+ExQueueWorkItem()

+ZwCreateEvent()
+PsCreateSystemThread()

diff --git a/src/libcaptive/ke/exports.captivesym b/src/libcaptive/ke/exports.captivesym
index 4e29b87..8f45508 100644 (file)
--- a/src/libcaptive/ke/exports.captivesym
+++ b/src/libcaptive/ke/exports.captivesym
@@ -235,7 +235,7 @@ ntoskrnl.exe        FsRtlFreeFileLock       undef
 ntoskrnl.exe   IoVerifyVolume  undef
 ntoskrnl.exe   _allshr
 ntoskrnl.exe   _aullshr
-ntoskrnl.exe   ExQueueWorkItem undef
+ntoskrnl.exe   ExQueueWorkItem
 ntoskrnl.exe   _except_handler3        undef
 ntoskrnl.exe   _allshl
 ntoskrnl.exe   DbgBreakPoint
@@ -304,6 +304,8 @@ ntoskrnl.exe        RtlGetVersion
 ntoskrnl.exe   KeInitializeMutant      pass
 ntoskrnl.exe   IoRegisterDriverReinitialization
 ntoskrnl.exe   PoQueueShutdownWorkItem
+ntoskrnl.exe   ZwCreateEvent
+ntoskrnl.exe   PsCreateSystemThread
 
 hal.dll        KfReleaseSpinLock
 hal.dll        KeGetCurrentIrql