Log in

View Full Version : Pythonic way


Hex Blog
March 6th, 2008, 19:50
A brilliant blog post by Ero Carrera: IDAPython ("http://code.google.com/p/idapython/") in action:

http://blog.dkbza.org/2008/03/digging-up-system-call-ordinals.html

Just note how concise and powerful is the script!




http://hexblog.com/2008/03/pythonic_way.html

blabberer
March 7th, 2008, 12:47
i dont know why that should be termed brilliant

and i think the list is incomplete as well ntdll has more than 0xff ordinals that go through syscall hoop

and you can do it in three clicks with ollydbg

right click --> search for all sequences

Code:

mov r32,const
mov r32,const
call dword ptr ds:[edx]


result as follows

Code:

Found sequences
Address Disassembly Comment
7C90D379 ntdll.ZwAcceptConnectPort MOV EAX,0
7C90D38E ntdll.ZwAccessCheck MOV EAX,1
7C90D3A3 ntdll.ZwAccessCheckAndAuditAlarm MOV EAX,2
7C90D3B8 ntdll.ZwAccessCheckByType MOV EAX,3
7C90D3CD ntdll.ZwAccessCheckByTypeAndAuditAlarm MOV EAX,4
7C90D3E2 ntdll.ZwAccessCheckByTypeResultList MOV EAX,5
7C90D3F7 ntdll.ZwAccessCheckByTypeResultListAndAuditAlarm MOV EAX,6
7C90D40C ntdll.ZwAccessCheckByTypeResultListAndAuditAlarmByHandle MOV EAX,7
7C90D421 ntdll.ZwAddAtom MOV EAX,8
7C90D436 ntdll.ZwAddBootEntry MOV EAX,9
7C90D44B ntdll.ZwAdjustGroupsToken MOV EAX,0A
7C90D460 ntdll.ZwAdjustPrivilegesToken MOV EAX,0B
7C90D475 ntdll.ZwAlertResumeThread MOV EAX,0C
7C90D48A ntdll.ZwAlertThread MOV EAX,0D
7C90D49F ntdll.ZwAllocateLocallyUniqueId MOV EAX,0E
7C90D4B4 ntdll.ZwAllocateUserPhysicalPages MOV EAX,0F
7C90D4C9 ntdll.ZwAllocateUuids MOV EAX,10
7C90D4DE ntdll.ZwAllocateVirtualMemory MOV EAX,11
7C90D4F3 ntdll.ZwAreMappedFilesTheSame MOV EAX,12
7C90D508 ntdll.ZwAssignProcessToJobObject MOV EAX,13
7C90D51D ntdll.ZwCallbackReturn MOV EAX,14
7C90D532 ntdll.ZwCancelDeviceWakeupRequest MOV EAX,15
7C90D547 ntdll.ZwCancelIoFile MOV EAX,16
7C90D55C ntdll.ZwCancelTimer MOV EAX,17
7C90D571 ntdll.ZwClearEvent MOV EAX,18
7C90D586 ntdll.ZwClose MOV EAX,19
7C90D59B ntdll.ZwCloseObjectAuditAlarm MOV EAX,1A
7C90D5B0 ntdll.ZwCompactKeys MOV EAX,1B
7C90D5C5 ntdll.ZwCompareTokens MOV EAX,1C
7C90D5DA ntdll.ZwCompleteConnectPort MOV EAX,1D
7C90D5EF ntdll.ZwCompressKey MOV EAX,1E
7C90D604 ntdll.ZwConnectPort MOV EAX,1F
7C90D619 ntdll.ZwContinue MOV EAX,20
7C90D62E ntdll.ZwCreateDebugObject MOV EAX,21
7C90D643 ntdll.ZwCreateDirectoryObject MOV EAX,22
7C90D658 ntdll.ZwCreateEvent MOV EAX,23
7C90D66D ntdll.ZwCreateEventPair MOV EAX,24
7C90D682 ntdll.ZwCreateFile MOV EAX,25
7C90D697 ntdll.ZwCreateIoCompletion MOV EAX,26
7C90D6AC ntdll.ZwCreateJobObject MOV EAX,27
7C90D6C1 ntdll.ZwCreateJobSet MOV EAX,28
7C90D6D6 ntdll.ZwCreateKey MOV EAX,29
7C90D6EB ntdll.ZwCreateMailslotFile MOV EAX,2A
7C90D700 ntdll.ZwCreateMutant MOV EAX,2B
7C90D715 ntdll.ZwCreateNamedPipeFile MOV EAX,2C
7C90D72A ntdll.ZwCreatePagingFile MOV EAX,2D
7C90D73F ntdll.ZwCreatePort MOV EAX,2E
7C90D754 ntdll.ZwCreateProcess MOV EAX,2F
7C90D769 ntdll.ZwCreateProcessEx MOV EAX,30
7C90D77E ntdll.ZwCreateProfile MOV EAX,31
7C90D793 ntdll.ZwCreateSection MOV EAX,32
7C90D7A8 ntdll.ZwCreateSemaphore MOV EAX,33
7C90D7BD ntdll.ZwCreateSymbolicLinkObject MOV EAX,34
7C90D7D2 ntdll.ZwCreateThread MOV EAX,35
7C90D7E7 ntdll.ZwCreateTimer MOV EAX,36
7C90D7FC ntdll.ZwCreateToken MOV EAX,37
7C90D811 ntdll.ZwCreateWaitablePort MOV EAX,38
7C90D826 ntdll.ZwDebugActiveProcess MOV EAX,39
7C90D83B ntdll.ZwDebugContinue MOV EAX,3A
7C90D850 ntdll.ZwDelayExecution MOV EAX,3B
7C90D865 ntdll.ZwDeleteAtom MOV EAX,3C
7C90D87A ntdll.ZwDeleteBootEntry MOV EAX,3D
7C90D88F ntdll.ZwDeleteFile MOV EAX,3E
7C90D8A4 ntdll.ZwDeleteKey MOV EAX,3F
7C90D8B9 ntdll.ZwDeleteObjectAuditAlarm MOV EAX,40
7C90D8CE ntdll.ZwDeleteValueKey MOV EAX,41
7C90D8E3 ntdll.ZwDeviceIoControlFile MOV EAX,42
7C90D8F8 ntdll.ZwDisplayString MOV EAX,43
7C90D90D ntdll.ZwDuplicateObject MOV EAX,44
7C90D922 ntdll.ZwDuplicateToken MOV EAX,45
7C90D937 ntdll.ZwEnumerateBootEntries MOV EAX,46
7C90D94C ntdll.ZwEnumerateKey MOV EAX,47
7C90D961 ntdll.ZwEnumerateSystemEnvironmentValuesEx MOV EAX,48
7C90D976 ntdll.ZwEnumerateValueKey MOV EAX,49
7C90D98B ntdll.ZwExtendSection MOV EAX,4A
7C90D9A0 ntdll.ZwFilterToken MOV EAX,4B
7C90D9B5 ntdll.ZwFindAtom MOV EAX,4C
7C90D9CA ntdll.ZwFlushBuffersFile MOV EAX,4D
7C90D9DF ntdll.ZwFlushInstructionCache MOV EAX,4E
7C90D9F4 ntdll.ZwFlushKey MOV EAX,4F
7C90DA09 ntdll.ZwFlushVirtualMemory MOV EAX,50
7C90DA1E ntdll.ZwFlushWriteBuffer MOV EAX,51
7C90DA33 ntdll.ZwFreeUserPhysicalPages MOV EAX,52
7C90DA48 ntdll.ZwFreeVirtualMemory MOV EAX,53
7C90DA5D ntdll.ZwFsControlFile MOV EAX,54
7C90DA72 ntdll.ZwGetContextThread MOV EAX,55
7C90DA87 ntdll.ZwGetDevicePowerState MOV EAX,56
7C90DA9C ntdll.ZwGetPlugPlayEvent MOV EAX,57
7C90DAB1 ntdll.ZwGetWriteWatch MOV EAX,58
7C90DAC6 ntdll.ZwImpersonateAnonymousToken MOV EAX,59
7C90DADB ntdll.ZwImpersonateClientOfPort MOV EAX,5A
7C90DAF0 ntdll.ZwImpersonateThread MOV EAX,5B
7C90DB05 ntdll.ZwInitializeRegistry MOV EAX,5C
7C90DB1A ntdll.ZwInitiatePowerAction MOV EAX,5D
7C90DB2F ntdll.ZwIsProcessInJob MOV EAX,5E
7C90DB44 ntdll.ZwIsSystemResumeAutomatic MOV EAX,5F
7C90DB59 ntdll.ZwListenPort MOV EAX,60
7C90DB6E ntdll.ZwLoadDriver MOV EAX,61
7C90DB83 ntdll.ZwLoadKey MOV EAX,62
7C90DB98 ntdll.ZwLoadKey2 MOV EAX,63
7C90DBAD ntdll.ZwLockFile MOV EAX,64
7C90DBC2 ntdll.ZwLockProductActivationKeys MOV EAX,65
7C90DBD7 ntdll.ZwLockRegistryKey MOV EAX,66
7C90DBEC ntdll.ZwLockVirtualMemory MOV EAX,67
7C90DC01 ntdll.ZwMakePermanentObject MOV EAX,68
7C90DC16 ntdll.ZwMakeTemporaryObject MOV EAX,69
7C90DC2B ntdll.ZwMapUserPhysicalPages MOV EAX,6A
7C90DC40 ntdll.ZwMapUserPhysicalPagesScatter MOV EAX,6B
7C90DC55 ntdll.ZwMapViewOfSection MOV EAX,6C
7C90DC6A ntdll.ZwModifyBootEntry MOV EAX,6D
7C90DC7F ntdll.ZwNotifyChangeDirectoryFile MOV EAX,6E
7C90DC94 ntdll.ZwNotifyChangeKey MOV EAX,6F
7C90DCA9 ntdll.ZwNotifyChangeMultipleKeys MOV EAX,70
7C90DCBE ntdll.ZwOpenDirectoryObject MOV EAX,71
7C90DCD3 ntdll.ZwOpenEvent MOV EAX,72
7C90DCE8 ntdll.ZwOpenEventPair MOV EAX,73
7C90DCFD ntdll.ZwOpenFile MOV EAX,74
7C90DD12 ntdll.ZwOpenIoCompletion MOV EAX,75
7C90DD27 ntdll.ZwOpenJobObject MOV EAX,76
7C90DD3C ntdll.ZwOpenKey MOV EAX,77
7C90DD51 ntdll.ZwOpenMutant MOV EAX,78
7C90DD66 ntdll.ZwOpenObjectAuditAlarm MOV EAX,79
7C90DD7B ntdll.ZwOpenProcess MOV EAX,7A
7C90DD90 ntdll.ZwOpenProcessToken MOV EAX,7B
7C90DDA5 ntdll.ZwOpenProcessTokenEx MOV EAX,7C
7C90DDBA ntdll.ZwOpenSection MOV EAX,7D
7C90DDCF ntdll.ZwOpenSemaphore MOV EAX,7E
7C90DDE4 ntdll.ZwOpenSymbolicLinkObject MOV EAX,7F
7C90DDF9 ntdll.ZwOpenThread MOV EAX,80
7C90DE0E ntdll.ZwOpenThreadToken MOV EAX,81
7C90DE23 ntdll.ZwOpenThreadTokenEx MOV EAX,82
7C90DE38 ntdll.ZwOpenTimer MOV EAX,83
7C90DE4D ntdll.ZwPlugPlayControl MOV EAX,84
7C90DE62 ntdll.ZwPowerInformation MOV EAX,85
7C90DE77 ntdll.ZwPrivilegeCheck MOV EAX,86
7C90DE8C ntdll.ZwPrivilegeObjectAuditAlarm MOV EAX,87
7C90DEA1 ntdll.ZwPrivilegedServiceAuditAlarm MOV EAX,88
7C90DEB6 ntdll.ZwProtectVirtualMemory MOV EAX,89
7C90DECB ntdll.ZwPulseEvent MOV EAX,8A
7C90DEE0 ntdll.ZwQueryAttributesFile MOV EAX,8B
7C90DEF5 ntdll.ZwQueryBootEntryOrder MOV EAX,8C
7C90DF0A ntdll.ZwQueryBootOptions MOV EAX,8D
7C90DF1F ntdll.ZwQueryDebugFilterState MOV EAX,8E
7C90DF34 ntdll.ZwQueryDefaultLocale MOV EAX,8F
7C90DF49 ntdll.ZwQueryDefaultUILanguage MOV EAX,90
7C90DF5E ntdll.ZwQueryDirectoryFile MOV EAX,91
7C90DF73 ntdll.ZwQueryDirectoryObject MOV EAX,92
7C90DF88 ntdll.ZwQueryEaFile MOV EAX,93
7C90DF9D ntdll.ZwQueryEvent MOV EAX,94
7C90DFB2 ntdll.ZwQueryFullAttributesFile MOV EAX,95
7C90DFC7 ntdll.ZwQueryInformationAtom MOV EAX,96
7C90DFDC ntdll.ZwQueryInformationFile MOV EAX,97
7C90DFF1 ntdll.ZwQueryInformationJobObject MOV EAX,98
7C90E006 ntdll.ZwQueryInformationPort MOV EAX,99
7C90E01B ntdll.ZwQueryInformationProcess MOV EAX,9A
7C90E030 ntdll.ZwQueryInformationThread MOV EAX,9B
7C90E045 ntdll.ZwQueryInformationToken MOV EAX,9C
7C90E05A ntdll.ZwQueryInstallUILanguage MOV EAX,9D
7C90E06F ntdll.ZwQueryIntervalProfile MOV EAX,9E
7C90E084 ntdll.ZwQueryIoCompletion MOV EAX,9F
7C90E099 ntdll.ZwQueryKey MOV EAX,0A0
7C90E0AE ntdll.ZwQueryMultipleValueKey MOV EAX,0A1
7C90E0C3 ntdll.ZwQueryMutant MOV EAX,0A2
7C90E0D8 ntdll.ZwQueryObject MOV EAX,0A3
7C90E0ED ntdll.ZwQueryOpenSubKeys MOV EAX,0A4
7C90E102 ntdll.ZwQueryPerformanceCounter MOV EAX,0A5
7C90E117 ntdll.ZwQueryQuotaInformationFile MOV EAX,0A6
7C90E12C ntdll.ZwQuerySection MOV EAX,0A7
7C90E141 ntdll.ZwQuerySecurityObject MOV EAX,0A8
7C90E156 ntdll.ZwQuerySemaphore MOV EAX,0A9
7C90E16B ntdll.ZwQuerySymbolicLinkObject MOV EAX,0AA
7C90E180 ntdll.ZwQuerySystemEnvironmentValue MOV EAX,0AB
7C90E195 ntdll.ZwQuerySystemEnvironmentValueEx MOV EAX,0AC
7C90E1AA ntdll.ZwQuerySystemInformation MOV EAX,0AD
7C90E1BF ntdll.ZwQuerySystemTime MOV EAX,0AE
7C90E1D4 ntdll.ZwQueryTimer MOV EAX,0AF
7C90E1E9 ntdll.ZwQueryTimerResolution MOV EAX,0B0
7C90E1FE ntdll.ZwQueryValueKey MOV EAX,0B1
7C90E213 ntdll.ZwQueryVirtualMemory MOV EAX,0B2
7C90E228 ntdll.ZwQueryVolumeInformationFile MOV EAX,0B3
7C90E23D ntdll.ZwQueueApcThread MOV EAX,0B4
7C90E252 ntdll.ZwRaiseException MOV EAX,0B5
7C90E267 ntdll.ZwRaiseHardError MOV EAX,0B6
7C90E27C ntdll.ZwReadFile MOV EAX,0B7
7C90E291 ntdll.ZwReadFileScatter MOV EAX,0B8
7C90E2A6 ntdll.ZwReadRequestData MOV EAX,0B9
7C90E2BB ntdll.ZwReadVirtualMemory MOV EAX,0BA
7C90E2D0 ntdll.ZwRegisterThreadTerminatePort MOV EAX,0BB
7C90E2E5 ntdll.ZwReleaseMutant MOV EAX,0BC
7C90E2FA ntdll.ZwReleaseSemaphore MOV EAX,0BD
7C90E30F ntdll.ZwRemoveIoCompletion MOV EAX,0BE
7C90E324 ntdll.ZwRemoveProcessDebug MOV EAX,0BF
7C90E339 ntdll.ZwRenameKey MOV EAX,0C0
7C90E34E ntdll.ZwReplaceKey MOV EAX,0C1
7C90E363 ntdll.ZwReplyPort MOV EAX,0C2
7C90E378 ntdll.ZwReplyWaitReceivePort MOV EAX,0C3
7C90E38D ntdll.ZwReplyWaitReceivePortEx MOV EAX,0C4
7C90E3A2 ntdll.ZwReplyWaitReplyPort MOV EAX,0C5
7C90E3B7 ntdll.ZwRequestDeviceWakeup MOV EAX,0C6
7C90E3CC ntdll.ZwRequestPort MOV EAX,0C7
7C90E3E1 ntdll.ZwRequestWaitReplyPort MOV EAX,0C8
7C90E3F6 ntdll.ZwRequestWakeupLatency MOV EAX,0C9
7C90E40B ntdll.ZwResetEvent MOV EAX,0CA
7C90E420 ntdll.ZwResetWriteWatch MOV EAX,0CB
7C90E435 ntdll.ZwRestoreKey MOV EAX,0CC
7C90E44A ntdll.ZwResumeProcess MOV EAX,0CD
7C90E45F ntdll.ZwResumeThread MOV EAX,0CE
7C90E474 ntdll.ZwSaveKey MOV EAX,0CF
7C90E489 ntdll.ZwSaveKeyEx MOV EAX,0D0
7C90E49E ntdll.ZwSaveMergedKeys MOV EAX,0D1
7C90E4B3 ntdll.ZwSecureConnectPort MOV EAX,0D2
7C90E4C8 ntdll.ZwSetBootEntryOrder MOV EAX,0D3
7C90E4DD ntdll.ZwSetBootOptions MOV EAX,0D4
7C90E4F2 ntdll.ZwSetContextThread MOV EAX,0D5
7C90E507 ntdll.ZwSetDebugFilterState MOV EAX,0D6
7C90E51C ntdll.ZwSetDefaultHardErrorPort MOV EAX,0D7
7C90E531 ntdll.ZwSetDefaultLocale MOV EAX,0D8
7C90E546 ntdll.ZwSetDefaultUILanguage MOV EAX,0D9
7C90E55B ntdll.ZwSetEaFile MOV EAX,0DA
7C90E570 ntdll.ZwSetEvent MOV EAX,0DB
7C90E585 ntdll.ZwSetEventBoostPriority MOV EAX,0DC
7C90E59A ntdll.ZwSetHighEventPair MOV EAX,0DD
7C90E5AF ntdll.ZwSetHighWaitLowEventPair MOV EAX,0DE
7C90E5C4 ntdll.ZwSetInformationDebugObject MOV EAX,0DF
7C90E5D9 ntdll.ZwSetInformationFile MOV EAX,0E0
7C90E5EE ntdll.ZwSetInformationJobObject MOV EAX,0E1
7C90E603 ntdll.ZwSetInformationKey MOV EAX,0E2
7C90E618 ntdll.ZwSetInformationObject MOV EAX,0E3
7C90E62D ntdll.ZwSetInformationProcess MOV EAX,0E4
7C90E642 ntdll.ZwSetInformationThread MOV EAX,0E5
7C90E657 ntdll.ZwSetInformationToken MOV EAX,0E6
7C90E66C ntdll.ZwSetIntervalProfile MOV EAX,0E7
7C90E681 ntdll.ZwSetIoCompletion MOV EAX,0E8
7C90E696 ntdll.ZwSetLdtEntries MOV EAX,0E9
7C90E6AB ntdll.ZwSetLowEventPair MOV EAX,0EA
7C90E6C0 ntdll.ZwSetLowWaitHighEventPair MOV EAX,0EB
7C90E6D5 ntdll.ZwSetQuotaInformationFile MOV EAX,0EC
7C90E6EA ntdll.ZwSetSecurityObject MOV EAX,0ED
7C90E6FF ntdll.ZwSetSystemEnvironmentValue MOV EAX,0EE
7C90E714 ntdll.ZwSetSystemEnvironmentValueEx MOV EAX,0EF
7C90E729 ntdll.ZwSetSystemInformation MOV EAX,0F0
7C90E73E ntdll.ZwSetSystemPowerState MOV EAX,0F1
7C90E753 ntdll.ZwSetSystemTime MOV EAX,0F2
7C90E768 ntdll.ZwSetThreadExecutionState MOV EAX,0F3
7C90E77D ntdll.ZwSetTimer MOV EAX,0F4
7C90E792 ntdll.ZwSetTimerResolution MOV EAX,0F5
7C90E7A7 ntdll.ZwSetUuidSeed MOV EAX,0F6
7C90E7BC ntdll.ZwSetValueKey MOV EAX,0F7
7C90E7D1 ntdll.ZwSetVolumeInformationFile MOV EAX,0F8
7C90E7E6 ntdll.ZwShutdownSystem MOV EAX,0F9
7C90E7FB ntdll.ZwSignalAndWaitForSingleObject MOV EAX,0FA
7C90E810 ntdll.ZwStartProfile MOV EAX,0FB
7C90E825 ntdll.ZwStopProfile MOV EAX,0FC
7C90E83A ntdll.ZwSuspendProcess MOV EAX,0FD
7C90E84F ntdll.ZwSuspendThread MOV EAX,0FE
7C90E864 ntdll.ZwSystemDebugControl MOV EAX,0FF
7C90E879 ntdll.ZwTerminateJobObject MOV EAX,100
7C90E88E ntdll.ZwTerminateProcess MOV EAX,101
7C90E8A3 ntdll.ZwTerminateThread MOV EAX,102
7C90E8B8 ntdll.ZwTestAlert MOV EAX,103
7C90E8CD ntdll.ZwTraceEvent MOV EAX,104
7C90E8E2 ntdll.ZwTranslateFilePath MOV EAX,105
7C90E8F7 ntdll.ZwUnloadDriver MOV EAX,106
7C90E90C ntdll.ZwUnloadKey MOV EAX,107
7C90E921 ntdll.ZwUnloadKeyEx MOV EAX,108
7C90E936 ntdll.ZwUnlockFile MOV EAX,109
7C90E94B ntdll.ZwUnlockVirtualMemory MOV EAX,10A
7C90E960 ntdll.ZwUnmapViewOfSection MOV EAX,10B
7C90E975 ntdll.ZwVdmControl MOV EAX,10C
7C90E98A ntdll.ZwWaitForDebugEvent MOV EAX,10D
7C90E99F ntdll.ZwWaitForMultipleObjects MOV EAX,10E
7C90E9B4 ntdll.ZwWaitForSingleObject MOV EAX,10F
7C90E9C9 ntdll.ZwWaitHighEventPair MOV EAX,110
7C90E9DE ntdll.ZwWaitLowEventPair MOV EAX,111
7C90E9F3 ntdll.ZwWriteFile MOV EAX,112
7C90EA08 ntdll.ZwWriteFileGather MOV EAX,113
7C90EA1D ntdll.ZwWriteRequestData MOV EAX,114
7C90EA32 ntdll.ZwWriteVirtualMemory MOV EAX,115
7C90EA47 ntdll.ZwYieldExecution MOV EAX,116
7C90EA5C ntdll.ZwCreateKeyedEvent MOV EAX,117
7C90EA71 ntdll.ZwOpenKeyedEvent MOV EAX,118
7C90EA86 ntdll.ZwReleaseKeyedEvent MOV EAX,119
7C90EA9B ntdll.ZwWaitForKeyedEvent MOV EAX,11A
7C90EAB0 ntdll.ZwQueryPortInformationProcess MOV EAX,11B
7C913156 ntdll.<ModuleEntryPoint> MOV EDI,EDI (Initial CPU selection)




also if you do that in user32.dll you can dredge out all the syscall that goes to win32k.sys as well

Code:

Found sequences
Address Disassembly Comment
77D48466 MOV EAX,1143
77D4847A MOV EAX,1142
77D484B0 MOV EAX,1248
77D48697 USER32.GetDC MOV EAX,1191
77D486AB MOV EAX,11E3
77D48B58 MOV EAX,11DB
77D48C06 USER32.SetTimer MOV EAX,121E
77D48C1A USER32.KillTimer MOV EAX,11C5
77D48C8F MOV EAX,122F
77D48CEF USER32.GetUserObjectInformationW MOV EAX,11A7
77D48DEC MOV EAX,11ED
77D48FF9 USER32.GetWindowDC MOV EAX,11B7
77D49018 MOV EAX,1215
77D49172 USER32.GetProcessWindowStation MOV EAX,11AA
77D4918F MOV EAX,11A5
77D493BA MOV EAX,11DA
77D493E9 USER32.WaitMessage MOV EAX,124E
77D494D7 MOV EAX,11CC
77D494EB MOV EAX,1165
77D495A0 MOV EAX,124A
77D49829 MOV EAX,11E8
77D4983D MOV EAX,11B2
77D49890 MOV EAX,123E
77D49A22 MOV EAX,1179
77D4B0AC MOV EAX,11F3
77D4B49D USER32.InvalidateRect MOV EAX,11C2
77D4B4B1 USER32.BeginPaint MOV EAX,1134
77D4B4C5 USER32.EndPaint MOV EAX,1172
77D4BD2A MOV EAX,11B5
77D4BF8B USER32.GetKeyboardLayoutList MOV EAX,119C
77D4C09E MOV EAX,113C
77D4C402 MOV EAX,11A0
77D4C454 USER32.SendInput MOV EAX,11F6
77D4C476 MOV EAX,1239
77D4C4AE USER32.GetForegroundWindow MOV EAX,1194
77D4C4C0 MOV EAX,113F
77D4C57E USER32.WindowFromPoint MOV EAX,1250
77D4C617 MOV EAX,11B3
77D4C6A8 USER32.SetCursor MOV EAX,11FF
77D4C6BC USER32.RedrawWindow MOV EAX,11E7
77D4C78E USER32.SetWindowPos MOV EAX,1222
77D4C900 MOV EAX,124B
77D4C988 USER32.SetCapture MOV EAX,11F9
77D4CB4B USER32.HideCaret MOV EAX,11BB
77D4CB5F USER32.ShowCaret MOV EAX,1229
77D4CBE3 MOV EAX,1144
77D4CBF7 USER32.CreateCaret MOV EAX,1153
77D4CDB7 MOV EAX,1170
77D4CDED USER32.IsClipboardFormatAvailable MOV EAX,11C4
77D4CE01 USER32.GetClipboardSequenceNumber MOV EAX,1188
77D4CE13 USER32.DeferWindowPos MOV EAX,115C
77D4CE27 USER32.ExcludeUpdateRgn MOV EAX,1177
77D4CE89 MOV EAX,11B6
77D4D0F9 MOV EAX,117F
77D4D130 MOV EAX,118E
77D4D49D MOV EAX,1184
77D4D4DE USER32.ShowWindow MOV EAX,122B
77D4D501 USER32.GetAncestor MOV EAX,117D
77D4D515 USER32.MoveWindow MOV EAX,11D1
77D4D7A7 MOV EAX,1173
77D4D921 MOV EAX,1138
77D4DA8B USER32.EnumDisplayMonitors MOV EAX,1174
77D4DCF3 USER32.UpdateLayeredWindow MOV EAX,1243
77D4DD41 MOV EAX,11EF
77D4DD5C MOV EAX,1213
77D4DE2D MOV EAX,113E
77D4DE78 MOV EAX,1220
77D4E3A1 USER32.DestroyMenu MOV EAX,1162
77D4E5DC USER32.SetFocus MOV EAX,1203
77D4E666 USER32.DestroyWindow MOV EAX,1163
77D4E7B8 USER32.GetSystemMenu MOV EAX,11B1
77D4E867 MOV EAX,1232
77D4E87B USER32.DeleteMenu MOV EAX,115E
77D4E8B4 MOV EAX,1180
77D4E8E6 MOV EAX,1160
77D4E91F MOV EAX,11D4
77D4E98D MOV EAX,1197
77D4EB14 USER32.GetWindowPlacement MOV EAX,11B8
77D4EB28 USER32.SetWindowWord MOV EAX,1227
77D4EEE5 USER32.CloseClipboard MOV EAX,114B
77D4EF21 MOV EAX,11D5
77D4EF35 USER32.GetKeyboardState MOV EAX,119E
77D4EF49 USER32.SetKeyboardState MOV EAX,120A
77D4F209 USER32.GetTitleBarInfo MOV EAX,11B4
77D4F21D USER32.GetDCEx MOV EAX,1192
77D4F258 MOV EAX,11C1
77D4F26C USER32.CalcMenuBar MOV EAX,1236
77D4F40B MOV EAX,116B
77D4FC87 MOV EAX,116E
77D4FCDC MOV EAX,117A
77D4FDAE USER32.SetParent MOV EAX,1211
77D4FDC2 USER32.TrackMouseEvent MOV EAX,1234
77D4FDD6 MOV EAX,11DC
77D4FE5A MOV EAX,1238
77D4FFDD USER32.GetDoubleClickTime MOV EAX,1193
77D50142 USER32.ShowScrollBar MOV EAX,122A
77D5019F USER32.InvalidateRgn MOV EAX,11C3
77D501B3 USER32.SetLayeredWindowAttributes MOV EAX,1245
77D501C7 MOV EAX,11FA
77D50410 MOV EAX,11CA
77D50424 MOV EAX,11F4
77D50EB9 USER32.UserClientDllInitialize MOV EDI,EDI (Initial CPU selection)
77D517DF MOV EAX,1157
77D51DCC MOV EAX,1223
77D520C2 MOV EAX,1183
77D52400 MOV EAX,1198
77D52AB3 MOV EAX,1201
77D539ED MOV EAX,11F2
77D53A01 USER32.GetScrollBarInfo MOV EAX,11B0
77D54E5F MOV EAX,121F
77D5501A MOV EAX,121D
77D5536C MOV EAX,1178
77D55380 USER32.SetActiveWindow MOV EAX,11F7
77D55394 MOV EAX,1140
77D5674F USER32.AttachThreadInput MOV EAX,1133
77D57314 MOV EAX,118C
77D58759 MOV EAX,1131
77D5F84F USER32.LockWindowUpdate MOV EAX,11C8
77D60505 MOV EAX,118D
77D62886 MOV EAX,113B
77D629D8 USER32.UnlockWindowStation MOV EAX,123D
77D62AC1 MOV EAX,1175
77D6398E USER32.SetSystemMenu MOV EAX,1219
77D63D5C MOV EAX,1231
77D64EE0 USER32.ClipCursor MOV EAX,114A
77D64EF4 MOV EAX,1224
77D64F2E MOV EAX,1148
77D657AA MOV EAX,11D8
77D65FD1 MOV EAX,115F
77D66420 USER32.PrintWindow MOV EAX,11DD
77D66596 MOV EAX,11E5
77D66607 USER32.OpenInputDesktop MOV EAX,11D7
77D6678B USER32.RegisterHotKey MOV EAX,11EA
77D6696D MOV EAX,1208
77D66AE2 MOV EAX,1146
77D670EB USER32.SetMenuDefaultItem MOV EAX,120E
77D6724D USER32.RemoveMenu MOV EAX,11EE
77D679A3 USER32.SwitchDesktop MOV EAX,122E
77D67AC7 USER32.SetShellWindowEx MOV EAX,1216
77D67DA1 MOV EAX,113D
77D67EE5 MOV EAX,115A
77D68551 USER32.ChildWindowFromPointEx MOV EAX,1149
77D694A2 MOV EAX,11BF
77D69513 MOV EAX,11DE
77D6994B MOV EAX,1204
77D69DCE MOV EAX,11C6
77D69E24 MOV EAX,119D
77D69EC1 USER32.UnregisterUserApiHook MOV EAX,123F
77D69EFB MOV EAX,1226
77D69F9B USER32.LockWindowStation MOV EAX,11C7
77D6A3E8 USER32.SetLogonNotifyWindow MOV EAX,120B
77D6A7CB MOV EAX,1158
77D6A88C MOV EAX,1154
77D6AA59 MOV EAX,11E9
77D6AB93 MOV EAX,1246
77D6BC6F MOV EAX,11D0
77D6C233 USER32.ShowWindowAsync MOV EAX,122C
77D6DBBB MOV EAX,1141
77D6DEF7 USER32.GetGUIThreadInfo MOV EAX,1196
77D6E00E MOV EAX,1139
77D6E06F MOV EAX,11D6
77D6E424 MOV EAX,1228
77D6E544 USER32.UnhookWinEvent MOV EAX,123B
77D6E60D MOV EAX,1225
77D6E642 USER32.CreateAcceleratorTableW MOV EAX,1152
77D6EB22 USER32.PaintMenuBar MOV EAX,1237
77D6EB95 MOV EAX,115D
77D6EC29 USER32.ValidateRect MOV EAX,1249
77D6EDC3 USER32.CloseDesktop MOV EAX,114C
77D6EE93 MOV EAX,1135
77D6F0F1 USER32.GetCaretPos MOV EAX,1182
77D6F105 USER32.GetCaretBlinkTime MOV EAX,1181
77D6F29F USER32.UnhookWindowsHookEx MOV EAX,123A
77D6F46A MOV EAX,117C
77D6F47E USER32.SetClipboardViewer MOV EAX,11FD
77D6F492 USER32.ChangeClipboardChain MOV EAX,1145
77D6F76C USER32.PaintDesktop MOV EAX,11D9
77D6F780 USER32.SetConsoleReserveKeys MOV EAX,11FE
77D6F794 USER32.ActivateKeyboardLayout MOV EAX,1130
77D6F7A8 USER32.SetThreadDesktop MOV EAX,121B
77D6F7BC USER32.SetProcessWindowStation MOV EAX,1212
77D6F812 USER32.CloseWindowStation MOV EAX,114D
77D6FA7C USER32.CountClipboardFormats MOV EAX,1151
77D6FA8E USER32.GetOpenClipboardWindow MOV EAX,11A8
77D6FBEA USER32.SetWindowPlacement MOV EAX,1221
77D6FDB0 MOV EAX,1185
77D6FE19 MOV EAX,1156
77D6FE82 USER32.EmptyClipboard MOV EAX,116D
77D6FE94 USER32.GetClipboardOwner MOV EAX,1187
77D6FEA6 MOV EAX,11FC
77D70025 MOV EAX,114F
77D7028A MOV EAX,118F
77D703A1 MOV EAX,1186
77D7F469 MOV EAX,124D
77D7F97E USER32.CopyAcceleratorTableW MOV EAX,1150
77D7FCE6 MOV EAX,11CD
77D9C61A USER32.BlockInput MOV EAX,1136
77D9C62E MOV EAX,113A
77D9C642 USER32.DdeGetQualityOfService MOV EAX,1159
77D9C656 USER32.DdeSetQualityOfService MOV EAX,115B
77D9C66A USER32.DragDetect MOV EAX,1166
77D9C67E USER32.DragObject MOV EAX,1167
77D9C692 USER32.DrawAnimatedRects MOV EAX,1168
77D9C6A6 MOV EAX,1169
77D9C6BA MOV EAX,116A
77D9C6CE MOV EAX,116C
77D9C6E2 MOV EAX,116F
77D9C6F6 USER32.EndMenu MOV EAX,1171
77D9C708 MOV EAX,1176
77D9C71C USER32.FlashWindowEx MOV EAX,117B
77D9C730 USER32.GetClipboardViewer MOV EAX,1189
77D9C742 USER32.GetClipCursor MOV EAX,118A
77D9C756 USER32.GetComboBoxInfo MOV EAX,118B
77D9C76A USER32.GetCursorInfo MOV EAX,1190
77D9C77E USER32.GetGuiResources MOV EAX,1195
77D9C792 MOV EAX,1199
77D9C7A6 USER32.GetInternalWindowPos MOV EAX,119B
77D9C7BA MOV EAX,119F
77D9C7CE USER32.GetListBoxInfo MOV EAX,11A1
77D9C7E2 USER32.GetMenuBarInfo MOV EAX,11A2
77D9C7F6 MOV EAX,11A3
77D9C80A USER32.GetMenuItemRect MOV EAX,11A4
77D9C81E USER32.GetMouseMovePointsEx MOV EAX,11A6
77D9C832 USER32.GetPriorityClipboardFormat MOV EAX,11A9
77D9C846 MOV EAX,11AB
77D9C85A USER32.GetRawInputData MOV EAX,11AC
77D9C86E MOV EAX,11AD
77D9C882 USER32.GetRawInputDeviceList MOV EAX,11AE
77D9C896 USER32.GetRegisteredRawInputDevices MOV EAX,11AF
77D9C8AA MOV EAX,11B9
77D9C8BE USER32.HiliteMenuItem MOV EAX,11BC
77D9C8D2 USER32.ImpersonateDdeClientWindow MOV EAX,11BD
77D9C8E6 MOV EAX,11C0
77D9C8FA USER32.LockWorkStation MOV EAX,11C9
77D9C90C USER32.MenuItemFromPoint MOV EAX,11CB
77D9C920 MOV EAX,11CE
77D9C932 MOV EAX,11CF
77D9C946 MOV EAX,11D2
77D9C95A USER32.QuerySendMessage MOV EAX,11E1
77D9C96E USER32.QueryUserCounters MOV EAX,11E2
77D9C982 USER32.RealChildWindowFromPoint MOV EAX,11E4
77D9C996 MOV EAX,11E6
77D9C9AA USER32.RegisterRawInputDevices MOV EAX,11EB
77D9C9BE USER32.RegisterTasklist MOV EAX,11EC
77D9C9D2 USER32.ResolveDesktopForWOW MOV EAX,11F1
77D9C9E6 USER32.SetClassWord MOV EAX,11FB
77D9C9FA USER32.SetCursorContents MOV EAX,1200
77D9CA0E USER32.PrivateSetDbgTag MOV EAX,1202
77D9CA22 MOV EAX,1206
77D9CA36 USER32.SetInternalWindowPos MOV EAX,1209
77D9CA4A MOV EAX,120C
77D9CA5E USER32.SetMenuContextHelpId MOV EAX,120D
77D9CA72 MOV EAX,120F
77D9CA86 USER32.SetUserObjectInformationW MOV EAX,1210
77D9CA9A USER32.PrivateSetRipFlags MOV EAX,1214
77D9CAAE MOV EAX,1217
77D9CAC2 MOV EAX,1218
77D9CAD6 USER32.SetSystemTimer MOV EAX,121A
77D9CAEA MOV EAX,1233
77D9CAFE USER32.TrackPopupMenuEx MOV EAX,1235
77D9CB12 MOV EAX,123C
77D9CB26 USER32.UnregisterHotKey MOV EAX,1240
77D9CB3A MOV EAX,1241
77D9CB4E MOV EAX,1242
77D9CB62 USER32.GetLayeredWindowAttributes MOV EAX,1244
77D9CB76 USER32.UserHandleGrantAccess MOV EAX,1247
77D9CB8A MOV EAX,124C
77D9CB9E USER32.Win32PoolAllocationStats MOV EAX,124F
77D9CBB2 MOV EAX,1251


just load the concerned pdb into ollydbg and user32 undefined names like NtUserCallParamN() ordinal names will be visible too


and likewise its kinda trivial to do it in windbg as well if you get the grasp of the horrific pseudo registers
in both usermode as well as kernel mode including livekd
look in osronline windbg mailing lists archieves

also opcode has a fantastic comprehensive list of all syscalls including w2k and upto vista in metasploit opcode database

blabberer
March 7th, 2008, 13:51
here is a complete list of all syscall ordinals that end up in win32k.sys
via user32.dll and gdi32.dll

from 1000 to 129a

Code:

Found sequences
Address Disassembly
77D48466 USER32.NtUserCallOneParam MOV EAX,1143
77D4847A USER32.NtUserCallNoParam MOV EAX,1142
77D4B49D USER32.InvalidateRect MOV EAX,11C2
77D4B4B1 USER32.BeginPaint MOV EAX,1134
77D4B4C5 USER32.EndPaint MOV EAX,1172
77D4BD2A USER32.NtUserGetUpdateRect MOV EAX,11B5
77D4BF8B USER32.GetKeyboardLayoutList MOV EAX,119C
77D4C09E USER32.NtUserCallHwndLock MOV EAX,113C
77D4C402 USER32.NtUserGetKeyState MOV EAX,11A0
77D4C454 USER32.SendInput MOV EAX,11F6
77D4C476 USER32.NtUserTranslateMessage MOV EAX,1239
77D4C4AE USER32.GetForegroundWindow MOV EAX,1194
77D4C4C0 USER32.NtUserCallHwndParamLock MOV EAX,113F
77D4C57E USER32.WindowFromPoint MOV EAX,1250
77D4C617 USER32.NtUserGetThreadState MOV EAX,11B3
77D4C6A8 USER32.SetCursor MOV EAX,11FF
77D4C6BC USER32.RedrawWindow MOV EAX,11E7
77D4C78E USER32.SetWindowPos MOV EAX,1222
77D4C900 USER32.NtUserVkKeyScanEx MOV EAX,124B
77D4C988 USER32.SetCapture MOV EAX,11F9
77D4CB4B USER32.HideCaret MOV EAX,11BB
77D4CB5F USER32.ShowCaret MOV EAX,1229
77D4CBE3 USER32.NtUserCallTwoParam MOV EAX,1144
77D4CBF7 USER32.CreateCaret MOV EAX,1153
77D4CDB7 USER32.NtUserEndDeferWindowPosEx MOV EAX,1170
77D4CDED USER32.IsClipboardFormatAvailable MOV EAX,11C4
77D4CE01 USER32.GetClipboardSequenceNumber MOV EAX,1188
77D4CE13 USER32.DeferWindowPos MOV EAX,115C
77D4CE27 USER32.ExcludeUpdateRgn MOV EAX,1177
77D4CE89 USER32.NtUserGetUpdateRgn MOV EAX,11B6
77D4D0F9 USER32.NtUserGetAsyncKeyState MOV EAX,117F
77D4D130 USER32.NtUserGetCPD MOV EAX,118E
77D4D49D USER32.NtUserGetClassName MOV EAX,1184
77D4D4DE USER32.ShowWindow MOV EAX,122B
77D4D501 USER32.GetAncestor MOV EAX,117D
77D4D515 USER32.MoveWindow MOV EAX,11D1
77D4D7A7 USER32.NtUserEnumDisplayDevices MOV EAX,1173
77D4D921 USER32.NtUserBuildHwndList MOV EAX,1138
77D4DA8B USER32.EnumDisplayMonitors MOV EAX,1174
77D4DCF3 USER32.UpdateLayeredWindow MOV EAX,1243
77D4DD41 USER32.NtUserRemoveProp MOV EAX,11EF
77D4DD5C USER32.NtUserSetProp MOV EAX,1213
77D4DE2D USER32.NtUserCallHwndParam MOV EAX,113E
77D4DE78 USER32.NtUserSetWindowLong MOV EAX,1220
77D4E3A1 USER32.DestroyMenu MOV EAX,1162
77D4E5DC USER32.SetFocus MOV EAX,1203
77D4E666 USER32.DestroyWindow MOV EAX,1163
77D4E7B8 USER32.GetSystemMenu MOV EAX,11B1
77D4E867 USER32.NtUserThunkedMenuItemInfo MOV EAX,1232
77D4E87B USER32.DeleteMenu MOV EAX,115E
77D4E8B4 USER32.NtUserGetAtomName MOV EAX,1180
77D4E8E6 USER32.NtUserDestroyCursor MOV EAX,1160
77D4E91F USER32.NtUserNotifyWinEvent MOV EAX,11D4
77D4E98D USER32.NtUserGetIconInfo MOV EAX,1197
77D4EB14 USER32.GetWindowPlacement MOV EAX,11B8
77D4EB28 USER32.SetWindowWord MOV EAX,1227
77D4EEE5 USER32.CloseClipboard MOV EAX,114B
77D4EF21 USER32.NtUserOpenClipboard MOV EAX,11D5
77D4EF35 USER32.GetKeyboardState MOV EAX,119E
77D4EF49 USER32.SetKeyboardState MOV EAX,120A
77D4F209 USER32.GetTitleBarInfo MOV EAX,11B4
77D4F21D USER32.GetDCEx MOV EAX,1192
77D4F258 USER32.NtUserInternalGetWindowText MOV EAX,11C1
77D4F26C USER32.CalcMenuBar MOV EAX,1236
77D4F40B USER32.NtUserDrawIconEx MOV EAX,116B
77D4FC87 USER32.NtUserEnableMenuItem MOV EAX,116E
77D4FCDC USER32.NtUserFindWindowEx MOV EAX,117A
77D4FDAE USER32.SetParent MOV EAX,1211
77D4FDC2 USER32.TrackMouseEvent MOV EAX,1234
77D4FDD6 USER32.NtUserPostThreadMessage MOV EAX,11DC
77D4FE5A USER32.NtUserTranslateAccelerator MOV EAX,1238
77D4FFDD USER32.GetDoubleClickTime MOV EAX,1193
77D50142 USER32.ShowScrollBar MOV EAX,122A
77D5019F USER32.InvalidateRgn MOV EAX,11C3
77D501B3 USER32.SetLayeredWindowAttributes MOV EAX,1245
77D501C7 USER32.NtUserSetClassLong MOV EAX,11FA
77D50410 USER32.NtUserMapVirtualKeyEx MOV EAX,11CA
77D50424 USER32.NtUserScrollWindowEx MOV EAX,11F4
77D517DF USER32.NtUserCreateWindowEx MOV EAX,1157
77D51DCC USER32.NtUserSetWindowRgn MOV EAX,1223
77D520C2 USER32.NtUserGetClassInfo MOV EAX,1183
77D52400 USER32.NtUserGetIconSize MOV EAX,1198
77D52AB3 USER32.NtUserSetCursorIconData MOV EAX,1201
77D539ED USER32.NtUserSBGetParms MOV EAX,11F2
77D53A01 USER32.GetScrollBarInfo MOV EAX,11B0
77D54E5F USER32.NtUserSetWindowFNID MOV EAX,121F
77D5501A USER32.NtUserSetThreadState MOV EAX,121D
77D5536C USER32.NtUserFillWindow MOV EAX,1178
77D55380 USER32.SetActiveWindow MOV EAX,11F7
77D55394 USER32.NtUserCallMsgFilter MOV EAX,1140
77D5674F USER32.AttachThreadInput MOV EAX,1133
77D57314 USER32.NtUserGetControlBrush MOV EAX,118C
77D58759 USER32.NtUserAlterWindowStyle MOV EAX,1131
77D5F84F USER32.LockWindowUpdate MOV EAX,11C8
77D60505 USER32.NtUserGetControlColor MOV EAX,118D
77D62886 USER32.NtUserCallHwnd MOV EAX,113B
77D629D8 USER32.UnlockWindowStation MOV EAX,123D
77D62AC1 USER32.NtUserEnumDisplaySettings MOV EAX,1175
77D6398E USER32.SetSystemMenu MOV EAX,1219
77D63D5C USER32.NtUserThunkedMenuInfo MOV EAX,1231
77D64EE0 USER32.ClipCursor MOV EAX,114A
77D64EF4 USER32.NtUserSetWindowsHookAW MOV EAX,1224
77D64F2E USER32.NtUserCheckMenuItem MOV EAX,1148
77D657AA USER32.NtUserOpenWindowStation MOV EAX,11D8
77D65FD1 USER32.NtUserDestroyAcceleratorTable MOV EAX,115F
77D66420 USER32.PrintWindow MOV EAX,11DD
77D66596 USER32.NtUserRealInternalGetMessage MOV EAX,11E5
77D66607 USER32.OpenInputDesktop MOV EAX,11D7
77D6678B USER32.RegisterHotKey MOV EAX,11EA
77D6696D USER32.NtUserSetInformationThread MOV EAX,1208
77D66AE2 USER32.NtUserChangeDisplaySettings MOV EAX,1146
77D670EB USER32.SetMenuDefaultItem MOV EAX,120E
77D6724D USER32.RemoveMenu MOV EAX,11EE
77D679A3 USER32.SwitchDesktop MOV EAX,122E
77D67AC7 USER32.SetShellWindowEx MOV EAX,1216
77D67DA1 USER32.NtUserCallHwndOpt MOV EAX,113D
77D67EE5 USER32.NtUserDdeInitialize MOV EAX,115A
77D68551 USER32.ChildWindowFromPointEx MOV EAX,1149
77D694A2 USER32.NtUserInitializeClientPfnArrays MOV EAX,11BF
77D69513 USER32.NtUserProcessConnect MOV EAX,11DE
77D6994B USER32.NtUserSetImeHotKey MOV EAX,1204
77D69DCE USER32.NtUserLoadKeyboardLayoutEx MOV EAX,11C6
77D69E24 USER32.NtUserGetKeyboardLayoutName MOV EAX,119D
77D69EC1 USER32.UnregisterUserApiHook MOV EAX,123F
77D69EFB USER32.NtUserSetWindowStationUser MOV EAX,1226
77D69F9B USER32.LockWindowStation MOV EAX,11C7
77D6A3E8 USER32.SetLogonNotifyWindow MOV EAX,120B
77D6A7CB USER32.NtUserCreateWindowStation MOV EAX,1158
77D6A88C USER32.NtUserCreateDesktop MOV EAX,1154
77D6AA59 USER32.NtUserRegisterUserApiHook MOV EAX,11E9
77D6AB93 USER32.NtUserUpdatePerUserSystemParameters MOV EAX,1246
77D6BC6F USER32.NtUserModifyUserStartupInfoFlags MOV EAX,11D0
77D6C233 USER32.ShowWindowAsync MOV EAX,122C
77D6DBBB USER32.NtUserCallNextHookEx MOV EAX,1141
77D6DEF7 USER32.GetGUIThreadInfo MOV EAX,1196
77D6E00E USER32.NtUserBuildNameList MOV EAX,1139
77D6E06F USER32.NtUserOpenDesktop MOV EAX,11D6
77D6E424 USER32.NtUserSetWinEventHook MOV EAX,1228
77D6E544 USER32.UnhookWinEvent MOV EAX,123B
77D6E60D USER32.NtUserSetWindowsHookEx MOV EAX,1225
77D6E642 USER32.CreateAcceleratorTableW MOV EAX,1152
77D6EB22 USER32.PaintMenuBar MOV EAX,1237
77D6EB95 USER32.NtUserDefSetText MOV EAX,115D
77D6EC29 USER32.ValidateRect MOV EAX,1249
77D6EDC3 USER32.CloseDesktop MOV EAX,114C
77D6EE93 USER32.NtUserBitBltSysBmp MOV EAX,1135
77D6F0F1 USER32.GetCaretPos MOV EAX,1182
77D6F105 USER32.GetCaretBlinkTime MOV EAX,1181
77D6F29F USER32.UnhookWindowsHookEx MOV EAX,123A
77D6F46A USER32.NtUserGetAltTabInfo MOV EAX,117C
77D6F47E USER32.SetClipboardViewer MOV EAX,11FD
77D6F492 USER32.ChangeClipboardChain MOV EAX,1145
77D6F76C USER32.PaintDesktop MOV EAX,11D9
77D6F780 USER32.SetConsoleReserveKeys MOV EAX,11FE
77D6F794 USER32.ActivateKeyboardLayout MOV EAX,1130
77D6F7A8 USER32.SetThreadDesktop MOV EAX,121B
77D6F7BC USER32.SetProcessWindowStation MOV EAX,1212
77D6F812 USER32.CloseWindowStation MOV EAX,114D
77D6FA7C USER32.CountClipboardFormats MOV EAX,1151
77D6FA8E USER32.GetOpenClipboardWindow MOV EAX,11A8
77D6FBEA USER32.SetWindowPlacement MOV EAX,1221
77D6FDB0 USER32.NtUserGetClipboardData MOV EAX,1185
77D6FE19 USER32.NtUserCreateLocalMemHandle MOV EAX,1156
77D6FE82 USER32.EmptyClipboard MOV EAX,116D
77D6FE94 USER32.GetClipboardOwner MOV EAX,1187
77D6FEA6 USER32.NtUserSetClipboardData MOV EAX,11FC
77D70025 USER32.NtUserConvertMemHandle MOV EAX,114F
77D7028A USER32.NtUserGetCursorFrameInfo MOV EAX,118F
77D703A1 USER32.NtUserGetClipboardFormatName MOV EAX,1186
77D7F469 USER32.NtUserWaitForMsgAndEvent MOV EAX,124D
77D7F97E USER32.CopyAcceleratorTableW MOV EAX,1150
77D7FCE6 USER32.NtUserMinMaximize MOV EAX,11CD
77D9C61A USER32.BlockInput MOV EAX,1136
77D9C62E USER32.NtUserBuildPropList MOV EAX,113A
77D9C642 USER32.DdeGetQualityOfService MOV EAX,1159
77D9C656 USER32.DdeSetQualityOfService MOV EAX,115B
77D9C66A USER32.DragDetect MOV EAX,1166
77D9C67E USER32.DragObject MOV EAX,1167
77D9C692 USER32.DrawAnimatedRects MOV EAX,1168
77D9C6A6 USER32.NtUserDrawCaption MOV EAX,1169
77D9C6BA USER32.NtUserDrawCaptionTemp MOV EAX,116A
77D9C6CE USER32.NtUserDrawMenuBarTemp MOV EAX,116C
77D9C6E2 USER32.NtUserEnableScrollBar MOV EAX,116F
77D9C6F6 USER32.EndMenu MOV EAX,1171
77D9C708 USER32.NtUserEvent MOV EAX,1176
77D9C71C USER32.FlashWindowEx MOV EAX,117B
77D9C730 USER32.GetClipboardViewer MOV EAX,1189
77D9C742 USER32.GetClipCursor MOV EAX,118A
77D9C756 USER32.GetComboBoxInfo MOV EAX,118B
77D9C76A USER32.GetCursorInfo MOV EAX,1190
77D9C77E USER32.GetGuiResources MOV EAX,1195
77D9C792 USER32.NtUserGetImeHotKey MOV EAX,1199
77D9C7A6 USER32.GetInternalWindowPos MOV EAX,119B
77D9C7BA USER32.NtUserGetKeyNameText MOV EAX,119F
77D9C7CE USER32.GetListBoxInfo MOV EAX,11A1
77D9C7E2 USER32.GetMenuBarInfo MOV EAX,11A2
77D9C7F6 USER32.NtUserGetMenuIndex MOV EAX,11A3
77D9C80A USER32.GetMenuItemRect MOV EAX,11A4
77D9C81E USER32.GetMouseMovePointsEx MOV EAX,11A6
77D9C832 USER32.GetPriorityClipboardFormat MOV EAX,11A9
77D9C846 USER32.NtUserGetRawInputBuffer MOV EAX,11AB
77D9C85A USER32.GetRawInputData MOV EAX,11AC
77D9C86E USER32.NtUserGetRawInputDeviceInfo MOV EAX,11AD
77D9C882 USER32.GetRawInputDeviceList MOV EAX,11AE
77D9C896 USER32.GetRegisteredRawInputDevices MOV EAX,11AF
77D9C8AA USER32.NtUserGetWOWClass MOV EAX,11B9
77D9C8BE USER32.HiliteMenuItem MOV EAX,11BC
77D9C8D2 USER32.ImpersonateDdeClientWindow MOV EAX,11BD
77D9C8E6 USER32.NtUserInitTask MOV EAX,11C0
77D9C8FA USER32.LockWorkStation MOV EAX,11C9
77D9C90C USER32.MenuItemFromPoint MOV EAX,11CB
77D9C920 USER32.NtUserMNDragLeave MOV EAX,11CE
77D9C932 USER32.NtUserMNDragOver MOV EAX,11CF
77D9C946 USER32.NtUserNotifyIMEStatus MOV EAX,11D2
77D9C95A USER32.QuerySendMessage MOV EAX,11E1
77D9C96E USER32.QueryUserCounters MOV EAX,11E2
77D9C982 USER32.RealChildWindowFromPoint MOV EAX,11E4
77D9C996 USER32.NtUserRealWaitMessageEx MOV EAX,11E6
77D9C9AA USER32.RegisterRawInputDevices MOV EAX,11EB
77D9C9BE USER32.RegisterTasklist MOV EAX,11EC
77D9C9D2 USER32.ResolveDesktopForWOW MOV EAX,11F1
77D9C9E6 USER32.SetClassWord MOV EAX,11FB
77D9C9FA USER32.SetCursorContents MOV EAX,1200
77D9CA0E USER32.PrivateSetDbgTag MOV EAX,1202
77D9CA22 USER32.NtUserSetImeOwnerWindow MOV EAX,1206
77D9CA36 USER32.SetInternalWindowPos MOV EAX,1209
77D9CA4A USER32.NtUserSetMenu MOV EAX,120C
77D9CA5E USER32.SetMenuContextHelpId MOV EAX,120D
77D9CA72 USER32.NtUserSetMenuFlagRtoL MOV EAX,120F
77D9CA86 USER32.SetUserObjectInformationW MOV EAX,1210
77D9CA9A USER32.PrivateSetRipFlags MOV EAX,1214
77D9CAAE USER32.NtUserSetSysColors MOV EAX,1217
77D9CAC2 USER32.NtUserSetSystemCursor MOV EAX,1218
77D9CAD6 USER32.SetSystemTimer MOV EAX,121A
77D9CAEA USER32.NtUserToUnicodeEx MOV EAX,1233
77D9CAFE USER32.TrackPopupMenuEx MOV EAX,1235
77D9CB12 USER32.NtUserUnloadKeyboardLayout MOV EAX,123C
77D9CB26 USER32.UnregisterHotKey MOV EAX,1240
77D9CB3A USER32.NtUserUpdateInputContext MOV EAX,1241
77D9CB4E USER32.NtUserUpdateInstance MOV EAX,1242
77D9CB62 USER32.GetLayeredWindowAttributes MOV EAX,1244
77D9CB76 USER32.UserHandleGrantAccess MOV EAX,1247
77D9CB8A USER32.NtUserWaitForInputIdle MOV EAX,124C
77D9CB9E USER32.Win32PoolAllocationStats MOV EAX,124F
77D9CBB2 USER32.NtUserYieldTask MOV EAX,1251
77F157AC GDI32.NtGdiFlush MOV EAX,1097
77F15DFC GDI32.NtGdiSelectBitmap MOV EAX,1101
77F15E7E GDI32.NtGdiCreateCompatibleDC MOV EAX,101E
77F160CD GDI32.NtGdiCreateBitmap MOV EAX,1019
77F16298 GDI32.NtGdiCreateSolidBrush MOV EAX,102C
77F1635C GDI32.NtGdiGetStockObject MOV EAX,10C8
77F1643B GDI32.GdiConsoleTextOut MOV EAX,1017
77F165FB GDI32.NtGdiInit MOV EAX,10DC
77F1660D GDI32.NtGdiQueryFontAssocInfo MOV EAX,10F4
77F1686F GDI32.NtGdiGetCharSet MOV EAX,10A2
77F168D0 GDI32.NtGdiIntersectClipRect MOV EAX,10DE
77F168EF GDI32.NtGdiGetAppClipBox MOV EAX,109C
77F16903 GDI32.NtGdiGetRandomRgn MOV EAX,10C0
77F16A27 GDI32.NtGdiDrawStream MOV EAX,129A
77F16C58 GDI32.NtGdiDeleteObjectApp MOV EAX,107A
77F16E3D GDI32.NtGdiBitBlt MOV EAX,100D
77F16F2D GDI32.NtGdiCreateCompatibleBitmap MOV EAX,101D
77F178AA GDI32.NtGdiExtSelectClipRgn MOV EAX,1091
77F17D9C GDI32.NtGdiExtGetObjectW MOV EAX,1090
77F17E3F GDI32.NtGdiExtTextOutW MOV EAX,1092
77F17E53 GDI32.NtGdiSelectFont MOV EAX,1104
77F17F8F GDI32.NtGdiGetDCDword MOV EAX,10A7
77F1807B GDI32.NtGdiRectVisible MOV EAX,10F7
77F180F0 GDI32.GetTextCharsetInfo MOV EAX,10CB
77F1810C GDI32.NtGdiPolyPolyDraw MOV EAX,10EF
77F1828D GDI32.NtGdiGetDCObject MOV EAX,10A9
77F1830F GDI32.NtUserSelectPalette MOV EAX,11F5
77F1857C GDI32.NtGdiSetLayout MOV EAX,1119
77F1869C GDI32.NtGdiExcludeClipRect MOV EAX,108B
77F18820 GDI32.NtGdiPatBlt MOV EAX,10EA
77F189E3 GDI32.NtGdiGetRgnBox MOV EAX,10C4
77F18B30 GDI32.NtGdiHfontCreate MOV EAX,10DA
77F18DC3 GDI32.NtGdiGetBitmapBits MOV EAX,109D
77F18DF3 GDI32.NtGdiCreatePaletteInternal MOV EAX,1026
77F18E12 GDI32.NtGdiGetNearestColor MOV EAX,10BA
77F19499 GDI32.NtGdiSetDIBitsToDeviceInternal MOV EAX,110F
77F19788 GDI32.NtGdiCreateDIBSection MOV EAX,1021
77F19870 GDI32.NtGdiRestoreDC MOV EAX,10FC
77F1990D GDI32.NtGdiSaveDC MOV EAX,10FE
77F19A33 GDI32.NtGdiPolyPatBlt MOV EAX,10EB
77F19A47 GDI32.NtGdiSetBrushOrg MOV EAX,110B
77F19B39 GDI32.NtGdiGetRegionData MOV EAX,10C3
77F19B58 GDI32.NtGdiSetBitmapBits MOV EAX,1107
77F19C0D GDI32.NtGdiCreatePen MOV EAX,1028
77F19C4C GDI32.NtGdiGetDCPoint MOV EAX,10AA
77F19D4B GDI32.NtGdiLineTo MOV EAX,10E0
77F19E75 GDI32.NtGdiAlphaBlend MOV EAX,1007
77F1A0AA GDI32.NtGdiGetDIBitsInternal MOV EAX,10AE
77F1A133 GDI32.NtGdiDoPalette MOV EAX,107E
77F1A1F4 GDI32.NtGdiMaskBlt MOV EAX,10E3
77F1A36B GDI32.NtGdiCombineRgn MOV EAX,1014
77F1A47A GDI32.NtGdiOffsetRgn MOV EAX,10E8
77F1A76D GDI32.NtGdiFillRgn MOV EAX,1094
77F1AB31 GDI32.NtGdiInvertRgn MOV EAX,10DF
77F1AC70 GDI32.NtGdiExtCreateRegion MOV EAX,108D
77F1ACB0 GDI32.NtGdiCreateRectRgn MOV EAX,1029
77F1AD65 GDI32.NtGdiGetWidthTable MOV EAX,10D8
77F1B040 GDI32.NtGdiGetTextMetricsW MOV EAX,10CF
77F1B065 GDI32.NtGdiGetTextFaceW MOV EAX,10CE
77F1B23F GDI32.NtGdiGetTextExtent MOV EAX,10CC
77F1B4BE GDI32.NtGdiGetDCforBitmap MOV EAX,10A8
77F1B4EC GDI32.NtGdiCreatePatternBrushInternal MOV EAX,1027
77F1B6CE GDI32.NtGdiCreateDIBitmapInternal MOV EAX,1020
77F1B9D3 GDI32.NtGdiStretchDIBitsInternal MOV EAX,1125
77F1BB19 GDI32.NtGdiRectangle MOV EAX,10F5
77F1BD14 GDI32.DdEntry39 MOV EAX,1053
77F1BD45 GDI32.DdEntry53 MOV EAX,1061
77F1BD75 GDI32.DdEntry46 MOV EAX,105A
77F1BE5E GDI32.NtGdiSetIcmMode MOV EAX,1112
77F1BF3E GDI32.NtGdiTransformPoints MOV EAX,1129
77F1BFB2 GDI32.NtGdiGetAndSetDCDword MOV EAX,109B
77F1C0D4 GDI32.NtGdiGetCharABCWidthsW MOV EAX,10A0
77F1C435 GDI32.NtGdiTransparentBlt MOV EAX,112A
77F1C527 GDI32.NtGdiGetTransform MOV EAX,10D0
77F1C53B GDI32.NtGdiModifyWorldTransform MOV EAX,10E4
77F1C680 GDI32.NtGdiGetBoundsRect MOV EAX,109F
77F1C694 GDI32.NtGdiSetBoundsRect MOV EAX,1109
77F1C764 GDI32.NtGdiStretchBlt MOV EAX,1124
77F1C8C7 GDI32.NtGdiEllipse MOV EAX,1080
77F1C94F GDI32.NtGdiRectInRegion MOV EAX,10F6
77F1C9CF GDI32.NtGdiGetFontData MOV EAX,10B1
77F1C9F8 GDI32.NtGdiGetRasterizerCaps MOV EAX,10C1
77F1CD22 GDI32.NtGdiOpenDCW MOV EAX,10E9
77F1D048 GDI32.GetCharWidthInfo MOV EAX,10A4
77F1D0AE GDI32.NtGdiComputeXformCoefficients MOV EAX,1016
77F1D347 GDI32.GdiGetSpoolMessage MOV EAX,10C6
77F1D3CD GDI32.NtGdiGetPixel MOV EAX,10BF
77F1D496 GDI32.NtGdiSetPixel MOV EAX,111A
77F1D547 GDI32.CreateHalftonePalette MOV EAX,1023
77F1D9EF GDI32.NtGdiSetupPublicCFONT MOV EAX,111F
77F1DA61 GDI32.DdEntry20 MOV EAX,1040
77F1DAA9 GDI32.DdEntry23 MOV EAX,1043
77F1DB91 GDI32.NtGdiDeleteClientObj MOV EAX,1077
77F1DBCF GDI32.NtGdiCreateClientObj MOV EAX,101A
77F1DF8F GDI32.NtGdiCombineTransform MOV EAX,1015
77F1E034 GDI32.NtGdiSetVirtualResolution MOV EAX,1120
77F1E24E GDI32.NtGdiSetMetaRgn MOV EAX,1115
77F1EE0D GDI32.NtGdiSetMiterLimit MOV EAX,1116
77F1EF52 GDI32.NtGdiSetSizeDevice MOV EAX,1121
77F1F608 GDI32.NtGdiSetFontXform MOV EAX,1111
77F1F804 GDI32.NtGdiExtCreatePen MOV EAX,108C
77F1FAF8 GDI32.NtGdiSetPUMPDOBJ MOV EAX,1297
77F1FCF4 GDI32.EngCreatePalette MOV EAX,125B
77F20707 GDI32.EngDeletePalette MOV EAX,125E
77F20B24 GDI32.NtGdiExtEscape MOV EAX,108E
77F2184A GDI32.NtGdiRemoveFontResourceW MOV EAX,10F8
77F23D52 GDI32.NtGdiResetDC MOV EAX,10FA
77F24595 GDI32.BRUSHOBJ_ulGetBrushColor MOV EAX,127A
77F245A9 GDI32.XFORMOBJ_iGetXform MOV EAX,127F
77F245BD GDI32.FONTOBJ_pxoGetXform MOV EAX,1281
77F245D1 GDI32.FONTOBJ_pifi MOV EAX,1283
77F24700 GDI32.EngBitBlt MOV EAX,1263
77F24800 GDI32.EngStretchBlt MOV EAX,1264
77F24C95 GDI32.NtGdiBeginPath MOV EAX,100C
77F24D15 GDI32.NtGdiEndPath MOV EAX,1084
77F24D75 GDI32.NtGdiDoBanding MOV EAX,107D
77F252CA GDI32.NtGdiSetLinkedUFIs MOV EAX,1113
77F25354 GDI32.NtGdiSelectClipPath MOV EAX,1103
77F25435 GDI32.NtGdiGetPerBandInfo MOV EAX,107C
77F25499 GDI32.NtGdiOffsetClipRgn MOV EAX,10E7
77F2590F GDI32.EngDeleteSurface MOV EAX,125F
77F25CE0 GDI32.NtGdiEndDoc MOV EAX,1082
77F25E27 GDI32.NtGdiEndPage MOV EAX,1083
77F25E8F GDI32.EngUnlockSurface MOV EAX,1261
77F2611B GDI32.EngTextOut MOV EAX,126F
77F261D9 GDI32.EngStrokePath MOV EAX,1267
77F261ED GDI32.EngStrokeAndFillPath MOV EAX,1269
77F264D8 GDI32.CLIPOBJ_bEnum MOV EAX,1274
77F264EC GDI32.CLIPOBJ_cEnumStart MOV EAX,1275
77F26693 GDI32.NtGdiCloseFigure MOV EAX,1010
77F26745 GDI32.NtGdiStrokeAndFillPath MOV EAX,1126
77F269BD GDI32.EngAssociateSurface MOV EAX,1257
77F269D1 GDI32.EngCreateDeviceSurface MOV EAX,1259
77F269E5 GDI32.NtGdiStartDoc MOV EAX,1122
77F26B74 GDI32.NtGdiStartPage MOV EAX,1123
77F26F29 GDI32.EngCreateBitmap MOV EAX,1258
77F26F3D GDI32.EngLockSurface MOV EAX,1262
77F2742C GDI32.STROBJ_bEnumPositionsOnly MOV EAX,1289
77F27440 GDI32.STROBJ_bGetAdvanceWidths MOV EAX,128A
77F27454 GDI32.STROBJ_vEnumStart MOV EAX,128B
77F27468 GDI32.FONTOBJ_cGetGlyphs MOV EAX,1282
77F2748D GDI32.XFORMOBJ_bApplyXform MOV EAX,127E
77F274A1 GDI32.FONTOBJ_vGetInfo MOV EAX,1280
77F27915 GDI32.HT_Get8BPPFormatPalette MOV EAX,1294
77F27990 GDI32.EngMarkBandingSurface MOV EAX,1266
77F27AD8 GDI32.BRUSHOBJ_hGetColorTransform MOV EAX,127D
77F27B49 GDI32.NtGdiEngComputeGlyphSet MOV EAX,125C
77F280DE GDI32.NtGdiCreateDIBBrush MOV EAX,101F
77F281E0 GDI32.NtGdiEnumObjects MOV EAX,1088
77F2821B GDI32.DdEntry21 MOV EAX,1041
77F2824C GDI32.DdEntry22 MOV EAX,1042
77F282A4 GDI32.DdEntry9 MOV EAX,1035
77F282D7 GDI32.DdEntry52 MOV EAX,1060
77F28313 GDI32.DdEntry12 MOV EAX,1038
77F2834F GDI32.DdEntry28 MOV EAX,1048
77F2838E GDI32.DdEntry36 MOV EAX,1050
77F283BE GDI32.DdEntry30 MOV EAX,104A
77F283EB GDI32.DdEntry44 MOV EAX,1058
77F28435 GDI32.DdEntry18 MOV EAX,103E
77F28471 GDI32.DdEntry27 MOV EAX,1047
77F284D0 GDI32.DdEntry38 MOV EAX,1052
77F289E2 GDI32.DdEntry31 MOV EAX,104B
77F28A45 GDI32.DdEntry26 MOV EAX,1046
77F28A94 GDI32.DdEntry55 MOV EAX,1063
77F28B90 GDI32.DdEntry47 MOV EAX,105B
77F28C82 GDI32.DdEntry19 MOV EAX,103F
77F28E70 GDI32.NtGdiMonoBitmap MOV EAX,10E5
77F29D0A GDI32.NtGdiAddFontResourceW MOV EAX,1002
77F2A057 GDI32.NtGdiGetDeviceCapsAll MOV EAX,10AD
77F2AE7D GDI32.NtGdiCreateMetafileDC MOV EAX,1025
77F2BFEF GDI32.NtGdiGetMiterLimit MOV EAX,10B8
77F2EA8B GDI32.NtGdiGetTextExtentExW MOV EAX,10CD
77F2ED9F GDI32.DdEntry16 MOV EAX,103C
77F2EDEC GDI32.DdEntry15 MOV EAX,103B
77F2F17B GDI32.DdEntry41 MOV EAX,1055
77F2F1B7 GDI32.DdEntry43 MOV EAX,1057
77F2F37D GDI32.DdEntry11 MOV EAX,1037
77F2F3AC GDI32.NtGdiSetFontEnumeration MOV EAX,1110
77F2F4D7 GDI32.EnableEUDC MOV EAX,1081
77F2F4EB GDI32.GdiInitSpool MOV EAX,10DD
77F2F52C GDI32.NtGdiSetBitmapAttributes MOV EAX,1106
77F2F57E GDI32.NtGdiClearBitmapAttributes MOV EAX,1011
77F2F80B GDI32.NtGdiEnumFontOpen MOV EAX,1087
77F2F81F GDI32.NtGdiEnumFontClose MOV EAX,1086
77F2F833 GDI32.NtGdiEnumFontChunk MOV EAX,1085
77F2F9DF GDI32.NtGdiGradientFill MOV EAX,10D9
77F2FE66 GDI32.NtGdiGetSystemPaletteUse MOV EAX,10CA
77F2FF38 GDI32.NtGdiFrameRgn MOV EAX,1099
77F2FF57 GDI32.NtGdiCreateRoundRectRgn MOV EAX,102A
77F303B1 GDI32.NtGdiGetOutlineTextMetricsInternalW MOV EAX,10BD
77F303CD GDI32.NtGdiGetCharWidthW MOV EAX,10A3
77F3BD6A GDI32.NtGdiGetServerMetaFileBits MOV EAX,10C5
77F5002C GDI32.NtGdiAbortDoc MOV EAX,1000
77F50040 GDI32.NtGdiAbortPath MOV EAX,1001
77F50054 GDI32.NtGdiAddRemoteFontToDC MOV EAX,1003
77F50068 GDI32.NtGdiAddFontMemResourceEx MOV EAX,1004
77F5007C GDI32.NtGdiRemoveMergeFont MOV EAX,1005
77F50090 GDI32.NtGdiAddRemoteMMInstanceToDC MOV EAX,1006
77F500A4 GDI32.NtGdiAngleArc MOV EAX,1008
77F500B8 GDI32.AnyLinkedFonts MOV EAX,1009
77F500CA GDI32.FontIsLinked MOV EAX,100A
77F500DE GDI32.NtGdiArcInternal MOV EAX,100B
77F500F2 GDI32.NtGdiCancelDC MOV EAX,100E
77F50106 GDI32.NtGdiCheckBitmapBits MOV EAX,100F
77F5011A GDI32.NtGdiClearBrushAttributes MOV EAX,1012
77F5012E GDI32.NtGdiColorCorrectPalette MOV EAX,1013
77F50142 GDI32.NtGdiConvertMetafileRect MOV EAX,1018
77F50156 GDI32.NtGdiCreateColorSpace MOV EAX,101B
77F5016A GDI32.NtGdiCreateColorTransform MOV EAX,101C
77F5017E GDI32.NtGdiCreateEllipticRgn MOV EAX,1022
77F50192 GDI32.NtGdiCreateHatchBrushInternal MOV EAX,1024
77F501A6 GDI32.NtGdiCreateServerMetaFile MOV EAX,102B
77F501BA GDI32.DdEntry1 MOV EAX,102D
77F501CE GDI32.DdEntry2 MOV EAX,102E
77F501E2 GDI32.DdEntry3 MOV EAX,102F
77F501F6 GDI32.DdEntry4 MOV EAX,1030
77F5020A GDI32.DdEntry5 MOV EAX,1031
77F5021E GDI32.DdEntry6 MOV EAX,1032
77F50232 GDI32.DdEntry7 MOV EAX,1033
77F50246 GDI32.DdEntry8 MOV EAX,1034
77F5025A GDI32.DdEntry10 MOV EAX,1036
77F5026E GDI32.DdEntry13 MOV EAX,1039
77F50282 GDI32.DdEntry14 MOV EAX,103A
77F50296 GDI32.DdEntry17 MOV EAX,103D
77F502AA GDI32.DdEntry24 MOV EAX,1044
77F502BE GDI32.DdEntry25 MOV EAX,1045
77F502D2 GDI32.DdEntry29 MOV EAX,1049
77F502E6 GDI32.DdEntry32 MOV EAX,104C
77F502FA GDI32.DdEntry33 MOV EAX,104D
77F5030E GDI32.DdEntry34 MOV EAX,104E
77F50322 GDI32.DdEntry35 MOV EAX,104F
77F50336 GDI32.DdEntry37 MOV EAX,1051
77F5034A GDI32.DdEntry40 MOV EAX,1054
77F5035E GDI32.DdEntry42 MOV EAX,1056
77F50372 GDI32.DdEntry45 MOV EAX,1059
77F50386 GDI32.DdEntry48 MOV EAX,105C
77F5039A GDI32.DdEntry49 MOV EAX,105D
77F503AE GDI32.DdEntry50 MOV EAX,105E
77F503C2 GDI32.DdEntry51 MOV EAX,105F
77F503D6 GDI32.DdEntry54 MOV EAX,1062
77F503EA GDI32.DdEntry56 MOV EAX,1064
77F503FE GDI32.NtGdiDvpCanCreateVideoPort MOV EAX,1065
77F50412 GDI32.NtGdiDvpColorControl MOV EAX,1066
77F50426 GDI32.NtGdiDvpCreateVideoPort MOV EAX,1067
77F5043A GDI32.NtGdiDvpDestroyVideoPort MOV EAX,1068
77F5044E GDI32.NtGdiDvpFlipVideoPort MOV EAX,1069
77F50462 GDI32.NtGdiDvpGetVideoPortBandwidth MOV EAX,106A
77F50476 GDI32.NtGdiDvpGetVideoPortField MOV EAX,106B
77F5048A GDI32.NtGdiDvpGetVideoPortFlipStatus MOV EAX,106C
77F5049E GDI32.NtGdiDvpGetVideoPortInputFormats MOV EAX,106D
77F504B2 GDI32.NtGdiDvpGetVideoPortLine MOV EAX,106E
77F504C6 GDI32.NtGdiDvpGetVideoPortOutputFormats MOV EAX,106F
77F504DA GDI32.NtGdiDvpGetVideoPortConnectInfo MOV EAX,1070
77F504EE GDI32.NtGdiDvpGetVideoSignalStatus MOV EAX,1071
77F50502 GDI32.NtGdiDvpUpdateVideoPort MOV EAX,1072
77F50516 GDI32.NtGdiDvpWaitForVideoPortSync MOV EAX,1073
77F5052A GDI32.NtGdiDvpAcquireNotification MOV EAX,1074
77F5053E GDI32.NtGdiDvpReleaseNotification MOV EAX,1075
77F50552 GDI32.DdEntry0 MOV EAX,1076
77F50566 GDI32.NtGdiDeleteColorSpace MOV EAX,1078
77F5057A GDI32.NtGdiDeleteColorTransform MOV EAX,1079
77F5058E GDI32.NtGdiDescribePixelFormat MOV EAX,107B
77F505A2 GDI32.NtGdiDrawEscape MOV EAX,107F
77F505B6 GDI32.NtGdiEqualRgn MOV EAX,1089
77F505CA GDI32.NtGdiEudcLoadUnloadLink MOV EAX,108A
77F505DE GDI32.NtGdiExtFloodFill MOV EAX,108F
77F505F2 GDI32.NtGdiFillPath MOV EAX,1093
77F50606 GDI32.NtGdiFlattenPath MOV EAX,1095
77F5061A GDI32.NtGdiForceUFIMapping MOV EAX,1098
77F5062E GDI32.GdiFullscreenControl MOV EAX,109A
77F50642 GDI32.NtGdiGetBitmapDimension MOV EAX,109E
77F50656 GDI32.NtGdiGetCharacterPlacementW MOV EAX,10A1
77F5066A GDI32.NtGdiGetColorAdjustment MOV EAX,10A5
77F5067E GDI32.NtGdiGetDeviceCaps MOV EAX,10AB
77F50692 GDI32.NtGdiGetDeviceGammaRamp MOV EAX,10AC
77F506A6 GDI32.NtGdiGetETM MOV EAX,10AF
77F506BA GDI32.NtGdiGetEudcTimeStampEx MOV EAX,10B0
77F506CE GDI32.NtGdiGetFontResourceInfoInternalW MOV EAX,10B2
77F506E2 GDI32.GetGlyphIndicesW MOV EAX,10B3
77F506F6 GDI32.NtGdiGetGlyphIndicesWInternal MOV EAX,10B4
77F5070A GDI32.NtGdiGetGlyphOutline MOV EAX,10B5
77F5071E GDI32.NtGdiGetKerningPairs MOV EAX,10B6
77F50732 GDI32.NtGdiGetLinkedUFIs MOV EAX,10B7
77F50746 GDI32.NtGdiGetMonitorID MOV EAX,10B9
77F5075A GDI32.NtGdiGetNearestPaletteIndex MOV EAX,10BB
77F5076E GDI32.NtGdiGetObjectBitmapHandle MOV EAX,10BC
77F50782 GDI32.NtGdiGetPath MOV EAX,10BE
77F50796 GDI32.NtGdiGetRealizationInfo MOV EAX,10C2
77F507AA GDI32.NtGdiGetStringBitmapW MOV EAX,10C9
77F507BE GDI32.NtGdiGetUFI MOV EAX,10D1
77F507D2 GDI32.NtGdiGetEmbUFI MOV EAX,10D2
77F507E6 GDI32.NtGdiGetUFIPathname MOV EAX,10D3
77F507FA GDI32.NtGdiGetEmbedFonts MOV EAX,10D4
77F5080C GDI32.NtGdiChangeGhostFont MOV EAX,10D5
77F50820 GDI32.NtGdiAddEmbFontToDC MOV EAX,10D6
77F50834 GDI32.GetFontUnicodeRanges MOV EAX,10D7
77F50848 GDI32.NtGdiIcmBrushInfo MOV EAX,10DB
77F5085C GDI32.NtGdiMakeFontDir MOV EAX,10E1
77F50870 GDI32.NtGdiMakeInfoDC MOV EAX,10E2
77F50884 GDI32.NtGdiPathToRegion MOV EAX,10EC
77F50898 GDI32.NtGdiPlgBlt MOV EAX,10ED
77F508AC GDI32.NtGdiPolyDraw MOV EAX,10EE
77F508C0 GDI32.NtGdiPolyTextOutW MOV EAX,10F0
77F508D4 GDI32.NtGdiPtInRegion MOV EAX,10F1
77F508E8 GDI32.NtGdiPtVisible MOV EAX,10F2
77F508FC GDI32.GdiQueryFonts MOV EAX,10F3
77F50910 GDI32.NtGdiRemoveFontMemResourceEx MOV EAX,10F9
77F50924 GDI32.NtGdiResizePalette MOV EAX,10FB
77F50938 GDI32.NtGdiRoundRect MOV EAX,10FD
77F5094C GDI32.NtGdiScaleViewportExtEx MOV EAX,10FF
77F50960 GDI32.NtGdiScaleWindowExtEx MOV EAX,1100
77F50974 GDI32.NtGdiSelectPen MOV EAX,1105
77F50988 GDI32.NtGdiSetBitmapDimension MOV EAX,1108
77F5099C GDI32.NtGdiSetBrushAttributes MOV EAX,110A
77F509B0 GDI32.NtGdiSetColorAdjustment MOV EAX,110C
77F509C4 GDI32.NtGdiSetColorSpace MOV EAX,110D
77F509D8 GDI32.NtGdiSetDeviceGammaRamp MOV EAX,110E
77F509EC GDI32.SetMagicColors MOV EAX,1114
77F50A00 GDI32.NtGdiGetDeviceWidth MOV EAX,1117
77F50A14 GDI32.NtGdiMirrorWindowOrg MOV EAX,1118
77F50A28 GDI32.NtGdiSetPixelFormat MOV EAX,111B
77F50A3C GDI32.NtGdiSetRectRgn MOV EAX,111C
77F50A50 GDI32.NtGdiSetSystemPaletteUse MOV EAX,111D
77F50A64 GDI32.NtGdiStrokePath MOV EAX,1127
77F50A78 GDI32.NtGdiSwapBuffers MOV EAX,1128
77F50A8C GDI32.NtGdiUnloadPrinterDriver MOV EAX,112B
77F50AA0 GDI32.NtGdiUnrealizeObject MOV EAX,112D
77F50AB4 GDI32.NtGdiUpdateColors MOV EAX,112E
77F50AC8 GDI32.NtGdiWidenPath MOV EAX,112F
77F50ADC GDI32.EngCreateDeviceBitmap MOV EAX,125A
77F50AF0 GDI32.EngCopyBits MOV EAX,125D
77F50B04 GDI32.EngEraseSurface MOV EAX,1260
77F50B18 GDI32.EngPlgBlt MOV EAX,1265
77F50B2C GDI32.EngFillPath MOV EAX,1268
77F50B40 GDI32.EngPaint MOV EAX,126A
77F50B54 GDI32.EngLineTo MOV EAX,126B
77F50B68 GDI32.EngAlphaBlend MOV EAX,126C
77F50B7C GDI32.EngGradientFill MOV EAX,126D
77F50B90 GDI32.EngTransparentBlt MOV EAX,126E
77F50BA4 GDI32.EngStretchBltROP MOV EAX,1270
77F50BB8 GDI32.XLATEOBJ_cGetPalette MOV EAX,1271
77F50BCC GDI32.XLATEOBJ_iXlate MOV EAX,1272
77F50BE0 GDI32.XLATEOBJ_hGetColorTransform MOV EAX,1273
77F50BF4 GDI32.CLIPOBJ_ppoGetPath MOV EAX,1276
77F50C08 GDI32.EngDeletePath MOV EAX,1277
77F50C1C GDI32.EngCreateClip MOV EAX,1278
77F50C2E GDI32.EngDeleteClip MOV EAX,1279
77F50C42 GDI32.BRUSHOBJ_pvAllocRbrush MOV EAX,127B
77F50C56 GDI32.BRUSHOBJ_pvGetRbrush MOV EAX,127C
77F50C6A GDI32.FONTOBJ_pfdg MOV EAX,1284
77F50C7E GDI32.FONTOBJ_pQueryGlyphAttrs MOV EAX,1285
77F50C92 GDI32.FONTOBJ_pvTrueTypeFontFile MOV EAX,1286
77F50CA6 GDI32.FONTOBJ_cGetAllGlyphHandles MOV EAX,1287
77F50CBA GDI32.STROBJ_bEnum MOV EAX,1288
77F50CCE GDI32.STROBJ_dwGetCodePage MOV EAX,128C
77F50CE2 GDI32.PATHOBJ_vGetBounds MOV EAX,128D
77F50CF6 GDI32.PATHOBJ_bEnum MOV EAX,128E
77F50D0A GDI32.PATHOBJ_vEnumStart MOV EAX,128F
77F50D1E GDI32.PATHOBJ_vEnumStartClipLines MOV EAX,1290
77F50D32 GDI32.PATHOBJ_bEnumClipLines MOV EAX,1291
77F50D46 GDI32.NtGdiGetDhpdev MOV EAX,1292
77F50D5A GDI32.EngCheckAbort MOV EAX,1293
77F50D6E GDI32.HT_Get8BPPMaskPalette MOV EAX,1295
77F50D82 GDI32.NtGdiUpdateTransform MOV EAX,1296
77F50D96 GDI32.NtGdiBRUSHOBJ_DeleteRbrush MOV EAX,1298
77F50DAA GDI32.NtGdiUMPDEngFreeUserMem MOV EAX,1299


JMI
March 7th, 2008, 18:59
Blabber:

Don't forget this is an "Imported Blog" and while we certainly appreciate your imput, it is not a comment that appears in the original Hex Blog entry.

Damn fine information though and glad to have it here for others to share.



Regards,

dELTA
March 8th, 2008, 06:47
If Oleh would have his own PR blog for OllyDbg, just like Ilfak has HexBlog for IDA Pro, you would be mentioned more than once in there blab.