IMPORT("ntoskrnl.exe", "FsRtlIsNameInExpression", 0x00025a20); IMPORT("ntoskrnl.exe", "RtlCompressBuffer", 0x00025ae4); IMPORT("hal", "KfReleaseSpinLock", 0x00025dec); IMPORT("ntoskrnl.exe", "SePrivilegeCheck", 0x00025a54); IMPORT("ntoskrnl.exe", "KeStackAttachProcess", 0x00025da4); IMPORT("ntoskrnl.exe", "ExDeleteResourceLite", 0x00025bc4); IMPORT("ntoskrnl.exe", "SeAccessCheck", 0x00025b68); IMPORT("ntoskrnl.exe", "CcSetLogHandleForFile", 0x000259a0); IMPORT("ntoskrnl.exe", "_allmul", 0x00025978); IMPORT("ntoskrnl.exe", "InterlockedPopEntrySList", 0x00025910); IMPORT("ntoskrnl.exe", "CcMdlWriteComplete", 0x000259c0); IMPORT("ntoskrnl.exe", "RtlCreateSecurityDescriptor", 0x00025c38); IMPORT("ntoskrnl.exe", "FsRtlUninitializeLargeMcb", 0x00025bac); IMPORT("ntoskrnl.exe", "MmPrefetchPages", 0x00025b50); IMPORT("ntoskrnl.exe", "RtlInitializeSid", 0x00025c48); IMPORT("ntoskrnl.exe", "SeSinglePrivilegeCheck", 0x00025a64); IMPORT("ntoskrnl.exe", "RtlAppendUnicodeStringToString", 0x00025c10); IMPORT("ntoskrnl.exe", "ZwOpenKey", 0x00025c64); IMPORT("ntoskrnl.exe", "IoBuildAsynchronousFsdRequest", 0x00025aec); IMPORT("ntoskrnl.exe", "CcUnpinDataForThread", 0x00025ab8); IMPORT("ntoskrnl.exe", "SeReleaseSubjectContext", 0x00025b60); IMPORT("ntoskrnl.exe", "RtlLookupElementGenericTableAvl", 0x00025af0); IMPORT("ntoskrnl.exe", "FsRtlCheckOplock", 0x0002592c); IMPORT("ntoskrnl.exe", "IoFreeErrorLogEntry", 0x00025d8c); IMPORT("ksecdd.sys", "InitSecurityInterfaceW", 0x00025e10); IMPORT("ntoskrnl.exe", "RtlSplay", 0x00025c98); IMPORT("ntoskrnl.exe", "_except_handler3", 0x00025d40); IMPORT("ntoskrnl.exe", "RtlGenerate8dot3Name", 0x0002593c); IMPORT("ntoskrnl.exe", "FsRtlBalanceReads", 0x00025b7c); IMPORT("ntoskrnl.exe", "SeAuditingFileEvents", 0x00025cf8); IMPORT("ntoskrnl.exe", "IoGetFileObjectGenericMapping", 0x00025b74); IMPORT("ntoskrnl.exe", "SeExports", 0x00025cb0); IMPORT("ntoskrnl.exe", "FsRtlSplitLargeMcb", 0x00025bec); IMPORT("ntoskrnl.exe", "NlsMbOemCodePageTag", 0x00025b0c); IMPORT("ntoskrnl.exe", "KeReleaseMutant", 0x00025994); IMPORT("ntoskrnl.exe", "FsRtlFastUnlockAll", 0x000259ec); IMPORT("ntoskrnl.exe", "RtlUnicodeStringToCountedOemString", 0x00025bfc); IMPORT("ntoskrnl.exe", "RtlLengthSecurityDescriptor", 0x00025c2c); IMPORT("ntoskrnl.exe", "IoCheckEaBufferValidity", 0x00025a28); IMPORT("ntoskrnl.exe", "IoReleaseCancelSpinLock", 0x00025c1c); IMPORT("ntoskrnl.exe", "RtlLengthSid", 0x00025b5c); IMPORT("hal", "ExAcquireFastMutex", 0x00025de0); IMPORT("ntoskrnl.exe", "FsRtlPostStackOverflow", 0x00025cc8); IMPORT("ntoskrnl.exe", "_allshl", 0x00025958); IMPORT("ntoskrnl.exe", "RtlDelete", 0x00025c94); IMPORT("ntoskrnl.exe", "RtlLengthRequiredSid", 0x00025c4c); IMPORT("ntoskrnl.exe", "ExRaiseStatus", 0x00025b20); IMPORT("ntoskrnl.exe", "RtlAddAccessAllowedAce", 0x00025c3c); IMPORT("ntoskrnl.exe", "FsRtlTeardownPerStreamContexts", 0x00025d20); IMPORT("ntoskrnl.exe", "SeOpenObjectAuditAlarm", 0x00025cec); IMPORT("ntoskrnl.exe", "SeQuerySecurityDescriptorInfo", 0x00025ce8); IMPORT("ntoskrnl.exe", "RtlInsertElementGenericTableFullAvl", 0x00025ca0); IMPORT("ntoskrnl.exe", "FsRtlFastCheckLockForRead", 0x00025c08); IMPORT("ntoskrnl.exe", "FsRtlNotifyFilterChangeDirectory", 0x00025a00); IMPORT("ntoskrnl.exe", "ObGetObjectSecurity", 0x00025a50); IMPORT("ntoskrnl.exe", "KeSetEvent", 0x00025a30); IMPORT("ntoskrnl.exe", "ProbeForRead", 0x00025b44); IMPORT("ntoskrnl.exe", "IoAcquireCancelSpinLock", 0x00025c20); IMPORT("ntoskrnl.exe", "FsRtlDeleteTunnelCache", 0x00025d28); IMPORT("ntoskrnl.exe", "ObReferenceObjectByHandle", 0x00025ad8); IMPORT("ntoskrnl.exe", "RtlDecompressFragment", 0x00025aa8); IMPORT("ntoskrnl.exe", "FsRtlNotifyFilterReportChange", 0x000259f4); IMPORT("ntoskrnl.exe", "FsRtlIncrementCcFastReadResourceMiss", 0x00025b90); IMPORT("ntoskrnl.exe", "CcPinMappedData", 0x000259b4); IMPORT("ntoskrnl.exe", "RtlFreeOemString", 0x00025bf8); IMPORT("ntoskrnl.exe", "FsRtlPrivateLock", 0x00025bb4); IMPORT("ntoskrnl.exe", "FsRtlIncrementCcFastReadNoWait", 0x00025b9c); IMPORT("ntoskrnl.exe", "IoCheckShareAccess", 0x00025a44); IMPORT("ntoskrnl.exe", "SeQueryInformationToken", 0x00025ca8); IMPORT("ntoskrnl.exe", "CcGetDirtyPages", 0x00025bdc); IMPORT("ksecdd.sys", "GenerateSessionKey", 0x00025e04); IMPORT("ntoskrnl.exe", "FsRtlIncrementCcFastReadWait", 0x00025ba0); IMPORT("ntoskrnl.exe", "FsRtlNotifyInitializeSync", 0x00025d0c); IMPORT("ntoskrnl.exe", "InterlockedPushEntrySList", 0x00025914); IMPORT("ntoskrnl.exe", "memmove", 0x00025d60); IMPORT("ntoskrnl.exe", "ZwCreateFile", 0x00025b40); IMPORT("ntoskrnl.exe", "MmQuerySystemSize", 0x00025c5c); IMPORT("ntoskrnl.exe", "IoAllocateErrorLogEntry", 0x00025d38); IMPORT("ntoskrnl.exe", "MmIsThisAnNtAsSystem", 0x00025c58); IMPORT("ntoskrnl.exe", "IoPageRead", 0x00025d88); IMPORT("ntoskrnl.exe", "RtlDecompressBuffer", 0x00025aa4); IMPORT("ntoskrnl.exe", "RtlInitializeBitMap", 0x00025d58); IMPORT("ntoskrnl.exe", "RtlSetBits", 0x00025960); IMPORT("ntoskrnl.exe", "SeLockSubjectContext", 0x00025b6c); IMPORT("hal", "KeReleaseQueuedSpinLock", 0x00025de4); IMPORT("ntoskrnl.exe", "ObfReferenceObject", 0x00025ac8); IMPORT("ntoskrnl.exe", "IoRegisterDriverReinitialization", 0x00025c70); IMPORT("ntoskrnl.exe", "CcFastCopyWrite", 0x00025ba4); IMPORT("ntoskrnl.exe", "RtlInitializeGenericTableAvl", 0x00025cb8); IMPORT("ntoskrnl.exe", "IoBuildPartialMdl", 0x00025a90); IMPORT("ntoskrnl.exe", "CcMdlRead", 0x00025b30); IMPORT("ntoskrnl.exe", "PsLookupProcessByProcessId", 0x00025da8); IMPORT("ntoskrnl.exe", "_abnormal_termination", 0x00025d48); IMPORT("ntoskrnl.exe", "_allshr", 0x00025d6c); IMPORT("ntoskrnl.exe", "ExDeleteNPagedLookasideList", 0x00025d98); IMPORT("ntoskrnl.exe", "IoSetTopLevelIrp", 0x00025a0c); IMPORT("ntoskrnl.exe", "IoBuildSynchronousFsdRequest", 0x00025b48); IMPORT("ntoskrnl.exe", "IoGetDeviceObjectPointer", 0x00025d9c); IMPORT("ntoskrnl.exe", "ExInitializePagedLookasideList", 0x00025c50); IMPORT("ntoskrnl.exe", "RtlGetCompressionWorkSpaceSize", 0x00025aac); IMPORT("ntoskrnl.exe", "FsRtlNotifyCleanup", 0x000259fc); IMPORT("ntoskrnl.exe", "MmSetAddressRangeModified", 0x00025934); IMPORT("ntoskrnl.exe", "CcDeferWrite", 0x00025b38); IMPORT("ntoskrnl.exe", "ObReferenceObjectByPointer", 0x00025dd4); IMPORT("ntoskrnl.exe", "_alldiv", 0x00025b58); IMPORT("ntoskrnl.exe", "KeSetPriorityThread", 0x00025be0); IMPORT("ntoskrnl.exe", "FsRtlAddToTunnelCache", 0x000259e8); IMPORT("ntoskrnl.exe", "FsRtlTruncateLargeMcb", 0x00025bf0); IMPORT("ntoskrnl.exe", "IoRemoveShareAccess", 0x000259e4); IMPORT("ntoskrnl.exe", "RtlClearBits", 0x00025964); IMPORT("ntoskrnl.exe", "ExReleaseFastMutexUnsafe", 0x00025d64); IMPORT("ntoskrnl.exe", "IoCreateDevice", 0x00025b88); IMPORT("ntoskrnl.exe", "IoSynchronousPageWrite", 0x00025d90); IMPORT("ntoskrnl.exe", "CcMdlReadComplete", 0x000259bc); IMPORT("ntoskrnl.exe", "PoQueueShutdownWorkItem", 0x00025db8); IMPORT("ntoskrnl.exe", "IoGetStackLimits", 0x0002595c); IMPORT("ntoskrnl.exe", "ExAcquireSharedWaitForExclusive", 0x00025cc4); IMPORT("ntoskrnl.exe", "ObQueryObjectAuditingByHandle", 0x00025b14); IMPORT("ntoskrnl.exe", "SeCaptureSubjectContext", 0x00025af4); IMPORT("ntoskrnl.exe", "IoGetCurrentProcess", 0x00025a1c); IMPORT("ntoskrnl.exe", "CcUnpinData", 0x00025d78); IMPORT("ntoskrnl.exe", "IoSetDeviceToVerify", 0x00025d3c); IMPORT("ntoskrnl.exe", "KeUnstackDetachProcess", 0x00025da0); IMPORT("ntoskrnl.exe", "_local_unwind2", 0x00025ae0); IMPORT("ntoskrnl.exe", "FsRtlOplockIsFastIoPossible", 0x00025928); IMPORT("ntoskrnl.exe", "CcPinRead", 0x0002594c); IMPORT("ntoskrnl.exe", "IoSetShareAccess", 0x00025a40); IMPORT("ntoskrnl.exe", "ExAcquireResourceSharedLite", 0x00025d70); IMPORT("ntoskrnl.exe", "FsRtlUninitializeOplock", 0x00025d18); IMPORT("ntoskrnl.exe", "RtlEnumerateGenericTableAvl", 0x00025d30); IMPORT("ntoskrnl.exe", "RtlCreateAcl", 0x00025c40); IMPORT("ntoskrnl.exe", "IoCheckQuotaBufferValidity", 0x00025cb4); IMPORT("ntoskrnl.exe", "RtlUpperString", 0x00025af8); IMPORT("ntoskrnl.exe", "ZwWaitForSingleObject", 0x00025dac); IMPORT("ntoskrnl.exe", "SeUnlockSubjectContext", 0x00025b64); IMPORT("ntoskrnl.exe", "RtlCompareString", 0x00025afc); IMPORT("ntoskrnl.exe", "FsRtlIsTotalDeviceFailure", 0x00025ac0); IMPORT("ntoskrnl.exe", "RtlFindNextForwardRunClear", 0x00025d4c); IMPORT("ntoskrnl.exe", "CcMapData", 0x000259b0); IMPORT("ntoskrnl.exe", "FsRtlCurrentBatchOplock", 0x00025a48); IMPORT("ntoskrnl.exe", "FsRtlNormalizeNtstatus", 0x00025900); IMPORT("ntoskrnl.exe", "CcFastCopyRead", 0x00025b98); IMPORT("ntoskrnl.exe", "KeInitializeMutant", 0x00025c84); IMPORT("ntoskrnl.exe", "KeEnterCriticalRegion", 0x00025a10); IMPORT("ntoskrnl.exe", "KeInitializeTimer", 0x00025c78); IMPORT("ntoskrnl.exe", "IoAllocateMdl", 0x00025a9c); IMPORT("ntoskrnl.exe", "ExIsResourceAcquiredExclusiveLite", 0x00025908); IMPORT("ntoskrnl.exe", "FsRtlFindInTunnelCache", 0x00025a60); IMPORT("ntoskrnl.exe", "IoSetInformation", 0x00025a34); IMPORT("hal", "ExTryToAcquireFastMutex", 0x00025df0); IMPORT("ntoskrnl.exe", "DbgBreakPoint", 0x000259d0); IMPORT("ntoskrnl.exe", "FsRtlCheckLockForWriteAccess", 0x00025924); IMPORT("ntoskrnl.exe", "RtlSetDaclSecurityDescriptor", 0x00025c34); IMPORT("ntoskrnl.exe", "FsRtlFastCheckLockForWrite", 0x00025c04); IMPORT("ntoskrnl.exe", "FsRtlFastUnlockAllByKey", 0x00025bbc); IMPORT("ntoskrnl.exe", "CcMdlWriteAbort", 0x00025c24); IMPORT("ntoskrnl.exe", "_aullshr", 0x00025954); IMPORT("ntoskrnl.exe", "CcPurgeCacheSection", 0x00025d44); IMPORT("ntoskrnl.exe", "IoUpdateShareAccess", 0x00025a3c); IMPORT("ntoskrnl.exe", "FsRtlOplockFsctrl", 0x00025a38); IMPORT("ntoskrnl.exe", "FsRtlIncrementCcFastReadNotPossible", 0x00025b94); IMPORT("ntoskrnl.exe", "CcSetAdditionalCacheAttributes", 0x00025b78); IMPORT("ntoskrnl.exe", "FsRtlGetNextLargeMcbEntry", 0x00025968); IMPORT("ntoskrnl.exe", "RtlAreBitsSet", 0x0002596c); IMPORT("ntoskrnl.exe", "ExUuidCreate", 0x00025c90); IMPORT("ntoskrnl.exe", "KeQuerySystemTime", 0x00025918); IMPORT("ntoskrnl.exe", "RtlInitUnicodeString", 0x0002590c); IMPORT("ntoskrnl.exe", "RtlSubAuthoritySid", 0x00025c44); IMPORT("ntoskrnl.exe", "ExReleaseResourceLite", 0x00025d68); IMPORT("ntoskrnl.exe", "SeAppendPrivileges", 0x00025cf4); IMPORT("ntoskrnl.exe", "CcPreparePinWrite", 0x000259b8); IMPORT("ntoskrnl.exe", "SeDeassignSecurity", 0x00025ce0); IMPORT("ntoskrnl.exe", "KeInitializeEvent", 0x00025a7c); IMPORT("ntoskrnl.exe", "PsImpersonateClient", 0x00025dc8); IMPORT("ntoskrnl.exe", "MmProbeAndLockPages", 0x00025a98); IMPORT("ksecdd.sys", "GenerateDirEfs", 0x00025e0c); IMPORT("hal", "KeAcquireQueuedSpinLock", 0x00025de8); IMPORT("ntoskrnl.exe", "MmMapLockedPagesSpecifyCache", 0x00025a8c); IMPORT("ntoskrnl.exe", "RtlDeleteElementGenericTableAvl", 0x000259e0); IMPORT("ntoskrnl.exe", "FsRtlMdlReadCompleteDev", 0x00025c8c); IMPORT("ntoskrnl.exe", "FsRtlLegalAnsiCharacterArray", 0x00025b04); IMPORT("hal", "KeAcquireInStackQueuedSpinLock", 0x00025ddc); IMPORT("ntoskrnl.exe", "FsRtlAddLargeMcbEntry", 0x00025990); IMPORT("ntoskrnl.exe", "IoCancelIrp", 0x00025a74); IMPORT("ntoskrnl.exe", "ObQueryNameString", 0x00025b80); IMPORT("ntoskrnl.exe", "FsRtlDissectName", 0x00025a6c); IMPORT("ntoskrnl.exe", "RtlFindClearRuns", 0x00025984); IMPORT("ntoskrnl.exe", "CcCanIWrite", 0x00025948); IMPORT("ntoskrnl.exe", "ExAcquireResourceExclusiveLite", 0x00025d74); IMPORT("ntoskrnl.exe", "IoRaiseInformationalHardError", 0x00025c0c); IMPORT("ntoskrnl.exe", "CcCopyWrite", 0x00025944); IMPORT("ntoskrnl.exe", "FsRtlInitializeTunnelCache", 0x00025d10); IMPORT("ntoskrnl.exe", "FsRtlRemoveLargeMcbEntry", 0x00025988); IMPORT("ntoskrnl.exe", "RtlNumberOfClearBits", 0x00025974); IMPORT("ntoskrnl.exe", "ExDeletePagedLookasideList", 0x00025d94); IMPORT("ntoskrnl.exe", "wcslen", 0x00025b84); IMPORT("ntoskrnl.exe", "IoBuildDeviceIoControlRequest", 0x00025b28); IMPORT("hal", "KfAcquireSpinLock", 0x00025dfc); IMPORT("ntoskrnl.exe", "KeClearEvent", 0x00025a68); IMPORT("ntoskrnl.exe", "FsRtlNotifyVolumeEvent", 0x000259dc); IMPORT("ntoskrnl.exe", "FsRtlInitializeLargeMcb", 0x00025bb0); IMPORT("ntoskrnl.exe", "RtlFindClearBits", 0x00025980); IMPORT("ntoskrnl.exe", "FsRtlAreNamesEqual", 0x00025920); IMPORT("ntoskrnl.exe", "CcSetDirtyPinnedData", 0x00025930); IMPORT("ntoskrnl.exe", "ExAllocatePoolWithTag", 0x00025d54); IMPORT("ntoskrnl.exe", "ObReleaseObjectSecurity", 0x00025a4c); IMPORT("ntoskrnl.exe", "RtlUpcaseUnicodeString", 0x00025940); IMPORT("ntoskrnl.exe", "IoFreeIrp", 0x00025ab0); IMPORT("ntoskrnl.exe", "KeGetCurrentThread", 0x00025aa0); IMPORT("ntoskrnl.exe", "FsRtlIsNtstatusExpected", 0x000259cc); IMPORT("ntoskrnl.exe", "MmBuildMdlForNonPagedPool", 0x00025acc); IMPORT("ntoskrnl.exe", "ExAcquireFastMutexUnsafe", 0x00025d50); IMPORT("ntoskrnl.exe", "FsRtlFreeFileLock", 0x00025d00); IMPORT("ntoskrnl.exe", "SeOpenObjectForDeleteAuditAlarm", 0x00025cf0); IMPORT("ntoskrnl.exe", "KeSetTimer", 0x00025bd4); IMPORT("ksecdd.sys", "EfsDecryptFek", 0x00025e14); IMPORT("ntoskrnl.exe", "FsRtlDoesNameContainWildCards", 0x00025a24); IMPORT("ntoskrnl.exe", "RtlMapGenericMask", 0x00025b70); IMPORT("ntoskrnl.exe", "ExGetExclusiveWaiterCount", 0x00025ad0); IMPORT("ntoskrnl.exe", "ObfDereferenceObject", 0x00025998); IMPORT("ntoskrnl.exe", "SeFreePrivileges", 0x00025cdc); IMPORT("ntoskrnl.exe", "FsRtlFastUnlockSingle", 0x00025bb8); IMPORT("ntoskrnl.exe", "_allrem", 0x00025b1c); IMPORT("ntoskrnl.exe", "KeInitializeDpc", 0x00025c74); IMPORT("ntoskrnl.exe", "ZwAllocateVirtualMemory", 0x00025dd0); IMPORT("ntoskrnl.exe", "NlsOemLeadByteInfo", 0x00025b08); IMPORT("ntoskrnl.exe", "ExQueueWorkItem", 0x00025a18); IMPORT("ntoskrnl.exe", "KeNumberProcessors", 0x00025b34); IMPORT("ntoskrnl.exe", "SeAuditingHardLinkEvents", 0x00025b24); IMPORT("ntoskrnl.exe", "RtlEqualSid", 0x00025cac); IMPORT("ntoskrnl.exe", "FsRtlDeleteKeyFromTunnelCache", 0x000259f8); IMPORT("ntoskrnl.exe", "IoFileObjectType", 0x00025adc); IMPORT("ntoskrnl.exe", "MmCanFileBeTruncated", 0x00025938); IMPORT("ntoskrnl.exe", "IoReleaseVpbSpinLock", 0x00025cd0); IMPORT("ntoskrnl.exe", "CcSetFileSizes", 0x00025d80); IMPORT("ntoskrnl.exe", "PsRevertToSelf", 0x00025dc0); IMPORT("ntoskrnl.exe", "ExIsResourceAcquiredSharedLite", 0x00025a2c); IMPORT("ntoskrnl.exe", "SeSetSecurityDescriptorInfo", 0x00025ce4); IMPORT("ntoskrnl.exe", "ExfInterlockedAddUlong", 0x00025b8c); IMPORT("ntoskrnl.exe", "FsRtlAllocateFileLock", 0x00025d04); IMPORT("ntoskrnl.exe", "ExAcquireSharedStarveExclusive", 0x00025bd8); IMPORT("ntoskrnl.exe", "ExReleaseResourceForThreadLite", 0x00025ab4); IMPORT("ntoskrnl.exe", "CcSetReadAheadGranularity", 0x00025cbc); IMPORT("ntoskrnl.exe", "CcInitializeCacheMap", 0x000259a4); IMPORT("ntoskrnl.exe", "RtlLookupElementGenericTableFullAvl", 0x00025ca4); IMPORT("ntoskrnl.exe", "ZwCreateEvent", 0x00025db4); IMPORT("ntoskrnl.exe", "MmUnlockPages", 0x00025ae8); IMPORT("ntoskrnl.exe", "IoGetRelatedDeviceObject", 0x00025b4c); IMPORT("ntoskrnl.exe", "RtlVerifyVersionInfo", 0x00025c68); IMPORT("ntoskrnl.exe", "PsCreateSystemThread", 0x00025db0); IMPORT("ntoskrnl.exe", "KeSetKernelStackSwapEnable", 0x00025a78); IMPORT("ntoskrnl.exe", "IoIsOperationSynchronous", 0x00025a80); IMPORT("ntoskrnl.exe", "ProbeForWrite", 0x00025b54); IMPORT("ntoskrnl.exe", "RtlValidSid", 0x00025c9c); IMPORT("hal", "KeReleaseInStackQueuedSpinLock", 0x00025df8); IMPORT("ntoskrnl.exe", "KdDebuggerEnabled", 0x000259d8); IMPORT("ntoskrnl.exe", "CcPrepareMdlWrite", 0x00025b2c); IMPORT("ntoskrnl.exe", "_alloca_probe", 0x00025a70); IMPORT("ntoskrnl.exe", "IoCreateStreamFileObjectLite", 0x000259a8); IMPORT("ntoskrnl.exe", "IoAcquireVpbSpinLock", 0x00025cd4); IMPORT("ntoskrnl.exe", "RtlCopyUnicodeString", 0x00025c14); IMPORT("ntoskrnl.exe", "SeValidSecurityDescriptor", 0x00025cd8); IMPORT("ntoskrnl.exe", "CcUninitializeCacheMap", 0x0002599c); IMPORT("ksecdd.sys", "EfsGenerateKey", 0x00025e08); IMPORT("ntoskrnl.exe", "PsDereferenceImpersonationToken", 0x00025dc4); IMPORT("ntoskrnl.exe", "DbgPrint", 0x000259d4); IMPORT("ntoskrnl.exe", "KeBugCheck", 0x00025c80); IMPORT("ntoskrnl.exe", "CcZeroData", 0x000259c8); IMPORT("ntoskrnl.exe", "FsRtlPostPagingFileStackOverflow", 0x00025ccc); IMPORT("ntoskrnl.exe", "SeAssignSecurity", 0x00025c30); IMPORT("ntoskrnl.exe", "FsRtlLookupLargeMcbEntry", 0x0002598c); IMPORT("ntoskrnl.exe", "RtlInsertElementGenericTableAvl", 0x00025d14); IMPORT("ntoskrnl.exe", "MmFlushImageSection", 0x00025a04); IMPORT("ntoskrnl.exe", "RtlAreBitsClear", 0x0002597c); IMPORT("ntoskrnl.exe", "RtlFindLastBackwardRunClear", 0x00025970); IMPORT("ntoskrnl.exe", "CcSetBcbOwnerPointer", 0x00025abc); IMPORT("ntoskrnl.exe", "IoGetTopLevelIrp", 0x00025950); IMPORT("ntoskrnl.exe", "RtlFillMemoryUlong", 0x00025d84); IMPORT("ntoskrnl.exe", "CcCopyRead", 0x00025b18); IMPORT("ntoskrnl.exe", "IoGetRequestorProcess", 0x000259f0); IMPORT("ntoskrnl.exe", "VerSetConditionMask", 0x00025c6c); IMPORT("ntoskrnl.exe", "MmUnmapLockedPages", 0x00025a88); IMPORT("ntoskrnl.exe", "IoWriteErrorLogEntry", 0x00025d34); IMPORT("ntoskrnl.exe", "SeAuditHardLinkCreation", 0x00025d7c); IMPORT("ntoskrnl.exe", "RtlGetOwnerSecurityDescriptor", 0x00025a5c); IMPORT("ntoskrnl.exe", "IofCompleteRequest", 0x00025a14); IMPORT("ntoskrnl.exe", "CcWaitForCurrentLazyWriterActivity", 0x00025a58); IMPORT("ntoskrnl.exe", "IoDeleteDevice", 0x00025d24); IMPORT("ntoskrnl.exe", "CcFlushCache", 0x00025904); IMPORT("hal", "ExReleaseFastMutex", 0x00025df4); IMPORT("ntoskrnl.exe", "KeLeaveCriticalRegion", 0x00025a08); IMPORT("ntoskrnl.exe", "ZwQueryValueKey", 0x00025c60); IMPORT("ntoskrnl.exe", "CcRemapBcb", 0x00025bf4); IMPORT("ntoskrnl.exe", "FsRtlLookupLastLargeMcbEntry", 0x00025be4); IMPORT("ntoskrnl.exe", "IoIsSystemThread", 0x00025c28); IMPORT("ntoskrnl.exe", "ExReinitializeResourceLite", 0x00025d08); IMPORT("ntoskrnl.exe", "ExInitializeResourceLite", 0x00025bc8); IMPORT("ntoskrnl.exe", "FsRtlCheckLockForReadAccess", 0x00025cc0); IMPORT("ntoskrnl.exe", "IofCallDriver", 0x00025a84); IMPORT("ntoskrnl.exe", "ExFreePoolWithTag", 0x00025d5c); IMPORT("ntoskrnl.exe", "IoVolumeDeviceToDosName", 0x00025c18); IMPORT("ntoskrnl.exe", "FsRtlMdlWriteCompleteDev", 0x00025c88); IMPORT("ntoskrnl.exe", "ZwFreeVirtualMemory", 0x00025dbc); IMPORT("ntoskrnl.exe", "RtlCompareMemory", 0x0002591c); IMPORT("ntoskrnl.exe", "RtlEnumerateGenericTableWithoutSplayingAvl", 0x00025cfc); IMPORT("ntoskrnl.exe", "FsRtlInitializeOplock", 0x00025d1c); IMPORT("ntoskrnl.exe", "ExInitializeNPagedLookasideList", 0x00025c54); IMPORT("ntoskrnl.exe", "FsRtlNumberOfRunsInLargeMcb", 0x00025be8); IMPORT("ntoskrnl.exe", "SeDeleteObjectAuditAlarm", 0x00025b10); IMPORT("ntoskrnl.exe", "FsRtlNotifyUninitializeSync", 0x00025d2c); IMPORT("ntoskrnl.exe", "IoMakeAssociatedIrp", 0x00025ac4); IMPORT("ntoskrnl.exe", "FsRtlResetLargeMcb", 0x00025bd0); IMPORT("ntoskrnl.exe", "FsRtlIsFatDbcsLegal", 0x00025c00); IMPORT("ntoskrnl.exe", "KeInitializeSpinLock", 0x00025bcc); IMPORT("ntoskrnl.exe", "PsReferenceImpersonationToken", 0x00025dcc); IMPORT("ntoskrnl.exe", "KeBugCheckEx", 0x000259c4); IMPORT("ntoskrnl.exe", "KeDelayExecutionThread", 0x00025ad4); IMPORT("ntoskrnl.exe", "KeWaitForSingleObject", 0x000259ac); IMPORT("ntoskrnl.exe", "RtlInitString", 0x00025b00); IMPORT("ntoskrnl.exe", "CcFastMdlReadWait", 0x00025ba8); IMPORT("ntoskrnl.exe", "ZwClose", 0x00025b3c); IMPORT("ntoskrnl.exe", "IoRegisterFileSystem", 0x00025c7c); IMPORT("ntoskrnl.exe", "IoFreeMdl", 0x00025a94); IMPORT("ntoskrnl.exe", "FsRtlProcessFileLock", 0x00025bc0);