Revision: 5348 Date 2:3:2008. Time 15:0 //===================================================== *** Hardware *** Processor: Intel(R) Celeron(R) CPU 2.93GHz Number Of Processors: 1 Physical Memory: 2087728 KB (Available: 651580 KB) Commit Charge Limit: 4194303 KB *** Operation System *** Microsoft Windows 2000 Professional Service Pack 4 (Version 5.0, Build 2195) //===================================================== Exception code: C0000005 ACCESS_VIOLATION Fault address: 77FCD989 03:00003989 C:\WINNT\system32\ntdll.dll Registers: EAX:00000000 EBX:00DE0000 ECX:00000000 EDX:54BFCE80 ESI:54BE10E8 EDI:54BFCE80 CS:EIP:001B:77FCD989 SS:ESP:0023:55C8FBFC EBP:55C8FC08 DS:0023 ES:0023 FS:0038 GS:0000 Flags:00010246 Call stack: Address Frame Function SourceFile 77FCD989 55C8FC08 RtlZeroHeap+813 77FCB80C 55C8FCB4 RtlFreeHeap+142 00682F59 55C8FCF0 ?step@barGoLink@@QAEXXZ+89B89 00649830 0154A738 ?step@barGoLink@@QAEXXZ+50460 0154A773 0154A770 0000:00000000 30003100 31003231 0000:00000000 ======================== Local Variables And Parameters Call stack: Address Frame Function SourceFile 77FCD989 55C8FC08 RtlZeroHeap+813 77FCB80C 55C8FCB4 RtlFreeHeap+142 00682F59 55C8FCF0 ?step@barGoLink@@QAEXXZ+89B89 00649830 0154A738 ?step@barGoLink@@QAEXXZ+50460 0154A773 0154A770 0000:00000000 30003100 31003231 0000:00000000 ======================== Global Variables 'LdrDisableThreadCalloutsForDll' 'RtlNormalizeProcessParams' 'RtlInitNlsTables' 'RtlInitCodePageTable' 'RtlInitializeCriticalSection' 'LdrLoadDll' 'LdrGetDllHandle' 'RtlLockHeap' 'RtlUnlockHeap' 'RtlSetCurrentDirectory_U' 'RtlDosPathNameToNtPathName_U' 'RtlAcquirePebLock' 'RtlReleasePebLock' 'RtlDetermineDosPathNameType_U' 'RtlAnsiStringToUnicodeString' 'RtlMultiByteToUnicodeN' 'RtlUnicodeStringToAnsiString' 'RtlUnicodeToMultiByteN' 'RtlFreeAnsiString' 'RtlFreeUnicodeString' 'RtlFreeOemString' 'RtlOemStringToUnicodeString' 'RtlOemToUnicodeN' 'RtlUnicodeStringToOemString' 'RtlUnicodeToOemN' 'RtlEnterCriticalSection' 'RtlLeaveCriticalSection' 'RtlTryEnterCriticalSection' 'LdrInitializeThunk' 'NtAcceptConnectPort' 'ZwAcceptConnectPort' 'ZwAccessCheck' 'NtAccessCheck' 'NtAccessCheckAndAuditAlarm' 'ZwAccessCheckAndAuditAlarm' 'NtAccessCheckByType' 'ZwAccessCheckByType' 'ZwAccessCheckByTypeAndAuditAlarm' 'NtAccessCheckByTypeAndAuditAlarm' 'ZwAccessCheckByTypeResultList' 'NtAccessCheckByTypeResultList' 'NtAccessCheckByTypeResultListAndAuditAlarm' 'ZwAccessCheckByTypeResultListAndAuditAlarm' 'ZwAccessCheckByTypeResultListAndAuditAlarmByHandle' 'NtAccessCheckByTypeResultListAndAuditAlarmByHandle' 'NtAddAtom' 'ZwAddAtom' 'NtAdjustGroupsToken' 'ZwAdjustGroupsToken' 'ZwAdjustPrivilegesToken' 'NtAdjustPrivilegesToken' 'NtAlertResumeThread' 'ZwAlertResumeThread' 'NtAlertThread' 'ZwAlertThread' 'ZwAllocateLocallyUniqueId' 'NtAllocateLocallyUniqueId' 'ZwAllocateUserPhysicalPages' 'NtAllocateUserPhysicalPages' 'NtAllocateUuids' 'ZwAllocateUuids' 'NtAllocateVirtualMemory' 'ZwAllocateVirtualMemory' 'NtAreMappedFilesTheSame' 'ZwAreMappedFilesTheSame' 'NtAssignProcessToJobObject' 'ZwAssignProcessToJobObject' 'NtCallbackReturn' 'ZwCallbackReturn' 'ZwCancelIoFile' 'NtCancelIoFile' 'NtCancelTimer' 'ZwCancelTimer' 'NtCancelDeviceWakeupRequest' 'ZwCancelDeviceWakeupRequest' 'ZwClearEvent' 'NtClearEvent' 'ZwClose' 'NtClose' 'NtCloseObjectAuditAlarm' 'ZwCloseObjectAuditAlarm' 'ZwCompleteConnectPort' 'NtCompleteConnectPort' 'ZwConnectPort' 'NtConnectPort' 'NtContinue' 'ZwContinue' 'NtCreateDirectoryObject' 'ZwCreateDirectoryObject' 'NtCreateEvent' 'ZwCreateEvent' 'NtCreateEventPair' 'ZwCreateEventPair' 'NtCreateFile' 'ZwCreateFile' 'NtCreateIoCompletion' 'ZwCreateIoCompletion' 'NtCreateJobObject' 'ZwCreateJobObject' 'NtCreateKey' 'ZwCreateKey' 'ZwCreateMailslotFile' 'NtCreateMailslotFile' 'NtCreateMutant' 'ZwCreateMutant' 'NtCreateNamedPipeFile' 'ZwCreateNamedPipeFile' 'NtCreatePagingFile' 'ZwCreatePagingFile' 'NtCreatePort' 'ZwCreatePort' 'ZwCreateProcess' 'NtCreateProcess' 'NtCreateProfile' 'ZwCreateProfile' 'ZwCreateSection' 'NtCreateSection' 'ZwCreateSemaphore' 'NtCreateSemaphore' 'NtCreateSymbolicLinkObject' 'ZwCreateSymbolicLinkObject' 'NtCreateThread' 'ZwCreateThread' 'ZwCreateTimer' 'NtCreateTimer' 'NtCreateToken' 'ZwCreateToken' 'ZwCreateWaitablePort' 'NtCreateWaitablePort' 'ZwDelayExecution' 'NtDelayExecution' 'NtDeleteAtom' 'ZwDeleteAtom' 'ZwDeleteFile' 'NtDeleteFile' 'NtDeleteKey' 'ZwDeleteKey' 'NtDeleteObjectAuditAlarm' 'ZwDeleteObjectAuditAlarm' 'NtDeleteValueKey' 'ZwDeleteValueKey' 'NtDeviceIoControlFile' 'ZwDeviceIoControlFile' 'NtDisplayString' 'ZwDisplayString' 'ZwDuplicateObject' 'NtDuplicateObject' 'NtDuplicateToken' 'ZwDuplicateToken' 'ZwEnumerateKey' 'NtEnumerateKey' 'ZwEnumerateValueKey' 'NtEnumerateValueKey' 'NtExtendSection' 'ZwExtendSection' 'NtFilterToken' 'ZwFilterToken' 'NtFindAtom' 'ZwFindAtom' 'NtFlushBuffersFile' 'ZwFlushBuffersFile' 'ZwFlushInstructionCache' 'NtFlushInstructionCache' 'ZwFlushKey' 'NtFlushKey' 'ZwFlushVirtualMemory' 'NtFlushVirtualMemory' 'ZwFlushWriteBuffer' 'NtFlushWriteBuffer' 'ZwFreeUserPhysicalPages' 'NtFreeUserPhysicalPages' 'ZwFreeVirtualMemory' 'NtFreeVirtualMemory' 'ZwFsControlFile' 'NtFsControlFile' 'NtGetContextThread' 'ZwGetContextThread' 'ZwGetDevicePowerState' 'NtGetDevicePowerState' 'ZwGetPlugPlayEvent' 'NtGetPlugPlayEvent' 'ZwGetTickCount' 'NtGetTickCount' 'ZwGetWriteWatch' 'NtGetWriteWatch' 'ZwImpersonateAnonymousToken' 'NtImpersonateAnonymousToken' 'ZwImpersonateClientOfPort' 'NtImpersonateClientOfPort' 'ZwImpersonateThread' 'NtImpersonateThread' 'ZwInitializeRegistry' 'NtInitializeRegistry' 'ZwInitiatePowerAction' 'NtInitiatePowerAction' 'ZwIsSystemResumeAutomatic' 'NtIsSystemResumeAutomatic' 'NtListenPort' 'ZwListenPort' 'ZwLoadDriver' 'NtLoadDriver' 'ZwLoadKey' 'NtLoadKey' 'NtLoadKey2' 'ZwLoadKey2' 'NtLockFile' 'ZwLockFile' 'ZwLockVirtualMemory' 'NtLockVirtualMemory' 'ZwMakeTemporaryObject' 'NtMakeTemporaryObject' 'ZwMapUserPhysicalPages' 'NtMapUserPhysicalPages' 'NtMapUserPhysicalPagesScatter' 'ZwMapUserPhysicalPagesScatter' 'NtMapViewOfSection' 'ZwMapViewOfSection' 'NtNotifyChangeDirectoryFile' 'ZwNotifyChangeDirectoryFile' 'ZwNotifyChangeKey' 'NtNotifyChangeKey' 'ZwNotifyChangeMultipleKeys' 'NtNotifyChangeMultipleKeys' 'ZwOpenDirectoryObject' 'NtOpenDirectoryObject' 'ZwOpenEvent' 'NtOpenEvent' 'ZwOpenEventPair' 'NtOpenEventPair' 'ZwOpenFile' 'NtOpenFile' 'ZwOpenIoCompletion' 'NtOpenIoCompletion' 'ZwOpenJobObject' 'NtOpenJobObject' 'NtOpenKey' 'ZwOpenKey' 'ZwOpenMutant' 'NtOpenMutant' 'ZwOpenObjectAuditAlarm' 'NtOpenObjectAuditAlarm' 'NtOpenProcess' 'ZwOpenProcess' 'ZwOpenProcessToken' 'NtOpenProcessToken' 'ZwOpenSection' 'NtOpenSection' 'NtOpenSemaphore' 'ZwOpenSemaphore' 'NtOpenSymbolicLinkObject' 'ZwOpenSymbolicLinkObject' 'NtOpenThread' 'ZwOpenThread' 'ZwOpenThreadToken' 'NtOpenThreadToken' 'ZwOpenTimer' 'NtOpenTimer' 'NtPlugPlayControl' 'ZwPlugPlayControl' 'ZwPowerInformation' 'NtPowerInformation' 'NtPrivilegeCheck' 'ZwPrivilegeCheck' 'ZwPrivilegedServiceAuditAlarm' 'NtPrivilegedServiceAuditAlarm' 'ZwPrivilegeObjectAuditAlarm' 'NtPrivilegeObjectAuditAlarm' 'ZwProtectVirtualMemory' 'NtProtectVirtualMemory' 'ZwPulseEvent' 'NtPulseEvent' 'ZwQueryInformationAtom' 'NtQueryInformationAtom' 'NtQueryAttributesFile' 'ZwQueryAttributesFile' 'ZwQueryDefaultLocale' 'NtQueryDefaultLocale' 'ZwQueryDefaultUILanguage' 'NtQueryDefaultUILanguage' 'ZwQueryDirectoryFile' 'NtQueryDirectoryFile' 'NtQueryDirectoryObject' 'ZwQueryDirectoryObject' 'NtQueryEaFile' 'ZwQueryEaFile' 'ZwQueryEvent' 'NtQueryEvent' 'ZwQueryFullAttributesFile' 'NtQueryFullAttributesFile' 'ZwQueryInformationFile' 'NtQueryInformationFile' 'NtQueryInformationJobObject' 'ZwQueryInformationJobObject' 'ZwQueryIoCompletion' 'NtQueryIoCompletion' 'NtQueryInformationPort' 'ZwQueryInformationPort' 'NtQueryInformationProcess' 'ZwQueryInformationProcess' 'NtQueryInformationThread' 'ZwQueryInformationThread' 'ZwQueryInformationToken' 'NtQueryInformationToken' 'ZwQueryInstallUILanguage' 'NtQueryInstallUILanguage' 'ZwQueryIntervalProfile' 'NtQueryIntervalProfile' 'NtQueryKey' 'ZwQueryKey' 'ZwQueryMultipleValueKey' 'NtQueryMultipleValueKey' 'NtQueryMutant' 'ZwQueryMutant' 'NtQueryObject' 'ZwQueryObject' 'ZwQueryOpenSubKeys' 'NtQueryOpenSubKeys' 'NtQueryPerformanceCounter' 'ZwQueryPerformanceCounter' 'ZwQueryQuotaInformationFile' 'NtQueryQuotaInformationFile' 'NtQuerySection' 'ZwQuerySection' 'NtQuerySecurityObject' 'ZwQuerySecurityObject' 'NtQuerySemaphore' 'ZwQuerySemaphore' 'ZwQuerySymbolicLinkObject' 'NtQuerySymbolicLinkObject' 'ZwQuerySystemEnvironmentValue' 'NtQuerySystemEnvironmentValue' 'NtQuerySystemInformation' 'ZwQuerySystemInformation' 'NtQuerySystemTime' 'ZwQuerySystemTime' 'NtQueryTimer' 'ZwQueryTimer' 'NtQueryTimerResolution' 'ZwQueryTimerResolution' 'ZwQueryValueKey' 'NtQueryValueKey' 'ZwQueryVirtualMemory' 'NtQueryVirtualMemory' 'NtQueryVolumeInformationFile' 'ZwQueryVolumeInformationFile' 'ZwQueueApcThread' 'NtQueueApcThread' 'NtRaiseException' 'ZwRaiseException' 'ZwRaiseHardError' 'NtRaiseHardError' 'NtReadFile' 'ZwReadFile' 'NtReadFileScatter' 'ZwReadFileScatter' 'NtReadRequestData' 'ZwReadRequestData' 'NtReadVirtualMemory' 'ZwReadVirtualMemory' 'NtRegisterThreadTerminatePort' 'ZwRegisterThreadTerminatePort' 'NtReleaseMutant' 'ZwReleaseMutant' 'NtReleaseSemaphore' 'ZwReleaseSemaphore' 'ZwRemoveIoCompletion' 'NtRemoveIoCompletion' 'ZwReplaceKey' 'NtReplaceKey' 'ZwReplyPort' 'NtReplyPort' 'ZwReplyWaitReceivePort' 'NtReplyWaitReceivePort' 'ZwReplyWaitReceivePortEx' 'NtReplyWaitReceivePortEx' 'ZwReplyWaitReplyPort' 'NtReplyWaitReplyPort' 'NtRequestDeviceWakeup' 'ZwRequestDeviceWakeup' 'ZwRequestPort' 'NtRequestPort' 'NtRequestWaitReplyPort' 'ZwRequestWaitReplyPort' 'ZwRequestWakeupLatency' 'NtRequestWakeupLatency' 'NtResetEvent' 'ZwResetEvent' 'ZwResetWriteWatch' 'NtResetWriteWatch' 'ZwRestoreKey' 'NtRestoreKey' 'ZwResumeThread' 'NtResumeThread' 'NtSaveKey' 'ZwSaveKey' 'NtSaveMergedKeys' 'ZwSaveMergedKeys' 'ZwSecureConnectPort' 'NtSecureConnectPort' 'ZwSetIoCompletion' 'NtSetIoCompletion' 'NtSetContextThread' 'ZwSetContextThread' 'ZwSetDefaultHardErrorPort' 'NtSetDefaultHardErrorPort' 'ZwSetDefaultLocale' 'NtSetDefaultLocale' 'ZwSetDefaultUILanguage' 'NtSetDefaultUILanguage' 'ZwSetEaFile' 'NtSetEaFile' 'NtSetEvent' 'ZwSetEvent' 'NtSetHighEventPair' 'ZwSetHighEventPair' 'NtSetHighWaitLowEventPair' 'ZwSetHighWaitLowEventPair' 'NtSetInformationFile' 'ZwSetInformationFile' 'NtSetInformationJobObject' 'ZwSetInformationJobObject' 'ZwSetInformationKey' 'NtSetInformationKey' 'ZwSetInformationObject' 'NtSetInformationObject' 'NtSetInformationProcess' 'ZwSetInformationProcess' 'ZwSetInformationThread' 'NtSetInformationThread' 'NtSetInformationToken' 'ZwSetInformationToken' 'NtSetIntervalProfile' 'ZwSetIntervalProfile' 'ZwSetLdtEntries' 'NtSetLdtEntries' 'NtSetLowEventPair' 'ZwSetLowEventPair' 'ZwSetLowWaitHighEventPair' 'NtSetLowWaitHighEventPair' 'ZwSetQuotaInformationFile' 'NtSetQuotaInformationFile' 'ZwSetSecurityObject' 'NtSetSecurityObject' 'ZwSetSystemEnvironmentValue' 'NtSetSystemEnvironmentValue' 'ZwSetSystemInformation' 'NtSetSystemInformation' 'ZwSetSystemPowerState' 'NtSetSystemPowerState' 'NtSetSystemTime' 'ZwSetSystemTime' 'ZwSetThreadExecutionState' 'NtSetThreadExecutionState' 'NtSetTimer' 'ZwSetTimer' 'NtSetTimerResolution' 'ZwSetTimerResolution' 'NtSetUuidSeed' 'ZwSetUuidSeed' 'NtSetValueKey' 'ZwSetValueKey' 'NtSetVolumeInformationFile' 'ZwSetVolumeInformationFile' 'ZwShutdownSystem' 'NtShutdownSystem' 'NtSignalAndWaitForSingleObject' 'ZwSignalAndWaitForSingleObject' 'NtStartProfile' 'ZwStartProfile' 'ZwStopProfile' 'NtStopProfile' 'ZwSuspendThread' 'NtSuspendThread' 'NtSystemDebugControl' 'ZwSystemDebugControl' 'ZwTerminateJobObject' 'NtTerminateJobObject' 'ZwTerminateProcess' 'NtTerminateProcess' 'ZwTerminateThread' 'NtTerminateThread' 'NtTestAlert' 'ZwTestAlert' 'ZwUnloadDriver' 'NtUnloadDriver' 'NtUnloadKey' 'ZwUnloadKey' 'NtUnlockFile' 'ZwUnlockFile' 'ZwUnlockVirtualMemory' 'NtUnlockVirtualMemory' 'ZwUnmapViewOfSection' 'NtUnmapViewOfSection' 'NtVdmControl' 'ZwVdmControl' 'NtWaitForMultipleObjects' 'ZwWaitForMultipleObjects' 'ZwWaitForSingleObject' 'NtWaitForSingleObject' 'NtWaitHighEventPair' 'ZwWaitHighEventPair' 'ZwWaitLowEventPair' 'NtWaitLowEventPair' 'NtWriteFile' 'ZwWriteFile' 'ZwWriteFileGather' 'NtWriteFileGather' 'NtWriteRequestData' 'ZwWriteRequestData' 'ZwWriteVirtualMemory' 'NtWriteVirtualMemory' 'NtCreateChannel' 'ZwCreateChannel' 'NtListenChannel' 'ZwListenChannel' 'NtOpenChannel' 'ZwOpenChannel' 'ZwReplyWaitSendChannel' 'NtReplyWaitSendChannel' 'ZwSendWaitReplyChannel' 'NtSendWaitReplyChannel' 'NtSetContextChannel' 'ZwSetContextChannel' 'ZwYieldExecution' 'NtYieldExecution' 'RtlGetLongestNtPathLength' 'RtlGetCurrentDirectory_U' 'RtlIsDosDeviceName_U' 'RtlGetFullPathName_U' 'RtlDoesFileExists_U' 'RtlDosSearchPath_U' 'CsrClientConnectToServer' 'CsrNewThread' 'CsrIdentifyAlertableThread' 'CsrSetPriorityClass' 'CsrClientCallServer' 'CsrAllocateCaptureBuffer' 'CsrFreeCaptureBuffer' 'CsrAllocateMessagePointer' 'CsrCaptureMessageBuffer' 'CsrCaptureMessageString' 'CsrCaptureTimeout' 'CsrProbeForWrite' 'CsrProbeForRead' 'DbgSsInitialize' 'DbgSsHandleKmApiMsg' 'DbgUiConnectToDbg' 'DbgUiWaitStateChange' 'DbgUiContinue' 'LdrShutdownProcess' 'LdrShutdownThread' 'LdrQueryImageFileExecutionOptions' 'LdrUnloadDll' 'LdrGetProcedureAddress' 'LdrVerifyImageMatchesChecksum' 'LdrQueryProcessModuleInformation' 'RtlCreateLpcServer' 'RtlShutdownLpcServer' 'RtlImpersonateLpcClient' 'RtlCallbackLpcClient' 'RtlInitializeResource' 'RtlAcquireResourceShared' 'RtlAcquireResourceExclusive' 'RtlReleaseResource' 'RtlConvertSharedToExclusive' 'RtlConvertExclusiveToShared' 'RtlDeleteResource' 'RtlDumpResource' 'RtlEnableEarlyCriticalSectionEventCreation' 'RtlInitializeCriticalSectionAndSpinCount' 'RtlSetCriticalSectionSpinCount' 'RtlDeleteCriticalSection' 'RtlpWaitForCriticalSection' 'RtlpUnWaitCriticalSection' 'RtlCheckForOrphanedCriticalSections' 'RtlSetUnicodeCallouts' = CC0004C2 'RtlNewSecurityObjectEx' 'RtlNewSecurityObject' 'RtlSetSecurityObject' 'RtlSetSecurityObjectEx' 'RtlQuerySecurityObject' 'RtlDeleteSecurityObject' 'RtlNewInstanceSecurityObject' 'RtlNewSecurityGrantedAccess' 'RtlCopySecurityDescriptor' 'RtlCreateAndSetSD' 'RtlCreateUserSecurityObject' 'RtlConvertToAutoInheritSecurityObject' 'RtlDefaultNpAcl' 'RtlConvertUiListToApiList' 'RtlCreateQueryDebugBuffer' 'RtlDestroyQueryDebugBuffer' 'RtlQueryProcessDebugInformation' 'RtlQueryProcessBackTraceInformation' 'RtlQueryProcessHeapInformation' 'RtlQueryProcessLockInformation' 'RtlConvertVariantToProperty' 'RtlConvertPropertyToVariant' 'PropertyLengthAsVariant' 'DbgBreakPoint' = FF8BC3CC 'DbgUserBreakPoint' 'DbgPrint' 'DbgPrintReturnControlC' 'DbgPrompt' 'KiUserApcDispatcher' 'KiUserCallbackDispatcher' 'KiUserExceptionDispatcher' 'KiRaiseUserExceptionDispatcher' 'LdrAccessResource' 'LdrFindEntryForAddress' 'LdrFindResource_U' 'LdrFindResourceDirectory_U' 'LdrEnumResources' 'LdrAlternateResourcesEnabled' 'LdrLoadAlternateResourceModule' 'LdrUnloadAlternateResourceModule' 'LdrFlushAlternateResourceModules' 'LdrProcessRelocationBlock' 'RtlConsoleMultiByteToUnicodeN' 'RtlMultiByteToUnicodeSize' 'RtlUnicodeToMultiByteSize' 'RtlUpcaseUnicodeToMultiByteN' 'RtlUpcaseUnicodeToOemN' 'RtlCustomCPToUnicodeN' 'RtlUnicodeToCustomCPN' 'RtlUpcaseUnicodeToCustomCPN' 'RtlResetRtlTranslations' 'NtCurrentTeb' = CCC300000018A164 'PfxInitialize' 'PfxInsertPrefix' 'PfxRemovePrefix' 'PfxFindPrefix' 'RtlInitializeRXact' 'RtlStartRXact' 'RtlAbortRXact' 'RtlAddAttributeActionToRXact' 'RtlAddActionToRXact' 'RtlApplyRXact' 'RtlApplyRXactNoFlush' 'RtlSelfRelativeToAbsoluteSD' 'RtlMakeSelfRelativeSD' 'RtlAbsoluteToSelfRelativeSD' 'RtlSelfRelativeToAbsoluteSD2' 'RtlCreateAcl' 'RtlValidAcl' 'RtlQueryInformationAcl' 'RtlSetInformationAcl' 'RtlAddAce' 'RtlDeleteAce' 'RtlGetAce' 'RtlAddCompoundAce' 'RtlAddAccessAllowedAce' 'RtlAddAccessAllowedAceEx' 'RtlAddAccessDeniedAce' 'RtlAddAccessDeniedAceEx' 'RtlAddAuditAccessAce' 'RtlAddAuditAccessAceEx' 'RtlAddAccessAllowedObjectAce' 'RtlAddAccessDeniedObjectAce' 'RtlAddAuditAccessObjectAce' 'RtlFirstFreeAce' 'RtlInitializeAtomPackage' 'RtlCreateAtomTable' 'RtlDestroyAtomTable' 'RtlEmptyAtomTable' 'RtlAddAtomToAtomTable' 'RtlLookupAtomInAtomTable' 'RtlDeleteAtomFromAtomTable' 'RtlPinAtomInAtomTable' 'RtlQueryAtomInAtomTable' 'RtlRunEncodeUnicodeString' 'RtlRunDecodeUnicodeString' 'RtlEraseUnicodeString' 'RtlAdjustPrivilege' 'RtlValidSid' 'RtlEqualSid' 'RtlEqualPrefixSid' 'RtlLengthRequiredSid' 'RtlAllocateAndInitializeSid' 'RtlInitializeSid' 'RtlFreeSid' 'RtlIdentifierAuthoritySid' 'RtlSubAuthoritySid' 'RtlSubAuthorityCountSid' = 4C2400424448B 'RtlLengthSid' 'RtlCopySid' 'RtlCopySidAndAttributesArray' 'RtlConvertSidToUnicodeString' 'RtlEqualLuid' 'RtlCopyLuid' 'RtlCopyLuidAndAttributesArray' 'RtlCreateSecurityDescriptor' 'RtlValidSecurityDescriptor' 'RtlLengthSecurityDescriptor' 'RtlSetAttributesSecurityDescriptor' 'RtlGetControlSecurityDescriptor' 'RtlSetControlSecurityDescriptor' 'RtlSetDaclSecurityDescriptor' 'RtlGetDaclSecurityDescriptor' 'RtlSetSaclSecurityDescriptor' 'RtlGetSaclSecurityDescriptor' 'RtlSetOwnerSecurityDescriptor' 'RtlGetOwnerSecurityDescriptor' 'RtlSetGroupSecurityDescriptor' 'RtlGetGroupSecurityDescriptor' 'RtlAreAllAccessesGranted' 'RtlAreAnyAccessesGranted' 'RtlMapGenericMask' 'RtlImpersonateSelf' 'RtlValidRelativeSecurityDescriptor' 'RtlGetSecurityDescriptorRMControl' 'RtlSetSecurityDescriptorRMControl' 'RtlInitializeHandleTable' 'RtlDestroyHandleTable' 'RtlAllocateHandle' 'RtlFreeHandle' 'RtlIsValidHandle' 'RtlIsValidIndexHandle' 'RtlAnsiCharToUnicodeChar' 'RtlUpcaseUnicodeStringToAnsiString' 'RtlUpcaseUnicodeStringToOemString' 'RtlUnicodeStringToCountedOemString' 'RtlUpcaseUnicodeStringToCountedOemString' 'RtlUpcaseUnicodeString' 'RtlDowncaseUnicodeString' 'RtlUpcaseUnicodeChar' 'RtlxUnicodeStringToAnsiSize' 'RtlUnicodeStringToOemSize' 'RtlUnicodeStringToAnsiSize' 'RtlxUnicodeStringToOemSize' 'RtlOemStringToUnicodeSize' 'RtlAnsiStringToUnicodeSize' 'RtlxAnsiStringToUnicodeSize' 'RtlxOemStringToUnicodeSize' 'RtlCompareUnicodeString' 'RtlEqualUnicodeString' 'RtlPrefixUnicodeString' 'RtlCopyUnicodeString' 'RtlAppendUnicodeToString' 'RtlAppendUnicodeStringToString' 'RtlCreateUnicodeString' 'RtlEqualDomainName' 'RtlEqualComputerName' 'RtlIsTextUnicode' 'RtlDnsHostNameToComputerName' 'RtlCopyString' 'RtlUpperChar' 'RtlCompareString' 'RtlEqualString' 'RtlPrefixString' 'RtlCreateUnicodeStringFromAsciiz' 'RtlUpperString' 'RtlAppendAsciizToString' 'RtlAppendStringToString' 'RtlInitializeBitMap' 'RtlClearAllBits' 'RtlSetAllBits' 'RtlFindClearBits' 'RtlFindSetBits' 'RtlFindClearBitsAndSet' 'RtlFindSetBitsAndClear' 'RtlClearBits' 'RtlSetBits' 'RtlFindLongestRunClear' 'RtlNumberOfClearBits' 'RtlNumberOfSetBits' 'RtlAreBitsClear' 'RtlAreBitsSet' 'RtlFindNextForwardRunClear' 'RtlFindLastBackwardRunClear' 'RtlFindMostSignificantBit' 'RtlFindLeastSignificantBit' 'RtlAssert' 'RtlRegisterWait' 'RtlDeregisterWait' 'RtlDeregisterWaitEx' 'RtlQueueWorkItem' 'RtlSetIoCompletionCallback' 'RtlCreateTimerQueue' 'RtlDeleteTimerQueue' 'RtlDeleteTimerQueueEx' 'RtlCreateTimer' 'RtlUpdateTimer' 'RtlDeleteTimer' 'RtlSetThreadPoolStartFunc' 'RtlDebugPrintTimes' 'RtlSetTimer' 'RtlCancelTimer' 'RtlGetCallersAddress' 'RtlCaptureStackBackTrace' 'RtlWalkFrameChain' 'RtlIntegerToChar' 'RtlCharToInteger' 'RtlUnicodeStringToInteger' 'RtlIntegerToUnicodeString' 'RtlLargeIntegerToChar' 'RtlInt64ToUnicodeString' 'RtlQueryRegistryValues' 'RtlWriteRegistryValue' 'RtlCheckRegistryKey' 'RtlCreateRegistryKey' 'RtlDeleteRegistryValue' 'RtlExpandEnvironmentStrings_U' 'RtlGetNtGlobalFlags' 'RtlFormatCurrentUserKeyPath' 'RtlOpenCurrentUser' 'RtlQueryTimeZoneInformation' 'RtlSetTimeZoneInformation' 'RtlProtectHeap' 'RtlReAllocateHeap' 'RtlGetUserInfoHeap' 'RtlSetUserValueHeap' 'RtlSetUserFlagsHeap' 'RtlCreateTagHeap' 'RtlQueryTagHeap' 'RtlExtendHeap' 'RtlCompactHeap' 'RtlValidateHeap' 'RtlValidateProcessHeaps' 'RtlGetProcessHeaps' 'RtlEnumProcessHeaps' 'RtlUsageHeap' 'RtlWalkHeap' 'RtlSetHeapInformation' 'RtlQueryHeapInformation' 'RtlGetCompressionWorkSpaceSize' 'RtlCompressBuffer' 'RtlDecompressBuffer' 'RtlDecompressFragment' 'RtlCreateEnvironment' 'RtlDestroyEnvironment' 'RtlSetCurrentEnvironment' 'RtlQueryEnvironmentVariable_U' 'RtlSetEnvironmentVariable' 'RtlCreateProcessParameters' 'RtlDestroyProcessParameters' 'RtlDeNormalizeProcessParams' 'RtlCreateUserProcess' 'RtlCreateUserThread' 'RtlFreeUserThreadStack' 'RtlTimeToTimeFields' 'RtlCutoverTimeToSystemTime' 'RtlTimeFieldsToTime' 'RtlTimeToElapsedTimeFields' 'RtlTimeToSecondsSince1980' 'RtlSecondsSince1980ToTime' 'RtlTimeToSecondsSince1970' 'RtlSecondsSince1970ToTime' 'RtlSystemTimeToLocalTime' 'RtlLocalTimeToSystemTime' 'RtlSplay' 'RtlDelete' 'RtlDeleteNoSplay' 'RtlSubtreeSuccessor' 'RtlSubtreePredecessor' 'RtlRealSuccessor' 'RtlRealPredecessor' 'RtlInitializeGenericTable' 'RtlInsertElementGenericTable' 'RtlDeleteElementGenericTable' 'RtlLookupElementGenericTable' 'RtlEnumerateGenericTable' 'RtlIsGenericTableEmpty' 'RtlGetElementGenericTable' 'RtlNumberGenericTableElements' 'RtlEnumerateGenericTableWithoutSplaying' 'RtlFindMessage' 'RtlFormatMessage' 'RtlStringFromGUID' 'RtlGUIDFromString' 'RtlGenerate8dot3Name' 'RtlIsNameLegalDOS8Dot3' 'RtlGetNtProductType' 'RtlGetVersion' 'RtlVerifyVersionInfo' 'VerSetConditionMask' 'RtlImageNtHeader' 'RtlImageRvaToSection' 'RtlImageDirectoryEntryToData' 'RtlImageRvaToVa' 'RtlInitString' 'RtlInitAnsiString' 'RtlInitUnicodeString' 'RtlInitializeContext' 'RtlRemoteCall' 'RtlLargeIntegerDivide' 'RtlNtStatusToDosError' 'RtlPcToFileHeader' 'RtlRaiseException' 'RtlRaiseStatus' 'RtlUniform' 'RtlRandom' 'RtlTraceDatabaseCreate' 'RtlTraceDatabaseDestroy' 'RtlTraceDatabaseValidate' 'RtlTraceDatabaseAdd' 'RtlTraceDatabaseFind' 'RtlTraceDatabaseLock' 'RtlTraceDatabaseUnlock' 'RtlTraceDatabaseEnumerate' 'RtlUnwind' 'RtlpNtOpenKey' 'RtlpNtCreateKey' 'RtlpNtQueryValueKey' 'RtlpNtSetValueKey' 'RtlpNtMakeTemporaryKey' 'RtlpNtEnumerateSubKey' '_CIpow' 'pow' 'isalpha' 'isupper' 'islower' 'isdigit' 'isxdigit' 'isspace' 'ispunct' 'isalnum' 'isprint' 'isgraph' 'iscntrl' '__isascii' '__toascii' = C37FE0830424448B '__iscsymf' '__iscsym' '_alldiv' '_allmul' '_alloca_probe' '_chkstk' '_allrem' '_allshl' '_allshr' 'atol' 'atoi' '_atoi64' '_aulldiv' '_aullrem' '_aullshr' '_ftol' '_itoa' '_ltoa' '_ultoa' '_i64toa' '_ui64toa' '_itow' '_ltow' '_ultow' '_i64tow' '_memccpy' '_memicmp' '_snprintf' '_snwprintf' '_splitpath' '_stricmp' '_strcmpi' '_strlwr' '_strnicmp' '_strupr' '_tolower' = C320C0830424448B 'tolower' '_toupper' = C3E0C0830424448B 'toupper' '_vsnprintf' '_wcsicmp' '_wcslwr' '_wcsnicmp' '_wcsupr' '_wtoi' '_wtol' '_wtoi64' 'atan' 'ceil' 'cos' 'fabs' 'floor' 'iswalpha' 'iswlower' 'iswdigit' 'iswxdigit' 'iswspace' 'iswctype' 'labs' 'abs' 'log' 'mbstowcs' 'memchr' 'memcmp' 'memcpy' 'memmove' 'memset' 'qsort' 'sin' 'sprintf' 'sqrt' 'sscanf' 'strcpy' 'strcat' 'strchr' 'strcmp' 'strcspn' 'strlen' 'strncat' 'strncmp' 'strncpy' 'strpbrk' 'strrchr' 'strspn' 'strstr' 'strtol' 'strtoul' 'swprintf' 'tan' 'towlower' 'towupper' 'vsprintf' 'wcscat' 'wcscpy' 'wcschr' 'wcscmp' 'wcscspn' 'wcslen' 'wcsncat' 'wcsncmp' 'wcsncpy' 'wcspbrk' 'wcsrchr' 'wcsspn' 'wcsstr' 'wcstol' 'wcstoul' 'wcstombs' 'RtlUshortByteSwap' 'RtlUlongByteSwap' 'RtlUlonglongByteSwap' 'RtlCompareMemory' 'RtlCompareMemoryUlong' 'RtlFillMemory' 'RtlFillMemoryUlong' 'RtlZeroMemory' 'RtlMoveMemory' 'RtlLargeIntegerAdd' 'RtlEnlargedIntegerMultiply' 'RtlEnlargedUnsignedMultiply' 'RtlEnlargedUnsignedDivide' 'RtlExtendedLargeIntegerDivide' 'RtlExtendedMagicDivide' 'RtlExtendedIntegerMultiply' 'RtlLargeIntegerShiftLeft' 'RtlLargeIntegerShiftRight' 'RtlLargeIntegerArithmeticShift' 'RtlLargeIntegerNegate' 'RtlLargeIntegerSubtract' 'RtlConvertLongToLargeInteger' = 4C2990424448B 'RtlConvertUlongToLargeInteger' '__eFINIT' '__eEmulatorInit' '__eCommonExceptions' 'NPXEMULATORTABLE' '__eFPREM' '__eFPREM1' '__eFSCALE' '__eFPATAN' '__eFYL2X' '__eFYL2XP1' '__eFISUB16' '__eFISUBR16' '__eFIADD16' '__eFISUB32' '__eFISUBR32' '__eFIADD32' '__eFSUB32' '__eFSUBR32' '__eFADD32' '__eFSUB64' '__eFSUBR64' '__eFADD64' '__eFSUBPreg' '__eFSUBreg' = F787 '__eFSUBtop' '__eFSUBRPreg' '__eFSUBRreg' = F787 '__eFSUBRtop' '__eFADDPreg' '__eFADDreg' = F787 '__eFADDtop' '__eFIMUL16' '__eFIMUL32' '__eFMUL32' '__eFMUL64' '__eFMULPreg' '__eFMULreg' = F787 '__eFMULtop' '__eFIDIV16' '__eFIDIVR16' '__eFIDIV32' '__eFIDIVR32' '__eFDIV32' '__eFDIVR32' '__eFDIV64' '__eFDIVR64' '__eFDIVRPreg' '__eFDIVRreg' = F787 '__eFDIVRtop' '__eFDIVPreg' '__eFDIVreg' = F787 '__eFDIVtop' '__eFRNDINT' '__eFLD32' '__eFLD64' '__eFILD16' '__eFILD32' '__eFILD64' '__eFLD80' '__eFSTP' '__eFST' '__eFSTP64' '__eFST64' '__eFSTP32' '__eFST32' '__eFISTP32' '__eFIST32' '__eFISTP16' '__eFIST16' '__eFISTP64' '__eFSTP80' '__eFABS' '__eFCHS' '__eFFREE' '__eFXCH' '__eFICOMP16' '__eFICOM16' '__eFICOMP32' '__eFICOM32' '__eFCOMP32' '__eFCOM32' '__eFCOMP64' '__eFCOM64' '__eFUCOMPP' '__eFUCOMP' '__eFUCOM' '__eFCOMPP' '__eFCOMP' '__eFCOM' '__eFXAM' '__eFTST' '__eFLD1' '__eFLDZ' '__eFLDL2E' '__eFLDLN2' '__eFLDPI' '__eFXTRACT' '__eFCOS' '__eFSIN' '__eFPTAN' '__eF2XM1' '__eFLDCW' '__eFSTCW' '__eFSTSW' '__eFDECSTP' '__eFINCSTP' '__eFSTENV' '__eFSAVE' '__eFRSTOR' '__eFLDENV' '__eGetStatusWord' 'SaveEm87Context' 'RestoreEm87Context' '__eFSQRT' 'RtlCreateHeap' 'RtlAllocateHeap' 'RtlFreeHeap' 'RtlInitializeRangeList' 'RtlAddRange' 'RtlDeleteRange' 'RtlDeleteOwnersRanges' 'RtlCopyRangeList' 'RtlFreeRangeList' 'RtlIsRangeAvailable' 'RtlFindRange' 'RtlGetFirstRange' 'RtlGetNextRange' 'RtlMergeRangeLists' 'RtlInvertRangeList' 'RtlDestroyHeap' 'RtlSizeHeap' 'RtlZeroHeap' '_fltused' 'NlsMbCodePageTag' = 0 'NlsMbOemCodePageTag' 'NlsAnsiCodePage'