Home | History | Annotate | Download | only in traceline
      1 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 // This table is a dump of system call numbers -> function names on an XP
      6 // system.  These numbers change between kernel versions, so it's likely they
      7 // will have to be regenerated for your system.  See the idarub script.
      8 
      9 // Define a global map used for resolving a syscall number to name.
     10 // Call CreateSyscallMap() to create a return a std::map<int, const char*>
     11 // which maps from a system call number to its function name.
     12 
     13 #ifndef TRACELINE_SYSCALL_MAP_H_
     14 #define TRACELINE_SYSCALL_MAP_H_
     15 
     16 #include <map>
     17 
     18 // TODO(deanm): Right now these tables are manually extracted and hardcoded
     19 // here.  It would be great (but possibly difficult) to do it on startup.  We
     20 // should at least checksum the DLLs to make sure they match.
     21 
     22 std::map<int, const char*> CreateSyscallMap() {
     23   std::map<int, const char*> table;
     24 if (1) {  // XP table.
     25   table[0] = "ntdll.dll!NtAcceptConnectPort";
     26   table[1] = "ntdll.dll!NtAccessCheck";
     27   table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm";
     28   table[3] = "ntdll.dll!NtAccessCheckByType";
     29   table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm";
     30   table[5] = "ntdll.dll!NtAccessCheckByTypeResultList";
     31   table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm";
     32   table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle";
     33   table[8] = "ntdll.dll!NtAddAtom";
     34   table[9] = "ntdll.dll!ZwAddBootEntry";
     35   table[10] = "ntdll.dll!ZwAdjustGroupsToken";
     36   table[11] = "ntdll.dll!ZwAdjustPrivilegesToken";
     37   table[12] = "ntdll.dll!NtAlertResumeThread";
     38   table[13] = "ntdll.dll!NtAlertThread";
     39   table[14] = "ntdll.dll!ZwAllocateLocallyUniqueId";
     40   table[15] = "ntdll.dll!NtAllocateUserPhysicalPages";
     41   table[16] = "ntdll.dll!NtAllocateUuids";
     42   table[17] = "ntdll.dll!NtAllocateVirtualMemory";
     43   table[18] = "ntdll.dll!ZwAreMappedFilesTheSame";
     44   table[19] = "ntdll.dll!ZwAssignProcessToJobObject";
     45   table[20] = "ntdll.dll!ZwCallbackReturn";
     46   table[21] = "ntdll.dll!NtCancelDeviceWakeupRequest";
     47   table[22] = "ntdll.dll!ZwCancelIoFile";
     48   table[23] = "ntdll.dll!ZwCancelTimer";
     49   table[24] = "ntdll.dll!NtClearEvent";
     50   table[25] = "ntdll.dll!NtClose";
     51   table[26] = "ntdll.dll!ZwCloseObjectAuditAlarm";
     52   table[27] = "ntdll.dll!NtCompactKeys";
     53   table[28] = "ntdll.dll!ZwCompareTokens";
     54   table[29] = "ntdll.dll!NtCompleteConnectPort";
     55   table[30] = "ntdll.dll!ZwCompressKey";
     56   table[31] = "ntdll.dll!NtConnectPort";
     57   table[32] = "ntdll.dll!ZwContinue";
     58   table[33] = "ntdll.dll!ZwCreateDebugObject";
     59   table[34] = "ntdll.dll!ZwCreateDirectoryObject";
     60   table[35] = "ntdll.dll!NtCreateEvent";
     61   table[36] = "ntdll.dll!NtCreateEventPair";
     62   table[37] = "ntdll.dll!NtCreateFile";
     63   table[38] = "ntdll.dll!NtCreateIoCompletion";
     64   table[39] = "ntdll.dll!ZwCreateJobObject";
     65   table[40] = "ntdll.dll!NtCreateJobSet";
     66   table[41] = "ntdll.dll!ZwCreateKey";
     67   table[42] = "ntdll.dll!ZwCreateMailslotFile";
     68   table[43] = "ntdll.dll!ZwCreateMutant";
     69   table[44] = "ntdll.dll!ZwCreateNamedPipeFile";
     70   table[45] = "ntdll.dll!NtCreatePagingFile";
     71   table[46] = "ntdll.dll!ZwCreatePort";
     72   table[47] = "ntdll.dll!ZwCreateProcess";
     73   table[48] = "ntdll.dll!ZwCreateProcessEx";
     74   table[49] = "ntdll.dll!ZwCreateProfile";
     75   table[50] = "ntdll.dll!NtCreateSection";
     76   table[51] = "ntdll.dll!NtCreateSemaphore";
     77   table[52] = "ntdll.dll!ZwCreateSymbolicLinkObject";
     78   table[53] = "ntdll.dll!NtCreateThread";
     79   table[54] = "ntdll.dll!ZwCreateTimer";
     80   table[55] = "ntdll.dll!NtCreateToken";
     81   table[56] = "ntdll.dll!ZwCreateWaitablePort";
     82   table[57] = "ntdll.dll!NtDebugActiveProcess";
     83   table[58] = "ntdll.dll!ZwDebugContinue";
     84   table[59] = "ntdll.dll!ZwDelayExecution";
     85   table[60] = "ntdll.dll!ZwDeleteAtom";
     86   table[61] = "ntdll.dll!NtDeleteBootEntry";
     87   table[62] = "ntdll.dll!NtDeleteFile";
     88   table[63] = "ntdll.dll!ZwDeleteKey";
     89   table[64] = "ntdll.dll!NtDeleteObjectAuditAlarm";
     90   table[65] = "ntdll.dll!NtDeleteValueKey";
     91   table[66] = "ntdll.dll!ZwDeviceIoControlFile";
     92   table[67] = "ntdll.dll!NtDisplayString";
     93   table[68] = "ntdll.dll!ZwDuplicateObject";
     94   table[69] = "ntdll.dll!NtDuplicateToken";
     95   table[70] = "ntdll.dll!ZwEnumerateBootEntries";
     96   table[71] = "ntdll.dll!ZwEnumerateKey";
     97   table[72] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx";
     98   table[73] = "ntdll.dll!NtEnumerateValueKey";
     99   table[74] = "ntdll.dll!ZwExtendSection";
    100   table[75] = "ntdll.dll!NtFilterToken";
    101   table[76] = "ntdll.dll!NtFindAtom";
    102   table[77] = "ntdll.dll!ZwFlushBuffersFile";
    103   table[78] = "ntdll.dll!ZwFlushInstructionCache";
    104   table[79] = "ntdll.dll!NtFlushKey";
    105   table[80] = "ntdll.dll!ZwFlushVirtualMemory";
    106   table[81] = "ntdll.dll!NtFlushWriteBuffer";
    107   table[82] = "ntdll.dll!NtFreeUserPhysicalPages";
    108   table[83] = "ntdll.dll!NtFreeVirtualMemory";
    109   table[84] = "ntdll.dll!NtFsControlFile";
    110   table[85] = "ntdll.dll!NtGetContextThread";
    111   table[86] = "ntdll.dll!NtGetDevicePowerState";
    112   table[87] = "ntdll.dll!ZwGetPlugPlayEvent";
    113   table[88] = "ntdll.dll!NtGetWriteWatch";
    114   table[89] = "ntdll.dll!NtImpersonateAnonymousToken";
    115   table[90] = "ntdll.dll!ZwImpersonateClientOfPort";
    116   table[91] = "ntdll.dll!ZwImpersonateThread";
    117   table[92] = "ntdll.dll!ZwInitializeRegistry";
    118   table[93] = "ntdll.dll!NtInitiatePowerAction";
    119   table[94] = "ntdll.dll!ZwIsProcessInJob";
    120   table[95] = "ntdll.dll!NtIsSystemResumeAutomatic";
    121   table[96] = "ntdll.dll!ZwListenPort";
    122   table[97] = "ntdll.dll!NtLoadDriver";
    123   table[98] = "ntdll.dll!NtLoadKey";
    124   table[99] = "ntdll.dll!NtLoadKey2";
    125   table[100] = "ntdll.dll!NtLockFile";
    126   table[101] = "ntdll.dll!ZwLockProductActivationKeys";
    127   table[102] = "ntdll.dll!NtLockRegistryKey";
    128   table[103] = "ntdll.dll!ZwLockVirtualMemory";
    129   table[104] = "ntdll.dll!ZwMakePermanentObject";
    130   table[105] = "ntdll.dll!NtMakeTemporaryObject";
    131   table[106] = "ntdll.dll!NtMapUserPhysicalPages";
    132   table[107] = "ntdll.dll!ZwMapUserPhysicalPagesScatter";
    133   table[108] = "ntdll.dll!ZwMapViewOfSection";
    134   table[109] = "ntdll.dll!NtModifyBootEntry";
    135   table[110] = "ntdll.dll!NtNotifyChangeDirectoryFile";
    136   table[111] = "ntdll.dll!NtNotifyChangeKey";
    137   table[112] = "ntdll.dll!NtNotifyChangeMultipleKeys";
    138   table[113] = "ntdll.dll!ZwOpenDirectoryObject";
    139   table[114] = "ntdll.dll!NtOpenEvent";
    140   table[115] = "ntdll.dll!NtOpenEventPair";
    141   table[116] = "ntdll.dll!NtOpenFile";
    142   table[117] = "ntdll.dll!ZwOpenIoCompletion";
    143   table[118] = "ntdll.dll!ZwOpenJobObject";
    144   table[119] = "ntdll.dll!ZwOpenKey";
    145   table[120] = "ntdll.dll!NtOpenMutant";
    146   table[121] = "ntdll.dll!ZwOpenObjectAuditAlarm";
    147   table[122] = "ntdll.dll!ZwOpenProcess";
    148   table[123] = "ntdll.dll!ZwOpenProcessToken";
    149   table[124] = "ntdll.dll!ZwOpenProcessTokenEx";
    150   table[125] = "ntdll.dll!NtOpenSection";
    151   table[126] = "ntdll.dll!NtOpenSemaphore";
    152   table[127] = "ntdll.dll!NtOpenSymbolicLinkObject";
    153   table[128] = "ntdll.dll!ZwOpenThread";
    154   table[129] = "ntdll.dll!NtOpenThreadToken";
    155   table[130] = "ntdll.dll!NtOpenThreadTokenEx";
    156   table[131] = "ntdll.dll!ZwOpenTimer";
    157   table[132] = "ntdll.dll!NtPlugPlayControl";
    158   table[133] = "ntdll.dll!ZwPowerInformation";
    159   table[134] = "ntdll.dll!ZwPrivilegeCheck";
    160   table[135] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm";
    161   table[136] = "ntdll.dll!NtPrivilegedServiceAuditAlarm";
    162   table[137] = "ntdll.dll!ZwProtectVirtualMemory";
    163   table[138] = "ntdll.dll!ZwPulseEvent";
    164   table[139] = "ntdll.dll!ZwQueryAttributesFile";
    165   table[140] = "ntdll.dll!ZwQueryBootEntryOrder";
    166   table[141] = "ntdll.dll!ZwQueryBootOptions";
    167   table[142] = "ntdll.dll!NtQueryDebugFilterState";
    168   table[143] = "ntdll.dll!NtQueryDefaultLocale";
    169   table[144] = "ntdll.dll!ZwQueryDefaultUILanguage";
    170   table[145] = "ntdll.dll!ZwQueryDirectoryFile";
    171   table[146] = "ntdll.dll!ZwQueryDirectoryObject";
    172   table[147] = "ntdll.dll!ZwQueryEaFile";
    173   table[148] = "ntdll.dll!NtQueryEvent";
    174   table[149] = "ntdll.dll!ZwQueryFullAttributesFile";
    175   table[150] = "ntdll.dll!NtQueryInformationAtom";
    176   table[151] = "ntdll.dll!ZwQueryInformationFile";
    177   table[152] = "ntdll.dll!ZwQueryInformationJobObject";
    178   table[153] = "ntdll.dll!ZwQueryInformationPort";
    179   table[154] = "ntdll.dll!ZwQueryInformationProcess";
    180   table[155] = "ntdll.dll!NtQueryInformationThread";
    181   table[156] = "ntdll.dll!ZwQueryInformationToken";
    182   table[157] = "ntdll.dll!NtQueryInstallUILanguage";
    183   table[158] = "ntdll.dll!NtQueryIntervalProfile";
    184   table[159] = "ntdll.dll!NtQueryIoCompletion";
    185   table[160] = "ntdll.dll!ZwQueryKey";
    186   table[161] = "ntdll.dll!NtQueryMultipleValueKey";
    187   table[162] = "ntdll.dll!NtQueryMutant";
    188   table[163] = "ntdll.dll!NtQueryObject";
    189   table[164] = "ntdll.dll!NtQueryOpenSubKeys";
    190   table[165] = "ntdll.dll!NtQueryPerformanceCounter";
    191   table[166] = "ntdll.dll!ZwQueryQuotaInformationFile";
    192   table[167] = "ntdll.dll!ZwQuerySection";
    193   table[168] = "ntdll.dll!NtQuerySecurityObject";
    194   table[169] = "ntdll.dll!ZwQuerySemaphore";
    195   table[170] = "ntdll.dll!ZwQuerySymbolicLinkObject";
    196   table[171] = "ntdll.dll!ZwQuerySystemEnvironmentValue";
    197   table[172] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx";
    198   table[173] = "ntdll.dll!NtQuerySystemInformation";
    199   table[174] = "ntdll.dll!NtQuerySystemTime";
    200   table[175] = "ntdll.dll!ZwQueryTimer";
    201   table[176] = "ntdll.dll!NtQueryTimerResolution";
    202   table[177] = "ntdll.dll!ZwQueryValueKey";
    203   table[178] = "ntdll.dll!NtQueryVirtualMemory";
    204   table[179] = "ntdll.dll!NtQueryVolumeInformationFile";
    205   table[180] = "ntdll.dll!NtQueueApcThread";
    206   table[181] = "ntdll.dll!ZwRaiseException";
    207   table[182] = "ntdll.dll!ZwRaiseHardError";
    208   table[183] = "ntdll.dll!NtReadFile";
    209   table[184] = "ntdll.dll!NtReadFileScatter";
    210   table[185] = "ntdll.dll!ZwReadRequestData";
    211   table[186] = "ntdll.dll!NtReadVirtualMemory";
    212   table[187] = "ntdll.dll!ZwRegisterThreadTerminatePort";
    213   table[188] = "ntdll.dll!ZwReleaseMutant";
    214   table[189] = "ntdll.dll!NtReleaseSemaphore";
    215   table[190] = "ntdll.dll!ZwRemoveIoCompletion";
    216   table[191] = "ntdll.dll!ZwRemoveProcessDebug";
    217   table[192] = "ntdll.dll!ZwRenameKey";
    218   table[193] = "ntdll.dll!ZwReplaceKey";
    219   table[194] = "ntdll.dll!ZwReplyPort";
    220   table[195] = "ntdll.dll!NtReplyWaitReceivePort";
    221   table[196] = "ntdll.dll!NtReplyWaitReceivePortEx";
    222   table[197] = "ntdll.dll!NtReplyWaitReplyPort";
    223   table[198] = "ntdll.dll!ZwRequestDeviceWakeup";
    224   table[199] = "ntdll.dll!ZwRequestPort";
    225   table[200] = "ntdll.dll!NtRequestWaitReplyPort";
    226   table[201] = "ntdll.dll!ZwRequestWakeupLatency";
    227   table[202] = "ntdll.dll!NtResetEvent";
    228   table[203] = "ntdll.dll!ZwResetWriteWatch";
    229   table[204] = "ntdll.dll!NtRestoreKey";
    230   table[205] = "ntdll.dll!ZwResumeProcess";
    231   table[206] = "ntdll.dll!ZwResumeThread";
    232   table[207] = "ntdll.dll!NtSaveKey";
    233   table[208] = "ntdll.dll!NtSaveKeyEx";
    234   table[209] = "ntdll.dll!NtSaveMergedKeys";
    235   table[210] = "ntdll.dll!NtSecureConnectPort";
    236   table[211] = "ntdll.dll!ZwSetBootEntryOrder";
    237   table[212] = "ntdll.dll!ZwSetBootOptions";
    238   table[213] = "ntdll.dll!ZwSetContextThread";
    239   table[214] = "ntdll.dll!NtSetDebugFilterState";
    240   table[215] = "ntdll.dll!NtSetDefaultHardErrorPort";
    241   table[216] = "ntdll.dll!NtSetDefaultLocale";
    242   table[217] = "ntdll.dll!ZwSetDefaultUILanguage";
    243   table[218] = "ntdll.dll!ZwSetEaFile";
    244   table[219] = "ntdll.dll!NtSetEvent";
    245   table[220] = "ntdll.dll!NtSetEventBoostPriority";
    246   table[221] = "ntdll.dll!NtSetHighEventPair";
    247   table[222] = "ntdll.dll!NtSetHighWaitLowEventPair";
    248   table[223] = "ntdll.dll!ZwSetInformationDebugObject";
    249   table[224] = "ntdll.dll!ZwSetInformationFile";
    250   table[225] = "ntdll.dll!ZwSetInformationJobObject";
    251   table[226] = "ntdll.dll!ZwSetInformationKey";
    252   table[227] = "ntdll.dll!ZwSetInformationObject";
    253   table[228] = "ntdll.dll!ZwSetInformationProcess";
    254   table[229] = "ntdll.dll!ZwSetInformationThread";
    255   table[230] = "ntdll.dll!ZwSetInformationToken";
    256   table[231] = "ntdll.dll!NtSetIntervalProfile";
    257   table[232] = "ntdll.dll!NtSetIoCompletion";
    258   table[233] = "ntdll.dll!ZwSetLdtEntries";
    259   table[234] = "ntdll.dll!ZwSetLowEventPair";
    260   table[235] = "ntdll.dll!ZwSetLowWaitHighEventPair";
    261   table[236] = "ntdll.dll!ZwSetQuotaInformationFile";
    262   table[237] = "ntdll.dll!NtSetSecurityObject";
    263   table[238] = "ntdll.dll!ZwSetSystemEnvironmentValue";
    264   table[239] = "ntdll.dll!ZwSetSystemEnvironmentValueEx";
    265   table[240] = "ntdll.dll!ZwSetSystemInformation";
    266   table[241] = "ntdll.dll!ZwSetSystemPowerState";
    267   table[242] = "ntdll.dll!ZwSetSystemTime";
    268   table[243] = "ntdll.dll!ZwSetThreadExecutionState";
    269   table[244] = "ntdll.dll!ZwSetTimer";
    270   table[245] = "ntdll.dll!NtSetTimerResolution";
    271   table[246] = "ntdll.dll!ZwSetUuidSeed";
    272   table[247] = "ntdll.dll!ZwSetValueKey";
    273   table[248] = "ntdll.dll!NtSetVolumeInformationFile";
    274   table[249] = "ntdll.dll!ZwShutdownSystem";
    275   table[250] = "ntdll.dll!ZwSignalAndWaitForSingleObject";
    276   table[251] = "ntdll.dll!NtStartProfile";
    277   table[252] = "ntdll.dll!ZwStopProfile";
    278   table[253] = "ntdll.dll!ZwSuspendProcess";
    279   table[254] = "ntdll.dll!ZwSuspendThread";
    280   table[255] = "ntdll.dll!NtSystemDebugControl";
    281   table[256] = "ntdll.dll!ZwTerminateJobObject";
    282   table[257] = "ntdll.dll!ZwTerminateProcess";
    283   table[258] = "ntdll.dll!ZwTerminateThread";
    284   table[259] = "ntdll.dll!NtTestAlert";
    285   table[260] = "ntdll.dll!NtTraceEvent";
    286   table[261] = "ntdll.dll!NtTranslateFilePath";
    287   table[262] = "ntdll.dll!ZwUnloadDriver";
    288   table[263] = "ntdll.dll!NtUnloadKey";
    289   table[264] = "ntdll.dll!ZwUnloadKeyEx";
    290   table[265] = "ntdll.dll!ZwUnlockFile";
    291   table[266] = "ntdll.dll!NtUnlockVirtualMemory";
    292   table[267] = "ntdll.dll!NtUnmapViewOfSection";
    293   table[268] = "ntdll.dll!NtVdmControl";
    294   table[269] = "ntdll.dll!NtWaitForDebugEvent";
    295   table[270] = "ntdll.dll!NtWaitForMultipleObjects";
    296   table[271] = "ntdll.dll!ZwWaitForSingleObject";
    297   table[272] = "ntdll.dll!ZwWaitHighEventPair";
    298   table[273] = "ntdll.dll!NtWaitLowEventPair";
    299   table[274] = "ntdll.dll!NtWriteFile";
    300   table[275] = "ntdll.dll!NtWriteFileGather";
    301   table[276] = "ntdll.dll!NtWriteRequestData";
    302   table[277] = "ntdll.dll!NtWriteVirtualMemory";
    303   table[278] = "ntdll.dll!ZwYieldExecution";
    304   table[279] = "ntdll.dll!ZwCreateKeyedEvent";
    305   table[280] = "ntdll.dll!NtOpenKeyedEvent";
    306   table[281] = "ntdll.dll!NtReleaseKeyedEvent";
    307   table[282] = "ntdll.dll!NtWaitForKeyedEvent";
    308   table[283] = "ntdll.dll!ZwQueryPortInformationProcess";
    309   table[4096] = "gdi32.dll!NtGdiAbortDoc";
    310   table[4097] = "gdi32.dll!NtGdiAbortPath";
    311   table[4098] = "gdi32.dll!NtGdiAddFontResourceW";
    312   table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC";
    313   table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx";
    314   table[4101] = "gdi32.dll!NtGdiRemoveMergeFont";
    315   table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC";
    316   table[4103] = "gdi32.dll!NtGdiAlphaBlend";
    317   table[4104] = "gdi32.dll!NtGdiAngleArc";
    318   table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts";
    319   table[4106] = "gdi32.dll!NtGdiFontIsLinked";
    320   table[4107] = "gdi32.dll!NtGdiArcInternal";
    321   table[4108] = "gdi32.dll!NtGdiBeginPath";
    322   table[4109] = "gdi32.dll!NtGdiBitBlt";
    323   table[4110] = "gdi32.dll!NtGdiCancelDC";
    324   table[4111] = "gdi32.dll!NtGdiCheckBitmapBits";
    325   table[4112] = "gdi32.dll!NtGdiCloseFigure";
    326   table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes";
    327   table[4114] = "gdi32.dll!NtGdiClearBrushAttributes";
    328   table[4115] = "gdi32.dll!NtGdiColorCorrectPalette";
    329   table[4116] = "gdi32.dll!NtGdiCombineRgn";
    330   table[4117] = "gdi32.dll!CombineTransform";
    331   table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients";
    332   table[4119] = "gdi32.dll!NtGdiConsoleTextOut";
    333   table[4120] = "gdi32.dll!NtGdiConvertMetafileRect";
    334   table[4121] = "gdi32.dll!NtGdiCreateBitmap";
    335   table[4122] = "gdi32.dll!NtGdiCreateClientObj";
    336   table[4123] = "gdi32.dll!NtGdiCreateColorSpace";
    337   table[4124] = "gdi32.dll!NtGdiCreateColorTransform";
    338   table[4125] = "gdi32.dll!NtGdiCreateCompatibleBitmap";
    339   table[4126] = "gdi32.dll!NtGdiCreateCompatibleDC";
    340   table[4127] = "gdi32.dll!NtGdiCreateDIBBrush";
    341   table[4128] = "gdi32.dll!NtGdiCreateDIBitmapInternal";
    342   table[4129] = "gdi32.dll!NtGdiCreateDIBSection";
    343   table[4130] = "gdi32.dll!NtGdiCreateEllipticRgn";
    344   table[4131] = "gdi32.dll!NtGdiCreateHalftonePalette";
    345   table[4132] = "gdi32.dll!NtGdiCreateHatchBrushInternal";
    346   table[4133] = "gdi32.dll!NtGdiCreateMetafileDC";
    347   table[4134] = "gdi32.dll!NtGdiCreatePaletteInternal";
    348   table[4135] = "gdi32.dll!NtGdiCreatePatternBrushInternal";
    349   table[4136] = "gdi32.dll!CreatePen";
    350   table[4137] = "gdi32.dll!NtGdiCreateRectRgn";
    351   table[4138] = "gdi32.dll!CreateRoundRectRgn";
    352   table[4139] = "gdi32.dll!NtGdiCreateServerMetaFile";
    353   table[4140] = "gdi32.dll!NtGdiCreateSolidBrush";
    354   table[4141] = "gdi32.dll!NtGdiD3dContextCreate";
    355   table[4142] = "gdi32.dll!NtGdiD3dContextDestroy";
    356   table[4143] = "gdi32.dll!NtGdiD3dContextDestroyAll";
    357   table[4144] = "gdi32.dll!NtGdiD3dValidateTextureStageState";
    358   table[4145] = "gdi32.dll!NtGdiD3dDrawPrimitives2";
    359   table[4146] = "gdi32.dll!NtGdiDdGetDriverState";
    360   table[4147] = "gdi32.dll!NtGdiDdAddAttachedSurface";
    361   table[4148] = "gdi32.dll!NtGdiDdAlphaBlt";
    362   table[4149] = "gdi32.dll!NtGdiDdAttachSurface";
    363   table[4150] = "gdi32.dll!NtGdiDdBeginMoCompFrame";
    364   table[4151] = "gdi32.dll!NtGdiDdBlt";
    365   table[4152] = "gdi32.dll!NtGdiDdCanCreateSurface";
    366   table[4153] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer";
    367   table[4154] = "gdi32.dll!NtGdiDdColorControl";
    368   table[4155] = "gdi32.dll!NtGdiDdCreateDirectDrawObject";
    369   table[4156] = "gdi32.dll!NtGdiDdCreateSurface";
    370   table[4157] = "gdi32.dll!NtGdiDdCreateD3DBuffer";
    371   table[4158] = "gdi32.dll!NtGdiDdCreateMoComp";
    372   table[4159] = "gdi32.dll!NtGdiDdCreateSurfaceObject";
    373   table[4160] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject";
    374   table[4161] = "gdi32.dll!NtGdiDdDeleteSurfaceObject";
    375   table[4162] = "gdi32.dll!NtGdiDdDestroyMoComp";
    376   table[4163] = "gdi32.dll!NtGdiDdDestroySurface";
    377   table[4164] = "gdi32.dll!NtGdiDdDestroyD3DBuffer";
    378   table[4165] = "gdi32.dll!NtGdiDdEndMoCompFrame";
    379   table[4166] = "gdi32.dll!NtGdiDdFlip";
    380   table[4167] = "gdi32.dll!NtGdiDdFlipToGDISurface";
    381   table[4168] = "gdi32.dll!NtGdiDdGetAvailDriverMemory";
    382   table[4169] = "gdi32.dll!NtGdiDdGetBltStatus";
    383   table[4170] = "gdi32.dll!NtGdiDdGetDC";
    384   table[4171] = "gdi32.dll!NtGdiDdGetDriverInfo";
    385   table[4172] = "gdi32.dll!NtGdiDdGetDxHandle";
    386   table[4173] = "gdi32.dll!NtGdiDdGetFlipStatus";
    387   table[4174] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo";
    388   table[4175] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo";
    389   table[4176] = "gdi32.dll!NtGdiDdGetMoCompGuids";
    390   table[4177] = "gdi32.dll!NtGdiDdGetMoCompFormats";
    391   table[4178] = "gdi32.dll!NtGdiDdGetScanLine";
    392   table[4179] = "gdi32.dll!NtGdiDdLock";
    393   table[4180] = "gdi32.dll!NtGdiDdLockD3D";
    394   table[4181] = "gdi32.dll!NtGdiDdQueryDirectDrawObject";
    395   table[4182] = "gdi32.dll!NtGdiDdQueryMoCompStatus";
    396   table[4183] = "gdi32.dll!NtGdiDdReenableDirectDrawObject";
    397   table[4184] = "gdi32.dll!NtGdiDdReleaseDC";
    398   table[4185] = "gdi32.dll!NtGdiDdRenderMoComp";
    399   table[4186] = "gdi32.dll!NtGdiDdResetVisrgn";
    400   table[4187] = "gdi32.dll!NtGdiDdSetColorKey";
    401   table[4188] = "gdi32.dll!NtGdiDdSetExclusiveMode";
    402   table[4189] = "gdi32.dll!NtGdiDdSetGammaRamp";
    403   table[4190] = "gdi32.dll!NtGdiDdCreateSurfaceEx";
    404   table[4191] = "gdi32.dll!NtGdiDdSetOverlayPosition";
    405   table[4192] = "gdi32.dll!NtGdiDdUnattachSurface";
    406   table[4193] = "gdi32.dll!NtGdiDdUnlock";
    407   table[4194] = "gdi32.dll!NtGdiDdUnlockD3D";
    408   table[4195] = "gdi32.dll!NtGdiDdUpdateOverlay";
    409   table[4196] = "gdi32.dll!NtGdiDdWaitForVerticalBlank";
    410   table[4197] = "gdi32.dll!NtGdiDvpCanCreateVideoPort";
    411   table[4198] = "gdi32.dll!NtGdiDvpColorControl";
    412   table[4199] = "gdi32.dll!NtGdiDvpCreateVideoPort";
    413   table[4200] = "gdi32.dll!NtGdiDvpDestroyVideoPort";
    414   table[4201] = "gdi32.dll!NtGdiDvpFlipVideoPort";
    415   table[4202] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth";
    416   table[4203] = "gdi32.dll!NtGdiDvpGetVideoPortField";
    417   table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus";
    418   table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats";
    419   table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortLine";
    420   table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats";
    421   table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo";
    422   table[4209] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus";
    423   table[4210] = "gdi32.dll!NtGdiDvpUpdateVideoPort";
    424   table[4211] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync";
    425   table[4212] = "gdi32.dll!NtGdiDvpAcquireNotification";
    426   table[4213] = "gdi32.dll!NtGdiDvpReleaseNotification";
    427   table[4214] = "gdi32.dll!NtGdiDxgGenericThunk";
    428   table[4215] = "gdi32.dll!NtGdiDeleteClientObj";
    429   table[4216] = "gdi32.dll!NtGdiDeleteColorSpace";
    430   table[4217] = "gdi32.dll!NtGdiDeleteColorTransform";
    431   table[4218] = "gdi32.dll!DeleteObject";
    432   table[4219] = "gdi32.dll!NtGdiDescribePixelFormat";
    433   table[4220] = "gdi32.dll!NtGdiGetPerBandInfo";
    434   table[4221] = "gdi32.dll!NtGdiDoBanding";
    435   table[4222] = "gdi32.dll!NtGdiDoPalette";
    436   table[4223] = "gdi32.dll!NtGdiDrawEscape";
    437   table[4224] = "gdi32.dll!NtGdiEllipse";
    438   table[4225] = "gdi32.dll!NtGdiEnableEudc";
    439   table[4226] = "gdi32.dll!NtGdiEndDoc";
    440   table[4227] = "gdi32.dll!NtGdiEndPage";
    441   table[4228] = "gdi32.dll!NtGdiEndPath";
    442   table[4229] = "gdi32.dll!NtGdiEnumFontChunk";
    443   table[4230] = "gdi32.dll!NtGdiEnumFontClose";
    444   table[4231] = "gdi32.dll!NtGdiEnumFontOpen";
    445   table[4232] = "gdi32.dll!NtGdiEnumObjects";
    446   table[4233] = "gdi32.dll!NtGdiEqualRgn";
    447   table[4234] = "gdi32.dll!NtGdiEudcLoadUnloadLink";
    448   table[4235] = "gdi32.dll!NtGdiExcludeClipRect";
    449   table[4236] = "gdi32.dll!NtGdiExtCreatePen";
    450   table[4237] = "gdi32.dll!NtGdiExtCreateRegion";
    451   table[4238] = "gdi32.dll!NtGdiExtEscape";
    452   table[4239] = "gdi32.dll!NtGdiExtFloodFill";
    453   table[4240] = "gdi32.dll!NtGdiExtGetObjectW";
    454   table[4241] = "gdi32.dll!ExtSelectClipRgn";
    455   table[4242] = "gdi32.dll!NtGdiExtTextOutW";
    456   table[4243] = "gdi32.dll!NtGdiFillPath";
    457   table[4244] = "gdi32.dll!NtGdiFillRgn";
    458   table[4245] = "gdi32.dll!NtGdiFlattenPath";
    459   table[4247] = "gdi32.dll!NtGdiFlush";
    460   table[4248] = "gdi32.dll!NtGdiForceUFIMapping";
    461   table[4249] = "gdi32.dll!NtGdiFrameRgn";
    462   table[4250] = "gdi32.dll!NtGdiFullscreenControl";
    463   table[4251] = "gdi32.dll!NtGdiGetAndSetDCDword";
    464   table[4252] = "gdi32.dll!GetClipBox";
    465   table[4253] = "gdi32.dll!GetBitmapBits";
    466   table[4254] = "gdi32.dll!NtGdiGetBitmapDimension";
    467   table[4255] = "gdi32.dll!NtGdiGetBoundsRect";
    468   table[4256] = "gdi32.dll!NtGdiGetCharABCWidthsW";
    469   table[4257] = "gdi32.dll!NtGdiGetCharacterPlacementW";
    470   table[4258] = "gdi32.dll!NtGdiGetCharSet";
    471   table[4259] = "gdi32.dll!NtGdiGetCharWidthW";
    472   table[4260] = "gdi32.dll!NtGdiGetCharWidthInfo";
    473   table[4261] = "gdi32.dll!NtGdiGetColorAdjustment";
    474   table[4263] = "gdi32.dll!NtGdiGetDCDword";
    475   table[4264] = "gdi32.dll!NtGdiGetDCforBitmap";
    476   table[4265] = "gdi32.dll!NtGdiGetDCObject";
    477   table[4266] = "gdi32.dll!NtGdiGetDCPoint";
    478   table[4267] = "gdi32.dll!NtGdiGetDeviceCaps";
    479   table[4268] = "gdi32.dll!NtGdiGetDeviceGammaRamp";
    480   table[4269] = "gdi32.dll!NtGdiGetDeviceCapsAll";
    481   table[4270] = "gdi32.dll!NtGdiGetDIBitsInternal";
    482   table[4271] = "gdi32.dll!NtGdiGetETM";
    483   table[4272] = "gdi32.dll!NtGdiGetEudcTimeStampEx";
    484   table[4273] = "gdi32.dll!GetFontData";
    485   table[4274] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW";
    486   table[4275] = "gdi32.dll!NtGdiGetGlyphIndicesW";
    487   table[4276] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal";
    488   table[4277] = "gdi32.dll!NtGdiGetGlyphOutline";
    489   table[4278] = "gdi32.dll!NtGdiGetKerningPairs";
    490   table[4279] = "gdi32.dll!NtGdiGetLinkedUFIs";
    491   table[4280] = "gdi32.dll!GetMiterLimit";
    492   table[4281] = "gdi32.dll!NtGdiGetMonitorID";
    493   table[4282] = "gdi32.dll!GetNearestColor";
    494   table[4283] = "gdi32.dll!NtGdiGetNearestPaletteIndex";
    495   table[4284] = "gdi32.dll!NtGdiGetObjectBitmapHandle";
    496   table[4285] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW";
    497   table[4286] = "gdi32.dll!NtGdiGetPath";
    498   table[4287] = "gdi32.dll!NtGdiGetPixel";
    499   table[4288] = "gdi32.dll!NtGdiGetRandomRgn";
    500   table[4289] = "gdi32.dll!GetRasterizerCaps";
    501   table[4290] = "gdi32.dll!NtGdiGetRealizationInfo";
    502   table[4291] = "gdi32.dll!GetRegionData";
    503   table[4292] = "gdi32.dll!NtGdiGetRgnBox";
    504   table[4293] = "gdi32.dll!NtGdiGetServerMetaFileBits";
    505   table[4294] = "gdi32.dll!NtGdiGetSpoolMessage";
    506   table[4296] = "gdi32.dll!NtGdiGetStockObject";
    507   table[4297] = "gdi32.dll!NtGdiGetStringBitmapW";
    508   table[4298] = "gdi32.dll!GetSystemPaletteUse";
    509   table[4299] = "gdi32.dll!NtGdiGetTextCharsetInfo";
    510   table[4300] = "gdi32.dll!NtGdiGetTextExtent";
    511   table[4301] = "gdi32.dll!NtGdiGetTextExtentExW";
    512   table[4302] = "gdi32.dll!NtGdiGetTextFaceW";
    513   table[4303] = "gdi32.dll!NtGdiGetTextMetricsW";
    514   table[4304] = "gdi32.dll!NtGdiGetTransform";
    515   table[4305] = "gdi32.dll!NtGdiGetUFI";
    516   table[4306] = "gdi32.dll!NtGdiGetEmbUFI";
    517   table[4307] = "gdi32.dll!NtGdiGetUFIPathname";
    518   table[4308] = "gdi32.dll!NtGdiGetEmbedFonts";
    519   table[4309] = "gdi32.dll!NtGdiChangeGhostFont";
    520   table[4310] = "gdi32.dll!NtGdiAddEmbFontToDC";
    521   table[4311] = "gdi32.dll!NtGdiGetFontUnicodeRanges";
    522   table[4312] = "gdi32.dll!NtGdiGetWidthTable";
    523   table[4313] = "gdi32.dll!NtGdiGradientFill";
    524   table[4314] = "gdi32.dll!NtGdiHfontCreate";
    525   table[4315] = "gdi32.dll!NtGdiIcmBrushInfo";
    526   table[4316] = "gdi32.dll!NtGdiInit";
    527   table[4317] = "gdi32.dll!NtGdiInitSpool";
    528   table[4318] = "gdi32.dll!NtGdiIntersectClipRect";
    529   table[4319] = "gdi32.dll!NtGdiInvertRgn";
    530   table[4320] = "gdi32.dll!NtGdiLineTo";
    531   table[4321] = "gdi32.dll!NtGdiMakeFontDir";
    532   table[4322] = "gdi32.dll!NtGdiMakeInfoDC";
    533   table[4323] = "gdi32.dll!NtGdiMaskBlt";
    534   table[4324] = "gdi32.dll!NtGdiModifyWorldTransform";
    535   table[4325] = "gdi32.dll!NtGdiMonoBitmap";
    536   table[4327] = "gdi32.dll!NtGdiOffsetClipRgn";
    537   table[4328] = "gdi32.dll!NtGdiOffsetRgn";
    538   table[4329] = "gdi32.dll!NtGdiOpenDCW";
    539   table[4330] = "gdi32.dll!NtGdiPatBlt";
    540   table[4331] = "gdi32.dll!NtGdiPolyPatBlt";
    541   table[4332] = "gdi32.dll!NtGdiPathToRegion";
    542   table[4333] = "gdi32.dll!NtGdiPlgBlt";
    543   table[4334] = "gdi32.dll!NtGdiPolyDraw";
    544   table[4335] = "gdi32.dll!NtGdiPolyPolyDraw";
    545   table[4336] = "gdi32.dll!NtGdiPolyTextOutW";
    546   table[4337] = "gdi32.dll!NtGdiPtInRegion";
    547   table[4338] = "gdi32.dll!NtGdiPtVisible";
    548   table[4339] = "gdi32.dll!NtGdiQueryFonts";
    549   table[4340] = "gdi32.dll!NtGdiQueryFontAssocInfo";
    550   table[4341] = "gdi32.dll!NtGdiRectangle";
    551   table[4342] = "gdi32.dll!NtGdiRectInRegion";
    552   table[4343] = "gdi32.dll!RectVisible";
    553   table[4344] = "gdi32.dll!NtGdiRemoveFontResourceW";
    554   table[4345] = "gdi32.dll!NtGdiRemoveFontMemResourceEx";
    555   table[4346] = "gdi32.dll!NtGdiResetDC";
    556   table[4347] = "gdi32.dll!NtGdiResizePalette";
    557   table[4348] = "gdi32.dll!NtGdiRestoreDC";
    558   table[4349] = "gdi32.dll!NtGdiRoundRect";
    559   table[4350] = "gdi32.dll!NtGdiSaveDC";
    560   table[4351] = "gdi32.dll!NtGdiScaleViewportExtEx";
    561   table[4352] = "gdi32.dll!NtGdiScaleWindowExtEx";
    562   table[4353] = "gdi32.dll!NtGdiSelectBitmap";
    563   table[4355] = "gdi32.dll!NtGdiSelectClipPath";
    564   table[4356] = "gdi32.dll!NtGdiSelectFont";
    565   table[4357] = "gdi32.dll!NtGdiSelectPen";
    566   table[4358] = "gdi32.dll!NtGdiSetBitmapAttributes";
    567   table[4359] = "gdi32.dll!SetBitmapBits";
    568   table[4360] = "gdi32.dll!NtGdiSetBitmapDimension";
    569   table[4361] = "gdi32.dll!NtGdiSetBoundsRect";
    570   table[4362] = "gdi32.dll!NtGdiSetBrushAttributes";
    571   table[4363] = "gdi32.dll!NtGdiSetBrushOrg";
    572   table[4364] = "gdi32.dll!NtGdiSetColorAdjustment";
    573   table[4365] = "gdi32.dll!NtGdiSetColorSpace";
    574   table[4366] = "gdi32.dll!NtGdiSetDeviceGammaRamp";
    575   table[4367] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal";
    576   table[4368] = "gdi32.dll!NtGdiSetFontEnumeration";
    577   table[4369] = "gdi32.dll!NtGdiSetFontXform";
    578   table[4370] = "gdi32.dll!NtGdiSetIcmMode";
    579   table[4371] = "gdi32.dll!NtGdiSetLinkedUFIs";
    580   table[4372] = "gdi32.dll!NtGdiSetMagicColors";
    581   table[4373] = "gdi32.dll!NtGdiSetMetaRgn";
    582   table[4374] = "gdi32.dll!NtGdiSetMiterLimit";
    583   table[4375] = "gdi32.dll!NtGdiGetDeviceWidth";
    584   table[4376] = "gdi32.dll!NtGdiMirrorWindowOrg";
    585   table[4377] = "gdi32.dll!NtGdiSetLayout";
    586   table[4378] = "gdi32.dll!NtGdiSetPixel";
    587   table[4379] = "gdi32.dll!NtGdiSetPixelFormat";
    588   table[4380] = "gdi32.dll!NtGdiSetRectRgn";
    589   table[4381] = "gdi32.dll!NtGdiSetSystemPaletteUse";
    590   table[4383] = "gdi32.dll!NtGdiSetupPublicCFONT";
    591   table[4384] = "gdi32.dll!NtGdiSetVirtualResolution";
    592   table[4385] = "gdi32.dll!NtGdiSetSizeDevice";
    593   table[4386] = "gdi32.dll!NtGdiStartDoc";
    594   table[4387] = "gdi32.dll!NtGdiStartPage";
    595   table[4388] = "gdi32.dll!NtGdiStretchBlt";
    596   table[4389] = "gdi32.dll!NtGdiStretchDIBitsInternal";
    597   table[4390] = "gdi32.dll!NtGdiStrokeAndFillPath";
    598   table[4391] = "gdi32.dll!NtGdiStrokePath";
    599   table[4392] = "gdi32.dll!NtGdiSwapBuffers";
    600   table[4393] = "gdi32.dll!NtGdiTransformPoints";
    601   table[4394] = "gdi32.dll!NtGdiTransparentBlt";
    602   table[4395] = "gdi32.dll!NtGdiUnloadPrinterDriver";
    603   table[4397] = "gdi32.dll!NtGdiUnrealizeObject";
    604   table[4398] = "gdi32.dll!NtGdiUpdateColors";
    605   table[4399] = "gdi32.dll!NtGdiWidenPath";
    606   table[4400] = "user32.dll!NtUserActivateKeyboardLayout";
    607   table[4401] = "user32.dll!NtUserAlterWindowStyle";
    608   table[4402] = "imm32.dll!NtUserAssociateInputContext";
    609   table[4403] = "user32.dll!NtUserAttachThreadInput";
    610   table[4404] = "user32.dll!NtUserBeginPaint";
    611   table[4405] = "user32.dll!NtUserBitBltSysBmp";
    612   table[4406] = "user32.dll!NtUserBlockInput";
    613   table[4407] = "imm32.dll!NtUserBuildHimcList";
    614   table[4408] = "user32.dll!NtUserBuildHwndList";
    615   table[4409] = "user32.dll!NtUserBuildNameList";
    616   table[4410] = "user32.dll!NtUserBuildPropList";
    617   table[4411] = "user32.dll!NtUserCallHwnd";
    618   table[4412] = "user32.dll!NtUserCallHwndLock";
    619   table[4413] = "user32.dll!NtUserCallHwndOpt";
    620   table[4414] = "user32.dll!NtUserCallHwndParam";
    621   table[4415] = "user32.dll!NtUserCallHwndParamLock";
    622   table[4416] = "user32.dll!NtUserCallMsgFilter";
    623   table[4417] = "user32.dll!NtUserCallNextHookEx";
    624   table[4418] = "user32.dll!NtUserCallNoParam";
    625   table[4419] = "imm32.dll!NtUserCallOneParam";
    626   table[4419] = "user32.dll!NtUserCallOneParam";
    627   table[4420] = "user32.dll!NtUserCallTwoParam";
    628   table[4421] = "user32.dll!NtUserChangeClipboardChain";
    629   table[4422] = "user32.dll!NtUserChangeDisplaySettings";
    630   table[4424] = "user32.dll!NtUserCheckMenuItem";
    631   table[4425] = "user32.dll!NtUserChildWindowFromPointEx";
    632   table[4426] = "user32.dll!NtUserClipCursor";
    633   table[4427] = "user32.dll!NtUserCloseClipboard";
    634   table[4428] = "user32.dll!NtUserCloseDesktop";
    635   table[4429] = "user32.dll!NtUserCloseWindowStation";
    636   table[4431] = "user32.dll!NtUserConvertMemHandle";
    637   table[4432] = "user32.dll!NtUserCopyAcceleratorTable";
    638   table[4433] = "user32.dll!NtUserCountClipboardFormats";
    639   table[4434] = "user32.dll!NtUserCreateAcceleratorTable";
    640   table[4435] = "user32.dll!NtUserCreateCaret";
    641   table[4436] = "user32.dll!NtUserCreateDesktop";
    642   table[4437] = "imm32.dll!NtUserCreateInputContext";
    643   table[4438] = "user32.dll!NtUserCreateLocalMemHandle";
    644   table[4439] = "user32.dll!NtUserCreateWindowEx";
    645   table[4440] = "user32.dll!NtUserCreateWindowStation";
    646   table[4441] = "user32.dll!NtUserDdeGetQualityOfService";
    647   table[4442] = "user32.dll!NtUserDdeInitialize";
    648   table[4443] = "user32.dll!NtUserDdeSetQualityOfService";
    649   table[4444] = "user32.dll!NtUserDeferWindowPos";
    650   table[4445] = "user32.dll!NtUserDefSetText";
    651   table[4446] = "user32.dll!NtUserDeleteMenu";
    652   table[4447] = "user32.dll!DestroyAcceleratorTable";
    653   table[4448] = "user32.dll!NtUserDestroyCursor";
    654   table[4449] = "imm32.dll!NtUserDestroyInputContext";
    655   table[4450] = "user32.dll!NtUserDestroyMenu";
    656   table[4451] = "user32.dll!NtUserDestroyWindow";
    657   table[4452] = "imm32.dll!NtUserDisableThreadIme";
    658   table[4453] = "user32.dll!NtUserDispatchMessage";
    659   table[4454] = "user32.dll!NtUserDragDetect";
    660   table[4455] = "user32.dll!NtUserDragObject";
    661   table[4456] = "user32.dll!NtUserDrawAnimatedRects";
    662   table[4457] = "user32.dll!NtUserDrawCaption";
    663   table[4458] = "user32.dll!NtUserDrawCaptionTemp";
    664   table[4459] = "user32.dll!NtUserDrawIconEx";
    665   table[4460] = "user32.dll!NtUserDrawMenuBarTemp";
    666   table[4461] = "user32.dll!NtUserEmptyClipboard";
    667   table[4462] = "user32.dll!NtUserEnableMenuItem";
    668   table[4463] = "user32.dll!NtUserEnableScrollBar";
    669   table[4464] = "user32.dll!NtUserEndDeferWindowPosEx";
    670   table[4465] = "user32.dll!NtUserEndMenu";
    671   table[4466] = "user32.dll!NtUserEndPaint";
    672   table[4467] = "user32.dll!NtUserEnumDisplayDevices";
    673   table[4468] = "user32.dll!NtUserEnumDisplayMonitors";
    674   table[4469] = "user32.dll!NtUserEnumDisplaySettings";
    675   table[4470] = "user32.dll!NtUserEvent";
    676   table[4471] = "user32.dll!NtUserExcludeUpdateRgn";
    677   table[4472] = "user32.dll!NtUserFillWindow";
    678   table[4473] = "user32.dll!NtUserFindExistingCursorIcon";
    679   table[4474] = "user32.dll!NtUserFindWindowEx";
    680   table[4475] = "user32.dll!NtUserFlashWindowEx";
    681   table[4476] = "user32.dll!NtUserGetAltTabInfo";
    682   table[4477] = "user32.dll!NtUserGetAncestor";
    683   table[4478] = "imm32.dll!NtUserGetAppImeLevel";
    684   table[4479] = "user32.dll!GetAsyncKeyState";
    685   table[4480] = "user32.dll!NtUserGetAtomName";
    686   table[4481] = "user32.dll!NtUserGetCaretBlinkTime";
    687   table[4482] = "user32.dll!NtUserGetCaretPos";
    688   table[4483] = "user32.dll!NtUserGetClassInfo";
    689   table[4484] = "user32.dll!NtUserGetClassName";
    690   table[4485] = "user32.dll!NtUserGetClipboardData";
    691   table[4486] = "user32.dll!NtUserGetClipboardFormatName";
    692   table[4487] = "user32.dll!NtUserGetClipboardOwner";
    693   table[4488] = "user32.dll!NtUserGetClipboardSequenceNumber";
    694   table[4489] = "user32.dll!NtUserGetClipboardViewer";
    695   table[4490] = "user32.dll!NtUserGetClipCursor";
    696   table[4491] = "user32.dll!NtUserGetComboBoxInfo";
    697   table[4492] = "user32.dll!NtUserGetControlBrush";
    698   table[4493] = "user32.dll!NtUserGetControlColor";
    699   table[4494] = "user32.dll!NtUserGetCPD";
    700   table[4495] = "user32.dll!NtUserGetCursorFrameInfo";
    701   table[4496] = "user32.dll!NtUserGetCursorInfo";
    702   table[4497] = "user32.dll!NtUserGetDC";
    703   table[4498] = "user32.dll!NtUserGetDCEx";
    704   table[4499] = "user32.dll!NtUserGetDoubleClickTime";
    705   table[4500] = "user32.dll!NtUserGetForegroundWindow";
    706   table[4501] = "user32.dll!NtUserGetGuiResources";
    707   table[4502] = "user32.dll!NtUserGetGUIThreadInfo";
    708   table[4503] = "user32.dll!NtUserGetIconInfo";
    709   table[4504] = "user32.dll!NtUserGetIconSize";
    710   table[4505] = "imm32.dll!NtUserGetImeHotKey";
    711   table[4505] = "user32.dll!NtUserGetImeHotKey";
    712   table[4506] = "imm32.dll!NtUserGetImeInfoEx";
    713   table[4507] = "user32.dll!NtUserGetInternalWindowPos";
    714   table[4508] = "user32.dll!NtUserGetKeyboardLayoutList";
    715   table[4509] = "user32.dll!NtUserGetKeyboardLayoutName";
    716   table[4510] = "user32.dll!NtUserGetKeyboardState";
    717   table[4511] = "user32.dll!NtUserGetKeyNameText";
    718   table[4512] = "user32.dll!NtUserGetKeyState";
    719   table[4513] = "user32.dll!NtUserGetListBoxInfo";
    720   table[4514] = "user32.dll!NtUserGetMenuBarInfo";
    721   table[4515] = "user32.dll!NtUserGetMenuIndex";
    722   table[4516] = "user32.dll!NtUserGetMenuItemRect";
    723   table[4517] = "user32.dll!NtUserGetMessage";
    724   table[4518] = "user32.dll!NtUserGetMouseMovePointsEx";
    725   table[4519] = "user32.dll!NtUserGetObjectInformation";
    726   table[4520] = "user32.dll!NtUserGetOpenClipboardWindow";
    727   table[4521] = "user32.dll!NtUserGetPriorityClipboardFormat";
    728   table[4522] = "user32.dll!NtUserGetProcessWindowStation";
    729   table[4523] = "user32.dll!NtUserGetRawInputBuffer";
    730   table[4524] = "user32.dll!NtUserGetRawInputData";
    731   table[4525] = "user32.dll!NtUserGetRawInputDeviceInfo";
    732   table[4526] = "user32.dll!NtUserGetRawInputDeviceList";
    733   table[4527] = "user32.dll!NtUserGetRegisteredRawInputDevices";
    734   table[4528] = "user32.dll!NtUserGetScrollBarInfo";
    735   table[4529] = "user32.dll!NtUserGetSystemMenu";
    736   table[4530] = "user32.dll!NtUserGetThreadDesktop";
    737   table[4531] = "imm32.dll!NtUserGetThreadState";
    738   table[4531] = "user32.dll!NtUserGetThreadState";
    739   table[4532] = "user32.dll!NtUserGetTitleBarInfo";
    740   table[4533] = "user32.dll!GetUpdateRect";
    741   table[4534] = "user32.dll!GetUpdateRgn";
    742   table[4535] = "user32.dll!NtUserGetWindowDC";
    743   table[4536] = "user32.dll!NtUserGetWindowPlacement";
    744   table[4537] = "user32.dll!NtUserGetWOWClass";
    745   table[4539] = "user32.dll!NtUserHideCaret";
    746   table[4540] = "user32.dll!NtUserHiliteMenuItem";
    747   table[4541] = "user32.dll!NtUserImpersonateDdeClientWindow";
    748   table[4543] = "user32.dll!NtUserInitializeClientPfnArrays";
    749   table[4544] = "user32.dll!NtUserInitTask";
    750   table[4545] = "user32.dll!NtUserInternalGetWindowText";
    751   table[4546] = "user32.dll!NtUserInvalidateRect";
    752   table[4547] = "user32.dll!NtUserInvalidateRgn";
    753   table[4548] = "user32.dll!NtUserIsClipboardFormatAvailable";
    754   table[4549] = "user32.dll!NtUserKillTimer";
    755   table[4550] = "user32.dll!NtUserLoadKeyboardLayoutEx";
    756   table[4551] = "user32.dll!NtUserLockWindowStation";
    757   table[4552] = "user32.dll!NtUserLockWindowUpdate";
    758   table[4553] = "user32.dll!NtUserLockWorkStation";
    759   table[4554] = "user32.dll!NtUserMapVirtualKeyEx";
    760   table[4555] = "user32.dll!NtUserMenuItemFromPoint";
    761   table[4556] = "user32.dll!NtUserMessageCall";
    762   table[4557] = "user32.dll!NtUserMinMaximize";
    763   table[4558] = "user32.dll!NtUserMNDragLeave";
    764   table[4559] = "user32.dll!NtUserMNDragOver";
    765   table[4560] = "user32.dll!NtUserModifyUserStartupInfoFlags";
    766   table[4561] = "user32.dll!NtUserMoveWindow";
    767   table[4562] = "imm32.dll!NtUserNotifyIMEStatus";
    768   table[4562] = "user32.dll!NtUserNotifyIMEStatus";
    769   table[4564] = "user32.dll!NtUserNotifyWinEvent";
    770   table[4565] = "user32.dll!NtUserOpenClipboard";
    771   table[4566] = "user32.dll!NtUserOpenDesktop";
    772   table[4567] = "user32.dll!NtUserOpenInputDesktop";
    773   table[4568] = "user32.dll!NtUserOpenWindowStation";
    774   table[4569] = "user32.dll!NtUserPaintDesktop";
    775   table[4570] = "user32.dll!PeekMessageW";
    776   table[4571] = "user32.dll!NtUserPostMessage";
    777   table[4572] = "user32.dll!NtUserPostThreadMessage";
    778   table[4573] = "user32.dll!NtUserPrintWindow";
    779   table[4574] = "user32.dll!NtUserProcessConnect";
    780   table[4576] = "imm32.dll!NtUserQueryInputContext";
    781   table[4577] = "user32.dll!NtUserQuerySendMessage";
    782   table[4578] = "user32.dll!NtUserQueryUserCounters";
    783   table[4579] = "imm32.dll!NtUserQueryWindow";
    784   table[4579] = "user32.dll!NtUserQueryWindow";
    785   table[4580] = "user32.dll!NtUserRealChildWindowFromPoint";
    786   table[4581] = "user32.dll!NtUserRealInternalGetMessage";
    787   table[4582] = "user32.dll!NtUserRealWaitMessageEx";
    788   table[4583] = "user32.dll!NtUserRedrawWindow";
    789   table[4584] = "user32.dll!NtUserRegisterClassExWOW";
    790   table[4585] = "user32.dll!NtUserRegisterUserApiHook";
    791   table[4586] = "user32.dll!NtUserRegisterHotKey";
    792   table[4587] = "user32.dll!NtUserRegisterRawInputDevices";
    793   table[4588] = "user32.dll!NtUserRegisterTasklist";
    794   table[4589] = "user32.dll!NtUserRegisterWindowMessage";
    795   table[4590] = "user32.dll!NtUserRemoveMenu";
    796   table[4591] = "user32.dll!NtUserRemoveProp";
    797   table[4593] = "user32.dll!NtUserResolveDesktopForWOW";
    798   table[4594] = "user32.dll!NtUserSBGetParms";
    799   table[4595] = "user32.dll!ScrollDC";
    800   table[4596] = "user32.dll!NtUserScrollWindowEx";
    801   table[4597] = "gdi32.dll!NtUserSelectPalette";
    802   table[4598] = "user32.dll!NtUserSendInput";
    803   table[4599] = "user32.dll!NtUserSetActiveWindow";
    804   table[4600] = "imm32.dll!NtUserSetAppImeLevel";
    805   table[4601] = "user32.dll!NtUserSetCapture";
    806   table[4602] = "user32.dll!NtUserSetClassLong";
    807   table[4603] = "user32.dll!NtUserSetClassWord";
    808   table[4604] = "user32.dll!NtUserSetClipboardData";
    809   table[4605] = "user32.dll!NtUserSetClipboardViewer";
    810   table[4606] = "user32.dll!NtUserSetConsoleReserveKeys";
    811   table[4607] = "user32.dll!NtUserSetCursor";
    812   table[4608] = "user32.dll!NtUserSetCursorContents";
    813   table[4609] = "user32.dll!NtUserSetCursorIconData";
    814   table[4610] = "user32.dll!NtUserSetDbgTag";
    815   table[4611] = "user32.dll!NtUserSetFocus";
    816   table[4612] = "user32.dll!NtUserSetImeHotKey";
    817   table[4613] = "imm32.dll!NtUserSetImeInfoEx";
    818   table[4614] = "user32.dll!NtUserSetImeOwnerWindow";
    819   table[4616] = "user32.dll!NtUserSetInformationThread";
    820   table[4617] = "user32.dll!NtUserSetInternalWindowPos";
    821   table[4618] = "user32.dll!NtUserSetKeyboardState";
    822   table[4619] = "user32.dll!NtUserSetLogonNotifyWindow";
    823   table[4620] = "user32.dll!NtUserSetMenu";
    824   table[4621] = "user32.dll!NtUserSetMenuContextHelpId";
    825   table[4622] = "user32.dll!NtUserSetMenuDefaultItem";
    826   table[4623] = "user32.dll!NtUserSetMenuFlagRtoL";
    827   table[4624] = "user32.dll!NtUserSetObjectInformation";
    828   table[4625] = "user32.dll!NtUserSetParent";
    829   table[4626] = "user32.dll!NtUserSetProcessWindowStation";
    830   table[4627] = "user32.dll!NtUserSetProp";
    831   table[4628] = "user32.dll!NtUserSetRipFlags";
    832   table[4629] = "user32.dll!NtUserSetScrollInfo";
    833   table[4630] = "user32.dll!NtUserSetShellWindowEx";
    834   table[4631] = "user32.dll!NtUserSetSysColors";
    835   table[4632] = "user32.dll!NtUserSetSystemCursor";
    836   table[4633] = "user32.dll!NtUserSetSystemMenu";
    837   table[4634] = "user32.dll!NtUserSetSystemTimer";
    838   table[4635] = "user32.dll!NtUserSetThreadDesktop";
    839   table[4636] = "imm32.dll!NtUserSetThreadLayoutHandles";
    840   table[4637] = "user32.dll!NtUserSetThreadState";
    841   table[4638] = "user32.dll!NtUserSetTimer";
    842   table[4639] = "user32.dll!NtUserSetWindowFNID";
    843   table[4640] = "user32.dll!NtUserSetWindowLong";
    844   table[4641] = "user32.dll!NtUserSetWindowPlacement";
    845   table[4642] = "user32.dll!NtUserSetWindowPos";
    846   table[4643] = "user32.dll!NtUserSetWindowRgn";
    847   table[4644] = "user32.dll!NtUserSetWindowsHookAW";
    848   table[4645] = "user32.dll!NtUserSetWindowsHookEx";
    849   table[4646] = "user32.dll!NtUserSetWindowStationUser";
    850   table[4647] = "user32.dll!NtUserSetWindowWord";
    851   table[4648] = "user32.dll!NtUserSetWinEventHook";
    852   table[4649] = "user32.dll!NtUserShowCaret";
    853   table[4650] = "user32.dll!NtUserShowScrollBar";
    854   table[4651] = "user32.dll!NtUserShowWindow";
    855   table[4652] = "user32.dll!NtUserShowWindowAsync";
    856   table[4654] = "user32.dll!NtUserSwitchDesktop";
    857   table[4655] = "user32.dll!NtUserSystemParametersInfo";
    858   table[4657] = "user32.dll!NtUserThunkedMenuInfo";
    859   table[4658] = "user32.dll!NtUserThunkedMenuItemInfo";
    860   table[4659] = "user32.dll!NtUserToUnicodeEx";
    861   table[4660] = "user32.dll!NtUserTrackMouseEvent";
    862   table[4661] = "user32.dll!NtUserTrackPopupMenuEx";
    863   table[4662] = "user32.dll!NtUserCalcMenuBar";
    864   table[4663] = "user32.dll!NtUserPaintMenuBar";
    865   table[4664] = "user32.dll!TranslateAcceleratorA";
    866   table[4665] = "user32.dll!NtUserTranslateMessage";
    867   table[4666] = "user32.dll!NtUserUnhookWindowsHookEx";
    868   table[4667] = "user32.dll!NtUserUnhookWinEvent";
    869   table[4668] = "user32.dll!NtUserUnloadKeyboardLayout";
    870   table[4669] = "user32.dll!NtUserUnlockWindowStation";
    871   table[4670] = "user32.dll!NtUserUnregisterClass";
    872   table[4671] = "user32.dll!NtUserUnregisterUserApiHook";
    873   table[4672] = "user32.dll!NtUserUnregisterHotKey";
    874   table[4673] = "imm32.dll!NtUserUpdateInputContext";
    875   table[4673] = "user32.dll!NtUserUpdateInputContext";
    876   table[4674] = "user32.dll!NtUserUpdateInstance";
    877   table[4675] = "user32.dll!NtUserUpdateLayeredWindow";
    878   table[4676] = "user32.dll!NtUserGetLayeredWindowAttributes";
    879   table[4677] = "user32.dll!NtUserSetLayeredWindowAttributes";
    880   table[4678] = "user32.dll!NtUserUpdatePerUserSystemParameters";
    881   table[4679] = "user32.dll!NtUserUserHandleGrantAccess";
    882   table[4680] = "imm32.dll!NtUserValidateHandleSecure";
    883   table[4680] = "user32.dll!NtUserValidateHandleSecure";
    884   table[4681] = "user32.dll!NtUserValidateRect";
    885   table[4682] = "user32.dll!NtUserValidateTimerCallback";
    886   table[4683] = "user32.dll!NtUserVkKeyScanEx";
    887   table[4684] = "user32.dll!NtUserWaitForInputIdle";
    888   table[4685] = "user32.dll!NtUserWaitForMsgAndEvent";
    889   table[4686] = "user32.dll!NtUserWaitMessage";
    890   table[4687] = "user32.dll!NtUserWin32PoolAllocationStats";
    891   table[4688] = "user32.dll!NtUserWindowFromPoint";
    892   table[4689] = "user32.dll!NtUserYieldTask";
    893   table[4695] = "gdi32.dll!NtGdiEngAssociateSurface";
    894   table[4696] = "gdi32.dll!NtGdiEngCreateBitmap";
    895   table[4697] = "gdi32.dll!NtGdiEngCreateDeviceSurface";
    896   table[4698] = "gdi32.dll!NtGdiEngCreateDeviceBitmap";
    897   table[4699] = "gdi32.dll!NtGdiEngCreatePalette";
    898   table[4700] = "gdi32.dll!NtGdiEngComputeGlyphSet";
    899   table[4701] = "gdi32.dll!NtGdiEngCopyBits";
    900   table[4702] = "gdi32.dll!NtGdiEngDeletePalette";
    901   table[4703] = "gdi32.dll!NtGdiEngDeleteSurface";
    902   table[4704] = "gdi32.dll!NtGdiEngEraseSurface";
    903   table[4705] = "gdi32.dll!NtGdiEngUnlockSurface";
    904   table[4706] = "gdi32.dll!NtGdiEngLockSurface";
    905   table[4707] = "gdi32.dll!NtGdiEngBitBlt";
    906   table[4708] = "gdi32.dll!NtGdiEngStretchBlt";
    907   table[4709] = "gdi32.dll!NtGdiEngPlgBlt";
    908   table[4710] = "gdi32.dll!NtGdiEngMarkBandingSurface";
    909   table[4711] = "gdi32.dll!NtGdiEngStrokePath";
    910   table[4712] = "gdi32.dll!NtGdiEngFillPath";
    911   table[4713] = "gdi32.dll!NtGdiEngStrokeAndFillPath";
    912   table[4714] = "gdi32.dll!NtGdiEngPaint";
    913   table[4715] = "gdi32.dll!NtGdiEngLineTo";
    914   table[4716] = "gdi32.dll!NtGdiEngAlphaBlend";
    915   table[4717] = "gdi32.dll!NtGdiEngGradientFill";
    916   table[4718] = "gdi32.dll!NtGdiEngTransparentBlt";
    917   table[4719] = "gdi32.dll!NtGdiEngTextOut";
    918   table[4720] = "gdi32.dll!NtGdiEngStretchBltROP";
    919   table[4721] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette";
    920   table[4722] = "gdi32.dll!NtGdiXLATEOBJ_iXlate";
    921   table[4723] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform";
    922   table[4724] = "gdi32.dll!NtGdiCLIPOBJ_bEnum";
    923   table[4725] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart";
    924   table[4726] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath";
    925   table[4727] = "gdi32.dll!NtGdiEngDeletePath";
    926   table[4728] = "gdi32.dll!NtGdiEngCreateClip";
    927   table[4729] = "gdi32.dll!NtGdiEngDeleteClip";
    928   table[4730] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor";
    929   table[4731] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush";
    930   table[4732] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush";
    931   table[4733] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform";
    932   table[4734] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform";
    933   table[4735] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform";
    934   table[4736] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo";
    935   table[4737] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform";
    936   table[4738] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs";
    937   table[4739] = "gdi32.dll!NtGdiFONTOBJ_pifi";
    938   table[4740] = "gdi32.dll!NtGdiFONTOBJ_pfdg";
    939   table[4741] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs";
    940   table[4742] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile";
    941   table[4743] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles";
    942   table[4744] = "gdi32.dll!NtGdiSTROBJ_bEnum";
    943   table[4745] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly";
    944   table[4746] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths";
    945   table[4747] = "gdi32.dll!NtGdiSTROBJ_vEnumStart";
    946   table[4748] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage";
    947   table[4749] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds";
    948   table[4750] = "gdi32.dll!NtGdiPATHOBJ_bEnum";
    949   table[4751] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart";
    950   table[4752] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines";
    951   table[4753] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines";
    952   table[4754] = "gdi32.dll!NtGdiGetDhpdev";
    953   table[4755] = "gdi32.dll!NtGdiEngCheckAbort";
    954   table[4756] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette";
    955   table[4757] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette";
    956   table[4758] = "gdi32.dll!NtGdiUpdateTransform";
    957   table[4759] = "gdi32.dll!NtGdiSetPUMPDOBJ";
    958   table[4760] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush";
    959   table[4761] = "gdi32.dll!NtGdiUMPDEngFreeUserMem";
    960   table[4762] = "gdi32.dll!NtGdiDrawStream";
    961 } else {  // Vista table.
    962   table[4272] = "gdi32.dll!NtGdiGetDeviceCaps";
    963   table[4220] = "gdi32.dll!NtGdiDeleteObjectApp";
    964   table[4249] = "gdi32.dll!NtGdiFlush";
    965   table[4120] = "gdi32.dll!NtGdiConsoleTextOut";
    966   table[4825] = "gdi32.dll!NtGdiDdDDIEscape";
    967   table[4299] = "gdi32.dll!GetRgnBox";
    968   table[4828] = "gdi32.dll!NtGdiDdDDIGetPresentHistory";
    969   table[4835] = "gdi32.dll!NtGdiDdDDIGetDeviceState";
    970   table[4850] = "gdi32.dll!NtGdiDdDDICheckExclusiveOwnership";
    971   table[4849] = "gdi32.dll!NtGdiDdDDICheckMonitorPowerState";
    972   table[4833] = "gdi32.dll!NtGdiDdDDIWaitForVerticalBlankEvent";
    973   table[4298] = "gdi32.dll!GetRegionData";
    974   table[4796] = "gdi32.dll!NtGdiDwmGetDirtyRgn";
    975   table[4820] = "gdi32.dll!NtGdiDdDDIRender";
    976   table[4819] = "gdi32.dll!NtGdiDdDDIPresent";
    977   table[4815] = "gdi32.dll!NtGdiDdDDIUnlock";
    978   table[4814] = "gdi32.dll!NtGdiDdDDILock";
    979   table[4240] = "gdi32.dll!NtGdiExtCreateRegion";
    980   table[4339] = "gdi32.dll!NtGdiPolyPatBlt";
    981   table[4361] = "gdi32.dll!NtGdiSelectBitmap";
    982   table[4127] = "gdi32.dll!NtGdiCreateCompatibleDC";
    983   table[4142] = "gdi32.dll!NtGdiCreateSolidBrush";
    984   table[4122] = "gdi32.dll!CreateBitmap";
    985   table[4303] = "gdi32.dll!CreateBitmap";
    986   table[4348] = "gdi32.dll!NtGdiQueryFontAssocInfo";
    987   table[4126] = "gdi32.dll!NtGdiCreateCompatibleBitmap";
    988   table[4109] = "gdi32.dll!NtGdiBitBlt";
    989   table[4243] = "gdi32.dll!NtGdiExtGetObjectW";
    990   table[4270] = "gdi32.dll!NtGdiGetDCObject";
    991   table[4620] = "gdi32.dll!NtUserSelectPalette";
    992   table[4338] = "gdi32.dll!NtGdiPatBlt";
    993   table[4275] = "gdi32.dll!NtGdiGetDIBitsInternal";
    994   table[4398] = "gdi32.dll!NtGdiStretchDIBitsInternal";
    995   table[4130] = "gdi32.dll!NtGdiCreateDIBSection";
    996   table[4356] = "gdi32.dll!NtGdiRestoreDC";
    997   table[4358] = "gdi32.dll!NtGdiSaveDC";
    998   table[4103] = "gdi32.dll!NtGdiAlphaBlend";
    999   table[4349] = "gdi32.dll!NtGdiRectangle";
   1000   table[4295] = "gdi32.dll!NtGdiGetRandomRgn";
   1001   table[4244] = "gdi32.dll!NtGdiExtSelectClipRgn";
   1002   table[4268] = "gdi32.dll!NtGdiGetDCDword";
   1003   table[4245] = "gdi32.dll!NtGdiExtTextOutW";
   1004   table[4254] = "gdi32.dll!GetClipBox";
   1005   table[4397] = "gdi32.dll!NtGdiStretchBlt";
   1006   table[4331] = "gdi32.dll!NtGdiMaskBlt";
   1007   table[4324] = "gdi32.dll!NtGdiInit";
   1008   table[4262] = "gdi32.dll!NtGdiGetCharSet";
   1009   table[4336] = "gdi32.dll!NtGdiOffsetRgn";
   1010   table[4326] = "gdi32.dll!NtGdiIntersectClipRect";
   1011   table[4795] = "gdi32.dll!NtGdiDrawStream";
   1012   table[4364] = "gdi32.dll!NtGdiSelectFont";
   1013   table[4116] = "gdi32.dll!NtGdiCombineRgn";
   1014   table[4238] = "gdi32.dll!NtGdiExcludeClipRect";
   1015   table[4802] = "gdi32.dll!NtGdiDdDDISetAllocationPriority";
   1016   table[4798] = "gdi32.dll!NtGdiDdDDICreateAllocation";
   1017   table[4801] = "gdi32.dll!NtGdiDdDDIDestroyAllocation";
   1018   table[4797] = "gdi32.dll!NtGdiDwmGetSurfaceData";
   1019   table[4140] = "gdi32.dll!CreateRoundRectRgn";
   1020   table[4840] = "gdi32.dll!NtGdiDdDDISetProcessSchedulingPriorityClass";
   1021   table[4307] = "gdi32.dll!NtGdiGetTextCharsetInfo";
   1022   table[4351] = "gdi32.dll!RectVisible";
   1023   table[4139] = "gdi32.dll!NtGdiCreateRectRgn";
   1024   table[4369] = "gdi32.dll!NtGdiSetBoundsRect";
   1025   table[4257] = "gdi32.dll!NtGdiGetBoundsRect";
   1026   table[4309] = "gdi32.dll!NtGdiGetTextExtentExW";
   1027   table[4402] = "gdi32.dll!NtGdiTransformPoints";
   1028   table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients";
   1029   table[4337] = "gdi32.dll!NtGdiOpenDCW";
   1030   table[4813] = "gdi32.dll!NtGdiDdDDIQueryAdapterInfo";
   1031   table[4822] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromHdc";
   1032   table[4816] = "gdi32.dll!NtGdiDdDDIGetDisplayModeList";
   1033   table[4823] = "gdi32.dll!NtGdiDdDDICloseAdapter";
   1034   table[4804] = "gdi32.dll!NtGdiDdDDICreateDevice";
   1035   table[4806] = "gdi32.dll!NtGdiDdDDICreateContext";
   1036   table[4271] = "gdi32.dll!NtGdiGetDCPoint";
   1037   table[4225] = "gdi32.dll!NtGdiDoPalette";
   1038   table[4288] = "gdi32.dll!GetNearestColor";
   1039   table[4129] = "gdi32.dll!NtGdiCreateDIBitmapInternal";
   1040   table[4322] = "gdi32.dll!NtGdiHfontCreate";
   1041   table[4137] = "gdi32.dll!NtGdiCreatePatternBrushInternal";
   1042   table[4136] = "gdi32.dll!NtGdiCreatePaletteInternal";
   1043   table[4132] = "gdi32.dll!NtGdiCreateHalftonePalette";
   1044   table[4375] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal";
   1045   table[4269] = "gdi32.dll!NtGdiGetDCforBitmap";
   1046   table[4392] = "gdi32.dll!NtGdiSetupPublicCFONT";
   1047   table[4836] = "gdi32.dll!NtGdiDdDDICreateDCFromMemory";
   1048   table[4264] = "gdi32.dll!NtGdiGetCharWidthInfo";
   1049   table[4367] = "gdi32.dll!SetBitmapBits";
   1050   table[4255] = "gdi32.dll!GetBitmapBits";
   1051   table[4311] = "gdi32.dll!NtGdiGetTextMetricsW";
   1052   table[4297] = "gdi32.dll!NtGdiGetRealizationInfo";
   1053   table[4310] = "gdi32.dll!NtGdiGetTextFaceW";
   1054   table[4292] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW";
   1055   table[4280] = "gdi32.dll!NtGdiGetGlyphIndicesW";
   1056   table[4320] = "gdi32.dll!NtGdiGetWidthTable";
   1057   table[4234] = "gdi32.dll!NtGdiEnumFontOpen";
   1058   table[4233] = "gdi32.dll!NtGdiEnumFontClose";
   1059   table[4232] = "gdi32.dll!NtGdiEnumFontChunk";
   1060   table[4260] = "gdi32.dll!NtGdiGetCharABCWidthsW";
   1061   table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts";
   1062   table[4278] = "gdi32.dll!NtGdiGetFontData";
   1063   table[4106] = "gdi32.dll!NtGdiFontIsLinked";
   1064   table[4332] = "gdi32.dll!NtGdiModifyWorldTransform";
   1065   table[4312] = "gdi32.dll!NtGdiGetTransform";
   1066   table[4321] = "gdi32.dll!NtGdiGradientFill";
   1067   table[4294] = "gdi32.dll!NtGdiGetPixel";
   1068   table[4403] = "gdi32.dll!NtGdiTransparentBlt";
   1069   table[4319] = "gdi32.dll!NtGdiGetFontUnicodeRanges";
   1070   table[4817] = "gdi32.dll!NtGdiDdDDISetDisplayMode";
   1071   table[4827] = "gdi32.dll!NtGdiDdDDISetVidPnSourceOwner";
   1072   table[4273] = "gdi32.dll!NtGdiGetDeviceGammaRamp";
   1073   table[4374] = "gdi32.dll!NtGdiSetDeviceGammaRamp";
   1074   table[4366] = "gdi32.dll!NtGdiSetBitmapAttributes";
   1075   table[4098] = "gdi32.dll!NtGdiAddFontResourceW";
   1076   table[4376] = "gdi32.dll!NtGdiSetFontEnumeration";
   1077   table[4228] = "gdi32.dll!NtGdiEnableEudc";
   1078   table[4343] = "gdi32.dll!NtGdiPolyPolyDraw";
   1079   table[4328] = "gdi32.dll!NtGdiLineTo";
   1080   table[4138] = "gdi32.dll!NtGdiCreatePen";
   1081   table[4236] = "gdi32.dll!EqualRgn";
   1082   table[4805] = "gdi32.dll!NtGdiDdDDIDestroyDevice";
   1083   table[4807] = "gdi32.dll!NtGdiDdDDIDestroyContext";
   1084   table[4799] = "gdi32.dll!NtGdiDdDDIQueryResourceInfo";
   1085   table[4800] = "gdi32.dll!NtGdiDdDDIOpenResource";
   1086   table[4838] = "gdi32.dll!NtGdiDdDDISetContextSchedulingPriority";
   1087   table[4263] = "gdi32.dll!NtGdiGetCharWidthW";
   1088   table[4837] = "gdi32.dll!NtGdiDdDDIDestroyDCFromMemory";
   1089   table[4803] = "gdi32.dll!NtGdiDdDDIQueryAllocationResidency";
   1090   table[4824] = "gdi32.dll!NtGdiDdDDIGetSharedPrimaryHandle";
   1091   table[4385] = "gdi32.dll!NtGdiSetLayout";
   1092   table[4371] = "gdi32.dll!NtGdiSetBrushOrg";
   1093   table[4157] = "gdi32.dll!NtGdiDdCreateDirectDrawObject";
   1094   table[4128] = "gdi32.dll!NtGdiCreateDIBBrush";
   1095   table[4387] = "gdi32.dll!NtGdiSetPixel";
   1096   table[4345] = "gdi32.dll!PtInRegion";
   1097   table[4821] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromDeviceName";
   1098   table[4253] = "gdi32.dll!NtGdiGetAndSetDCDword";
   1099   table[4274] = "gdi32.dll!NtGdiGetDeviceCapsAll";
   1100   table[4247] = "gdi32.dll!NtGdiFillRgn";
   1101   table[4289] = "gdi32.dll!GetNearestPaletteIndex";
   1102   table[4378] = "gdi32.dll!NtGdiSetIcmMode";
   1103   table[4327] = "gdi32.dll!NtGdiInvertRgn";
   1104   table[4792] = "gdi32.dll!NtGdiSetPUMPDOBJ";
   1105   table[4735] = "gdi32.dll!NtGdiEngDeletePalette";
   1106   table[4732] = "gdi32.dll!NtGdiEngCreatePalette";
   1107   table[4241] = "gdi32.dll!NtGdiExtEscape";
   1108   table[4217] = "gdi32.dll!NtGdiDeleteClientObj";
   1109   table[4123] = "gdi32.dll!NtGdiCreateClientObj";
   1110   table[4354] = "gdi32.dll!NtGdiResetDC";
   1111   table[4235] = "gdi32.dll!NtGdiEnumObjects";
   1112   table[4135] = "gdi32.dll!NtGdiCreateOPMProtectedOutputs";
   1113   table[4222] = "gdi32.dll!NtGdiDestroyOPMProtectedOutput";
   1114   table[4258] = "gdi32.dll!NtGdiGetCertificate";
   1115   table[4259] = "gdi32.dll!NtGdiGetCertificateSize";
   1116   table[4291] = "gdi32.dll!NtGdiGetOPMRandomNumber";
   1117   table[4305] = "gdi32.dll!NtGdiGetSuggestedOPMProtectedOutputArraySize";
   1118   table[4386] = "gdi32.dll!NtGdiSetOPMSigningKeyAndSequenceNumbers";
   1119   table[4844] = "gdi32.dll!NtGdiDdDDISetQueuedLimit";
   1120   table[4341] = "gdi32.dll!NtGdiPlgBlt";
   1121   table[4117] = "gdi32.dll!CombineTransform";
   1122   table[4134] = "gdi32.dll!NtGdiCreateMetafileDC";
   1123   table[4393] = "gdi32.dll!NtGdiSetVirtualResolution";
   1124   table[4394] = "gdi32.dll!NtGdiSetSizeDevice";
   1125   table[4381] = "gdi32.dll!NtGdiSetMetaRgn";
   1126   table[4382] = "gdi32.dll!NtGdiSetMiterLimit";
   1127   table[4377] = "gdi32.dll!NtGdiSetFontXform";
   1128   table[4333] = "gdi32.dll!NtGdiMonoBitmap";
   1129   table[4768] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform";
   1130   table[4770] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform";
   1131   table[4239] = "gdi32.dll!NtGdiExtCreatePen";
   1132   table[4286] = "gdi32.dll!GetMiterLimit";
   1133   table[4290] = "gdi32.dll!NtGdiGetObjectBitmapHandle";
   1134   table[4287] = "gdi32.dll!NtGdiGetMonitorID";
   1135   table[4284] = "gdi32.dll!NtGdiGetKerningPairs";
   1136   table[4357] = "gdi32.dll!NtGdiRoundRect";
   1137   table[4242] = "gdi32.dll!NtGdiExtFloodFill";
   1138   table[4306] = "gdi32.dll!GetSystemPaletteUse";
   1139   table[4096] = "gdi32.dll!NtGdiAbortDoc";
   1140   table[4097] = "gdi32.dll!NtGdiAbortPath";
   1141   table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC";
   1142   table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx";
   1143   table[4101] = "gdi32.dll!NtGdiRemoveMergeFont";
   1144   table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC";
   1145   table[4104] = "gdi32.dll!NtGdiAngleArc";
   1146   table[4107] = "gdi32.dll!NtGdiArcInternal";
   1147   table[4108] = "gdi32.dll!NtGdiBeginPath";
   1148   table[4110] = "gdi32.dll!NtGdiCancelDC";
   1149   table[4111] = "gdi32.dll!NtGdiCheckBitmapBits";
   1150   table[4112] = "gdi32.dll!NtGdiCloseFigure";
   1151   table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes";
   1152   table[4114] = "gdi32.dll!NtGdiClearBrushAttributes";
   1153   table[4115] = "gdi32.dll!NtGdiColorCorrectPalette";
   1154   table[4119] = "gdi32.dll!NtGdiConfigureOPMProtectedOutput";
   1155   table[4121] = "gdi32.dll!NtGdiConvertMetafileRect";
   1156   table[4124] = "gdi32.dll!NtGdiCreateColorSpace";
   1157   table[4125] = "gdi32.dll!NtGdiCreateColorTransform";
   1158   table[4131] = "gdi32.dll!NtGdiCreateEllipticRgn";
   1159   table[4133] = "gdi32.dll!NtGdiCreateHatchBrushInternal";
   1160   table[4141] = "gdi32.dll!NtGdiCreateServerMetaFile";
   1161   table[4143] = "gdi32.dll!NtGdiD3dContextCreate";
   1162   table[4144] = "gdi32.dll!NtGdiD3dContextDestroy";
   1163   table[4145] = "gdi32.dll!NtGdiD3dContextDestroyAll";
   1164   table[4146] = "gdi32.dll!NtGdiD3dValidateTextureStageState";
   1165   table[4147] = "gdi32.dll!NtGdiD3dDrawPrimitives2";
   1166   table[4148] = "gdi32.dll!NtGdiDdGetDriverState";
   1167   table[4149] = "gdi32.dll!NtGdiDdAddAttachedSurface";
   1168   table[4150] = "gdi32.dll!NtGdiDdAlphaBlt";
   1169   table[4151] = "gdi32.dll!NtGdiDdAttachSurface";
   1170   table[4152] = "gdi32.dll!NtGdiDdBeginMoCompFrame";
   1171   table[4153] = "gdi32.dll!NtGdiDdBlt";
   1172   table[4154] = "gdi32.dll!NtGdiDdCanCreateSurface";
   1173   table[4155] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer";
   1174   table[4156] = "gdi32.dll!NtGdiDdColorControl";
   1175   table[4158] = "gdi32.dll!NtGdiDdCreateSurface";
   1176   table[4159] = "gdi32.dll!NtGdiDdCreateD3DBuffer";
   1177   table[4160] = "gdi32.dll!NtGdiDdCreateMoComp";
   1178   table[4161] = "gdi32.dll!NtGdiDdCreateSurfaceObject";
   1179   table[4162] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject";
   1180   table[4163] = "gdi32.dll!NtGdiDdDeleteSurfaceObject";
   1181   table[4164] = "gdi32.dll!NtGdiDdDestroyMoComp";
   1182   table[4165] = "gdi32.dll!NtGdiDdDestroySurface";
   1183   table[4166] = "gdi32.dll!NtGdiDdDestroyD3DBuffer";
   1184   table[4167] = "gdi32.dll!NtGdiDdEndMoCompFrame";
   1185   table[4168] = "gdi32.dll!NtGdiDdFlip";
   1186   table[4169] = "gdi32.dll!NtGdiDdFlipToGDISurface";
   1187   table[4170] = "gdi32.dll!NtGdiDdGetAvailDriverMemory";
   1188   table[4171] = "gdi32.dll!NtGdiDdGetBltStatus";
   1189   table[4172] = "gdi32.dll!NtGdiDdGetDC";
   1190   table[4173] = "gdi32.dll!NtGdiDdGetDriverInfo";
   1191   table[4174] = "gdi32.dll!NtGdiDdGetDxHandle";
   1192   table[4175] = "gdi32.dll!NtGdiDdGetFlipStatus";
   1193   table[4176] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo";
   1194   table[4177] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo";
   1195   table[4178] = "gdi32.dll!NtGdiDdGetMoCompGuids";
   1196   table[4179] = "gdi32.dll!NtGdiDdGetMoCompFormats";
   1197   table[4180] = "gdi32.dll!NtGdiDdGetScanLine";
   1198   table[4181] = "gdi32.dll!NtGdiDdLock";
   1199   table[4182] = "gdi32.dll!NtGdiDdLockD3D";
   1200   table[4183] = "gdi32.dll!NtGdiDdQueryDirectDrawObject";
   1201   table[4184] = "gdi32.dll!NtGdiDdQueryMoCompStatus";
   1202   table[4185] = "gdi32.dll!NtGdiDdReenableDirectDrawObject";
   1203   table[4186] = "gdi32.dll!NtGdiDdReleaseDC";
   1204   table[4187] = "gdi32.dll!NtGdiDdRenderMoComp";
   1205   table[4188] = "gdi32.dll!NtGdiDdResetVisrgn";
   1206   table[4189] = "gdi32.dll!NtGdiDdSetColorKey";
   1207   table[4190] = "gdi32.dll!NtGdiDdSetExclusiveMode";
   1208   table[4191] = "gdi32.dll!NtGdiDdSetGammaRamp";
   1209   table[4192] = "gdi32.dll!NtGdiDdCreateSurfaceEx";
   1210   table[4193] = "gdi32.dll!NtGdiDdSetOverlayPosition";
   1211   table[4194] = "gdi32.dll!NtGdiDdUnattachSurface";
   1212   table[4195] = "gdi32.dll!NtGdiDdUnlock";
   1213   table[4196] = "gdi32.dll!NtGdiDdUnlockD3D";
   1214   table[4197] = "gdi32.dll!NtGdiDdUpdateOverlay";
   1215   table[4198] = "gdi32.dll!NtGdiDdWaitForVerticalBlank";
   1216   table[4199] = "gdi32.dll!NtGdiDvpCanCreateVideoPort";
   1217   table[4200] = "gdi32.dll!NtGdiDvpColorControl";
   1218   table[4201] = "gdi32.dll!NtGdiDvpCreateVideoPort";
   1219   table[4202] = "gdi32.dll!NtGdiDvpDestroyVideoPort";
   1220   table[4203] = "gdi32.dll!NtGdiDvpFlipVideoPort";
   1221   table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth";
   1222   table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortField";
   1223   table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus";
   1224   table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats";
   1225   table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortLine";
   1226   table[4209] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats";
   1227   table[4210] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo";
   1228   table[4211] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus";
   1229   table[4212] = "gdi32.dll!NtGdiDvpUpdateVideoPort";
   1230   table[4213] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync";
   1231   table[4214] = "gdi32.dll!NtGdiDvpAcquireNotification";
   1232   table[4215] = "gdi32.dll!NtGdiDvpReleaseNotification";
   1233   table[4216] = "gdi32.dll!NtGdiDxgGenericThunk";
   1234   table[4218] = "gdi32.dll!NtGdiDeleteColorSpace";
   1235   table[4219] = "gdi32.dll!NtGdiDeleteColorTransform";
   1236   table[4221] = "gdi32.dll!NtGdiDescribePixelFormat";
   1237   table[4223] = "gdi32.dll!NtGdiGetPerBandInfo";
   1238   table[4224] = "gdi32.dll!NtGdiDoBanding";
   1239   table[4226] = "gdi32.dll!NtGdiDrawEscape";
   1240   table[4227] = "gdi32.dll!NtGdiEllipse";
   1241   table[4229] = "gdi32.dll!NtGdiEndDoc";
   1242   table[4230] = "gdi32.dll!NtGdiEndPage";
   1243   table[4231] = "gdi32.dll!NtGdiEndPath";
   1244   table[4237] = "gdi32.dll!NtGdiEudcLoadUnloadLink";
   1245   table[4246] = "gdi32.dll!NtGdiFillPath";
   1246   table[4248] = "gdi32.dll!NtGdiFlattenPath";
   1247   table[4250] = "gdi32.dll!NtGdiForceUFIMapping";
   1248   table[4251] = "gdi32.dll!NtGdiFrameRgn";
   1249   table[4252] = "gdi32.dll!NtGdiFullscreenControl";
   1250   table[4256] = "gdi32.dll!NtGdiGetBitmapDimension";
   1251   table[4261] = "gdi32.dll!NtGdiGetCharacterPlacementW";
   1252   table[4265] = "gdi32.dll!NtGdiGetColorAdjustment";
   1253   table[4267] = "gdi32.dll!NtGdiGetCOPPCompatibleOPMInformation";
   1254   table[4276] = "gdi32.dll!NtGdiGetETM";
   1255   table[4277] = "gdi32.dll!NtGdiGetEudcTimeStampEx";
   1256   table[4279] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW";
   1257   table[4281] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal";
   1258   table[4282] = "gdi32.dll!NtGdiGetGlyphOutline";
   1259   table[4283] = "gdi32.dll!NtGdiGetOPMInformation";
   1260   table[4285] = "gdi32.dll!NtGdiGetLinkedUFIs";
   1261   table[4293] = "gdi32.dll!NtGdiGetPath";
   1262   table[4296] = "gdi32.dll!NtGdiGetRasterizerCaps";
   1263   table[4300] = "gdi32.dll!NtGdiGetServerMetaFileBits";
   1264   table[4301] = "gdi32.dll!NtGdiGetSpoolMessage";
   1265   table[4304] = "gdi32.dll!NtGdiGetStringBitmapW";
   1266   table[4308] = "gdi32.dll!NtGdiGetTextExtent";
   1267   table[4313] = "gdi32.dll!NtGdiGetUFI";
   1268   table[4314] = "gdi32.dll!NtGdiGetEmbUFI";
   1269   table[4315] = "gdi32.dll!NtGdiGetUFIPathname";
   1270   table[4316] = "gdi32.dll!NtGdiGetEmbedFonts";
   1271   table[4317] = "gdi32.dll!NtGdiChangeGhostFont";
   1272   table[4318] = "gdi32.dll!NtGdiAddEmbFontToDC";
   1273   table[4323] = "gdi32.dll!NtGdiIcmBrushInfo";
   1274   table[4325] = "gdi32.dll!NtGdiInitSpool";
   1275   table[4329] = "gdi32.dll!NtGdiMakeFontDir";
   1276   table[4330] = "gdi32.dll!NtGdiMakeInfoDC";
   1277   table[4335] = "gdi32.dll!NtGdiOffsetClipRgn";
   1278   table[4340] = "gdi32.dll!NtGdiPathToRegion";
   1279   table[4342] = "gdi32.dll!NtGdiPolyDraw";
   1280   table[4344] = "gdi32.dll!NtGdiPolyTextOutW";
   1281   table[4346] = "gdi32.dll!NtGdiPtVisible";
   1282   table[4347] = "gdi32.dll!NtGdiQueryFonts";
   1283   table[4350] = "gdi32.dll!NtGdiRectInRegion";
   1284   table[4352] = "gdi32.dll!NtGdiRemoveFontResourceW";
   1285   table[4353] = "gdi32.dll!NtGdiRemoveFontMemResourceEx";
   1286   table[4355] = "gdi32.dll!NtGdiResizePalette";
   1287   table[4359] = "gdi32.dll!NtGdiScaleViewportExtEx";
   1288   table[4360] = "gdi32.dll!NtGdiScaleWindowExtEx";
   1289   table[4363] = "gdi32.dll!NtGdiSelectClipPath";
   1290   table[4365] = "gdi32.dll!NtGdiSelectPen";
   1291   table[4368] = "gdi32.dll!NtGdiSetBitmapDimension";
   1292   table[4370] = "gdi32.dll!NtGdiSetBrushAttributes";
   1293   table[4372] = "gdi32.dll!NtGdiSetColorAdjustment";
   1294   table[4373] = "gdi32.dll!NtGdiSetColorSpace";
   1295   table[4379] = "gdi32.dll!NtGdiSetLinkedUFIs";
   1296   table[4380] = "gdi32.dll!NtGdiSetMagicColors";
   1297   table[4383] = "gdi32.dll!NtGdiGetDeviceWidth";
   1298   table[4384] = "gdi32.dll!NtGdiMirrorWindowOrg";
   1299   table[4388] = "gdi32.dll!NtGdiSetPixelFormat";
   1300   table[4389] = "gdi32.dll!NtGdiSetRectRgn";
   1301   table[4390] = "gdi32.dll!NtGdiSetSystemPaletteUse";
   1302   table[4395] = "gdi32.dll!NtGdiStartDoc";
   1303   table[4396] = "gdi32.dll!NtGdiStartPage";
   1304   table[4399] = "gdi32.dll!NtGdiStrokeAndFillPath";
   1305   table[4400] = "gdi32.dll!NtGdiStrokePath";
   1306   table[4401] = "gdi32.dll!NtGdiSwapBuffers";
   1307   table[4404] = "gdi32.dll!NtGdiUnloadPrinterDriver";
   1308   table[4406] = "gdi32.dll!NtGdiUnrealizeObject";
   1309   table[4407] = "gdi32.dll!NtGdiUpdateColors";
   1310   table[4408] = "gdi32.dll!NtGdiWidenPath";
   1311   table[4728] = "gdi32.dll!NtGdiEngAssociateSurface";
   1312   table[4729] = "gdi32.dll!NtGdiEngCreateBitmap";
   1313   table[4730] = "gdi32.dll!NtGdiEngCreateDeviceSurface";
   1314   table[4731] = "gdi32.dll!NtGdiEngCreateDeviceBitmap";
   1315   table[4733] = "gdi32.dll!NtGdiEngComputeGlyphSet";
   1316   table[4734] = "gdi32.dll!NtGdiEngCopyBits";
   1317   table[4736] = "gdi32.dll!NtGdiEngDeleteSurface";
   1318   table[4737] = "gdi32.dll!NtGdiEngEraseSurface";
   1319   table[4738] = "gdi32.dll!NtGdiEngUnlockSurface";
   1320   table[4739] = "gdi32.dll!NtGdiEngLockSurface";
   1321   table[4740] = "gdi32.dll!NtGdiEngBitBlt";
   1322   table[4741] = "gdi32.dll!NtGdiEngStretchBlt";
   1323   table[4742] = "gdi32.dll!NtGdiEngPlgBlt";
   1324   table[4743] = "gdi32.dll!NtGdiEngMarkBandingSurface";
   1325   table[4744] = "gdi32.dll!NtGdiEngStrokePath";
   1326   table[4745] = "gdi32.dll!NtGdiEngFillPath";
   1327   table[4746] = "gdi32.dll!NtGdiEngStrokeAndFillPath";
   1328   table[4747] = "gdi32.dll!NtGdiEngPaint";
   1329   table[4748] = "gdi32.dll!NtGdiEngLineTo";
   1330   table[4749] = "gdi32.dll!NtGdiEngAlphaBlend";
   1331   table[4750] = "gdi32.dll!NtGdiEngGradientFill";
   1332   table[4751] = "gdi32.dll!NtGdiEngTransparentBlt";
   1333   table[4752] = "gdi32.dll!NtGdiEngTextOut";
   1334   table[4753] = "gdi32.dll!NtGdiEngStretchBltROP";
   1335   table[4754] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette";
   1336   table[4755] = "gdi32.dll!NtGdiXLATEOBJ_iXlate";
   1337   table[4756] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform";
   1338   table[4757] = "gdi32.dll!NtGdiCLIPOBJ_bEnum";
   1339   table[4758] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart";
   1340   table[4759] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath";
   1341   table[4760] = "gdi32.dll!NtGdiEngDeletePath";
   1342   table[4761] = "gdi32.dll!NtGdiEngCreateClip";
   1343   table[4762] = "gdi32.dll!NtGdiEngDeleteClip";
   1344   table[4763] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor";
   1345   table[4764] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush";
   1346   table[4765] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush";
   1347   table[4766] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform";
   1348   table[4767] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform";
   1349   table[4769] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo";
   1350   table[4771] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs";
   1351   table[4772] = "gdi32.dll!NtGdiFONTOBJ_pifi";
   1352   table[4773] = "gdi32.dll!NtGdiFONTOBJ_pfdg";
   1353   table[4774] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs";
   1354   table[4775] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile";
   1355   table[4776] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles";
   1356   table[4777] = "gdi32.dll!NtGdiSTROBJ_bEnum";
   1357   table[4778] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly";
   1358   table[4779] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths";
   1359   table[4780] = "gdi32.dll!NtGdiSTROBJ_vEnumStart";
   1360   table[4781] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage";
   1361   table[4782] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds";
   1362   table[4783] = "gdi32.dll!NtGdiPATHOBJ_bEnum";
   1363   table[4784] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart";
   1364   table[4785] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines";
   1365   table[4786] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines";
   1366   table[4787] = "gdi32.dll!NtGdiGetDhpdev";
   1367   table[4788] = "gdi32.dll!NtGdiEngCheckAbort";
   1368   table[4789] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette";
   1369   table[4790] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette";
   1370   table[4791] = "gdi32.dll!NtGdiUpdateTransform";
   1371   table[4793] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush";
   1372   table[4794] = "gdi32.dll!NtGdiUMPDEngFreeUserMem";
   1373   table[4808] = "gdi32.dll!NtGdiDdDDICreateSynchronizationObject";
   1374   table[4809] = "gdi32.dll!NtGdiDdDDIDestroySynchronizationObject";
   1375   table[4810] = "gdi32.dll!NtGdiDdDDIWaitForSynchronizationObject";
   1376   table[4811] = "gdi32.dll!NtGdiDdDDISignalSynchronizationObject";
   1377   table[4812] = "gdi32.dll!NtGdiDdDDIGetRuntimeData";
   1378   table[4818] = "gdi32.dll!NtGdiDdDDIGetMultisampleMethodList";
   1379   table[4826] = "gdi32.dll!NtGdiDdDDIQueryStatistics";
   1380   table[4829] = "gdi32.dll!NtGdiDdDDICreateOverlay";
   1381   table[4830] = "gdi32.dll!NtGdiDdDDIUpdateOverlay";
   1382   table[4831] = "gdi32.dll!NtGdiDdDDIFlipOverlay";
   1383   table[4832] = "gdi32.dll!NtGdiDdDDIDestroyOverlay";
   1384   table[4834] = "gdi32.dll!NtGdiDdDDISetGammaRamp";
   1385   table[4839] = "gdi32.dll!NtGdiDdDDIGetContextSchedulingPriority";
   1386   table[4841] = "gdi32.dll!NtGdiDdDDIGetProcessSchedulingPriorityClass";
   1387   table[4842] = "gdi32.dll!NtGdiDdDDIReleaseProcessVidPnSourceOwners";
   1388   table[4843] = "gdi32.dll!NtGdiDdDDIGetScanLine";
   1389   table[4845] = "gdi32.dll!NtGdiDdDDIPollDisplayChildren";
   1390   table[4846] = "gdi32.dll!NtGdiDdDDIInvalidateActiveVidPn";
   1391   table[4847] = "gdi32.dll!NtGdiDdDDICheckOcclusion";
   1392   table[4848] = "gdi32.dll!NtGdiDdDDIWaitForIdle";
   1393   table[4851] = "gdi32.dll!NtGdiDdDDISetDisplayPrivateDriverFormat";
   1394   table[4852] = "gdi32.dll!NtGdiDdDDISharedPrimaryLockNotification";
   1395   table[4853] = "gdi32.dll!NtGdiDdDDISharedPrimaryUnLockNotification";
   1396   table[4856] = "gdi32.dll!NtGdiGetNumberOfPhysicalMonitors";
   1397   table[4857] = "gdi32.dll!NtGdiGetPhysicalMonitors";
   1398   table[4858] = "gdi32.dll!NtGdiGetPhysicalMonitorDescription";
   1399   table[4859] = "gdi32.dll!NtGdiDestroyPhysicalMonitor";
   1400   table[4860] = "gdi32.dll!NtGdiDDCCIGetVCPFeature";
   1401   table[4861] = "gdi32.dll!NtGdiDDCCISetVCPFeature";
   1402   table[4862] = "gdi32.dll!NtGdiDDCCISaveCurrentSettings";
   1403   table[4863] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesStringLength";
   1404   table[4864] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesString";
   1405   table[4865] = "gdi32.dll!NtGdiDDCCIGetTimingReport";
   1406   table[0] = "ntdll.dll!NtAcceptConnectPort";
   1407   table[1] = "ntdll.dll!NtAccessCheck";
   1408   table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm";
   1409   table[3] = "ntdll.dll!NtAccessCheckByType";
   1410   table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm";
   1411   table[5] = "ntdll.dll!NtAccessCheckByTypeResultList";
   1412   table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm";
   1413   table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle";
   1414   table[8] = "ntdll.dll!NtAddAtom";
   1415   table[9] = "ntdll.dll!ZwAddBootEntry";
   1416   table[10] = "ntdll.dll!NtAddDriverEntry";
   1417   table[11] = "ntdll.dll!ZwAdjustGroupsToken";
   1418   table[12] = "ntdll.dll!ZwAdjustPrivilegesToken";
   1419   table[13] = "ntdll.dll!NtAlertResumeThread";
   1420   table[14] = "ntdll.dll!NtAlertThread";
   1421   table[15] = "ntdll.dll!ZwAllocateLocallyUniqueId";
   1422   table[16] = "ntdll.dll!NtAllocateUserPhysicalPages";
   1423   table[17] = "ntdll.dll!NtAllocateUuids";
   1424   table[18] = "ntdll.dll!NtAllocateVirtualMemory";
   1425   table[19] = "ntdll.dll!NtAlpcAcceptConnectPort";
   1426   table[20] = "ntdll.dll!ZwAlpcCancelMessage";
   1427   table[21] = "ntdll.dll!ZwAlpcConnectPort";
   1428   table[22] = "ntdll.dll!ZwAlpcCreatePort";
   1429   table[23] = "ntdll.dll!NtAlpcCreatePortSection";
   1430   table[24] = "ntdll.dll!ZwAlpcCreateResourceReserve";
   1431   table[25] = "ntdll.dll!ZwAlpcCreateSectionView";
   1432   table[26] = "ntdll.dll!ZwAlpcCreateSecurityContext";
   1433   table[27] = "ntdll.dll!ZwAlpcDeletePortSection";
   1434   table[28] = "ntdll.dll!NtAlpcDeleteResourceReserve";
   1435   table[29] = "ntdll.dll!NtAlpcDeleteSectionView";
   1436   table[30] = "ntdll.dll!NtAlpcDeleteSecurityContext";
   1437   table[31] = "ntdll.dll!NtAlpcDisconnectPort";
   1438   table[32] = "ntdll.dll!ZwAlpcImpersonateClientOfPort";
   1439   table[33] = "ntdll.dll!ZwAlpcOpenSenderProcess";
   1440   table[34] = "ntdll.dll!ZwAlpcOpenSenderThread";
   1441   table[35] = "ntdll.dll!ZwAlpcQueryInformation";
   1442   table[36] = "ntdll.dll!ZwAlpcQueryInformationMessage";
   1443   table[37] = "ntdll.dll!NtAlpcRevokeSecurityContext";
   1444   table[38] = "ntdll.dll!NtAlpcSendWaitReceivePort";
   1445   table[39] = "ntdll.dll!NtAlpcSetInformation";
   1446   table[40] = "ntdll.dll!NtApphelpCacheControl";
   1447   table[41] = "ntdll.dll!ZwAreMappedFilesTheSame";
   1448   table[42] = "ntdll.dll!ZwAssignProcessToJobObject";
   1449   table[43] = "ntdll.dll!ZwCallbackReturn";
   1450   table[44] = "ntdll.dll!NtCancelDeviceWakeupRequest";
   1451   table[45] = "ntdll.dll!ZwCancelIoFile";
   1452   table[46] = "ntdll.dll!ZwCancelTimer";
   1453   table[47] = "ntdll.dll!NtClearEvent";
   1454   table[48] = "ntdll.dll!NtClose";
   1455   table[49] = "ntdll.dll!ZwCloseObjectAuditAlarm";
   1456   table[50] = "ntdll.dll!NtCompactKeys";
   1457   table[51] = "ntdll.dll!ZwCompareTokens";
   1458   table[52] = "ntdll.dll!NtCompleteConnectPort";
   1459   table[53] = "ntdll.dll!ZwCompressKey";
   1460   table[54] = "ntdll.dll!NtConnectPort";
   1461   table[55] = "ntdll.dll!ZwContinue";
   1462   table[56] = "ntdll.dll!ZwCreateDebugObject";
   1463   table[57] = "ntdll.dll!ZwCreateDirectoryObject";
   1464   table[58] = "ntdll.dll!NtCreateEvent";
   1465   table[59] = "ntdll.dll!NtCreateEventPair";
   1466   table[60] = "ntdll.dll!NtCreateFile";
   1467   table[61] = "ntdll.dll!NtCreateIoCompletion";
   1468   table[62] = "ntdll.dll!ZwCreateJobObject";
   1469   table[63] = "ntdll.dll!NtCreateJobSet";
   1470   table[64] = "ntdll.dll!ZwCreateKey";
   1471   table[65] = "ntdll.dll!NtCreateKeyTransacted";
   1472   table[66] = "ntdll.dll!ZwCreateMailslotFile";
   1473   table[67] = "ntdll.dll!ZwCreateMutant";
   1474   table[68] = "ntdll.dll!ZwCreateNamedPipeFile";
   1475   table[69] = "ntdll.dll!NtCreatePrivateNamespace";
   1476   table[70] = "ntdll.dll!NtCreatePagingFile";
   1477   table[71] = "ntdll.dll!ZwCreatePort";
   1478   table[72] = "ntdll.dll!ZwCreateProcess";
   1479   table[73] = "ntdll.dll!ZwCreateProcessEx";
   1480   table[74] = "ntdll.dll!ZwCreateProfile";
   1481   table[75] = "ntdll.dll!NtCreateSection";
   1482   table[76] = "ntdll.dll!NtCreateSemaphore";
   1483   table[77] = "ntdll.dll!ZwCreateSymbolicLinkObject";
   1484   table[78] = "ntdll.dll!NtCreateThread";
   1485   table[79] = "ntdll.dll!ZwCreateTimer";
   1486   table[80] = "ntdll.dll!NtCreateToken";
   1487   table[81] = "ntdll.dll!NtCreateTransaction";
   1488   table[82] = "ntdll.dll!ZwOpenTransaction";
   1489   table[83] = "ntdll.dll!ZwQueryInformationTransaction";
   1490   table[84] = "ntdll.dll!NtQueryInformationTransactionManager";
   1491   table[85] = "ntdll.dll!NtPrePrepareEnlistment";
   1492   table[86] = "ntdll.dll!ZwPrepareEnlistment";
   1493   table[87] = "ntdll.dll!NtCommitEnlistment";
   1494   table[88] = "ntdll.dll!ZwReadOnlyEnlistment";
   1495   table[89] = "ntdll.dll!ZwRollbackComplete";
   1496   table[90] = "ntdll.dll!NtRollbackEnlistment";
   1497   table[91] = "ntdll.dll!NtCommitTransaction";
   1498   table[92] = "ntdll.dll!NtRollbackTransaction";
   1499   table[93] = "ntdll.dll!ZwPrePrepareComplete";
   1500   table[94] = "ntdll.dll!NtPrepareComplete";
   1501   table[95] = "ntdll.dll!ZwCommitComplete";
   1502   table[96] = "ntdll.dll!ZwSinglePhaseReject";
   1503   table[97] = "ntdll.dll!ZwSetInformationTransaction";
   1504   table[98] = "ntdll.dll!ZwSetInformationTransactionManager";
   1505   table[99] = "ntdll.dll!ZwSetInformationResourceManager";
   1506   table[100] = "ntdll.dll!ZwCreateTransactionManager";
   1507   table[101] = "ntdll.dll!ZwOpenTransactionManager";
   1508   table[102] = "ntdll.dll!NtRenameTransactionManager";
   1509   table[103] = "ntdll.dll!NtRollforwardTransactionManager";
   1510   table[104] = "ntdll.dll!NtRecoverEnlistment";
   1511   table[105] = "ntdll.dll!NtRecoverResourceManager";
   1512   table[106] = "ntdll.dll!ZwRecoverTransactionManager";
   1513   table[107] = "ntdll.dll!ZwCreateResourceManager";
   1514   table[108] = "ntdll.dll!ZwOpenResourceManager";
   1515   table[109] = "ntdll.dll!ZwGetNotificationResourceManager";
   1516   table[110] = "ntdll.dll!ZwQueryInformationResourceManager";
   1517   table[111] = "ntdll.dll!ZwCreateEnlistment";
   1518   table[112] = "ntdll.dll!ZwOpenEnlistment";
   1519   table[113] = "ntdll.dll!NtSetInformationEnlistment";
   1520   table[114] = "ntdll.dll!ZwQueryInformationEnlistment";
   1521   table[115] = "ntdll.dll!ZwCreateWaitablePort";
   1522   table[116] = "ntdll.dll!NtDebugActiveProcess";
   1523   table[117] = "ntdll.dll!ZwDebugContinue";
   1524   table[118] = "ntdll.dll!ZwDelayExecution";
   1525   table[119] = "ntdll.dll!ZwDeleteAtom";
   1526   table[120] = "ntdll.dll!NtDeleteBootEntry";
   1527   table[121] = "ntdll.dll!ZwDeleteDriverEntry";
   1528   table[122] = "ntdll.dll!NtDeleteFile";
   1529   table[123] = "ntdll.dll!ZwDeleteKey";
   1530   table[124] = "ntdll.dll!NtDeletePrivateNamespace";
   1531   table[125] = "ntdll.dll!NtDeleteObjectAuditAlarm";
   1532   table[126] = "ntdll.dll!NtDeleteValueKey";
   1533   table[127] = "ntdll.dll!ZwDeviceIoControlFile";
   1534   table[128] = "ntdll.dll!NtDisplayString";
   1535   table[129] = "ntdll.dll!ZwDuplicateObject";
   1536   table[130] = "ntdll.dll!NtDuplicateToken";
   1537   table[131] = "ntdll.dll!ZwEnumerateBootEntries";
   1538   table[132] = "ntdll.dll!NtEnumerateDriverEntries";
   1539   table[133] = "ntdll.dll!ZwEnumerateKey";
   1540   table[134] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx";
   1541   table[135] = "ntdll.dll!ZwEnumerateTransactionObject";
   1542   table[136] = "ntdll.dll!NtEnumerateValueKey";
   1543   table[137] = "ntdll.dll!ZwExtendSection";
   1544   table[138] = "ntdll.dll!NtFilterToken";
   1545   table[139] = "ntdll.dll!NtFindAtom";
   1546   table[140] = "ntdll.dll!ZwFlushBuffersFile";
   1547   table[141] = "ntdll.dll!ZwFlushInstructionCache";
   1548   table[142] = "ntdll.dll!NtFlushKey";
   1549   table[143] = "ntdll.dll!ZwFlushProcessWriteBuffers";
   1550   table[144] = "ntdll.dll!ZwFlushVirtualMemory";
   1551   table[145] = "ntdll.dll!NtFlushWriteBuffer";
   1552   table[146] = "ntdll.dll!NtFreeUserPhysicalPages";
   1553   table[147] = "ntdll.dll!NtFreeVirtualMemory";
   1554   table[148] = "ntdll.dll!NtFreezeRegistry";
   1555   table[149] = "ntdll.dll!ZwFreezeTransactions";
   1556   table[150] = "ntdll.dll!NtFsControlFile";
   1557   table[151] = "ntdll.dll!NtGetContextThread";
   1558   table[152] = "ntdll.dll!NtGetDevicePowerState";
   1559   table[153] = "ntdll.dll!NtGetNlsSectionPtr";
   1560   table[154] = "ntdll.dll!ZwGetPlugPlayEvent";
   1561   table[155] = "ntdll.dll!NtGetWriteWatch";
   1562   table[156] = "ntdll.dll!NtImpersonateAnonymousToken";
   1563   table[157] = "ntdll.dll!ZwImpersonateClientOfPort";
   1564   table[158] = "ntdll.dll!ZwImpersonateThread";
   1565   table[159] = "ntdll.dll!ZwInitializeNlsFiles";
   1566   table[160] = "ntdll.dll!ZwInitializeRegistry";
   1567   table[161] = "ntdll.dll!NtInitiatePowerAction";
   1568   table[162] = "ntdll.dll!ZwIsProcessInJob";
   1569   table[163] = "ntdll.dll!NtIsSystemResumeAutomatic";
   1570   table[164] = "ntdll.dll!ZwListenPort";
   1571   table[165] = "ntdll.dll!NtLoadDriver";
   1572   table[166] = "ntdll.dll!NtLoadKey";
   1573   table[167] = "ntdll.dll!NtLoadKey2";
   1574   table[168] = "ntdll.dll!NtLoadKeyEx";
   1575   table[169] = "ntdll.dll!NtLockFile";
   1576   table[170] = "ntdll.dll!ZwLockProductActivationKeys";
   1577   table[171] = "ntdll.dll!NtLockRegistryKey";
   1578   table[172] = "ntdll.dll!ZwLockVirtualMemory";
   1579   table[173] = "ntdll.dll!ZwMakePermanentObject";
   1580   table[174] = "ntdll.dll!NtMakeTemporaryObject";
   1581   table[175] = "ntdll.dll!NtMapUserPhysicalPages";
   1582   table[176] = "ntdll.dll!ZwMapUserPhysicalPagesScatter";
   1583   table[177] = "ntdll.dll!ZwMapViewOfSection";
   1584   table[178] = "ntdll.dll!NtModifyBootEntry";
   1585   table[179] = "ntdll.dll!ZwModifyDriverEntry";
   1586   table[180] = "ntdll.dll!NtNotifyChangeDirectoryFile";
   1587   table[181] = "ntdll.dll!NtNotifyChangeKey";
   1588   table[182] = "ntdll.dll!NtNotifyChangeMultipleKeys";
   1589   table[183] = "ntdll.dll!ZwOpenDirectoryObject";
   1590   table[184] = "ntdll.dll!NtOpenEvent";
   1591   table[185] = "ntdll.dll!NtOpenEventPair";
   1592   table[186] = "ntdll.dll!NtOpenFile";
   1593   table[187] = "ntdll.dll!ZwOpenIoCompletion";
   1594   table[188] = "ntdll.dll!ZwOpenJobObject";
   1595   table[189] = "ntdll.dll!ZwOpenKey";
   1596   table[190] = "ntdll.dll!NtOpenKeyTransacted";
   1597   table[191] = "ntdll.dll!NtOpenMutant";
   1598   table[192] = "ntdll.dll!NtOpenPrivateNamespace";
   1599   table[193] = "ntdll.dll!ZwOpenObjectAuditAlarm";
   1600   table[194] = "ntdll.dll!ZwOpenProcess";
   1601   table[195] = "ntdll.dll!ZwOpenProcessToken";
   1602   table[196] = "ntdll.dll!ZwOpenProcessTokenEx";
   1603   table[197] = "ntdll.dll!NtOpenSection";
   1604   table[198] = "ntdll.dll!NtOpenSemaphore";
   1605   table[199] = "ntdll.dll!NtOpenSession";
   1606   table[200] = "ntdll.dll!NtOpenSymbolicLinkObject";
   1607   table[201] = "ntdll.dll!ZwOpenThread";
   1608   table[202] = "ntdll.dll!NtOpenThreadToken";
   1609   table[203] = "ntdll.dll!NtOpenThreadTokenEx";
   1610   table[204] = "ntdll.dll!ZwOpenTimer";
   1611   table[205] = "ntdll.dll!NtPlugPlayControl";
   1612   table[206] = "ntdll.dll!ZwPowerInformation";
   1613   table[207] = "ntdll.dll!ZwPrivilegeCheck";
   1614   table[208] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm";
   1615   table[209] = "ntdll.dll!NtPrivilegedServiceAuditAlarm";
   1616   table[210] = "ntdll.dll!ZwProtectVirtualMemory";
   1617   table[211] = "ntdll.dll!ZwPulseEvent";
   1618   table[212] = "ntdll.dll!ZwQueryAttributesFile";
   1619   table[213] = "ntdll.dll!ZwQueryBootEntryOrder";
   1620   table[214] = "ntdll.dll!ZwQueryBootOptions";
   1621   table[215] = "ntdll.dll!NtQueryDebugFilterState";
   1622   table[216] = "ntdll.dll!NtQueryDefaultLocale";
   1623   table[217] = "ntdll.dll!ZwQueryDefaultUILanguage";
   1624   table[218] = "ntdll.dll!ZwQueryDirectoryFile";
   1625   table[219] = "ntdll.dll!ZwQueryDirectoryObject";
   1626   table[220] = "ntdll.dll!NtQueryDriverEntryOrder";
   1627   table[221] = "ntdll.dll!ZwQueryEaFile";
   1628   table[222] = "ntdll.dll!NtQueryEvent";
   1629   table[223] = "ntdll.dll!ZwQueryFullAttributesFile";
   1630   table[224] = "ntdll.dll!NtQueryInformationAtom";
   1631   table[225] = "ntdll.dll!ZwQueryInformationFile";
   1632   table[226] = "ntdll.dll!ZwQueryInformationJobObject";
   1633   table[227] = "ntdll.dll!ZwQueryInformationPort";
   1634   table[228] = "ntdll.dll!ZwQueryInformationProcess";
   1635   table[229] = "ntdll.dll!NtQueryInformationThread";
   1636   table[230] = "ntdll.dll!ZwQueryInformationToken";
   1637   table[231] = "ntdll.dll!NtQueryInstallUILanguage";
   1638   table[232] = "ntdll.dll!NtQueryIntervalProfile";
   1639   table[233] = "ntdll.dll!NtQueryIoCompletion";
   1640   table[234] = "ntdll.dll!ZwQueryKey";
   1641   table[235] = "ntdll.dll!NtQueryMultipleValueKey";
   1642   table[236] = "ntdll.dll!NtQueryMutant";
   1643   table[237] = "ntdll.dll!NtQueryObject";
   1644   table[238] = "ntdll.dll!NtQueryOpenSubKeys";
   1645   table[239] = "ntdll.dll!NtQueryOpenSubKeysEx";
   1646   table[240] = "ntdll.dll!NtQueryPerformanceCounter";
   1647   table[241] = "ntdll.dll!ZwQueryQuotaInformationFile";
   1648   table[242] = "ntdll.dll!ZwQuerySection";
   1649   table[243] = "ntdll.dll!NtQuerySecurityObject";
   1650   table[244] = "ntdll.dll!ZwQuerySemaphore";
   1651   table[245] = "ntdll.dll!ZwQuerySymbolicLinkObject";
   1652   table[246] = "ntdll.dll!ZwQuerySystemEnvironmentValue";
   1653   table[247] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx";
   1654   table[248] = "ntdll.dll!NtQuerySystemInformation";
   1655   table[249] = "ntdll.dll!NtQuerySystemTime";
   1656   table[250] = "ntdll.dll!ZwQueryTimer";
   1657   table[251] = "ntdll.dll!NtQueryTimerResolution";
   1658   table[252] = "ntdll.dll!ZwQueryValueKey";
   1659   table[253] = "ntdll.dll!NtQueryVirtualMemory";
   1660   table[254] = "ntdll.dll!NtQueryVolumeInformationFile";
   1661   table[255] = "ntdll.dll!NtQueueApcThread";
   1662   table[256] = "ntdll.dll!ZwRaiseException";
   1663   table[257] = "ntdll.dll!ZwRaiseHardError";
   1664   table[258] = "ntdll.dll!NtReadFile";
   1665   table[259] = "ntdll.dll!NtReadFileScatter";
   1666   table[260] = "ntdll.dll!ZwReadRequestData";
   1667   table[261] = "ntdll.dll!NtReadVirtualMemory";
   1668   table[262] = "ntdll.dll!ZwRegisterThreadTerminatePort";
   1669   table[263] = "ntdll.dll!ZwReleaseMutant";
   1670   table[264] = "ntdll.dll!NtReleaseSemaphore";
   1671   table[265] = "ntdll.dll!ZwRemoveIoCompletion";
   1672   table[266] = "ntdll.dll!ZwRemoveProcessDebug";
   1673   table[267] = "ntdll.dll!ZwRenameKey";
   1674   table[268] = "ntdll.dll!ZwReplaceKey";
   1675   table[269] = "ntdll.dll!NtReplacePartitionUnit";
   1676   table[270] = "ntdll.dll!ZwReplyPort";
   1677   table[271] = "ntdll.dll!NtReplyWaitReceivePort";
   1678   table[272] = "ntdll.dll!NtReplyWaitReceivePortEx";
   1679   table[273] = "ntdll.dll!NtReplyWaitReplyPort";
   1680   table[274] = "ntdll.dll!ZwRequestDeviceWakeup";
   1681   table[275] = "ntdll.dll!ZwRequestPort";
   1682   table[276] = "ntdll.dll!NtRequestWaitReplyPort";
   1683   table[277] = "ntdll.dll!ZwRequestWakeupLatency";
   1684   table[278] = "ntdll.dll!NtResetEvent";
   1685   table[279] = "ntdll.dll!ZwResetWriteWatch";
   1686   table[280] = "ntdll.dll!NtRestoreKey";
   1687   table[281] = "ntdll.dll!ZwResumeProcess";
   1688   table[282] = "ntdll.dll!ZwResumeThread";
   1689   table[283] = "ntdll.dll!NtSaveKey";
   1690   table[284] = "ntdll.dll!NtSaveKeyEx";
   1691   table[285] = "ntdll.dll!NtSaveMergedKeys";
   1692   table[286] = "ntdll.dll!NtSecureConnectPort";
   1693   table[287] = "ntdll.dll!ZwSetBootEntryOrder";
   1694   table[288] = "ntdll.dll!ZwSetBootOptions";
   1695   table[289] = "ntdll.dll!ZwSetContextThread";
   1696   table[290] = "ntdll.dll!NtSetDebugFilterState";
   1697   table[291] = "ntdll.dll!NtSetDefaultHardErrorPort";
   1698   table[292] = "ntdll.dll!NtSetDefaultLocale";
   1699   table[293] = "ntdll.dll!ZwSetDefaultUILanguage";
   1700   table[294] = "ntdll.dll!NtSetDriverEntryOrder";
   1701   table[295] = "ntdll.dll!ZwSetEaFile";
   1702   table[296] = "ntdll.dll!NtSetEvent";
   1703   table[297] = "ntdll.dll!NtSetEventBoostPriority";
   1704   table[298] = "ntdll.dll!NtSetHighEventPair";
   1705   table[299] = "ntdll.dll!NtSetHighWaitLowEventPair";
   1706   table[300] = "ntdll.dll!ZwSetInformationDebugObject";
   1707   table[301] = "ntdll.dll!ZwSetInformationFile";
   1708   table[302] = "ntdll.dll!ZwSetInformationJobObject";
   1709   table[303] = "ntdll.dll!ZwSetInformationKey";
   1710   table[304] = "ntdll.dll!ZwSetInformationObject";
   1711   table[305] = "ntdll.dll!ZwSetInformationProcess";
   1712   table[306] = "ntdll.dll!ZwSetInformationThread";
   1713   table[307] = "ntdll.dll!ZwSetInformationToken";
   1714   table[308] = "ntdll.dll!NtSetIntervalProfile";
   1715   table[309] = "ntdll.dll!NtSetIoCompletion";
   1716   table[310] = "ntdll.dll!ZwSetLdtEntries";
   1717   table[311] = "ntdll.dll!ZwSetLowEventPair";
   1718   table[312] = "ntdll.dll!ZwSetLowWaitHighEventPair";
   1719   table[313] = "ntdll.dll!ZwSetQuotaInformationFile";
   1720   table[314] = "ntdll.dll!NtSetSecurityObject";
   1721   table[315] = "ntdll.dll!ZwSetSystemEnvironmentValue";
   1722   table[316] = "ntdll.dll!ZwSetSystemEnvironmentValueEx";
   1723   table[317] = "ntdll.dll!ZwSetSystemInformation";
   1724   table[318] = "ntdll.dll!ZwSetSystemPowerState";
   1725   table[319] = "ntdll.dll!ZwSetSystemTime";
   1726   table[320] = "ntdll.dll!ZwSetThreadExecutionState";
   1727   table[321] = "ntdll.dll!ZwSetTimer";
   1728   table[322] = "ntdll.dll!NtSetTimerResolution";
   1729   table[323] = "ntdll.dll!ZwSetUuidSeed";
   1730   table[324] = "ntdll.dll!ZwSetValueKey";
   1731   table[325] = "ntdll.dll!NtSetVolumeInformationFile";
   1732   table[326] = "ntdll.dll!ZwShutdownSystem";
   1733   table[327] = "ntdll.dll!ZwSignalAndWaitForSingleObject";
   1734   table[328] = "ntdll.dll!NtStartProfile";
   1735   table[329] = "ntdll.dll!ZwStopProfile";
   1736   table[330] = "ntdll.dll!ZwSuspendProcess";
   1737   table[331] = "ntdll.dll!ZwSuspendThread";
   1738   table[332] = "ntdll.dll!NtSystemDebugControl";
   1739   table[333] = "ntdll.dll!ZwTerminateJobObject";
   1740   table[334] = "ntdll.dll!ZwTerminateProcess";
   1741   table[335] = "ntdll.dll!ZwTerminateThread";
   1742   table[336] = "ntdll.dll!NtTestAlert";
   1743   table[337] = "ntdll.dll!ZwThawRegistry";
   1744   table[338] = "ntdll.dll!NtThawTransactions";
   1745   table[339] = "ntdll.dll!NtTraceEvent";
   1746   table[340] = "ntdll.dll!ZwTraceControl";
   1747   table[341] = "ntdll.dll!NtTranslateFilePath";
   1748   table[342] = "ntdll.dll!ZwUnloadDriver";
   1749   table[343] = "ntdll.dll!NtUnloadKey";
   1750   table[344] = "ntdll.dll!ZwUnloadKey2";
   1751   table[345] = "ntdll.dll!ZwUnloadKeyEx";
   1752   table[346] = "ntdll.dll!ZwUnlockFile";
   1753   table[347] = "ntdll.dll!NtUnlockVirtualMemory";
   1754   table[348] = "ntdll.dll!NtUnmapViewOfSection";
   1755   table[349] = "ntdll.dll!NtVdmControl";
   1756   table[350] = "ntdll.dll!NtWaitForDebugEvent";
   1757   table[351] = "ntdll.dll!NtWaitForMultipleObjects";
   1758   table[352] = "ntdll.dll!ZwWaitForSingleObject";
   1759   table[353] = "ntdll.dll!ZwWaitHighEventPair";
   1760   table[354] = "ntdll.dll!NtWaitLowEventPair";
   1761   table[355] = "ntdll.dll!NtWriteFile";
   1762   table[356] = "ntdll.dll!NtWriteFileGather";
   1763   table[357] = "ntdll.dll!NtWriteRequestData";
   1764   table[358] = "ntdll.dll!NtWriteVirtualMemory";
   1765   table[359] = "ntdll.dll!ZwYieldExecution";
   1766   table[360] = "ntdll.dll!ZwCreateKeyedEvent";
   1767   table[361] = "ntdll.dll!NtOpenKeyedEvent";
   1768   table[362] = "ntdll.dll!NtReleaseKeyedEvent";
   1769   table[363] = "ntdll.dll!NtWaitForKeyedEvent";
   1770   table[364] = "ntdll.dll!ZwQueryPortInformationProcess";
   1771   table[365] = "ntdll.dll!NtGetCurrentProcessorNumber";
   1772   table[366] = "ntdll.dll!NtWaitForMultipleObjects32";
   1773   table[367] = "ntdll.dll!ZwGetNextProcess";
   1774   table[368] = "ntdll.dll!ZwGetNextThread";
   1775   table[369] = "ntdll.dll!NtCancelIoFileEx";
   1776   table[370] = "ntdll.dll!NtCancelSynchronousIoFile";
   1777   table[371] = "ntdll.dll!ZwRemoveIoCompletionEx";
   1778   table[372] = "ntdll.dll!ZwRegisterProtocolAddressInformation";
   1779   table[373] = "ntdll.dll!NtPropagationComplete";
   1780   table[374] = "ntdll.dll!ZwPropagationFailed";
   1781   table[375] = "ntdll.dll!NtCreateWorkerFactory";
   1782   table[376] = "ntdll.dll!ZwReleaseWorkerFactoryWorker";
   1783   table[377] = "ntdll.dll!NtWaitForWorkViaWorkerFactory";
   1784   table[378] = "ntdll.dll!ZwSetInformationWorkerFactory";
   1785   table[379] = "ntdll.dll!ZwQueryInformationWorkerFactory";
   1786   table[380] = "ntdll.dll!NtWorkerFactoryWorkerReady";
   1787   table[381] = "ntdll.dll!NtShutdownWorkerFactory";
   1788   table[382] = "ntdll.dll!NtCreateThreadEx";
   1789   table[383] = "ntdll.dll!NtCreateUserProcess";
   1790   table[384] = "ntdll.dll!NtQueryLicenseValue";
   1791   table[385] = "ntdll.dll!ZwMapCMFModule";
   1792   table[386] = "ntdll.dll!ZwIsUILanguageComitted";
   1793   table[387] = "ntdll.dll!ZwFlushInstallUILanguage";
   1794   table[388] = "ntdll.dll!NtGetMUIRegistryInfo";
   1795   table[389] = "ntdll.dll!ZwAcquireCMFViewOwnership";
   1796   table[390] = "ntdll.dll!NtReleaseCMFViewOwnership";
   1797   table[4545] = "imm32.dll!NtUserGetThreadState";
   1798   table[4520] = "imm32.dll!NtUserGetImeInfoEx";
   1799   table[4600] = "imm32.dll!NtUserQueryWindow";
   1800   table[4598] = "imm32.dll!NtUserQueryInputContext";
   1801   table[4581] = "imm32.dll!NtUserNotifyIMEStatus";
   1802   table[4412] = "imm32.dll!NtUserAssociateInputContext";
   1803   table[4429] = "imm32.dll!NtUserCallOneParam";
   1804   table[4463] = "imm32.dll!NtUserDisableThreadIme";
   1805   table[4635] = "imm32.dll!NtUserSetImeInfoEx";
   1806   table[4697] = "imm32.dll!NtUserUpdateInputContext";
   1807   table[4417] = "imm32.dll!NtUserBuildHimcList";
   1808   table[4704] = "imm32.dll!NtUserValidateHandleSecure";
   1809   table[4450] = "imm32.dll!NtUserCreateInputContext";
   1810   table[4460] = "imm32.dll!NtUserDestroyInputContext";
   1811   table[4492] = "imm32.dll!NtUserGetAppImeLevel";
   1812   table[4519] = "imm32.dll!NtUserGetImeHotKey";
   1813   table[4623] = "imm32.dll!NtUserSetAppImeLevel";
   1814   table[4657] = "imm32.dll!NtUserSetThreadLayoutHandles";
   1815   table[4560] = "user32.dll!NtUserInitializeClientPfnArrays";
   1816   table[4596] = "user32.dll!NtUserProcessConnect";
   1817   table[4453] = "user32.dll!NtUserCreateWindowStation";
   1818   table[4449] = "user32.dll!NtUserCreateDesktopEx";
   1819   table[4695] = "user32.dll!NtUserUnregisterUserApiHook";
   1820   table[4607] = "user32.dll!NtUserRegisterUserApiHook";
   1821   table[4634] = "user32.dll!NtUserSetImeHotKey";
   1822   table[4670] = "user32.dll!NtUserSetWindowStationUser";
   1823   table[4568] = "user32.dll!NtUserLoadKeyboardLayoutEx";
   1824   table[4702] = "user32.dll!NtUserUpdatePerUserSystemParameters";
   1825   table[4465] = "user32.dll!NtUserDoSoundConnect";
   1826   table[4720] = "user32.dll!NtUserRegisterSessionPort";
   1827   table[4423] = "user32.dll!NtUserCallHwndOpt";
   1828   table[4651] = "user32.dll!NtUserSetShellWindowEx";
   1829   table[4421] = "user32.dll!NtUserCallHwnd";
   1830   table[4723] = "user32.dll!NtUserDwmStartRedirection";
   1831   table[4609] = "user32.dll!NtUserRegisterRawInputDevices";
   1832   table[4495] = "user32.dll!NtUserGetCaretBlinkTime";
   1833   table[4681] = "user32.dll!NtUserThunkedMenuInfo";
   1834   table[4570] = "user32.dll!NtUserLockWindowUpdate";
   1835   table[4445] = "user32.dll!NtUserCopyAcceleratorTable";
   1836   table[4478] = "user32.dll!NtUserEndMenu";
   1837   table[4458] = "user32.dll!DestroyAcceleratorTable";
   1838   table[4625] = "user32.dll!NtUserSetClassLong";
   1839   table[4613] = "user32.dll!NtUserRemoveMenu";
   1840   table[4643] = "user32.dll!NtUserSetMenuDefaultItem";
   1841   table[4461] = "user32.dll!NtUserDestroyMenu";
   1842   table[4553] = "user32.dll!NtUserGhostWindowFromHungWindow";
   1843   table[4590] = "user32.dll!NtUserPaintMonitor";
   1844   table[4589] = "user32.dll!NtUserPaintDesktop";
   1845   table[4454] = "user32.dll!NtUserDdeInitialize";
   1846   table[4663] = "user32.dll!NtUserSetWindowPlacement";
   1847   table[4669] = "user32.dll!NtUserSetWindowsHookEx";
   1848   table[4457] = "user32.dll!NtUserDeleteMenu";
   1849   table[4565] = "user32.dll!NtUserInvalidateRgn";
   1850   table[4638] = "user32.dll!NtUserSetInformationThread";
   1851   table[4493] = "user32.dll!NtUserGetAsyncKeyState";
   1852   table[4434] = "user32.dll!NtUserCheckDesktopByThreadId";
   1853   table[4727] = "user32.dll!NtUserGetWindowMinimizeRect";
   1854   table[4672] = "user32.dll!NtUserSetWinEventHook";
   1855   table[4508] = "user32.dll!NtUserGetCPD";
   1856   table[4665] = "user32.dll!NtUserSetWindowRgn";
   1857   table[4569] = "user32.dll!NtUserLockWindowStation";
   1858   table[4485] = "user32.dll!NtUserFillWindow";
   1859   table[4677] = "user32.dll!NtUserSoundSentry";
   1860   table[4696] = "user32.dll!NtUserUnregisterHotKey";
   1861   table[4524] = "user32.dll!NtUserGetKeyboardState";
   1862   table[4691] = "user32.dll!NtUserUnhookWinEvent";
   1863   table[4621] = "user32.dll!NtUserSendInput";
   1864   table[4658] = "user32.dll!NtUserSetThreadState";
   1865   table[4624] = "user32.dll!NtUserSetCapture";
   1866   table[4633] = "user32.dll!NtUserSetFocus";
   1867   table[4636] = "user32.dll!NtUserSetImeOwnerWindow";
   1868   table[4425] = "user32.dll!NtUserCallHwndParamLock";
   1869   table[4686] = "user32.dll!NtUserCalcMenuBar";
   1870   table[4546] = "user32.dll!NtUserGetTitleBarInfo";
   1871   table[4512] = "user32.dll!NtUserGetDCEx";
   1872   table[4528] = "user32.dll!NtUserGetMenuBarInfo";
   1873   table[4678] = "user32.dll!NtUserSwitchDesktop";
   1874   table[4522] = "user32.dll!NtUserGetKeyboardLayoutList";
   1875   table[4675] = "user32.dll!NtUserShowWindow";
   1876   table[4660] = "user32.dll!NtUserSetProcessDPIAware";
   1877   table[4646] = "user32.dll!NtUserSetParent";
   1878   table[4693] = "user32.dll!NtUserUnlockWindowStation";
   1879   table[4684] = "user32.dll!NtUserTrackMouseEvent";
   1880   table[4608] = "user32.dll!NtUserRegisterHotKey";
   1881   table[4701] = "user32.dll!NtUserSetLayeredWindowAttributes";
   1882   table[4580] = "user32.dll!NtUserMoveWindow";
   1883   table[4699] = "user32.dll!NtUserUpdateLayeredWindow";
   1884   table[4542] = "user32.dll!NtUserGetScrollBarInfo";
   1885   table[4447] = "user32.dll!NtUserCreateAcceleratorTable";
   1886   table[4630] = "user32.dll!NtUserSetCursor";
   1887   table[4586] = "user32.dll!NtUserOpenInputDesktop";
   1888   table[4514] = "user32.dll!NtUserGetForegroundWindow";
   1889   table[4548] = "user32.dll!GetUpdateRect";
   1890   table[4656] = "user32.dll!NtUserSetThreadDesktop";
   1891   table[4536] = "user32.dll!NtUserGetProcessWindowStation";
   1892   table[4647] = "user32.dll!NtUserSetProcessWindowStation";
   1893   table[4605] = "user32.dll!NtUserRegisterClassExWOW";
   1894   table[4494] = "user32.dll!NtUserGetAtomName";
   1895   table[4697] = "user32.dll!NtUserUpdateInputContext";
   1896   table[4661] = "user32.dll!NtUserSetWindowFNID";
   1897   table[4498] = "user32.dll!NtUserGetClassName";
   1898   table[4516] = "user32.dll!NtUserGetGUIThreadInfo";
   1899   table[4585] = "user32.dll!NtUserOpenDesktop";
   1900   table[4419] = "user32.dll!NtUserBuildNameList";
   1901   table[4617] = "user32.dll!NtUserSBGetParms";
   1902   table[4674] = "user32.dll!NtUserShowScrollBar";
   1903   table[4588] = "user32.dll!NtUserOpenWindowStation";
   1904   table[4694] = "user32.dll!NtUserUnregisterClass";
   1905   table[4481] = "user32.dll!NtUserEnumDisplayMonitors";
   1906   table[4462] = "user32.dll!NtUserDestroyWindow";
   1907   table[4441] = "user32.dll!NtUserCloseDesktop";
   1908   table[4459] = "user32.dll!NtUserDestroyCursor";
   1909   table[4442] = "user32.dll!NtUserCloseWindowStation";
   1910   table[4418] = "user32.dll!NtUserBuildHwndList";
   1911   table[4594] = "user32.dll!NtUserPostThreadMessage";
   1912   table[4614] = "user32.dll!NtUserRemoveProp";
   1913   table[4662] = "user32.dll!NtUserSetWindowLong";
   1914   table[4664] = "user32.dll!NtUserSetWindowPos";
   1915   table[4422] = "user32.dll!NtUserCallHwndLock";
   1916   table[4649] = "user32.dll!NtUserSetProp";
   1917   table[4477] = "user32.dll!NtUserEndDeferWindowPosEx";
   1918   table[4455] = "user32.dll!NtUserDeferWindowPos";
   1919   table[4632] = "user32.dll!NtUserSetCursorIconData";
   1920   table[4486] = "user32.dll!NtUserFindExistingCursorIcon";
   1921   table[4533] = "user32.dll!NtUserGetObjectInformation";
   1922   table[4452] = "user32.dll!NtUserCreateWindowEx";
   1923   table[4682] = "user32.dll!NtUserThunkedMenuItemInfo";
   1924   table[4543] = "user32.dll!NtUserGetSystemMenu";
   1925   table[4676] = "user32.dll!NtUserShowWindowAsync";
   1926   table[4600] = "user32.dll!NtUserQueryWindow";
   1927   table[4517] = "user32.dll!NtUserGetIconInfo";
   1928   table[4518] = "user32.dll!NtUserGetIconSize";
   1929   table[4583] = "user32.dll!NtUserNotifyWinEvent";
   1930   table[4562] = "user32.dll!NtUserInternalGetWindowText";
   1931   table[4666] = "user32.dll!NtUserGetWindowRgnEx";
   1932   table[4472] = "user32.dll!NtUserDrawIconEx";
   1933   table[4424] = "user32.dll!NtUserCallHwndParam";
   1934   table[4409] = "user32.dll!NtUserActivateKeyboardLayout";
   1935   table[4629] = "user32.dll!NtUserSetConsoleReserveKeys";
   1936   table[4557] = "user32.dll!NtUserHungWindowFromGhostWindow";
   1937   table[4622] = "user32.dll!NtUserSetActiveWindow";
   1938   table[4544] = "user32.dll!NtUserGetThreadDesktop";
   1939   table[4497] = "user32.dll!NtUserGetClassInfoEx";
   1940   table[4480] = "user32.dll!NtUserEnumDisplayDevices";
   1941   table[4482] = "user32.dll!NtUserEnumDisplaySettings";
   1942   table[4650] = "user32.dll!NtUserSetScrollInfo";
   1943   table[4526] = "user32.dll!NtUserGetKeyState";
   1944   table[4575] = "user32.dll!NtUserMessageCall";
   1945   table[4706] = "user32.dll!NtUserValidateTimerCallback";
   1946   table[4611] = "user32.dll!NtUserRegisterWindowMessage";
   1947   table[4511] = "user32.dll!NtUserGetDC";
   1948   table[4602] = "user32.dll!NtUserRealInternalGetMessage";
   1949   table[4487] = "user32.dll!NtUserFindWindowEx";
   1950   table[4500] = "user32.dll!NtUserGetClipboardFormatName";
   1951   table[4545] = "user32.dll!NtUserGetThreadState";
   1952   table[4679] = "user32.dll!NtUserSystemParametersInfo";
   1953   table[4593] = "user32.dll!NtUserPostMessage";
   1954   table[4659] = "user32.dll!NtUserSetTimer";
   1955   table[4567] = "user32.dll!NtUserKillTimer";
   1956   table[4414] = "user32.dll!NtUserBeginPaint";
   1957   table[4479] = "user32.dll!NtUserEndPaint";
   1958   table[4604] = "user32.dll!NtUserRedrawWindow";
   1959   table[4491] = "user32.dll!NtUserGetAncestor";
   1960   table[4555] = "user32.dll!NtUserHideCaret";
   1961   table[4673] = "user32.dll!NtUserShowCaret";
   1962   table[4448] = "user32.dll!NtUserCreateCaret";
   1963   table[4531] = "user32.dll!NtUserGetMessage";
   1964   table[4591] = "user32.dll!PeekMessageW";
   1965   table[4429] = "user32.dll!NtUserCallOneParam";
   1966   table[4428] = "user32.dll!NtUserCallNoParam";
   1967   table[4464] = "user32.dll!NtUserDispatchMessage";
   1968   table[4648] = "user32.dll!NtUserGetProp";
   1969   table[4550] = "user32.dll!NtUserGetWindowDC";
   1970   table[4513] = "user32.dll!NtUserGetDoubleClickTime";
   1971   table[4710] = "user32.dll!NtUserWaitMessage";
   1972   table[4564] = "user32.dll!NtUserInvalidateRect";
   1973   table[4430] = "user32.dll!NtUserCallTwoParam";
   1974   table[4618] = "user32.dll!NtUserScrollDC";
   1975   table[4704] = "user32.dll!NtUserValidateHandleSecure";
   1976   table[4439] = "user32.dll!NtUserClipCursor";
   1977   table[4571] = "user32.dll!NtUserLockWorkStation";
   1978   table[4724] = "user32.dll!NtUserDwmStopRedirection";
   1979   table[4534] = "user32.dll!NtUserGetOpenClipboardWindow";
   1980   table[4484] = "user32.dll!NtUserExcludeUpdateRgn";
   1981   table[4707] = "user32.dll!NtUserVkKeyScanEx";
   1982   table[4654] = "user32.dll!NtUserSetSystemMenu";
   1983   table[4438] = "user32.dll!NtUserChildWindowFromPointEx";
   1984   table[4671] = "user32.dll!NtUserSetWindowWord";
   1985   table[4476] = "user32.dll!NtUserEnableScrollBar";
   1986   table[4415] = "user32.dll!NtUserBitBltSysBmp";
   1987   table[4509] = "user32.dll!NtUserGetCursorFrameInfo";
   1988   table[4427] = "user32.dll!NtUserCallNextHookEx";
   1989   table[4628] = "user32.dll!NtUserSetClipboardViewer";
   1990   table[4437] = "user32.dll!CheckMenuItem";
   1991   table[4566] = "user32.dll!NtUserIsClipboardFormatAvailable";
   1992   table[4440] = "user32.dll!NtUserCloseClipboard";
   1993   table[4584] = "user32.dll!NtUserOpenClipboard";
   1994   table[4502] = "user32.dll!NtUserGetClipboardSequenceNumber";
   1995   table[4431] = "user32.dll!NtUserChangeClipboardChain";
   1996   table[4688] = "user32.dll!NtUserTranslateAccelerator";
   1997   table[4705] = "user32.dll!NtUserValidateRect";
   1998   table[4667] = "user32.dll!NtUserSetWindowRgnEx";
   1999   table[4475] = "user32.dll!NtUserEnableMenuItem";
   2000   table[4496] = "user32.dll!NtUserGetCaretPos";
   2001   table[4505] = "user32.dll!NtUserGetComboBoxInfo";
   2002   table[4426] = "user32.dll!NtUserCallMsgFilter";
   2003   table[4690] = "user32.dll!NtUserUnhookWindowsHookEx";
   2004   table[4416] = "user32.dll!NtUserBlockInput";
   2005   table[4595] = "user32.dll!NtUserPrintWindow";
   2006   table[4501] = "user32.dll!NtUserGetClipboardOwner";
   2007   table[4413] = "user32.dll!NtUserAttachThreadInput";
   2008   table[4446] = "user32.dll!NtUserCountClipboardFormats";
   2009   table[4572] = "user32.dll!NtUserLogicalToPhysicalPoint";
   2010   table[4592] = "user32.dll!NtUserPhysicalToLogicalPoint";
   2011   table[4712] = "user32.dll!NtUserWindowFromPhysicalPoint";
   2012   table[4685] = "user32.dll!NtUserTrackPopupMenuEx";
   2013   table[4641] = "user32.dll!NtUserSetMenu";
   2014   table[4432] = "user32.dll!NtUserChangeDisplaySettings";
   2015   table[4726] = "user32.dll!NtUserDwmGetDxRgn";
   2016   table[4725] = "user32.dll!NtUserDwmHintDxUpdate";
   2017   table[4573] = "user32.dll!NtUserMapVirtualKeyEx";
   2018   table[4640] = "user32.dll!NtUserSetKeyboardState";
   2019   table[4708] = "user32.dll!NtUserWaitForInputIdle";
   2020   table[4549] = "user32.dll!NtUserGetUpdateRgn";
   2021   table[4456] = "user32.dll!NtUserDefSetText";
   2022   table[4506] = "user32.dll!NtUserGetControlBrush";
   2023   table[4488] = "user32.dll!NtUserFlashWindowEx";
   2024   table[4689] = "user32.dll!NtUserTranslateMessage";
   2025   table[4619] = "user32.dll!NtUserScrollWindowEx";
   2026   table[4687] = "user32.dll!NtUserPaintMenuBar";
   2027   table[4551] = "user32.dll!NtUserGetWindowPlacement";
   2028   table[4713] = "user32.dll!NtUserWindowFromPoint";
   2029   table[4410] = "user32.dll!NtUserAddClipboardFormatListener";
   2030   table[4411] = "user32.dll!NtUserAlterWindowStyle";
   2031   table[4420] = "user32.dll!NtUserBuildPropList";
   2032   table[4433] = "user32.dll!NtUserCheckAccessForIntegrityLevel";
   2033   table[4435] = "user32.dll!NtUserCheckWindowThreadDesktop";
   2034   table[4444] = "user32.dll!NtUserConvertMemHandle";
   2035   table[4451] = "user32.dll!NtUserCreateLocalMemHandle";
   2036   table[4466] = "user32.dll!NtUserDoSoundDisconnect";
   2037   table[4467] = "user32.dll!NtUserDragDetect";
   2038   table[4468] = "user32.dll!NtUserDragObject";
   2039   table[4469] = "user32.dll!NtUserDrawAnimatedRects";
   2040   table[4470] = "user32.dll!NtUserDrawCaption";
   2041   table[4471] = "user32.dll!NtUserDrawCaptionTemp";
   2042   table[4473] = "user32.dll!NtUserDrawMenuBarTemp";
   2043   table[4474] = "user32.dll!NtUserEmptyClipboard";
   2044   table[4483] = "user32.dll!NtUserEvent";
   2045   table[4489] = "user32.dll!NtUserFrostCrashedWindow";
   2046   table[4490] = "user32.dll!NtUserGetAltTabInfo";
   2047   table[4499] = "user32.dll!NtUserGetClipboardData";
   2048   table[4503] = "user32.dll!NtUserGetClipboardViewer";
   2049   table[4504] = "user32.dll!NtUserGetClipCursor";
   2050   table[4507] = "user32.dll!NtUserGetControlColor";
   2051   table[4510] = "user32.dll!NtUserGetCursorInfo";
   2052   table[4515] = "user32.dll!NtUserGetGuiResources";
   2053   table[4519] = "user32.dll!NtUserGetImeHotKey";
   2054   table[4521] = "user32.dll!NtUserGetInternalWindowPos";
   2055   table[4523] = "user32.dll!NtUserGetKeyboardLayoutName";
   2056   table[4525] = "user32.dll!NtUserGetKeyNameText";
   2057   table[4527] = "user32.dll!NtUserGetListBoxInfo";
   2058   table[4529] = "user32.dll!NtUserGetMenuIndex";
   2059   table[4530] = "user32.dll!NtUserGetMenuItemRect";
   2060   table[4532] = "user32.dll!NtUserGetMouseMovePointsEx";
   2061   table[4535] = "user32.dll!NtUserGetPriorityClipboardFormat";
   2062   table[4537] = "user32.dll!NtUserGetRawInputBuffer";
   2063   table[4538] = "user32.dll!NtUserGetRawInputData";
   2064   table[4539] = "user32.dll!NtUserGetRawInputDeviceInfo";
   2065   table[4540] = "user32.dll!NtUserGetRawInputDeviceList";
   2066   table[4541] = "user32.dll!NtUserGetRegisteredRawInputDevices";
   2067   table[4547] = "user32.dll!NtUserGetUpdatedClipboardFormats";
   2068   table[4552] = "user32.dll!NtUserGetWOWClass";
   2069   table[4556] = "user32.dll!NtUserHiliteMenuItem";
   2070   table[4558] = "user32.dll!NtUserImpersonateDdeClientWindow";
   2071   table[4561] = "user32.dll!NtUserInitTask";
   2072   table[4563] = "user32.dll!NtUserInternalGetWindowIcon";
   2073   table[4574] = "user32.dll!NtUserMenuItemFromPoint";
   2074   table[4576] = "user32.dll!NtUserMinMaximize";
   2075   table[4577] = "user32.dll!NtUserMNDragLeave";
   2076   table[4578] = "user32.dll!NtUserMNDragOver";
   2077   table[4579] = "user32.dll!NtUserModifyUserStartupInfoFlags";
   2078   table[4581] = "user32.dll!NtUserNotifyIMEStatus";
   2079   table[4587] = "user32.dll!NtUserOpenThreadDesktop";
   2080   table[4599] = "user32.dll!NtUserQuerySendMessage";
   2081   table[4601] = "user32.dll!NtUserRealChildWindowFromPoint";
   2082   table[4603] = "user32.dll!NtUserRealWaitMessageEx";
   2083   table[4606] = "user32.dll!NtUserRegisterErrorReportingDialog";
   2084   table[4610] = "user32.dll!NtUserRegisterTasklist";
   2085   table[4612] = "user32.dll!NtUserRemoveClipboardFormatListener";
   2086   table[4616] = "user32.dll!NtUserResolveDesktopForWOW";
   2087   table[4626] = "user32.dll!NtUserSetClassWord";
   2088   table[4627] = "user32.dll!NtUserSetClipboardData";
   2089   table[4631] = "user32.dll!NtUserSetCursorContents";
   2090   table[4639] = "user32.dll!NtUserSetInternalWindowPos";
   2091   table[4642] = "user32.dll!NtUserSetMenuContextHelpId";
   2092   table[4644] = "user32.dll!NtUserSetMenuFlagRtoL";
   2093   table[4645] = "user32.dll!NtUserSetObjectInformation";
   2094   table[4652] = "user32.dll!NtUserSetSysColors";
   2095   table[4653] = "user32.dll!NtUserSetSystemCursor";
   2096   table[4655] = "user32.dll!NtUserSetSystemTimer";
   2097   table[4668] = "user32.dll!NtUserSetWindowsHookAW";
   2098   table[4680] = "user32.dll!NtUserTestForInteractiveUser";
   2099   table[4683] = "user32.dll!NtUserToUnicodeEx";
   2100   table[4692] = "user32.dll!NtUserUnloadKeyboardLayout";
   2101   table[4698] = "user32.dll!NtUserUpdateInstance";
   2102   table[4700] = "user32.dll!NtUserGetLayeredWindowAttributes";
   2103   table[4703] = "user32.dll!NtUserUserHandleGrantAccess";
   2104   table[4709] = "user32.dll!NtUserWaitForMsgAndEvent";
   2105   table[4711] = "user32.dll!NtUserWin32PoolAllocationStats";
   2106   table[4714] = "user32.dll!NtUserYieldTask";
   2107   table[4721] = "user32.dll!NtUserUnregisterSessionPort";
   2108   table[4722] = "user32.dll!NtUserUpdateWindowTransform";
   2109   table[4866] = "user32.dll!NtUserSetMirrorRendering";
   2110   table[4867] = "user32.dll!NtUserShowSystemCursor";
   2111 }
   2112 
   2113   return table;
   2114 }
   2115 
   2116 #endif  // TRACELINE_SYSCALL_MAP_H_
   2117