| SSDT | 22621 | 07601 | 03790 | RET |
|---|---|---|---|---|
| NtAccessCheck | 0x00 | 0x61 | 0x61 | 0x20 |
| NtWorkerFactoryWorkerReady | 0x01 | 0x190 | - | 0x04 |
| NtAcceptConnectPort | 0x02 | 0x60 | 0x60 | 0x18 |
| NtMapUserPhysicalPagesScatter | 0x03 | 0x00 | 0x00 | 0x0C |
| NtWaitForSingleObject | 0x04 | 0x01 | 0x01 | 0x0C |
| NtCallbackReturn | 0x05 | 0x02 | 0x02 | 0x0C |
| NtReadFile | 0x06 | 0x03 | 0x03 | 0x24 |
| NtDeviceIoControlFile | 0x07 | 0x04 | 0x04 | 0x28 |
| NtWriteFile | 0x08 | 0x05 | 0x05 | 0x24 |
| NtRemoveIoCompletion | 0x09 | 0x06 | 0x06 | 0x14 |
| NtReleaseSemaphore | 0x0A | 0x07 | 0x07 | 0x0C |
| NtReplyWaitReceivePort | 0x0B | 0x08 | 0x08 | 0x10 |
| NtReplyPort | 0x0C | 0x09 | 0x09 | 0x08 |
| NtSetInformationThread | 0x0D | 0x0A | 0x0A | 0x10 |
| NtSetEvent | 0x0E | 0x0B | 0x0B | 0x08 |
| NtClose | 0x0F | 0x0C | 0x0C | 0x04 |
| NtQueryObject | 0x10 | 0x0D | 0x0D | 0x14 |
| NtQueryInformationFile | 0x11 | 0x0E | 0x0E | 0x14 |
| NtOpenKey | 0x12 | 0x0F | 0x0F | 0x0C |
| NtEnumerateValueKey | 0x13 | 0x10 | 0x10 | 0x18 |
| NtFindAtom | 0x14 | 0x11 | 0x11 | 0x0C |
| NtQueryDefaultLocale | 0x15 | 0x12 | 0x12 | 0x08 |
| NtQueryKey | 0x16 | 0x13 | 0x13 | 0x14 |
| NtQueryValueKey | 0x17 | 0x14 | 0x14 | 0x18 |
| NtAllocateVirtualMemory | 0x18 | 0x15 | 0x15 | 0x18 |
| NtQueryInformationProcess | 0x19 | 0x16 | 0x16 | 0x14 |
| NtWaitForMultipleObjects32 | 0x1A | 0x17 | 0x17 | 0x14 |
| NtWriteFileGather | 0x1B | 0x18 | 0x18 | 0x24 |
| NtSetInformationProcess | 0x1C | 0x19 | 0x19 | 0x10 |
| NtCreateKey | 0x1D | 0x1A | 0x1A | 0x1C |
| NtFreeVirtualMemory | 0x1E | 0x1B | 0x1B | 0x10 |
| NtImpersonateClientOfPort | 0x1F | 0x1C | 0x1C | 0x08 |
| NtReleaseMutant | 0x20 | 0x1D | 0x1D | 0x08 |
| NtQueryInformationToken | 0x21 | 0x1E | 0x1E | 0x14 |
| NtRequestWaitReplyPort | 0x22 | 0x1F | 0x1F | 0x0C |
| NtQueryVirtualMemory | 0x23 | 0x20 | 0x20 | 0x18 |
| NtOpenThreadToken | 0x24 | 0x21 | 0x21 | 0x10 |
| NtQueryInformationThread | 0x25 | 0x22 | 0x22 | 0x14 |
| NtOpenProcess | 0x26 | 0x23 | 0x23 | 0x10 |
| NtSetInformationFile | 0x27 | 0x24 | 0x24 | 0x14 |
| NtMapViewOfSection | 0x28 | 0x25 | 0x25 | 0x28 |
| NtAccessCheckAndAuditAlarm | 0x29 | 0x26 | 0x26 | 0x2C |
| NtUnmapViewOfSection | 0x2A | 0x27 | 0x27 | 0x08 |
| NtReplyWaitReceivePortEx | 0x2B | 0x28 | 0x28 | 0x14 |
| NtTerminateProcess | 0x2C | 0x29 | 0x29 | 0x08 |
| NtSetEventBoostPriority | 0x2D | 0x2A | 0x2A | 0x04 |
| NtReadFileScatter | 0x2E | 0x2B | 0x2B | 0x24 |
| NtOpenThreadTokenEx | 0x2F | 0x2C | 0x2C | 0x14 |
| NtOpenProcessTokenEx | 0x30 | 0x2D | 0x2D | 0x10 |
| NtQueryPerformanceCounter | 0x31 | 0x2E | 0x2E | 0x08 |
| NtEnumerateKey | 0x32 | 0x2F | 0x2F | 0x18 |
| NtOpenFile | 0x33 | 0x30 | 0x30 | 0x18 |
| NtDelayExecution | 0x34 | 0x31 | 0x31 | 0x08 |
| NtQueryDirectoryFile | 0x35 | 0x32 | 0x32 | 0x2C |
| NtQuerySystemInformation | 0x36 | 0x33 | 0x33 | 0x10 |
| NtOpenSection | 0x37 | 0x34 | 0x34 | 0x0C |
| NtQueryTimer | 0x38 | 0x35 | 0x35 | 0x14 |
| NtFsControlFile | 0x39 | 0x36 | 0x36 | 0x28 |
| NtWriteVirtualMemory | 0x3A | 0x37 | 0x37 | 0x14 |
| NtCloseObjectAuditAlarm | 0x3B | 0x38 | 0x38 | 0x0C |
| NtDuplicateObject | 0x3C | 0x39 | 0x39 | 0x1C |
| NtQueryAttributesFile | 0x3D | 0x3A | 0x3A | 0x08 |
| NtClearEvent | 0x3E | 0x3B | 0x3B | 0x04 |
| NtReadVirtualMemory | 0x3F | 0x3C | 0x3C | 0x14 |
| NtOpenEvent | 0x40 | 0x3D | 0x3D | 0x0C |
| NtAdjustPrivilegesToken | 0x41 | 0x3E | 0x3E | 0x18 |
| NtDuplicateToken | 0x42 | 0x3F | 0x3F | 0x18 |
| NtContinue | 0x43 | 0x40 | 0x40 | 0x08 |
| NtQueryDefaultUILanguage | 0x44 | 0x41 | 0x41 | 0x04 |
| NtQueueApcThread | 0x45 | 0x42 | 0x42 | 0x14 |
| NtYieldExecution | 0x46 | 0x43 | 0x43 | 0x00 |
| NtAddAtom | 0x47 | 0x44 | 0x44 | 0x0C |
| NtCreateEvent | 0x48 | 0x45 | 0x45 | 0x14 |
| NtQueryVolumeInformationFile | 0x49 | 0x46 | 0x46 | 0x14 |
| NtCreateSection | 0x4A | 0x47 | 0x47 | 0x1C |
| NtFlushBuffersFile | 0x4B | 0x48 | 0x48 | 0x08 |
| NtApphelpCacheControl | 0x4C | 0x49 | 0x49 | 0x08 |
| NtCreateProcessEx | 0x4D | 0x4A | 0x4A | 0x24 |
| NtCreateThread | 0x4E | 0x4B | 0x4B | 0x20 |
| NtIsProcessInJob | 0x4F | 0x4C | 0x4C | 0x08 |
| NtProtectVirtualMemory | 0x50 | 0x4D | 0x4D | 0x14 |
| NtQuerySection | 0x51 | 0x4E | 0x4E | 0x14 |
| NtResumeThread | 0x52 | 0x4F | 0x4F | 0x08 |
| NtTerminateThread | 0x53 | 0x50 | 0x50 | 0x08 |
| NtReadRequestData | 0x54 | 0x51 | 0x51 | 0x18 |
| NtCreateFile | 0x55 | 0x52 | 0x52 | 0x2C |
| NtQueryEvent | 0x56 | 0x53 | 0x53 | 0x14 |
| NtWriteRequestData | 0x57 | 0x54 | 0x54 | 0x18 |
| NtOpenDirectoryObject | 0x58 | 0x55 | 0x55 | 0x0C |
| NtAccessCheckByTypeAndAuditAlarm | 0x59 | 0x56 | 0x56 | 0x40 |
| NtQuerySystemTime | 0x5A | ILINE | ILINE | 0x04 |
| NtWaitForMultipleObjects | 0x5B | 0x57 | 0x57 | 0x14 |
| NtSetInformationObject | 0x5C | 0x58 | 0x58 | 0x10 |
| NtCancelIoFile | 0x5D | 0x59 | 0x59 | 0x08 |
| NtTraceEvent | 0x5E | 0x5B | 0x5B | 0x10 |
| NtPowerInformation | 0x5F | 0x5C | 0x5C | 0x14 |
| NtSetValueKey | 0x60 | 0x5D | 0x5D | 0x18 |
| NtCancelTimer | 0x61 | 0x5E | 0x5E | 0x08 |
| NtSetTimer | 0x62 | 0x5F | 0x5F | 0x1C |
| NtAcceptConnectPort | 2 | 0x60 | 0x60 | see2 |
| NtAccessCheck | 0 | 0x61 | 0x61 | see0 |
| NtAccessCheckByType | 0x63 | 0x62 | 0x62 | 0x2C |
| NtAccessCheckByTypeResultList | 0x64 | 0x63 | 0x63 | 0x2C |
| NtAccessCheckByTypeResultListAndAuditAlarm | 0x65 | 0x64 | 0x64 | 0x40 |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle | 0x66 | 0x65 | 0x65 | 0x44 |
| NtAcquireCrossVmMutant | 0x67 | - | - | 0x08 |
| NtAcquireProcessActivityReference | 0x68 | - | - | 0x0C |
| NtAddAtomEx | 0x69 | - | - | 0x10 |
| NtAddBootEntry | 0x6A | 0x66 | 0x66 | 0x08 |
| NtAddDriverEntry | 0x6B | 0x67 | 0x67 | 0x08 |
| NtAdjustGroupsToken | 0x6C | 0x68 | 0x68 | 0x18 |
| NtAdjustTokenClaimsAndDeviceGroups | 0x6D | - | - | 0x40 |
| NtAlertResumeThread | 0x6E | 0x69 | 0x69 | 0x08 |
| NtAlertThread | 0x6F | 0x6A | 0x6A | 0x04 |
| NtAlertThreadByThreadId | 0x70 | - | - | 0x04 |
| NtAllocateLocallyUniqueId | 0x71 | 0x6B | 0x6B | 0x04 |
| NtAllocateReserveObject | 0x72 | 0x6C | - | 0x0C |
| NtAllocateUserPhysicalPages | 0x73 | 0x6D | 0x6C | 0x0C |
| NtAllocateUserPhysicalPagesEx | 0x74 | - | - | 0x14 |
| NtAllocateUuids | 0x75 | 0x6E | 0x6D | 0x10 |
| NtAllocateVirtualMemoryEx | 0x76 | - | - | 0x1C |
| NtAlpcAcceptConnectPort | 0x77 | 0x6F | - | 0x24 |
| NtAlpcCancelMessage | 0x78 | 0x70 | - | 0x0C |
| NtAlpcConnectPort | 0x79 | 0x71 | - | 0x2C |
| NtAlpcConnectPortEx | 0x7A | - | - | 0x2C |
| NtAlpcCreatePort | 0x7B | 0x72 | - | 0x0C |
| NtAlpcCreatePortSection | 0x7C | 0x73 | - | 0x18 |
| NtAlpcCreateResourceReserve | 0x7D | 0x74 | - | 0x10 |
| NtAlpcCreateSectionView | 0x7E | 0x75 | - | 0x0C |
| NtAlpcCreateSecurityContext | 0x7F | 0x76 | - | 0x0C |
| NtAlpcDeletePortSection | 0x80 | 0x77 | - | 0x0C |
| NtAlpcDeleteResourceReserve | 0x81 | 0x78 | - | 0x0C |
| NtAlpcDeleteSectionView | 0x82 | 0x79 | - | 0x0C |
| NtAlpcDeleteSecurityContext | 0x83 | 0x7A | - | 0x0C |
| NtAlpcDisconnectPort | 0x84 | 0x7B | - | 0x08 |
| NtAlpcImpersonateClientContainerOfPort | 0x85 | - | - | 0x0C |
| NtAlpcImpersonateClientOfPort | 0x86 | 0x7C | - | 0x0C |
| NtAlpcOpenSenderProcess | 0x87 | 0x7D | - | 0x18 |
| NtAlpcOpenSenderThread | 0x88 | 0x7E | - | 0x18 |
| NtAlpcQueryInformation | 0x89 | 0x7F | - | 0x14 |
| NtAlpcQueryInformationMessage | 0x8A | 0x80 | - | 0x18 |
| NtAlpcRevokeSecurityContext | 0x8B | 0x81 | - | 0x0C |
| NtAlpcSendWaitReceivePort | 0x8C | 0x82 | - | 0x20 |
| NtAlpcSetInformation | 0x8D | 0x83 | - | 0x10 |
| NtAreMappedFilesTheSame | 0x8E | 0x84 | 0x6E | 0x08 |
| NtAssignProcessToJobObject | 0x8F | 0x85 | 0x6F | 0x08 |
| NtAssociateWaitCompletionPacket | 0x90 | - | - | 0x20 |
| NtCallEnclave | 0x91 | - | - | 0x10 |
| NtCancelIoFileEx | 0x92 | 0x86 | - | 0x0C |
| NtCancelSynchronousIoFile | 0x93 | 0x87 | - | 0x0C |
| NtCancelTimer2 | 0x94 | - | - | 0x08 |
| NtCancelWaitCompletionPacket | 0x95 | - | - | 0x08 |
| NtChangeProcessState | 0x96 | - | - | 0x18 |
| NtChangeThreadState | 0x97 | - | - | 0x18 |
| NtCommitComplete | 0x98 | 0x88 | - | 0x08 |
| NtCommitEnlistment | 0x99 | 0x89 | - | 0x08 |
| NtCommitRegistryTransaction | 0x9A | - | - | 0x08 |
| NtCommitTransaction | 0x9B | 0x8A | - | 0x08 |
| NtCancelDeviceWakeupRequest | - | - | 0x70 | - |
| NtCompactKeys | 0x9C | 0x8B | 0x71 | 0x08 |
| NtCompareObjects | 0x9D | - | - | 0x08 |
| NtCompareSigningLevels | 0x9E | - | - | 0x08 |
| NtCompareTokens | 0x9F | 0x8C | 0x72 | 0x0C |
| NtCompleteConnectPort | 0xA0 | 0x8D | 0x73 | 0x04 |
| NtCompressKey | 0xA1 | 0x8E | 0x74 | 0x04 |
| NtConnectPort | 0xA2 | 0x8F | 0x75 | 0x20 |
| NtContinueEx | 0xA3 | - | - | 0x08 |
| NtConvertBetweenAuxiliaryCounterAndPerformanceCounter | 0xA4 | - | - | 0x10 |
| NtCopyFileChunk | 0xA5 | - | - | 0x28 |
| NtCreateCpuPartition | 0xA6 | - | - | 0x0C |
| NtCreateCrossVmEvent | 0xA7 | - | - | 0x18 |
| NtCreateCrossVmMutant | 0xA8 | - | - | 0x18 |
| NtCreateDebugObject | 0xA9 | 0x90 | 0x76 | 0x10 |
| NtCreateDirectoryObject | 0xAA | 0x91 | 0x77 | 0x0C |
| NtCreateDirectoryObjectEx | 0xAB | - | - | 0x14 |
| NtCreateEnclave | 0xAC | - | - | 0x24 |
| NtCreateEnlistment | 0xAD | 0x92 | - | 0x20 |
| NtCreateEventPair | 0xAE | 0x93 | 0x78 | 0x0C |
| NtCreateIRTimer | 0xAF | - | - | 0x0C |
| NtCreateIoCompletion | 0xB0 | 0x94 | 0x79 | 0x10 |
| NtCreateIoRing | 0xB1 | - | - | 0x14 |
| NtCreateJobObject | 0xB2 | 0x95 | 0x7A | 0x0C |
| NtCreateJobSet | 0xB3 | 0x96 | - | 0x0C |
| NtCreateKeyTransacted | 0xB4 | 0x97 | 0x7B | 0x20 |
| NtCreateKeyedEvent | 0xB5 | 0x98 | 0x7C | 0x10 |
| NtCreateLowBoxToken | 0xB6 | - | - | 0x24 |
| NtCreateMailslotFile | 0xB7 | 0x99 | 0x7D | 0x20 |
| NtCreateMutant | 0xB8 | 0x9A | 0x7E | 0x10 |
| NtCreateNamedPipeFile | 0xB9 | 0x9B | 0x7F | 0x38 |
| NtCreatePagingFile | 0xBA | 0x9C | 0x80 | 0x10 |
| NtCreatePartition | 0xBB | - | - | 0x10 |
| NtCreatePort | 0xBC | 0x9D | 0x81 | 0x14 |
| NtCreatePrivateNamespace | 0xBD | 0x9E | - | 0x10 |
| NtCreateProcess | 0xBE | 0x9F | 0x82 | 0x20 |
| NtCreateProcessStateChange | 0xBF | - | - | 0x14 |
| NtCreateProfile | 0xC0 | 0xA0 | 0x83 | 0x24 |
| NtCreateProfileEx | 0xC1 | 0xA1 | 0x84 | 0x28 |
| NtCreateRegistryTransaction | 0xC2 | - | - | 0x10 |
| NtCreateResourceManager | 0xC3 | 0xA2 | - | 0x1C |
| NtCreateSectionEx | 0xC4 | - | - | 0x24 |
| NtCreateSemaphore | 0xC5 | 0xA3 | - | 0x14 |
| NtCreateSymbolicLinkObject | 0xC6 | 0xA4 | 0x85 | 0x10 |
| NtCreateThreadEx | 0xC7 0xA5 | 0x2C | ||
| NtCreateThreadStateChange | 0xC8 - | 0x14 | ||
| NtCreateTimer | 0xC9 | 0xA6 | 0x86 | 0x10 |
| NtCreateTimer2 | 0xCA | - | - | 0x14 |
| NtCreateToken | 0xCB | 0xA7 | 0x87 | 0x34 |
| NtCreateTokenEx | 0xCC | - | - | 0x44 |
| NtCreateTransaction | 0xCD | 0xA8 | - | 0x28 |
| NtCreateTransactionManager | 0xCE | 0xA9 | - | 0x18 |
| NtCreateUserProcess | 0xCF | 0xAA | - | 0x2C |
| NtCreateWaitCompletionPacket | 0xD0 | - | - | 0x0C |
| NtCreateWaitablePort | 0xD1 | 0xAB | 0x88 | 0x14 |
| NtCreateWnfStateName | 0xD2 | - | - | 0x1C |
| NtCreateWorkerFactory | 0xD3 | 0xAC | - | 0x28 |
| NtDebugActiveProcess | 0xD4 | 0xAD | 0x89 | 0x08 |
| NtDebugContinue | 0xD5 | 0xAE | 0x8A | 0x0C |
| NtDeleteAtom | 0xD6 | 0xAF | 0x8B | 0x04 |
| NtDeleteBootEntry | 0xD7 | 0xB0 | 0x8C | 0x04 |
| NtDeleteDriverEntry | 0xD8 | 0xB1 | 0x8D | 0x04 |
| NtDeleteFile | 0xD9 | 0xB2 | 0x8E | 0x04 |
| NtDeleteKey | 0xDA | 0xB3 | 0x8F | 0x04 |
| NtDeleteObjectAuditAlarm | 0xDB | 0xB4 | 0x90 | 0x0C |
| NtDeletePrivateNamespace | 0xDC | 0xB5 | - | 0x04 |
| NtDeleteValueKey | 0xDD | 0xB6 | 0x91 | 0x08 |
| NtDeleteWnfStateData | 0xDE | 0xB7 | - | 0x08 |
| NtDeleteWnfStateName | 0xDF | - | - | 0x04 |
| NtDirectGraphicsCall | 0xE0 | - | - | 0x14 |
| NtDisableLastKnownGood | 0xE1 | - | - | 0x00 |
| NtDisplayString | 0xE2 | 0xB8 | 0x92 | 0x04 |
| NtDrawText | 0xE3 | 0xB9 | - | 0x04 |
| NtEnableLastKnownGood | 0xE4 | 0xBA | - | 0x00 |
| NtEnumerateBootEntries | 0xE5 | 0xBB | 0x93 | 0x08 |
| NtEnumerateDriverEntries | 0xE6 | 0xBC | 0x94 | 0x08 |
| NtEnumerateSystemEnvironmentValuesEx | 0xE7 | 0xBD | 0x95 | 0x0C |
| NtEnumerateTransactionObject | 0xE8 | 0xBE | - | 0x14 |
| NtExtendSection | 0xE9 | 0xBF | 0x96 | 0x08 |
| NtFilterBootOption | 0xEA | - | - | 0x14 |
| NtFilterToken | 0xEB | 0xC0 | 0x97 | 0x18 |
| NtFilterTokenEx | 0xEC | - | - | 0x38 |
| NtFlushBuffersFileEx | 0xED | - | - | 0x14 |
| NtFlushInstallUILanguage | 0xEE | 0xC1 | - | 0x08 |
| NtFlushInstructionCache | 0xEF | 0xC2 | 0x98 | 0x0C |
| NtFlushKey | 0xF0 | 0xC3 | 0x99 | 0x04 |
| NtFlushProcessWriteBuffers | 0xF1 | 0xC4 | - | 0x00 |
| NtFlushVirtualMemory | 0xF2 | 0xC5 | 0x99 | 0x10 |
| NtFlushWriteBuffer | 0xF3 | 0xC6 | 0x9A | 0x00 |
| NtFreeUserPhysicalPages | 0xF4 | 0xC7 | 0x9B | 0x0C |
| NtFreezeRegistry | 0xF5 | 0xC8 | 0x9C | 0x04 |
| NtFreezeTransactions | 0xF6 | 0xC9 | - | 0x08 |
| NtGetCachedSigningLevel | 0xF7 | - | - | 0x18 |
| NtGetCompleteWnfStateSubscription | 0xF8 | - | - | 0x18 |
| NtGetContextThread | 0xF9 | 0xCA | 0x9D | 0x08 |
| NtGetCurrentProcessorNumber | 0xFA | 0xCB | 0x9E | 0x00 |
| NtGetCurrentProcessorNumberEx | 0xFB | - | - | 0x04 |
| NtGetDevicePowerState | 0xFC | 0xCC | 0x9F | 0x08 |
| NtGetMUIRegistryInfo | 0xFD | 0xCD | - | 0x0C |
| NtGetNextProcess | 0xFE | 0xCE | - | 0x14 |
| NtGetNextThread | 0xFF | 0xCF | - | 0x18 |
| NtGetNlsSectionPtr | 0x100 | 0xD0 | - | 0x14 |
| NtGetNotificationResourceManager | 0x101 | 0xD1 | - | 0x1C |
| NtGetPlugPlayEvent | - | 0xD2 | 0xA0 | - |
| NtGetWriteWatch | 0x102 | 0xD3 | 0xA1 | 0x1C |
| NtImpersonateAnonymousToken | 0x103 | 0xD4 | 0xA2 | 0x04 |
| NtImpersonateThread | 0x104 | 0xD5 | 0xA3 | 0x0C |
| NtInitializeEnclave | 0x105 | - | - | 0x14 |
| NtInitializeNlsFiles | 0x106 | 0xD6 | - | 0x0C |
| NtInitializeRegistry | 0x107 | 0xD7 | 0xA4 | 0x04 |
| NtInitiatePowerAction | 0x108 | 0xD8 | 0xA5 | 0x10 |
| NtIsSystemResumeAutomatic | 0x109 | 0xD9 | 0xA6 | 0x00 |
| NtIsUILanguageComitted | 0x10A | 0xDA | - | 0x00 |
| NtListenPort | 0x10B | 0xDB | 0xA7 | 0x08 |
| NtLoadDriver | 0x10C | 0xDC | 0xA8 | 0x04 |
| NtLoadEnclaveData | 0x10D | - | - | 0x24 |
| NtLoadKey | 0x10E | 0xDD | 0xA9 | 0x08 |
| NtLoadKey2 | 0x10F | 0xDE | 0xAA | 0x0C |
| NtLoadKey3 | 0x110 | - | - | 0x20 |
| NtLoadKeyEx | 0x111 | 0xDF | 0xAB | 0x20 |
| NtLockFile | 0x112 | 0xE0 | 0xAC | 0x28 |
| NtLockProductActivationKeys | 0x113 | 0xE1 | 0xAD | 0x08 |
| NtLockRegistryKey | 0x114 | 0xE2 | 0xAE | 0x04 |
| NtLockVirtualMemory | 0x115 | 0xE3 | 0xAF | 0x10 |
| NtMakePermanentObject | 0x116 | 0xE4 | 0xB0 | 0x04 |
| NtMakeTemporaryObject | 0x117 | 0xE5 | 0xB1 | 0x04 |
| NtManageHotPatch | 0x118 | - | - | 0x10 |
| NtManagePartition | 0x119 | - | - | 0x14 |
| NtMapCMFModule | 0x11A | 0xE6 | - | 0x18 |
| NtMapUserPhysicalPages | 0x11B | 0xE7 | 0xB2 | 0x0C |
| NtMapViewOfSectionEx | 0x11C | - | - | 0x24 |
| NtModifyBootEntry | 0x11D | 0xE8 | 0xB3 | 0x04 |
| NtModifyDriverEntry | 0x11E | 0xE9 | 0xB4 | 0x04 |
| NtNotifyChangeDirectoryFile | 0x11F | 0xEA | 0xB5 | 0x24 |
| NtNotifyChangeDirectoryFileEx | 0x120 | - | 0xB6 | 0x28 |
| NtNotifyChangeKey | 0x121 | 0xEB | 0xB7 | 0x28 |
| NtNotifyChangeMultipleKeys | 0x122 | 0xEC | - | 0x30 |
| NtNotifyChangeSession | 0x123 | 0xED | - | 0x20 |
| NtOpenCpuPartition | 0x124 | - | - | 0x0C |
| NtOpenEnlistment | 0x125 | 0xEE | - | 0x14 |
| NtOpenEventPair | 0x126 | 0xEF | 0xB8 | 0x0C |
| NtOpenIoCompletion | 0x127 | 0xF0 | 0xB9 | 0x0C |
| NtOpenJobObject | 0x128 | 0xF1 | 0xBA | 0x0C |
| NtOpenKeyEx | 0x129 | 0xF2 | - | 0x10 |
| NtOpenKeyTransacted | 0x12A | 0xF3 | - | 0x10 |
| NtOpenKeyTransactedEx | 0x12B | 0xF4 | - | 0x14 |
| NtOpenKeyedEvent | 0x12C | 0xF5 | 0xBB | 0x0C |
| NtOpenMutant | 0x12D | 0xF6 | 0xBC | 0x0C |
| NtOpenObjectAuditAlarm | 0x12E | 0xF7 | 0xBD | 0x30 |
| NtOpenPartition | 0x12F | 0xF8 | - | 0x0C |
| NtOpenPrivateNamespace | 0x130 | 0xF9 | - | 0x10 |
| NtOpenProcessToken | 0x131 | - | 0xBE | 0x0C |
| NtOpenRegistryTransaction | 0x132 | - | - | 0x0C |
| NtOpenResourceManager | 0x133 | 0xFA | - | 0x14 |
| NtOpenSemaphore | 0x134 | 0xFB | 0xBF | 0x0C |
| NtOpenSession | 0x135 | 0xFC | - | 0x0C |
| NtOpenSymbolicLinkObject | 0x136 | 0xFD | 0xC0 | 0x0C |
| NtOpenThread | 0x137 | 0xFE | 0xC1 | 0x10 |
| NtOpenTimer | 0x138 | 0xFF | 0xC2 | 0x0C |
| NtOpenTransaction | 0x139 | 0x100 | - | 0x14 |
| NtOpenTransactionManager | 0x13A | 0x101 | - | 0x18 |
| NtPlugPlayControl | 0x13B | 0x102 | 0xC3 | 0x0C |
| NtPrePrepareComplete | 0x13C | 0x103 | - | 0x08 |
| NtPrePrepareEnlistment | 0x13D | 0x104 | - | 0x08 |
| NtPrepareComplete | 0x13E | 0x105 | - | 0x08 |
| NtPrepareEnlistment | 0x13F | 0x106 | - | 0x08 |
| NtPrivilegeCheck | 0x140 | 0x107 | 0xC4 | 0x0C |
| NtPrivilegeObjectAuditAlarm | 0x141 | 0x108 | 0xC5 | 0x18 |
| NtPrivilegedServiceAuditAlarm | 0x142 | 0x109 | 0xC6 | 0x14 |
| NtPropagationComplete | 0x143 | 0x10A | - | 0x10 |
| NtPropagationFailed | 0x144 | 0x10B | - | 0x0C |
| NtPssCaptureVaSpaceBulk | 0x145 | - | - | 0x14 |
| NtPulseEvent | 0x146 | 0x10C | 0xC7 | 0x08 |
| NtQueryAuxiliaryCounterFrequency | 0x147 | - | - | 0x04 |
| NtQueryBootEntryOrder | 0x148 | 0x10D | 0xC8 | 0x08 |
| NtQueryBootOptions | 0x149 | 0x10E | 0xC9 | 0x08 |
| NtQueryDebugFilterState | 0x14A | 0x10F | 0xCA | 0x08 |
| NtQueryDirectoryFileEx | 0x14B | - | - | 0x28 |
| NtQueryDirectoryObject | 0x14C | 0x110 | 0xCB | 0x1C |
| NtQueryDriverEntryOrder | 0x14D | 0x111 | 0xCC | 0x08 |
| NtQueryEaFile | 0x14E | 0x112 | 0xCD | 0x24 |
| NtQueryFullAttributesFile | 0x14F | 0x113 | 0xCE | 0x08 |
| NtQueryInformationAtom | 0x150 | 0x114 | 0xCF | 0x14 |
| NtQueryInformationByName | 0x151 | - | 0xD0 | 0x14 |
| NtQueryInformationCpuPartition | 0x152 | - | - | 0x14 |
| NtQueryInformationEnlistment | 0x153 | 0x115 | - | 0x14 |
| NtQueryInformationJobObject | 0x154 | 0x116 | - | 0x14 |
| NtQueryInformationPort | 0x155 | 0x117 | 0xD1 | 0x14 |
| NtQueryInformationResourceManager | 0x156 | 0x118 | - | 0x14 |
| NtQueryInformationTransaction | 0x157 | 0x119 | - | 0x14 |
| NtQueryInformationTransactionManager | 0x158 | 0x11A | - | 0x14 |
| NtQueryInformationWorkerFactory | 0x159 | 0x11B | - | 0x14 |
| NtQueryInstallUILanguage | 0x15A | 0x11C | 0xD2 | 0x04 |
| NtQueryIntervalProfile | 0x15B | 0x11D | 0xD3 | 0x08 |
| NtQueryIoCompletion | 0x15C | 0x11E | 0xD4 | 0x14 |
| NtQueryIoRingCapabilities | 0x15D | - | - | 0x08 |
| NtQueryLicenseValue | 0x15E | 0x11F | - | 0x14 |
| NtQueryMultipleValueKey | 0x15F | 0x120 | 0xD5 | 0x18 |
| NtQueryMutant | 0x160 | 0x121 | 0xD6 | 0x14 |
| NtQueryOpenSubKeys | 0x161 | 0x122 | 0xD7 | 0x08 |
| NtQueryOpenSubKeysEx | 0x162 | 0x123 | 0xD8 | 0x10 |
| NtQueryPortInformationProcess | 0x163 | 0x124 | 0xD9 | 0x00 |
| NtQueryQuotaInformationFile | 0x164 | 0x125 | 0xDA | 0x24 |
| NtQuerySecurityAttributesToken | 0x165 | 0x126 | - | 0x18 |
| NtQuerySecurityObject | 0x166 | 0x127 | 0xDB | 0x14 |
| NtQuerySecurityPolicy | 0x167 | - | - | 0x18 |
| NtQuerySemaphore | 0x168 | 0x128 | 0xDC | 0x14 |
| NtQuerySymbolicLinkObject | 0x169 | 0x129 | 0xDD | 0x0C |
| NtQuerySystemEnvironmentValue | 0x16A | 0x12A | 0xDE | 0x10 |
| NtQuerySystemEnvironmentValueEx | 0x16B | 0x12B | 0xDF | 0x14 |
| NtQuerySystemInformationEx | 0x16C | 0x12C | - | 0x18 |
| NtQueryTimerResolution | 0x16D | 0x12D | 0xE0 | 0x0C |
| NtQueryWnfStateData | 0x16E | - | - | 0x18 |
| NtQueryWnfStateNameInformation | 0x16F | - | - | 0x14 |
| NtQueueApcThreadEx | 0x170 | 0x12E | - | 0x18 |
| NtQueueApcThreadEx2 | 0x171 | - | - | 0x1C |
| NtRaiseException | 0x172 | 0x12F | 0xE1 | 0x0C |
| NtRaiseHardError | 0x173 | 0x130 | 0xE2 | 0x18 |
| NtReadOnlyEnlistment | 0x174 | 0x131 | - | 0x08 |
| NtReadVirtualMemoryEx | 0x175 | - | - | 0x18 |
| NtRecoverEnlistment | 0x176 | 0x132 | - | 0x08 |
| NtRecoverResourceManager | 0x177 | 0x133 | - | 0x04 |
| NtRecoverTransactionManager | 0x178 | 0x134 | - | 0x04 |
| NtRegisterProtocolAddressInformation | 0x179 | 0x135 | - | 0x14 |
| NtRegisterThreadTerminatePort | 0x17A | 0x136 | 0xE3 | 0x04 |
| NtReleaseKeyedEvent | 0x17B | 0x137 | 0xE4 | 0x10 |
| NtReleaseWorkerFactoryWorker | 0x17C | 0x138 | - | 0x04 |
| NtRemoveIoCompletionEx | 0x17D | 0x139 | - | 0x18 |
| NtRemoveProcessDebug | 0x17E | 0x13A | 0xE5 | 0x08 |
| NtRenameKey | 0x17F | 0x13B | 0xE6 | 0x08 |
| NtRenameTransactionManager | 0x180 | 0x13C | - | 0x08 |
| NtReplaceKey | 0x181 | 0x13D | 0xE7 | 0x0C |
| NtReplacePartitionUnit | 0x182 | 0x13E | - | 0x0C |
| NtReplyWaitReplyPort | 0x183 | 0x13F | 0xE8 | 0x08 |
| NtRequestDeviceWakeup | - | - | 0xE9 | - |
| NtRequestPort | 0x184 | 0x140 | 0xEA | 0x08 |
| NtRequestWakeupLatency | - | - | 0xEB | - |
| NtResetEvent | 0x185 | 0x141 | 0xEC | 0x08 |
| NtResetWriteWatch | 0x186 | 0x142 | 0xED | 0x0C |
| NtRestoreKey | 0x187 | 0x143 | 0xEE | 0x0C |
| NtResumeProcess | 0x188 | 0x144 | 0xEF | 0x04 |
| NtRevertContainerImpersonation | 0x189 | - | - | 0x00 |
| NtRollbackComplete | 0x18A | 0x145 | - | 0x08 |
| NtRollbackEnlistment | 0x18B | 0x146 | - | 0x08 |
| NtRollbackRegistryTransaction | 0x18C | - | - | 0x08 |
| NtRollbackTransaction | 0x18D | 0x147 | - | 0x08 |
| NtRollforwardTransactionManager | 0x18E | 0x148 | - | 0x08 |
| NtSaveKey | 0x18F | 0x149 | 0xF0 | 0x08 |
| NtSaveKeyEx | 0x190 | 0x14A | 0xF1 | 0x0C |
| NtSaveMergedKeys | 0x191 | 0x14B | 0xF2 | 0x0C |
| NtSecureConnectPort | 0x192 | 0x14C | 0xF3 | 0x24 |
| NtSerializeBoot | 0x193 | 0x14D | - | 0x00 |
| NtSetBootEntryOrder | 0x194 | 0x14E | 0xF4 | 0x08 |
| NtSetBootOptions | 0x195 | 0x14F | 0xF5 | 0x08 |
| NtSetCachedSigningLevel | 0x196 | - | - | 0x14 |
| NtSetCachedSigningLevel2 | 0x197 | - | - | 0x18 |
| NtSetContextThread | 0x198 | 0x150 | 0xF6 | 0x08 |
| NtSetDebugFilterState | 0x199 | 0x151 | 0xF7 | 0x0C |
| NtSetDefaultHardErrorPort | 0x19A | 0x152 | 0xF8 | 0x04 |
| NtSetDefaultLocale | 0x19B | 0x153 | 0xF9 | 0x08 |
| NtSetDefaultUILanguage | 0x19C | 0x154 | 0xFA | 0x04 |
| NtSetDriverEntryOrder | 0x19D | 0x155 | 0xFB | 0x08 |
| NtSetEaFile | 0x19E | 0x156 | 0xFC | 0x10 |
| NtSetHighEventPair | 0x19F | 0x157 | 0xFD | 0x04 |
| NtSetHighWaitLowEventPair | 0x1A0 | 0x158 | 0xFE | 0x04 |
| NtSetIRTimer | 0x1A1 | - | - | 0x08 |
| NtSetInformationCpuPartition | 0x1A2 | - | - | 0x1C |
| NtSetInformationDebugObject | 0x1A3 | 0x159 | 0xFF | 0x14 |
| NtSetInformationEnlistment | 0x1A4 | 0x15A | 0x100 | 0x10 |
| NtSetInformationIoRing | 0x1A5 | 0x15B | 0x101 | 0x10 |
| NtSetInformationJobObject | 0x1A6 | 0x15C | 0x102 | 0x10 |
| NtSetInformationKey | 0x1A7 | 0x15D | - | 0x10 |
| NtSetInformationResourceManager | 0x1A8 | - | - | 0x10 |
| NtSetInformationSymbolicLink | 0x1A9 | - | - | 0x10 |
| NtSetInformationToken | 0x1AA | 0x15E | - | 0x10 |
| NtSetInformationTransaction | 0x1AB | 0x15F | - | 0x10 |
| NtSetInformationTransactionManager | 0x1AC | 0x160 | - | 0x10 |
| NtSetInformationVirtualMemory | 0x1AD | - | - | 0x18 |
| NtSetInformationWorkerFactory | 0x1AE | 0x161 | - | 0x10 |
| NtSetIntervalProfile | 0x1AF | 0x162 | 0x103 | 0x08 |
| NtSetIoCompletion | 0x1B0 | 0x163 | 0x104 | 0x14 |
| NtSetIoCompletionEx | 0x1B1 | 0x164 | - | 0x18 |
| NtSetLdtEntries | 0x1B2 | 0x165 | 0x105 | 0x18 |
| NtSetLowEventPair | 0x1B3 | 0x166 | 0x106 | 0x04 |
| NtSetLowWaitHighEventPair | 0x1B4 | 0x167 | 0x107 | 0x04 |
| NtSetQuotaInformationFile | 0x1B5 | 0x168 | 0x108 | 0x10 |
| NtSetSecurityObject | 0x1B6 | 0x169 | 0x109 | 0x0C |
| NtSetSystemEnvironmentValue | 0x1B7 | 0x16A | 0x10A | 0x08 |
| NtSetSystemEnvironmentValueEx | 0x1B8 | 0x16B | 0x10B | 0x14 |
| NtSetSystemInformation | 0x1B9 | 0x16C | 0x10C | 0x0C |
| NtSetSystemPowerState | 0x1BA | 0x16D | 0x10D | 0x0C |
| NtSetSystemTime | 0x1BB | 0x16E | 0x10E | 0x08 |
| NtSetThreadExecutionState | 0x1BC | 0x16F | 0x10F | 0x08 |
| NtSetTimer2 | 0x1BD | - | - | 0x10 |
| NtSetTimerEx | 0x1BE | 0x170 | - | 0x10 |
| NtSetTimerResolution | 0x1BF | 0x171 | 0x110 | 0x0C |
| NtSetUuidSeed | 0x1C0 | 0x172 | 0x111 | 0x04 |
| NtSetVolumeInformationFile | 0x1C1 | 0x173 | 0x112 | 0x14 |
| NtSetWnfProcessNotificationEvent | 0x1C2 | - | 0x113 | 0x04 |
| NtShutdownSystem | 0x1C3 | 0x174 | - | 0x04 |
| NtShutdownWorkerFactory | 0x1C4 | 0x175 | - | 0x08 |
| NtSinglePhaseReject | 0x1C6 | 0x177 | - | 0x10 |
| NtStartProfile | 0x1C7 | 0x178 | - | 0x08 |
| NtSignalAndWaitForSingleObject | 0x1C5 | 0x176 | 0x114 | 0x04 |
| NtStartProfile | - | - | 0x115 | - |
| NtStopProfile | 0x1C8 | 0x179 | 0x116 | 0x04 |
| NtSubmitIoRing | 0x1C9 | - | - | 0x10 |
| NtSubscribeWnfStateChange | 0x1CA | - | - | 0x10 |
| NtSuspendProcess | 0x1CB | 0x17A | 0x117 | 0x04 |
| NtSuspendThread | 0x1CC | 0x17B | 0x118 | 0x08 |
| NtSystemDebugControl | 0x1CD | 0x17C | 0x119 | 0x18 |
| NtTerminateEnclave | 0x1CE | - | - | 0x08 |
| NtTerminateJobObject | 0x1CF | 0x17D | 0x11A | 0x08 |
| NtTestAlert | 0x1D0 | 0x17E | 0x11B | 0x00 |
| NtThawRegistry | 0x1D1 | 0x17F | - | 0x00 |
| NtThawTransactions | 0x1D2 | 0x180 | - | 0x00 |
| NtTraceControl | 0x1D3 | 0x181 | - | 0x18 |
| NtTranslateFilePath | 0x1D4 | 0x182 | 0x11C | 0x10 |
| NtUmsThreadYield | 0x1D5 | 0x183 | - | 0x04 |
| NtUnloadDriver | 0x1D6 | 0x184 | 0x11D | 0x04 |
| NtUnloadKey | 0x1D7 | 0x185 | 0x11E | 0x04 |
| NtUnloadKey2 | 0x1D8 | 0x186 | 0x11F | 0x08 |
| NtUnloadKeyEx | 0x1D9 | 0x187 | 0x120 | 0x08 |
| NtUnlockFile | 0x1DA | 0x188 | 0x121 | 0x14 |
| NtUnlockVirtualMemory | 0x1DB | 0x189 | 0x122 | 0x10 |
| NtUnmapViewOfSectionEx | 0x1DC | - | - | 0x0C |
| NtUnsubscribeWnfStateChange | 0x1DD | - | - | 0x04 |
| NtUpdateWnfStateData | 0x1DE | - | - | 0x1C |
| NtVdmControl | 0x1DF | 0x18A | 0x123 | 0x08 |
| NtWaitForAlertByThreadId | 0x1E0 | - | - | 0x08 |
| NtWaitForDebugEvent | 0x1E1 | 0x18B | 0x124 | 0x10 |
| NtWaitForKeyedEvent | 0x1E2 | 0x18C | 0x125 | 0x10 |
| NtWaitForWorkViaWorkerFactory | 0x1E3 | 0x18D | - | 0x14 |
| NtWaitHighEventPair | 0x1E4 | 0x18E | 0x126 | 0x04 |
| NtWaitLowEventPair | 0x1E5 | 0x18F | 0x127 | 0x04 |
| ------------------------------------------------------- | ------- | ------- | ------- | ------- |
| NtWow64CsrClientConnectToServer | 0x1E6 | - | - | 0x14 |
| NtWow64CsrIdentifyAlertableThread | 0x1E7 | - | - | 0x00 |
| NtWow64CsrClientCallServer | 0x1E8 | - | - | 0x10 |
| NtWow64CsrAllocateCaptureBuffer | 0x1E9 | - | - | 0x08 |
| NtWow64CsrFreeCaptureBuffer | 0x1EA | - | - | 0x04 |
| NtWow64CsrAllocateMessagePointer | 0x1EB | - | - | 0x0C |
| NtWow64CsrCaptureMessageBuffer | 0x1EC | - | - | 0x10 |
| NtWow64CsrCaptureMessageString | 0x1ED | - | - | 0x14 |
| NtWow64CsrGetProcessId | 0x1EE | - | - | 0x00 |
| NtWow64CsrVerifyRegion | 0x1EF | - | - | 0x08 |
| NtWow64DebuggerCall | 0x1F0 | - | - | 0x14 |
| NtWow64GetCurrentProcessorNumberEx | 0x1F1 | - | - | 0x04 |
| NtWow64GetNativeSystemInformation | 0x1F2 | - | - | 0x10 |
| NtWow64QueryInformationProcess64 | 0x1F3 | - | - | 0x14 |
| NtWow64AllocateVirtualMemory64 | 0x1F4 | - | - | 0x1C |
| NtWow64ReadVirtualMemory64 | 0x1F5 | - | - | 0x1C |
| NtWow64WriteVirtualMemory64 | 0x1F6 | - | - | 0x1C |
| NtWow64CallFunction64 | 0x1F7 | - | - | 0x1C |
| NtWow64IsProcessorFeaturePresent | 0x1F8 | - | - | 0x04 |
