!This program cannot be run in DOS mode.
Zy>_Zul
ZRichtl
h.hook
.rdata
H.data
.pdata
B.reloc
fffffff
fffffff
t$ UWATAVAWH
A_A^A\_]
UVWATAUAVAWH
s(D9o0u"A
`A_A^A]A\_^]
UVWATAUAVAWH
D$@H#D$8H
A_A^A]A\_^]
VWATAVAWH
A_A^A\_^
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
"D9V(t&
`A_A^A]A\_^]
x ATAVAWH
0A_A^A\
{ ATAVAWH
0A_A^A\
{ ATAVAWH
fE9$Nu
fE9$^u
0A_A^A\
|$ UAVAWH
@USVWAWH
A__^[]
H!]0!] H!]
M0H!\$ A
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
@USVWATAUAVAWH
p8fD9.u
A_A^A]A\_^[]
WAVAWH
A_A^_
s WAVAWH
WAVAWH
@A_A^_
UVWATAUAVAWH
fD9$Cu
fE9$Au
fE9$Fu
`A_A^A]A\_^]
UWAUAVAWH
D$8!t$0D
D$8!t$0E3
H!t$(H
A_A^A]_]
UVWATAUAVAWH
fD9<Fu
fD;=<M
@D9}xD
A_A^A]A\_^]
UVWATAUAVAWH
fF9$Fu
A_A^A]A\_^]
VWAUAVAWH
A_A^A]_^
UVWATAUAVAWH
D$(L!l$
@A_A^A]A\_^]
D$(L!l$ A
fF94Gu
{ ATAVAWH
A_A^A\
f9)uHH
f9(u?9h u:
p WAVAWH
@A_A^_
x ATAVAWH
l$0H9Fhu$H
A_A^A\
x ATAVAWH
@A_A^A\
SVWATAUAVAWH
A_A^A]A\_^[
@SUAVH
H9D$pr
H9D$8r
D$p9D$DvAH
D$D9D$@s
D$L9D$Ds@
t$ WAVAWH
WAVAWH
@A_A^_
VWAUAVAWH
A_A^A]_^
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
fD9,Au
fD9,pu
A_A^A]A\_^]
UWATAVAWH
A_A^A\_]
G 8XKtaH
D$0H!\$ E3
D$h@88
!\$ E3
@USVWATAUAVAWH
D$Xu7H
H!t$@H
H9L$Hu!H
H+D$HH=
A_A^A]A\_^[]
WATAUAVAWH
A_A^A]A\_
s WATAUAVAWH
A_A^A]A\_
` AUAVAWH
D$(H!l$
D$(L!|$ H
D$(L!|$ H
@A_A^A]
D$ tSD
L$PH!|$H!|$@
WAVAWH
D$(H!\$
VWATAVAWH
fD9$Bu
A_A^A\_^
x UATAVH
x ATAVAWH
0A_A^A\
9\$@uJH
\$ UVWATAUAVAWH
t7fD9't1H
A_A^A]A\_^]
Unable to disasm 0x%Ix => res == DECRES_INPUTERR || DecodedInstructionCount == 0
Disasm
..\..\..\..\KernelLibs\DiStorm3\disasm.c
StopOnBranch is TRUE and there is not enough instructions
DisasmSize is less than min size
DWORD
QWORD
TBYTE
DQWORD
YWORD
REPNZ
;TAKEN
;NOT TAKEN
Buffer can not be null
HlpAllocateUnicodeString
..\..\..\..\KernelLibs\HelperFunctions\HelperFunctions.c
Not enough memory
Can not allocate unicode string %wZ
HlpMatchUnicodeString
Can not upcase %wZ
Can not allocate buffer for wide string
HlpUnicodeStringToWideString
HlpAllocateAnsiString
Can not allocate ansi string for %s
HlpContainsTextA
Path is null
HlpGetProcessImagePath
NtOpenProcess failed!
ZwQueryInformationProcess failed!
Can not allocate memory for buffer
ZwQueryInformationProcess failed 2nd time
ERROR: ZwCreateFile failed!
Cannot allocate buffer
HlpGetSystemRootPath
ERROR: ObReferenceObjectByHandle failed!
ERROR: ObQueryNameString failed!
Current process %s
HlpPrintCurrentProcessName
Can not open process id %d
HlpIsCriticalSystemProcess
STATUS_SUCCESS
STATUS_WAIT_1
STATUS_WAIT_2
STATUS_WAIT_3
STATUS_WAIT_63
STATUS_ABANDONED
STATUS_ABANDONED_WAIT_63
STATUS_USER_APC
STATUS_KERNEL_APC
STATUS_ALERTED
STATUS_TIMEOUT
STATUS_PENDING
STATUS_REPARSE
STATUS_MORE_ENTRIES
STATUS_NOT_ALL_ASSIGNED
STATUS_SOME_NOT_MAPPED
STATUS_OPLOCK_BREAK_IN_PROGRESS
STATUS_VOLUME_MOUNTED
STATUS_RXACT_COMMITTED
STATUS_NOTIFY_CLEANUP
STATUS_NOTIFY_ENUM_DIR
STATUS_NO_QUOTAS_FOR_ACCOUNT
STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED
STATUS_PAGE_FAULT_TRANSITION
STATUS_PAGE_FAULT_DEMAND_ZERO
STATUS_PAGE_FAULT_COPY_ON_WRITE
STATUS_PAGE_FAULT_GUARD_PAGE
STATUS_PAGE_FAULT_PAGING_FILE
STATUS_CACHE_PAGE_LOCKED
STATUS_CRASH_DUMP
STATUS_BUFFER_ALL_ZEROS
STATUS_REPARSE_OBJECT
STATUS_RESOURCE_REQUIREMENTS_CHANGED
STATUS_TRANSLATION_COMPLETE
STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY
DBG_EXCEPTION_HANDLED
DBG_CONTINUE
STATUS_OBJECT_NAME_EXISTS
STATUS_THREAD_WAS_SUSPENDED
STATUS_WORKING_SET_LIMIT_RANGE
STATUS_IMAGE_NOT_AT_BASE
STATUS_RXACT_STATE_CREATED
STATUS_SEGMENT_NOTIFICATION
STATUS_LOCAL_USER_SESSION_KEY
STATUS_BAD_CURRENT_DIRECTORY
STATUS_SERIAL_MORE_WRITES
STATUS_REGISTRY_RECOVERED
STATUS_FT_READ_RECOVERY_FROM_BACKUP
STATUS_FT_WRITE_RECOVERY
STATUS_SERIAL_COUNTER_TIMEOUT
STATUS_NULL_LM_PASSWORD
STATUS_IMAGE_MACHINE_TYPE_MISMATCH
STATUS_RECEIVE_PARTIAL
STATUS_RECEIVE_EXPEDITED
STATUS_RECEIVE_PARTIAL_EXPEDITED
STATUS_EVENT_DONE
STATUS_EVENT_PENDING
STATUS_CHECKING_FILE_SYSTEM
STATUS_FATAL_APP_EXIT
STATUS_PREDEFINED_HANDLE
STATUS_WAS_UNLOCKED
STATUS_SERVICE_NOTIFICATION
STATUS_WAS_LOCKED
STATUS_LOG_HARD_ERROR
STATUS_ALREADY_WIN32
STATUS_WX86_UNSIMULATE
STATUS_WX86_CONTINUE
STATUS_WX86_SINGLE_STEP
STATUS_WX86_BREAKPOINT
STATUS_WX86_EXCEPTION_CONTINUE
STATUS_WX86_EXCEPTION_LASTCHANCE
STATUS_WX86_EXCEPTION_CHAIN
STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE
STATUS_NO_YIELD_PERFORMED
STATUS_TIMER_RESUME_IGNORED
STATUS_ARBITRATION_UNHANDLED
STATUS_CARDBUS_NOT_SUPPORTED
STATUS_WX86_CREATEWX86TIB
STATUS_MP_PROCESSOR_MISMATCH
STATUS_WAKE_SYSTEM
DBG_REPLY_LATER
DBG_UNABLE_TO_PROVIDE_HANDLE
DBG_TERMINATE_THREAD
DBG_TERMINATE_PROCESS
DBG_CONTROL_C
DBG_PRINTEXCEPTION_C
DBG_RIPEXCEPTION
DBG_CONTROL_BREAK
RPC_NT_UUID_LOCAL_ONLY
RPC_NT_SEND_INCOMPLETE
STATUS_CTX_CDM_CONNECT
STATUS_CTX_CDM_DISCONNECT
STATUS_GUARD_PAGE_VIOLATION
STATUS_DATATYPE_MISALIGNMENT
STATUS_BREAKPOINT
STATUS_SINGLE_STEP
STATUS_BUFFER_OVERFLOW
STATUS_NO_MORE_FILES
STATUS_WAKE_SYSTEM_DEBUGGER
STATUS_HANDLES_CLOSED
STATUS_NO_INHERITANCE
STATUS_GUID_SUBSTITUTION_MADE
STATUS_PARTIAL_COPY
STATUS_DEVICE_PAPER_EMPTY
STATUS_DEVICE_POWERED_OFF
STATUS_DEVICE_OFF_LINE
STATUS_DEVICE_BUSY
STATUS_NO_MORE_EAS
STATUS_INVALID_EA_NAME
STATUS_EA_LIST_INCONSISTENT
STATUS_INVALID_EA_FLAG
STATUS_VERIFY_REQUIRED
STATUS_EXTRANEOUS_INFORMATION
STATUS_RXACT_COMMIT_NECESSARY
STATUS_NO_MORE_ENTRIES
STATUS_FILEMARK_DETECTED
STATUS_MEDIA_CHANGED
STATUS_BUS_RESET
STATUS_END_OF_MEDIA
STATUS_BEGINNING_OF_MEDIA
STATUS_MEDIA_CHECK
STATUS_SETMARK_DETECTED
STATUS_NO_DATA_DETECTED
STATUS_REDIRECTOR_HAS_OPEN_HANDLES
STATUS_SERVER_HAS_OPEN_HANDLES
STATUS_ALREADY_DISCONNECTED
STATUS_LONGJUMP
STATUS_DEVICE_REQUIRES_CLEANING
STATUS_DEVICE_DOOR_OPEN
DBG_EXCEPTION_NOT_HANDLED
STATUS_UNSUCCESSFUL
STATUS_NOT_IMPLEMENTED
STATUS_INVALID_INFO_CLASS
STATUS_INFO_LENGTH_MISMATCH
STATUS_ACCESS_VIOLATION
STATUS_IN_PAGE_ERROR
STATUS_PAGEFILE_QUOTA
STATUS_INVALID_HANDLE
STATUS_BAD_INITIAL_STACK
STATUS_BAD_INITIAL_PC
STATUS_INVALID_CID
STATUS_TIMER_NOT_CANCELED
STATUS_INVALID_PARAMETER
STATUS_NO_SUCH_DEVICE
STATUS_NO_SUCH_FILE
STATUS_INVALID_DEVICE_REQUEST
STATUS_END_OF_FILE
STATUS_WRONG_VOLUME
STATUS_NO_MEDIA_IN_DEVICE
STATUS_UNRECOGNIZED_MEDIA
STATUS_NONEXISTENT_SECTOR
STATUS_MORE_PROCESSING_REQUIRED
STATUS_NO_MEMORY
STATUS_CONFLICTING_ADDRESSES
STATUS_NOT_MAPPED_VIEW
STATUS_UNABLE_TO_FREE_VM
STATUS_UNABLE_TO_DELETE_SECTION
STATUS_INVALID_SYSTEM_SERVICE
STATUS_ILLEGAL_INSTRUCTION
STATUS_INVALID_LOCK_SEQUENCE
STATUS_INVALID_VIEW_SIZE
STATUS_INVALID_FILE_FOR_SECTION
STATUS_ALREADY_COMMITTED
STATUS_ACCESS_DENIED
STATUS_BUFFER_TOO_SMALL
STATUS_OBJECT_TYPE_MISMATCH
STATUS_NONCONTINUABLE_EXCEPTION
STATUS_INVALID_DISPOSITION
STATUS_UNWIND
STATUS_BAD_STACK
STATUS_INVALID_UNWIND_TARGET
STATUS_NOT_LOCKED
STATUS_PARITY_ERROR
STATUS_UNABLE_TO_DECOMMIT_VM
STATUS_NOT_COMMITTED
STATUS_INVALID_PORT_ATTRIBUTES
STATUS_PORT_MESSAGE_TOO_LONG
STATUS_INVALID_PARAMETER_MIX
STATUS_INVALID_QUOTA_LOWER
STATUS_DISK_CORRUPT_ERROR
STATUS_OBJECT_NAME_INVALID
STATUS_OBJECT_NAME_NOT_FOUND
STATUS_OBJECT_NAME_COLLISION
STATUS_PORT_DISCONNECTED
STATUS_DEVICE_ALREADY_ATTACHED
STATUS_OBJECT_PATH_INVALID
STATUS_OBJECT_PATH_NOT_FOUND
STATUS_OBJECT_PATH_SYNTAX_BAD
STATUS_DATA_OVERRUN
STATUS_DATA_LATE_ERROR
STATUS_DATA_ERROR
STATUS_CRC_ERROR
STATUS_SECTION_TOO_BIG
STATUS_PORT_CONNECTION_REFUSED
STATUS_INVALID_PORT_HANDLE
STATUS_SHARING_VIOLATION
STATUS_QUOTA_EXCEEDED
STATUS_INVALID_PAGE_PROTECTION
STATUS_MUTANT_NOT_OWNED
STATUS_SEMAPHORE_LIMIT_EXCEEDED
STATUS_PORT_ALREADY_SET
STATUS_SECTION_NOT_IMAGE
STATUS_SUSPEND_COUNT_EXCEEDED
STATUS_THREAD_IS_TERMINATING
STATUS_BAD_WORKING_SET_LIMIT
STATUS_INCOMPATIBLE_FILE_MAP
STATUS_SECTION_PROTECTION
STATUS_EAS_NOT_SUPPORTED
STATUS_EA_TOO_LARGE
STATUS_NONEXISTENT_EA_ENTRY
STATUS_NO_EAS_ON_FILE
STATUS_EA_CORRUPT_ERROR
STATUS_FILE_LOCK_CONFLICT
STATUS_LOCK_NOT_GRANTED
STATUS_DELETE_PENDING
STATUS_CTL_FILE_NOT_SUPPORTED
STATUS_UNKNOWN_REVISION
STATUS_REVISION_MISMATCH
STATUS_INVALID_OWNER
STATUS_INVALID_PRIMARY_GROUP
STATUS_NO_IMPERSONATION_TOKEN
STATUS_CANT_DISABLE_MANDATORY
STATUS_NO_LOGON_SERVERS
STATUS_NO_SUCH_LOGON_SESSION
STATUS_NO_SUCH_PRIVILEGE
STATUS_PRIVILEGE_NOT_HELD
STATUS_INVALID_ACCOUNT_NAME
STATUS_USER_EXISTS
STATUS_NO_SUCH_USER
STATUS_GROUP_EXISTS
STATUS_NO_SUCH_GROUP
STATUS_MEMBER_IN_GROUP
STATUS_MEMBER_NOT_IN_GROUP
STATUS_LAST_ADMIN
STATUS_WRONG_PASSWORD
STATUS_ILL_FORMED_PASSWORD
STATUS_PASSWORD_RESTRICTION
STATUS_LOGON_FAILURE
STATUS_ACCOUNT_RESTRICTION
STATUS_INVALID_LOGON_HOURS
STATUS_INVALID_WORKSTATION
STATUS_PASSWORD_EXPIRED
STATUS_ACCOUNT_DISABLED
STATUS_NONE_MAPPED
STATUS_TOO_MANY_LUIDS_REQUESTED
STATUS_LUIDS_EXHAUSTED
STATUS_INVALID_SUB_AUTHORITY
STATUS_INVALID_ACL
STATUS_INVALID_SID
STATUS_INVALID_SECURITY_DESCR
STATUS_PROCEDURE_NOT_FOUND
STATUS_INVALID_IMAGE_FORMAT
STATUS_NO_TOKEN
STATUS_BAD_INHERITANCE_ACL
STATUS_RANGE_NOT_LOCKED
STATUS_DISK_FULL
STATUS_SERVER_DISABLED
STATUS_SERVER_NOT_DISABLED
STATUS_TOO_MANY_GUIDS_REQUESTED
STATUS_GUIDS_EXHAUSTED
STATUS_INVALID_ID_AUTHORITY
STATUS_AGENTS_EXHAUSTED
STATUS_INVALID_VOLUME_LABEL
STATUS_SECTION_NOT_EXTENDED
STATUS_NOT_MAPPED_DATA
STATUS_RESOURCE_DATA_NOT_FOUND
STATUS_RESOURCE_TYPE_NOT_FOUND
STATUS_RESOURCE_NAME_NOT_FOUND
STATUS_ARRAY_BOUNDS_EXCEEDED
STATUS_FLOAT_DENORMAL_OPERAND
STATUS_FLOAT_DIVIDE_BY_ZERO
STATUS_FLOAT_INEXACT_RESULT
STATUS_FLOAT_INVALID_OPERATION
STATUS_FLOAT_OVERFLOW
STATUS_FLOAT_STACK_CHECK
STATUS_FLOAT_UNDERFLOW
STATUS_INTEGER_DIVIDE_BY_ZERO
STATUS_INTEGER_OVERFLOW
STATUS_PRIVILEGED_INSTRUCTION
STATUS_TOO_MANY_PAGING_FILES
STATUS_FILE_INVALID
STATUS_ALLOTTED_SPACE_EXCEEDED
STATUS_INSUFFICIENT_RESOURCES
STATUS_DFS_EXIT_PATH_FOUND
STATUS_DEVICE_DATA_ERROR
STATUS_DEVICE_NOT_CONNECTED
STATUS_DEVICE_POWER_FAILURE
STATUS_FREE_VM_NOT_AT_BASE
STATUS_MEMORY_NOT_ALLOCATED
STATUS_WORKING_SET_QUOTA
STATUS_MEDIA_WRITE_PROTECTED
STATUS_DEVICE_NOT_READY
STATUS_INVALID_GROUP_ATTRIBUTES
STATUS_BAD_IMPERSONATION_LEVEL
STATUS_CANT_OPEN_ANONYMOUS
STATUS_BAD_VALIDATION_CLASS
STATUS_BAD_TOKEN_TYPE
STATUS_BAD_MASTER_BOOT_RECORD
STATUS_INSTRUCTION_MISALIGNMENT
STATUS_INSTANCE_NOT_AVAILABLE
STATUS_PIPE_NOT_AVAILABLE
STATUS_INVALID_PIPE_STATE
STATUS_PIPE_BUSY
STATUS_ILLEGAL_FUNCTION
STATUS_PIPE_DISCONNECTED
STATUS_PIPE_CLOSING
STATUS_PIPE_CONNECTED
STATUS_PIPE_LISTENING
STATUS_INVALID_READ_MODE
STATUS_IO_TIMEOUT
STATUS_FILE_FORCED_CLOSED
STATUS_PROFILING_NOT_STARTED
STATUS_PROFILING_NOT_STOPPED
STATUS_COULD_NOT_INTERPRET
STATUS_FILE_IS_A_DIRECTORY
STATUS_NOT_SUPPORTED
STATUS_REMOTE_NOT_LISTENING
STATUS_DUPLICATE_NAME
STATUS_BAD_NETWORK_PATH
STATUS_NETWORK_BUSY
STATUS_DEVICE_DOES_NOT_EXIST
STATUS_TOO_MANY_COMMANDS
STATUS_ADAPTER_HARDWARE_ERROR
STATUS_INVALID_NETWORK_RESPONSE
STATUS_UNEXPECTED_NETWORK_ERROR
STATUS_BAD_REMOTE_ADAPTER
STATUS_PRINT_QUEUE_FULL
STATUS_NO_SPOOL_SPACE
STATUS_PRINT_CANCELLED
STATUS_NETWORK_NAME_DELETED
STATUS_NETWORK_ACCESS_DENIED
STATUS_BAD_DEVICE_TYPE
STATUS_BAD_NETWORK_NAME
STATUS_TOO_MANY_NAMES
STATUS_TOO_MANY_SESSIONS
STATUS_SHARING_PAUSED
STATUS_REQUEST_NOT_ACCEPTED
STATUS_REDIRECTOR_PAUSED
STATUS_NET_WRITE_FAULT
STATUS_PROFILING_AT_LIMIT
STATUS_NOT_SAME_DEVICE
STATUS_FILE_RENAMED
STATUS_VIRTUAL_CIRCUIT_CLOSED
STATUS_NO_SECURITY_ON_OBJECT
STATUS_CANT_WAIT
STATUS_PIPE_EMPTY
STATUS_CANT_ACCESS_DOMAIN_INFO
STATUS_CANT_TERMINATE_SELF
STATUS_INVALID_SERVER_STATE
STATUS_INVALID_DOMAIN_STATE
STATUS_INVALID_DOMAIN_ROLE
STATUS_NO_SUCH_DOMAIN
STATUS_DOMAIN_EXISTS
STATUS_DOMAIN_LIMIT_EXCEEDED
STATUS_OPLOCK_NOT_GRANTED
STATUS_INVALID_OPLOCK_PROTOCOL
STATUS_INTERNAL_DB_CORRUPTION
STATUS_INTERNAL_ERROR
STATUS_GENERIC_NOT_MAPPED
STATUS_BAD_DESCRIPTOR_FORMAT
STATUS_INVALID_USER_BUFFER
STATUS_UNEXPECTED_IO_ERROR
STATUS_UNEXPECTED_MM_CREATE_ERR
STATUS_UNEXPECTED_MM_MAP_ERROR
STATUS_UNEXPECTED_MM_EXTEND_ERR
STATUS_NOT_LOGON_PROCESS
STATUS_LOGON_SESSION_EXISTS
STATUS_INVALID_PARAMETER_1
STATUS_INVALID_PARAMETER_2
STATUS_INVALID_PARAMETER_3
STATUS_INVALID_PARAMETER_4
STATUS_INVALID_PARAMETER_5
STATUS_INVALID_PARAMETER_6
STATUS_INVALID_PARAMETER_7
STATUS_INVALID_PARAMETER_8
STATUS_INVALID_PARAMETER_9
STATUS_INVALID_PARAMETER_10
STATUS_INVALID_PARAMETER_11
STATUS_INVALID_PARAMETER_12
STATUS_REDIRECTOR_NOT_STARTED
STATUS_REDIRECTOR_STARTED
STATUS_STACK_OVERFLOW
STATUS_NO_SUCH_PACKAGE
STATUS_BAD_FUNCTION_TABLE
STATUS_VARIABLE_NOT_FOUND
STATUS_DIRECTORY_NOT_EMPTY
STATUS_FILE_CORRUPT_ERROR
STATUS_NOT_A_DIRECTORY
STATUS_BAD_LOGON_SESSION_STATE
STATUS_LOGON_SESSION_COLLISION
STATUS_NAME_TOO_LONG
STATUS_FILES_OPEN
STATUS_CONNECTION_IN_USE
STATUS_MESSAGE_NOT_FOUND
STATUS_PROCESS_IS_TERMINATING
STATUS_INVALID_LOGON_TYPE
STATUS_NO_GUID_TRANSLATION
STATUS_CANNOT_IMPERSONATE
STATUS_IMAGE_ALREADY_LOADED
STATUS_ABIOS_NOT_PRESENT
STATUS_ABIOS_LID_NOT_EXIST
STATUS_ABIOS_LID_ALREADY_OWNED
STATUS_ABIOS_NOT_LID_OWNER
STATUS_ABIOS_INVALID_COMMAND
STATUS_ABIOS_INVALID_LID
STATUS_ABIOS_SELECTOR_NOT_AVAILABLE
STATUS_ABIOS_INVALID_SELECTOR
STATUS_NO_LDT
STATUS_INVALID_LDT_SIZE
STATUS_INVALID_LDT_OFFSET
STATUS_INVALID_LDT_DESCRIPTOR
STATUS_INVALID_IMAGE_NE_FORMAT
STATUS_RXACT_INVALID_STATE
STATUS_RXACT_COMMIT_FAILURE
STATUS_MAPPED_FILE_SIZE_ZERO
STATUS_TOO_MANY_OPENED_FILES
STATUS_CANCELLED
STATUS_CANNOT_DELETE
STATUS_INVALID_COMPUTER_NAME
STATUS_FILE_DELETED
STATUS_SPECIAL_ACCOUNT
STATUS_SPECIAL_GROUP
STATUS_SPECIAL_USER
STATUS_MEMBERS_PRIMARY_GROUP
STATUS_FILE_CLOSED
STATUS_TOO_MANY_THREADS
STATUS_THREAD_NOT_IN_PROCESS
STATUS_TOKEN_ALREADY_IN_USE
STATUS_PAGEFILE_QUOTA_EXCEEDED
STATUS_COMMITMENT_LIMIT
STATUS_INVALID_IMAGE_LE_FORMAT
STATUS_INVALID_IMAGE_NOT_MZ
STATUS_INVALID_IMAGE_PROTECT
STATUS_INVALID_IMAGE_WIN_16
STATUS_LOGON_SERVER_CONFLICT
STATUS_TIME_DIFFERENCE_AT_DC
STATUS_SYNCHRONIZATION_REQUIRED
STATUS_DLL_NOT_FOUND
STATUS_OPEN_FAILED
STATUS_IO_PRIVILEGE_FAILED
STATUS_ORDINAL_NOT_FOUND
STATUS_ENTRYPOINT_NOT_FOUND
STATUS_CONTROL_C_EXIT
STATUS_LOCAL_DISCONNECT
STATUS_REMOTE_DISCONNECT
STATUS_REMOTE_RESOURCES
STATUS_LINK_FAILED
STATUS_LINK_TIMEOUT
STATUS_INVALID_CONNECTION
STATUS_INVALID_ADDRESS
STATUS_DLL_INIT_FAILED
STATUS_MISSING_SYSTEMFILE
STATUS_UNHANDLED_EXCEPTION
STATUS_APP_INIT_FAILURE
STATUS_PAGEFILE_CREATE_FAILED
STATUS_NO_PAGEFILE
STATUS_INVALID_LEVEL
STATUS_WRONG_PASSWORD_CORE
STATUS_ILLEGAL_FLOAT_CONTEXT
STATUS_PIPE_BROKEN
STATUS_REGISTRY_CORRUPT
STATUS_REGISTRY_IO_FAILED
STATUS_NO_EVENT_PAIR
STATUS_UNRECOGNIZED_VOLUME
STATUS_SERIAL_NO_DEVICE_INITED
STATUS_NO_SUCH_ALIAS
STATUS_MEMBER_NOT_IN_ALIAS
STATUS_MEMBER_IN_ALIAS
STATUS_ALIAS_EXISTS
STATUS_LOGON_NOT_GRANTED
STATUS_TOO_MANY_SECRETS
STATUS_SECRET_TOO_LONG
STATUS_INTERNAL_DB_ERROR
STATUS_FULLSCREEN_MODE
STATUS_TOO_MANY_CONTEXT_IDS
STATUS_LOGON_TYPE_NOT_GRANTED
STATUS_NOT_REGISTRY_FILE
STATUS_NT_CROSS_ENCRYPTION_REQUIRED
STATUS_DOMAIN_CTRLR_CONFIG_ERROR
STATUS_FT_MISSING_MEMBER
STATUS_ILL_FORMED_SERVICE_ENTRY
STATUS_ILLEGAL_CHARACTER
STATUS_UNMAPPABLE_CHARACTER
STATUS_UNDEFINED_CHARACTER
STATUS_FLOPPY_VOLUME
STATUS_FLOPPY_ID_MARK_NOT_FOUND
STATUS_FLOPPY_WRONG_CYLINDER
STATUS_FLOPPY_UNKNOWN_ERROR
STATUS_FLOPPY_BAD_REGISTERS
STATUS_DISK_RECALIBRATE_FAILED
STATUS_DISK_OPERATION_FAILED
STATUS_DISK_RESET_FAILED
STATUS_SHARED_IRQ_BUSY
STATUS_FT_ORPHANING
STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT
STATUS_PARTITION_FAILURE
STATUS_INVALID_BLOCK_LENGTH
STATUS_DEVICE_NOT_PARTITIONED
STATUS_UNABLE_TO_LOCK_MEDIA
STATUS_UNABLE_TO_UNLOAD_MEDIA
STATUS_EOM_OVERFLOW
STATUS_NO_MEDIA
STATUS_NO_SUCH_MEMBER
STATUS_INVALID_MEMBER
STATUS_KEY_DELETED
STATUS_NO_LOG_SPACE
STATUS_TOO_MANY_SIDS
STATUS_LM_CROSS_ENCRYPTION_REQUIRED
STATUS_KEY_HAS_CHILDREN
STATUS_CHILD_MUST_BE_VOLATILE
STATUS_DEVICE_CONFIGURATION_ERROR
STATUS_DRIVER_INTERNAL_ERROR
STATUS_INVALID_DEVICE_STATE
STATUS_IO_DEVICE_ERROR
STATUS_DEVICE_PROTOCOL_ERROR
STATUS_BACKUP_CONTROLLER
STATUS_LOG_FILE_FULL
STATUS_TOO_LATE
STATUS_NO_TRUST_LSA_SECRET
STATUS_NO_TRUST_SAM_ACCOUNT
STATUS_TRUSTED_DOMAIN_FAILURE
STATUS_TRUSTED_RELATIONSHIP_FAILURE
STATUS_EVENTLOG_FILE_CORRUPT
STATUS_EVENTLOG_CANT_START
STATUS_TRUST_FAILURE
STATUS_MUTANT_LIMIT_EXCEEDED
STATUS_NETLOGON_NOT_STARTED
STATUS_ACCOUNT_EXPIRED
STATUS_POSSIBLE_DEADLOCK
STATUS_NETWORK_CREDENTIAL_CONFLICT
STATUS_REMOTE_SESSION_LIMIT
STATUS_EVENTLOG_FILE_CHANGED
STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
STATUS_DOMAIN_TRUST_INCONSISTENT
STATUS_FS_DRIVER_REQUIRED
STATUS_NO_USER_SESSION_KEY
STATUS_USER_SESSION_DELETED
STATUS_RESOURCE_LANG_NOT_FOUND
STATUS_INSUFF_SERVER_RESOURCES
STATUS_INVALID_BUFFER_SIZE
STATUS_INVALID_ADDRESS_COMPONENT
STATUS_INVALID_ADDRESS_WILDCARD
STATUS_TOO_MANY_ADDRESSES
STATUS_ADDRESS_ALREADY_EXISTS
STATUS_ADDRESS_CLOSED
STATUS_CONNECTION_DISCONNECTED
STATUS_CONNECTION_RESET
STATUS_TOO_MANY_NODES
STATUS_TRANSACTION_ABORTED
STATUS_TRANSACTION_TIMED_OUT
STATUS_TRANSACTION_NO_RELEASE
STATUS_TRANSACTION_NO_MATCH
STATUS_TRANSACTION_RESPONDED
STATUS_TRANSACTION_INVALID_ID
STATUS_TRANSACTION_INVALID_TYPE
STATUS_NOT_SERVER_SESSION
STATUS_NOT_CLIENT_SESSION
STATUS_CANNOT_LOAD_REGISTRY_FILE
STATUS_DEBUG_ATTACH_FAILED
STATUS_SYSTEM_PROCESS_TERMINATED
STATUS_DATA_NOT_ACCEPTED
STATUS_NO_BROWSER_SERVERS_FOUND
STATUS_VDM_HARD_ERROR
STATUS_DRIVER_CANCEL_TIMEOUT
STATUS_REPLY_MESSAGE_MISMATCH
STATUS_MAPPED_ALIGNMENT
STATUS_IMAGE_CHECKSUM_MISMATCH
STATUS_LOST_WRITEBEHIND_DATA
STATUS_CLIENT_SERVER_PARAMETERS_INVALID
STATUS_PASSWORD_MUST_CHANGE
STATUS_NOT_FOUND
STATUS_NOT_TINY_STREAM
STATUS_RECOVERY_FAILURE
STATUS_STACK_OVERFLOW_READ
STATUS_FAIL_CHECK
STATUS_DUPLICATE_OBJECTID
STATUS_OBJECTID_EXISTS
STATUS_CONVERT_TO_LARGE
STATUS_RETRY
STATUS_FOUND_OUT_OF_SCOPE
STATUS_ALLOCATE_BUCKET
STATUS_PROPSET_NOT_FOUND
STATUS_MARSHALL_OVERFLOW
STATUS_INVALID_VARIANT
STATUS_DOMAIN_CONTROLLER_NOT_FOUND
STATUS_ACCOUNT_LOCKED_OUT
STATUS_HANDLE_NOT_CLOSABLE
STATUS_CONNECTION_REFUSED
STATUS_GRACEFUL_DISCONNECT
STATUS_ADDRESS_ALREADY_ASSOCIATED
STATUS_ADDRESS_NOT_ASSOCIATED
STATUS_CONNECTION_INVALID
STATUS_CONNECTION_ACTIVE
STATUS_NETWORK_UNREACHABLE
STATUS_HOST_UNREACHABLE
STATUS_PROTOCOL_UNREACHABLE
STATUS_PORT_UNREACHABLE
STATUS_REQUEST_ABORTED
STATUS_CONNECTION_ABORTED
STATUS_BAD_COMPRESSION_BUFFER
STATUS_USER_MAPPED_FILE
STATUS_AUDIT_FAILED
STATUS_TIMER_RESOLUTION_NOT_SET
STATUS_CONNECTION_COUNT_LIMIT
STATUS_LOGIN_TIME_RESTRICTION
STATUS_LOGIN_WKSTA_RESTRICTION
STATUS_IMAGE_MP_UP_MISMATCH
STATUS_INSUFFICIENT_LOGON_INFO
STATUS_BAD_DLL_ENTRYPOINT
STATUS_BAD_SERVICE_ENTRYPOINT
STATUS_LPC_REPLY_LOST
STATUS_IP_ADDRESS_CONFLICT1
STATUS_IP_ADDRESS_CONFLICT2
STATUS_REGISTRY_QUOTA_LIMIT
STATUS_PATH_NOT_COVERED
STATUS_NO_CALLBACK_ACTIVE
STATUS_LICENSE_QUOTA_EXCEEDED
STATUS_PWD_TOO_SHORT
STATUS_PWD_TOO_RECENT
STATUS_PWD_HISTORY_CONFLICT
STATUS_PLUGPLAY_NO_DEVICE
STATUS_UNSUPPORTED_COMPRESSION
STATUS_INVALID_HW_PROFILE
STATUS_INVALID_PLUGPLAY_DEVICE_PATH
STATUS_DRIVER_ORDINAL_NOT_FOUND
STATUS_DRIVER_ENTRYPOINT_NOT_FOUND
STATUS_RESOURCE_NOT_OWNED
STATUS_TOO_MANY_LINKS
STATUS_QUOTA_LIST_INCONSISTENT
STATUS_FILE_IS_OFFLINE
STATUS_EVALUATION_EXPIRATION
STATUS_ILLEGAL_DLL_RELOCATION
STATUS_LICENSE_VIOLATION
STATUS_DLL_INIT_FAILED_LOGOFF
STATUS_DRIVER_UNABLE_TO_LOAD
STATUS_DFS_UNAVAILABLE
STATUS_VOLUME_DISMOUNTED
STATUS_WX86_INTERNAL_ERROR
STATUS_WX86_FLOAT_STACK_CHECK
STATUS_VALIDATE_CONTINUE
STATUS_NO_MATCH
STATUS_NO_MORE_MATCHES
STATUS_NOT_A_REPARSE_POINT
STATUS_IO_REPARSE_TAG_INVALID
STATUS_IO_REPARSE_TAG_MISMATCH
STATUS_IO_REPARSE_DATA_INVALID
STATUS_IO_REPARSE_TAG_NOT_HANDLED
STATUS_REPARSE_POINT_NOT_RESOLVED
STATUS_DIRECTORY_IS_A_REPARSE_POINT
STATUS_RANGE_LIST_CONFLICT
STATUS_SOURCE_ELEMENT_EMPTY
STATUS_DESTINATION_ELEMENT_FULL
STATUS_ILLEGAL_ELEMENT_ADDRESS
STATUS_MAGAZINE_NOT_PRESENT
STATUS_REINITIALIZATION_NEEDED
STATUS_ENCRYPTION_FAILED
STATUS_DECRYPTION_FAILED
STATUS_RANGE_NOT_FOUND
STATUS_NO_RECOVERY_POLICY
STATUS_NO_EFS
STATUS_WRONG_EFS
STATUS_NO_USER_KEYS
STATUS_FILE_NOT_ENCRYPTED
STATUS_NOT_EXPORT_FORMAT
STATUS_FILE_ENCRYPTED
STATUS_WMI_GUID_NOT_FOUND
STATUS_WMI_INSTANCE_NOT_FOUND
STATUS_WMI_ITEMID_NOT_FOUND
STATUS_WMI_TRY_AGAIN
STATUS_SHARED_POLICY
STATUS_POLICY_OBJECT_NOT_FOUND
STATUS_POLICY_ONLY_IN_DS
STATUS_VOLUME_NOT_UPGRADED
STATUS_REMOTE_STORAGE_NOT_ACTIVE
STATUS_REMOTE_STORAGE_MEDIA_ERROR
STATUS_NO_TRACKING_SERVICE
STATUS_SERVER_SID_MISMATCH
STATUS_DS_NO_ATTRIBUTE_OR_VALUE
STATUS_DS_INVALID_ATTRIBUTE_SYNTAX
STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED
STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS
STATUS_DS_BUSY
STATUS_DS_UNAVAILABLE
STATUS_DS_NO_RIDS_ALLOCATED
STATUS_DS_NO_MORE_RIDS
STATUS_DS_INCORRECT_ROLE_OWNER
STATUS_DS_RIDMGR_INIT_ERROR
STATUS_DS_OBJ_CLASS_VIOLATION
STATUS_DS_CANT_ON_NON_LEAF
STATUS_DS_CANT_ON_RDN
STATUS_DS_CANT_MOD_OBJ_CLASS
STATUS_DS_CROSS_DOM_MOVE_FAILED
STATUS_DS_GC_NOT_AVAILABLE
STATUS_DIRECTORY_SERVICE_REQUIRED
STATUS_REPARSE_ATTRIBUTE_CONFLICT
STATUS_CANT_ENABLE_DENY_ONLY
STATUS_FLOAT_MULTIPLE_FAULTS
STATUS_FLOAT_MULTIPLE_TRAPS
STATUS_DEVICE_REMOVED
STATUS_JOURNAL_DELETE_IN_PROGRESS
STATUS_JOURNAL_NOT_ACTIVE
STATUS_NOINTERFACE
STATUS_DS_ADMIN_LIMIT_EXCEEDED
STATUS_DRIVER_FAILED_SLEEP
STATUS_MUTUAL_AUTHENTICATION_FAILED
STATUS_CORRUPT_SYSTEM_FILE
STATUS_DATATYPE_MISALIGNMENT_ERROR
STATUS_WMI_READ_ONLY
STATUS_WMI_SET_FAILURE
STATUS_COMMITMENT_MINIMUM
STATUS_REG_NAT_CONSUMPTION
STATUS_TRANSPORT_FULL
STATUS_DS_SAM_INIT_FAILURE
STATUS_ONLY_IF_CONNECTED
STATUS_DS_SENSITIVE_GROUP_VIOLATION
STATUS_PNP_RESTART_ENUMERATION
STATUS_JOURNAL_ENTRY_DELETED
STATUS_DS_CANT_MOD_PRIMARYGROUPID
STATUS_SYSTEM_IMAGE_BAD_SIGNATURE
STATUS_PNP_REBOOT_REQUIRED
STATUS_POWER_STATE_INVALID
STATUS_DS_INVALID_GROUP_TYPE
STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN
STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN
STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER
STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER
STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER
STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER
STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER
STATUS_DS_HAVE_PRIMARY_MEMBERS
STATUS_WMI_NOT_SUPPORTED
STATUS_INSUFFICIENT_POWER
STATUS_SAM_NEED_BOOTKEY_PASSWORD
STATUS_SAM_NEED_BOOTKEY_FLOPPY
STATUS_DS_CANT_START
STATUS_DS_INIT_FAILURE
STATUS_SAM_INIT_FAILURE
STATUS_DS_GC_REQUIRED
STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY
STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS
STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED
STATUS_MULTIPLE_FAULT_VIOLATION
STATUS_NOT_SUPPORTED_ON_SBS
STATUS_WOW_ASSERTION
DBG_NO_STATE_CHANGE
DBG_APP_NOT_IDLE
RPC_NT_INVALID_STRING_BINDING
RPC_NT_WRONG_KIND_OF_BINDING
RPC_NT_INVALID_BINDING
RPC_NT_PROTSEQ_NOT_SUPPORTED
RPC_NT_INVALID_RPC_PROTSEQ
RPC_NT_INVALID_STRING_UUID
RPC_NT_INVALID_ENDPOINT_FORMAT
RPC_NT_INVALID_NET_ADDR
RPC_NT_NO_ENDPOINT_FOUND
RPC_NT_INVALID_TIMEOUT
RPC_NT_OBJECT_NOT_FOUND
RPC_NT_ALREADY_REGISTERED
RPC_NT_TYPE_ALREADY_REGISTERED
RPC_NT_ALREADY_LISTENING
RPC_NT_NO_PROTSEQS_REGISTERED
RPC_NT_NOT_LISTENING
RPC_NT_UNKNOWN_MGR_TYPE
RPC_NT_UNKNOWN_IF
RPC_NT_NO_BINDINGS
RPC_NT_NO_PROTSEQS
RPC_NT_CANT_CREATE_ENDPOINT
RPC_NT_OUT_OF_RESOURCES
RPC_NT_SERVER_UNAVAILABLE
RPC_NT_SERVER_TOO_BUSY
RPC_NT_INVALID_NETWORK_OPTIONS
RPC_NT_NO_CALL_ACTIVE
RPC_NT_CALL_FAILED
RPC_NT_CALL_FAILED_DNE
RPC_NT_PROTOCOL_ERROR
RPC_NT_UNSUPPORTED_TRANS_SYN
RPC_NT_UNSUPPORTED_TYPE
RPC_NT_INVALID_TAG
RPC_NT_INVALID_BOUND
RPC_NT_NO_ENTRY_NAME
RPC_NT_INVALID_NAME_SYNTAX
RPC_NT_UNSUPPORTED_NAME_SYNTAX
RPC_NT_UUID_NO_ADDRESS
RPC_NT_DUPLICATE_ENDPOINT
RPC_NT_UNKNOWN_AUTHN_TYPE
RPC_NT_MAX_CALLS_TOO_SMALL
RPC_NT_STRING_TOO_LONG
RPC_NT_PROTSEQ_NOT_FOUND
RPC_NT_PROCNUM_OUT_OF_RANGE
RPC_NT_BINDING_HAS_NO_AUTH
RPC_NT_UNKNOWN_AUTHN_SERVICE
RPC_NT_UNKNOWN_AUTHN_LEVEL
RPC_NT_INVALID_AUTH_IDENTITY
RPC_NT_UNKNOWN_AUTHZ_SERVICE
EPT_NT_INVALID_ENTRY
EPT_NT_CANT_PERFORM_OP
EPT_NT_NOT_REGISTERED
RPC_NT_NOTHING_TO_EXPORT
RPC_NT_INCOMPLETE_NAME
RPC_NT_INVALID_VERS_OPTION
RPC_NT_NO_MORE_MEMBERS
RPC_NT_NOT_ALL_OBJS_UNEXPORTED
RPC_NT_INTERFACE_NOT_FOUND
RPC_NT_ENTRY_ALREADY_EXISTS
RPC_NT_ENTRY_NOT_FOUND
RPC_NT_NAME_SERVICE_UNAVAILABLE
RPC_NT_INVALID_NAF_ID
RPC_NT_CANNOT_SUPPORT
RPC_NT_NO_CONTEXT_AVAILABLE
RPC_NT_INTERNAL_ERROR
RPC_NT_ZERO_DIVIDE
RPC_NT_ADDRESS_ERROR
RPC_NT_FP_DIV_ZERO
RPC_NT_FP_UNDERFLOW
RPC_NT_FP_OVERFLOW
RPC_NT_CALL_IN_PROGRESS
RPC_NT_NO_MORE_BINDINGS
RPC_NT_GROUP_MEMBER_NOT_FOUND
EPT_NT_CANT_CREATE
RPC_NT_INVALID_OBJECT
RPC_NT_NO_INTERFACES
RPC_NT_CALL_CANCELLED
RPC_NT_BINDING_INCOMPLETE
RPC_NT_COMM_FAILURE
RPC_NT_UNSUPPORTED_AUTHN_LEVEL
RPC_NT_NO_PRINC_NAME
RPC_NT_NOT_RPC_ERROR
RPC_NT_SEC_PKG_ERROR
RPC_NT_NOT_CANCELLED
RPC_NT_INVALID_ASYNC_HANDLE
RPC_NT_INVALID_ASYNC_CALL
RPC_NT_NO_MORE_ENTRIES
RPC_NT_SS_CHAR_TRANS_OPEN_FAIL
RPC_NT_SS_CHAR_TRANS_SHORT_FILE
RPC_NT_SS_IN_NULL_CONTEXT
RPC_NT_SS_CONTEXT_MISMATCH
RPC_NT_SS_CONTEXT_DAMAGED
RPC_NT_SS_HANDLES_MISMATCH
RPC_NT_SS_CANNOT_GET_CALL_HANDLE
RPC_NT_NULL_REF_POINTER
RPC_NT_ENUM_VALUE_OUT_OF_RANGE
RPC_NT_BYTE_COUNT_TOO_SMALL
RPC_NT_BAD_STUB_DATA
RPC_NT_INVALID_ES_ACTION
RPC_NT_WRONG_ES_VERSION
RPC_NT_WRONG_STUB_VERSION
RPC_NT_INVALID_PIPE_OBJECT
RPC_NT_INVALID_PIPE_OPERATION
RPC_NT_WRONG_PIPE_VERSION
RPC_NT_PIPE_CLOSED
RPC_NT_PIPE_DISCIPLINE_ERROR
RPC_NT_PIPE_EMPTY
STATUS_PNP_BAD_MPS_TABLE
STATUS_PNP_TRANSLATION_FAILED
STATUS_PNP_IRQ_TRANSLATION_FAILED
STATUS_CTX_WINSTATION_NAME_INVALID
STATUS_CTX_INVALID_PD
STATUS_CTX_PD_NOT_FOUND
STATUS_CTX_CLOSE_PENDING
STATUS_CTX_NO_OUTBUF
STATUS_CTX_MODEM_INF_NOT_FOUND
STATUS_CTX_INVALID_MODEMNAME
STATUS_CTX_RESPONSE_ERROR
STATUS_CTX_MODEM_RESPONSE_TIMEOUT
STATUS_CTX_MODEM_RESPONSE_NO_CARRIER
STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE
STATUS_CTX_MODEM_RESPONSE_BUSY
STATUS_CTX_MODEM_RESPONSE_VOICE
STATUS_CTX_TD_ERROR
STATUS_CTX_LICENSE_CLIENT_INVALID
STATUS_CTX_LICENSE_NOT_AVAILABLE
STATUS_CTX_LICENSE_EXPIRED
STATUS_CTX_WINSTATION_NOT_FOUND
STATUS_CTX_WINSTATION_NAME_COLLISION
STATUS_CTX_WINSTATION_BUSY
STATUS_CTX_BAD_VIDEO_MODE
STATUS_CTX_GRAPHICS_INVALID
STATUS_CTX_NOT_CONSOLE
STATUS_CTX_CLIENT_QUERY_TIMEOUT
STATUS_CTX_CONSOLE_DISCONNECT
STATUS_CTX_CONSOLE_CONNECT
STATUS_CTX_SHADOW_DENIED
STATUS_CTX_WINSTATION_ACCESS_DENIED
STATUS_CTX_INVALID_WD
STATUS_CTX_WD_NOT_FOUND
STATUS_CTX_SHADOW_INVALID
STATUS_CTX_SHADOW_DISABLED
STATUS_RDP_PROTOCOL_ERROR
STATUS_CTX_CLIENT_LICENSE_NOT_SET
STATUS_CTX_CLIENT_LICENSE_IN_USE
STATUS_ACPI_INVALID_OPCODE
STATUS_ACPI_STACK_OVERFLOW
STATUS_ACPI_ASSERT_FAILED
STATUS_ACPI_INVALID_INDEX
STATUS_ACPI_INVALID_ARGUMENT
STATUS_ACPI_FATAL
STATUS_ACPI_INVALID_SUPERNAME
STATUS_ACPI_INVALID_ARGTYPE
STATUS_ACPI_INVALID_OBJTYPE
STATUS_ACPI_INVALID_TARGETTYPE
STATUS_ACPI_INCORRECT_ARGUMENT_COUNT
STATUS_ACPI_ADDRESS_NOT_MAPPED
STATUS_ACPI_INVALID_EVENTTYPE
STATUS_ACPI_HANDLER_COLLISION
STATUS_ACPI_INVALID_DATA
STATUS_ACPI_INVALID_REGION
STATUS_ACPI_INVALID_ACCESS_SIZE
STATUS_ACPI_ACQUIRE_GLOBAL_LOCK
STATUS_ACPI_ALREADY_INITIALIZED
STATUS_ACPI_NOT_INITIALIZED
STATUS_ACPI_INVALID_MUTEX_LEVEL
STATUS_ACPI_MUTEX_NOT_OWNED
STATUS_ACPI_MUTEX_NOT_OWNER
STATUS_ACPI_RS_ACCESS
STATUS_ACPI_INVALID_TABLE
STATUS_ACPI_REG_HANDLER_FAILED
STATUS_ACPI_POWER_REQUEST_FAILED
NTSTATSTR_UNKNOWN_STATUS
WARNING
SPECIAL
EXCEPTION
ERROR_CRITICAL
Unknown
[%s(%i)]
, GetExceptionCode()=0x%.8X
, NTSTATUS=%s(0x%.8X)
%wZ, %s,line=%i, pid=%d,tid=%d
waiting for flusher %d
System low on resources
Flusher woke up
ZwCreateFile failed!
Flush error %x
Can not get system root path
Can not append \ to path
Can not append %ls to path
Can not create flusher thread
Can not reference flusher thread
Log file initialized %wZ
Wait for thread
Wait completed
Authentication Manager is already initialized!
ZmnAuthInitialize
Authentication\AuthenticationManager.c
Can not register ZmnAuthProcessCallback
Process callback detected an authenticated process is terminating...
ZmnAuthProcessCallback
Last auth process terminated, real time protection disabled
PID %d Created
I am alive :) beat beat beat... PID %d
ZmnAuthSetProcessLastBeat
Authentication Manager is not initialized
ZmnAuthRegisterProcess
%d is already registered
Can not lookup process by id %d
Can not get process name for pid %d
ProcessID %d ProcessName %s registered to #%d slot / total %d
ZmnAuthUnregisterProcess
Unregistered process %d - %s
g_Engine.RegisteredProcesses.Count %d
ZmnAuthIsRegisteredProcessId
DeleteFile %ls
ZmnClnDeleteFilesProcessor
Cleaner\Cleaner.c
DeleteService %ls
ZmnClnDeleteServicesProcessor
Can not allocate unicode string for delete service entry %ls
Can not append %wZ to %wZ
Can not delete service key %wZ
CopyFile %ls
ZmnClnCopyFilesProcessor
Can not clone entry buffer %ls
Can not find position of |
SourcePath: %ls -> DestinationPath: %ls
Can not copy file %ls -> %ls
Can not query key value information for %ls value
ZmnClnProcessEntries
Can not allocate failed entries buffer
Entry %ls
Can not set delete failed entries
Can not delete value
Can not open boot cleaner key
ZmnClnRunCleaner
Can not calculate volume path length for file path %ws
ZmnIoCreateFileBypassFilters
DiskReader\IoManager.c
Can not allocate volume path buffer for %ws
Can not get a handle to volume %ws
Can not reference object by handle
Can not create file %wZ
Can not get system module information size
ZmnIoGetModuleInformationList
Can not alocate buffer for system module information
ZmnIoGetModuleInformationByAddress
ZmnIoGetModuleInformationByName
Can not get system module information (2nd call)
Module %s ?= %s
Found kernel image %s
Can not find system module
ZmnIoGetDriverObjectInformation
Found driver object module %s
Not enough buffer for image path
DriverObjectInfo->ModulePath %s
Can not get system module list
ZmnIoIsFileSystemDriverHooked
Suspicious NTFS CreateRoutine detected in %s
Suspicious NTFS ReadRoutine detected in %s
Suspicious NTFS WriteRoutine detected in %s
Suspicious NTFS DirectoryControlRoutine detected in %s
Fixed dispatch routine %d 0x%llx of %llx
ZmnIoFixDriverDispatchRoutines
Can not allocate unicode strings
ZmnIoGetDeviceObjectForPhysicalDrive
Can not convert disk number integer to unicode string
Can not append drive number to symbolic link
Unable to open symbolic link
Can not alocate unicode string for symlink target
Can not allocate symbolic link target
Can not query symlink target
Symbolic link target is %wZ
Can not get device object for %wZ
TDL3 infection on miniport device
ZmnIoScsiGetMiniportInfectionType
TDL4 infection on miniport device
Can not get system module info list
Miniport->StartIo points to invalid memory!
Miniport->ScsiHandler points to invalid memory!
Top level device object 0x%I64x
ZmnIoScsiGetMiniportForPhysicalDrive
Miniport device object for PhysicalDrive%d is 0x%I64x
Can not get miniport device
ZmnIoScsiGetMiniportInfo
Miniport->pRealDevice = %I64x
Miniport->pRealDriver = %I64x
Miniport->pRealScsiHandler = %I64x
Miniport->pRealStartIo = %I64x
SCSI Operation failed
ZmnIoScsiReadWriteIoCompletionRoutine
SCSI Operation completed with NTSTATUS %X
HighOffset is not NULL!
ZmnIoScsiReadWriteDisk
Can not allocate IRP
Exception occured while trying to lock pages
Using Cloud Miniport Information for Miniport Hook Bypass
Using Old Tactics for Miniport Hook Bypass
Calling Driver Object 0x%I64x Scsi Dispatch @ 0x%I64x with DeviceObject 0x%I64x
srb.ScsiStatus->0x%x srb.SrbStatus->0x%x
Already protected sectors
ZmnIoScsiProtectSectors
Protected sector range 0x%X - 0x%X
ALLOWED %s REQUEST => THREAD 0x%x Sector 0x%x - L%d
ZmnIoScsiNeutralizeOperation
BLOCKED ENEMY WRITE REQUEST => THREAD 0x%x Sector 0x%x - L%d
ZmnIoOpenPhysicalDrive
Drive symlink is %wZ
Can not open physical drive by ZwOpenFile
File path is NULL
ZmnIoSetFileAttributes
Can not open file for read write attributes %ls
Can not set file attibutes %ls
ZmnIoDeleteFile
DeleteFile - %ls
Can not allocate file path string
Can not set file attributes %ls
ZwDeleteFile %X
Can not delete file
Can not create destination file %ls
ZmnIoCopyFile
Can not open source file %ls
Can not reference file by handle %ls
Can not get file size %ls
File size is too big
Can not allocate buffer for source file data %ls
Can not read file data %ls
Can not write to destination file %ls
Can not find port driver %s
ZmnIoScsiSaveMiniportFix
Found port driver with name %s
Saved miniport fix
ZmnIoRemoveReadOnly
ZwQueryInformation file failed for %ls
Can not get volume device
Can not get IoGetDeviceAttachmentBaseRef
Can not reference directory object
ZmnIoQueryDirectoryFile
Wait failed
Can not initialize hook manager
ZmnHmInitialize
HookManager\HookManager.c
Hook manager is not initialized
ZmnHmAddInlineHook
Already hooked function %llx
Can not allocate inline hook structure
Added hook %llx
ZmnHmIsInlineHooked
ZmnHmGetNumberOfInlineHooks
ZmnHmRemoveInlineHook
Function %llx is not hooked
Removed inline hook %llx
Unhooking %llx - Bytes %d
ZmnHmUnHookFunctionInlineInternal
ZmnHmUnHookFunctionInline
This function is not hooked by me
Function at address 0x%llx is UNHOOKED successfully!
ZmnHmHookFunctionInline
pFunction is NULL
Function %llx is already hooked!
Hook function inline %llx
Can not disassemble function
Function at address 0x%Ix is HOOKED successfully!
Can not fix inline hook at address %llx
ZmnHmFixInlineHook
Fixed inline hook at address %llx
Can not get module information for kernel image
ZmnHmCheckAndFixCriticalKernelFunctions
INLINE HOOK -> IofCallDriver
INLINE HOOK -> IofCompleteRequest
INLINE HOOK -> IoCallDriver
INLINE HOOK -> IoCompleteRequest
INLINE HOOK -> NtOpenProcess
INLINE HOOK -> NtQuerySystemInformation
POINTER HOOK -> pIofCallDriver
Pointer hook pIofCallDriver fixed!
POINTER HOOK -> pIofCompleteRequest
Pointer hook pIofCompleteRequest fixed!
Busting rootkit watchdog routine @ %llx
ZmnHmExQueueWorkItemHandler
Rootkit watchdog neutralized :)
Can not set Watchdogs Killed event
ZmnHmPrepareBypassTrampoline
Can not disasm provided prologue until first branch
First branch instruction offset is %d
Looks like there is no infection on the handler
Bytes to clean RAW is %d
Can not convert raw byte count to instruction aligned count
Bytes to clean ALIGNED is %d
Copied %d bytes of prolog to bypass routine
ZmnHmNeutralizeWatchdogs
Can not reference event object by handle
Watchdogs already neutralized...
Can not hook ExQueueWorkItem
Watchdogs neutralized wait result %X
Wait for watchdogs neutralized failed...
Watchdogs neutralized
OffsetPreviousMode is not set yet...
ZmnHmKeSetPreviousMode
Unexpected previous mode value found
ZmnHmZwQuerySystemInformation calling Nt* routine
ZmnHmZwQuerySystemInformation
ZmnHmZwQuerySystemInformation calling Zw* routine
ZmnHmZwOpenProcess calling Nt* routine
ZmnHmZwOpenProcess
ZmnHmZwOpenProcess calling Zw* routine
Request %ws
IoctlCreateFileBypassFilters
IoctlHandler.c
Request %S
IoctlCheckDriverDispatchRoutines
Can not allocate unicode string for driver name %S
Can not reference driver object %wZ
Opened driver object %wZ
Can not get driver object information
IoctlFixDriverDispatchRoutines
Can not get miniport information for disk number %d
IoctlScsiRead
Can not read disk via SCSI
Can not get miniport information
IoctlScsiWrite
Can not open drive %d
IoctlOpenPhysicalDrive
Can not get kernel image information
IoctlGetKernelImageInformation
Can not get miniport information for drive number %d
IoctlDumpMiniportInformation
Can not get driver name for miniport driver
DriverExtension->AddDevice is NULL for miniport object
Can not get system module information list
Can not find AddDevice driver name
Add Device Path:%s
SCSI handler VA is NULL!
Can not find scsi handler module
ScsiHandler Path:%s
Can not find start io handler module base
StartIo Path:%s
Exception while handler information
Can not check critical kernel functions
IoctlFixCriticalKernelFunctions
Enum process modules by id failed
IoctlEnumProcessModules
Request %ls
IoctlCreateKey
Can not convert %ls to UNICODE_STRING
Can not open registry key %ls
Can not open process %d
IoctlOpenProcess
Can not open thread %d
IoctlOpenThread
Can not convert value name %ls to unicode string
IoctlDeleteValue
Can not delete value %wZ
pRequest is invalid
IoctlQueryDirectoryFile
DriverInit
Main.c
System Root Path %wZ
Driver verifier is active
Unable to create DeviceObject %wZ
Unable to create symbolic link
ZAM Driver initialized :) PID %d
ZAM Guard initialized :) PID %d
ZAM Driver - v%d Loaded :):)
DriverEntry
Version Info %d.%d ServicePack %d.%d
Can not allocate early boot pattern
Can not append early boot to *
Can not allocate zam guard pattern
Can not append ZAM guard to *
ZAM Driver Unloaded!
DriverUnload
IO Stack Location is NULL
DeviceIoControlHandler
ProcessID %d is not authorized to send IOCTLs
IOCTL_CREATE_FILE_BYPASS_FILTERS
IOCTL_CHECK_DRIVER_DISPATCH_ROUTINES
IOCTL_FIX_DRIVER_DISPATCH_ROUTINES
IOCTL_REGISTER_PROCESS
IOCTL_SCSI_READ
IOCTL_SCSI_WRITE
IOCTL_OPEN_PHYSICAL_DRIVE
IOCTL_GET_KERNEL_IMAGE_INFORMATION
IOCTL_DUMP_MINIPORT_INFORMATION
IOCTL_FIX_CRITICAL_KERNEL_FUNCTIONS
IOCTL_DELETE_FILE
IOCTL_ENUM_PROCESSES
IOCTL_ENUM_PROCESS_MODULES
IOCTL_CREATE_KEY
IOCTL_DELETE_KEY
IOCTL_PROTECT_REGISTRY
IOCTL_SAVE_MINIPORT_FIX
IOCTL_TERMINATE_PROCESS
IOCTL_OPEN_PROCESS
IOCTL_BLOCK_UNSAFE_DLL
IOCTL_GET_DRIVER_PROTOCOL
IOCTL_DELETE_VALUE
IOCTL_QUERY_DIRECTORY_FILE
ZAM Guard enabled
ZAM Guard disabled
Send system information
Send Sys Info size mismatch
IOCTL_OPEN_THREAD
Enabled RT protection
Disabled RT protection
Unknown IOCTL code provided 0x%X
Response size %d
competitor
ZmnMfPostCreateCallback
MiniFilter\MiniFilter.c
Exception while accessing buffer
ZmnMfPreWriteCallback
New client %d connected to comm port %d
ZmnMfOnPortConnect
port disconnect %d
ZmnMfOnPortDisconnect
Process %d is exiting
ZmnMfProcessNotifyEx
No command line for process %d
New process %d started with cmdline %wZ
Process %d blocked %wZ
Can not get ps create notify routine ex address
ZmnMfSetProcessCreateNotifyRoutine
Register ex routine
NotifyRoutineEx registered
Mini filter registration failed :(
ZmnMfInitialize
Mini filter registered :)
Can not start filtering :(
Filtering started
FltBuildDefaultSecurityDescriptor
Can not create communication port
Comm port created
Minifilter not initialized
ZmnMfDestroy
ZmnMfSendMessage
Can not get process object from pid
No clients are connected from session %d
No heart beats yet...
Last beat is bigger than interval
Data size is bigger than message data size
Can not send message
ZmnMfScanProcessInUserModeById
Can not get process path from process
Scan file in user mode %wZ
Can not send scan process message for %wZ
Scan result for %wZ - %d
ZmnMfScanProcessInUserModeByCommandLine
pInfo->Object = NULL
ZmnNrRegistryCallback
Monitoring\NotifyRoutines.c
Can not get name information for registry object
Can not convert UNICODE_STRING to ZERO terminated UNICODE_STRING
Can not allocate full path for registry key
Can not append slash to full path %wZ
Can not append value name to full path %wZ - %wZ
Protected registry value [%wZ] SET VALUE blocked!
Exception in registry callback
ZmnPhOpenProcess
ProcessHelper\ProcessHelper.c
Can not open thread id %d
ZmnPhOpenThread
Can not get system processes information size
ZmnPhEnumProcesses
Required size for Processes is %d
Can not alocate buffer for system process information
ZwQuerySystemInformation -> ProcessesAndThreadsInformation failed
Process count is %d
Not enough slots for processes, provided pid count is %d
ZwQueryInformationProcess failed
ZmnPhIsWow64Process
Can not query process information
ZmnPhGetPeb
Open Process for PID %d failed
ZmnPhEnumProcessModulesById
Can not get process PEB address %d
Can not reference process object by handle
Invalid address detected
Exception while traversing module list
Critical process termination attempt blocked
ZmnPhTerminateProcessById
Can not open process with TERMINATE access
Can not terminate process
Wait for Process %d starting
Wait for process %d failed
Can not get os version information
ZmnPhGetProcessPath
Can not get process information size
Can not allocate unicode string
Can not get process information
ZmnPhGetParentProcessId
Can not registry Registry Callback
ZmnPrInitialize
ProtectedRegistry\ProtectedRegistry.c
pPath is both NULL
ZmnPrAddEntry
Can not allocate unicode string for key path
Can not allocate list head for protected registry entries
Added new protected registry entry %ls
Provided key path is NULL
ZmnRegCreateKey
RegistryHelper\RegistryHelper.c
Can not open key %wZ
Can not convert unicode string to WCHAR* %wZ
Can not create registry key %ls
Can not open key %ls
Can not allocate buffer for %ls value information
ZmnRegQueryValueKey
%ls value not found
ZwQueryValueKey returned unknown status code
Can not read %ls value
Can not get name length
ZmnRegGetNameInformation
Can not allocate object name information
QueryNameString failed
Called for %wZ
ZmnRegDeleteKey
ZwQueryKey failed
Can not allocate Key Full Information buffer
ZwQueryKey failed (2nd time)
KeyPath %wZ has %d subkeys
ZwEnumerateKey failed for sub key %d of %wZ
Can not allocate memory for basic info
ZwEnumerateKey failed (2nd time) for %d
Can not convert sub key name to unicode string
Can not allocate unicode string for merging sub key name to key path
Can not append slash to SubKeyPath
Can not append SubKeyName to SubKeyPath
Deletion of sub key %wZ failed
Can not delete key %wZ
ALLOW, because dwProcessId=%d <= 10
ZmnPgIsOperationAllowed
SelfGuard\ProcessGuard.c
Can not allocate unicode string for suspect process
HlpGetProcessImagePath failed!
Current process %wZ
HlpAllocateUnicodeString failed!
%wZ is not allowed to open a registered process
Process guard is disabled
ALLOW, because KeGetCurrentIrql() != PASSIVE_LEVEL
Blocked TERMINATE access to ZAM
ZmnPgOpenProcessObjectPreCallback
Handle is kernel handle for PID %d
PID %d is allowed to open PID %d with terminate access
Process id %d wants to open itself
Can not find address of ObRegisterCallbacks
ZmnPgBlockOpenProcess64
Can not register object callbacks
Self guard is already initialized!
ZmnSgInitialize
SelfGuard\SelfGuard.c
Can not register ZmnNrLoadImageNotifyRoutine
Registered ZmnNrLoadImageNotifyRoutine
Can not register ZmnSgLoadDriverNotifyRoutine
Registered ZmnSgLoadDriverNotifyRoutine
Can not get OEP of image
ZmnSgBlockDriver
Unknown machine format for driver
Blocked driver at image base %I64x
Block drivers can not be run in DriverMode %d
ZmnSgBlockBootDrivers
Can not openearly boot driver key %wZ
Can not read value of %ls
Type of boot block value is not REG_MULTI_SZ
BootBlock value is empty
Boot block value %d. %ls
Can not block boot driver %s
pDosHeader HlpIsUserModePointerValid failed
ZmnSgGetArchitecture
pNtHeaders32 HlpIsUserModePointerValid failed
ZmnSgGetImageSignature
Can not block driver
ZmnSgLoadDriverNotifyRoutine
Load image %wZ
ZmnSgLoadImageNotifyRoutine
Can not read DLL OEP bytes
Can not block executable
PID %d - Blocked executable %wZ
PID %d - Blocked real time threat %wZ
PID %d - Blocked real time threat
ZmnSgReadOEP
ProbeForWrite failed
ZmnSgBlockExecutable
ZmnHmScsiHookHandlerTrampoline
ZmnHmStartIoHookTrampoline
ZmnHmScsiHookBypassTrampoline
ZmnHmStartIoHookBypassTrampoline
ZmnHmExQueueWorkItemTrampoline
V3k2]X:
UNDEFINED
CALL FAR
LOOPNZ
JMP FAR
SYSCALL
SYSRET
WBINVD
SYSENTER
SYSEXIT
GETSEC
CMOVNO
CMOVAE
CMOVNZ
CMOVBE
CMOVNS
CMOVNP
CMOVGE
CMOVLE
CMPXCHG
MOVNTI
FLDENV
FLDL2T
FLDL2E
FLDLG2
FLDLN2
FPATAN
FXTRACT
FPREM1
FDECSTP
FINCSTP
FYL2XP1
FSINCOS
FRNDINT
FSCALE
FICOMP
FISUBR
FIDIVR
FCMOVB
FCMOVE
FCMOVBE
FCMOVU
FUCOMPP
FISTTP
FCMOVNB
FCMOVNE
FCMOVNBE
FCMOVNU
FEDISI
FSETPM
FUCOMI
FRSTOR
FUCOMP
FCOMPP
FSUBRP
FDIVRP
FUCOMIP
FCOMIP
INVLPG
VMCALL
VMLAUNCH
VMRESUME
VMXOFF
MONITOR
XGETBV
XSETBV
VMMCALL
VMLOAD
VMSAVE
SKINIT
INVLPGA
SWAPGS
RDTSCP
PREFETCH
PREFETCHW
PFNACC
PFPNACC
PFCMPGE
PFRSQRT
PFCMPGT
PFRCPIT1
PFRSQIT1
PFSUBR
PFCMPEQ
PFRCPIT2
PMULHRW
PSWAPD
PAVGUSB
MOVUPS
MOVUPD
VMOVSS
VMOVSD
VMOVUPS
VMOVUPD
MOVHLPS
MOVLPS
MOVLPD
MOVSLDUP
MOVDDUP
VMOVHLPS
VMOVLPS
VMOVLPD
VMOVSLDUP
VMOVDDUP
UNPCKLPS
UNPCKLPD
VUNPCKLPS
VUNPCKLPD
UNPCKHPS
UNPCKHPD
VUNPCKHPS
VUNPCKHPD
MOVLHPS
MOVHPS
MOVHPD
MOVSHDUP
VMOVLHPS
VMOVHPS
VMOVHPD
VMOVSHDUP
PREFETCHNTA
PREFETCHT0
PREFETCHT1
PREFETCHT2
MOVAPS
MOVAPD
VMOVAPS
VMOVAPD
CVTPI2PS
CVTPI2PD
CVTSI2SS
CVTSI2SD
VCVTSI2SS
VCVTSI2SD
MOVNTPS
MOVNTPD
MOVNTSS
MOVNTSD
VMOVNTPS
VMOVNTPD
CVTTPS2PI
CVTTPD2PI
CVTTSS2SI
CVTTSD2SI
VCVTTSS2SI
VCVTTSD2SI
CVTPS2PI
CVTPD2PI
CVTSS2SI
CVTSD2SI
VCVTSS2SI
VCVTSD2SI
UCOMISS
UCOMISD
VUCOMISS
VUCOMISD
COMISS
COMISD
VCOMISS
VCOMISD
MOVMSKPS
MOVMSKPD
VMOVMSKPS
VMOVMSKPD
SQRTPS
SQRTPD
SQRTSS
SQRTSD
VSQRTSS
VSQRTSD
VSQRTPS
VSQRTPD
RSQRTPS
RSQRTSS
VRSQRTSS
VRSQRTPS
VRCPSS
VRCPPS
VANDPS
VANDPD
ANDNPS
ANDNPD
VANDNPS
VANDNPD
VXORPS
VXORPD
VADDPS
VADDPD
VADDSS
VADDSD
VMULPS
VMULPD
VMULSS
VMULSD
CVTPS2PD
CVTPD2PS
CVTSS2SD
CVTSD2SS
VCVTSS2SD
VCVTSD2SS
VCVTPS2PD
VCVTPD2PS
CVTDQ2PS
CVTPS2DQ
CVTTPS2DQ
VCVTDQ2PS
VCVTPS2DQ
VCVTTPS2DQ
VSUBPS
VSUBPD
VSUBSS
VSUBSD
VMINPS
VMINPD
VMINSS
VMINSD
VDIVPS
VDIVPD
VDIVSS
VDIVSD
VMAXPS
VMAXPD
VMAXSS
VMAXSD
PUNPCKLBW
VPUNPCKLBW
PUNPCKLWD
VPUNPCKLWD
PUNPCKLDQ
VPUNPCKLDQ
PACKSSWB
VPACKSSWB
PCMPGTB
VPCMPGTB
PCMPGTW
VPCMPGTW
PCMPGTD
VPCMPGTD
PACKUSWB
VPACKUSWB
PUNPCKHBW
VPUNPCKHBW
PUNPCKHWD
VPUNPCKHWD
PUNPCKHDQ
VPUNPCKHDQ
PACKSSDW
VPACKSSDW
PUNPCKLQDQ
VPUNPCKLQDQ
PUNPCKHQDQ
VPUNPCKHQDQ
MOVDQA
MOVDQU
VMOVDQA
VMOVDQU
PSHUFW
PSHUFD
PSHUFHW
PSHUFLW
VPSHUFD
VPSHUFHW
VPSHUFLW
PCMPEQB
VPCMPEQB
PCMPEQW
VPCMPEQW
PCMPEQD
VPCMPEQD
VZEROUPPER
VZEROALL
VMREAD
INSERTQ
VMWRITE
HADDPD
HADDPS
VHADDPD
VHADDPS
HSUBPD
HSUBPS
VHSUBPD
VHSUBPS
FXSAVE
FXRSTOR
LFENCE
XRSTOR
MFENCE
SFENCE
CLFLUSH
POPCNT
CMPEQPS
CMPLTPS
CMPLEPS
CMPUNORDPS
CMPNEQPS
CMPNLTPS
CMPNLEPS
CMPORDPS
CMPEQPD
CMPLTPD
CMPLEPD
CMPUNORDPD
CMPNEQPD
CMPNLTPD
CMPNLEPD
CMPORDPD
CMPEQSS
CMPLTSS
CMPLESS
CMPUNORDSS
CMPNEQSS
CMPNLTSS
CMPNLESS
CMPORDSS
CMPEQSD
CMPLTSD
CMPLESD
CMPUNORDSD
CMPNEQSD
CMPNLTSD
CMPNLESD
CMPORDSD
VCMPEQPS
VCMPLTPS
VCMPLEPS
VCMPUNORDPS
VCMPNEQPS
VCMPNLTPS
VCMPNLEPS
VCMPORDPS
VCMPEQPD
VCMPLTPD
VCMPLEPD
VCMPUNORDPD
VCMPNEQPD
VCMPNLTPD
VCMPNLEPD
VCMPORDPD
VCMPEQSS
VCMPLTSS
VCMPLESS
VCMPUNORDSS
VCMPNEQSS
VCMPNLTSS
VCMPNLESS
VCMPORDSS
VCMPEQSD
VCMPLTSD
VCMPLESD
VCMPUNORDSD
VCMPNEQSD
VCMPNLTSD
VCMPNLESD
VCMPORDSD
PINSRW
VPINSRW
PEXTRW
VPEXTRW
SHUFPS
SHUFPD
VSHUFPS
VSHUFPD
CMPXCHG8B
CMPXCHG16B
VMPTRST
ADDSUBPD
ADDSUBPS
VADDSUBPD
VADDSUBPS
VPSRLW
VPSRLD
VPSRLQ
VPADDQ
PMULLW
VPMULLW
MOVQ2DQ
MOVDQ2Q
PMOVMSKB
VPMOVMSKB
PSUBUSB
VPSUBUSB
PSUBUSW
VPSUBUSW
PMINUB
VPMINUB
PADDUSB
VPADDUSW
PADDUSW
PMAXUB
VPMAXUB
VPANDN
VPAVGB
VPSRAW
VPSRAD
VPAVGW
PMULHUW
VPMULHUW
PMULHW
VPMULHW
CVTTPD2DQ
CVTDQ2PD
CVTPD2DQ
VCVTTPD2DQ
VCVTDQ2PD
VCVTPD2DQ
MOVNTQ
MOVNTDQ
VMOVNTDQ
PSUBSB
VPSUBSB
PSUBSW
VPSUBSW
PMINSW
VPMINSW
PADDSB
VPADDSB
PADDSW
VPADDSW
PMAXSW
VPMAXSW
VLDDQU
VPSLLW
VPSLLD
VPSLLQ
PMULUDQ
VPMULUDQ
PMADDWD
VPMADDWD
PSADBW
VPSADBW
MASKMOVQ
MASKMOVDQU
VMASKMOVDQU
VPSUBB
VPSUBW