IAT
| # | rva | value | meaning |
|---|---|---|---|
| 0 | 0x2000 | 0x9a54 | ksecdd.sys!BCryptDestroyKey |
| 1 | 0x2008 | 0x9a40 | ksecdd.sys!BCryptImportKeyPair |
| 2 | 0x2010 | 0x9a2a | ksecdd.sys!BCryptCloseAlgorithmProvider |
| 3 | 0x2018 | 0x9a0a | ksecdd.sys!BCryptVerifySignature |
| 4 | 0x2020 | 0x99f2 | ksecdd.sys!BCryptFinishHash |
| 5 | 0x2028 | 0x99de | ksecdd.sys!BCryptHashData |
| 6 | 0x2030 | 0x99cc | ksecdd.sys!BCryptDestroyHash |
| 7 | 0x2038 | 0x99b8 | ksecdd.sys!BCryptOpenAlgorithmProvider |
| 8 | 0x2040 | 0x999a | ksecdd.sys!BCryptGetProperty |
| 9 | 0x2048 | 0x9a68 | |
| 10 | 0x2050 | 0x0 | ntoskrnl.exe!SePrivilegeCheck |
| 11 | 0x2058 | 0x943e | ntoskrnl.exe!ZwOpenKey |
| 12 | 0x2060 | 0x9452 | ntoskrnl.exe!ProbeForRead |
| 13 | 0x2068 | 0x945e | ntoskrnl.exe!RtlGetVersion |
| 14 | 0x2070 | 0x946e | ntoskrnl.exe!PsProcessType |
| 15 | 0x2078 | 0x947e | ntoskrnl.exe!ObOpenObjectByName |
| 16 | 0x2080 | 0x948e | ntoskrnl.exe!ObGetObjectType |
| 17 | 0x2088 | 0x94a4 | ntoskrnl.exe!PsReleaseProcessExitSynchronization |
| 18 | 0x2090 | 0x94b6 | ntoskrnl.exe!ZwQueryObject |
| 19 | 0x2098 | 0x94dc | ntoskrnl.exe!RtlEqualUnicodeString |