SSDT[0] at 80501b8c with 284 entries Entry 0x0000: 0x80599a5e (NtAcceptConnectPort) owned by ntoskrnl.exe Entry 0x0001: 0x805e7704 (NtAccessCheck) owned by ntoskrnl.exe Entry 0x0002: 0x805eaf4a (NtAccessCheckAndAuditAlarm) owned by ntoskrnl.exe Entry 0x0003: 0x805e7736 (NtAccessCheckByType) owned by ntoskrnl.exe Entry 0x0004: 0x805eaf84 (NtAccessCheckByTypeAndAuditAlarm) owned by ntoskrnl.exe Entry 0x0005: 0x805e776c (NtAccessCheckByTypeResultList) owned by ntoskrnl.exe Entry 0x0006: 0x805eafc8 (NtAccessCheckByTypeResultListAndAuditAlarm) owned by ntoskrnl.exe Entry 0x0007: 0x805eb00c (NtAccessCheckByTypeResultListAndAuditAlarmByHandle) owned by ntoskrnl.exe Entry 0x0008: 0x8060c75e (NtAddAtom) owned by ntoskrnl.exe Entry 0x0009: 0x8060d4a2 (NtAddBootEntry) owned by ntoskrnl.exe Entry 0x000a: 0x805e2aea (NtAdjustGroupsToken) owned by ntoskrnl.exe Entry 0x000b: 0x805e2742 (NtAdjustPrivilegesToken) owned by ntoskrnl.exe Entry 0x000c: 0x805cafa4 (NtAlertResumeThread) owned by ntoskrnl.exe Entry 0x000d: 0x805caf54 (NtAlertThread) owned by ntoskrnl.exe Entry 0x000e: 0x8060cd84 (NtAllocateLocallyUniqueId) owned by ntoskrnl.exe Entry 0x000f: 0x805ab6ec (NtAllocateUserPhysicalPages) owned by ntoskrnl.exe Entry 0x0010: 0x8060c39c (NtAllocateUuids) owned by ntoskrnl.exe Entry 0x0011: 0x8059ded4 (NtAllocateVirtualMemory) owned by ntoskrnl.exe Entry 0x0012: 0x805a5b2e (NtAreMappedFilesTheSame) owned by ntoskrnl.exe Entry 0x0013: 0x805cca82 (NtAssignProcessToJobObject) owned by ntoskrnl.exe Entry 0x0014: 0x804ff810 (NtCallbackReturn) owned by ntoskrnl.exe Entry 0x0015: 0x805be602 (NtCancelDeviceWakeupRequest) owned by ntoskrnl.exe Entry 0x0016: 0x8056bdc8 (NtCancelIoFile) owned by ntoskrnl.exe Entry 0x0017: 0x805350ce (NtCancelTimer) owned by ntoskrnl.exe Entry 0x0018: 0x80605a34 (NtClearEvent) owned by ntoskrnl.exe Entry 0x0019: 0x805b1d78 (NtClose) owned by ntoskrnl.exe Entry 0x001a: 0x805eb484 (NtCloseObjectAuditAlarm) owned by ntoskrnl.exe Entry 0x001b: 0x8061a7b2 (NtCompactKeys) owned by ntoskrnl.exe Entry 0x001c: 0x805ef998 (NtCompareTokens) owned by ntoskrnl.exe Entry 0x001d: 0x8059a14c (NtCompleteConnectPort) owned by ntoskrnl.exe Entry 0x001e: 0x8061aa06 (NtCompressKey) owned by ntoskrnl.exe Entry 0x001f: 0x805999fe (NtConnectPort) owned by ntoskrnl.exe Entry 0x0020: 0x80540ed8 (NtContinue) owned by ntoskrnl.exe Entry 0x0021: 0x8063957e (NtCreateDebugObject) owned by ntoskrnl.exe Entry 0x0022: 0x805b3dac (NtCreateDirectoryObject) owned by ntoskrnl.exe Entry 0x0023: 0x80605a84 (NtCreateEvent) owned by ntoskrnl.exe Entry 0x0024: 0x8060dd18 (NtCreateEventPair) owned by ntoskrnl.exe Entry 0x0025: 0x8056e36e (NtCreateFile) owned by ntoskrnl.exe Entry 0x0026: 0x8056dd4c (NtCreateIoCompletion) owned by ntoskrnl.exe Entry 0x0027: 0x805cba46 (NtCreateJobObject) owned by ntoskrnl.exe Entry 0x0028: 0x805cb77e (NtCreateJobSet) owned by ntoskrnl.exe Entry 0x0029: 0x8061abe2 (NtCreateKey) owned by ntoskrnl.exe Entry 0x002a: 0x8056e47c (NtCreateMailslotFile) owned by ntoskrnl.exe Entry 0x002b: 0x8060e110 (NtCreateMutant) owned by ntoskrnl.exe Entry 0x002c: 0x8056e3a8 (NtCreateNamedPipeFile) owned by ntoskrnl.exe Entry 0x002d: 0x805a0ebc (NtCreatePagingFile) owned by ntoskrnl.exe Entry 0x002e: 0x8059a51a (NtCreatePort) owned by ntoskrnl.exe Entry 0x002f: 0x805c7576 (NtCreateProcess) owned by ntoskrnl.exe Entry 0x0030: 0x805c74c0 (NtCreateProcessEx) owned by ntoskrnl.exe Entry 0x0031: 0x8060e530 (NtCreateProfile) owned by ntoskrnl.exe Entry 0x0032: 0x805a0800 (NtCreateSection) owned by ntoskrnl.exe Entry 0x0033: 0x8060baba (NtCreateSemaphore) owned by ntoskrnl.exe Entry 0x0034: 0x805b96d2 (NtCreateSymbolicLinkObject) owned by ntoskrnl.exe Entry 0x0035: 0x805c735e (NtCreateThread) owned by ntoskrnl.exe Entry 0x0036: 0x8060d9e0 (NtCreateTimer) owned by ntoskrnl.exe Entry 0x0037: 0x805efd40 (NtCreateToken) owned by ntoskrnl.exe Entry 0x0038: 0x8059a53e (NtCreateWaitablePort) owned by ntoskrnl.exe Entry 0x0039: 0x8063a65a (NtDebugActiveProcess) owned by ntoskrnl.exe Entry 0x003a: 0x8063a7aa (NtDebugContinue) owned by ntoskrnl.exe Entry 0x003b: 0x8060d3f2 (NtDelayExecution) owned by ntoskrnl.exe Entry 0x003c: 0x8060cc14 (NtDeleteAtom) owned by ntoskrnl.exe Entry 0x003d: 0x805be602 (NtDeleteBootEntry) owned by ntoskrnl.exe Entry 0x003e: 0x8056bf0e (NtDeleteFile) owned by ntoskrnl.exe Entry 0x003f: 0x8061b07e (NtDeleteKey) owned by ntoskrnl.exe Entry 0x0040: 0x805eb590 (NtDeleteObjectAuditAlarm) owned by ntoskrnl.exe Entry 0x0041: 0x8061b24e (NtDeleteValueKey) owned by ntoskrnl.exe Entry 0x0042: 0x8056e534 (NtDeviceIoControlFile) owned by ntoskrnl.exe Entry 0x0043: 0x80609a2e (NtDisplayString) owned by ntoskrnl.exe Entry 0x0044: 0x805b398c (NtDuplicateObject) owned by ntoskrnl.exe Entry 0x0045: 0x805e3998 (NtDuplicateToken) owned by ntoskrnl.exe Entry 0x0046: 0x8060d4a2 (NtEnumerateBootEntries) owned by ntoskrnl.exe Entry 0x0047: 0x8061b42e (NtEnumerateKey) owned by ntoskrnl.exe Entry 0x0048: 0x8060d494 (NtEnumerateSystemEnvironmentValuesEx) owned by ntoskrnl.exe Entry 0x0049: 0x8061b698 (NtEnumerateValueKey) owned by ntoskrnl.exe Entry 0x004a: 0x805a9258 (NtExtendSection) owned by ntoskrnl.exe Entry 0x004b: 0x805e3b44 (NtFilterToken) owned by ntoskrnl.exe Entry 0x004c: 0x8060c9c8 (NtFindAtom) owned by ntoskrnl.exe Entry 0x004d: 0x8056bfda (NtFlushBuffersFile) owned by ntoskrnl.exe Entry 0x004e: 0x805abf76 (NtFlushInstructionCache) owned by ntoskrnl.exe Entry 0x004f: 0x8061b902 (NtFlushKey) owned by ntoskrnl.exe Entry 0x0050: 0x805a1be6 (NtFlushVirtualMemory) owned by ntoskrnl.exe Entry 0x0051: 0x805abf18 (NtFlushWriteBuffer) owned by ntoskrnl.exe Entry 0x0052: 0x805aba88 (NtFreeUserPhysicalPages) owned by ntoskrnl.exe Entry 0x0053: 0x805a852e (NtFreeVirtualMemory) owned by ntoskrnl.exe Entry 0x0054: 0x8056e568 (NtFsControlFile) owned by ntoskrnl.exe Entry 0x0055: 0x805c8da6 (NtGetContextThread) owned by ntoskrnl.exe Entry 0x0056: 0x805be624 (NtGetDevicePowerState) owned by ntoskrnl.exe Entry 0x0057: 0x8058e694 (NtGetPlugPlayEvent) owned by ntoskrnl.exe Entry 0x0058: 0x8051d9a2 (NtGetWriteWatch) owned by ntoskrnl.exe Entry 0x0059: 0x805ef68c (NtImpersonateAnonymousToken) owned by ntoskrnl.exe Entry 0x005a: 0x8059a5a8 (NtImpersonateClientOfPort) owned by ntoskrnl.exe Entry 0x005b: 0x805cdc1a (NtImpersonateThread) owned by ntoskrnl.exe Entry 0x005c: 0x80618d24 (NtInitializeRegistry) owned by ntoskrnl.exe Entry 0x005d: 0x805be3fc (NtInitiatePowerAction) owned by ntoskrnl.exe Entry 0x005e: 0x805cb642 (NtIsProcessInJob) owned by ntoskrnl.exe Entry 0x005f: 0x805be610 (NtIsSystemResumeAutomatic) owned by ntoskrnl.exe Entry 0x0060: 0x8059a7b4 (NtListenPort) owned by ntoskrnl.exe Entry 0x0061: 0x80579694 (NtLoadDriver) owned by ntoskrnl.exe Entry 0x0062: 0x8061ce06 (NtLoadKey) owned by ntoskrnl.exe Entry 0x0063: 0x8061ca12 (NtLoadKey2) owned by ntoskrnl.exe Entry 0x0064: 0x8056e59c (NtLockFile) owned by ntoskrnl.exe Entry 0x0065: 0x80609f90 (NtLockProductActivationKeys) owned by ntoskrnl.exe Entry 0x0066: 0x8061aab2 (NtLockRegistryKey) owned by ntoskrnl.exe Entry 0x0067: 0x805ac07e (NtLockVirtualMemory) owned by ntoskrnl.exe Entry 0x0068: 0x805b522c (NtMakePermanentObject) owned by ntoskrnl.exe Entry 0x0069: 0x805b1e1c (NtMakeTemporaryObject) owned by ntoskrnl.exe Entry 0x006a: 0x805aa9e0 (NtMapUserPhysicalPages) owned by ntoskrnl.exe Entry 0x006b: 0x805aafb8 (NtMapUserPhysicalPagesScatter) owned by ntoskrnl.exe Entry 0x006c: 0x805a75ae (NtMapViewOfSection) owned by ntoskrnl.exe Entry 0x006d: 0x805be602 (NtModifyBootEntry) owned by ntoskrnl.exe Entry 0x006e: 0x8056f1cc (NtNotifyChangeDirectoryFile) owned by ntoskrnl.exe Entry 0x006f: 0x8061cdd0 (NtNotifyChangeKey) owned by ntoskrnl.exe Entry 0x0070: 0x8061ba04 (NtNotifyChangeMultipleKeys) owned by ntoskrnl.exe Entry 0x0071: 0x805b3e7e (NtOpenDirectoryObject) owned by ntoskrnl.exe Entry 0x0072: 0x80605b84 (NtOpenEvent) owned by ntoskrnl.exe Entry 0x0073: 0x8060ddf0 (NtOpenEventPair) owned by ntoskrnl.exe Entry 0x0074: 0x8056f48c (NtOpenFile) owned by ntoskrnl.exe Entry 0x0075: 0x8056de24 (NtOpenIoCompletion) owned by ntoskrnl.exe Entry 0x0076: 0x805cbbcc (NtOpenJobObject) owned by ntoskrnl.exe Entry 0x0077: 0x8061bfc0 (NtOpenKey) owned by ntoskrnl.exe Entry 0x0078: 0x8060e1e8 (NtOpenMutant) owned by ntoskrnl.exe Entry 0x0079: 0x805eb052 (NtOpenObjectAuditAlarm) owned by ntoskrnl.exe Entry 0x007a: 0x805c13e2 (NtOpenProcess) owned by ntoskrnl.exe Entry 0x007b: 0x805e4332 (NtOpenProcessToken) owned by ntoskrnl.exe Entry 0x007c: 0x805e3f96 (NtOpenProcessTokenEx) owned by ntoskrnl.exe Entry 0x007d: 0x8059f836 (NtOpenSection) owned by ntoskrnl.exe Entry 0x007e: 0x8060bbb4 (NtOpenSemaphore) owned by ntoskrnl.exe Entry 0x007f: 0x805b98b8 (NtOpenSymbolicLinkObject) owned by ntoskrnl.exe Entry 0x0080: 0x805c166e (NtOpenThread) owned by ntoskrnl.exe Entry 0x0081: 0x805e4350 (NtOpenThreadToken) owned by ntoskrnl.exe Entry 0x0082: 0x805e4106 (NtOpenThreadTokenEx) owned by ntoskrnl.exe Entry 0x0083: 0x8060db02 (NtOpenTimer) owned by ntoskrnl.exe Entry 0x0084: 0x8063c84c (NtPlugPlayControl) owned by ntoskrnl.exe Entry 0x0085: 0x805bf492 (NtPowerInformation) owned by ntoskrnl.exe Entry 0x0086: 0x805ee73e (NtPrivilegeCheck) owned by ntoskrnl.exe Entry 0x0087: 0x805ea364 (NtPrivilegeObjectAuditAlarm) owned by ntoskrnl.exe Entry 0x0088: 0x805ea550 (NtPrivilegedServiceAuditAlarm) owned by ntoskrnl.exe Entry 0x0089: 0x805adb46 (NtProtectVirtualMemory) owned by ntoskrnl.exe Entry 0x008a: 0x80605c3c (NtPulseEvent) owned by ntoskrnl.exe Entry 0x008b: 0x8056c1c0 (NtQueryAttributesFile) owned by ntoskrnl.exe Entry 0x008c: 0x8060d4a2 (NtQueryBootEntryOrder) owned by ntoskrnl.exe Entry 0x008d: 0x8060d4a2 (NtQueryBootOptions) owned by ntoskrnl.exe Entry 0x008e: 0x8053c0ee (NtQueryDebugFilterState) owned by ntoskrnl.exe Entry 0x008f: 0x806077c8 (NtQueryDefaultLocale) owned by ntoskrnl.exe Entry 0x0090: 0x80608428 (NtQueryDefaultUILanguage) owned by ntoskrnl.exe Entry 0x0091: 0x8056f166 (NtQueryDirectoryFile) owned by ntoskrnl.exe Entry 0x0092: 0x805b3f1e (NtQueryDirectoryObject) owned by ntoskrnl.exe Entry 0x0093: 0x8056f4bc (NtQueryEaFile) owned by ntoskrnl.exe Entry 0x0094: 0x80605d04 (NtQueryEvent) owned by ntoskrnl.exe Entry 0x0095: 0x8056c314 (NtQueryFullAttributesFile) owned by ntoskrnl.exe Entry 0x0096: 0x8060cc3c (NtQueryInformationAtom) owned by ntoskrnl.exe Entry 0x0097: 0x8056fd38 (NtQueryInformationFile) owned by ntoskrnl.exe Entry 0x0098: 0x805cc09e (NtQueryInformationJobObject) owned by ntoskrnl.exe Entry 0x0099: 0x8059a812 (NtQueryInformationPort) owned by ntoskrnl.exe Entry 0x009a: 0x805c2d48 (NtQueryInformationProcess) owned by ntoskrnl.exe Entry 0x009b: 0x805c1914 (NtQueryInformationThread) owned by ntoskrnl.exe Entry 0x009c: 0x805e4430 (NtQueryInformationToken) owned by ntoskrnl.exe Entry 0x009d: 0x80607bc6 (NtQueryInstallUILanguage) owned by ntoskrnl.exe Entry 0x009e: 0x8060e9b2 (NtQueryIntervalProfile) owned by ntoskrnl.exe Entry 0x009f: 0x8056decc (NtQueryIoCompletion) owned by ntoskrnl.exe Entry 0x00a0: 0x8061c302 (NtQueryKey) owned by ntoskrnl.exe Entry 0x00a1: 0x80619d30 (NtQueryMultipleValueKey) owned by ntoskrnl.exe Entry 0x00a2: 0x8060e290 (NtQueryMutant) owned by ntoskrnl.exe Entry 0x00a3: 0x805bb18a (NtQueryObject) owned by ntoskrnl.exe Entry 0x00a4: 0x8061a3dc (NtQueryOpenSubKeys) owned by ntoskrnl.exe Entry 0x00a5: 0x8060ea40 (NtQueryPerformanceCounter) owned by ntoskrnl.exe Entry 0x00a6: 0x80570be4 (NtQueryQuotaInformationFile) owned by ntoskrnl.exe Entry 0x00a7: 0x805add08 (NtQuerySection) owned by ntoskrnl.exe Entry 0x00a8: 0x805b5b54 (NtQuerySecurityObject) owned by ntoskrnl.exe Entry 0x00a9: 0x8060bc6c (NtQuerySemaphore) owned by ntoskrnl.exe Entry 0x00aa: 0x805b9958 (NtQuerySymbolicLinkObject) owned by ntoskrnl.exe Entry 0x00ab: 0x8060d4be (NtQuerySystemEnvironmentValue) owned by ntoskrnl.exe Entry 0x00ac: 0x8060d486 (NtQuerySystemEnvironmentValueEx) owned by ntoskrnl.exe Entry 0x00ad: 0x806084a8 (NtQuerySystemInformation) owned by ntoskrnl.exe Entry 0x00ae: 0x8060a344 (NtQuerySystemTime) owned by ntoskrnl.exe Entry 0x00af: 0x8060dbba (NtQueryTimer) owned by ntoskrnl.exe Entry 0x00b0: 0x80609bfc (NtQueryTimerResolution) owned by ntoskrnl.exe Entry 0x00b1: 0x80618e06 (NtQueryValueKey) owned by ntoskrnl.exe Entry 0x00b2: 0x805ae38e (NtQueryVirtualMemory) owned by ntoskrnl.exe Entry 0x00b3: 0x805710d4 (NtQueryVolumeInformationFile) owned by ntoskrnl.exe Entry 0x00b4: 0x805c8af2 (NtQueueApcThread) owned by ntoskrnl.exe Entry 0x00b5: 0x80540f20 (NtRaiseException) owned by ntoskrnl.exe Entry 0x00b6: 0x8060b8de (NtRaiseHardError) owned by ntoskrnl.exe Entry 0x00b7: 0x8057189c (NtReadFile) owned by ntoskrnl.exe Entry 0x00b8: 0x80571e2a (NtReadFileScatter) owned by ntoskrnl.exe Entry 0x00b9: 0x8059b29a (NtReadRequestData) owned by ntoskrnl.exe Entry 0x00ba: 0x805a9844 (NtReadVirtualMemory) owned by ntoskrnl.exe Entry 0x00bb: 0x805c8420 (NtRegisterThreadTerminatePort) owned by ntoskrnl.exe Entry 0x00bc: 0x8060e3c8 (NtReleaseMutant) owned by ntoskrnl.exe Entry 0x00bd: 0x8060bd9c (NtReleaseSemaphore) owned by ntoskrnl.exe Entry 0x00be: 0x8056e1c4 (NtRemoveIoCompletion) owned by ntoskrnl.exe Entry 0x00bf: 0x8063a72a (NtRemoveProcessDebug) owned by ntoskrnl.exe Entry 0x00c0: 0x8061a604 (NtRenameKey) owned by ntoskrnl.exe Entry 0x00c1: 0x8061ccb6 (NtReplaceKey) owned by ntoskrnl.exe Entry 0x00c2: 0x8059a91a (NtReplyPort) owned by ntoskrnl.exe Entry 0x00c3: 0x8059b8e2 (NtReplyWaitReceivePort) owned by ntoskrnl.exe Entry 0x00c4: 0x8059b2ea (NtReplyWaitReceivePortEx) owned by ntoskrnl.exe Entry 0x00c5: 0x8059ac04 (NtReplyWaitReplyPort) owned by ntoskrnl.exe Entry 0x00c6: 0x805be594 (NtRequestDeviceWakeup) owned by ntoskrnl.exe Entry 0x00c7: 0x80597e78 (NtRequestPort) owned by ntoskrnl.exe Entry 0x00c8: 0x805981a4 (NtRequestWaitReplyPort) owned by ntoskrnl.exe Entry 0x00c9: 0x805be3a2 (NtRequestWakeupLatency) owned by ntoskrnl.exe Entry 0x00ca: 0x80605e16 (NtResetEvent) owned by ntoskrnl.exe Entry 0x00cb: 0x8051de82 (NtResetWriteWatch) owned by ntoskrnl.exe Entry 0x00cc: 0x8061c5c2 (NtRestoreKey) owned by ntoskrnl.exe Entry 0x00cd: 0x805caefe (NtResumeProcess) owned by ntoskrnl.exe Entry 0x00ce: 0x805cade0 (NtResumeThread) owned by ntoskrnl.exe Entry 0x00cf: 0x8061c6be (NtSaveKey) owned by ntoskrnl.exe Entry 0x00d0: 0x8061c7a4 (NtSaveKeyEx) owned by ntoskrnl.exe Entry 0x00d1: 0x8061c8cc (NtSaveMergedKeys) owned by ntoskrnl.exe Entry 0x00d2: 0x80599192 (NtSecureConnectPort) owned by ntoskrnl.exe Entry 0x00d3: 0x8060d4a2 (NtSetBootEntryOrder) owned by ntoskrnl.exe Entry 0x00d4: 0x8060d4a2 (NtSetBootOptions) owned by ntoskrnl.exe Entry 0x00d5: 0x805c8fb6 (NtSetContextThread) owned by ntoskrnl.exe Entry 0x00d6: 0x8063d3e2 (NtSetDebugFilterState) owned by ntoskrnl.exe Entry 0x00d7: 0x8060b788 (NtSetDefaultHardErrorPort) owned by ntoskrnl.exe Entry 0x00d8: 0x80607918 (NtSetDefaultLocale) owned by ntoskrnl.exe Entry 0x00d9: 0x8060818a (NtSetDefaultUILanguage) owned by ntoskrnl.exe Entry 0x00da: 0x8056f9d8 (NtSetEaFile) owned by ntoskrnl.exe Entry 0x00db: 0x80605ed6 (NtSetEvent) owned by ntoskrnl.exe Entry 0x00dc: 0x80605fa0 (NtSetEventBoostPriority) owned by ntoskrnl.exe Entry 0x00dd: 0x8060e0ac (NtSetHighEventPair) owned by ntoskrnl.exe Entry 0x00de: 0x8060dfdc (NtSetHighWaitLowEventPair) owned by ntoskrnl.exe Entry 0x00df: 0x8063a0f4 (NtSetInformationDebugObject) owned by ntoskrnl.exe Entry 0x00e0: 0x80570376 (NtSetInformationFile) owned by ntoskrnl.exe Entry 0x00e1: 0x805ccdae (NtSetInformationJobObject) owned by ntoskrnl.exe Entry 0x00e2: 0x806198fc (NtSetInformationKey) owned by ntoskrnl.exe Entry 0x00e3: 0x805ba5ce (NtSetInformationObject) owned by ntoskrnl.exe Entry 0x00e4: 0x805c3ea0 (NtSetInformationProcess) owned by ntoskrnl.exe Entry 0x00e5: 0x805c1e60 (NtSetInformationThread) owned by ntoskrnl.exe Entry 0x00e6: 0x805f0aba (NtSetInformationToken) owned by ntoskrnl.exe Entry 0x00e7: 0x8060e514 (NtSetIntervalProfile) owned by ntoskrnl.exe Entry 0x00e8: 0x8056e162 (NtSetIoCompletion) owned by ntoskrnl.exe Entry 0x00e9: 0x805c9d2a (NtSetLdtEntries) owned by ntoskrnl.exe Entry 0x00ea: 0x8060e048 (NtSetLowEventPair) owned by ntoskrnl.exe Entry 0x00eb: 0x8060df70 (NtSetLowWaitHighEventPair) owned by ntoskrnl.exe Entry 0x00ec: 0x80570bc2 (NtSetQuotaInformationFile) owned by ntoskrnl.exe Entry 0x00ed: 0x805b60fe (NtSetSecurityObject) owned by ntoskrnl.exe Entry 0x00ee: 0x8060d742 (NtSetSystemEnvironmentValue) owned by ntoskrnl.exe Entry 0x00ef: 0x8060d486 (NtSetSystemEnvironmentValueEx) owned by ntoskrnl.exe Entry 0x00f0: 0x806067d6 (NtSetSystemInformation) owned by ntoskrnl.exe Entry 0x00f1: 0x806499d6 (NtSetSystemPowerState) owned by ntoskrnl.exe Entry 0x00f2: 0x8060af04 (NtSetSystemTime) owned by ntoskrnl.exe Entry 0x00f3: 0x805be2b6 (NtSetThreadExecutionState) owned by ntoskrnl.exe Entry 0x00f4: 0x8053520a (NtSetTimer) owned by ntoskrnl.exe Entry 0x00f5: 0x8060a3d6 (NtSetTimerResolution) owned by ntoskrnl.exe Entry 0x00f6: 0x8060c252 (NtSetUuidSeed) owned by ntoskrnl.exe Entry 0x00f7: 0x80619154 (NtSetValueKey) owned by ntoskrnl.exe Entry 0x00f8: 0x805714f8 (NtSetVolumeInformationFile) owned by ntoskrnl.exe Entry 0x00f9: 0x806099f2 (NtShutdownSystem) owned by ntoskrnl.exe Entry 0x00fa: 0x80522c50 (NtSignalAndWaitForSingleObject) owned by ntoskrnl.exe Entry 0x00fb: 0x8060e75e (NtStartProfile) owned by ntoskrnl.exe Entry 0x00fc: 0x8060e908 (NtStopProfile) owned by ntoskrnl.exe Entry 0x00fd: 0x805caea8 (NtSuspendProcess) owned by ntoskrnl.exe Entry 0x00fe: 0x805cad1a (NtSuspendThread) owned by ntoskrnl.exe Entry 0x00ff: 0x8060eb2c (NtSystemDebugControl) owned by ntoskrnl.exe Entry 0x0100: 0x805cd918 (NtTerminateJobObject) owned by ntoskrnl.exe Entry 0x0101: 0x805c866a (NtTerminateProcess) owned by ntoskrnl.exe Entry 0x0102: 0x805c8864 (NtTerminateThread) owned by ntoskrnl.exe Entry 0x0103: 0x805cb068 (NtTestAlert) owned by ntoskrnl.exe Entry 0x0104: 0x805318d6 (NtTraceEvent) owned by ntoskrnl.exe Entry 0x0105: 0x8060d4b0 (NtTranslateFilePath) owned by ntoskrnl.exe Entry 0x0106: 0x80579828 (NtUnloadDriver) owned by ntoskrnl.exe Entry 0x0107: 0x8061947e (NtUnloadKey) owned by ntoskrnl.exe Entry 0x0108: 0x806196a0 (NtUnloadKeyEx) owned by ntoskrnl.exe Entry 0x0109: 0x8056e948 (NtUnlockFile) owned by ntoskrnl.exe Entry 0x010a: 0x805ac60c (NtUnlockVirtualMemory) owned by ntoskrnl.exe Entry 0x010b: 0x805a83c4 (NtUnmapViewOfSection) owned by ntoskrnl.exe Entry 0x010c: 0x805f1e72 (NtVdmControl) owned by ntoskrnl.exe Entry 0x010d: 0x80639e5c (NtWaitForDebugEvent) owned by ntoskrnl.exe Entry 0x010e: 0x805b62b4 (NtWaitForMultipleObjects) owned by ntoskrnl.exe Entry 0x010f: 0x805b61ca (NtWaitForSingleObject) owned by ntoskrnl.exe Entry 0x0110: 0x8060df0c (NtWaitHighEventPair) owned by ntoskrnl.exe Entry 0x0111: 0x8060dea8 (NtWaitLowEventPair) owned by ntoskrnl.exe Entry 0x0112: 0x8057233a (NtWriteFile) owned by ntoskrnl.exe Entry 0x0113: 0x8057294a (NtWriteFileGather) owned by ntoskrnl.exe Entry 0x0114: 0x8059b2c2 (NtWriteRequestData) owned by ntoskrnl.exe Entry 0x0115: 0x805a994e (NtWriteVirtualMemory) owned by ntoskrnl.exe Entry 0x0116: 0x8050222c (NtYieldExecution) owned by ntoskrnl.exe Entry 0x0117: 0x8060ef84 (NtCreateKeyedEvent) owned by ntoskrnl.exe Entry 0x0118: 0x8060f06e (NtOpenKeyedEvent) owned by ntoskrnl.exe Entry 0x0119: 0x8060f120 (NtReleaseKeyedEvent) owned by ntoskrnl.exe Entry 0x011a: 0x8060f3ac (NtWaitForKeyedEvent) owned by ntoskrnl.exe Entry 0x011b: 0x805c18e4 (NtQueryPortInformationProcess) owned by ntoskrnl.exe SSDT[1] at bf99d900 with 667 entries Entry 0x1000: 0xbf939a6f (NtGdiAbortDoc) owned by win32k.sys Entry 0x1001: 0xbf94b0a0 (NtGdiAbortPath) owned by win32k.sys Entry 0x1002: 0xbf86fc7f (NtGdiAddFontResourceW) owned by win32k.sys Entry 0x1003: 0xbf942ba4 (NtGdiAddRemoteFontToDC) owned by win32k.sys Entry 0x1004: 0xbf94c6c2 (NtGdiAddFontMemResourceEx) owned by win32k.sys Entry 0x1005: 0xbf939d03 (NtGdiRemoveMergeFont) owned by win32k.sys Entry 0x1006: 0xbf939da8 (NtGdiAddRemoteMMInstanceToDC) owned by win32k.sys Entry 0x1007: 0xbf831475 (NtGdiAlphaBlend) owned by win32k.sys Entry 0x1008: 0xbf94bfde (NtGdiAngleArc) owned by win32k.sys Entry 0x1009: 0xbf937e6e (NtGdiAnyLinkedFonts) owned by win32k.sys Entry 0x100a: 0xbf94c5d6 (NtGdiFontIsLinked) owned by win32k.sys Entry 0x100b: 0xbf910430 (NtGdiArcInternal) owned by win32k.sys Entry 0x100c: 0xbf9002c7 (NtGdiBeginPath) owned by win32k.sys Entry 0x100d: 0xbf8098f2 (NtGdiBitBlt) owned by win32k.sys Entry 0x100e: 0xbf94c4a8 (NtGdiCancelDC) owned by win32k.sys Entry 0x100f: 0xbf94dcaf (NtGdiCheckBitmapBits) owned by win32k.sys Entry 0x1010: 0xbf8febc4 (NtGdiCloseFigure) owned by win32k.sys Entry 0x1011: 0xbf876d70 (NtGdiClearBitmapAttributes) owned by win32k.sys Entry 0x1012: 0xbf94c586 (NtGdiClearBrushAttributes) owned by win32k.sys Entry 0x1013: 0xbf94dde2 (NtGdiColorCorrectPalette) owned by win32k.sys Entry 0x1014: 0xbf81c618 (NtGdiCombineRgn) owned by win32k.sys Entry 0x1015: 0xbf8e5515 (NtGdiCombineTransform) owned by win32k.sys Entry 0x1016: 0xbf8ac66a (NtGdiComputeXformCoefficients) owned by win32k.sys Entry 0x1017: 0xbf859e19 (NtGdiConsoleTextOut) owned by win32k.sys Entry 0x1018: 0xbf91166b (NtGdiConvertMetafileRect) owned by win32k.sys Entry 0x1019: 0xbf80e2ad (NtGdiCreateBitmap) owned by win32k.sys Entry 0x101a: 0xbf8e51bd (NtGdiCreateClientObj) owned by win32k.sys Entry 0x101b: 0xbf94daa7 (NtGdiCreateColorSpace) owned by win32k.sys Entry 0x101c: 0xbf94e9b2 (NtGdiCreateColorTransform) owned by win32k.sys Entry 0x101d: 0xbf813a59 (NtGdiCreateCompatibleBitmap) owned by win32k.sys Entry 0x101e: 0xbf80c84e (NtGdiCreateCompatibleDC) owned by win32k.sys Entry 0x101f: 0xbf8d9ec6 (NtGdiCreateDIBBrush) owned by win32k.sys Entry 0x1020: 0xbf828c59 (NtGdiCreateDIBitmapInternal) owned by win32k.sys Entry 0x1021: 0xbf82a6f3 (NtGdiCreateDIBSection) owned by win32k.sys Entry 0x1022: 0xbf93c31b (NtGdiCreateEllipticRgn) owned by win32k.sys Entry 0x1023: 0xbf8ac474 (NtGdiCreateHalftonePalette) owned by win32k.sys Entry 0x1024: 0xbf94fa3e (NtGdiCreateHatchBrushInternal) owned by win32k.sys Entry 0x1025: 0xbf8cb475 (NtGdiCreateMetafileDC) owned by win32k.sys Entry 0x1026: 0xbf85f156 (NtGdiCreatePaletteInternal) owned by win32k.sys Entry 0x1027: 0xbf8aa865 (NtGdiCreatePatternBrushInternal) owned by win32k.sys Entry 0x1028: 0xbf8a4608 (NtGdiCreatePen) owned by win32k.sys Entry 0x1029: 0xbf835006 (NtGdiCreateRectRgn) owned by win32k.sys Entry 0x102a: 0xbf8b7bf6 (NtGdiCreateRoundRectRgn) owned by win32k.sys Entry 0x102b: 0xbf911570 (NtGdiCreateServerMetaFile) owned by win32k.sys Entry 0x102c: 0xbf819d51 (NtGdiCreateSolidBrush) owned by win32k.sys Entry 0x102d: 0xbf93748e (NtGdiD3dContextCreate) owned by win32k.sys Entry 0x102e: 0xbf9374a1 (NtGdiD3dContextDestroy) owned by win32k.sys Entry 0x102f: 0xbf9374b4 (NtGdiD3dContextDestroyAll) owned by win32k.sys Entry 0x1030: 0xbf9374c7 (NtGdiD3dValidateTextureStageState) owned by win32k.sys Entry 0x1031: 0xbf9374da (NtGdiD3dDrawPrimitives2) owned by win32k.sys Entry 0x1032: 0xbf9374ed (NtGdiDdGetDriverState) owned by win32k.sys Entry 0x1033: 0xbf937363 (NtGdiDdAddAttachedSurface) owned by win32k.sys Entry 0x1034: 0xbf9375ad (NtGdiDdAlphaBlt) owned by win32k.sys Entry 0x1035: 0xbf9065fc (NtGdiDdAttachSurface) owned by win32k.sys Entry 0x1036: 0xbf937558 (NtGdiDdBeginMoCompFrame) owned by win32k.sys Entry 0x1037: 0xbf90660f (NtGdiDdBlt) owned by win32k.sys Entry 0x1038: 0xbf9063e9 (NtGdiDdCanCreateSurface) owned by win32k.sys Entry 0x1039: 0xbf937465 (NtGdiDdCanCreateD3DBuffer) owned by win32k.sys Entry 0x103a: 0xbf937376 (NtGdiDdColorControl) owned by win32k.sys Entry 0x103b: 0xbf8f428b (NtGdiDdCreateDirectDrawObject) owned by win32k.sys Entry 0x103c: 0xbf8f429e (NtGdiDdCreateSurface) owned by win32k.sys Entry 0x103d: 0xbf93744f (NtGdiDdCreateD3DBuffer) owned by win32k.sys Entry 0x103e: 0xbf906428 (NtGdiDdCreateMoComp) owned by win32k.sys Entry 0x103f: 0xbf906a53 (NtGdiDdCreateSurfaceObject) owned by win32k.sys Entry 0x1040: 0xbf8f44e7 (NtGdiDdDeleteDirectDrawObject) owned by win32k.sys Entry 0x1041: 0xbf9065d0 (NtGdiDdDeleteSurfaceObject) owned by win32k.sys Entry 0x1042: 0xbf9063fc (NtGdiDdDestroyMoComp) owned by win32k.sys Entry 0x1043: 0xbf8f44d1 (NtGdiDdDestroySurface) owned by win32k.sys Entry 0x1044: 0xbf937478 (NtGdiDdDestroyD3DBuffer) owned by win32k.sys Entry 0x1045: 0xbf93756b (NtGdiDdEndMoCompFrame) owned by win32k.sys Entry 0x1046: 0xbf906af9 (NtGdiDdFlip) owned by win32k.sys Entry 0x1047: 0xbf907204 (NtGdiDdFlipToGDISurface) owned by win32k.sys Entry 0x1048: 0xbf9065e6 (NtGdiDdGetAvailDriverMemory) owned by win32k.sys Entry 0x1049: 0xbf937389 (NtGdiDdGetBltStatus) owned by win32k.sys Entry 0x104a: 0xbf906354 (NtGdiDdGetDC) owned by win32k.sys Entry 0x104b: 0xbf906393 (NtGdiDdGetDriverInfo) owned by win32k.sys Entry 0x104c: 0xbf9373f7 (NtGdiDdGetDxHandle) owned by win32k.sys Entry 0x104d: 0xbf93739f (NtGdiDdGetFlipStatus) owned by win32k.sys Entry 0x104e: 0xbf937542 (NtGdiDdGetInternalMoCompInfo) owned by win32k.sys Entry 0x104f: 0xbf93752c (NtGdiDdGetMoCompBuffInfo) owned by win32k.sys Entry 0x1050: 0xbf906412 (NtGdiDdGetMoCompGuids) owned by win32k.sys Entry 0x1051: 0xbf937516 (NtGdiDdGetMoCompFormats) owned by win32k.sys Entry 0x1052: 0xbf90730a (NtGdiDdGetScanLine) owned by win32k.sys Entry 0x1053: 0xbf8c877d (NtGdiDdLock) owned by win32k.sys Entry 0x1054: 0xbf937423 (NtGdiDdLockD3D) owned by win32k.sys Entry 0x1055: 0xbf8f422a (NtGdiDdQueryDirectDrawObject) owned by win32k.sys Entry 0x1056: 0xbf937597 (NtGdiDdQueryMoCompStatus) owned by win32k.sys Entry 0x1057: 0xbf8f4265 (NtGdiDdReenableDirectDrawObject) owned by win32k.sys Entry 0x1058: 0xbf9064c8 (NtGdiDdReleaseDC) owned by win32k.sys Entry 0x1059: 0xbf937581 (NtGdiDdRenderMoComp) owned by win32k.sys Entry 0x105a: 0xbf8c85c3 (NtGdiDdResetVisrgn) owned by win32k.sys Entry 0x105b: 0xbf906b0f (NtGdiDdSetColorKey) owned by win32k.sys Entry 0x105c: 0xbf9373b5 (NtGdiDdSetExclusiveMode) owned by win32k.sys Entry 0x105d: 0xbf93740d (NtGdiDdSetGammaRamp) owned by win32k.sys Entry 0x105e: 0xbf937500 (NtGdiDdCreateSurfaceEx) owned by win32k.sys Entry 0x105f: 0xbf9373cb (NtGdiDdSetOverlayPosition) owned by win32k.sys Entry 0x1060: 0xbf90669c (NtGdiDdUnattachSurface) owned by win32k.sys Entry 0x1061: 0xbf8c8573 (NtGdiDdUnlock) owned by win32k.sys Entry 0x1062: 0xbf937439 (NtGdiDdUnlockD3D) owned by win32k.sys Entry 0x1063: 0xbf906ae3 (NtGdiDdUpdateOverlay) owned by win32k.sys Entry 0x1064: 0xbf9373e1 (NtGdiDdWaitForVerticalBlank) owned by win32k.sys Entry 0x1065: 0xbf9375c0 (NtGdiDvpCanCreateVideoPort) owned by win32k.sys Entry 0x1066: 0xbf9375d6 (NtGdiDvpColorControl) owned by win32k.sys Entry 0x1067: 0xbf9375ec (NtGdiDvpCreateVideoPort) owned by win32k.sys Entry 0x1068: 0xbf937602 (NtGdiDvpDestroyVideoPort) owned by win32k.sys Entry 0x1069: 0xbf937618 (NtGdiDvpFlipVideoPort) owned by win32k.sys Entry 0x106a: 0xbf93762e (NtGdiDvpGetVideoPortBandwidth) owned by win32k.sys Entry 0x106b: 0xbf937644 (NtGdiDvpGetVideoPortField) owned by win32k.sys Entry 0x106c: 0xbf93765a (NtGdiDvpGetVideoPortFlipStatus) owned by win32k.sys Entry 0x106d: 0xbf937670 (NtGdiDvpGetVideoPortInputFormats) owned by win32k.sys Entry 0x106e: 0xbf937686 (NtGdiDvpGetVideoPortLine) owned by win32k.sys Entry 0x106f: 0xbf93769c (NtGdiDvpGetVideoPortOutputFormats) owned by win32k.sys Entry 0x1070: 0xbf9376b2 (NtGdiDvpGetVideoPortConnectInfo) owned by win32k.sys Entry 0x1071: 0xbf9376c8 (NtGdiDvpGetVideoSignalStatus) owned by win32k.sys Entry 0x1072: 0xbf9376de (NtGdiDvpUpdateVideoPort) owned by win32k.sys Entry 0x1073: 0xbf9376f4 (NtGdiDvpWaitForVideoPortSync) owned by win32k.sys Entry 0x1074: 0xbf93770a (NtGdiDvpAcquireNotification) owned by win32k.sys Entry 0x1075: 0xbf937720 (NtGdiDvpReleaseNotification) owned by win32k.sys Entry 0x1076: 0xbf937350 (NtGdiDxgGenericThunk) owned by win32k.sys Entry 0x1077: 0xbf8e52df (NtGdiDeleteClientObj) owned by win32k.sys Entry 0x1078: 0xbf94da9a (NtGdiDeleteColorSpace) owned by win32k.sys Entry 0x1079: 0xbf94ec6e (NtGdiDeleteColorTransform) owned by win32k.sys Entry 0x107a: 0xbf8138e6 (NtGdiDeleteObjectApp) owned by win32k.sys Entry 0x107b: 0xbf94d198 (NtGdiDescribePixelFormat) owned by win32k.sys Entry 0x107c: 0xbf8f97e8 (NtGdiGetPerBandInfo) owned by win32k.sys Entry 0x107d: 0xbf8fbf6d (NtGdiDoBanding) owned by win32k.sys Entry 0x107e: 0xbf837d4b (NtGdiDoPalette) owned by win32k.sys Entry 0x107f: 0xbf94c028 (NtGdiDrawEscape) owned by win32k.sys Entry 0x1080: 0xbf8dc9cb (NtGdiEllipse) owned by win32k.sys Entry 0x1081: 0xbf87523c (NtGdiEnableEudc) owned by win32k.sys Entry 0x1082: 0xbf8fa778 (NtGdiEndDoc) owned by win32k.sys Entry 0x1083: 0xbf8fb4f1 (NtGdiEndPage) owned by win32k.sys Entry 0x1084: 0xbf900367 (NtGdiEndPath) owned by win32k.sys Entry 0x1085: 0xbf86a710 (NtGdiEnumFontChunk) owned by win32k.sys Entry 0x1086: 0xbf86a68f (NtGdiEnumFontClose) owned by win32k.sys Entry 0x1087: 0xbf869d1e (NtGdiEnumFontOpen) owned by win32k.sys Entry 0x1088: 0xbf8da1ce (NtGdiEnumObjects) owned by win32k.sys Entry 0x1089: 0xbf93c416 (NtGdiEqualRgn) owned by win32k.sys Entry 0x108a: 0xbf953249 (NtGdiEudcLoadUnloadLink) owned by win32k.sys Entry 0x108b: 0xbf827d4a (NtGdiExcludeClipRect) owned by win32k.sys Entry 0x108c: 0xbf8d2152 (NtGdiExtCreatePen) owned by win32k.sys Entry 0x108d: 0xbf8354fa (NtGdiExtCreateRegion) owned by win32k.sys Entry 0x108e: 0xbf8b5f87 (NtGdiExtEscape) owned by win32k.sys Entry 0x108f: 0xbf954067 (NtGdiExtFloodFill) owned by win32k.sys Entry 0x1090: 0xbf826e8b (NtGdiExtGetObjectW) owned by win32k.sys Entry 0x1091: 0xbf80f16d (NtGdiExtSelectClipRgn) owned by win32k.sys Entry 0x1092: 0xbf899670 (NtGdiExtTextOutW) owned by win32k.sys Entry 0x1093: 0xbf94b1c5 (NtGdiFillPath) owned by win32k.sys Entry 0x1094: 0xbf8aa1a6 (NtGdiFillRgn) owned by win32k.sys Entry 0x1095: 0xbf94b12a (NtGdiFlattenPath) owned by win32k.sys Entry 0x1096: 0xbf80c331 (NtGdiFlushUserBatch) owned by win32k.sys Entry 0x1097: 0xbf80a1f5 (NtGdiFlush) owned by win32k.sys Entry 0x1098: 0xbf94d078 (NtGdiForceUFIMapping) owned by win32k.sys Entry 0x1099: 0xbf8b7e68 (NtGdiFrameRgn) owned by win32k.sys Entry 0x109a: 0xbf93f0f3 (NtGdiFullscreenControl) owned by win32k.sys Entry 0x109b: 0xbf8d1423 (NtGdiGetAndSetDCDword) owned by win32k.sys Entry 0x109c: 0xbf81647d (NtGdiGetAppClipBox) owned by win32k.sys Entry 0x109d: 0xbf8aa699 (NtGdiGetBitmapBits) owned by win32k.sys Entry 0x109e: 0xbf94cf9a (NtGdiGetBitmapDimension) owned by win32k.sys Entry 0x109f: 0xbf8bd9bb (NtGdiGetBoundsRect) owned by win32k.sys Entry 0x10a0: 0xbf8c9e29 (NtGdiGetCharABCWidthsW) owned by win32k.sys Entry 0x10a1: 0xbf94b733 (NtGdiGetCharacterPlacementW) owned by win32k.sys Entry 0x10a2: 0xbf80f7a8 (NtGdiGetCharSet) owned by win32k.sys Entry 0x10a3: 0xbf8f6bc4 (NtGdiGetCharWidthW) owned by win32k.sys Entry 0x10a4: 0xbf8ab3af (NtGdiGetCharWidthInfo) owned by win32k.sys Entry 0x10a5: 0xbf94c34a (NtGdiGetColorAdjustment) owned by win32k.sys Entry 0x10a6: 0xbf95491c (NtGdiGetColorSpaceforBitmap) owned by win32k.sys Entry 0x10a7: 0xbf827158 (NtGdiGetDCDword) owned by win32k.sys Entry 0x10a8: 0xbf89835c (NtGdiGetDCforBitmap) owned by win32k.sys Entry 0x10a9: 0xbf826fe5 (NtGdiGetDCObject) owned by win32k.sys Entry 0x10aa: 0xbf8c324d (NtGdiGetDCPoint) owned by win32k.sys Entry 0x10ab: 0xbf94c546 (NtGdiGetDeviceCaps) owned by win32k.sys Entry 0x10ac: 0xbf94e045 (NtGdiGetDeviceGammaRamp) owned by win32k.sys Entry 0x10ad: 0xbf8d06c4 (NtGdiGetDeviceCapsAll) owned by win32k.sys Entry 0x10ae: 0xbf839b2f (NtGdiGetDIBitsInternal) owned by win32k.sys Entry 0x10af: 0xbf95587f (NtGdiGetETM) owned by win32k.sys Entry 0x10b0: 0xbf950ceb (NtGdiGetEudcTimeStampEx) owned by win32k.sys Entry 0x10b1: 0xbf8f83e0 (NtGdiGetFontData) owned by win32k.sys Entry 0x10b2: 0xbf94c7f0 (NtGdiGetFontResourceInfoInternalW) owned by win32k.sys Entry 0x10b3: 0xbf94d47b (NtGdiGetGlyphIndicesW) owned by win32k.sys Entry 0x10b4: 0xbf94d31e (NtGdiGetGlyphIndicesWInternal) owned by win32k.sys Entry 0x10b5: 0xbf94c13b (NtGdiGetGlyphOutline) owned by win32k.sys Entry 0x10b6: 0xbf94c240 (NtGdiGetKerningPairs) owned by win32k.sys Entry 0x10b7: 0xbf939a87 (NtGdiGetLinkedUFIs) owned by win32k.sys Entry 0x10b8: 0xbf8cb4dd (NtGdiGetMiterLimit) owned by win32k.sys Entry 0x10b9: 0xbf942035 (NtGdiGetMonitorID) owned by win32k.sys Entry 0x10ba: 0xbf827ea0 (NtGdiGetNearestColor) owned by win32k.sys Entry 0x10bb: 0xbf94fac4 (NtGdiGetNearestPaletteIndex) owned by win32k.sys Entry 0x10bc: 0xbf94c2d1 (NtGdiGetObjectBitmapHandle) owned by win32k.sys Entry 0x10bd: 0xbf8f63ed (NtGdiGetOutlineTextMetricsInternalW) owned by win32k.sys Entry 0x10be: 0xbf94b592 (NtGdiGetPath) owned by win32k.sys Entry 0x10bf: 0xbf8649c1 (NtGdiGetPixel) owned by win32k.sys Entry 0x10c0: 0xbf80f17d (NtGdiGetRandomRgn) owned by win32k.sys Entry 0x10c1: 0xbf8f8f1e (NtGdiGetRasterizerCaps) owned by win32k.sys Entry 0x10c2: 0xbf94d526 (NtGdiGetRealizationInfo) owned by win32k.sys Entry 0x10c3: 0xbf83a4ff (NtGdiGetRegionData) owned by win32k.sys Entry 0x10c4: 0xbf8c3197 (NtGdiGetRgnBox) owned by win32k.sys Entry 0x10c5: 0xbf9117ca (NtGdiGetServerMetaFileBits) owned by win32k.sys Entry 0x10c6: 0xbf8928d2 (NtGdiGetSpoolMessage) owned by win32k.sys Entry 0x10c7: 0xbf9559fc (NtGdiGetStats) owned by win32k.sys Entry 0x10c8: 0xbf8528b2 (NtGdiGetStockObject) owned by win32k.sys Entry 0x10c9: 0xbf9528dd (NtGdiGetStringBitmapW) owned by win32k.sys Entry 0x10ca: 0xbf8d04cb (NtGdiGetSystemPaletteUse) owned by win32k.sys Entry 0x10cb: 0xbf828493 (NtGdiGetTextCharsetInfo) owned by win32k.sys Entry 0x10cc: 0xbf84e37a (NtGdiGetTextExtent) owned by win32k.sys Entry 0x10cd: 0xbf8d9a34 (NtGdiGetTextExtentExW) owned by win32k.sys Entry 0x10ce: 0xbf82fb62 (NtGdiGetTextFaceW) owned by win32k.sys Entry 0x10cf: 0xbf8282f1 (NtGdiGetTextMetricsW) owned by win32k.sys Entry 0x10d0: 0xbf8b396d (NtGdiGetTransform) owned by win32k.sys Entry 0x10d1: 0xbf94ca37 (NtGdiGetUFI) owned by win32k.sys Entry 0x10d2: 0xbf94cb00 (NtGdiGetEmbUFI) owned by win32k.sys Entry 0x10d3: 0xbf94cbe0 (NtGdiGetUFIPathname) owned by win32k.sys Entry 0x10d4: 0xbf94c9b8 (NtGdiGetEmbedFonts) owned by win32k.sys Entry 0x10d5: 0xbf94c9c2 (NtGdiChangeGhostFont) owned by win32k.sys Entry 0x10d6: 0xbf938719 (NtGdiAddEmbFontToDC) owned by win32k.sys Entry 0x10d7: 0xbf94d49f (NtGdiGetFontUnicodeRanges) owned by win32k.sys Entry 0x10d8: 0xbf82ed1a (NtGdiGetWidthTable) owned by win32k.sys Entry 0x10d9: 0xbf860ad6 (NtGdiGradientFill) owned by win32k.sys Entry 0x10da: 0xbf827fdf (NtGdiHfontCreate) owned by win32k.sys Entry 0x10db: 0xbf94e629 (NtGdiIcmBrushInfo) owned by win32k.sys Entry 0x10dc: 0xbf858fbc (NtGdiInit) owned by win32k.sys Entry 0x10dd: 0xbf87725a (NtGdiInitSpool) owned by win32k.sys Entry 0x10de: 0xbf815fa6 (NtGdiIntersectClipRect) owned by win32k.sys Entry 0x10df: 0xbf8c4b65 (NtGdiInvertRgn) owned by win32k.sys Entry 0x10e0: 0xbf8c5b1f (NtGdiLineTo) owned by win32k.sys Entry 0x10e1: 0xbf94d212 (NtGdiMakeFontDir) owned by win32k.sys Entry 0x10e2: 0xbf954955 (NtGdiMakeInfoDC) owned by win32k.sys Entry 0x10e3: 0xbf828a2a (NtGdiMaskBlt) owned by win32k.sys Entry 0x10e4: 0xbf8b374a (NtGdiModifyWorldTransform) owned by win32k.sys Entry 0x10e5: 0xbf8cb6b0 (NtGdiMonoBitmap) owned by win32k.sys Entry 0x10e6: 0xbf94c4d8 (NtGdiMoveTo) owned by win32k.sys Entry 0x10e7: 0xbf8fbe2c (NtGdiOffsetClipRgn) owned by win32k.sys Entry 0x10e8: 0xbf898720 (NtGdiOffsetRgn) owned by win32k.sys Entry 0x10e9: 0xbf839eac (NtGdiOpenDCW) owned by win32k.sys Entry 0x10ea: 0xbf8c2c19 (NtGdiPatBlt) owned by win32k.sys Entry 0x10eb: 0xbf829dcc (NtGdiPolyPatBlt) owned by win32k.sys Entry 0x10ec: 0xbf94b29f (NtGdiPathToRegion) owned by win32k.sys Entry 0x10ed: 0xbf946e38 (NtGdiPlgBlt) owned by win32k.sys Entry 0x10ee: 0xbf94bbc6 (NtGdiPolyDraw) owned by win32k.sys Entry 0x10ef: 0xbf8a3e5f (NtGdiPolyPolyDraw) owned by win32k.sys Entry 0x10f0: 0xbf94bcc3 (NtGdiPolyTextOutW) owned by win32k.sys Entry 0x10f1: 0xbf94c5c6 (NtGdiPtInRegion) owned by win32k.sys Entry 0x10f2: 0xbf93c5b8 (NtGdiPtVisible) owned by win32k.sys Entry 0x10f3: 0xbf94c5e6 (NtGdiQueryFonts) owned by win32k.sys Entry 0x10f4: 0xbf8594d7 (NtGdiQueryFontAssocInfo) owned by win32k.sys Entry 0x10f5: 0xbf8c7acf (NtGdiRectangle) owned by win32k.sys Entry 0x10f6: 0xbf8ec847 (NtGdiRectInRegion) owned by win32k.sys Entry 0x10f7: 0xbf899ffa (NtGdiRectVisible) owned by win32k.sys Entry 0x10f8: 0xbf8d930a (NtGdiRemoveFontResourceW) owned by win32k.sys Entry 0x10f9: 0xbf94c7d4 (NtGdiRemoveFontMemResourceEx) owned by win32k.sys Entry 0x10fa: 0xbf8eb8be (NtGdiResetDC) owned by win32k.sys Entry 0x10fb: 0xbf94fd38 (NtGdiResizePalette) owned by win32k.sys Entry 0x10fc: 0xbf8291c3 (NtGdiRestoreDC) owned by win32k.sys Entry 0x10fd: 0xbf90f5f9 (NtGdiRoundRect) owned by win32k.sys Entry 0x10fe: 0xbf8291d3 (NtGdiSaveDC) owned by win32k.sys Entry 0x10ff: 0xbf944fab (NtGdiScaleViewportExtEx) owned by win32k.sys Entry 0x1100: 0xbf94cf26 (NtGdiScaleWindowExtEx) owned by win32k.sys Entry 0x1101: 0xbf808500 (NtGdiSelectBitmap) owned by win32k.sys Entry 0x1102: 0xbf94c4b8 (NtGdiSelectBrush) owned by win32k.sys Entry 0x1103: 0xbf900466 (NtGdiSelectClipPath) owned by win32k.sys Entry 0x1104: 0xbf81c628 (NtGdiSelectFont) owned by win32k.sys Entry 0x1105: 0xbf94c4c8 (NtGdiSelectPen) owned by win32k.sys Entry 0x1106: 0xbf876ca4 (NtGdiSetBitmapAttributes) owned by win32k.sys Entry 0x1107: 0xbf8c36cd (NtGdiSetBitmapBits) owned by win32k.sys Entry 0x1108: 0xbf94d004 (NtGdiSetBitmapDimension) owned by win32k.sys Entry 0x1109: 0xbf8bddc2 (NtGdiSetBoundsRect) owned by win32k.sys Entry 0x110a: 0xbf94c566 (NtGdiSetBrushAttributes) owned by win32k.sys Entry 0x110b: 0xbf8c376b (NtGdiSetBrushOrg) owned by win32k.sys Entry 0x110c: 0xbf94c3ab (NtGdiSetColorAdjustment) owned by win32k.sys Entry 0x110d: 0xbf94db5c (NtGdiSetColorSpace) owned by win32k.sys Entry 0x110e: 0xbf94e381 (NtGdiSetDeviceGammaRamp) owned by win32k.sys Entry 0x110f: 0xbf8268a0 (NtGdiSetDIBitsToDeviceInternal) owned by win32k.sys Entry 0x1110: 0xbf891923 (NtGdiSetFontEnumeration) owned by win32k.sys Entry 0x1111: 0xbf8e5695 (NtGdiSetFontXform) owned by win32k.sys Entry 0x1112: 0xbf8c5462 (NtGdiSetIcmMode) owned by win32k.sys Entry 0x1113: 0xbf8f94e6 (NtGdiSetLinkedUFIs) owned by win32k.sys Entry 0x1114: 0xbf950156 (NtGdiSetMagicColors) owned by win32k.sys Entry 0x1115: 0xbf8e5414 (NtGdiSetMetaRgn) owned by win32k.sys Entry 0x1116: 0xbf8e5436 (NtGdiSetMiterLimit) owned by win32k.sys Entry 0x1117: 0xbf94cf16 (NtGdiGetDeviceWidth) owned by win32k.sys Entry 0x1118: 0xbf94cf06 (NtGdiMirrorWindowOrg) owned by win32k.sys Entry 0x1119: 0xbf827c52 (NtGdiSetLayout) owned by win32k.sys Entry 0x111a: 0xbf864c03 (NtGdiSetPixel) owned by win32k.sys Entry 0x111b: 0xbf9566c6 (NtGdiSetPixelFormat) owned by win32k.sys Entry 0x111c: 0xbf94c5b6 (NtGdiSetRectRgn) owned by win32k.sys Entry 0x111d: 0xbf94c556 (NtGdiSetSystemPaletteUse) owned by win32k.sys Entry 0x111e: 0xbf955c8c (NtGdiSetTextJustification) owned by win32k.sys Entry 0x111f: 0xbf8728e4 (NtGdiSetupPublicCFONT) owned by win32k.sys Entry 0x1120: 0xbf8e5238 (NtGdiSetVirtualResolution) owned by win32k.sys Entry 0x1121: 0xbf8e5706 (NtGdiSetSizeDevice) owned by win32k.sys Entry 0x1122: 0xbf903c5e (NtGdiStartDoc) owned by win32k.sys Entry 0x1123: 0xbf8fb335 (NtGdiStartPage) owned by win32k.sys Entry 0x1124: 0xbf894515 (NtGdiStretchBlt) owned by win32k.sys Entry 0x1125: 0xbf8afb6f (NtGdiStretchDIBitsInternal) owned by win32k.sys Entry 0x1126: 0xbf8fefdd (NtGdiStrokeAndFillPath) owned by win32k.sys Entry 0x1127: 0xbf94b4a6 (NtGdiStrokePath) owned by win32k.sys Entry 0x1128: 0xbf95686e (NtGdiSwapBuffers) owned by win32k.sys Entry 0x1129: 0xbf8d05e6 (NtGdiTransformPoints) owned by win32k.sys Entry 0x112a: 0xbf894fed (NtGdiTransparentBlt) owned by win32k.sys Entry 0x112b: 0xbf94d0e9 (NtGdiUnloadPrinterDriver) owned by win32k.sys Entry 0x112c: 0xbf94c6b7 (NtGdiUnmapMemFont) owned by win32k.sys Entry 0x112d: 0xbf94c5a6 (NtGdiUnrealizeObject) owned by win32k.sys Entry 0x112e: 0xbf94ffc2 (NtGdiUpdateColors) owned by win32k.sys Entry 0x112f: 0xbf94b387 (NtGdiWidenPath) owned by win32k.sys Entry 0x1130: 0xbf868650 (NtUserActivateKeyboardLayout) owned by win32k.sys Entry 0x1131: 0xbf863000 (NtUserAlterWindowStyle) owned by win32k.sys Entry 0x1132: 0xbf915aaf (NtUserAssociateInputContext) owned by win32k.sys Entry 0x1133: 0xbf8f4f2c (NtUserAttachThreadInput) owned by win32k.sys Entry 0x1134: 0xbf815b8e (NtUserBeginPaint) owned by win32k.sys Entry 0x1135: 0xbf8d04f1 (NtUserBitBltSysBmp) owned by win32k.sys Entry 0x1136: 0xbf9143e8 (NtUserBlockInput) owned by win32k.sys Entry 0x1137: 0xbf915be6 (NtUserBuildHimcList) owned by win32k.sys Entry 0x1138: 0xbf8958ad (NtUserBuildHwndList) owned by win32k.sys Entry 0x1139: 0xbf85e37f (NtUserBuildNameList) owned by win32k.sys Entry 0x113a: 0xbf9141ab (NtUserBuildPropList) owned by win32k.sys Entry 0x113b: 0xbf865337 (NtUserCallHwnd) owned by win32k.sys Entry 0x113c: 0xbf898667 (NtUserCallHwndLock) owned by win32k.sys Entry 0x113d: 0xbf874284 (NtUserCallHwndOpt) owned by win32k.sys Entry 0x113e: 0xbf89885a (NtUserCallHwndParam) owned by win32k.sys Entry 0x113f: 0xbf8240c0 (NtUserCallHwndParamLock) owned by win32k.sys Entry 0x1140: 0xbf8d0400 (NtUserCallMsgFilter) owned by win32k.sys Entry 0x1141: 0xbf8f5d77 (NtUserCallNextHookEx) owned by win32k.sys Entry 0x1142: 0xbf8010c7 (NtUserCallNoParam) owned by win32k.sys Entry 0x1143: 0xbf80107f (NtUserCallOneParam) owned by win32k.sys Entry 0x1144: 0xbf89881a (NtUserCallTwoParam) owned by win32k.sys Entry 0x1145: 0xbf8ca3bc (NtUserChangeClipboardChain) owned by win32k.sys Entry 0x1146: 0xbf88ff05 (NtUserChangeDisplaySettings) owned by win32k.sys Entry 0x1147: 0xbf8a1a6b (NtUserCheckImeHotKey) owned by win32k.sys Entry 0x1148: 0xbf8d5271 (NtUserCheckMenuItem) owned by win32k.sys Entry 0x1149: 0xbf86d718 (NtUserChildWindowFromPointEx) owned by win32k.sys Entry 0x114a: 0xbf8f9306 (NtUserClipCursor) owned by win32k.sys Entry 0x114b: 0xbf8c4a6a (NtUserCloseClipboard) owned by win32k.sys Entry 0x114c: 0xbf85e05a (NtUserCloseDesktop) owned by win32k.sys Entry 0x114d: 0xbf85e11c (NtUserCloseWindowStation) owned by win32k.sys Entry 0x114e: 0xbf8589f0 (NtUserConsoleControl) owned by win32k.sys Entry 0x114f: 0xbf8cf8e3 (NtUserConvertMemHandle) owned by win32k.sys Entry 0x1150: 0xbf90ec32 (NtUserCopyAcceleratorTable) owned by win32k.sys Entry 0x1151: 0xbf8d04a5 (NtUserCountClipboardFormats) owned by win32k.sys Entry 0x1152: 0xbf8ac399 (NtUserCreateAcceleratorTable) owned by win32k.sys Entry 0x1153: 0xbf8a2ff9 (NtUserCreateCaret) owned by win32k.sys Entry 0x1154: 0xbf876947 (NtUserCreateDesktop) owned by win32k.sys Entry 0x1155: 0xbf915a15 (NtUserCreateInputContext) owned by win32k.sys Entry 0x1156: 0xbf8ca717 (NtUserCreateLocalMemHandle) owned by win32k.sys Entry 0x1157: 0xbf832c22 (NtUserCreateWindowEx) owned by win32k.sys Entry 0x1158: 0xbf876f9a (NtUserCreateWindowStation) owned by win32k.sys Entry 0x1159: 0xbf913235 (NtUserDdeGetQualityOfService) owned by win32k.sys Entry 0x115a: 0xbf874f18 (NtUserDdeInitialize) owned by win32k.sys Entry 0x115b: 0xbf913165 (NtUserDdeSetQualityOfService) owned by win32k.sys Entry 0x115c: 0xbf8a15f8 (NtUserDeferWindowPos) owned by win32k.sys Entry 0x115d: 0xbf8a1f8c (NtUserDefSetText) owned by win32k.sys Entry 0x115e: 0xbf8a3425 (NtUserDeleteMenu) owned by win32k.sys Entry 0x115f: 0xbf8f92a5 (NtUserDestroyAcceleratorTable) owned by win32k.sys Entry 0x1160: 0xbf89686a (NtUserDestroyCursor) owned by win32k.sys Entry 0x1161: 0xbf915a65 (NtUserDestroyInputContext) owned by win32k.sys Entry 0x1162: 0xbf8a28f0 (NtUserDestroyMenu) owned by win32k.sys Entry 0x1163: 0xbf89d928 (NtUserDestroyWindow) owned by win32k.sys Entry 0x1164: 0xbf9161bb (NtUserDisableThreadIme) owned by win32k.sys Entry 0x1165: 0xbf80ec0f (NtUserDispatchMessage) owned by win32k.sys Entry 0x1166: 0xbf9142a6 (NtUserDragDetect) owned by win32k.sys Entry 0x1167: 0xbf9126b3 (NtUserDragObject) owned by win32k.sys Entry 0x1168: 0xbf913405 (NtUserDrawAnimatedRects) owned by win32k.sys Entry 0x1169: 0xbf9134c8 (NtUserDrawCaption) owned by win32k.sys Entry 0x116a: 0xbf90c9d7 (NtUserDrawCaptionTemp) owned by win32k.sys Entry 0x116b: 0xbf83203b (NtUserDrawIconEx) owned by win32k.sys Entry 0x116c: 0xbf914473 (NtUserDrawMenuBarTemp) owned by win32k.sys Entry 0x116d: 0xbf8cf575 (NtUserEmptyClipboard) owned by win32k.sys Entry 0x116e: 0xbf8c3352 (NtUserEnableMenuItem) owned by win32k.sys Entry 0x116f: 0xbf9130e0 (NtUserEnableScrollBar) owned by win32k.sys Entry 0x1170: 0xbf827625 (NtUserEndDeferWindowPosEx) owned by win32k.sys Entry 0x1171: 0xbf913571 (NtUserEndMenu) owned by win32k.sys Entry 0x1172: 0xbf815845 (NtUserEndPaint) owned by win32k.sys Entry 0x1173: 0xbf865c52 (NtUserEnumDisplayDevices) owned by win32k.sys Entry 0x1174: 0xbf896310 (NtUserEnumDisplayMonitors) owned by win32k.sys Entry 0x1175: 0xbf8936d4 (NtUserEnumDisplaySettings) owned by win32k.sys Entry 0x1176: 0xbf912940 (NtUserEvent) owned by win32k.sys Entry 0x1177: 0xbf8c4d6b (NtUserExcludeUpdateRgn) owned by win32k.sys Entry 0x1178: 0xbf8d0337 (NtUserFillWindow) owned by win32k.sys Entry 0x1179: 0xbf84e5e0 (NtUserFindExistingCursorIcon) owned by win32k.sys Entry 0x117a: 0xbf85bdcf (NtUserFindWindowEx) owned by win32k.sys Entry 0x117b: 0xbf9165c8 (NtUserFlashWindowEx) owned by win32k.sys Entry 0x117c: 0xbf8cd787 (NtUserGetAltTabInfo) owned by win32k.sys Entry 0x117d: 0xbf8277ed (NtUserGetAncestor) owned by win32k.sys Entry 0x117e: 0xbf915fba (NtUserGetAppImeLevel) owned by win32k.sys Entry 0x117f: 0xbf89c393 (NtUserGetAsyncKeyState) owned by win32k.sys Entry 0x1180: 0xbf832dfe (NtUserGetAtomName) owned by win32k.sys Entry 0x1181: 0xbf8a1b44 (NtUserGetCaretBlinkTime) owned by win32k.sys Entry 0x1182: 0xbf8c37e6 (NtUserGetCaretPos) owned by win32k.sys Entry 0x1183: 0xbf837a0c (NtUserGetClassInfo) owned by win32k.sys Entry 0x1184: 0xbf81f6d1 (NtUserGetClassName) owned by win32k.sys Entry 0x1185: 0xbf8ca552 (NtUserGetClipboardData) owned by win32k.sys Entry 0x1186: 0xbf8ec90c (NtUserGetClipboardFormatName) owned by win32k.sys Entry 0x1187: 0xbf8cf66b (NtUserGetClipboardOwner) owned by win32k.sys Entry 0x1188: 0xbf8c2f8f (NtUserGetClipboardSequenceNumber) owned by win32k.sys Entry 0x1189: 0xbf9135b7 (NtUserGetClipboardViewer) owned by win32k.sys Entry 0x118a: 0xbf913048 (NtUserGetClipCursor) owned by win32k.sys Entry 0x118b: 0xbf912c7e (NtUserGetComboBoxInfo) owned by win32k.sys Entry 0x118c: 0xbf8ab2c6 (NtUserGetControlBrush) owned by win32k.sys Entry 0x118d: 0xbf905ed5 (NtUserGetControlColor) owned by win32k.sys Entry 0x118e: 0xbf81cc5b (NtUserGetCPD) owned by win32k.sys Entry 0x118f: 0xbf860854 (NtUserGetCursorFrameInfo) owned by win32k.sys Entry 0x1190: 0xbf912d9b (NtUserGetCursorInfo) owned by win32k.sys Entry 0x1191: 0xbf804366 (NtUserGetDC) owned by win32k.sys Entry 0x1192: 0xbf82ffb5 (NtUserGetDCEx) owned by win32k.sys Entry 0x1193: 0xbf831018 (NtUserGetDoubleClickTime) owned by win32k.sys Entry 0x1194: 0xbf81c2a5 (NtUserGetForegroundWindow) owned by win32k.sys Entry 0x1195: 0xbf91277c (NtUserGetGuiResources) owned by win32k.sys Entry 0x1196: 0xbf85c773 (NtUserGetGUIThreadInfo) owned by win32k.sys Entry 0x1197: 0xbf83715b (NtUserGetIconInfo) owned by win32k.sys Entry 0x1198: 0xbf8372ab (NtUserGetIconSize) owned by win32k.sys Entry 0x1199: 0xbf915e78 (NtUserGetImeHotKey) owned by win32k.sys Entry 0x119a: 0xbf915ce8 (NtUserGetImeInfoEx) owned by win32k.sys Entry 0x119b: 0xbf9129d1 (NtUserGetInternalWindowPos) owned by win32k.sys Entry 0x119c: 0xbf89a330 (NtUserGetKeyboardLayoutList) owned by win32k.sys Entry 0x119d: 0xbf8f48d8 (NtUserGetKeyboardLayoutName) owned by win32k.sys Entry 0x119e: 0xbf85bc8a (NtUserGetKeyboardState) owned by win32k.sys Entry 0x119f: 0xbf90cd28 (NtUserGetKeyNameText) owned by win32k.sys Entry 0x11a0: 0xbf81c550 (NtUserGetKeyState) owned by win32k.sys Entry 0x11a1: 0xbf912d47 (NtUserGetListBoxInfo) owned by win32k.sys Entry 0x11a2: 0xbf912e98 (NtUserGetMenuBarInfo) owned by win32k.sys Entry 0x11a3: 0xbf9132ee (NtUserGetMenuIndex) owned by win32k.sys Entry 0x11a4: 0xbf913e22 (NtUserGetMenuItemRect) owned by win32k.sys Entry 0x11a5: 0xbf819c8b (NtUserGetMessage) owned by win32k.sys Entry 0x11a6: 0xbf913afd (NtUserGetMouseMovePointsEx) owned by win32k.sys Entry 0x11a7: 0xbf819f03 (NtUserGetObjectInformation) owned by win32k.sys Entry 0x11a8: 0xbf8d0479 (NtUserGetOpenClipboardWindow) owned by win32k.sys Entry 0x11a9: 0xbf9135e3 (NtUserGetPriorityClipboardFormat) owned by win32k.sys Entry 0x11aa: 0xbf819d6e (NtUserGetProcessWindowStation) owned by win32k.sys Entry 0x11ab: 0xbf916e48 (NtUserGetRawInputBuffer) owned by win32k.sys Entry 0x11ac: 0xbf916748 (NtUserGetRawInputData) owned by win32k.sys Entry 0x11ad: 0xbf916922 (NtUserGetRawInputDeviceInfo) owned by win32k.sys Entry 0x11ae: 0xbf916c17 (NtUserGetRawInputDeviceList) owned by win32k.sys Entry 0x11af: 0xbf916e0d (NtUserGetRegisteredRawInputDevices) owned by win32k.sys Entry 0x11b0: 0xbf8a1293 (NtUserGetScrollBarInfo) owned by win32k.sys Entry 0x11b1: 0xbf8351e0 (NtUserGetSystemMenu) owned by win32k.sys Entry 0x11b2: 0xbf81a1b9 (NtUserGetThreadDesktop) owned by win32k.sys Entry 0x11b3: 0xbf81f16c (NtUserGetThreadState) owned by win32k.sys Entry 0x11b4: 0xbf83023f (NtUserGetTitleBarInfo) owned by win32k.sys Entry 0x11b5: 0xbf830e45 (NtUserGetUpdateRect) owned by win32k.sys Entry 0x11b6: 0xbf8c303e (NtUserGetUpdateRgn) owned by win32k.sys Entry 0x11b7: 0xbf803766 (NtUserGetWindowDC) owned by win32k.sys Entry 0x11b8: 0xbf8ec0a9 (NtUserGetWindowPlacement) owned by win32k.sys Entry 0x11b9: 0xbf90efde (NtUserGetWOWClass) owned by win32k.sys Entry 0x11ba: 0xbf9125bd (NtUserHardErrorControl) owned by win32k.sys Entry 0x11bb: 0xbf89937d (NtUserHideCaret) owned by win32k.sys Entry 0x11bc: 0xbf91366c (NtUserHiliteMenuItem) owned by win32k.sys Entry 0x11bd: 0xbf91440e (NtUserImpersonateDdeClientWindow) owned by win32k.sys Entry 0x11be: 0xbf88b3e2 (NtUserInitialize) owned by win32k.sys Entry 0x11bf: 0xbf885937 (NtUserInitializeClientPfnArrays) owned by win32k.sys Entry 0x11c0: 0xbf912ab0 (NtUserInitTask) owned by win32k.sys Entry 0x11c1: 0xbf83033b (NtUserInternalGetWindowText) owned by win32k.sys Entry 0x11c2: 0xbf814edc (NtUserInvalidateRect) owned by win32k.sys Entry 0x11c3: 0xbf8a2896 (NtUserInvalidateRgn) owned by win32k.sys Entry 0x11c4: 0xbf8c2f55 (NtUserIsClipboardFormatAvailable) owned by win32k.sys Entry 0x11c5: 0xbf80e8bd (NtUserKillTimer) owned by win32k.sys Entry 0x11c6: 0xbf8b90d3 (NtUserLoadKeyboardLayoutEx) owned by win32k.sys Entry 0x11c7: 0xbf876ba9 (NtUserLockWindowStation) owned by win32k.sys Entry 0x11c8: 0xbf8d51b9 (NtUserLockWindowUpdate) owned by win32k.sys Entry 0x11c9: 0xbf912696 (NtUserLockWorkStation) owned by win32k.sys Entry 0x11ca: 0xbf8c6cf2 (NtUserMapVirtualKeyEx) owned by win32k.sys Entry 0x11cb: 0xbf913ef9 (NtUserMenuItemFromPoint) owned by win32k.sys Entry 0x11cc: 0xbf80ee53 (NtUserMessageCall) owned by win32k.sys Entry 0x11cd: 0xbf910bd3 (NtUserMinMaximize) owned by win32k.sys Entry 0x11ce: 0xbf9137bc (NtUserMNDragLeave) owned by win32k.sys Entry 0x11cf: 0xbf91370c (NtUserMNDragOver) owned by win32k.sys Entry 0x11d0: 0xbf8ebac5 (NtUserModifyUserStartupInfoFlags) owned by win32k.sys Entry 0x11d1: 0xbf828e1d (NtUserMoveWindow) owned by win32k.sys Entry 0x11d2: 0xbf916156 (NtUserNotifyIMEStatus) owned by win32k.sys Entry 0x11d3: 0xbf858ff2 (NtUserNotifyProcessCreate) owned by win32k.sys Entry 0x11d4: 0xbf8c32fd (NtUserNotifyWinEvent) owned by win32k.sys Entry 0x11d5: 0xbf8c49e7 (NtUserOpenClipboard) owned by win32k.sys Entry 0x11d6: 0xbf85e2f4 (NtUserOpenDesktop) owned by win32k.sys Entry 0x11d7: 0xbf8731c7 (NtUserOpenInputDesktop) owned by win32k.sys Entry 0x11d8: 0xbf8ec2f1 (NtUserOpenWindowStation) owned by win32k.sys Entry 0x11d9: 0xbf868906 (NtUserPaintDesktop) owned by win32k.sys Entry 0x11da: 0xbf803655 (NtUserPeekMessage) owned by win32k.sys Entry 0x11db: 0xbf8082c7 (NtUserPostMessage) owned by win32k.sys Entry 0x11dc: 0xbf85dc4e (NtUserPostThreadMessage) owned by win32k.sys Entry 0x11dd: 0xbf891a26 (NtUserPrintWindow) owned by win32k.sys Entry 0x11de: 0xbf856d2f (NtUserProcessConnect) owned by win32k.sys Entry 0x11df: 0xbf913f8b (NtUserQueryInformationThread) owned by win32k.sys Entry 0x11e0: 0xbf915b62 (NtUserQueryInputContext) owned by win32k.sys Entry 0x11e1: 0xbf914339 (NtUserQuerySendMessage) owned by win32k.sys Entry 0x11e2: 0xbf91625f (NtUserQueryUserCounters) owned by win32k.sys Entry 0x11e3: 0xbf80a0e2 (NtUserQueryWindow) owned by win32k.sys Entry 0x11e4: 0xbf912e5a (NtUserRealChildWindowFromPoint) owned by win32k.sys Entry 0x11e5: 0xbf872c7f (NtUserRealInternalGetMessage) owned by win32k.sys Entry 0x11e6: 0xbf913d62 (NtUserRealWaitMessageEx) owned by win32k.sys Entry 0x11e7: 0xbf81f341 (NtUserRedrawWindow) owned by win32k.sys Entry 0x11e8: 0xbf8521ce (NtUserRegisterClassExWOW) owned by win32k.sys Entry 0x11e9: 0xbf877386 (NtUserRegisterUserApiHook) owned by win32k.sys Entry 0x11ea: 0xbf890f6a (NtUserRegisterHotKey) owned by win32k.sys Entry 0x11eb: 0xbf916d61 (NtUserRegisterRawInputDevices) owned by win32k.sys Entry 0x11ec: 0xbf912c01 (NtUserRegisterTasklist) owned by win32k.sys Entry 0x11ed: 0xbf80a386 (NtUserRegisterWindowMessage) owned by win32k.sys Entry 0x11ee: 0xbf89194e (NtUserRemoveMenu) owned by win32k.sys Entry 0x11ef: 0xbf895bc0 (NtUserRemoveProp) owned by win32k.sys Entry 0x11f0: 0xbf86b86e (NtUserResolveDesktop) owned by win32k.sys Entry 0x11f1: 0xbf917059 (NtUserResolveDesktopForWOW) owned by win32k.sys Entry 0x11f2: 0xbf8a113a (NtUserSBGetParms) owned by win32k.sys Entry 0x11f3: 0xbf85663f (NtUserScrollDC) owned by win32k.sys Entry 0x11f4: 0xbf8eca25 (NtUserScrollWindowEx) owned by win32k.sys Entry 0x11f5: 0xbf8288a4 (NtUserSelectPalette) owned by win32k.sys Entry 0x11f6: 0xbf8c1e70 (NtUserSendInput) owned by win32k.sys Entry 0x11f7: 0xbf8ab536 (NtUserSetActiveWindow) owned by win32k.sys Entry 0x11f8: 0xbf915f4f (NtUserSetAppImeLevel) owned by win32k.sys Entry 0x11f9: 0xbf89d400 (NtUserSetCapture) owned by win32k.sys Entry 0x11fa: 0xbf8a0cb0 (NtUserSetClassLong) owned by win32k.sys Entry 0x11fb: 0xbf9137d9 (NtUserSetClassWord) owned by win32k.sys Entry 0x11fc: 0xbf8cf807 (NtUserSetClipboardData) owned by win32k.sys Entry 0x11fd: 0xbf8ca2d2 (NtUserSetClipboardViewer) owned by win32k.sys Entry 0x11fe: 0xbf8693f1 (NtUserSetConsoleReserveKeys) owned by win32k.sys Entry 0x11ff: 0xbf81c7cb (NtUserSetCursor) owned by win32k.sys Entry 0x1200: 0xbf913ddb (NtUserSetCursorContents) owned by win32k.sys Entry 0x1201: 0xbf8373bd (NtUserSetCursorIconData) owned by win32k.sys Entry 0x1202: 0xbf913371 (NtUserSetDbgTag) owned by win32k.sys Entry 0x1203: 0xbf830731 (NtUserSetFocus) owned by win32k.sys Entry 0x1204: 0xbf8b8ff3 (NtUserSetImeHotKey) owned by win32k.sys Entry 0x1205: 0xbf915dcd (NtUserSetImeInfoEx) owned by win32k.sys Entry 0x1206: 0xbf916024 (NtUserSetImeOwnerWindow) owned by win32k.sys Entry 0x1207: 0xbf858c56 (NtUserSetInformationProcess) owned by win32k.sys Entry 0x1208: 0xbf8691bb (NtUserSetInformationThread) owned by win32k.sys Entry 0x1209: 0xbf912f67 (NtUserSetInternalWindowPos) owned by win32k.sys Entry 0x120a: 0xbf8c4e4b (NtUserSetKeyboardState) owned by win32k.sys Entry 0x120b: 0xbf87f581 (NtUserSetLogonNotifyWindow) owned by win32k.sys Entry 0x120c: 0xbf90cbee (NtUserSetMenu) owned by win32k.sys Entry 0x120d: 0xbf913394 (NtUserSetMenuContextHelpId) owned by win32k.sys Entry 0x120e: 0xbf8918e3 (NtUserSetMenuDefaultItem) owned by win32k.sys Entry 0x120f: 0xbf9133d1 (NtUserSetMenuFlagRtoL) owned by win32k.sys Entry 0x1210: 0xbf912608 (NtUserSetObjectInformation) owned by win32k.sys Entry 0x1211: 0xbf8ab083 (NtUserSetParent) owned by win32k.sys Entry 0x1212: 0xbf85e6e6 (NtUserSetProcessWindowStation) owned by win32k.sys Entry 0x1213: 0xbf823d29 (NtUserSetProp) owned by win32k.sys Entry 0x1214: 0xbf91334e (NtUserSetRipFlags) owned by win32k.sys Entry 0x1215: 0xbf80e5fa (NtUserSetScrollInfo) owned by win32k.sys Entry 0x1216: 0xbf873a65 (NtUserSetShellWindowEx) owned by win32k.sys Entry 0x1217: 0xbf913814 (NtUserSetSysColors) owned by win32k.sys Entry 0x1218: 0xbf913da2 (NtUserSetSystemCursor) owned by win32k.sys Entry 0x1219: 0xbf8f59d3 (NtUserSetSystemMenu) owned by win32k.sys Entry 0x121a: 0xbf914300 (NtUserSetSystemTimer) owned by win32k.sys Entry 0x121b: 0xbf85e73e (NtUserSetThreadDesktop) owned by win32k.sys Entry 0x121c: 0xbf9160d5 (NtUserSetThreadLayoutHandles) owned by win32k.sys Entry 0x121d: 0xbf8ab28a (NtUserSetThreadState) owned by win32k.sys Entry 0x121e: 0xbf803a00 (NtUserSetTimer) owned by win32k.sys Entry 0x121f: 0xbf8ab12e (NtUserSetWindowFNID) owned by win32k.sys Entry 0x1220: 0xbf895d55 (NtUserSetWindowLong) owned by win32k.sys Entry 0x1221: 0xbf8b88e9 (NtUserSetWindowPlacement) owned by win32k.sys Entry 0x1222: 0xbf823ad0 (NtUserSetWindowPos) owned by win32k.sys Entry 0x1223: 0xbf834f5b (NtUserSetWindowRgn) owned by win32k.sys Entry 0x1224: 0xbf860104 (NtUserSetWindowsHookAW) owned by win32k.sys Entry 0x1225: 0xbf85f5f2 (NtUserSetWindowsHookEx) owned by win32k.sys Entry 0x1226: 0xbf876a46 (NtUserSetWindowStationUser) owned by win32k.sys Entry 0x1227: 0xbf8f44fd (NtUserSetWindowWord) owned by win32k.sys Entry 0x1228: 0xbf8ebf17 (NtUserSetWinEventHook) owned by win32k.sys Entry 0x1229: 0xbf8993df (NtUserShowCaret) owned by win32k.sys Entry 0x122a: 0xbf8c3eec (NtUserShowScrollBar) owned by win32k.sys Entry 0x122b: 0xbf899f43 (NtUserShowWindow) owned by win32k.sys Entry 0x122c: 0xbf86b761 (NtUserShowWindowAsync) owned by win32k.sys Entry 0x122d: 0xbf8ebbbd (NtUserSoundSentry) owned by win32k.sys Entry 0x122e: 0xbf873d04 (NtUserSwitchDesktop) owned by win32k.sys Entry 0x122f: 0xbf85174b (NtUserSystemParametersInfo) owned by win32k.sys Entry 0x1230: 0xbf90f169 (NtUserTestForInteractiveUser) owned by win32k.sys Entry 0x1231: 0xbf8f5934 (NtUserThunkedMenuInfo) owned by win32k.sys Entry 0x1232: 0xbf89fc3a (NtUserThunkedMenuItemInfo) owned by win32k.sys Entry 0x1233: 0xbf913bad (NtUserToUnicodeEx) owned by win32k.sys Entry 0x1234: 0xbf85ab05 (NtUserTrackMouseEvent) owned by win32k.sys Entry 0x1235: 0xbf9139ca (NtUserTrackPopupMenuEx) owned by win32k.sys Entry 0x1236: 0xbf8304a6 (NtUserCalcMenuBar) owned by win32k.sys Entry 0x1237: 0xbf8ede9e (NtUserPaintMenuBar) owned by win32k.sys Entry 0x1238: 0xbf8cfe1d (NtUserTranslateAccelerator) owned by win32k.sys Entry 0x1239: 0xbf89bb06 (NtUserTranslateMessage) owned by win32k.sys Entry 0x123a: 0xbf860504 (NtUserUnhookWindowsHookEx) owned by win32k.sys Entry 0x123b: 0xbf8ebff2 (NtUserUnhookWinEvent) owned by win32k.sys Entry 0x123c: 0xbf914278 (NtUserUnloadKeyboardLayout) owned by win32k.sys Entry 0x123d: 0xbf8bc985 (NtUserUnlockWindowStation) owned by win32k.sys Entry 0x123e: 0xbf852b82 (NtUserUnregisterClass) owned by win32k.sys Entry 0x123f: 0xbf876823 (NtUserUnregisterUserApiHook) owned by win32k.sys Entry 0x1240: 0xbf913ac0 (NtUserUnregisterHotKey) owned by win32k.sys Entry 0x1241: 0xbf915b12 (NtUserUpdateInputContext) owned by win32k.sys Entry 0x1242: 0xbf9128ab (NtUserUpdateInstance) owned by win32k.sys Entry 0x1243: 0xbf8aa023 (NtUserUpdateLayeredWindow) owned by win32k.sys Entry 0x1244: 0xbf91668a (NtUserGetLayeredWindowAttributes) owned by win32k.sys Entry 0x1245: 0xbf8a29cc (NtUserSetLayeredWindowAttributes) owned by win32k.sys Entry 0x1246: 0xbf87c59d (NtUserUpdatePerUserSystemParameters) owned by win32k.sys Entry 0x1247: 0xbf913fd2 (NtUserUserHandleGrantAccess) owned by win32k.sys Entry 0x1248: 0xbf8018f1 (NtUserValidateHandleSecure) owned by win32k.sys Entry 0x1249: 0xbf8c76c7 (NtUserValidateRect) owned by win32k.sys Entry 0x124a: 0xbf80a6ad (NtUserValidateTimerCallback) owned by win32k.sys Entry 0x124b: 0xbf8c282e (NtUserVkKeyScanEx) owned by win32k.sys Entry 0x124c: 0xbf90e9ad (NtUserWaitForInputIdle) owned by win32k.sys Entry 0x124d: 0xbf90d8ea (NtUserWaitForMsgAndEvent) owned by win32k.sys Entry 0x124e: 0xbf8036fc (NtUserWaitMessage) owned by win32k.sys Entry 0x124f: 0xbf9125fe (NtUserWin32PoolAllocationStats) owned by win32k.sys Entry 0x1250: 0xbf81cb29 (NtUserWindowFromPoint) owned by win32k.sys Entry 0x1251: 0xbf90f101 (NtUserYieldTask) owned by win32k.sys Entry 0x1252: 0xbf8735ec (NtUserRemoteConnect) owned by win32k.sys Entry 0x1253: 0xbf912485 (NtUserRemoteRedrawRectangle) owned by win32k.sys Entry 0x1254: 0xbf9124d2 (NtUserRemoteRedrawScreen) owned by win32k.sys Entry 0x1255: 0xbf912526 (NtUserRemoteStopScreenUpdates) owned by win32k.sys Entry 0x1256: 0xbf912573 (NtUserCtxDisplayIOCtl) owned by win32k.sys Entry 0x1257: 0xbf8fa61f (NtGdiEngAssociateSurface) owned by win32k.sys Entry 0x1258: 0xbf8fc139 (NtGdiEngCreateBitmap) owned by win32k.sys Entry 0x1259: 0xbf8fa5ec (NtGdiEngCreateDeviceSurface) owned by win32k.sys Entry 0x125a: 0xbf956be2 (NtGdiEngCreateDeviceBitmap) owned by win32k.sys Entry 0x125b: 0xbf8e785d (NtGdiEngCreatePalette) owned by win32k.sys Entry 0x125c: 0xbf904c69 (NtGdiEngComputeGlyphSet) owned by win32k.sys Entry 0x125d: 0xbf95713e (NtGdiEngCopyBits) owned by win32k.sys Entry 0x125e: 0xbf8e83e9 (NtGdiEngDeletePalette) owned by win32k.sys Entry 0x125f: 0xbf8fa572 (NtGdiEngDeleteSurface) owned by win32k.sys Entry 0x1260: 0xbf956d68 (NtGdiEngEraseSurface) owned by win32k.sys Entry 0x1261: 0xbf8ff98f (NtGdiEngUnlockSurface) owned by win32k.sys Entry 0x1262: 0xbf8fbb86 (NtGdiEngLockSurface) owned by win32k.sys Entry 0x1263: 0xbf8fb0ba (NtGdiEngBitBlt) owned by win32k.sys Entry 0x1264: 0xbf8ffd68 (NtGdiEngStretchBlt) owned by win32k.sys Entry 0x1265: 0xbf957536 (NtGdiEngPlgBlt) owned by win32k.sys Entry 0x1266: 0xbf8fc215 (NtGdiEngMarkBandingSurface) owned by win32k.sys Entry 0x1267: 0xbf8fd00f (NtGdiEngStrokePath) owned by win32k.sys Entry 0x1268: 0xbf95772d (NtGdiEngFillPath) owned by win32k.sys Entry 0x1269: 0xbf8fdca4 (NtGdiEngStrokeAndFillPath) owned by win32k.sys Entry 0x126a: 0xbf957898 (NtGdiEngPaint) owned by win32k.sys Entry 0x126b: 0xbf9579b4 (NtGdiEngLineTo) owned by win32k.sys Entry 0x126c: 0xbf957add (NtGdiEngAlphaBlend) owned by win32k.sys Entry 0x126d: 0xbf957c5c (NtGdiEngGradientFill) owned by win32k.sys Entry 0x126e: 0xbf957e35 (NtGdiEngTransparentBlt) owned by win32k.sys Entry 0x126f: 0xbf8fe7e4 (NtGdiEngTextOut) owned by win32k.sys Entry 0x1270: 0xbf9572da (NtGdiEngStretchBltROP) owned by win32k.sys Entry 0x1271: 0xbf958902 (NtGdiXLATEOBJ_cGetPalette) owned by win32k.sys Entry 0x1272: 0xbf9589be (NtGdiXLATEOBJ_iXlate) owned by win32k.sys Entry 0x1273: 0xbf9588b4 (NtGdiXLATEOBJ_hGetColorTransform) owned by win32k.sys Entry 0x1274: 0xbf8fd50c (NtGdiCLIPOBJ_bEnum) owned by win32k.sys Entry 0x1275: 0xbf8fd5b9 (NtGdiCLIPOBJ_cEnumStart) owned by win32k.sys Entry 0x1276: 0xbf956e59 (NtGdiCLIPOBJ_ppoGetPath) owned by win32k.sys Entry 0x1277: 0xbf956e97 (NtGdiEngDeletePath) owned by win32k.sys Entry 0x1278: 0xbf956ed1 (NtGdiEngCreateClip) owned by win32k.sys Entry 0x1279: 0xbf956f03 (NtGdiEngDeleteClip) owned by win32k.sys Entry 0x127a: 0xbf8fcb77 (NtGdiBRUSHOBJ_ulGetBrushColor) owned by win32k.sys Entry 0x127b: 0xbf957fa1 (NtGdiBRUSHOBJ_pvAllocRbrush) owned by win32k.sys Entry 0x127c: 0xbf957ff2 (NtGdiBRUSHOBJ_pvGetRbrush) owned by win32k.sys Entry 0x127d: 0xbf904cef (NtGdiBRUSHOBJ_hGetColorTransform) owned by win32k.sys Entry 0x127e: 0xbf904638 (NtGdiXFORMOBJ_bApplyXform) owned by win32k.sys Entry 0x127f: 0xbf8f991c (NtGdiXFORMOBJ_iGetXform) owned by win32k.sys Entry 0x1280: 0xbf9047f9 (NtGdiFONTOBJ_vGetInfo) owned by win32k.sys Entry 0x1281: 0xbf8f9882 (NtGdiFONTOBJ_pxoGetXform) owned by win32k.sys Entry 0x1282: 0xbf90429d (NtGdiFONTOBJ_cGetGlyphs) owned by win32k.sys Entry 0x1283: 0xbf8f9a8d (NtGdiFONTOBJ_pifi) owned by win32k.sys Entry 0x1284: 0xbf95810b (NtGdiFONTOBJ_pfdg) owned by win32k.sys Entry 0x1285: 0xbf958212 (NtGdiFONTOBJ_pQueryGlyphAttrs) owned by win32k.sys Entry 0x1286: 0xbf9587e4 (NtGdiFONTOBJ_pvTrueTypeFontFile) owned by win32k.sys Entry 0x1287: 0xbf958040 (NtGdiFONTOBJ_cGetAllGlyphHandles) owned by win32k.sys Entry 0x1288: 0xbf9582ea (NtGdiSTROBJ_bEnum) owned by win32k.sys Entry 0x1289: 0xbf904a27 (NtGdiSTROBJ_bEnumPositionsOnly) owned by win32k.sys Entry 0x128a: 0xbf8f9ba0 (NtGdiSTROBJ_bGetAdvanceWidths) owned by win32k.sys Entry 0x128b: 0xbf904a45 (NtGdiSTROBJ_vEnumStart) owned by win32k.sys Entry 0x128c: 0xbf958308 (NtGdiSTROBJ_dwGetCodePage) owned by win32k.sys Entry 0x128d: 0xbf9583f9 (NtGdiPATHOBJ_vGetBounds) owned by win32k.sys Entry 0x128e: 0xbf95848a (NtGdiPATHOBJ_bEnum) owned by win32k.sys Entry 0x128f: 0xbf958597 (NtGdiPATHOBJ_vEnumStart) owned by win32k.sys Entry 0x1290: 0xbf9585f3 (NtGdiPATHOBJ_vEnumStartClipLines) owned by win32k.sys Entry 0x1291: 0xbf9586b1 (NtGdiPATHOBJ_bEnumClipLines) owned by win32k.sys Entry 0x1292: 0xbf956bbb (NtGdiGetDhpdev) owned by win32k.sys Entry 0x1293: 0xbf956f3d (NtGdiEngCheckAbort) owned by win32k.sys Entry 0x1294: 0xbf8fb9a3 (NtGdiHT_Get8BPPFormatPalette) owned by win32k.sys Entry 0x1295: 0xbf956c24 (NtGdiHT_Get8BPPMaskPalette) owned by win32k.sys Entry 0x1296: 0xbf945170 (NtGdiUpdateTransform) owned by win32k.sys Entry 0x1297: 0xbf8e5f75 (NtGdiSetPUMPDOBJ) owned by win32k.sys Entry 0x1298: 0xbf958356 (NtGdiBRUSHOBJ_DeleteRbrush) owned by win32k.sys Entry 0x1299: 0xbf94c6b7 (NtGdiUMPDEngFreeUserMem) owned by win32k.sys Entry 0x129a: 0xbf817d44 (NtGdiDrawStream) owned by win32k.sys