npu_kmd.sys - Full PE Import Table
Source: Ghidra import enumeration (npu_kmd_extract_report, EC2)
SHA-256: 8e6f4adeece8f3297a5a68a67a4f02fe732a06bee1aaa66321a82690bff8a5de
Resolved from exactly four modules. No IoCreateDevice / IoCreateSymbolicLink
(WDM) and no Wdf* (KMDF) imports are present; no static dxgkrnl.sys import.
======================================================================
HAL.DLL:
  KeQueryPerformanceCounter
  KeStallExecutionProcessor

KSECDD.SYS:
  BCryptCloseAlgorithmProvider
  BCryptCreateHash
  BCryptDestroyHash
  BCryptFinishHash
  BCryptGetProperty
  BCryptHashData
  BCryptOpenAlgorithmProvider

NTOSKRNL.EXE:
  DbgPrintEx
  EtwRegister
  EtwSetInformation
  EtwUnregister
  EtwWriteTransfer
  ExAllocatePool2
  ExAllocatePoolWithQuotaTag
  ExAllocatePoolWithTag
  ExEventObjectType
  ExFreePoolWithTag
  ExSystemTimeToLocalTime
  ExpInterlockedPopEntrySList
  ExpInterlockedPushEntrySList
  InitializeSListHead
  IoAllocateMdl
  IoAllocateWorkItem
  IoBuildDeviceIoControlRequest
  IoBuildPartialMdl
  IoBuildSynchronousFsdRequest
  IoFreeMdl
  IoFreeWorkItem
  IoGetCurrentProcess
  IoGetDeviceDirectory
  IoGetDeviceInterfaces
  IoGetDeviceObjectPointer
  IoGetDeviceProperty
  IoOpenDeviceRegistryKey
  IoQueueWorkItem
  IoRegisterDeviceInterface
  IoRegisterPlugPlayNotification
  IoUnregisterPlugPlayNotification
  IoWMIRegistrationControl
  IofCallDriver
  KeAcquireGuardedMutex
  KeAcquireInStackQueuedSpinLock
  KeAcquireInStackQueuedSpinLockAtDpcLevel
  KeAcquireSpinLockRaiseToDpc
  KeCancelTimer
  KeClearEvent
  KeDelayExecutionThread
  KeDeregisterBugCheckReasonCallback
  KeGetCurrentIrql
  KeInitializeDpc
  KeInitializeEvent
  KeInitializeGuardedMutex
  KeInitializeMutex
  KeInitializeSemaphore
  KeInitializeSpinLock
  KeInitializeTimer
  KeInvalidateAllCaches
  KeInvalidateRangeAllCaches
  KeLowerIrql
  KeNumberProcessors
  KePulseEvent
  KeQueryActiveProcessorCount
  KeQuerySystemTimePrecise
  KeRegisterBugCheckReasonCallback
  KeReleaseGuardedMutex
  KeReleaseInStackQueuedSpinLock
  KeReleaseInStackQueuedSpinLockFromDpcLevel
  KeReleaseMutex
  KeReleaseSemaphore
  KeReleaseSpinLock
  KeSetEvent
  KeSetPriorityThread
  KeSetTimerEx
  KeTryToAcquireGuardedMutex
  KeWaitForMultipleObjects
  KeWaitForSingleObject
  KfRaiseIrql
  MmAllocateContiguousMemory
  MmAllocateContiguousMemorySpecifyCache
  MmAllocatePagesForMdlEx
  MmFreeContiguousMemory
  MmFreeContiguousMemorySpecifyCache
  MmFreePagesFromMdl
  MmGetPhysicalAddress
  MmGetPhysicalMemoryRanges
  MmGetSystemRoutineAddress
  MmMapLockedPagesSpecifyCache
  MmProbeAndLockPages
  MmProtectDriverSection
  MmUnlockPages
  MmUnmapLockedPages
  ObOpenObjectByPointer
  ObReferenceObjectByHandle
  ObfDereferenceObject
  PoRegisterPowerSettingCallback
  PoUnregisterPowerSettingCallback
  ProbeForRead
  ProbeForWrite
  PsCreateSystemThread
  PsGetCurrentProcessId
  PsGetVersion
  PsTerminateSystemThread
  RtlAddAccessAllowedAce
  RtlAnsiStringToUnicodeString
  RtlCheckRegistryKey
  RtlCompareMemory
  RtlCreateAcl
  RtlCreateRegistryKey
  RtlCreateSecurityDescriptor
  RtlEqualUnicodeString
  RtlFreeUnicodeString
  RtlGetVersion
  RtlInitString
  RtlInitUnicodeString
  RtlNumberOfSetBitsUlongPtr
  RtlQueryRegistryValues
  RtlRaiseException
  RtlSetDaclSecurityDescriptor
  RtlTimeToTimeFields
  RtlWriteRegistryValue
  SeExports
  ZwClose
  ZwCreateEvent
  ZwCreateFile
  ZwCreateKey
  ZwLoadDriver
  ZwOpenEvent
  ZwOpenFile
  ZwOpenKey
  ZwQueryInformationFile
  ZwQuerySystemInformation
  ZwQueryValueKey
  ZwReadFile
  ZwSetValueKey
  ZwUnloadDriver
  ZwWriteFile
  __C_specific_handler
  _purecall
  _vsnwprintf
  sprintf_s
  strcmp
  strlen
  strncmp
  strncpy_s
  strstr
  vsprintf_s
  wcscpy_s
  wcsncpy_s
  wcsrchr

WPPRECORDER.SYS:
  imp_WppRecorderConfigure