[368] = "ntdll.dll!ZwGetNextThread"; 1775 table[369] = "ntdll.dll!NtCancelIoFileEx"; 1776 table[370] = "ntdll.dll!NtCancelSynchronousIoFile"; 1777 table[371] = "ntdll.dll!ZwRemoveIoCompletionEx"; 1778 table[372] = "ntdll.dll!ZwRegisterProtocolAddressInformation"; 1779 table[373] = "ntdll.dll!NtPropagationComplete"; 1780 table[374] = "ntdll.dll!ZwPropagationFailed"; 1781 table[375] = "ntdll.dll!NtCreateWorkerFactory"; 1782 table[376] = "ntdll.dll!ZwReleaseWorkerFactoryWorker"; 1783 table[377] = "ntdll.dll!NtWaitForWorkViaWorkerFactory"; 1784 table[378] = "ntdll.dll!ZwSetInformationWorkerFactory"; 1785 table[379] = "ntdll.dll!ZwQueryInformationWorkerFactory"; 1786 table[380] = "ntdll.dll!NtWorkerFactoryWorkerReady"; 1787 table[381] = "ntdll.dll!NtShutdownWorkerFactory"; 1788 table[382] = "ntdll.dll!NtCreateThreadEx"; 1789 table[383] = "ntdll.dll!NtCreateUserProcess"; 1790 table[384] = "ntdll.dll!NtQueryLicenseValue"; 1791 table[385] = "ntdll.dll!ZwMapCMFModule"; 1792 table[386] = "ntdll.dll!ZwIsUILanguageComitted"; 1793 table[387] = "ntdll.dll!ZwFlushInstallUILanguage"; 1794 table[388] = "ntdll.dll!NtGetMUIRegistryInfo"; 1795 table[389] = "ntdll.dll!ZwAcquireCMFViewOwnership"; 1796 table[390] = "ntdll.dll!NtReleaseCMFViewOwnership"; 1797 table[4545] = "imm32.dll!NtUserGetThreadState"; 1798 table[4520] = "imm32.dll!NtUserGetImeInfoEx"; 1799 table[4600] = "imm32.dll!NtUserQueryWindow"; 1800 table[4598] = "imm32.dll!NtUserQueryInputContext"; 1801 table[4581] = "imm32.dll!NtUserNotifyIMEStatus"; 1802 table[4412] = "imm32.dll!NtUserAssociateInputContext"; 1803 table[4429] = "imm32.dll!NtUserCallOneParam"; 1804 table[4463] = "imm32.dll!NtUserDisableThreadIme"; 1805 table[4635] = "imm32.dll!NtUserSetImeInfoEx"; 1806 table[4697] = "imm32.dll!NtUserUpdateInputContext"; 1807 table[4417] = "imm32.dll!NtUserBuildHimcList"; 1808 table[4704] = "imm32.dll!NtUserValidateHandleSecure"; 1809 table[4450] = "imm32.dll!NtUserCreateInputContext"; 1810 table[4460] = "imm32.dll!NtUserDestroyInputContext"; 1811 table[4492] = "imm32.dll!NtUserGetAppImeLevel"; 1812 table[4519] = "imm32.dll!NtUserGetImeHotKey"; 1813 table[4623] = "imm32.dll!NtUserSetAppImeLevel"; 1814 table[4657] = "imm32.dll!NtUserSetThreadLayoutHandles"; 1815 table[4560] = "user32.dll!NtUserInitializeClientPfnArrays"; 1816 table[4596] = "user32.dll!NtUserProcessConnect"; 1817 table[4453] = "user32.dll!NtUserCreateWindowStation"; 1818 table[4449] = "user32.dll!NtUserCreateDesktopEx"; 1819 table[4695] = "user32.dll!NtUserUnregisterUserApiHook"; 1820 table[4607] = "user32.dll!NtUserRegisterUserApiHook"; 1821 table[4634] = "user32.dll!NtUserSetImeHotKey"; 1822 table[4670] = "user32.dll!NtUserSetWindowStationUser"; 1823 table[4568] = "user32.dll!NtUserLoadKeyboardLayoutEx"; 1824 table[4702] = "user32.dll!NtUserUpdatePerUserSystemParameters"; 1825 table[4465] = "user32.dll!NtUserDoSoundConnect"; 1826 table[4720] = "user32.dll!NtUserRegisterSessionPort"; 1827 table[4423] = "user32.dll!NtUserCallHwndOpt"; 1828 table[4651] = "user32.dll!NtUserSetShellWindowEx"; 1829 table[4421] = "user32.dll!NtUserCallHwnd"; 1830 table[4723] = "user32.dll!NtUserDwmStartRedirection"; 1831 table[4609] = "user32.dll!NtUserRegisterRawInputDevices"; 1832 table[4495] = "user32.dll!NtUserGetCaretBlinkTime"; 1833 table[4681] = "user32.dll!NtUserThunkedMenuInfo"; 1834 table[4570] = "user32.dll!NtUserLockWindowUpdate"; 1835 table[4445] = "user32.dll!NtUserCopyAcceleratorTable"; 1836 table[4478] = "user32.dll!NtUserEndMenu"; 1837 table[4458] = "user32.dll!DestroyAcceleratorTable"; 1838 table[4625] = "user32.dll!NtUserSetClassLong"; 1839 table[4613] = "user32.dll!NtUserRemoveMenu"; 1840 table[4643] = "user32.dll!NtUserSetMenuDefaultItem"; 1841 table[4461] = "user32.dll!NtUserDestroyMenu"; 1842 table[4553] = "user32.dll!NtUserGhostWindowFromHungWindow"; 1843 table[4590] = "user32.dll!NtUserPaintMonitor"; 1844 table[4589] = "user32.dll!NtUserPaintDesktop"; 1845 table[4454] = "user32.dll!NtUserDdeInitialize"; 1846 table[4663] = "user32.dll!NtUserSetWindowPlacement"; 1847 table[4669] = "user32.dll!NtUserSetWindowsHookEx"; 1848 table[4457] = "user32.dll!NtUserDeleteMenu"; 1849 table[4565] = "user32.dll!NtUserInvalidateRgn"; 1850 table[4638] = "user32.dll!NtUserSetInformationThread"; 1851 table[4493] = "user32.dll!NtUserGetAsyncKeyState"; 1852 table[4434] = "user32.dll!NtUserCheckDesktopByThreadId"; 1853 table[4727] = "user32.dll!NtUserGetWindowMinimizeRect"; 1854 table[4672] = "user32.dll!NtUserSetWinEventHook"; 1855 table[4508] = "user32.dll!NtUserGetCPD"; 1856 table[4665] = "user32.dll!NtUserSetWindowRgn"; 1857 table[4569] = "user32.dll!NtUserLockWindowStation"; 1858 table[4485] = "user32.dll!NtUserFillWindow"; 1859 table[4677] = "user32.dll!NtUserSoundSentry"; 1860 table[4696] = "user32.dll!NtUserUnregisterHotKey"; 1861 table[4524] = "user32.dll!NtUserGetKeyboardState"; 1862 table[4691] = "user32.dll!NtUserUnhookWinEvent"; 1863 table[4621] = "user32.dll!NtUserSendInput"; 1864 table[4658] = "user32.dll!NtUserSetThreadState"; 1865 table[4624] = "user32.dll!NtUserSetCapture"; 1866 table[4633] = "user32.dll!NtUserSetFocus"; 1867 table[4636] = "user32.dll!NtUserSetImeOwnerWindow"; 1868 table[4425] = "user32.dll!NtUserCallHwndParamLock"; 1869 table[4686] = "user32.dll!NtUserCalcMenuBar"; 1870 table[4546] = "user32.dll!NtUserGetTitleBarInfo"; 1871 table[4512] = "user32.dll!NtUserGetDCEx"; 1872 table[4528] = "user32.dll!NtUserGetMenuBarInfo"; 1873 table[4678] = "user32.dll!NtUserSwitchDesktop"; 1874 table[4522] = "user32.dll!NtUserGetKeyboardLayoutList"; 1875 table[4675] = "user32.dll!NtUserShowWindow"; 1876 table[4660] = "user32.dll!NtUserSetProcessDPIAware"; 1877 table[4646] = "user32.dll!NtUserSetParent"; 1878 table[4693] = "user32.dll!NtUserUnlockWindowStation"; 1879 table[4684] = "user32.dll!NtUserTrackMouseEvent"; 1880 table[4608] = "user32.dll!NtUserRegisterHotKey"; 1881 table[4701] = "user32.dll!NtUserSetLayeredWindowAttributes"; 1882 table[4580] = "user32.dll!NtUserMoveWindow"; 1883 table[4699] = "user32.dll!NtUserUpdateLayeredWindow"; 1884 table[4542] = "user32.dll!NtUserGetScrollBarInfo"; 1885 table[4447] = "user32.dll!NtUserCreateAcceleratorTable"; 1886 table[4630] = "user32.dll!NtUserSetCursor"; 1887 table[4586] = "user32.dll!NtUserOpenInputDesktop"; 1888 table[4514] = "user32.dll!NtUserGetForegroundWindow"; 1889 table[4548] = "user32.dll!GetUpdateRect"; 1890 table[4656] = "user32.dll!NtUserSetThreadDesktop"; 1891 table[4536] = "user32.dll!NtUserGetProcessWindowStation"; 1892 table[4647] = "user32.dll!NtUserSetProcessWindowStation"; 1893 table[4605] = "user32.dll!NtUserRegisterClassExWOW"; 1894 table[4494] = "user32.dll!NtUserGetAtomName"; 1895 table[4697] = "user32.dll!NtUserUpdateInputContext"; 1896 table[4661] = "user32.dll!NtUserSetWindowFNID"; 1897 table[4498] = "user32.dll!NtUserGetClassName"; 1898 table[4516] = "user32.dll!NtUserGetGUIThreadInfo"; 1899 table[4585] = "user32.dll!NtUserOpenDesktop"; 1900 table[4419] = "user32.dll!NtUserBuildNameList"; 1901 table[4617] = "user32.dll!NtUserSBGetParms"; 1902 table[4674] = "user32.dll!NtUserShowScrollBar"; 1903 table[4588] = "user32.dll!NtUserOpenWindowStation"; 1904 table[4694] = "user32.dll!NtUserUnregisterClass"; 1905 table[4481] = "user32.dll!NtUserEnumDisplayMonitors"; 1906 table[4462] = "user32.dll!NtUserDestroyWindow"; 1907 table[4441] = "user32.dll!NtUserCloseDesktop"; 1908 table[4459] = "user32.dll!NtUserDestroyCursor"; 1909 table[4442] = "user32.dll!NtUserCloseWindowStation"; 1910 table[4418] = "user32.dll!NtUserBuildHwndList"; 1911 table[4594] = "user32.dll!NtUserPostThreadMessage"; 1912 table[4614] = "user32.dll!NtUserRemoveProp"; 1913 table[4662] = "user32.dll!NtUserSetWindowLong"; 1914 table[4664] = "user32.dll!NtUserSetWindowPos"; 1915 table[4422] = "user32.dll!NtUserCallHwndLock"; 1916 table[4649] = "user32.dll!NtUserSetProp"; 1917 table[4477] = "user32.dll!NtUserEndDeferWindowPosEx"; 1918 table[4455] = "user32.dll!NtUserDeferWindowPos"; 1919 table[4632] = "user32.dll!NtUserSetCursorIconData"; 1920 table[4486] = "user32.dll!NtUserFindExistingCursorIcon"; 1921 table[4533] = "user32.dll!NtUserGetObjectInformation"; 1922 table[4452] = "user32.dll!NtUserCreateWindowEx"; 1923 table[4682] = "user32.dll!NtUserThunkedMenuItemInfo"; 1924 table[4543] = "user32.dll!NtUserGetSystemMenu"; 1925 table[4676] = "user32.dll!NtUserShowWindowAsync"; 1926 table[4600] = "user32.dll!NtUserQueryWindow"; 1927 table[4517] = "user32.dll!NtUserGetIconInfo"; 1928 table[4518] = "user32.dll!NtUserGetIconSize"; 1929 table[4583] = "user32.dll!NtUserNotifyWinEvent"; 1930 table[4562] = "user32.dll!NtUserInternalGetWindowText"; 1931 table[4666] = "user32.dll!NtUserGetWindowRgnEx"; 1932 table[4472] = "user32.dll!NtUserDrawIconEx"; 1933 table[4424] = "user32.dll!NtUserCallHwndParam"; 1934 table[4409] = "user32.dll!NtUserActivateKeyboardLayout"; 1935 table[4629] = "user32.dll!NtUserSetConsoleReserveKeys"; 1936 table[4557] = "user32.dll!NtUserHungWindowFromGhostWindow"; 1937 table[4622] = "user32.dll!NtUserSetActiveWindow"; 1938 table[4544] = "user32.dll!NtUserGetThreadDesktop"; 1939 table[4497] = "user32.dll!NtUserGetClassInfoEx"; 1940 table[4480] = "user32.dll!NtUserEnumDisplayDevices"; 1941 table[4482] = "user32.dll!NtUserEnumDisplaySettings"; 1942 table[4650] = "user32.dll!NtUserSetScrollInfo"; 1943 table[4526] = "user32.dll!NtUserGetKeyState"; 1944 table[4575] = "user32.dll!NtUserMessageCall"; 1945 table[4706] = "user32.dll!NtUserValidateTimerCallback"; 1946 table[4611] = "user32.dll!NtUserRegisterWindowMessage"; 1947 table[4511] = "user32.dll!NtUserGetDC"; 1948 table[4602] = "user32.dll!NtUserRealInternalGetMessage"; 1949 table[4487] = "user32.dll!NtUserFindWindowEx"; 1950 table[4500] = "user32.dll!NtUserGetClipboardFormatName"; 1951 table[4545] = "user32.dll!NtUserGetThreadState"; 1952 table[4679] = "user32.dll!NtUserSystemParametersInfo"; 1953 table[4593] = "user32.dll!NtUserPostMessage"; 1954 table[4659] = "user32.dll!NtUserSetTimer"; 1955 table[4567] = "user32.dll!NtUserKillTimer"; 1956 table[4414] = "user32.dll!NtUserBeginPaint"; 1957 table[4479] = "user32.dll!NtUserEndPaint"; 1958 table[4604] = "user32.dll!NtUserRedrawWindow"; 1959 table[4491] = "user32.dll!NtUserGetAncestor"; 1960 table[4555] = "user32.dll!NtUserHideCaret"; 1961 table[4673] = "user32.dll!NtUserShowCaret"; 1962 table[4448] = "user32.dll!NtUserCreateCaret"; 1963 table[4531] = "user32.dll!NtUserGetMessage"; 1964 table[4591] = "user32.dll!PeekMessageW"; 1965 table[4429] = "user32.dll!NtUserCallOneParam"; 1966 table[4428] = "user32.dll!NtUserCallNoParam"; 1967 table[4464] = "user32.dll!NtUserDispatchMessage"; 1968 table[4648] = "user32.dll!NtUserGetProp"; 1969 table[4550] = "user32.dll!NtUserGetWindowDC"; 1970 table[4513] = "user32.dll!NtUserGetDoubleClickTime"; 1971 table[4710] = "user32.dll!NtUserWaitMessage"; 1972 table[4564] = "user32.dll!NtUserInvalidateRect"; 1973 table[4430] = "user32.dll!NtUserCallTwoParam"; 1974 table[4618] = "user32.dll!NtUserScrollDC"; 1975 table[4704] = "user32.dll!NtUserValidateHandleSecure"; 1976 table[4439] = "user32.dll!NtUserClipCursor"; 1977 table[4571] = "user32.dll!NtUserLockWorkStation"; 1978 table[4724] = "user32.dll!NtUserDwmStopRedirection"; 1979 table[4534] = "user32.dll!NtUserGetOpenClipboardWindow"; 1980 table[4484] = "user32.dll!NtUserExcludeUpdateRgn"; 1981 table[4707] = "user32.dll!NtUserVkKeyScanEx"; 1982 table[4654] = "user32.dll!NtUserSetSystemMenu"; 1983 table[4438] = "user32.dll!NtUserChildWindowFromPointEx"; 1984 table[4671] = "user32.dll!NtUserSetWindowWord"; 1985 table[4476] = "user32.dll!NtUserEnableScrollBar"; 1986 table[4415] = "user32.dll!NtUserBitBltSysBmp"; 1987 table[4509] = "user32.dll!NtUserGetCursorFrameInfo"; 1988 table[4427] = "user32.dll!NtUserCallNextHookEx"; 1989 table[4628] = "user32.dll!NtUserSetClipboardViewer"; 1990 table[4437] = "user32.dll!CheckMenuItem"; 1991 table[4566] = "user32.dll!NtUserIsClipboardFormatAvailable"; 1992 table[4440] = "user32.dll!NtUserCloseClipboard"; 1993 table[4584] = "user32.dll!NtUserOpenClipboard"; 1994 table[4502] = "user32.dll!NtUserGetClipboardSequenceNumber"; 1995 table[4431] = "user32.dll!NtUserChangeClipboardChain"; 1996 table[4688] = "user32.dll!NtUserTranslateAccelerator"; 1997 table[4705] = "user32.dll!NtUserValidateRect"; 1998 table[4667] = "user32.dll!NtUserSetWindowRgnEx"; 1999 table[4475] = "user32.dll!NtUserEnableMenuItem"; 2000 table[4496] = "user32.dll!NtUserGetCaretPos"; 2001 table[4505] = "user32.dll!NtUserGetComboBoxInfo"; 2002 table[4426] = "user32.dll!NtUserCallMsgFilter"; 2003 table[4690] = "user32.dll!NtUserUnhookWindowsHookEx"; 2004 table[4416] = "user32.dll!NtUserBlockInput"; 2005 table[4595] = "user32.dll!NtUserPrintWindow"; 2006 table[4501] = "user32.dll!NtUserGetClipboardOwner"; 2007 table[4413] = "user32.dll!NtUserAttachThreadInput"; 2008 table[4446] = "user32.dll!NtUserCountClipboardFormats"; 2009 table[4572] = "user32.dll!NtUserLogicalToPhysicalPoint"; 2010 table[4592] = "user32.dll!NtUserPhysicalToLogicalPoint"; 2011 table[4712] = "user32.dll!NtUserWindowFromPhysicalPoint"; 2012 table[4685] = "user32.dll!NtUserTrackPopupMenuEx"; 2013 table[4641] = "user32.dll!NtUserSetMenu"; 2014 table[4432] = "user32.dll!NtUserChangeDisplaySettings"; 2015 table[4726] = "user32.dll!NtUserDwmGetDxRgn"; 2016 table[4725] = "user32.dll!NtUserDwmHintDxUpdate"; 2017 table[4573] = "user32.dll!NtUserMapVirtualKeyEx"; 2018 table[4640] = "user32.dll!NtUserSetKeyboardState"; 2019 table[4708] = "user32.dll!NtUserWaitForInputIdle"; 2020 table[4549] = "user32.dll!NtUserGetUpdateRgn"; 2021 table[4456] = "user32.dll!NtUserDefSetText"; 2022 table[4506] = "user32.dll!NtUserGetControlBrush"; 2023 table[4488] = "user32.dll!NtUserFlashWindowEx"; 2024 table[4689] = "user32.dll!NtUserTranslateMessage"; 2025 table[4619] = "user32.dll!NtUserScrollWindowEx"; 2026 table[4687] = "user32.dll!NtUserPaintMenuBar"; 2027 table[4551] = "user32.dll!NtUserGetWindowPlacement"; 2028 table[4713] = "user32.dll!NtUserWindowFromPoint"; 2029 table[4410] = "user32.dll!NtUserAddClipboardFormatListener"; 2030 table[4411] = "user32.dll!NtUserAlterWindowStyle"; 2031 table[4420] = "user32.dll!NtUserBuildPropList"; 2032 table[4433] = "user32.dll!NtUserCheckAccessForIntegrityLevel"; 2033 table[4435] = "user32.dll!NtUserCheckWindowThreadDesktop"; 2034 table[4444] = "user32.dll!NtUserConvertMemHandle"; 2035 table[4451] = "user32.dll!NtUserCreateLocalMemHandle"; 2036 table[4466] = "user32.dll!NtUserDoSoundDisconnect"; 2037 table[4467] = "user32.dll!NtUserDragDetect"; 2038 table[4468] = "user32.dll!NtUserDragObject"; 2039 table[4469] = "user32.dll!NtUserDrawAnimatedRects"; 2040 table[4470] = "user32.dll!NtUserDrawCaption"; 2041 table[4471] = "user32.dll!NtUserDrawCaptionTemp"; 2042 table[4473] = "user32.dll!NtUserDrawMenuBarTemp"; 2043 table[4474] = "user32.dll!NtUserEmptyClipboard"; 2044 table[4483] = "user32.dll!NtUserEvent"; 2045 table[4489] = "user32.dll!NtUserFrostCrashedWindow"; 2046 table[4490] = "user32.dll!NtUserGetAltTabInfo"; 2047 table[4499] = "user32.dll!NtUserGetClipboardData"; 2048 table[4503] = "user32.dll!NtUserGetClipboardViewer"; 2049 table[4504] = "user32.dll!NtUserGetClipCursor"; 2050 table[4507] = "user32.dll!NtUserGetControlColor"; 2051 table[4510] = "user32.dll!NtUserGetCursorInfo"; 2052 table[4515] = "user32.dll!NtUserGetGuiResources"; 2053 table[4519] = "user32.dll!NtUserGetImeHotKey"; 2054 table[4521] = "user32.dll!NtUserGetInternalWindowPos"; 2055 table[4523] = "user32.dll!NtUserGetKeyboardLayoutName"; 2056 table[4525] = "user32.dll!NtUserGetKeyNameText"; 2057 table[4527] = "user32.dll!NtUserGetListBoxInfo"; 2058 table[4529] = "user32.dll!NtUserGetMenuIndex"; 2059 table[4530] = "user32.dll!NtUserGetMenuItemRect"; 2060 table[4532] = "user32.dll!NtUserGetMouseMovePointsEx"; 2061 table[4535] = "user32.dll!NtUserGetPriorityClipboardFormat"; 2062 table[4537] = "user32.dll!NtUserGetRawInputBuffer"; 2063 table[4538] = "user32.dll!NtUserGetRawInputData"; 2064 table[4539] = "user32.dll!NtUserGetRawInputDeviceInfo"; 2065 table[4540] = "user32.dll!NtUserGetRawInputDeviceList"; 2066 table[4541] = "user32.dll!NtUserGetRegisteredRawInputDevices"; 2067 table[4547] = "user32.dll!NtUserGetUpdatedClipboardFormats"; 2068 table[4552] = "user32.dll!NtUserGetWOWClass"; 2069 table[4556] = "user32.dll!NtUserHiliteMenuItem"; 2070 table[4558] = "user32.dll!NtUserImpersonateDdeClientWindow"; 2071 table[4561] = "user32.dll!NtUserInitTask"; 2072 table[4563] = "user32.dll!NtUserInternalGetWindowIcon"; 2073 table[4574] = "user32.dll!NtUserMenuItemFromPoint"; 2074 table[4576] = "user32.dll!NtUserMinMaximize"; 2075 table[4577] = "user32.dll!NtUserMNDragLeave"; 2076 table[4578] = "user32.dll!NtUserMNDragOver"; 2077 table[4579] = "user32.dll!NtUserModifyUserStartupInfoFlags"; 2078 table[4581] = "user32.dll!NtUserNotifyIMEStatus"; 2079 table[4587] = "user32.dll!NtUserOpenThreadDesktop"; 2080 table[4599] = "user32.dll!NtUserQuerySendMessage"; 2081 table[4601] = "user32.dll!NtUserRealChildWindowFromPoint"; 2082 table[4603] = "user32.dll!NtUserRealWaitMessageEx"; 2083 table[4606] = "user32.dll!NtUserRegisterErrorReportingDialog"; 2084 table[4610] = "user32.dll!NtUserRegisterTasklist"; 2085 table[4612] = "user32.dll!NtUserRemoveClipboardFormatListener"; 2086 table[4616] = "user32.dll!NtUserResolveDesktopForWOW"; 2087 table[4626] = "user32.dll!NtUserSetClassWord"; 2088 table[4627] = "user32.dll!NtUserSetClipboardData"; 2089 table[4631] = "user32.dll!NtUserSetCursorContents"; 2090 table[4639] = "user32.dll!NtUserSetInternalWindowPos"; 2091 table[4642] = "user32.dll!NtUserSetMenuContextHelpId"; 2092 table[4644] = "user32.dll!NtUserSetMenuFlagRtoL"; 2093 table[4645] = "user32.dll!NtUserSetObjectInformation"; 2094 table[4652] = "user32.dll!NtUserSetSysColors"; 2095 table[4653] = "user32.dll!NtUserSetSystemCursor"; 2096 table[4655] = "user32.dll!NtUserSetSystemTimer"; 2097 table[4668] = "user32.dll!NtUserSetWindowsHookAW"; 2098 table[4680] = "user32.dll!NtUserTestForInteractiveUser"; 2099 table[4683] = "user32.dll!NtUserToUnicodeEx"; 2100 table[4692] = "user32.dll!NtUserUnloadKeyboardLayout"; 2101 table[4698] = "user32.dll!NtUserUpdateInstance"; 2102 table[4700] = "user32.dll!NtUserGetLayeredWindowAttributes"; 2103 table[4703] = "user32.dll!NtUserUserHandleGrantAccess"; 2104 table[4709] = "user32.dll!NtUserWaitForMsgAndEvent"; 2105 table[4711] = "user32.dll!NtUserWin32PoolAllocationStats"; 2106 table[4714] = "user32.dll!NtUserYieldTask"; 2107 table[4721] = "user32.dll!NtUserUnregisterSessionPort"; 2108 table[4722] = "user32.dll!NtUserUpdateWindowTransform"; 2109 table[4866] = "user32.dll!NtUserSetMirrorRendering"; 2110 table[4867] = "user32.dll!NtUserShowSystemCursor"; 2111 } 2112 2113 return table; 2114 } 2115 2116 #endif // TRACELINE_SYSCALL_MAP_H_ 2117