1// Copyright (c) 2009 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5// This table is a dump of system call numbers -> function names on an XP
6// system.  These numbers change between kernel versions, so it's likely they
7// will have to be regenerated for your system.  See the idarub script.
8
9// Define a global map used for resolving a syscall number to name.
10// Call CreateSyscallMap() to create a return a std::map<int, const char*>
11// which maps from a system call number to its function name.
12
13#ifndef TRACELINE_SYSCALL_MAP_H_
14#define TRACELINE_SYSCALL_MAP_H_
15
16#include <map>
17
18// TODO(deanm): Right now these tables are manually extracted and hardcoded
19// here.  It would be great (but possibly difficult) to do it on startup.  We
20// should at least checksum the DLLs to make sure they match.
21
22std::map<int, const char*> CreateSyscallMap() {
23  std::map<int, const char*> table;
24if (1) {  // XP table.
25  table[0] = "ntdll.dll!NtAcceptConnectPort";
26  table[1] = "ntdll.dll!NtAccessCheck";
27  table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm";
28  table[3] = "ntdll.dll!NtAccessCheckByType";
29  table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm";
30  table[5] = "ntdll.dll!NtAccessCheckByTypeResultList";
31  table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm";
32  table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle";
33  table[8] = "ntdll.dll!NtAddAtom";
34  table[9] = "ntdll.dll!ZwAddBootEntry";
35  table[10] = "ntdll.dll!ZwAdjustGroupsToken";
36  table[11] = "ntdll.dll!ZwAdjustPrivilegesToken";
37  table[12] = "ntdll.dll!NtAlertResumeThread";
38  table[13] = "ntdll.dll!NtAlertThread";
39  table[14] = "ntdll.dll!ZwAllocateLocallyUniqueId";
40  table[15] = "ntdll.dll!NtAllocateUserPhysicalPages";
41  table[16] = "ntdll.dll!NtAllocateUuids";
42  table[17] = "ntdll.dll!NtAllocateVirtualMemory";
43  table[18] = "ntdll.dll!ZwAreMappedFilesTheSame";
44  table[19] = "ntdll.dll!ZwAssignProcessToJobObject";
45  table[20] = "ntdll.dll!ZwCallbackReturn";
46  table[21] = "ntdll.dll!NtCancelDeviceWakeupRequest";
47  table[22] = "ntdll.dll!ZwCancelIoFile";
48  table[23] = "ntdll.dll!ZwCancelTimer";
49  table[24] = "ntdll.dll!NtClearEvent";
50  table[25] = "ntdll.dll!NtClose";
51  table[26] = "ntdll.dll!ZwCloseObjectAuditAlarm";
52  table[27] = "ntdll.dll!NtCompactKeys";
53  table[28] = "ntdll.dll!ZwCompareTokens";
54  table[29] = "ntdll.dll!NtCompleteConnectPort";
55  table[30] = "ntdll.dll!ZwCompressKey";
56  table[31] = "ntdll.dll!NtConnectPort";
57  table[32] = "ntdll.dll!ZwContinue";
58  table[33] = "ntdll.dll!ZwCreateDebugObject";
59  table[34] = "ntdll.dll!ZwCreateDirectoryObject";
60  table[35] = "ntdll.dll!NtCreateEvent";
61  table[36] = "ntdll.dll!NtCreateEventPair";
62  table[37] = "ntdll.dll!NtCreateFile";
63  table[38] = "ntdll.dll!NtCreateIoCompletion";
64  table[39] = "ntdll.dll!ZwCreateJobObject";
65  table[40] = "ntdll.dll!NtCreateJobSet";
66  table[41] = "ntdll.dll!ZwCreateKey";
67  table[42] = "ntdll.dll!ZwCreateMailslotFile";
68  table[43] = "ntdll.dll!ZwCreateMutant";
69  table[44] = "ntdll.dll!ZwCreateNamedPipeFile";
70  table[45] = "ntdll.dll!NtCreatePagingFile";
71  table[46] = "ntdll.dll!ZwCreatePort";
72  table[47] = "ntdll.dll!ZwCreateProcess";
73  table[48] = "ntdll.dll!ZwCreateProcessEx";
74  table[49] = "ntdll.dll!ZwCreateProfile";
75  table[50] = "ntdll.dll!NtCreateSection";
76  table[51] = "ntdll.dll!NtCreateSemaphore";
77  table[52] = "ntdll.dll!ZwCreateSymbolicLinkObject";
78  table[53] = "ntdll.dll!NtCreateThread";
79  table[54] = "ntdll.dll!ZwCreateTimer";
80  table[55] = "ntdll.dll!NtCreateToken";
81  table[56] = "ntdll.dll!ZwCreateWaitablePort";
82  table[57] = "ntdll.dll!NtDebugActiveProcess";
83  table[58] = "ntdll.dll!ZwDebugContinue";
84  table[59] = "ntdll.dll!ZwDelayExecution";
85  table[60] = "ntdll.dll!ZwDeleteAtom";
86  table[61] = "ntdll.dll!NtDeleteBootEntry";
87  table[62] = "ntdll.dll!NtDeleteFile";
88  table[63] = "ntdll.dll!ZwDeleteKey";
89  table[64] = "ntdll.dll!NtDeleteObjectAuditAlarm";
90  table[65] = "ntdll.dll!NtDeleteValueKey";
91  table[66] = "ntdll.dll!ZwDeviceIoControlFile";
92  table[67] = "ntdll.dll!NtDisplayString";
93  table[68] = "ntdll.dll!ZwDuplicateObject";
94  table[69] = "ntdll.dll!NtDuplicateToken";
95  table[70] = "ntdll.dll!ZwEnumerateBootEntries";
96  table[71] = "ntdll.dll!ZwEnumerateKey";
97  table[72] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx";
98  table[73] = "ntdll.dll!NtEnumerateValueKey";
99  table[74] = "ntdll.dll!ZwExtendSection";
100  table[75] = "ntdll.dll!NtFilterToken";
101  table[76] = "ntdll.dll!NtFindAtom";
102  table[77] = "ntdll.dll!ZwFlushBuffersFile";
103  table[78] = "ntdll.dll!ZwFlushInstructionCache";
104  table[79] = "ntdll.dll!NtFlushKey";
105  table[80] = "ntdll.dll!ZwFlushVirtualMemory";
106  table[81] = "ntdll.dll!NtFlushWriteBuffer";
107  table[82] = "ntdll.dll!NtFreeUserPhysicalPages";
108  table[83] = "ntdll.dll!NtFreeVirtualMemory";
109  table[84] = "ntdll.dll!NtFsControlFile";
110  table[85] = "ntdll.dll!NtGetContextThread";
111  table[86] = "ntdll.dll!NtGetDevicePowerState";
112  table[87] = "ntdll.dll!ZwGetPlugPlayEvent";
113  table[88] = "ntdll.dll!NtGetWriteWatch";
114  table[89] = "ntdll.dll!NtImpersonateAnonymousToken";
115  table[90] = "ntdll.dll!ZwImpersonateClientOfPort";
116  table[91] = "ntdll.dll!ZwImpersonateThread";
117  table[92] = "ntdll.dll!ZwInitializeRegistry";
118  table[93] = "ntdll.dll!NtInitiatePowerAction";
119  table[94] = "ntdll.dll!ZwIsProcessInJob";
120  table[95] = "ntdll.dll!NtIsSystemResumeAutomatic";
121  table[96] = "ntdll.dll!ZwListenPort";
122  table[97] = "ntdll.dll!NtLoadDriver";
123  table[98] = "ntdll.dll!NtLoadKey";
124  table[99] = "ntdll.dll!NtLoadKey2";
125  table[100] = "ntdll.dll!NtLockFile";
126  table[101] = "ntdll.dll!ZwLockProductActivationKeys";
127  table[102] = "ntdll.dll!NtLockRegistryKey";
128  table[103] = "ntdll.dll!ZwLockVirtualMemory";
129  table[104] = "ntdll.dll!ZwMakePermanentObject";
130  table[105] = "ntdll.dll!NtMakeTemporaryObject";
131  table[106] = "ntdll.dll!NtMapUserPhysicalPages";
132  table[107] = "ntdll.dll!ZwMapUserPhysicalPagesScatter";
133  table[108] = "ntdll.dll!ZwMapViewOfSection";
134  table[109] = "ntdll.dll!NtModifyBootEntry";
135  table[110] = "ntdll.dll!NtNotifyChangeDirectoryFile";
136  table[111] = "ntdll.dll!NtNotifyChangeKey";
137  table[112] = "ntdll.dll!NtNotifyChangeMultipleKeys";
138  table[113] = "ntdll.dll!ZwOpenDirectoryObject";
139  table[114] = "ntdll.dll!NtOpenEvent";
140  table[115] = "ntdll.dll!NtOpenEventPair";
141  table[116] = "ntdll.dll!NtOpenFile";
142  table[117] = "ntdll.dll!ZwOpenIoCompletion";
143  table[118] = "ntdll.dll!ZwOpenJobObject";
144  table[119] = "ntdll.dll!ZwOpenKey";
145  table[120] = "ntdll.dll!NtOpenMutant";
146  table[121] = "ntdll.dll!ZwOpenObjectAuditAlarm";
147  table[122] = "ntdll.dll!ZwOpenProcess";
148  table[123] = "ntdll.dll!ZwOpenProcessToken";
149  table[124] = "ntdll.dll!ZwOpenProcessTokenEx";
150  table[125] = "ntdll.dll!NtOpenSection";
151  table[126] = "ntdll.dll!NtOpenSemaphore";
152  table[127] = "ntdll.dll!NtOpenSymbolicLinkObject";
153  table[128] = "ntdll.dll!ZwOpenThread";
154  table[129] = "ntdll.dll!NtOpenThreadToken";
155  table[130] = "ntdll.dll!NtOpenThreadTokenEx";
156  table[131] = "ntdll.dll!ZwOpenTimer";
157  table[132] = "ntdll.dll!NtPlugPlayControl";
158  table[133] = "ntdll.dll!ZwPowerInformation";
159  table[134] = "ntdll.dll!ZwPrivilegeCheck";
160  table[135] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm";
161  table[136] = "ntdll.dll!NtPrivilegedServiceAuditAlarm";
162  table[137] = "ntdll.dll!ZwProtectVirtualMemory";
163  table[138] = "ntdll.dll!ZwPulseEvent";
164  table[139] = "ntdll.dll!ZwQueryAttributesFile";
165  table[140] = "ntdll.dll!ZwQueryBootEntryOrder";
166  table[141] = "ntdll.dll!ZwQueryBootOptions";
167  table[142] = "ntdll.dll!NtQueryDebugFilterState";
168  table[143] = "ntdll.dll!NtQueryDefaultLocale";
169  table[144] = "ntdll.dll!ZwQueryDefaultUILanguage";
170  table[145] = "ntdll.dll!ZwQueryDirectoryFile";
171  table[146] = "ntdll.dll!ZwQueryDirectoryObject";
172  table[147] = "ntdll.dll!ZwQueryEaFile";
173  table[148] = "ntdll.dll!NtQueryEvent";
174  table[149] = "ntdll.dll!ZwQueryFullAttributesFile";
175  table[150] = "ntdll.dll!NtQueryInformationAtom";
176  table[151] = "ntdll.dll!ZwQueryInformationFile";
177  table[152] = "ntdll.dll!ZwQueryInformationJobObject";
178  table[153] = "ntdll.dll!ZwQueryInformationPort";
179  table[154] = "ntdll.dll!ZwQueryInformationProcess";
180  table[155] = "ntdll.dll!NtQueryInformationThread";
181  table[156] = "ntdll.dll!ZwQueryInformationToken";
182  table[157] = "ntdll.dll!NtQueryInstallUILanguage";
183  table[158] = "ntdll.dll!NtQueryIntervalProfile";
184  table[159] = "ntdll.dll!NtQueryIoCompletion";
185  table[160] = "ntdll.dll!ZwQueryKey";
186  table[161] = "ntdll.dll!NtQueryMultipleValueKey";
187  table[162] = "ntdll.dll!NtQueryMutant";
188  table[163] = "ntdll.dll!NtQueryObject";
189  table[164] = "ntdll.dll!NtQueryOpenSubKeys";
190  table[165] = "ntdll.dll!NtQueryPerformanceCounter";
191  table[166] = "ntdll.dll!ZwQueryQuotaInformationFile";
192  table[167] = "ntdll.dll!ZwQuerySection";
193  table[168] = "ntdll.dll!NtQuerySecurityObject";
194  table[169] = "ntdll.dll!ZwQuerySemaphore";
195  table[170] = "ntdll.dll!ZwQuerySymbolicLinkObject";
196  table[171] = "ntdll.dll!ZwQuerySystemEnvironmentValue";
197  table[172] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx";
198  table[173] = "ntdll.dll!NtQuerySystemInformation";
199  table[174] = "ntdll.dll!NtQuerySystemTime";
200  table[175] = "ntdll.dll!ZwQueryTimer";
201  table[176] = "ntdll.dll!NtQueryTimerResolution";
202  table[177] = "ntdll.dll!ZwQueryValueKey";
203  table[178] = "ntdll.dll!NtQueryVirtualMemory";
204  table[179] = "ntdll.dll!NtQueryVolumeInformationFile";
205  table[180] = "ntdll.dll!NtQueueApcThread";
206  table[181] = "ntdll.dll!ZwRaiseException";
207  table[182] = "ntdll.dll!ZwRaiseHardError";
208  table[183] = "ntdll.dll!NtReadFile";
209  table[184] = "ntdll.dll!NtReadFileScatter";
210  table[185] = "ntdll.dll!ZwReadRequestData";
211  table[186] = "ntdll.dll!NtReadVirtualMemory";
212  table[187] = "ntdll.dll!ZwRegisterThreadTerminatePort";
213  table[188] = "ntdll.dll!ZwReleaseMutant";
214  table[189] = "ntdll.dll!NtReleaseSemaphore";
215  table[190] = "ntdll.dll!ZwRemoveIoCompletion";
216  table[191] = "ntdll.dll!ZwRemoveProcessDebug";
217  table[192] = "ntdll.dll!ZwRenameKey";
218  table[193] = "ntdll.dll!ZwReplaceKey";
219  table[194] = "ntdll.dll!ZwReplyPort";
220  table[195] = "ntdll.dll!NtReplyWaitReceivePort";
221  table[196] = "ntdll.dll!NtReplyWaitReceivePortEx";
222  table[197] = "ntdll.dll!NtReplyWaitReplyPort";
223  table[198] = "ntdll.dll!ZwRequestDeviceWakeup";
224  table[199] = "ntdll.dll!ZwRequestPort";
225  table[200] = "ntdll.dll!NtRequestWaitReplyPort";
226  table[201] = "ntdll.dll!ZwRequestWakeupLatency";
227  table[202] = "ntdll.dll!NtResetEvent";
228  table[203] = "ntdll.dll!ZwResetWriteWatch";
229  table[204] = "ntdll.dll!NtRestoreKey";
230  table[205] = "ntdll.dll!ZwResumeProcess";
231  table[206] = "ntdll.dll!ZwResumeThread";
232  table[207] = "ntdll.dll!NtSaveKey";
233  table[208] = "ntdll.dll!NtSaveKeyEx";
234  table[209] = "ntdll.dll!NtSaveMergedKeys";
235  table[210] = "ntdll.dll!NtSecureConnectPort";
236  table[211] = "ntdll.dll!ZwSetBootEntryOrder";
237  table[212] = "ntdll.dll!ZwSetBootOptions";
238  table[213] = "ntdll.dll!ZwSetContextThread";
239  table[214] = "ntdll.dll!NtSetDebugFilterState";
240  table[215] = "ntdll.dll!NtSetDefaultHardErrorPort";
241  table[216] = "ntdll.dll!NtSetDefaultLocale";
242  table[217] = "ntdll.dll!ZwSetDefaultUILanguage";
243  table[218] = "ntdll.dll!ZwSetEaFile";
244  table[219] = "ntdll.dll!NtSetEvent";
245  table[220] = "ntdll.dll!NtSetEventBoostPriority";
246  table[221] = "ntdll.dll!NtSetHighEventPair";
247  table[222] = "ntdll.dll!NtSetHighWaitLowEventPair";
248  table[223] = "ntdll.dll!ZwSetInformationDebugObject";
249  table[224] = "ntdll.dll!ZwSetInformationFile";
250  table[225] = "ntdll.dll!ZwSetInformationJobObject";
251  table[226] = "ntdll.dll!ZwSetInformationKey";
252  table[227] = "ntdll.dll!ZwSetInformationObject";
253  table[228] = "ntdll.dll!ZwSetInformationProcess";
254  table[229] = "ntdll.dll!ZwSetInformationThread";
255  table[230] = "ntdll.dll!ZwSetInformationToken";
256  table[231] = "ntdll.dll!NtSetIntervalProfile";
257  table[232] = "ntdll.dll!NtSetIoCompletion";
258  table[233] = "ntdll.dll!ZwSetLdtEntries";
259  table[234] = "ntdll.dll!ZwSetLowEventPair";
260  table[235] = "ntdll.dll!ZwSetLowWaitHighEventPair";
261  table[236] = "ntdll.dll!ZwSetQuotaInformationFile";
262  table[237] = "ntdll.dll!NtSetSecurityObject";
263  table[238] = "ntdll.dll!ZwSetSystemEnvironmentValue";
264  table[239] = "ntdll.dll!ZwSetSystemEnvironmentValueEx";
265  table[240] = "ntdll.dll!ZwSetSystemInformation";
266  table[241] = "ntdll.dll!ZwSetSystemPowerState";
267  table[242] = "ntdll.dll!ZwSetSystemTime";
268  table[243] = "ntdll.dll!ZwSetThreadExecutionState";
269  table[244] = "ntdll.dll!ZwSetTimer";
270  table[245] = "ntdll.dll!NtSetTimerResolution";
271  table[246] = "ntdll.dll!ZwSetUuidSeed";
272  table[247] = "ntdll.dll!ZwSetValueKey";
273  table[248] = "ntdll.dll!NtSetVolumeInformationFile";
274  table[249] = "ntdll.dll!ZwShutdownSystem";
275  table[250] = "ntdll.dll!ZwSignalAndWaitForSingleObject";
276  table[251] = "ntdll.dll!NtStartProfile";
277  table[252] = "ntdll.dll!ZwStopProfile";
278  table[253] = "ntdll.dll!ZwSuspendProcess";
279  table[254] = "ntdll.dll!ZwSuspendThread";
280  table[255] = "ntdll.dll!NtSystemDebugControl";
281  table[256] = "ntdll.dll!ZwTerminateJobObject";
282  table[257] = "ntdll.dll!ZwTerminateProcess";
283  table[258] = "ntdll.dll!ZwTerminateThread";
284  table[259] = "ntdll.dll!NtTestAlert";
285  table[260] = "ntdll.dll!NtTraceEvent";
286  table[261] = "ntdll.dll!NtTranslateFilePath";
287  table[262] = "ntdll.dll!ZwUnloadDriver";
288  table[263] = "ntdll.dll!NtUnloadKey";
289  table[264] = "ntdll.dll!ZwUnloadKeyEx";
290  table[265] = "ntdll.dll!ZwUnlockFile";
291  table[266] = "ntdll.dll!NtUnlockVirtualMemory";
292  table[267] = "ntdll.dll!NtUnmapViewOfSection";
293  table[268] = "ntdll.dll!NtVdmControl";
294  table[269] = "ntdll.dll!NtWaitForDebugEvent";
295  table[270] = "ntdll.dll!NtWaitForMultipleObjects";
296  table[271] = "ntdll.dll!ZwWaitForSingleObject";
297  table[272] = "ntdll.dll!ZwWaitHighEventPair";
298  table[273] = "ntdll.dll!NtWaitLowEventPair";
299  table[274] = "ntdll.dll!NtWriteFile";
300  table[275] = "ntdll.dll!NtWriteFileGather";
301  table[276] = "ntdll.dll!NtWriteRequestData";
302  table[277] = "ntdll.dll!NtWriteVirtualMemory";
303  table[278] = "ntdll.dll!ZwYieldExecution";
304  table[279] = "ntdll.dll!ZwCreateKeyedEvent";
305  table[280] = "ntdll.dll!NtOpenKeyedEvent";
306  table[281] = "ntdll.dll!NtReleaseKeyedEvent";
307  table[282] = "ntdll.dll!NtWaitForKeyedEvent";
308  table[283] = "ntdll.dll!ZwQueryPortInformationProcess";
309  table[4096] = "gdi32.dll!NtGdiAbortDoc";
310  table[4097] = "gdi32.dll!NtGdiAbortPath";
311  table[4098] = "gdi32.dll!NtGdiAddFontResourceW";
312  table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC";
313  table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx";
314  table[4101] = "gdi32.dll!NtGdiRemoveMergeFont";
315  table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC";
316  table[4103] = "gdi32.dll!NtGdiAlphaBlend";
317  table[4104] = "gdi32.dll!NtGdiAngleArc";
318  table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts";
319  table[4106] = "gdi32.dll!NtGdiFontIsLinked";
320  table[4107] = "gdi32.dll!NtGdiArcInternal";
321  table[4108] = "gdi32.dll!NtGdiBeginPath";
322  table[4109] = "gdi32.dll!NtGdiBitBlt";
323  table[4110] = "gdi32.dll!NtGdiCancelDC";
324  table[4111] = "gdi32.dll!NtGdiCheckBitmapBits";
325  table[4112] = "gdi32.dll!NtGdiCloseFigure";
326  table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes";
327  table[4114] = "gdi32.dll!NtGdiClearBrushAttributes";
328  table[4115] = "gdi32.dll!NtGdiColorCorrectPalette";
329  table[4116] = "gdi32.dll!NtGdiCombineRgn";
330  table[4117] = "gdi32.dll!CombineTransform";
331  table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients";
332  table[4119] = "gdi32.dll!NtGdiConsoleTextOut";
333  table[4120] = "gdi32.dll!NtGdiConvertMetafileRect";
334  table[4121] = "gdi32.dll!NtGdiCreateBitmap";
335  table[4122] = "gdi32.dll!NtGdiCreateClientObj";
336  table[4123] = "gdi32.dll!NtGdiCreateColorSpace";
337  table[4124] = "gdi32.dll!NtGdiCreateColorTransform";
338  table[4125] = "gdi32.dll!NtGdiCreateCompatibleBitmap";
339  table[4126] = "gdi32.dll!NtGdiCreateCompatibleDC";
340  table[4127] = "gdi32.dll!NtGdiCreateDIBBrush";
341  table[4128] = "gdi32.dll!NtGdiCreateDIBitmapInternal";
342  table[4129] = "gdi32.dll!NtGdiCreateDIBSection";
343  table[4130] = "gdi32.dll!NtGdiCreateEllipticRgn";
344  table[4131] = "gdi32.dll!NtGdiCreateHalftonePalette";
345  table[4132] = "gdi32.dll!NtGdiCreateHatchBrushInternal";
346  table[4133] = "gdi32.dll!NtGdiCreateMetafileDC";
347  table[4134] = "gdi32.dll!NtGdiCreatePaletteInternal";
348  table[4135] = "gdi32.dll!NtGdiCreatePatternBrushInternal";
349  table[4136] = "gdi32.dll!CreatePen";
350  table[4137] = "gdi32.dll!NtGdiCreateRectRgn";
351  table[4138] = "gdi32.dll!CreateRoundRectRgn";
352  table[4139] = "gdi32.dll!NtGdiCreateServerMetaFile";
353  table[4140] = "gdi32.dll!NtGdiCreateSolidBrush";
354  table[4141] = "gdi32.dll!NtGdiD3dContextCreate";
355  table[4142] = "gdi32.dll!NtGdiD3dContextDestroy";
356  table[4143] = "gdi32.dll!NtGdiD3dContextDestroyAll";
357  table[4144] = "gdi32.dll!NtGdiD3dValidateTextureStageState";
358  table[4145] = "gdi32.dll!NtGdiD3dDrawPrimitives2";
359  table[4146] = "gdi32.dll!NtGdiDdGetDriverState";
360  table[4147] = "gdi32.dll!NtGdiDdAddAttachedSurface";
361  table[4148] = "gdi32.dll!NtGdiDdAlphaBlt";
362  table[4149] = "gdi32.dll!NtGdiDdAttachSurface";
363  table[4150] = "gdi32.dll!NtGdiDdBeginMoCompFrame";
364  table[4151] = "gdi32.dll!NtGdiDdBlt";
365  table[4152] = "gdi32.dll!NtGdiDdCanCreateSurface";
366  table[4153] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer";
367  table[4154] = "gdi32.dll!NtGdiDdColorControl";
368  table[4155] = "gdi32.dll!NtGdiDdCreateDirectDrawObject";
369  table[4156] = "gdi32.dll!NtGdiDdCreateSurface";
370  table[4157] = "gdi32.dll!NtGdiDdCreateD3DBuffer";
371  table[4158] = "gdi32.dll!NtGdiDdCreateMoComp";
372  table[4159] = "gdi32.dll!NtGdiDdCreateSurfaceObject";
373  table[4160] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject";
374  table[4161] = "gdi32.dll!NtGdiDdDeleteSurfaceObject";
375  table[4162] = "gdi32.dll!NtGdiDdDestroyMoComp";
376  table[4163] = "gdi32.dll!NtGdiDdDestroySurface";
377  table[4164] = "gdi32.dll!NtGdiDdDestroyD3DBuffer";
378  table[4165] = "gdi32.dll!NtGdiDdEndMoCompFrame";
379  table[4166] = "gdi32.dll!NtGdiDdFlip";
380  table[4167] = "gdi32.dll!NtGdiDdFlipToGDISurface";
381  table[4168] = "gdi32.dll!NtGdiDdGetAvailDriverMemory";
382  table[4169] = "gdi32.dll!NtGdiDdGetBltStatus";
383  table[4170] = "gdi32.dll!NtGdiDdGetDC";
384  table[4171] = "gdi32.dll!NtGdiDdGetDriverInfo";
385  table[4172] = "gdi32.dll!NtGdiDdGetDxHandle";
386  table[4173] = "gdi32.dll!NtGdiDdGetFlipStatus";
387  table[4174] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo";
388  table[4175] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo";
389  table[4176] = "gdi32.dll!NtGdiDdGetMoCompGuids";
390  table[4177] = "gdi32.dll!NtGdiDdGetMoCompFormats";
391  table[4178] = "gdi32.dll!NtGdiDdGetScanLine";
392  table[4179] = "gdi32.dll!NtGdiDdLock";
393  table[4180] = "gdi32.dll!NtGdiDdLockD3D";
394  table[4181] = "gdi32.dll!NtGdiDdQueryDirectDrawObject";
395  table[4182] = "gdi32.dll!NtGdiDdQueryMoCompStatus";
396  table[4183] = "gdi32.dll!NtGdiDdReenableDirectDrawObject";
397  table[4184] = "gdi32.dll!NtGdiDdReleaseDC";
398  table[4185] = "gdi32.dll!NtGdiDdRenderMoComp";
399  table[4186] = "gdi32.dll!NtGdiDdResetVisrgn";
400  table[4187] = "gdi32.dll!NtGdiDdSetColorKey";
401  table[4188] = "gdi32.dll!NtGdiDdSetExclusiveMode";
402  table[4189] = "gdi32.dll!NtGdiDdSetGammaRamp";
403  table[4190] = "gdi32.dll!NtGdiDdCreateSurfaceEx";
404  table[4191] = "gdi32.dll!NtGdiDdSetOverlayPosition";
405  table[4192] = "gdi32.dll!NtGdiDdUnattachSurface";
406  table[4193] = "gdi32.dll!NtGdiDdUnlock";
407  table[4194] = "gdi32.dll!NtGdiDdUnlockD3D";
408  table[4195] = "gdi32.dll!NtGdiDdUpdateOverlay";
409  table[4196] = "gdi32.dll!NtGdiDdWaitForVerticalBlank";
410  table[4197] = "gdi32.dll!NtGdiDvpCanCreateVideoPort";
411  table[4198] = "gdi32.dll!NtGdiDvpColorControl";
412  table[4199] = "gdi32.dll!NtGdiDvpCreateVideoPort";
413  table[4200] = "gdi32.dll!NtGdiDvpDestroyVideoPort";
414  table[4201] = "gdi32.dll!NtGdiDvpFlipVideoPort";
415  table[4202] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth";
416  table[4203] = "gdi32.dll!NtGdiDvpGetVideoPortField";
417  table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus";
418  table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats";
419  table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortLine";
420  table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats";
421  table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo";
422  table[4209] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus";
423  table[4210] = "gdi32.dll!NtGdiDvpUpdateVideoPort";
424  table[4211] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync";
425  table[4212] = "gdi32.dll!NtGdiDvpAcquireNotification";
426  table[4213] = "gdi32.dll!NtGdiDvpReleaseNotification";
427  table[4214] = "gdi32.dll!NtGdiDxgGenericThunk";
428  table[4215] = "gdi32.dll!NtGdiDeleteClientObj";
429  table[4216] = "gdi32.dll!NtGdiDeleteColorSpace";
430  table[4217] = "gdi32.dll!NtGdiDeleteColorTransform";
431  table[4218] = "gdi32.dll!DeleteObject";
432  table[4219] = "gdi32.dll!NtGdiDescribePixelFormat";
433  table[4220] = "gdi32.dll!NtGdiGetPerBandInfo";
434  table[4221] = "gdi32.dll!NtGdiDoBanding";
435  table[4222] = "gdi32.dll!NtGdiDoPalette";
436  table[4223] = "gdi32.dll!NtGdiDrawEscape";
437  table[4224] = "gdi32.dll!NtGdiEllipse";
438  table[4225] = "gdi32.dll!NtGdiEnableEudc";
439  table[4226] = "gdi32.dll!NtGdiEndDoc";
440  table[4227] = "gdi32.dll!NtGdiEndPage";
441  table[4228] = "gdi32.dll!NtGdiEndPath";
442  table[4229] = "gdi32.dll!NtGdiEnumFontChunk";
443  table[4230] = "gdi32.dll!NtGdiEnumFontClose";
444  table[4231] = "gdi32.dll!NtGdiEnumFontOpen";
445  table[4232] = "gdi32.dll!NtGdiEnumObjects";
446  table[4233] = "gdi32.dll!NtGdiEqualRgn";
447  table[4234] = "gdi32.dll!NtGdiEudcLoadUnloadLink";
448  table[4235] = "gdi32.dll!NtGdiExcludeClipRect";
449  table[4236] = "gdi32.dll!NtGdiExtCreatePen";
450  table[4237] = "gdi32.dll!NtGdiExtCreateRegion";
451  table[4238] = "gdi32.dll!NtGdiExtEscape";
452  table[4239] = "gdi32.dll!NtGdiExtFloodFill";
453  table[4240] = "gdi32.dll!NtGdiExtGetObjectW";
454  table[4241] = "gdi32.dll!ExtSelectClipRgn";
455  table[4242] = "gdi32.dll!NtGdiExtTextOutW";
456  table[4243] = "gdi32.dll!NtGdiFillPath";
457  table[4244] = "gdi32.dll!NtGdiFillRgn";
458  table[4245] = "gdi32.dll!NtGdiFlattenPath";
459  table[4247] = "gdi32.dll!NtGdiFlush";
460  table[4248] = "gdi32.dll!NtGdiForceUFIMapping";
461  table[4249] = "gdi32.dll!NtGdiFrameRgn";
462  table[4250] = "gdi32.dll!NtGdiFullscreenControl";
463  table[4251] = "gdi32.dll!NtGdiGetAndSetDCDword";
464  table[4252] = "gdi32.dll!GetClipBox";
465  table[4253] = "gdi32.dll!GetBitmapBits";
466  table[4254] = "gdi32.dll!NtGdiGetBitmapDimension";
467  table[4255] = "gdi32.dll!NtGdiGetBoundsRect";
468  table[4256] = "gdi32.dll!NtGdiGetCharABCWidthsW";
469  table[4257] = "gdi32.dll!NtGdiGetCharacterPlacementW";
470  table[4258] = "gdi32.dll!NtGdiGetCharSet";
471  table[4259] = "gdi32.dll!NtGdiGetCharWidthW";
472  table[4260] = "gdi32.dll!NtGdiGetCharWidthInfo";
473  table[4261] = "gdi32.dll!NtGdiGetColorAdjustment";
474  table[4263] = "gdi32.dll!NtGdiGetDCDword";
475  table[4264] = "gdi32.dll!NtGdiGetDCforBitmap";
476  table[4265] = "gdi32.dll!NtGdiGetDCObject";
477  table[4266] = "gdi32.dll!NtGdiGetDCPoint";
478  table[4267] = "gdi32.dll!NtGdiGetDeviceCaps";
479  table[4268] = "gdi32.dll!NtGdiGetDeviceGammaRamp";
480  table[4269] = "gdi32.dll!NtGdiGetDeviceCapsAll";
481  table[4270] = "gdi32.dll!NtGdiGetDIBitsInternal";
482  table[4271] = "gdi32.dll!NtGdiGetETM";
483  table[4272] = "gdi32.dll!NtGdiGetEudcTimeStampEx";
484  table[4273] = "gdi32.dll!GetFontData";
485  table[4274] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW";
486  table[4275] = "gdi32.dll!NtGdiGetGlyphIndicesW";
487  table[4276] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal";
488  table[4277] = "gdi32.dll!NtGdiGetGlyphOutline";
489  table[4278] = "gdi32.dll!NtGdiGetKerningPairs";
490  table[4279] = "gdi32.dll!NtGdiGetLinkedUFIs";
491  table[4280] = "gdi32.dll!GetMiterLimit";
492  table[4281] = "gdi32.dll!NtGdiGetMonitorID";
493  table[4282] = "gdi32.dll!GetNearestColor";
494  table[4283] = "gdi32.dll!NtGdiGetNearestPaletteIndex";
495  table[4284] = "gdi32.dll!NtGdiGetObjectBitmapHandle";
496  table[4285] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW";
497  table[4286] = "gdi32.dll!NtGdiGetPath";
498  table[4287] = "gdi32.dll!NtGdiGetPixel";
499  table[4288] = "gdi32.dll!NtGdiGetRandomRgn";
500  table[4289] = "gdi32.dll!GetRasterizerCaps";
501  table[4290] = "gdi32.dll!NtGdiGetRealizationInfo";
502  table[4291] = "gdi32.dll!GetRegionData";
503  table[4292] = "gdi32.dll!NtGdiGetRgnBox";
504  table[4293] = "gdi32.dll!NtGdiGetServerMetaFileBits";
505  table[4294] = "gdi32.dll!NtGdiGetSpoolMessage";
506  table[4296] = "gdi32.dll!NtGdiGetStockObject";
507  table[4297] = "gdi32.dll!NtGdiGetStringBitmapW";
508  table[4298] = "gdi32.dll!GetSystemPaletteUse";
509  table[4299] = "gdi32.dll!NtGdiGetTextCharsetInfo";
510  table[4300] = "gdi32.dll!NtGdiGetTextExtent";
511  table[4301] = "gdi32.dll!NtGdiGetTextExtentExW";
512  table[4302] = "gdi32.dll!NtGdiGetTextFaceW";
513  table[4303] = "gdi32.dll!NtGdiGetTextMetricsW";
514  table[4304] = "gdi32.dll!NtGdiGetTransform";
515  table[4305] = "gdi32.dll!NtGdiGetUFI";
516  table[4306] = "gdi32.dll!NtGdiGetEmbUFI";
517  table[4307] = "gdi32.dll!NtGdiGetUFIPathname";
518  table[4308] = "gdi32.dll!NtGdiGetEmbedFonts";
519  table[4309] = "gdi32.dll!NtGdiChangeGhostFont";
520  table[4310] = "gdi32.dll!NtGdiAddEmbFontToDC";
521  table[4311] = "gdi32.dll!NtGdiGetFontUnicodeRanges";
522  table[4312] = "gdi32.dll!NtGdiGetWidthTable";
523  table[4313] = "gdi32.dll!NtGdiGradientFill";
524  table[4314] = "gdi32.dll!NtGdiHfontCreate";
525  table[4315] = "gdi32.dll!NtGdiIcmBrushInfo";
526  table[4316] = "gdi32.dll!NtGdiInit";
527  table[4317] = "gdi32.dll!NtGdiInitSpool";
528  table[4318] = "gdi32.dll!NtGdiIntersectClipRect";
529  table[4319] = "gdi32.dll!NtGdiInvertRgn";
530  table[4320] = "gdi32.dll!NtGdiLineTo";
531  table[4321] = "gdi32.dll!NtGdiMakeFontDir";
532  table[4322] = "gdi32.dll!NtGdiMakeInfoDC";
533  table[4323] = "gdi32.dll!NtGdiMaskBlt";
534  table[4324] = "gdi32.dll!NtGdiModifyWorldTransform";
535  table[4325] = "gdi32.dll!NtGdiMonoBitmap";
536  table[4327] = "gdi32.dll!NtGdiOffsetClipRgn";
537  table[4328] = "gdi32.dll!NtGdiOffsetRgn";
538  table[4329] = "gdi32.dll!NtGdiOpenDCW";
539  table[4330] = "gdi32.dll!NtGdiPatBlt";
540  table[4331] = "gdi32.dll!NtGdiPolyPatBlt";
541  table[4332] = "gdi32.dll!NtGdiPathToRegion";
542  table[4333] = "gdi32.dll!NtGdiPlgBlt";
543  table[4334] = "gdi32.dll!NtGdiPolyDraw";
544  table[4335] = "gdi32.dll!NtGdiPolyPolyDraw";
545  table[4336] = "gdi32.dll!NtGdiPolyTextOutW";
546  table[4337] = "gdi32.dll!NtGdiPtInRegion";
547  table[4338] = "gdi32.dll!NtGdiPtVisible";
548  table[4339] = "gdi32.dll!NtGdiQueryFonts";
549  table[4340] = "gdi32.dll!NtGdiQueryFontAssocInfo";
550  table[4341] = "gdi32.dll!NtGdiRectangle";
551  table[4342] = "gdi32.dll!NtGdiRectInRegion";
552  table[4343] = "gdi32.dll!RectVisible";
553  table[4344] = "gdi32.dll!NtGdiRemoveFontResourceW";
554  table[4345] = "gdi32.dll!NtGdiRemoveFontMemResourceEx";
555  table[4346] = "gdi32.dll!NtGdiResetDC";
556  table[4347] = "gdi32.dll!NtGdiResizePalette";
557  table[4348] = "gdi32.dll!NtGdiRestoreDC";
558  table[4349] = "gdi32.dll!NtGdiRoundRect";
559  table[4350] = "gdi32.dll!NtGdiSaveDC";
560  table[4351] = "gdi32.dll!NtGdiScaleViewportExtEx";
561  table[4352] = "gdi32.dll!NtGdiScaleWindowExtEx";
562  table[4353] = "gdi32.dll!NtGdiSelectBitmap";
563  table[4355] = "gdi32.dll!NtGdiSelectClipPath";
564  table[4356] = "gdi32.dll!NtGdiSelectFont";
565  table[4357] = "gdi32.dll!NtGdiSelectPen";
566  table[4358] = "gdi32.dll!NtGdiSetBitmapAttributes";
567  table[4359] = "gdi32.dll!SetBitmapBits";
568  table[4360] = "gdi32.dll!NtGdiSetBitmapDimension";
569  table[4361] = "gdi32.dll!NtGdiSetBoundsRect";
570  table[4362] = "gdi32.dll!NtGdiSetBrushAttributes";
571  table[4363] = "gdi32.dll!NtGdiSetBrushOrg";
572  table[4364] = "gdi32.dll!NtGdiSetColorAdjustment";
573  table[4365] = "gdi32.dll!NtGdiSetColorSpace";
574  table[4366] = "gdi32.dll!NtGdiSetDeviceGammaRamp";
575  table[4367] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal";
576  table[4368] = "gdi32.dll!NtGdiSetFontEnumeration";
577  table[4369] = "gdi32.dll!NtGdiSetFontXform";
578  table[4370] = "gdi32.dll!NtGdiSetIcmMode";
579  table[4371] = "gdi32.dll!NtGdiSetLinkedUFIs";
580  table[4372] = "gdi32.dll!NtGdiSetMagicColors";
581  table[4373] = "gdi32.dll!NtGdiSetMetaRgn";
582  table[4374] = "gdi32.dll!NtGdiSetMiterLimit";
583  table[4375] = "gdi32.dll!NtGdiGetDeviceWidth";
584  table[4376] = "gdi32.dll!NtGdiMirrorWindowOrg";
585  table[4377] = "gdi32.dll!NtGdiSetLayout";
586  table[4378] = "gdi32.dll!NtGdiSetPixel";
587  table[4379] = "gdi32.dll!NtGdiSetPixelFormat";
588  table[4380] = "gdi32.dll!NtGdiSetRectRgn";
589  table[4381] = "gdi32.dll!NtGdiSetSystemPaletteUse";
590  table[4383] = "gdi32.dll!NtGdiSetupPublicCFONT";
591  table[4384] = "gdi32.dll!NtGdiSetVirtualResolution";
592  table[4385] = "gdi32.dll!NtGdiSetSizeDevice";
593  table[4386] = "gdi32.dll!NtGdiStartDoc";
594  table[4387] = "gdi32.dll!NtGdiStartPage";
595  table[4388] = "gdi32.dll!NtGdiStretchBlt";
596  table[4389] = "gdi32.dll!NtGdiStretchDIBitsInternal";
597  table[4390] = "gdi32.dll!NtGdiStrokeAndFillPath";
598  table[4391] = "gdi32.dll!NtGdiStrokePath";
599  table[4392] = "gdi32.dll!NtGdiSwapBuffers";
600  table[4393] = "gdi32.dll!NtGdiTransformPoints";
601  table[4394] = "gdi32.dll!NtGdiTransparentBlt";
602  table[4395] = "gdi32.dll!NtGdiUnloadPrinterDriver";
603  table[4397] = "gdi32.dll!NtGdiUnrealizeObject";
604  table[4398] = "gdi32.dll!NtGdiUpdateColors";
605  table[4399] = "gdi32.dll!NtGdiWidenPath";
606  table[4400] = "user32.dll!NtUserActivateKeyboardLayout";
607  table[4401] = "user32.dll!NtUserAlterWindowStyle";
608  table[4402] = "imm32.dll!NtUserAssociateInputContext";
609  table[4403] = "user32.dll!NtUserAttachThreadInput";
610  table[4404] = "user32.dll!NtUserBeginPaint";
611  table[4405] = "user32.dll!NtUserBitBltSysBmp";
612  table[4406] = "user32.dll!NtUserBlockInput";
613  table[4407] = "imm32.dll!NtUserBuildHimcList";
614  table[4408] = "user32.dll!NtUserBuildHwndList";
615  table[4409] = "user32.dll!NtUserBuildNameList";
616  table[4410] = "user32.dll!NtUserBuildPropList";
617  table[4411] = "user32.dll!NtUserCallHwnd";
618  table[4412] = "user32.dll!NtUserCallHwndLock";
619  table[4413] = "user32.dll!NtUserCallHwndOpt";
620  table[4414] = "user32.dll!NtUserCallHwndParam";
621  table[4415] = "user32.dll!NtUserCallHwndParamLock";
622  table[4416] = "user32.dll!NtUserCallMsgFilter";
623  table[4417] = "user32.dll!NtUserCallNextHookEx";
624  table[4418] = "user32.dll!NtUserCallNoParam";
625  table[4419] = "imm32.dll!NtUserCallOneParam";
626  table[4419] = "user32.dll!NtUserCallOneParam";
627  table[4420] = "user32.dll!NtUserCallTwoParam";
628  table[4421] = "user32.dll!NtUserChangeClipboardChain";
629  table[4422] = "user32.dll!NtUserChangeDisplaySettings";
630  table[4424] = "user32.dll!NtUserCheckMenuItem";
631  table[4425] = "user32.dll!NtUserChildWindowFromPointEx";
632  table[4426] = "user32.dll!NtUserClipCursor";
633  table[4427] = "user32.dll!NtUserCloseClipboard";
634  table[4428] = "user32.dll!NtUserCloseDesktop";
635  table[4429] = "user32.dll!NtUserCloseWindowStation";
636  table[4431] = "user32.dll!NtUserConvertMemHandle";
637  table[4432] = "user32.dll!NtUserCopyAcceleratorTable";
638  table[4433] = "user32.dll!NtUserCountClipboardFormats";
639  table[4434] = "user32.dll!NtUserCreateAcceleratorTable";
640  table[4435] = "user32.dll!NtUserCreateCaret";
641  table[4436] = "user32.dll!NtUserCreateDesktop";
642  table[4437] = "imm32.dll!NtUserCreateInputContext";
643  table[4438] = "user32.dll!NtUserCreateLocalMemHandle";
644  table[4439] = "user32.dll!NtUserCreateWindowEx";
645  table[4440] = "user32.dll!NtUserCreateWindowStation";
646  table[4441] = "user32.dll!NtUserDdeGetQualityOfService";
647  table[4442] = "user32.dll!NtUserDdeInitialize";
648  table[4443] = "user32.dll!NtUserDdeSetQualityOfService";
649  table[4444] = "user32.dll!NtUserDeferWindowPos";
650  table[4445] = "user32.dll!NtUserDefSetText";
651  table[4446] = "user32.dll!NtUserDeleteMenu";
652  table[4447] = "user32.dll!DestroyAcceleratorTable";
653  table[4448] = "user32.dll!NtUserDestroyCursor";
654  table[4449] = "imm32.dll!NtUserDestroyInputContext";
655  table[4450] = "user32.dll!NtUserDestroyMenu";
656  table[4451] = "user32.dll!NtUserDestroyWindow";
657  table[4452] = "imm32.dll!NtUserDisableThreadIme";
658  table[4453] = "user32.dll!NtUserDispatchMessage";
659  table[4454] = "user32.dll!NtUserDragDetect";
660  table[4455] = "user32.dll!NtUserDragObject";
661  table[4456] = "user32.dll!NtUserDrawAnimatedRects";
662  table[4457] = "user32.dll!NtUserDrawCaption";
663  table[4458] = "user32.dll!NtUserDrawCaptionTemp";
664  table[4459] = "user32.dll!NtUserDrawIconEx";
665  table[4460] = "user32.dll!NtUserDrawMenuBarTemp";
666  table[4461] = "user32.dll!NtUserEmptyClipboard";
667  table[4462] = "user32.dll!NtUserEnableMenuItem";
668  table[4463] = "user32.dll!NtUserEnableScrollBar";
669  table[4464] = "user32.dll!NtUserEndDeferWindowPosEx";
670  table[4465] = "user32.dll!NtUserEndMenu";
671  table[4466] = "user32.dll!NtUserEndPaint";
672  table[4467] = "user32.dll!NtUserEnumDisplayDevices";
673  table[4468] = "user32.dll!NtUserEnumDisplayMonitors";
674  table[4469] = "user32.dll!NtUserEnumDisplaySettings";
675  table[4470] = "user32.dll!NtUserEvent";
676  table[4471] = "user32.dll!NtUserExcludeUpdateRgn";
677  table[4472] = "user32.dll!NtUserFillWindow";
678  table[4473] = "user32.dll!NtUserFindExistingCursorIcon";
679  table[4474] = "user32.dll!NtUserFindWindowEx";
680  table[4475] = "user32.dll!NtUserFlashWindowEx";
681  table[4476] = "user32.dll!NtUserGetAltTabInfo";
682  table[4477] = "user32.dll!NtUserGetAncestor";
683  table[4478] = "imm32.dll!NtUserGetAppImeLevel";
684  table[4479] = "user32.dll!GetAsyncKeyState";
685  table[4480] = "user32.dll!NtUserGetAtomName";
686  table[4481] = "user32.dll!NtUserGetCaretBlinkTime";
687  table[4482] = "user32.dll!NtUserGetCaretPos";
688  table[4483] = "user32.dll!NtUserGetClassInfo";
689  table[4484] = "user32.dll!NtUserGetClassName";
690  table[4485] = "user32.dll!NtUserGetClipboardData";
691  table[4486] = "user32.dll!NtUserGetClipboardFormatName";
692  table[4487] = "user32.dll!NtUserGetClipboardOwner";
693  table[4488] = "user32.dll!NtUserGetClipboardSequenceNumber";
694  table[4489] = "user32.dll!NtUserGetClipboardViewer";
695  table[4490] = "user32.dll!NtUserGetClipCursor";
696  table[4491] = "user32.dll!NtUserGetComboBoxInfo";
697  table[4492] = "user32.dll!NtUserGetControlBrush";
698  table[4493] = "user32.dll!NtUserGetControlColor";
699  table[4494] = "user32.dll!NtUserGetCPD";
700  table[4495] = "user32.dll!NtUserGetCursorFrameInfo";
701  table[4496] = "user32.dll!NtUserGetCursorInfo";
702  table[4497] = "user32.dll!NtUserGetDC";
703  table[4498] = "user32.dll!NtUserGetDCEx";
704  table[4499] = "user32.dll!NtUserGetDoubleClickTime";
705  table[4500] = "user32.dll!NtUserGetForegroundWindow";
706  table[4501] = "user32.dll!NtUserGetGuiResources";
707  table[4502] = "user32.dll!NtUserGetGUIThreadInfo";
708  table[4503] = "user32.dll!NtUserGetIconInfo";
709  table[4504] = "user32.dll!NtUserGetIconSize";
710  table[4505] = "imm32.dll!NtUserGetImeHotKey";
711  table[4505] = "user32.dll!NtUserGetImeHotKey";
712  table[4506] = "imm32.dll!NtUserGetImeInfoEx";
713  table[4507] = "user32.dll!NtUserGetInternalWindowPos";
714  table[4508] = "user32.dll!NtUserGetKeyboardLayoutList";
715  table[4509] = "user32.dll!NtUserGetKeyboardLayoutName";
716  table[4510] = "user32.dll!NtUserGetKeyboardState";
717  table[4511] = "user32.dll!NtUserGetKeyNameText";
718  table[4512] = "user32.dll!NtUserGetKeyState";
719  table[4513] = "user32.dll!NtUserGetListBoxInfo";
720  table[4514] = "user32.dll!NtUserGetMenuBarInfo";
721  table[4515] = "user32.dll!NtUserGetMenuIndex";
722  table[4516] = "user32.dll!NtUserGetMenuItemRect";
723  table[4517] = "user32.dll!NtUserGetMessage";
724  table[4518] = "user32.dll!NtUserGetMouseMovePointsEx";
725  table[4519] = "user32.dll!NtUserGetObjectInformation";
726  table[4520] = "user32.dll!NtUserGetOpenClipboardWindow";
727  table[4521] = "user32.dll!NtUserGetPriorityClipboardFormat";
728  table[4522] = "user32.dll!NtUserGetProcessWindowStation";
729  table[4523] = "user32.dll!NtUserGetRawInputBuffer";
730  table[4524] = "user32.dll!NtUserGetRawInputData";
731  table[4525] = "user32.dll!NtUserGetRawInputDeviceInfo";
732  table[4526] = "user32.dll!NtUserGetRawInputDeviceList";
733  table[4527] = "user32.dll!NtUserGetRegisteredRawInputDevices";
734  table[4528] = "user32.dll!NtUserGetScrollBarInfo";
735  table[4529] = "user32.dll!NtUserGetSystemMenu";
736  table[4530] = "user32.dll!NtUserGetThreadDesktop";
737  table[4531] = "imm32.dll!NtUserGetThreadState";
738  table[4531] = "user32.dll!NtUserGetThreadState";
739  table[4532] = "user32.dll!NtUserGetTitleBarInfo";
740  table[4533] = "user32.dll!GetUpdateRect";
741  table[4534] = "user32.dll!GetUpdateRgn";
742  table[4535] = "user32.dll!NtUserGetWindowDC";
743  table[4536] = "user32.dll!NtUserGetWindowPlacement";
744  table[4537] = "user32.dll!NtUserGetWOWClass";
745  table[4539] = "user32.dll!NtUserHideCaret";
746  table[4540] = "user32.dll!NtUserHiliteMenuItem";
747  table[4541] = "user32.dll!NtUserImpersonateDdeClientWindow";
748  table[4543] = "user32.dll!NtUserInitializeClientPfnArrays";
749  table[4544] = "user32.dll!NtUserInitTask";
750  table[4545] = "user32.dll!NtUserInternalGetWindowText";
751  table[4546] = "user32.dll!NtUserInvalidateRect";
752  table[4547] = "user32.dll!NtUserInvalidateRgn";
753  table[4548] = "user32.dll!NtUserIsClipboardFormatAvailable";
754  table[4549] = "user32.dll!NtUserKillTimer";
755  table[4550] = "user32.dll!NtUserLoadKeyboardLayoutEx";
756  table[4551] = "user32.dll!NtUserLockWindowStation";
757  table[4552] = "user32.dll!NtUserLockWindowUpdate";
758  table[4553] = "user32.dll!NtUserLockWorkStation";
759  table[4554] = "user32.dll!NtUserMapVirtualKeyEx";
760  table[4555] = "user32.dll!NtUserMenuItemFromPoint";
761  table[4556] = "user32.dll!NtUserMessageCall";
762  table[4557] = "user32.dll!NtUserMinMaximize";
763  table[4558] = "user32.dll!NtUserMNDragLeave";
764  table[4559] = "user32.dll!NtUserMNDragOver";
765  table[4560] = "user32.dll!NtUserModifyUserStartupInfoFlags";
766  table[4561] = "user32.dll!NtUserMoveWindow";
767  table[4562] = "imm32.dll!NtUserNotifyIMEStatus";
768  table[4562] = "user32.dll!NtUserNotifyIMEStatus";
769  table[4564] = "user32.dll!NtUserNotifyWinEvent";
770  table[4565] = "user32.dll!NtUserOpenClipboard";
771  table[4566] = "user32.dll!NtUserOpenDesktop";
772  table[4567] = "user32.dll!NtUserOpenInputDesktop";
773  table[4568] = "user32.dll!NtUserOpenWindowStation";
774  table[4569] = "user32.dll!NtUserPaintDesktop";
775  table[4570] = "user32.dll!PeekMessageW";
776  table[4571] = "user32.dll!NtUserPostMessage";
777  table[4572] = "user32.dll!NtUserPostThreadMessage";
778  table[4573] = "user32.dll!NtUserPrintWindow";
779  table[4574] = "user32.dll!NtUserProcessConnect";
780  table[4576] = "imm32.dll!NtUserQueryInputContext";
781  table[4577] = "user32.dll!NtUserQuerySendMessage";
782  table[4578] = "user32.dll!NtUserQueryUserCounters";
783  table[4579] = "imm32.dll!NtUserQueryWindow";
784  table[4579] = "user32.dll!NtUserQueryWindow";
785  table[4580] = "user32.dll!NtUserRealChildWindowFromPoint";
786  table[4581] = "user32.dll!NtUserRealInternalGetMessage";
787  table[4582] = "user32.dll!NtUserRealWaitMessageEx";
788  table[4583] = "user32.dll!NtUserRedrawWindow";
789  table[4584] = "user32.dll!NtUserRegisterClassExWOW";
790  table[4585] = "user32.dll!NtUserRegisterUserApiHook";
791  table[4586] = "user32.dll!NtUserRegisterHotKey";
792  table[4587] = "user32.dll!NtUserRegisterRawInputDevices";
793  table[4588] = "user32.dll!NtUserRegisterTasklist";
794  table[4589] = "user32.dll!NtUserRegisterWindowMessage";
795  table[4590] = "user32.dll!NtUserRemoveMenu";
796  table[4591] = "user32.dll!NtUserRemoveProp";
797  table[4593] = "user32.dll!NtUserResolveDesktopForWOW";
798  table[4594] = "user32.dll!NtUserSBGetParms";
799  table[4595] = "user32.dll!ScrollDC";
800  table[4596] = "user32.dll!NtUserScrollWindowEx";
801  table[4597] = "gdi32.dll!NtUserSelectPalette";
802  table[4598] = "user32.dll!NtUserSendInput";
803  table[4599] = "user32.dll!NtUserSetActiveWindow";
804  table[4600] = "imm32.dll!NtUserSetAppImeLevel";
805  table[4601] = "user32.dll!NtUserSetCapture";
806  table[4602] = "user32.dll!NtUserSetClassLong";
807  table[4603] = "user32.dll!NtUserSetClassWord";
808  table[4604] = "user32.dll!NtUserSetClipboardData";
809  table[4605] = "user32.dll!NtUserSetClipboardViewer";
810  table[4606] = "user32.dll!NtUserSetConsoleReserveKeys";
811  table[4607] = "user32.dll!NtUserSetCursor";
812  table[4608] = "user32.dll!NtUserSetCursorContents";
813  table[4609] = "user32.dll!NtUserSetCursorIconData";
814  table[4610] = "user32.dll!NtUserSetDbgTag";
815  table[4611] = "user32.dll!NtUserSetFocus";
816  table[4612] = "user32.dll!NtUserSetImeHotKey";
817  table[4613] = "imm32.dll!NtUserSetImeInfoEx";
818  table[4614] = "user32.dll!NtUserSetImeOwnerWindow";
819  table[4616] = "user32.dll!NtUserSetInformationThread";
820  table[4617] = "user32.dll!NtUserSetInternalWindowPos";
821  table[4618] = "user32.dll!NtUserSetKeyboardState";
822  table[4619] = "user32.dll!NtUserSetLogonNotifyWindow";
823  table[4620] = "user32.dll!NtUserSetMenu";
824  table[4621] = "user32.dll!NtUserSetMenuContextHelpId";
825  table[4622] = "user32.dll!NtUserSetMenuDefaultItem";
826  table[4623] = "user32.dll!NtUserSetMenuFlagRtoL";
827  table[4624] = "user32.dll!NtUserSetObjectInformation";
828  table[4625] = "user32.dll!NtUserSetParent";
829  table[4626] = "user32.dll!NtUserSetProcessWindowStation";
830  table[4627] = "user32.dll!NtUserSetProp";
831  table[4628] = "user32.dll!NtUserSetRipFlags";
832  table[4629] = "user32.dll!NtUserSetScrollInfo";
833  table[4630] = "user32.dll!NtUserSetShellWindowEx";
834  table[4631] = "user32.dll!NtUserSetSysColors";
835  table[4632] = "user32.dll!NtUserSetSystemCursor";
836  table[4633] = "user32.dll!NtUserSetSystemMenu";
837  table[4634] = "user32.dll!NtUserSetSystemTimer";
838  table[4635] = "user32.dll!NtUserSetThreadDesktop";
839  table[4636] = "imm32.dll!NtUserSetThreadLayoutHandles";
840  table[4637] = "user32.dll!NtUserSetThreadState";
841  table[4638] = "user32.dll!NtUserSetTimer";
842  table[4639] = "user32.dll!NtUserSetWindowFNID";
843  table[4640] = "user32.dll!NtUserSetWindowLong";
844  table[4641] = "user32.dll!NtUserSetWindowPlacement";
845  table[4642] = "user32.dll!NtUserSetWindowPos";
846  table[4643] = "user32.dll!NtUserSetWindowRgn";
847  table[4644] = "user32.dll!NtUserSetWindowsHookAW";
848  table[4645] = "user32.dll!NtUserSetWindowsHookEx";
849  table[4646] = "user32.dll!NtUserSetWindowStationUser";
850  table[4647] = "user32.dll!NtUserSetWindowWord";
851  table[4648] = "user32.dll!NtUserSetWinEventHook";
852  table[4649] = "user32.dll!NtUserShowCaret";
853  table[4650] = "user32.dll!NtUserShowScrollBar";
854  table[4651] = "user32.dll!NtUserShowWindow";
855  table[4652] = "user32.dll!NtUserShowWindowAsync";
856  table[4654] = "user32.dll!NtUserSwitchDesktop";
857  table[4655] = "user32.dll!NtUserSystemParametersInfo";
858  table[4657] = "user32.dll!NtUserThunkedMenuInfo";
859  table[4658] = "user32.dll!NtUserThunkedMenuItemInfo";
860  table[4659] = "user32.dll!NtUserToUnicodeEx";
861  table[4660] = "user32.dll!NtUserTrackMouseEvent";
862  table[4661] = "user32.dll!NtUserTrackPopupMenuEx";
863  table[4662] = "user32.dll!NtUserCalcMenuBar";
864  table[4663] = "user32.dll!NtUserPaintMenuBar";
865  table[4664] = "user32.dll!TranslateAcceleratorA";
866  table[4665] = "user32.dll!NtUserTranslateMessage";
867  table[4666] = "user32.dll!NtUserUnhookWindowsHookEx";
868  table[4667] = "user32.dll!NtUserUnhookWinEvent";
869  table[4668] = "user32.dll!NtUserUnloadKeyboardLayout";
870  table[4669] = "user32.dll!NtUserUnlockWindowStation";
871  table[4670] = "user32.dll!NtUserUnregisterClass";
872  table[4671] = "user32.dll!NtUserUnregisterUserApiHook";
873  table[4672] = "user32.dll!NtUserUnregisterHotKey";
874  table[4673] = "imm32.dll!NtUserUpdateInputContext";
875  table[4673] = "user32.dll!NtUserUpdateInputContext";
876  table[4674] = "user32.dll!NtUserUpdateInstance";
877  table[4675] = "user32.dll!NtUserUpdateLayeredWindow";
878  table[4676] = "user32.dll!NtUserGetLayeredWindowAttributes";
879  table[4677] = "user32.dll!NtUserSetLayeredWindowAttributes";
880  table[4678] = "user32.dll!NtUserUpdatePerUserSystemParameters";
881  table[4679] = "user32.dll!NtUserUserHandleGrantAccess";
882  table[4680] = "imm32.dll!NtUserValidateHandleSecure";
883  table[4680] = "user32.dll!NtUserValidateHandleSecure";
884  table[4681] = "user32.dll!NtUserValidateRect";
885  table[4682] = "user32.dll!NtUserValidateTimerCallback";
886  table[4683] = "user32.dll!NtUserVkKeyScanEx";
887  table[4684] = "user32.dll!NtUserWaitForInputIdle";
888  table[4685] = "user32.dll!NtUserWaitForMsgAndEvent";
889  table[4686] = "user32.dll!NtUserWaitMessage";
890  table[4687] = "user32.dll!NtUserWin32PoolAllocationStats";
891  table[4688] = "user32.dll!NtUserWindowFromPoint";
892  table[4689] = "user32.dll!NtUserYieldTask";
893  table[4695] = "gdi32.dll!NtGdiEngAssociateSurface";
894  table[4696] = "gdi32.dll!NtGdiEngCreateBitmap";
895  table[4697] = "gdi32.dll!NtGdiEngCreateDeviceSurface";
896  table[4698] = "gdi32.dll!NtGdiEngCreateDeviceBitmap";
897  table[4699] = "gdi32.dll!NtGdiEngCreatePalette";
898  table[4700] = "gdi32.dll!NtGdiEngComputeGlyphSet";
899  table[4701] = "gdi32.dll!NtGdiEngCopyBits";
900  table[4702] = "gdi32.dll!NtGdiEngDeletePalette";
901  table[4703] = "gdi32.dll!NtGdiEngDeleteSurface";
902  table[4704] = "gdi32.dll!NtGdiEngEraseSurface";
903  table[4705] = "gdi32.dll!NtGdiEngUnlockSurface";
904  table[4706] = "gdi32.dll!NtGdiEngLockSurface";
905  table[4707] = "gdi32.dll!NtGdiEngBitBlt";
906  table[4708] = "gdi32.dll!NtGdiEngStretchBlt";
907  table[4709] = "gdi32.dll!NtGdiEngPlgBlt";
908  table[4710] = "gdi32.dll!NtGdiEngMarkBandingSurface";
909  table[4711] = "gdi32.dll!NtGdiEngStrokePath";
910  table[4712] = "gdi32.dll!NtGdiEngFillPath";
911  table[4713] = "gdi32.dll!NtGdiEngStrokeAndFillPath";
912  table[4714] = "gdi32.dll!NtGdiEngPaint";
913  table[4715] = "gdi32.dll!NtGdiEngLineTo";
914  table[4716] = "gdi32.dll!NtGdiEngAlphaBlend";
915  table[4717] = "gdi32.dll!NtGdiEngGradientFill";
916  table[4718] = "gdi32.dll!NtGdiEngTransparentBlt";
917  table[4719] = "gdi32.dll!NtGdiEngTextOut";
918  table[4720] = "gdi32.dll!NtGdiEngStretchBltROP";
919  table[4721] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette";
920  table[4722] = "gdi32.dll!NtGdiXLATEOBJ_iXlate";
921  table[4723] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform";
922  table[4724] = "gdi32.dll!NtGdiCLIPOBJ_bEnum";
923  table[4725] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart";
924  table[4726] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath";
925  table[4727] = "gdi32.dll!NtGdiEngDeletePath";
926  table[4728] = "gdi32.dll!NtGdiEngCreateClip";
927  table[4729] = "gdi32.dll!NtGdiEngDeleteClip";
928  table[4730] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor";
929  table[4731] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush";
930  table[4732] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush";
931  table[4733] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform";
932  table[4734] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform";
933  table[4735] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform";
934  table[4736] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo";
935  table[4737] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform";
936  table[4738] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs";
937  table[4739] = "gdi32.dll!NtGdiFONTOBJ_pifi";
938  table[4740] = "gdi32.dll!NtGdiFONTOBJ_pfdg";
939  table[4741] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs";
940  table[4742] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile";
941  table[4743] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles";
942  table[4744] = "gdi32.dll!NtGdiSTROBJ_bEnum";
943  table[4745] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly";
944  table[4746] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths";
945  table[4747] = "gdi32.dll!NtGdiSTROBJ_vEnumStart";
946  table[4748] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage";
947  table[4749] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds";
948  table[4750] = "gdi32.dll!NtGdiPATHOBJ_bEnum";
949  table[4751] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart";
950  table[4752] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines";
951  table[4753] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines";
952  table[4754] = "gdi32.dll!NtGdiGetDhpdev";
953  table[4755] = "gdi32.dll!NtGdiEngCheckAbort";
954  table[4756] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette";
955  table[4757] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette";
956  table[4758] = "gdi32.dll!NtGdiUpdateTransform";
957  table[4759] = "gdi32.dll!NtGdiSetPUMPDOBJ";
958  table[4760] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush";
959  table[4761] = "gdi32.dll!NtGdiUMPDEngFreeUserMem";
960  table[4762] = "gdi32.dll!NtGdiDrawStream";
961} else {  // Vista table.
962  table[4272] = "gdi32.dll!NtGdiGetDeviceCaps";
963  table[4220] = "gdi32.dll!NtGdiDeleteObjectApp";
964  table[4249] = "gdi32.dll!NtGdiFlush";
965  table[4120] = "gdi32.dll!NtGdiConsoleTextOut";
966  table[4825] = "gdi32.dll!NtGdiDdDDIEscape";
967  table[4299] = "gdi32.dll!GetRgnBox";
968  table[4828] = "gdi32.dll!NtGdiDdDDIGetPresentHistory";
969  table[4835] = "gdi32.dll!NtGdiDdDDIGetDeviceState";
970  table[4850] = "gdi32.dll!NtGdiDdDDICheckExclusiveOwnership";
971  table[4849] = "gdi32.dll!NtGdiDdDDICheckMonitorPowerState";
972  table[4833] = "gdi32.dll!NtGdiDdDDIWaitForVerticalBlankEvent";
973  table[4298] = "gdi32.dll!GetRegionData";
974  table[4796] = "gdi32.dll!NtGdiDwmGetDirtyRgn";
975  table[4820] = "gdi32.dll!NtGdiDdDDIRender";
976  table[4819] = "gdi32.dll!NtGdiDdDDIPresent";
977  table[4815] = "gdi32.dll!NtGdiDdDDIUnlock";
978  table[4814] = "gdi32.dll!NtGdiDdDDILock";
979  table[4240] = "gdi32.dll!NtGdiExtCreateRegion";
980  table[4339] = "gdi32.dll!NtGdiPolyPatBlt";
981  table[4361] = "gdi32.dll!NtGdiSelectBitmap";
982  table[4127] = "gdi32.dll!NtGdiCreateCompatibleDC";
983  table[4142] = "gdi32.dll!NtGdiCreateSolidBrush";
984  table[4122] = "gdi32.dll!CreateBitmap";
985  table[4303] = "gdi32.dll!CreateBitmap";
986  table[4348] = "gdi32.dll!NtGdiQueryFontAssocInfo";
987  table[4126] = "gdi32.dll!NtGdiCreateCompatibleBitmap";
988  table[4109] = "gdi32.dll!NtGdiBitBlt";
989  table[4243] = "gdi32.dll!NtGdiExtGetObjectW";
990  table[4270] = "gdi32.dll!NtGdiGetDCObject";
991  table[4620] = "gdi32.dll!NtUserSelectPalette";
992  table[4338] = "gdi32.dll!NtGdiPatBlt";
993  table[4275] = "gdi32.dll!NtGdiGetDIBitsInternal";
994  table[4398] = "gdi32.dll!NtGdiStretchDIBitsInternal";
995  table[4130] = "gdi32.dll!NtGdiCreateDIBSection";
996  table[4356] = "gdi32.dll!NtGdiRestoreDC";
997  table[4358] = "gdi32.dll!NtGdiSaveDC";
998  table[4103] = "gdi32.dll!NtGdiAlphaBlend";
999  table[4349] = "gdi32.dll!NtGdiRectangle";
1000  table[4295] = "gdi32.dll!NtGdiGetRandomRgn";
1001  table[4244] = "gdi32.dll!NtGdiExtSelectClipRgn";
1002  table[4268] = "gdi32.dll!NtGdiGetDCDword";
1003  table[4245] = "gdi32.dll!NtGdiExtTextOutW";
1004  table[4254] = "gdi32.dll!GetClipBox";
1005  table[4397] = "gdi32.dll!NtGdiStretchBlt";
1006  table[4331] = "gdi32.dll!NtGdiMaskBlt";
1007  table[4324] = "gdi32.dll!NtGdiInit";
1008  table[4262] = "gdi32.dll!NtGdiGetCharSet";
1009  table[4336] = "gdi32.dll!NtGdiOffsetRgn";
1010  table[4326] = "gdi32.dll!NtGdiIntersectClipRect";
1011  table[4795] = "gdi32.dll!NtGdiDrawStream";
1012  table[4364] = "gdi32.dll!NtGdiSelectFont";
1013  table[4116] = "gdi32.dll!NtGdiCombineRgn";
1014  table[4238] = "gdi32.dll!NtGdiExcludeClipRect";
1015  table[4802] = "gdi32.dll!NtGdiDdDDISetAllocationPriority";
1016  table[4798] = "gdi32.dll!NtGdiDdDDICreateAllocation";
1017  table[4801] = "gdi32.dll!NtGdiDdDDIDestroyAllocation";
1018  table[4797] = "gdi32.dll!NtGdiDwmGetSurfaceData";
1019  table[4140] = "gdi32.dll!CreateRoundRectRgn";
1020  table[4840] = "gdi32.dll!NtGdiDdDDISetProcessSchedulingPriorityClass";
1021  table[4307] = "gdi32.dll!NtGdiGetTextCharsetInfo";
1022  table[4351] = "gdi32.dll!RectVisible";
1023  table[4139] = "gdi32.dll!NtGdiCreateRectRgn";
1024  table[4369] = "gdi32.dll!NtGdiSetBoundsRect";
1025  table[4257] = "gdi32.dll!NtGdiGetBoundsRect";
1026  table[4309] = "gdi32.dll!NtGdiGetTextExtentExW";
1027  table[4402] = "gdi32.dll!NtGdiTransformPoints";
1028  table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients";
1029  table[4337] = "gdi32.dll!NtGdiOpenDCW";
1030  table[4813] = "gdi32.dll!NtGdiDdDDIQueryAdapterInfo";
1031  table[4822] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromHdc";
1032  table[4816] = "gdi32.dll!NtGdiDdDDIGetDisplayModeList";
1033  table[4823] = "gdi32.dll!NtGdiDdDDICloseAdapter";
1034  table[4804] = "gdi32.dll!NtGdiDdDDICreateDevice";
1035  table[4806] = "gdi32.dll!NtGdiDdDDICreateContext";
1036  table[4271] = "gdi32.dll!NtGdiGetDCPoint";
1037  table[4225] = "gdi32.dll!NtGdiDoPalette";
1038  table[4288] = "gdi32.dll!GetNearestColor";
1039  table[4129] = "gdi32.dll!NtGdiCreateDIBitmapInternal";
1040  table[4322] = "gdi32.dll!NtGdiHfontCreate";
1041  table[4137] = "gdi32.dll!NtGdiCreatePatternBrushInternal";
1042  table[4136] = "gdi32.dll!NtGdiCreatePaletteInternal";
1043  table[4132] = "gdi32.dll!NtGdiCreateHalftonePalette";
1044  table[4375] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal";
1045  table[4269] = "gdi32.dll!NtGdiGetDCforBitmap";
1046  table[4392] = "gdi32.dll!NtGdiSetupPublicCFONT";
1047  table[4836] = "gdi32.dll!NtGdiDdDDICreateDCFromMemory";
1048  table[4264] = "gdi32.dll!NtGdiGetCharWidthInfo";
1049  table[4367] = "gdi32.dll!SetBitmapBits";
1050  table[4255] = "gdi32.dll!GetBitmapBits";
1051  table[4311] = "gdi32.dll!NtGdiGetTextMetricsW";
1052  table[4297] = "gdi32.dll!NtGdiGetRealizationInfo";
1053  table[4310] = "gdi32.dll!NtGdiGetTextFaceW";
1054  table[4292] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW";
1055  table[4280] = "gdi32.dll!NtGdiGetGlyphIndicesW";
1056  table[4320] = "gdi32.dll!NtGdiGetWidthTable";
1057  table[4234] = "gdi32.dll!NtGdiEnumFontOpen";
1058  table[4233] = "gdi32.dll!NtGdiEnumFontClose";
1059  table[4232] = "gdi32.dll!NtGdiEnumFontChunk";
1060  table[4260] = "gdi32.dll!NtGdiGetCharABCWidthsW";
1061  table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts";
1062  table[4278] = "gdi32.dll!NtGdiGetFontData";
1063  table[4106] = "gdi32.dll!NtGdiFontIsLinked";
1064  table[4332] = "gdi32.dll!NtGdiModifyWorldTransform";
1065  table[4312] = "gdi32.dll!NtGdiGetTransform";
1066  table[4321] = "gdi32.dll!NtGdiGradientFill";
1067  table[4294] = "gdi32.dll!NtGdiGetPixel";
1068  table[4403] = "gdi32.dll!NtGdiTransparentBlt";
1069  table[4319] = "gdi32.dll!NtGdiGetFontUnicodeRanges";
1070  table[4817] = "gdi32.dll!NtGdiDdDDISetDisplayMode";
1071  table[4827] = "gdi32.dll!NtGdiDdDDISetVidPnSourceOwner";
1072  table[4273] = "gdi32.dll!NtGdiGetDeviceGammaRamp";
1073  table[4374] = "gdi32.dll!NtGdiSetDeviceGammaRamp";
1074  table[4366] = "gdi32.dll!NtGdiSetBitmapAttributes";
1075  table[4098] = "gdi32.dll!NtGdiAddFontResourceW";
1076  table[4376] = "gdi32.dll!NtGdiSetFontEnumeration";
1077  table[4228] = "gdi32.dll!NtGdiEnableEudc";
1078  table[4343] = "gdi32.dll!NtGdiPolyPolyDraw";
1079  table[4328] = "gdi32.dll!NtGdiLineTo";
1080  table[4138] = "gdi32.dll!NtGdiCreatePen";
1081  table[4236] = "gdi32.dll!EqualRgn";
1082  table[4805] = "gdi32.dll!NtGdiDdDDIDestroyDevice";
1083  table[4807] = "gdi32.dll!NtGdiDdDDIDestroyContext";
1084  table[4799] = "gdi32.dll!NtGdiDdDDIQueryResourceInfo";
1085  table[4800] = "gdi32.dll!NtGdiDdDDIOpenResource";
1086  table[4838] = "gdi32.dll!NtGdiDdDDISetContextSchedulingPriority";
1087  table[4263] = "gdi32.dll!NtGdiGetCharWidthW";
1088  table[4837] = "gdi32.dll!NtGdiDdDDIDestroyDCFromMemory";
1089  table[4803] = "gdi32.dll!NtGdiDdDDIQueryAllocationResidency";
1090  table[4824] = "gdi32.dll!NtGdiDdDDIGetSharedPrimaryHandle";
1091  table[4385] = "gdi32.dll!NtGdiSetLayout";
1092  table[4371] = "gdi32.dll!NtGdiSetBrushOrg";
1093  table[4157] = "gdi32.dll!NtGdiDdCreateDirectDrawObject";
1094  table[4128] = "gdi32.dll!NtGdiCreateDIBBrush";
1095  table[4387] = "gdi32.dll!NtGdiSetPixel";
1096  table[4345] = "gdi32.dll!PtInRegion";
1097  table[4821] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromDeviceName";
1098  table[4253] = "gdi32.dll!NtGdiGetAndSetDCDword";
1099  table[4274] = "gdi32.dll!NtGdiGetDeviceCapsAll";
1100  table[4247] = "gdi32.dll!NtGdiFillRgn";
1101  table[4289] = "gdi32.dll!GetNearestPaletteIndex";
1102  table[4378] = "gdi32.dll!NtGdiSetIcmMode";
1103  table[4327] = "gdi32.dll!NtGdiInvertRgn";
1104  table[4792] = "gdi32.dll!NtGdiSetPUMPDOBJ";
1105  table[4735] = "gdi32.dll!NtGdiEngDeletePalette";
1106  table[4732] = "gdi32.dll!NtGdiEngCreatePalette";
1107  table[4241] = "gdi32.dll!NtGdiExtEscape";
1108  table[4217] = "gdi32.dll!NtGdiDeleteClientObj";
1109  table[4123] = "gdi32.dll!NtGdiCreateClientObj";
1110  table[4354] = "gdi32.dll!NtGdiResetDC";
1111  table[4235] = "gdi32.dll!NtGdiEnumObjects";
1112  table[4135] = "gdi32.dll!NtGdiCreateOPMProtectedOutputs";
1113  table[4222] = "gdi32.dll!NtGdiDestroyOPMProtectedOutput";
1114  table[4258] = "gdi32.dll!NtGdiGetCertificate";
1115  table[4259] = "gdi32.dll!NtGdiGetCertificateSize";
1116  table[4291] = "gdi32.dll!NtGdiGetOPMRandomNumber";
1117  table[4305] = "gdi32.dll!NtGdiGetSuggestedOPMProtectedOutputArraySize";
1118  table[4386] = "gdi32.dll!NtGdiSetOPMSigningKeyAndSequenceNumbers";
1119  table[4844] = "gdi32.dll!NtGdiDdDDISetQueuedLimit";
1120  table[4341] = "gdi32.dll!NtGdiPlgBlt";
1121  table[4117] = "gdi32.dll!CombineTransform";
1122  table[4134] = "gdi32.dll!NtGdiCreateMetafileDC";
1123  table[4393] = "gdi32.dll!NtGdiSetVirtualResolution";
1124  table[4394] = "gdi32.dll!NtGdiSetSizeDevice";
1125  table[4381] = "gdi32.dll!NtGdiSetMetaRgn";
1126  table[4382] = "gdi32.dll!NtGdiSetMiterLimit";
1127  table[4377] = "gdi32.dll!NtGdiSetFontXform";
1128  table[4333] = "gdi32.dll!NtGdiMonoBitmap";
1129  table[4768] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform";
1130  table[4770] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform";
1131  table[4239] = "gdi32.dll!NtGdiExtCreatePen";
1132  table[4286] = "gdi32.dll!GetMiterLimit";
1133  table[4290] = "gdi32.dll!NtGdiGetObjectBitmapHandle";
1134  table[4287] = "gdi32.dll!NtGdiGetMonitorID";
1135  table[4284] = "gdi32.dll!NtGdiGetKerningPairs";
1136  table[4357] = "gdi32.dll!NtGdiRoundRect";
1137  table[4242] = "gdi32.dll!NtGdiExtFloodFill";
1138  table[4306] = "gdi32.dll!GetSystemPaletteUse";
1139  table[4096] = "gdi32.dll!NtGdiAbortDoc";
1140  table[4097] = "gdi32.dll!NtGdiAbortPath";
1141  table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC";
1142  table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx";
1143  table[4101] = "gdi32.dll!NtGdiRemoveMergeFont";
1144  table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC";
1145  table[4104] = "gdi32.dll!NtGdiAngleArc";
1146  table[4107] = "gdi32.dll!NtGdiArcInternal";
1147  table[4108] = "gdi32.dll!NtGdiBeginPath";
1148  table[4110] = "gdi32.dll!NtGdiCancelDC";
1149  table[4111] = "gdi32.dll!NtGdiCheckBitmapBits";
1150  table[4112] = "gdi32.dll!NtGdiCloseFigure";
1151  table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes";
1152  table[4114] = "gdi32.dll!NtGdiClearBrushAttributes";
1153  table[4115] = "gdi32.dll!NtGdiColorCorrectPalette";
1154  table[4119] = "gdi32.dll!NtGdiConfigureOPMProtectedOutput";
1155  table[4121] = "gdi32.dll!NtGdiConvertMetafileRect";
1156  table[4124] = "gdi32.dll!NtGdiCreateColorSpace";
1157  table[4125] = "gdi32.dll!NtGdiCreateColorTransform";
1158  table[4131] = "gdi32.dll!NtGdiCreateEllipticRgn";
1159  table[4133] = "gdi32.dll!NtGdiCreateHatchBrushInternal";
1160  table[4141] = "gdi32.dll!NtGdiCreateServerMetaFile";
1161  table[4143] = "gdi32.dll!NtGdiD3dContextCreate";
1162  table[4144] = "gdi32.dll!NtGdiD3dContextDestroy";
1163  table[4145] = "gdi32.dll!NtGdiD3dContextDestroyAll";
1164  table[4146] = "gdi32.dll!NtGdiD3dValidateTextureStageState";
1165  table[4147] = "gdi32.dll!NtGdiD3dDrawPrimitives2";
1166  table[4148] = "gdi32.dll!NtGdiDdGetDriverState";
1167  table[4149] = "gdi32.dll!NtGdiDdAddAttachedSurface";
1168  table[4150] = "gdi32.dll!NtGdiDdAlphaBlt";
1169  table[4151] = "gdi32.dll!NtGdiDdAttachSurface";
1170  table[4152] = "gdi32.dll!NtGdiDdBeginMoCompFrame";
1171  table[4153] = "gdi32.dll!NtGdiDdBlt";
1172  table[4154] = "gdi32.dll!NtGdiDdCanCreateSurface";
1173  table[4155] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer";
1174  table[4156] = "gdi32.dll!NtGdiDdColorControl";
1175  table[4158] = "gdi32.dll!NtGdiDdCreateSurface";
1176  table[4159] = "gdi32.dll!NtGdiDdCreateD3DBuffer";
1177  table[4160] = "gdi32.dll!NtGdiDdCreateMoComp";
1178  table[4161] = "gdi32.dll!NtGdiDdCreateSurfaceObject";
1179  table[4162] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject";
1180  table[4163] = "gdi32.dll!NtGdiDdDeleteSurfaceObject";
1181  table[4164] = "gdi32.dll!NtGdiDdDestroyMoComp";
1182  table[4165] = "gdi32.dll!NtGdiDdDestroySurface";
1183  table[4166] = "gdi32.dll!NtGdiDdDestroyD3DBuffer";
1184  table[4167] = "gdi32.dll!NtGdiDdEndMoCompFrame";
1185  table[4168] = "gdi32.dll!NtGdiDdFlip";
1186  table[4169] = "gdi32.dll!NtGdiDdFlipToGDISurface";
1187  table[4170] = "gdi32.dll!NtGdiDdGetAvailDriverMemory";
1188  table[4171] = "gdi32.dll!NtGdiDdGetBltStatus";
1189  table[4172] = "gdi32.dll!NtGdiDdGetDC";
1190  table[4173] = "gdi32.dll!NtGdiDdGetDriverInfo";
1191  table[4174] = "gdi32.dll!NtGdiDdGetDxHandle";
1192  table[4175] = "gdi32.dll!NtGdiDdGetFlipStatus";
1193  table[4176] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo";
1194  table[4177] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo";
1195  table[4178] = "gdi32.dll!NtGdiDdGetMoCompGuids";
1196  table[4179] = "gdi32.dll!NtGdiDdGetMoCompFormats";
1197  table[4180] = "gdi32.dll!NtGdiDdGetScanLine";
1198  table[4181] = "gdi32.dll!NtGdiDdLock";
1199  table[4182] = "gdi32.dll!NtGdiDdLockD3D";
1200  table[4183] = "gdi32.dll!NtGdiDdQueryDirectDrawObject";
1201  table[4184] = "gdi32.dll!NtGdiDdQueryMoCompStatus";
1202  table[4185] = "gdi32.dll!NtGdiDdReenableDirectDrawObject";
1203  table[4186] = "gdi32.dll!NtGdiDdReleaseDC";
1204  table[4187] = "gdi32.dll!NtGdiDdRenderMoComp";
1205  table[4188] = "gdi32.dll!NtGdiDdResetVisrgn";
1206  table[4189] = "gdi32.dll!NtGdiDdSetColorKey";
1207  table[4190] = "gdi32.dll!NtGdiDdSetExclusiveMode";
1208  table[4191] = "gdi32.dll!NtGdiDdSetGammaRamp";
1209  table[4192] = "gdi32.dll!NtGdiDdCreateSurfaceEx";
1210  table[4193] = "gdi32.dll!NtGdiDdSetOverlayPosition";
1211  table[4194] = "gdi32.dll!NtGdiDdUnattachSurface";
1212  table[4195] = "gdi32.dll!NtGdiDdUnlock";
1213  table[4196] = "gdi32.dll!NtGdiDdUnlockD3D";
1214  table[4197] = "gdi32.dll!NtGdiDdUpdateOverlay";
1215  table[4198] = "gdi32.dll!NtGdiDdWaitForVerticalBlank";
1216  table[4199] = "gdi32.dll!NtGdiDvpCanCreateVideoPort";
1217  table[4200] = "gdi32.dll!NtGdiDvpColorControl";
1218  table[4201] = "gdi32.dll!NtGdiDvpCreateVideoPort";
1219  table[4202] = "gdi32.dll!NtGdiDvpDestroyVideoPort";
1220  table[4203] = "gdi32.dll!NtGdiDvpFlipVideoPort";
1221  table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth";
1222  table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortField";
1223  table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus";
1224  table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats";
1225  table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortLine";
1226  table[4209] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats";
1227  table[4210] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo";
1228  table[4211] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus";
1229  table[4212] = "gdi32.dll!NtGdiDvpUpdateVideoPort";
1230  table[4213] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync";
1231  table[4214] = "gdi32.dll!NtGdiDvpAcquireNotification";
1232  table[4215] = "gdi32.dll!NtGdiDvpReleaseNotification";
1233  table[4216] = "gdi32.dll!NtGdiDxgGenericThunk";
1234  table[4218] = "gdi32.dll!NtGdiDeleteColorSpace";
1235  table[4219] = "gdi32.dll!NtGdiDeleteColorTransform";
1236  table[4221] = "gdi32.dll!NtGdiDescribePixelFormat";
1237  table[4223] = "gdi32.dll!NtGdiGetPerBandInfo";
1238  table[4224] = "gdi32.dll!NtGdiDoBanding";
1239  table[4226] = "gdi32.dll!NtGdiDrawEscape";
1240  table[4227] = "gdi32.dll!NtGdiEllipse";
1241  table[4229] = "gdi32.dll!NtGdiEndDoc";
1242  table[4230] = "gdi32.dll!NtGdiEndPage";
1243  table[4231] = "gdi32.dll!NtGdiEndPath";
1244  table[4237] = "gdi32.dll!NtGdiEudcLoadUnloadLink";
1245  table[4246] = "gdi32.dll!NtGdiFillPath";
1246  table[4248] = "gdi32.dll!NtGdiFlattenPath";
1247  table[4250] = "gdi32.dll!NtGdiForceUFIMapping";
1248  table[4251] = "gdi32.dll!NtGdiFrameRgn";
1249  table[4252] = "gdi32.dll!NtGdiFullscreenControl";
1250  table[4256] = "gdi32.dll!NtGdiGetBitmapDimension";
1251  table[4261] = "gdi32.dll!NtGdiGetCharacterPlacementW";
1252  table[4265] = "gdi32.dll!NtGdiGetColorAdjustment";
1253  table[4267] = "gdi32.dll!NtGdiGetCOPPCompatibleOPMInformation";
1254  table[4276] = "gdi32.dll!NtGdiGetETM";
1255  table[4277] = "gdi32.dll!NtGdiGetEudcTimeStampEx";
1256  table[4279] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW";
1257  table[4281] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal";
1258  table[4282] = "gdi32.dll!NtGdiGetGlyphOutline";
1259  table[4283] = "gdi32.dll!NtGdiGetOPMInformation";
1260  table[4285] = "gdi32.dll!NtGdiGetLinkedUFIs";
1261  table[4293] = "gdi32.dll!NtGdiGetPath";
1262  table[4296] = "gdi32.dll!NtGdiGetRasterizerCaps";
1263  table[4300] = "gdi32.dll!NtGdiGetServerMetaFileBits";
1264  table[4301] = "gdi32.dll!NtGdiGetSpoolMessage";
1265  table[4304] = "gdi32.dll!NtGdiGetStringBitmapW";
1266  table[4308] = "gdi32.dll!NtGdiGetTextExtent";
1267  table[4313] = "gdi32.dll!NtGdiGetUFI";
1268  table[4314] = "gdi32.dll!NtGdiGetEmbUFI";
1269  table[4315] = "gdi32.dll!NtGdiGetUFIPathname";
1270  table[4316] = "gdi32.dll!NtGdiGetEmbedFonts";
1271  table[4317] = "gdi32.dll!NtGdiChangeGhostFont";
1272  table[4318] = "gdi32.dll!NtGdiAddEmbFontToDC";
1273  table[4323] = "gdi32.dll!NtGdiIcmBrushInfo";
1274  table[4325] = "gdi32.dll!NtGdiInitSpool";
1275  table[4329] = "gdi32.dll!NtGdiMakeFontDir";
1276  table[4330] = "gdi32.dll!NtGdiMakeInfoDC";
1277  table[4335] = "gdi32.dll!NtGdiOffsetClipRgn";
1278  table[4340] = "gdi32.dll!NtGdiPathToRegion";
1279  table[4342] = "gdi32.dll!NtGdiPolyDraw";
1280  table[4344] = "gdi32.dll!NtGdiPolyTextOutW";
1281  table[4346] = "gdi32.dll!NtGdiPtVisible";
1282  table[4347] = "gdi32.dll!NtGdiQueryFonts";
1283  table[4350] = "gdi32.dll!NtGdiRectInRegion";
1284  table[4352] = "gdi32.dll!NtGdiRemoveFontResourceW";
1285  table[4353] = "gdi32.dll!NtGdiRemoveFontMemResourceEx";
1286  table[4355] = "gdi32.dll!NtGdiResizePalette";
1287  table[4359] = "gdi32.dll!NtGdiScaleViewportExtEx";
1288  table[4360] = "gdi32.dll!NtGdiScaleWindowExtEx";
1289  table[4363] = "gdi32.dll!NtGdiSelectClipPath";
1290  table[4365] = "gdi32.dll!NtGdiSelectPen";
1291  table[4368] = "gdi32.dll!NtGdiSetBitmapDimension";
1292  table[4370] = "gdi32.dll!NtGdiSetBrushAttributes";
1293  table[4372] = "gdi32.dll!NtGdiSetColorAdjustment";
1294  table[4373] = "gdi32.dll!NtGdiSetColorSpace";
1295  table[4379] = "gdi32.dll!NtGdiSetLinkedUFIs";
1296  table[4380] = "gdi32.dll!NtGdiSetMagicColors";
1297  table[4383] = "gdi32.dll!NtGdiGetDeviceWidth";
1298  table[4384] = "gdi32.dll!NtGdiMirrorWindowOrg";
1299  table[4388] = "gdi32.dll!NtGdiSetPixelFormat";
1300  table[4389] = "gdi32.dll!NtGdiSetRectRgn";
1301  table[4390] = "gdi32.dll!NtGdiSetSystemPaletteUse";
1302  table[4395] = "gdi32.dll!NtGdiStartDoc";
1303  table[4396] = "gdi32.dll!NtGdiStartPage";
1304  table[4399] = "gdi32.dll!NtGdiStrokeAndFillPath";
1305  table[4400] = "gdi32.dll!NtGdiStrokePath";
1306  table[4401] = "gdi32.dll!NtGdiSwapBuffers";
1307  table[4404] = "gdi32.dll!NtGdiUnloadPrinterDriver";
1308  table[4406] = "gdi32.dll!NtGdiUnrealizeObject";
1309  table[4407] = "gdi32.dll!NtGdiUpdateColors";
1310  table[4408] = "gdi32.dll!NtGdiWidenPath";
1311  table[4728] = "gdi32.dll!NtGdiEngAssociateSurface";
1312  table[4729] = "gdi32.dll!NtGdiEngCreateBitmap";
1313  table[4730] = "gdi32.dll!NtGdiEngCreateDeviceSurface";
1314  table[4731] = "gdi32.dll!NtGdiEngCreateDeviceBitmap";
1315  table[4733] = "gdi32.dll!NtGdiEngComputeGlyphSet";
1316  table[4734] = "gdi32.dll!NtGdiEngCopyBits";
1317  table[4736] = "gdi32.dll!NtGdiEngDeleteSurface";
1318  table[4737] = "gdi32.dll!NtGdiEngEraseSurface";
1319  table[4738] = "gdi32.dll!NtGdiEngUnlockSurface";
1320  table[4739] = "gdi32.dll!NtGdiEngLockSurface";
1321  table[4740] = "gdi32.dll!NtGdiEngBitBlt";
1322  table[4741] = "gdi32.dll!NtGdiEngStretchBlt";
1323  table[4742] = "gdi32.dll!NtGdiEngPlgBlt";
1324  table[4743] = "gdi32.dll!NtGdiEngMarkBandingSurface";
1325  table[4744] = "gdi32.dll!NtGdiEngStrokePath";
1326  table[4745] = "gdi32.dll!NtGdiEngFillPath";
1327  table[4746] = "gdi32.dll!NtGdiEngStrokeAndFillPath";
1328  table[4747] = "gdi32.dll!NtGdiEngPaint";
1329  table[4748] = "gdi32.dll!NtGdiEngLineTo";
1330  table[4749] = "gdi32.dll!NtGdiEngAlphaBlend";
1331  table[4750] = "gdi32.dll!NtGdiEngGradientFill";
1332  table[4751] = "gdi32.dll!NtGdiEngTransparentBlt";
1333  table[4752] = "gdi32.dll!NtGdiEngTextOut";
1334  table[4753] = "gdi32.dll!NtGdiEngStretchBltROP";
1335  table[4754] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette";
1336  table[4755] = "gdi32.dll!NtGdiXLATEOBJ_iXlate";
1337  table[4756] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform";
1338  table[4757] = "gdi32.dll!NtGdiCLIPOBJ_bEnum";
1339  table[4758] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart";
1340  table[4759] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath";
1341  table[4760] = "gdi32.dll!NtGdiEngDeletePath";
1342  table[4761] = "gdi32.dll!NtGdiEngCreateClip";
1343  table[4762] = "gdi32.dll!NtGdiEngDeleteClip";
1344  table[4763] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor";
1345  table[4764] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush";
1346  table[4765] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush";
1347  table[4766] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform";
1348  table[4767] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform";
1349  table[4769] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo";
1350  table[4771] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs";
1351  table[4772] = "gdi32.dll!NtGdiFONTOBJ_pifi";
1352  table[4773] = "gdi32.dll!NtGdiFONTOBJ_pfdg";
1353  table[4774] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs";
1354  table[4775] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile";
1355  table[4776] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles";
1356  table[4777] = "gdi32.dll!NtGdiSTROBJ_bEnum";
1357  table[4778] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly";
1358  table[4779] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths";
1359  table[4780] = "gdi32.dll!NtGdiSTROBJ_vEnumStart";
1360  table[4781] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage";
1361  table[4782] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds";
1362  table[4783] = "gdi32.dll!NtGdiPATHOBJ_bEnum";
1363  table[4784] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart";
1364  table[4785] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines";
1365  table[4786] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines";
1366  table[4787] = "gdi32.dll!NtGdiGetDhpdev";
1367  table[4788] = "gdi32.dll!NtGdiEngCheckAbort";
1368  table[4789] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette";
1369  table[4790] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette";
1370  table[4791] = "gdi32.dll!NtGdiUpdateTransform";
1371  table[4793] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush";
1372  table[4794] = "gdi32.dll!NtGdiUMPDEngFreeUserMem";
1373  table[4808] = "gdi32.dll!NtGdiDdDDICreateSynchronizationObject";
1374  table[4809] = "gdi32.dll!NtGdiDdDDIDestroySynchronizationObject";
1375  table[4810] = "gdi32.dll!NtGdiDdDDIWaitForSynchronizationObject";
1376  table[4811] = "gdi32.dll!NtGdiDdDDISignalSynchronizationObject";
1377  table[4812] = "gdi32.dll!NtGdiDdDDIGetRuntimeData";
1378  table[4818] = "gdi32.dll!NtGdiDdDDIGetMultisampleMethodList";
1379  table[4826] = "gdi32.dll!NtGdiDdDDIQueryStatistics";
1380  table[4829] = "gdi32.dll!NtGdiDdDDICreateOverlay";
1381  table[4830] = "gdi32.dll!NtGdiDdDDIUpdateOverlay";
1382  table[4831] = "gdi32.dll!NtGdiDdDDIFlipOverlay";
1383  table[4832] = "gdi32.dll!NtGdiDdDDIDestroyOverlay";
1384  table[4834] = "gdi32.dll!NtGdiDdDDISetGammaRamp";
1385  table[4839] = "gdi32.dll!NtGdiDdDDIGetContextSchedulingPriority";
1386  table[4841] = "gdi32.dll!NtGdiDdDDIGetProcessSchedulingPriorityClass";
1387  table[4842] = "gdi32.dll!NtGdiDdDDIReleaseProcessVidPnSourceOwners";
1388  table[4843] = "gdi32.dll!NtGdiDdDDIGetScanLine";
1389  table[4845] = "gdi32.dll!NtGdiDdDDIPollDisplayChildren";
1390  table[4846] = "gdi32.dll!NtGdiDdDDIInvalidateActiveVidPn";
1391  table[4847] = "gdi32.dll!NtGdiDdDDICheckOcclusion";
1392  table[4848] = "gdi32.dll!NtGdiDdDDIWaitForIdle";
1393  table[4851] = "gdi32.dll!NtGdiDdDDISetDisplayPrivateDriverFormat";
1394  table[4852] = "gdi32.dll!NtGdiDdDDISharedPrimaryLockNotification";
1395  table[4853] = "gdi32.dll!NtGdiDdDDISharedPrimaryUnLockNotification";
1396  table[4856] = "gdi32.dll!NtGdiGetNumberOfPhysicalMonitors";
1397  table[4857] = "gdi32.dll!NtGdiGetPhysicalMonitors";
1398  table[4858] = "gdi32.dll!NtGdiGetPhysicalMonitorDescription";
1399  table[4859] = "gdi32.dll!NtGdiDestroyPhysicalMonitor";
1400  table[4860] = "gdi32.dll!NtGdiDDCCIGetVCPFeature";
1401  table[4861] = "gdi32.dll!NtGdiDDCCISetVCPFeature";
1402  table[4862] = "gdi32.dll!NtGdiDDCCISaveCurrentSettings";
1403  table[4863] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesStringLength";
1404  table[4864] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesString";
1405  table[4865] = "gdi32.dll!NtGdiDDCCIGetTimingReport";
1406  table[0] = "ntdll.dll!NtAcceptConnectPort";
1407  table[1] = "ntdll.dll!NtAccessCheck";
1408  table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm";
1409  table[3] = "ntdll.dll!NtAccessCheckByType";
1410  table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm";
1411  table[5] = "ntdll.dll!NtAccessCheckByTypeResultList";
1412  table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm";
1413  table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle";
1414  table[8] = "ntdll.dll!NtAddAtom";
1415  table[9] = "ntdll.dll!ZwAddBootEntry";
1416  table[10] = "ntdll.dll!NtAddDriverEntry";
1417  table[11] = "ntdll.dll!ZwAdjustGroupsToken";
1418  table[12] = "ntdll.dll!ZwAdjustPrivilegesToken";
1419  table[13] = "ntdll.dll!NtAlertResumeThread";
1420  table[14] = "ntdll.dll!NtAlertThread";
1421  table[15] = "ntdll.dll!ZwAllocateLocallyUniqueId";
1422  table[16] = "ntdll.dll!NtAllocateUserPhysicalPages";
1423  table[17] = "ntdll.dll!NtAllocateUuids";
1424  table[18] = "ntdll.dll!NtAllocateVirtualMemory";
1425  table[19] = "ntdll.dll!NtAlpcAcceptConnectPort";
1426  table[20] = "ntdll.dll!ZwAlpcCancelMessage";
1427  table[21] = "ntdll.dll!ZwAlpcConnectPort";
1428  table[22] = "ntdll.dll!ZwAlpcCreatePort";
1429  table[23] = "ntdll.dll!NtAlpcCreatePortSection";
1430  table[24] = "ntdll.dll!ZwAlpcCreateResourceReserve";
1431  table[25] = "ntdll.dll!ZwAlpcCreateSectionView";
1432  table[26] = "ntdll.dll!ZwAlpcCreateSecurityContext";
1433  table[27] = "ntdll.dll!ZwAlpcDeletePortSection";
1434  table[28] = "ntdll.dll!NtAlpcDeleteResourceReserve";
1435  table[29] = "ntdll.dll!NtAlpcDeleteSectionView";
1436  table[30] = "ntdll.dll!NtAlpcDeleteSecurityContext";
1437  table[31] = "ntdll.dll!NtAlpcDisconnectPort";
1438  table[32] = "ntdll.dll!ZwAlpcImpersonateClientOfPort";
1439  table[33] = "ntdll.dll!ZwAlpcOpenSenderProcess";
1440  table[34] = "ntdll.dll!ZwAlpcOpenSenderThread";
1441  table[35] = "ntdll.dll!ZwAlpcQueryInformation";
1442  table[36] = "ntdll.dll!ZwAlpcQueryInformationMessage";
1443  table[37] = "ntdll.dll!NtAlpcRevokeSecurityContext";
1444  table[38] = "ntdll.dll!NtAlpcSendWaitReceivePort";
1445  table[39] = "ntdll.dll!NtAlpcSetInformation";
1446  table[40] = "ntdll.dll!NtApphelpCacheControl";
1447  table[41] = "ntdll.dll!ZwAreMappedFilesTheSame";
1448  table[42] = "ntdll.dll!ZwAssignProcessToJobObject";
1449  table[43] = "ntdll.dll!ZwCallbackReturn";
1450  table[44] = "ntdll.dll!NtCancelDeviceWakeupRequest";
1451  table[45] = "ntdll.dll!ZwCancelIoFile";
1452  table[46] = "ntdll.dll!ZwCancelTimer";
1453  table[47] = "ntdll.dll!NtClearEvent";
1454  table[48] = "ntdll.dll!NtClose";
1455  table[49] = "ntdll.dll!ZwCloseObjectAuditAlarm";
1456  table[50] = "ntdll.dll!NtCompactKeys";
1457  table[51] = "ntdll.dll!ZwCompareTokens";
1458  table[52] = "ntdll.dll!NtCompleteConnectPort";
1459  table[53] = "ntdll.dll!ZwCompressKey";
1460  table[54] = "ntdll.dll!NtConnectPort";
1461  table[55] = "ntdll.dll!ZwContinue";
1462  table[56] = "ntdll.dll!ZwCreateDebugObject";
1463  table[57] = "ntdll.dll!ZwCreateDirectoryObject";
1464  table[58] = "ntdll.dll!NtCreateEvent";
1465  table[59] = "ntdll.dll!NtCreateEventPair";
1466  table[60] = "ntdll.dll!NtCreateFile";
1467  table[61] = "ntdll.dll!NtCreateIoCompletion";
1468  table[62] = "ntdll.dll!ZwCreateJobObject";
1469  table[63] = "ntdll.dll!NtCreateJobSet";
1470  table[64] = "ntdll.dll!ZwCreateKey";
1471  table[65] = "ntdll.dll!NtCreateKeyTransacted";
1472  table[66] = "ntdll.dll!ZwCreateMailslotFile";
1473  table[67] = "ntdll.dll!ZwCreateMutant";
1474  table[68] = "ntdll.dll!ZwCreateNamedPipeFile";
1475  table[69] = "ntdll.dll!NtCreatePrivateNamespace";
1476  table[70] = "ntdll.dll!NtCreatePagingFile";
1477  table[71] = "ntdll.dll!ZwCreatePort";
1478  table[72] = "ntdll.dll!ZwCreateProcess";
1479  table[73] = "ntdll.dll!ZwCreateProcessEx";
1480  table[74] = "ntdll.dll!ZwCreateProfile";
1481  table[75] = "ntdll.dll!NtCreateSection";
1482  table[76] = "ntdll.dll!NtCreateSemaphore";
1483  table[77] = "ntdll.dll!ZwCreateSymbolicLinkObject";
1484  table[78] = "ntdll.dll!NtCreateThread";
1485  table[79] = "ntdll.dll!ZwCreateTimer";
1486  table[80] = "ntdll.dll!NtCreateToken";
1487  table[81] = "ntdll.dll!NtCreateTransaction";
1488  table[82] = "ntdll.dll!ZwOpenTransaction";
1489  table[83] = "ntdll.dll!ZwQueryInformationTransaction";
1490  table[84] = "ntdll.dll!NtQueryInformationTransactionManager";
1491  table[85] = "ntdll.dll!NtPrePrepareEnlistment";
1492  table[86] = "ntdll.dll!ZwPrepareEnlistment";
1493  table[87] = "ntdll.dll!NtCommitEnlistment";
1494  table[88] = "ntdll.dll!ZwReadOnlyEnlistment";
1495  table[89] = "ntdll.dll!ZwRollbackComplete";
1496  table[90] = "ntdll.dll!NtRollbackEnlistment";
1497  table[91] = "ntdll.dll!NtCommitTransaction";
1498  table[92] = "ntdll.dll!NtRollbackTransaction";
1499  table[93] = "ntdll.dll!ZwPrePrepareComplete";
1500  table[94] = "ntdll.dll!NtPrepareComplete";
1501  table[95] = "ntdll.dll!ZwCommitComplete";
1502  table[96] = "ntdll.dll!ZwSinglePhaseReject";
1503  table[97] = "ntdll.dll!ZwSetInformationTransaction";
1504  table[98] = "ntdll.dll!ZwSetInformationTransactionManager";
1505  table[99] = "ntdll.dll!ZwSetInformationResourceManager";
1506  table[100] = "ntdll.dll!ZwCreateTransactionManager";
1507  table[101] = "ntdll.dll!ZwOpenTransactionManager";
1508  table[102] = "ntdll.dll!NtRenameTransactionManager";
1509  table[103] = "ntdll.dll!NtRollforwardTransactionManager";
1510  table[104] = "ntdll.dll!NtRecoverEnlistment";
1511  table[105] = "ntdll.dll!NtRecoverResourceManager";
1512  table[106] = "ntdll.dll!ZwRecoverTransactionManager";
1513  table[107] = "ntdll.dll!ZwCreateResourceManager";
1514  table[108] = "ntdll.dll!ZwOpenResourceManager";
1515  table[109] = "ntdll.dll!ZwGetNotificationResourceManager";
1516  table[110] = "ntdll.dll!ZwQueryInformationResourceManager";
1517  table[111] = "ntdll.dll!ZwCreateEnlistment";
1518  table[112] = "ntdll.dll!ZwOpenEnlistment";
1519  table[113] = "ntdll.dll!NtSetInformationEnlistment";
1520  table[114] = "ntdll.dll!ZwQueryInformationEnlistment";
1521  table[115] = "ntdll.dll!ZwCreateWaitablePort";
1522  table[116] = "ntdll.dll!NtDebugActiveProcess";
1523  table[117] = "ntdll.dll!ZwDebugContinue";
1524  table[118] = "ntdll.dll!ZwDelayExecution";
1525  table[119] = "ntdll.dll!ZwDeleteAtom";
1526  table[120] = "ntdll.dll!NtDeleteBootEntry";
1527  table[121] = "ntdll.dll!ZwDeleteDriverEntry";
1528  table[122] = "ntdll.dll!NtDeleteFile";
1529  table[123] = "ntdll.dll!ZwDeleteKey";
1530  table[124] = "ntdll.dll!NtDeletePrivateNamespace";
1531  table[125] = "ntdll.dll!NtDeleteObjectAuditAlarm";
1532  table[126] = "ntdll.dll!NtDeleteValueKey";
1533  table[127] = "ntdll.dll!ZwDeviceIoControlFile";
1534  table[128] = "ntdll.dll!NtDisplayString";
1535  table[129] = "ntdll.dll!ZwDuplicateObject";
1536  table[130] = "ntdll.dll!NtDuplicateToken";
1537  table[131] = "ntdll.dll!ZwEnumerateBootEntries";
1538  table[132] = "ntdll.dll!NtEnumerateDriverEntries";
1539  table[133] = "ntdll.dll!ZwEnumerateKey";
1540  table[134] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx";
1541  table[135] = "ntdll.dll!ZwEnumerateTransactionObject";
1542  table[136] = "ntdll.dll!NtEnumerateValueKey";
1543  table[137] = "ntdll.dll!ZwExtendSection";
1544  table[138] = "ntdll.dll!NtFilterToken";
1545  table[139] = "ntdll.dll!NtFindAtom";
1546  table[140] = "ntdll.dll!ZwFlushBuffersFile";
1547  table[141] = "ntdll.dll!ZwFlushInstructionCache";
1548  table[142] = "ntdll.dll!NtFlushKey";
1549  table[143] = "ntdll.dll!ZwFlushProcessWriteBuffers";
1550  table[144] = "ntdll.dll!ZwFlushVirtualMemory";
1551  table[145] = "ntdll.dll!NtFlushWriteBuffer";
1552  table[146] = "ntdll.dll!NtFreeUserPhysicalPages";
1553  table[147] = "ntdll.dll!NtFreeVirtualMemory";
1554  table[148] = "ntdll.dll!NtFreezeRegistry";
1555  table[149] = "ntdll.dll!ZwFreezeTransactions";
1556  table[150] = "ntdll.dll!NtFsControlFile";
1557  table[151] = "ntdll.dll!NtGetContextThread";
1558  table[152] = "ntdll.dll!NtGetDevicePowerState";
1559  table[153] = "ntdll.dll!NtGetNlsSectionPtr";
1560  table[154] = "ntdll.dll!ZwGetPlugPlayEvent";
1561  table[155] = "ntdll.dll!NtGetWriteWatch";
1562  table[156] = "ntdll.dll!NtImpersonateAnonymousToken";
1563  table[157] = "ntdll.dll!ZwImpersonateClientOfPort";
1564  table[158] = "ntdll.dll!ZwImpersonateThread";
1565  table[159] = "ntdll.dll!ZwInitializeNlsFiles";
1566  table[160] = "ntdll.dll!ZwInitializeRegistry";
1567  table[161] = "ntdll.dll!NtInitiatePowerAction";
1568  table[162] = "ntdll.dll!ZwIsProcessInJob";
1569  table[163] = "ntdll.dll!NtIsSystemResumeAutomatic";
1570  table[164] = "ntdll.dll!ZwListenPort";
1571  table[165] = "ntdll.dll!NtLoadDriver";
1572  table[166] = "ntdll.dll!NtLoadKey";
1573  table[167] = "ntdll.dll!NtLoadKey2";
1574  table[168] = "ntdll.dll!NtLoadKeyEx";
1575  table[169] = "ntdll.dll!NtLockFile";
1576  table[170] = "ntdll.dll!ZwLockProductActivationKeys";
1577  table[171] = "ntdll.dll!NtLockRegistryKey";
1578  table[172] = "ntdll.dll!ZwLockVirtualMemory";
1579  table[173] = "ntdll.dll!ZwMakePermanentObject";
1580  table[174] = "ntdll.dll!NtMakeTemporaryObject";
1581  table[175] = "ntdll.dll!NtMapUserPhysicalPages";
1582  table[176] = "ntdll.dll!ZwMapUserPhysicalPagesScatter";
1583  table[177] = "ntdll.dll!ZwMapViewOfSection";
1584  table[178] = "ntdll.dll!NtModifyBootEntry";
1585  table[179] = "ntdll.dll!ZwModifyDriverEntry";
1586  table[180] = "ntdll.dll!NtNotifyChangeDirectoryFile";
1587  table[181] = "ntdll.dll!NtNotifyChangeKey";
1588  table[182] = "ntdll.dll!NtNotifyChangeMultipleKeys";
1589  table[183] = "ntdll.dll!ZwOpenDirectoryObject";
1590  table[184] = "ntdll.dll!NtOpenEvent";
1591  table[185] = "ntdll.dll!NtOpenEventPair";
1592  table[186] = "ntdll.dll!NtOpenFile";
1593  table[187] = "ntdll.dll!ZwOpenIoCompletion";
1594  table[188] = "ntdll.dll!ZwOpenJobObject";
1595  table[189] = "ntdll.dll!ZwOpenKey";
1596  table[190] = "ntdll.dll!NtOpenKeyTransacted";
1597  table[191] = "ntdll.dll!NtOpenMutant";
1598  table[192] = "ntdll.dll!NtOpenPrivateNamespace";
1599  table[193] = "ntdll.dll!ZwOpenObjectAuditAlarm";
1600  table[194] = "ntdll.dll!ZwOpenProcess";
1601  table[195] = "ntdll.dll!ZwOpenProcessToken";
1602  table[196] = "ntdll.dll!ZwOpenProcessTokenEx";
1603  table[197] = "ntdll.dll!NtOpenSection";
1604  table[198] = "ntdll.dll!NtOpenSemaphore";
1605  table[199] = "ntdll.dll!NtOpenSession";
1606  table[200] = "ntdll.dll!NtOpenSymbolicLinkObject";
1607  table[201] = "ntdll.dll!ZwOpenThread";
1608  table[202] = "ntdll.dll!NtOpenThreadToken";
1609  table[203] = "ntdll.dll!NtOpenThreadTokenEx";
1610  table[204] = "ntdll.dll!ZwOpenTimer";
1611  table[205] = "ntdll.dll!NtPlugPlayControl";
1612  table[206] = "ntdll.dll!ZwPowerInformation";
1613  table[207] = "ntdll.dll!ZwPrivilegeCheck";
1614  table[208] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm";
1615  table[209] = "ntdll.dll!NtPrivilegedServiceAuditAlarm";
1616  table[210] = "ntdll.dll!ZwProtectVirtualMemory";
1617  table[211] = "ntdll.dll!ZwPulseEvent";
1618  table[212] = "ntdll.dll!ZwQueryAttributesFile";
1619  table[213] = "ntdll.dll!ZwQueryBootEntryOrder";
1620  table[214] = "ntdll.dll!ZwQueryBootOptions";
1621  table[215] = "ntdll.dll!NtQueryDebugFilterState";
1622  table[216] = "ntdll.dll!NtQueryDefaultLocale";
1623  table[217] = "ntdll.dll!ZwQueryDefaultUILanguage";
1624  table[218] = "ntdll.dll!ZwQueryDirectoryFile";
1625  table[219] = "ntdll.dll!ZwQueryDirectoryObject";
1626  table[220] = "ntdll.dll!NtQueryDriverEntryOrder";
1627  table[221] = "ntdll.dll!ZwQueryEaFile";
1628  table[222] = "ntdll.dll!NtQueryEvent";
1629  table[223] = "ntdll.dll!ZwQueryFullAttributesFile";
1630  table[224] = "ntdll.dll!NtQueryInformationAtom";
1631  table[225] = "ntdll.dll!ZwQueryInformationFile";
1632  table[226] = "ntdll.dll!ZwQueryInformationJobObject";
1633  table[227] = "ntdll.dll!ZwQueryInformationPort";
1634  table[228] = "ntdll.dll!ZwQueryInformationProcess";
1635  table[229] = "ntdll.dll!NtQueryInformationThread";
1636  table[230] = "ntdll.dll!ZwQueryInformationToken";
1637  table[231] = "ntdll.dll!NtQueryInstallUILanguage";
1638  table[232] = "ntdll.dll!NtQueryIntervalProfile";
1639  table[233] = "ntdll.dll!NtQueryIoCompletion";
1640  table[234] = "ntdll.dll!ZwQueryKey";
1641  table[235] = "ntdll.dll!NtQueryMultipleValueKey";
1642  table[236] = "ntdll.dll!NtQueryMutant";
1643  table[237] = "ntdll.dll!NtQueryObject";
1644  table[238] = "ntdll.dll!NtQueryOpenSubKeys";
1645  table[239] = "ntdll.dll!NtQueryOpenSubKeysEx";
1646  table[240] = "ntdll.dll!NtQueryPerformanceCounter";
1647  table[241] = "ntdll.dll!ZwQueryQuotaInformationFile";
1648  table[242] = "ntdll.dll!ZwQuerySection";
1649  table[243] = "ntdll.dll!NtQuerySecurityObject";
1650  table[244] = "ntdll.dll!ZwQuerySemaphore";
1651  table[245] = "ntdll.dll!ZwQuerySymbolicLinkObject";
1652  table[246] = "ntdll.dll!ZwQuerySystemEnvironmentValue";
1653  table[247] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx";
1654  table[248] = "ntdll.dll!NtQuerySystemInformation";
1655  table[249] = "ntdll.dll!NtQuerySystemTime";
1656  table[250] = "ntdll.dll!ZwQueryTimer";
1657  table[251] = "ntdll.dll!NtQueryTimerResolution";
1658  table[252] = "ntdll.dll!ZwQueryValueKey";
1659  table[253] = "ntdll.dll!NtQueryVirtualMemory";
1660  table[254] = "ntdll.dll!NtQueryVolumeInformationFile";
1661  table[255] = "ntdll.dll!NtQueueApcThread";
1662  table[256] = "ntdll.dll!ZwRaiseException";
1663  table[257] = "ntdll.dll!ZwRaiseHardError";
1664  table[258] = "ntdll.dll!NtReadFile";
1665  table[259] = "ntdll.dll!NtReadFileScatter";
1666  table[260] = "ntdll.dll!ZwReadRequestData";
1667  table[261] = "ntdll.dll!NtReadVirtualMemory";
1668  table[262] = "ntdll.dll!ZwRegisterThreadTerminatePort";
1669  table[263] = "ntdll.dll!ZwReleaseMutant";
1670  table[264] = "ntdll.dll!NtReleaseSemaphore";
1671  table[265] = "ntdll.dll!ZwRemoveIoCompletion";
1672  table[266] = "ntdll.dll!ZwRemoveProcessDebug";
1673  table[267] = "ntdll.dll!ZwRenameKey";
1674  table[268] = "ntdll.dll!ZwReplaceKey";
1675  table[269] = "ntdll.dll!NtReplacePartitionUnit";
1676  table[270] = "ntdll.dll!ZwReplyPort";
1677  table[271] = "ntdll.dll!NtReplyWaitReceivePort";
1678  table[272] = "ntdll.dll!NtReplyWaitReceivePortEx";
1679  table[273] = "ntdll.dll!NtReplyWaitReplyPort";
1680  table[274] = "ntdll.dll!ZwRequestDeviceWakeup";
1681  table[275] = "ntdll.dll!ZwRequestPort";
1682  table[276] = "ntdll.dll!NtRequestWaitReplyPort";
1683  table[277] = "ntdll.dll!ZwRequestWakeupLatency";
1684  table[278] = "ntdll.dll!NtResetEvent";
1685  table[279] = "ntdll.dll!ZwResetWriteWatch";
1686  table[280] = "ntdll.dll!NtRestoreKey";
1687  table[281] = "ntdll.dll!ZwResumeProcess";
1688  table[282] = "ntdll.dll!ZwResumeThread";
1689  table[283] = "ntdll.dll!NtSaveKey";
1690  table[284] = "ntdll.dll!NtSaveKeyEx";
1691  table[285] = "ntdll.dll!NtSaveMergedKeys";
1692  table[286] = "ntdll.dll!NtSecureConnectPort";
1693  table[287] = "ntdll.dll!ZwSetBootEntryOrder";
1694  table[288] = "ntdll.dll!ZwSetBootOptions";
1695  table[289] = "ntdll.dll!ZwSetContextThread";
1696  table[290] = "ntdll.dll!NtSetDebugFilterState";
1697  table[291] = "ntdll.dll!NtSetDefaultHardErrorPort";
1698  table[292] = "ntdll.dll!NtSetDefaultLocale";
1699  table[293] = "ntdll.dll!ZwSetDefaultUILanguage";
1700  table[294] = "ntdll.dll!NtSetDriverEntryOrder";
1701  table[295] = "ntdll.dll!ZwSetEaFile";
1702  table[296] = "ntdll.dll!NtSetEvent";
1703  table[297] = "ntdll.dll!NtSetEventBoostPriority";
1704  table[298] = "ntdll.dll!NtSetHighEventPair";
1705  table[299] = "ntdll.dll!NtSetHighWaitLowEventPair";
1706  table[300] = "ntdll.dll!ZwSetInformationDebugObject";
1707  table[301] = "ntdll.dll!ZwSetInformationFile";
1708  table[302] = "ntdll.dll!ZwSetInformationJobObject";
1709  table[303] = "ntdll.dll!ZwSetInformationKey";
1710  table[304] = "ntdll.dll!ZwSetInformationObject";
1711  table[305] = "ntdll.dll!ZwSetInformationProcess";
1712  table[306] = "ntdll.dll!ZwSetInformationThread";
1713  table[307] = "ntdll.dll!ZwSetInformationToken";
1714  table[308] = "ntdll.dll!NtSetIntervalProfile";
1715  table[309] = "ntdll.dll!NtSetIoCompletion";
1716  table[310] = "ntdll.dll!ZwSetLdtEntries";
1717  table[311] = "ntdll.dll!ZwSetLowEventPair";
1718  table[312] = "ntdll.dll!ZwSetLowWaitHighEventPair";
1719  table[313] = "ntdll.dll!ZwSetQuotaInformationFile";
1720  table[314] = "ntdll.dll!NtSetSecurityObject";
1721  table[315] = "ntdll.dll!ZwSetSystemEnvironmentValue";
1722  table[316] = "ntdll.dll!ZwSetSystemEnvironmentValueEx";
1723  table[317] = "ntdll.dll!ZwSetSystemInformation";
1724  table[318] = "ntdll.dll!ZwSetSystemPowerState";
1725  table[319] = "ntdll.dll!ZwSetSystemTime";
1726  table[320] = "ntdll.dll!ZwSetThreadExecutionState";
1727  table[321] = "ntdll.dll!ZwSetTimer";
1728  table[322] = "ntdll.dll!NtSetTimerResolution";
1729  table[323] = "ntdll.dll!ZwSetUuidSeed";
1730  table[324] = "ntdll.dll!ZwSetValueKey";
1731  table[325] = "ntdll.dll!NtSetVolumeInformationFile";
1732  table[326] = "ntdll.dll!ZwShutdownSystem";
1733  table[327] = "ntdll.dll!ZwSignalAndWaitForSingleObject";
1734  table[328] = "ntdll.dll!NtStartProfile";
1735  table[329] = "ntdll.dll!ZwStopProfile";
1736  table[330] = "ntdll.dll!ZwSuspendProcess";
1737  table[331] = "ntdll.dll!ZwSuspendThread";
1738  table[332] = "ntdll.dll!NtSystemDebugControl";
1739  table[333] = "ntdll.dll!ZwTerminateJobObject";
1740  table[334] = "ntdll.dll!ZwTerminateProcess";
1741  table[335] = "ntdll.dll!ZwTerminateThread";
1742  table[336] = "ntdll.dll!NtTestAlert";
1743  table[337] = "ntdll.dll!ZwThawRegistry";
1744  table[338] = "ntdll.dll!NtThawTransactions";
1745  table[339] = "ntdll.dll!NtTraceEvent";
1746  table[340] = "ntdll.dll!ZwTraceControl";
1747  table[341] = "ntdll.dll!NtTranslateFilePath";
1748  table[342] = "ntdll.dll!ZwUnloadDriver";
1749  table[343] = "ntdll.dll!NtUnloadKey";
1750  table[344] = "ntdll.dll!ZwUnloadKey2";
1751  table[345] = "ntdll.dll!ZwUnloadKeyEx";
1752  table[346] = "ntdll.dll!ZwUnlockFile";
1753  table[347] = "ntdll.dll!NtUnlockVirtualMemory";
1754  table[348] = "ntdll.dll!NtUnmapViewOfSection";
1755  table[349] = "ntdll.dll!NtVdmControl";
1756  table[350] = "ntdll.dll!NtWaitForDebugEvent";
1757  table[351] = "ntdll.dll!NtWaitForMultipleObjects";
1758  table[352] = "ntdll.dll!ZwWaitForSingleObject";
1759  table[353] = "ntdll.dll!ZwWaitHighEventPair";
1760  table[354] = "ntdll.dll!NtWaitLowEventPair";
1761  table[355] = "ntdll.dll!NtWriteFile";
1762  table[356] = "ntdll.dll!NtWriteFileGather";
1763  table[357] = "ntdll.dll!NtWriteRequestData";
1764  table[358] = "ntdll.dll!NtWriteVirtualMemory";
1765  table[359] = "ntdll.dll!ZwYieldExecution";
1766  table[360] = "ntdll.dll!ZwCreateKeyedEvent";
1767  table[361] = "ntdll.dll!NtOpenKeyedEvent";
1768  table[362] = "ntdll.dll!NtReleaseKeyedEvent";
1769  table[363] = "ntdll.dll!NtWaitForKeyedEvent";
1770  table[364] = "ntdll.dll!ZwQueryPortInformationProcess";
1771  table[365] = "ntdll.dll!NtGetCurrentProcessorNumber";
1772  table[366] = "ntdll.dll!NtWaitForMultipleObjects32";
1773  table[367] = "ntdll.dll!ZwGetNextProcess";
1774  table[368] = "ntdll.dll!ZwGetNextThread";
1775  table[369] = "ntdll.dll!NtCancelIoFileEx";
1776  table[370] = "ntdll.dll!NtCancelSynchronousIoFile";
1777  table[371] = "ntdll.dll!ZwRemoveIoCompletionEx";
1778  table[372] = "ntdll.dll!ZwRegisterProtocolAddressInformation";
1779  table[373] = "ntdll.dll!NtPropagationComplete";
1780  table[374] = "ntdll.dll!ZwPropagationFailed";
1781  table[375] = "ntdll.dll!NtCreateWorkerFactory";
1782  table[376] = "ntdll.dll!ZwReleaseWorkerFactoryWorker";
1783  table[377] = "ntdll.dll!NtWaitForWorkViaWorkerFactory";
1784  table[378] = "ntdll.dll!ZwSetInformationWorkerFactory";
1785  table[379] = "ntdll.dll!ZwQueryInformationWorkerFactory";
1786  table[380] = "ntdll.dll!NtWorkerFactoryWorkerReady";
1787  table[381] = "ntdll.dll!NtShutdownWorkerFactory";
1788  table[382] = "ntdll.dll!NtCreateThreadEx";
1789  table[383] = "ntdll.dll!NtCreateUserProcess";
1790  table[384] = "ntdll.dll!NtQueryLicenseValue";
1791  table[385] = "ntdll.dll!ZwMapCMFModule";
1792  table[386] = "ntdll.dll!ZwIsUILanguageComitted";
1793  table[387] = "ntdll.dll!ZwFlushInstallUILanguage";
1794  table[388] = "ntdll.dll!NtGetMUIRegistryInfo";
1795  table[389] = "ntdll.dll!ZwAcquireCMFViewOwnership";
1796  table[390] = "ntdll.dll!NtReleaseCMFViewOwnership";
1797  table[4545] = "imm32.dll!NtUserGetThreadState";
1798  table[4520] = "imm32.dll!NtUserGetImeInfoEx";
1799  table[4600] = "imm32.dll!NtUserQueryWindow";
1800  table[4598] = "imm32.dll!NtUserQueryInputContext";
1801  table[4581] = "imm32.dll!NtUserNotifyIMEStatus";
1802  table[4412] = "imm32.dll!NtUserAssociateInputContext";
1803  table[4429] = "imm32.dll!NtUserCallOneParam";
1804  table[4463] = "imm32.dll!NtUserDisableThreadIme";
1805  table[4635] = "imm32.dll!NtUserSetImeInfoEx";
1806  table[4697] = "imm32.dll!NtUserUpdateInputContext";
1807  table[4417] = "imm32.dll!NtUserBuildHimcList";
1808  table[4704] = "imm32.dll!NtUserValidateHandleSecure";
1809  table[4450] = "imm32.dll!NtUserCreateInputContext";
1810  table[4460] = "imm32.dll!NtUserDestroyInputContext";
1811  table[4492] = "imm32.dll!NtUserGetAppImeLevel";
1812  table[4519] = "imm32.dll!NtUserGetImeHotKey";
1813  table[4623] = "imm32.dll!NtUserSetAppImeLevel";
1814  table[4657] = "imm32.dll!NtUserSetThreadLayoutHandles";
1815  table[4560] = "user32.dll!NtUserInitializeClientPfnArrays";
1816  table[4596] = "user32.dll!NtUserProcessConnect";
1817  table[4453] = "user32.dll!NtUserCreateWindowStation";
1818  table[4449] = "user32.dll!NtUserCreateDesktopEx";
1819  table[4695] = "user32.dll!NtUserUnregisterUserApiHook";
1820  table[4607] = "user32.dll!NtUserRegisterUserApiHook";
1821  table[4634] = "user32.dll!NtUserSetImeHotKey";
1822  table[4670] = "user32.dll!NtUserSetWindowStationUser";
1823  table[4568] = "user32.dll!NtUserLoadKeyboardLayoutEx";
1824  table[4702] = "user32.dll!NtUserUpdatePerUserSystemParameters";
1825  table[4465] = "user32.dll!NtUserDoSoundConnect";
1826  table[4720] = "user32.dll!NtUserRegisterSessionPort";
1827  table[4423] = "user32.dll!NtUserCallHwndOpt";
1828  table[4651] = "user32.dll!NtUserSetShellWindowEx";
1829  table[4421] = "user32.dll!NtUserCallHwnd";
1830  table[4723] = "user32.dll!NtUserDwmStartRedirection";
1831  table[4609] = "user32.dll!NtUserRegisterRawInputDevices";
1832  table[4495] = "user32.dll!NtUserGetCaretBlinkTime";
1833  table[4681] = "user32.dll!NtUserThunkedMenuInfo";
1834  table[4570] = "user32.dll!NtUserLockWindowUpdate";
1835  table[4445] = "user32.dll!NtUserCopyAcceleratorTable";
1836  table[4478] = "user32.dll!NtUserEndMenu";
1837  table[4458] = "user32.dll!DestroyAcceleratorTable";
1838  table[4625] = "user32.dll!NtUserSetClassLong";
1839  table[4613] = "user32.dll!NtUserRemoveMenu";
1840  table[4643] = "user32.dll!NtUserSetMenuDefaultItem";
1841  table[4461] = "user32.dll!NtUserDestroyMenu";
1842  table[4553] = "user32.dll!NtUserGhostWindowFromHungWindow";
1843  table[4590] = "user32.dll!NtUserPaintMonitor";
1844  table[4589] = "user32.dll!NtUserPaintDesktop";
1845  table[4454] = "user32.dll!NtUserDdeInitialize";
1846  table[4663] = "user32.dll!NtUserSetWindowPlacement";
1847  table[4669] = "user32.dll!NtUserSetWindowsHookEx";
1848  table[4457] = "user32.dll!NtUserDeleteMenu";
1849  table[4565] = "user32.dll!NtUserInvalidateRgn";
1850  table[4638] = "user32.dll!NtUserSetInformationThread";
1851  table[4493] = "user32.dll!NtUserGetAsyncKeyState";
1852  table[4434] = "user32.dll!NtUserCheckDesktopByThreadId";
1853  table[4727] = "user32.dll!NtUserGetWindowMinimizeRect";
1854  table[4672] = "user32.dll!NtUserSetWinEventHook";
1855  table[4508] = "user32.dll!NtUserGetCPD";
1856  table[4665] = "user32.dll!NtUserSetWindowRgn";
1857  table[4569] = "user32.dll!NtUserLockWindowStation";
1858  table[4485] = "user32.dll!NtUserFillWindow";
1859  table[4677] = "user32.dll!NtUserSoundSentry";
1860  table[4696] = "user32.dll!NtUserUnregisterHotKey";
1861  table[4524] = "user32.dll!NtUserGetKeyboardState";
1862  table[4691] = "user32.dll!NtUserUnhookWinEvent";
1863  table[4621] = "user32.dll!NtUserSendInput";
1864  table[4658] = "user32.dll!NtUserSetThreadState";
1865  table[4624] = "user32.dll!NtUserSetCapture";
1866  table[4633] = "user32.dll!NtUserSetFocus";
1867  table[4636] = "user32.dll!NtUserSetImeOwnerWindow";
1868  table[4425] = "user32.dll!NtUserCallHwndParamLock";
1869  table[4686] = "user32.dll!NtUserCalcMenuBar";
1870  table[4546] = "user32.dll!NtUserGetTitleBarInfo";
1871  table[4512] = "user32.dll!NtUserGetDCEx";
1872  table[4528] = "user32.dll!NtUserGetMenuBarInfo";
1873  table[4678] = "user32.dll!NtUserSwitchDesktop";
1874  table[4522] = "user32.dll!NtUserGetKeyboardLayoutList";
1875  table[4675] = "user32.dll!NtUserShowWindow";
1876  table[4660] = "user32.dll!NtUserSetProcessDPIAware";
1877  table[4646] = "user32.dll!NtUserSetParent";
1878  table[4693] = "user32.dll!NtUserUnlockWindowStation";
1879  table[4684] = "user32.dll!NtUserTrackMouseEvent";
1880  table[4608] = "user32.dll!NtUserRegisterHotKey";
1881  table[4701] = "user32.dll!NtUserSetLayeredWindowAttributes";
1882  table[4580] = "user32.dll!NtUserMoveWindow";
1883  table[4699] = "user32.dll!NtUserUpdateLayeredWindow";
1884  table[4542] = "user32.dll!NtUserGetScrollBarInfo";
1885  table[4447] = "user32.dll!NtUserCreateAcceleratorTable";
1886  table[4630] = "user32.dll!NtUserSetCursor";
1887  table[4586] = "user32.dll!NtUserOpenInputDesktop";
1888  table[4514] = "user32.dll!NtUserGetForegroundWindow";
1889  table[4548] = "user32.dll!GetUpdateRect";
1890  table[4656] = "user32.dll!NtUserSetThreadDesktop";
1891  table[4536] = "user32.dll!NtUserGetProcessWindowStation";
1892  table[4647] = "user32.dll!NtUserSetProcessWindowStation";
1893  table[4605] = "user32.dll!NtUserRegisterClassExWOW";
1894  table[4494] = "user32.dll!NtUserGetAtomName";
1895  table[4697] = "user32.dll!NtUserUpdateInputContext";
1896  table[4661] = "user32.dll!NtUserSetWindowFNID";
1897  table[4498] = "user32.dll!NtUserGetClassName";
1898  table[4516] = "user32.dll!NtUserGetGUIThreadInfo";
1899  table[4585] = "user32.dll!NtUserOpenDesktop";
1900  table[4419] = "user32.dll!NtUserBuildNameList";
1901  table[4617] = "user32.dll!NtUserSBGetParms";
1902  table[4674] = "user32.dll!NtUserShowScrollBar";
1903  table[4588] = "user32.dll!NtUserOpenWindowStation";
1904  table[4694] = "user32.dll!NtUserUnregisterClass";
1905  table[4481] = "user32.dll!NtUserEnumDisplayMonitors";
1906  table[4462] = "user32.dll!NtUserDestroyWindow";
1907  table[4441] = "user32.dll!NtUserCloseDesktop";
1908  table[4459] = "user32.dll!NtUserDestroyCursor";
1909  table[4442] = "user32.dll!NtUserCloseWindowStation";
1910  table[4418] = "user32.dll!NtUserBuildHwndList";
1911  table[4594] = "user32.dll!NtUserPostThreadMessage";
1912  table[4614] = "user32.dll!NtUserRemoveProp";
1913  table[4662] = "user32.dll!NtUserSetWindowLong";
1914  table[4664] = "user32.dll!NtUserSetWindowPos";
1915  table[4422] = "user32.dll!NtUserCallHwndLock";
1916  table[4649] = "user32.dll!NtUserSetProp";
1917  table[4477] = "user32.dll!NtUserEndDeferWindowPosEx";
1918  table[4455] = "user32.dll!NtUserDeferWindowPos";
1919  table[4632] = "user32.dll!NtUserSetCursorIconData";
1920  table[4486] = "user32.dll!NtUserFindExistingCursorIcon";
1921  table[4533] = "user32.dll!NtUserGetObjectInformation";
1922  table[4452] = "user32.dll!NtUserCreateWindowEx";
1923  table[4682] = "user32.dll!NtUserThunkedMenuItemInfo";
1924  table[4543] = "user32.dll!NtUserGetSystemMenu";
1925  table[4676] = "user32.dll!NtUserShowWindowAsync";
1926  table[4600] = "user32.dll!NtUserQueryWindow";
1927  table[4517] = "user32.dll!NtUserGetIconInfo";
1928  table[4518] = "user32.dll!NtUserGetIconSize";
1929  table[4583] = "user32.dll!NtUserNotifyWinEvent";
1930  table[4562] = "user32.dll!NtUserInternalGetWindowText";
1931  table[4666] = "user32.dll!NtUserGetWindowRgnEx";
1932  table[4472] = "user32.dll!NtUserDrawIconEx";
1933  table[4424] = "user32.dll!NtUserCallHwndParam";
1934  table[4409] = "user32.dll!NtUserActivateKeyboardLayout";
1935  table[4629] = "user32.dll!NtUserSetConsoleReserveKeys";
1936  table[4557] = "user32.dll!NtUserHungWindowFromGhostWindow";
1937  table[4622] = "user32.dll!NtUserSetActiveWindow";
1938  table[4544] = "user32.dll!NtUserGetThreadDesktop";
1939  table[4497] = "user32.dll!NtUserGetClassInfoEx";
1940  table[4480] = "user32.dll!NtUserEnumDisplayDevices";
1941  table[4482] = "user32.dll!NtUserEnumDisplaySettings";
1942  table[4650] = "user32.dll!NtUserSetScrollInfo";
1943  table[4526] = "user32.dll!NtUserGetKeyState";
1944  table[4575] = "user32.dll!NtUserMessageCall";
1945  table[4706] = "user32.dll!NtUserValidateTimerCallback";
1946  table[4611] = "user32.dll!NtUserRegisterWindowMessage";
1947  table[4511] = "user32.dll!NtUserGetDC";
1948  table[4602] = "user32.dll!NtUserRealInternalGetMessage";
1949  table[4487] = "user32.dll!NtUserFindWindowEx";
1950  table[4500] = "user32.dll!NtUserGetClipboardFormatName";
1951  table[4545] = "user32.dll!NtUserGetThreadState";
1952  table[4679] = "user32.dll!NtUserSystemParametersInfo";
1953  table[4593] = "user32.dll!NtUserPostMessage";
1954  table[4659] = "user32.dll!NtUserSetTimer";
1955  table[4567] = "user32.dll!NtUserKillTimer";
1956  table[4414] = "user32.dll!NtUserBeginPaint";
1957  table[4479] = "user32.dll!NtUserEndPaint";
1958  table[4604] = "user32.dll!NtUserRedrawWindow";
1959  table[4491] = "user32.dll!NtUserGetAncestor";
1960  table[4555] = "user32.dll!NtUserHideCaret";
1961  table[4673] = "user32.dll!NtUserShowCaret";
1962  table[4448] = "user32.dll!NtUserCreateCaret";
1963  table[4531] = "user32.dll!NtUserGetMessage";
1964  table[4591] = "user32.dll!PeekMessageW";
1965  table[4429] = "user32.dll!NtUserCallOneParam";
1966  table[4428] = "user32.dll!NtUserCallNoParam";
1967  table[4464] = "user32.dll!NtUserDispatchMessage";
1968  table[4648] = "user32.dll!NtUserGetProp";
1969  table[4550] = "user32.dll!NtUserGetWindowDC";
1970  table[4513] = "user32.dll!NtUserGetDoubleClickTime";
1971  table[4710] = "user32.dll!NtUserWaitMessage";
1972  table[4564] = "user32.dll!NtUserInvalidateRect";
1973  table[4430] = "user32.dll!NtUserCallTwoParam";
1974  table[4618] = "user32.dll!NtUserScrollDC";
1975  table[4704] = "user32.dll!NtUserValidateHandleSecure";
1976  table[4439] = "user32.dll!NtUserClipCursor";
1977  table[4571] = "user32.dll!NtUserLockWorkStation";
1978  table[4724] = "user32.dll!NtUserDwmStopRedirection";
1979  table[4534] = "user32.dll!NtUserGetOpenClipboardWindow";
1980  table[4484] = "user32.dll!NtUserExcludeUpdateRgn";
1981  table[4707] = "user32.dll!NtUserVkKeyScanEx";
1982  table[4654] = "user32.dll!NtUserSetSystemMenu";
1983  table[4438] = "user32.dll!NtUserChildWindowFromPointEx";
1984  table[4671] = "user32.dll!NtUserSetWindowWord";
1985  table[4476] = "user32.dll!NtUserEnableScrollBar";
1986  table[4415] = "user32.dll!NtUserBitBltSysBmp";
1987  table[4509] = "user32.dll!NtUserGetCursorFrameInfo";
1988  table[4427] = "user32.dll!NtUserCallNextHookEx";
1989  table[4628] = "user32.dll!NtUserSetClipboardViewer";
1990  table[4437] = "user32.dll!CheckMenuItem";
1991  table[4566] = "user32.dll!NtUserIsClipboardFormatAvailable";
1992  table[4440] = "user32.dll!NtUserCloseClipboard";
1993  table[4584] = "user32.dll!NtUserOpenClipboard";
1994  table[4502] = "user32.dll!NtUserGetClipboardSequenceNumber";
1995  table[4431] = "user32.dll!NtUserChangeClipboardChain";
1996  table[4688] = "user32.dll!NtUserTranslateAccelerator";
1997  table[4705] = "user32.dll!NtUserValidateRect";
1998  table[4667] = "user32.dll!NtUserSetWindowRgnEx";
1999  table[4475] = "user32.dll!NtUserEnableMenuItem";
2000  table[4496] = "user32.dll!NtUserGetCaretPos";
2001  table[4505] = "user32.dll!NtUserGetComboBoxInfo";
2002  table[4426] = "user32.dll!NtUserCallMsgFilter";
2003  table[4690] = "user32.dll!NtUserUnhookWindowsHookEx";
2004  table[4416] = "user32.dll!NtUserBlockInput";
2005  table[4595] = "user32.dll!NtUserPrintWindow";
2006  table[4501] = "user32.dll!NtUserGetClipboardOwner";
2007  table[4413] = "user32.dll!NtUserAttachThreadInput";
2008  table[4446] = "user32.dll!NtUserCountClipboardFormats";
2009  table[4572] = "user32.dll!NtUserLogicalToPhysicalPoint";
2010  table[4592] = "user32.dll!NtUserPhysicalToLogicalPoint";
2011  table[4712] = "user32.dll!NtUserWindowFromPhysicalPoint";
2012  table[4685] = "user32.dll!NtUserTrackPopupMenuEx";
2013  table[4641] = "user32.dll!NtUserSetMenu";
2014  table[4432] = "user32.dll!NtUserChangeDisplaySettings";
2015  table[4726] = "user32.dll!NtUserDwmGetDxRgn";
2016  table[4725] = "user32.dll!NtUserDwmHintDxUpdate";
2017  table[4573] = "user32.dll!NtUserMapVirtualKeyEx";
2018  table[4640] = "user32.dll!NtUserSetKeyboardState";
2019  table[4708] = "user32.dll!NtUserWaitForInputIdle";
2020  table[4549] = "user32.dll!NtUserGetUpdateRgn";
2021  table[4456] = "user32.dll!NtUserDefSetText";
2022  table[4506] = "user32.dll!NtUserGetControlBrush";
2023  table[4488] = "user32.dll!NtUserFlashWindowEx";
2024  table[4689] = "user32.dll!NtUserTranslateMessage";
2025  table[4619] = "user32.dll!NtUserScrollWindowEx";
2026  table[4687] = "user32.dll!NtUserPaintMenuBar";
2027  table[4551] = "user32.dll!NtUserGetWindowPlacement";
2028  table[4713] = "user32.dll!NtUserWindowFromPoint";
2029  table[4410] = "user32.dll!NtUserAddClipboardFormatListener";
2030  table[4411] = "user32.dll!NtUserAlterWindowStyle";
2031  table[4420] = "user32.dll!NtUserBuildPropList";
2032  table[4433] = "user32.dll!NtUserCheckAccessForIntegrityLevel";
2033  table[4435] = "user32.dll!NtUserCheckWindowThreadDesktop";
2034  table[4444] = "user32.dll!NtUserConvertMemHandle";
2035  table[4451] = "user32.dll!NtUserCreateLocalMemHandle";
2036  table[4466] = "user32.dll!NtUserDoSoundDisconnect";
2037  table[4467] = "user32.dll!NtUserDragDetect";
2038  table[4468] = "user32.dll!NtUserDragObject";
2039  table[4469] = "user32.dll!NtUserDrawAnimatedRects";
2040  table[4470] = "user32.dll!NtUserDrawCaption";
2041  table[4471] = "user32.dll!NtUserDrawCaptionTemp";
2042  table[4473] = "user32.dll!NtUserDrawMenuBarTemp";
2043  table[4474] = "user32.dll!NtUserEmptyClipboard";
2044  table[4483] = "user32.dll!NtUserEvent";
2045  table[4489] = "user32.dll!NtUserFrostCrashedWindow";
2046  table[4490] = "user32.dll!NtUserGetAltTabInfo";
2047  table[4499] = "user32.dll!NtUserGetClipboardData";
2048  table[4503] = "user32.dll!NtUserGetClipboardViewer";
2049  table[4504] = "user32.dll!NtUserGetClipCursor";
2050  table[4507] = "user32.dll!NtUserGetControlColor";
2051  table[4510] = "user32.dll!NtUserGetCursorInfo";
2052  table[4515] = "user32.dll!NtUserGetGuiResources";
2053  table[4519] = "user32.dll!NtUserGetImeHotKey";
2054  table[4521] = "user32.dll!NtUserGetInternalWindowPos";
2055  table[4523] = "user32.dll!NtUserGetKeyboardLayoutName";
2056  table[4525] = "user32.dll!NtUserGetKeyNameText";
2057  table[4527] = "user32.dll!NtUserGetListBoxInfo";
2058  table[4529] = "user32.dll!NtUserGetMenuIndex";
2059  table[4530] = "user32.dll!NtUserGetMenuItemRect";
2060  table[4532] = "user32.dll!NtUserGetMouseMovePointsEx";
2061  table[4535] = "user32.dll!NtUserGetPriorityClipboardFormat";
2062  table[4537] = "user32.dll!NtUserGetRawInputBuffer";
2063  table[4538] = "user32.dll!NtUserGetRawInputData";
2064  table[4539] = "user32.dll!NtUserGetRawInputDeviceInfo";
2065  table[4540] = "user32.dll!NtUserGetRawInputDeviceList";
2066  table[4541] = "user32.dll!NtUserGetRegisteredRawInputDevices";
2067  table[4547] = "user32.dll!NtUserGetUpdatedClipboardFormats";
2068  table[4552] = "user32.dll!NtUserGetWOWClass";
2069  table[4556] = "user32.dll!NtUserHiliteMenuItem";
2070  table[4558] = "user32.dll!NtUserImpersonateDdeClientWindow";
2071  table[4561] = "user32.dll!NtUserInitTask";
2072  table[4563] = "user32.dll!NtUserInternalGetWindowIcon";
2073  table[4574] = "user32.dll!NtUserMenuItemFromPoint";
2074  table[4576] = "user32.dll!NtUserMinMaximize";
2075  table[4577] = "user32.dll!NtUserMNDragLeave";
2076  table[4578] = "user32.dll!NtUserMNDragOver";
2077  table[4579] = "user32.dll!NtUserModifyUserStartupInfoFlags";
2078  table[4581] = "user32.dll!NtUserNotifyIMEStatus";
2079  table[4587] = "user32.dll!NtUserOpenThreadDesktop";
2080  table[4599] = "user32.dll!NtUserQuerySendMessage";
2081  table[4601] = "user32.dll!NtUserRealChildWindowFromPoint";
2082  table[4603] = "user32.dll!NtUserRealWaitMessageEx";
2083  table[4606] = "user32.dll!NtUserRegisterErrorReportingDialog";
2084  table[4610] = "user32.dll!NtUserRegisterTasklist";
2085  table[4612] = "user32.dll!NtUserRemoveClipboardFormatListener";
2086  table[4616] = "user32.dll!NtUserResolveDesktopForWOW";
2087  table[4626] = "user32.dll!NtUserSetClassWord";
2088  table[4627] = "user32.dll!NtUserSetClipboardData";
2089  table[4631] = "user32.dll!NtUserSetCursorContents";
2090  table[4639] = "user32.dll!NtUserSetInternalWindowPos";
2091  table[4642] = "user32.dll!NtUserSetMenuContextHelpId";
2092  table[4644] = "user32.dll!NtUserSetMenuFlagRtoL";
2093  table[4645] = "user32.dll!NtUserSetObjectInformation";
2094  table[4652] = "user32.dll!NtUserSetSysColors";
2095  table[4653] = "user32.dll!NtUserSetSystemCursor";
2096  table[4655] = "user32.dll!NtUserSetSystemTimer";
2097  table[4668] = "user32.dll!NtUserSetWindowsHookAW";
2098  table[4680] = "user32.dll!NtUserTestForInteractiveUser";
2099  table[4683] = "user32.dll!NtUserToUnicodeEx";
2100  table[4692] = "user32.dll!NtUserUnloadKeyboardLayout";
2101  table[4698] = "user32.dll!NtUserUpdateInstance";
2102  table[4700] = "user32.dll!NtUserGetLayeredWindowAttributes";
2103  table[4703] = "user32.dll!NtUserUserHandleGrantAccess";
2104  table[4709] = "user32.dll!NtUserWaitForMsgAndEvent";
2105  table[4711] = "user32.dll!NtUserWin32PoolAllocationStats";
2106  table[4714] = "user32.dll!NtUserYieldTask";
2107  table[4721] = "user32.dll!NtUserUnregisterSessionPort";
2108  table[4722] = "user32.dll!NtUserUpdateWindowTransform";
2109  table[4866] = "user32.dll!NtUserSetMirrorRendering";
2110  table[4867] = "user32.dll!NtUserShowSystemCursor";
2111}
2112
2113  return table;
2114}
2115
2116#endif  // TRACELINE_SYSCALL_MAP_H_
2117