win11_21H2="""SYSCALL ADDRESS FUNCTION 0x02 00007FFBF39E3F40 NtAcceptConnectPort 0x00 00007FFBF39E3F00 NtAccessCheck 0x29 00007FFBF39E4420 NtAccessCheckAndAuditAlarm 0x63 00007FFBF39E4B50 NtAccessCheckByType 0x59 00007FFBF39E4A20 NtAccessCheckByTypeAndAuditAlarm 0x64 00007FFBF39E4B70 NtAccessCheckByTypeResultList 0x65 00007FFBF39E4B90 NtAccessCheckByTypeResultListAndAuditAlarm 0x66 00007FFBF39E4BB0 NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0x67 00007FFBF39E4BD0 NtAcquireCrossVmMutant 0x68 00007FFBF39E4BF0 NtAcquireProcessActivityReference 0x47 00007FFBF39E47E0 NtAddAtom 0x110069 00007FFBF39E4C10 NtAddAtomEx 0x6A 00007FFBF39E4C30 NtAddBootEntry 0x6B 00007FFBF39E4C50 NtAddDriverEntry 0x6C 00007FFBF39E4C70 NtAdjustGroupsToken 0x41 00007FFBF39E4720 NtAdjustPrivilegesToken 0x6D 00007FFBF39E4C90 NtAdjustTokenClaimsAndDeviceGroups 0x7006E 00007FFBF39E4CB0 NtAlertResumeThread 0x3006F 00007FFBF39E4CD0 NtAlertThread 0x40070 00007FFBF39E4CF0 NtAlertThreadByThreadId 0x40071 00007FFBF39E4D10 NtAllocateLocallyUniqueId 0x72 00007FFBF39E4D30 NtAllocateReserveObject 0x73 00007FFBF39E4D50 NtAllocateUserPhysicalPages 0x74 00007FFBF39E4D70 NtAllocateUserPhysicalPagesEx 0x110075 00007FFBF39E4D90 NtAllocateUuids 0x18 00007FFBF39E4200 NtAllocateVirtualMemory 0x76 00007FFBF39E4DB0 NtAllocateVirtualMemoryEx 0x77 00007FFBF39E4DD0 NtAlpcAcceptConnectPort 0x78 00007FFBF39E4DF0 NtAlpcCancelMessage 0x79 00007FFBF39E4E10 NtAlpcConnectPort 0x7A 00007FFBF39E4E30 NtAlpcConnectPortEx 0x7B 00007FFBF39E4E50 NtAlpcCreatePort 0x7C 00007FFBF39E4E70 NtAlpcCreatePortSection 0x7D 00007FFBF39E4E90 NtAlpcCreateResourceReserve 0x7E 00007FFBF39E4EB0 NtAlpcCreateSectionView 0x7F 00007FFBF39E4ED0 NtAlpcCreateSecurityContext 0x80 00007FFBF39E4EF0 NtAlpcDeletePortSection 0x81 00007FFBF39E4F10 NtAlpcDeleteResourceReserve 0x82 00007FFBF39E4F30 NtAlpcDeleteSectionView 0x83 00007FFBF39E4F50 NtAlpcDeleteSecurityContext 0x84 00007FFBF39E4F70 NtAlpcDisconnectPort 0x85 00007FFBF39E4F90 NtAlpcImpersonateClientContainerOfPort 0x86 00007FFBF39E4FB0 NtAlpcImpersonateClientOfPort 0x87 00007FFBF39E4FD0 NtAlpcOpenSenderProcess 0x88 00007FFBF39E4FF0 NtAlpcOpenSenderThread 0x89 00007FFBF39E5010 NtAlpcQueryInformation 0x8A 00007FFBF39E5030 NtAlpcQueryInformationMessage 0x8B 00007FFBF39E5050 NtAlpcRevokeSecurityContext 0x8C 00007FFBF39E5070 NtAlpcSendWaitReceivePort 0x8D 00007FFBF39E5090 NtAlpcSetInformation 0x4C 00007FFBF39E4880 NtApphelpCacheControl 0x5008E 00007FFBF39E50B0 NtAreMappedFilesTheSame 0x8008F 00007FFBF39E50D0 NtAssignProcessToJobObject 0x90 00007FFBF39E50F0 NtAssociateWaitCompletionPacket 0x91 00007FFBF39E5110 NtCallEnclave 0x05 00007FFBF39E3FA0 NtCallbackReturn 0x5D 00007FFBF39E4A90 NtCancelIoFile 0x92 00007FFBF39E5130 NtCancelIoFileEx 0x93 00007FFBF39E5150 NtCancelSynchronousIoFile 0x70061 00007FFBF39E4B10 NtCancelTimer 0x94 00007FFBF39E5170 NtCancelTimer2 0x95 00007FFBF39E5190 NtCancelWaitCompletionPacket 0x96 00007FFBF39E51B0 NtChangeProcessState 0x97 00007FFBF39E51D0 NtChangeThreadState 0x3003E 00007FFBF39E46C0 NtClearEvent 0x3003f 00007FFBF39E40E0 NtClose 0x3B 00007FFBF39E4660 NtCloseObjectAuditAlarm 0x98 00007FFBF39E51F0 NtCommitComplete 0x99 00007FFBF39E5210 NtCommitEnlistment 0x9A 00007FFBF39E5230 NtCommitRegistryTransaction 0x9B 00007FFBF39E5250 NtCommitTransaction 0x9C 00007FFBF39E5270 NtCompactKeys 0x9D 00007FFBF39E5290 NtCompareObjects 0x9E 00007FFBF39E52B0 NtCompareSigningLevels 0x9F 00007FFBF39E52D0 NtCompareTokens 0xA0 00007FFBF39E52F0 NtCompleteConnectPort 0x300A1 00007FFBF39E5310 NtCompressKey 0xA2 00007FFBF39E5330 NtConnectPort 0x43 00007FFBF39E4760 NtContinue 0xA3 00007FFBF39E5350 NtContinueEx 0xA4 00007FFBF39E5370 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 0xA5 00007FFBF39E5390 NtCreateCrossVmEvent 0xA6 00007FFBF39E53B0 NtCreateCrossVmMutant 0xA7 00007FFBF39E53D0 NtCreateDebugObject 0xA8 00007FFBF39E53F0 NtCreateDirectoryObject 0xA9 00007FFBF39E5410 NtCreateDirectoryObjectEx 0xAA 00007FFBF39E5430 NtCreateEnclave 0xAB 00007FFBF39E5450 NtCreateEnlistment 0x48 00007FFBF39E4800 NtCreateEvent 0xAC 00007FFBF39E5470 NtCreateEventPair 0x55 00007FFBF39E49A0 NtCreateFile 0xAD 00007FFBF39E5490 NtCreateIRTimer 0xAE 00007FFBF39E54B0 NtCreateIoCompletion 0xAF 00007FFBF39E54D0 NtCreateIoRing 0xB0 00007FFBF39E54F0 NtCreateJobObject 0xB1 00007FFBF39E5510 NtCreateJobSet 0x1D 00007FFBF39E42A0 NtCreateKey 0xB2 00007FFBF39E5530 NtCreateKeyTransacted 0xB3 00007FFBF39E5550 NtCreateKeyedEvent 0xB4 00007FFBF39E5570 NtCreateLowBoxToken 0xB5 00007FFBF39E5590 NtCreateMailslotFile 0xB6 00007FFBF39E55B0 NtCreateMutant 0xB7 00007FFBF39E55D0 NtCreateNamedPipeFile 0xB8 00007FFBF39E55F0 NtCreatePagingFile 0xB9 00007FFBF39E5610 NtCreatePartition 0xBA 00007FFBF39E5630 NtCreatePort 0xBB 00007FFBF39E5650 NtCreatePrivateNamespace 0xBC 00007FFBF39E5670 NtCreateProcess 0x4D 00007FFBF39E48A0 NtCreateProcessEx 0xBD 00007FFBF39E5690 NtCreateProcessStateChange 0xBE 00007FFBF39E56B0 NtCreateProfile 0xBF 00007FFBF39E56D0 NtCreateProfileEx 0xC0 00007FFBF39E56F0 NtCreateRegistryTransaction 0xC1 00007FFBF39E5710 NtCreateResourceManager 0x4A 00007FFBF39E4840 NtCreateSection 0xC2 00007FFBF39E5730 NtCreateSectionEx 0xC3 00007FFBF39E5750 NtCreateSemaphore 0xC4 00007FFBF39E5770 NtCreateSymbolicLinkObject 0x4E 00007FFBF39E48C0 NtCreateThread 0xC5 00007FFBF39E5790 NtCreateThreadEx 0xC6 00007FFBF39E57B0 NtCreateThreadStateChange 0xC7 00007FFBF39E57D0 NtCreateTimer 0xC8 00007FFBF39E57F0 NtCreateTimer2 0xC9 00007FFBF39E5810 NtCreateToken 0xCA 00007FFBF39E5830 NtCreateTokenEx 0xCB 00007FFBF39E5850 NtCreateTransaction 0xCC 00007FFBF39E5870 NtCreateTransactionManager 0xCD 00007FFBF39E5890 NtCreateUserProcess 0xCE 00007FFBF39E58B0 NtCreateWaitCompletionPacket 0xCF 00007FFBF39E58D0 NtCreateWaitablePort 0xD0 00007FFBF39E58F0 NtCreateWnfStateName 0xD1 00007FFBF39E5910 NtCreateWorkerFactory 0x800D2 00007FFBF39E5930 NtDebugActiveProcess 0xD3 00007FFBF39E5950 NtDebugContinue 0x60034 00007FFBF39E4580 NtDelayExecution 0x400D4 00007FFBF39E5970 NtDeleteAtom 0xD5 00007FFBF39E5990 NtDeleteBootEntry 0xD6 00007FFBF39E59B0 NtDeleteDriverEntry 0xD7 00007FFBF39E59D0 NtDeleteFile 0xD8 00007FFBF39E59F0 NtDeleteKey 0xD9 00007FFBF39E5A10 NtDeleteObjectAuditAlarm 0xDA 00007FFBF39E5A30 NtDeletePrivateNamespace 0xDB 00007FFBF39E5A50 NtDeleteValueKey 0xDC 00007FFBF39E5A70 NtDeleteWnfStateData 0xDD 00007FFBF39E5A90 NtDeleteWnfStateName 0x1B0007 00007FFBF39E3FE0 NtDeviceIoControlFile 0xDE 00007FFBF39E5AB0 NtDirectGraphicsCall 0xDF 00007FFBF39E5AD0 NtDisableLastKnownGood 0xE0 00007FFBF39E5AF0 NtDisplayString 0xE1 00007FFBF39E5B10 NtDrawText 0x3C 00007FFBF39E4680 NtDuplicateObject 0x42 00007FFBF39E4740 NtDuplicateToken 0xE2 00007FFBF39E5B30 NtEnableLastKnownGood 0xE3 00007FFBF39E5B50 NtEnumerateBootEntries 0xE4 00007FFBF39E5B70 NtEnumerateDriverEntries 0x32 00007FFBF39E4540 NtEnumerateKey 0xE5 00007FFBF39E5B90 NtEnumerateSystemEnvironmentValuesEx 0xE6 00007FFBF39E5BB0 NtEnumerateTransactionObject 0x13 00007FFBF39E4160 NtEnumerateValueKey 0xE7 00007FFBF39E5BD0 NtExtendSection 0xE8 00007FFBF39E5BF0 NtFilterBootOption 0xE9 00007FFBF39E5C10 NtFilterToken 0xEA 00007FFBF39E5C30 NtFilterTokenEx 0x0A0014 00007FFBF39E4180 NtFindAtom 0x4B 00007FFBF39E4860 NtFlushBuffersFile 0xEB 00007FFBF39E5C50 NtFlushBuffersFileEx 0xEC 00007FFBF39E5C70 NtFlushInstallUILanguage 0x0C00ED 00007FFBF39E5C90 NtFlushInstructionCache 0x300EE 00007FFBF39E5CB0 NtFlushKey 0xEF 00007FFBF39E5CD0 NtFlushProcessWriteBuffers 0xF0 00007FFBF39E5CF0 NtFlushVirtualMemory 0x100F1 00007FFBF39E5D10 NtFlushWriteBuffer 0xF2 00007FFBF39E5D30 NtFreeUserPhysicalPages 0x1E 00007FFBF39E42C0 NtFreeVirtualMemory 0xF3 00007FFBF39E5D50 NtFreezeRegistry 0xF4 00007FFBF39E5D70 NtFreezeTransactions 0x1B0039 00007FFBF39E4620 NtFsControlFile 0xF5 00007FFBF39E5D90 NtGetCachedSigningLevel 0xF6 00007FFBF39E5DB0 NtGetCompleteWnfStateSubscription 0xF7 00007FFBF39E5DD0 NtGetContextThread 0x1900F8 00007FFBF39E5DF0 NtGetCurrentProcessorNumber 0xF9 00007FFBF39E5E10 NtGetCurrentProcessorNumberEx 0x700FA 00007FFBF39E5E30 NtGetDevicePowerState 0xFB 00007FFBF39E5E50 NtGetMUIRegistryInfo 0xFC 00007FFBF39E5E70 NtGetNextProcess 0xFD 00007FFBF39E5E90 NtGetNextThread 0xFE 00007FFBF39E5EB0 NtGetNlsSectionPtr 0xFF 00007FFBF39E5ED0 NtGetNotificationResourceManager 0x100 00007FFBF39E5EF0 NtGetWriteWatch 0x30101 00007FFBF39E5F10 NtImpersonateAnonymousToken 0x7001F 00007FFBF39E42E0 NtImpersonateClientOfPort 0x102 00007FFBF39E5F30 NtImpersonateThread 0x103 00007FFBF39E5F50 NtInitializeEnclave 0x104 00007FFBF39E5F70 NtInitializeNlsFiles 0x105 00007FFBF39E5F90 NtInitializeRegistry 0x110106 00007FFBF39E5FB0 NtInitiatePowerAction 0x8004F 00007FFBF39E48E0 NtIsProcessInJob 0x10107 00007FFBF39E5FD0 NtIsSystemResumeAutomatic 0x108 00007FFBF39E5FF0 NtIsUILanguageComitted 0x109 00007FFBF39E6010 NtListenPort 0x10A 00007FFBF39E6030 NtLoadDriver 0x10B 00007FFBF39E6050 NtLoadEnclaveData 0x10C 00007FFBF39E6070 NtLoadKey 0x10D 00007FFBF39E6090 NtLoadKey2 0x10E 00007FFBF39E60B0 NtLoadKey3 0x10F 00007FFBF39E60D0 NtLoadKeyEx 0x110 00007FFBF39E60F0 NtLockFile 0x50111 00007FFBF39E6110 NtLockProductActivationKeys 0x30112 00007FFBF39E6130 NtLockRegistryKey 0x113 00007FFBF39E6150 NtLockVirtualMemory 0x30114 00007FFBF39E6170 NtMakePermanentObject 0x30115 00007FFBF39E6190 NtMakeTemporaryObject 0x116 00007FFBF39E61B0 NtManageHotPatch 0x117 00007FFBF39E61D0 NtManagePartition 0x118 00007FFBF39E61F0 NtMapCMFModule 0x0A0119 00007FFBF39E6210 NtMapUserPhysicalPages 0x0A0003 00007FFBF39E3F60 NtMapUserPhysicalPagesScatter 0x28 00007FFBF39E4400 NtMapViewOfSection 0x11A 00007FFBF39E6230 NtMapViewOfSectionEx 0x11B 00007FFBF39E6250 NtModifyBootEntry 0x11C 00007FFBF39E6270 NtModifyDriverEntry 0x11D 00007FFBF39E6290 NtNotifyChangeDirectoryFile 0x11E 00007FFBF39E62B0 NtNotifyChangeDirectoryFileEx 0x11F 00007FFBF39E62D0 NtNotifyChangeKey 0x120 00007FFBF39E62F0 NtNotifyChangeMultipleKeys 0x121 00007FFBF39E6310 NtNotifyChangeSession 0x58 00007FFBF39E4A00 NtOpenDirectoryObject 0x122 00007FFBF39E6330 NtOpenEnlistment 0x40 00007FFBF39E4700 NtOpenEvent 0x123 00007FFBF39E6350 NtOpenEventPair 0x33 00007FFBF39E4560 NtOpenFile 0x124 00007FFBF39E6370 NtOpenIoCompletion 0x125 00007FFBF39E6390 NtOpenJobObject 0x12 00007FFBF39E4140 NtOpenKey 0x126 00007FFBF39E63B0 NtOpenKeyEx 0x127 00007FFBF39E63D0 NtOpenKeyTransacted 0x128 00007FFBF39E63F0 NtOpenKeyTransactedEx 0x129 00007FFBF39E6410 NtOpenKeyedEvent 0x12A 00007FFBF39E6430 NtOpenMutant 0x12B 00007FFBF39E6450 NtOpenObjectAuditAlarm 0x12C 00007FFBF39E6470 NtOpenPartition 0x12D 00007FFBF39E6490 NtOpenPrivateNamespace 0x26 00007FFBF39E43C0 NtOpenProcess 0x12E 00007FFBF39E64B0 NtOpenProcessToken 0x30 00007FFBF39E4500 NtOpenProcessTokenEx 0x12F 00007FFBF39E64D0 NtOpenRegistryTransaction 0x130 00007FFBF39E64F0 NtOpenResourceManager 0x37 00007FFBF39E45E0 NtOpenSection 0x131 00007FFBF39E6510 NtOpenSemaphore 0x132 00007FFBF39E6530 NtOpenSession 0x133 00007FFBF39E6550 NtOpenSymbolicLinkObject 0x134 00007FFBF39E6570 NtOpenThread 0x24 00007FFBF39E4380 NtOpenThreadToken 0x2F 00007FFBF39E44E0 NtOpenThreadTokenEx 0x135 00007FFBF39E6590 NtOpenTimer 0x136 00007FFBF39E65B0 NtOpenTransaction 0x137 00007FFBF39E65D0 NtOpenTransactionManager 0x138 00007FFBF39E65F0 NtPlugPlayControl 0x5F 00007FFBF39E4AD0 NtPowerInformation 0x139 00007FFBF39E6610 NtPrePrepareComplete 0x13A 00007FFBF39E6630 NtPrePrepareEnlistment 0x13B 00007FFBF39E6650 NtPrepareComplete 0x13C 00007FFBF39E6670 NtPrepareEnlistment 0x0C013D 00007FFBF39E6690 NtPrivilegeCheck 0x13E 00007FFBF39E66B0 NtPrivilegeObjectAuditAlarm 0x13F 00007FFBF39E66D0 NtPrivilegedServiceAuditAlarm 0x140 00007FFBF39E66F0 NtPropagationComplete 0x141 00007FFBF39E6710 NtPropagationFailed 0x50 00007FFBF39E4900 NtProtectVirtualMemory 0x142 00007FFBF39E6730 NtPssCaptureVaSpaceBulk 0x70143 00007FFBF39E6750 NtPulseEvent 0x3D 00007FFBF39E46A0 NtQueryAttributesFile 0x144 00007FFBF39E6770 NtQueryAuxiliaryCounterFrequency 0x145 00007FFBF39E6790 NtQueryBootEntryOrder 0x146 00007FFBF39E67B0 NtQueryBootOptions 0x50147 00007FFBF39E67D0 NtQueryDebugFilterState 0x50015 00007FFBF39E41A0 NtQueryDefaultLocale 0x40044 00007FFBF39E4780 NtQueryDefaultUILanguage 0x35 00007FFBF39E45A0 NtQueryDirectoryFile 0x148 00007FFBF39E67F0 NtQueryDirectoryFileEx 0x149 00007FFBF39E6810 NtQueryDirectoryObject 0x14A 00007FFBF39E6830 NtQueryDriverEntryOrder 0x14B 00007FFBF39E6850 NtQueryEaFile 0x56 00007FFBF39E49C0 NtQueryEvent 0x14C 00007FFBF39E6870 NtQueryFullAttributesFile 0x14D 00007FFBF39E6890 NtQueryInformationAtom 0x14E 00007FFBF39E68B0 NtQueryInformationByName 0x14F 00007FFBF39E68D0 NtQueryInformationEnlistment 0x11 00007FFBF39E4120 NtQueryInformationFile 0x150 00007FFBF39E68F0 NtQueryInformationJobObject 0x151 00007FFBF39E6910 NtQueryInformationPort 0x19 00007FFBF39E4220 NtQueryInformationProcess 0x152 00007FFBF39E6930 NtQueryInformationResourceManager 0x25 00007FFBF39E43A0 NtQueryInformationThread 0x21 00007FFBF39E4320 NtQueryInformationToken 0x153 00007FFBF39E6950 NtQueryInformationTransaction 0x154 00007FFBF39E6970 NtQueryInformationTransactionManager 0x155 00007FFBF39E6990 NtQueryInformationWorkerFactory 0x40156 00007FFBF39E69B0 NtQueryInstallUILanguage 0x50157 00007FFBF39E69D0 NtQueryIntervalProfile 0x158 00007FFBF39E69F0 NtQueryIoCompletion 0x159 00007FFBF39E6A10 NtQueryIoRingCapabilities 0x16 00007FFBF39E41C0 NtQueryKey 0x15A 00007FFBF39E6A30 NtQueryLicenseValue 0x15B 00007FFBF39E6A50 NtQueryMultipleValueKey 0x15C 00007FFBF39E6A70 NtQueryMutant 0x10 00007FFBF39E4100 NtQueryObject 0x15D 00007FFBF39E6A90 NtQueryOpenSubKeys 0x15E 00007FFBF39E6AB0 NtQueryOpenSubKeysEx 0x50031 00007FFBF39E4520 NtQueryPerformanceCounter 0x1015F 00007FFBF39E6AD0 NtQueryPortInformationProcess 0x160 00007FFBF39E6AF0 NtQueryQuotaInformationFile 0x51 00007FFBF39E4920 NtQuerySection 0x161 00007FFBF39E6B10 NtQuerySecurityAttributesToken 0x162 00007FFBF39E6B30 NtQuerySecurityObject 0x163 00007FFBF39E6B50 NtQuerySecurityPolicy 0x164 00007FFBF39E6B70 NtQuerySemaphore 0x165 00007FFBF39E6B90 NtQuerySymbolicLinkObject 0x166 00007FFBF39E6BB0 NtQuerySystemEnvironmentValue 0x167 00007FFBF39E6BD0 NtQuerySystemEnvironmentValueEx 0x36 00007FFBF39E45C0 NtQuerySystemInformation 0x168 00007FFBF39E6BF0 NtQuerySystemInformationEx 0x38 00007FFBF39E4600 NtQueryTimer 0x0A0169 00007FFBF39E6C10 NtQueryTimerResolution 0x17 00007FFBF39E41E0 NtQueryValueKey 0x23 00007FFBF39E4360 NtQueryVirtualMemory 0x49 00007FFBF39E4820 NtQueryVolumeInformationFile 0x16A 00007FFBF39E6C30 NtQueryWnfStateData 0x16B 00007FFBF39E6C50 NtQueryWnfStateNameInformation 0x45 00007FFBF39E47A0 NtQueueApcThread 0x16C 00007FFBF39E6C70 NtQueueApcThreadEx 0x16D 00007FFBF39E6C90 NtQueueApcThreadEx2 0x16E 00007FFBF39E6CB0 NtRaiseException 0x16F 00007FFBF39E6CD0 NtRaiseHardError 0x1A0006 00007FFBF39E3FC0 NtReadFile 0x1A002E 00007FFBF39E44C0 NtReadFileScatter 0x170 00007FFBF39E6CF0 NtReadOnlyEnlistment 0x54 00007FFBF39E4980 NtReadRequestData 0x3F 00007FFBF39E46E0 NtReadVirtualMemory 0x171 00007FFBF39E6D10 NtReadVirtualMemoryEx 0x172 00007FFBF39E6D30 NtRecoverEnlistment 0x173 00007FFBF39E6D50 NtRecoverResourceManager 0x174 00007FFBF39E6D70 NtRecoverTransactionManager 0x175 00007FFBF39E6D90 NtRegisterProtocolAddressInformation 0x30176 00007FFBF39E6DB0 NtRegisterThreadTerminatePort 0x140177 00007FFBF39E6DD0 NtReleaseKeyedEvent 0x70020 00007FFBF39E4300 NtReleaseMutant 0x0C000A 00007FFBF39E4040 NtReleaseSemaphore 0x30178 00007FFBF39E6DF0 NtReleaseWorkerFactoryWorker 0x1C0009 00007FFBF39E4020 NtRemoveIoCompletion 0x179 00007FFBF39E6E10 NtRemoveIoCompletionEx 0x8017A 00007FFBF39E6E30 NtRemoveProcessDebug 0x17B 00007FFBF39E6E50 NtRenameKey 0x17C 00007FFBF39E6E70 NtRenameTransactionManager 0x17D 00007FFBF39E6E90 NtReplaceKey 0x17E 00007FFBF39E6EB0 NtReplacePartitionUnit 0x0C 00007FFBF39E4080 NtReplyPort 0x0B 00007FFBF39E4060 NtReplyWaitReceivePort 0x2B 00007FFBF39E4460 NtReplyWaitReceivePortEx 0x17F 00007FFBF39E6ED0 NtReplyWaitReplyPort 0x180 00007FFBF39E6EF0 NtRequestPort 0x22 00007FFBF39E4340 NtRequestWaitReplyPort 0x70181 00007FFBF39E6F10 NtResetEvent 0x0C0182 00007FFBF39E6F30 NtResetWriteWatch 0x183 00007FFBF39E6F50 NtRestoreKey 0x30184 00007FFBF39E6F70 NtResumeProcess 0x70052 00007FFBF39E4940 NtResumeThread 0x185 00007FFBF39E6F90 NtRevertContainerImpersonation 0x186 00007FFBF39E6FB0 NtRollbackComplete 0x187 00007FFBF39E6FD0 NtRollbackEnlistment 0x188 00007FFBF39E6FF0 NtRollbackRegistryTransaction 0x189 00007FFBF39E7010 NtRollbackTransaction 0x18A 00007FFBF39E7030 NtRollforwardTransactionManager 0x8018B 00007FFBF39E7050 NtSaveKey 0x0E018C 00007FFBF39E7070 NtSaveKeyEx 0x0B018D 00007FFBF39E7090 NtSaveMergedKeys 0x18E 00007FFBF39E70B0 NtSecureConnectPort 0x18F 00007FFBF39E70D0 NtSerializeBoot 0x190 00007FFBF39E70F0 NtSetBootEntryOrder 0x191 00007FFBF39E7110 NtSetBootOptions 0x192 00007FFBF39E7130 NtSetCachedSigningLevel 0x193 00007FFBF39E7150 NtSetCachedSigningLevel2 0x194 00007FFBF39E7170 NtSetContextThread 0x0A0195 00007FFBF39E7190 NtSetDebugFilterState 0x30196 00007FFBF39E71B0 NtSetDefaultHardErrorPort 0x50197 00007FFBF39E71D0 NtSetDefaultLocale 0x40198 00007FFBF39E71F0 NtSetDefaultUILanguage 0x199 00007FFBF39E7210 NtSetDriverEntryOrder 0x19A 00007FFBF39E7230 NtSetEaFile 0x7000E 00007FFBF39E40C0 NtSetEvent 0x3002D 00007FFBF39E44A0 NtSetEventBoostPriority 0x3019B 00007FFBF39E7250 NtSetHighEventPair 0x3019C 00007FFBF39E7270 NtSetHighWaitLowEventPair 0x7019D 00007FFBF39E7290 NtSetIRTimer 0x19E 00007FFBF39E72B0 NtSetInformationDebugObject 0x19F 00007FFBF39E72D0 NtSetInformationEnlistment 0x27 00007FFBF39E43E0 NtSetInformationFile 0x1A0 00007FFBF39E72F0 NtSetInformationIoRing 0x1A1 00007FFBF39E7310 NtSetInformationJobObject 0x1A2 00007FFBF39E7330 NtSetInformationKey 0x5C 00007FFBF39E4A70 NtSetInformationObject 0x1C 00007FFBF39E4280 NtSetInformationProcess 0x1A3 00007FFBF39E7350 NtSetInformationResourceManager 0x1A4 00007FFBF39E7370 NtSetInformationSymbolicLink 0x0D 00007FFBF39E40A0 NtSetInformationThread 0x1A5 00007FFBF39E7390 NtSetInformationToken 0x1A6 00007FFBF39E73B0 NtSetInformationTransaction 0x1A7 00007FFBF39E73D0 NtSetInformationTransactionManager 0x1A8 00007FFBF39E73F0 NtSetInformationVirtualMemory 0x1A9 00007FFBF39E7410 NtSetInformationWorkerFactory 0x501AA 00007FFBF39E7430 NtSetIntervalProfile 0x1AB 00007FFBF39E7450 NtSetIoCompletion 0x1AC 00007FFBF39E7470 NtSetIoCompletionEx 0x1AD 00007FFBF39E7490 NtSetLdtEntries 0x301AE 00007FFBF39E74B0 NtSetLowEventPair 0x301AF 00007FFBF39E74D0 NtSetLowWaitHighEventPair 0x1B0 00007FFBF39E74F0 NtSetQuotaInformationFile 0x1B1 00007FFBF39E7510 NtSetSecurityObject 0x1B2 00007FFBF39E7530 NtSetSystemEnvironmentValue 0x1B3 00007FFBF39E7550 NtSetSystemEnvironmentValueEx 0x1B4 00007FFBF39E7570 NtSetSystemInformation 0x1B5 00007FFBF39E7590 NtSetSystemPowerState 0x501B6 00007FFBF39E75B0 NtSetSystemTime 0x501B7 00007FFBF39E75D0 NtSetThreadExecutionState 0x62 00007FFBF39E4B30 NtSetTimer 0x1B8 00007FFBF39E75F0 NtSetTimer2 0x1B9 00007FFBF39E7610 NtSetTimerEx 0x0A01BA 00007FFBF39E7630 NtSetTimerResolution 0x401BB 00007FFBF39E7650 NtSetUuidSeed 0x60 00007FFBF39E4AF0 NtSetValueKey 0x1BC 00007FFBF39E7670 NtSetVolumeInformationFile 0x1BD 00007FFBF39E7690 NtSetWnfProcessNotificationEvent 0x401BE 00007FFBF39E76B0 NtShutdownSystem 0x1BF 00007FFBF39E76D0 NtShutdownWorkerFactory 0x1301C0 00007FFBF39E76F0 NtSignalAndWaitForSingleObject 0x1C1 00007FFBF39E7710 NtSinglePhaseReject 0x301C2 00007FFBF39E7730 NtStartProfile 0x301C3 00007FFBF39E7750 NtStopProfile 0x1C4 00007FFBF39E7770 NtSubmitIoRing 0x1C5 00007FFBF39E7790 NtSubscribeWnfStateChange 0x301C6 00007FFBF39E77B0 NtSuspendProcess 0x701C7 00007FFBF39E77D0 NtSuspendThread 0x1C8 00007FFBF39E77F0 NtSystemDebugControl 0x1C9 00007FFBF39E7810 NtTerminateEnclave 0x701CA 00007FFBF39E7830 NtTerminateJobObject 0x7002C 00007FFBF39E4480 NtTerminateProcess 0x70053 00007FFBF39E4960 NtTerminateThread 0x201CB 00007FFBF39E7850 NtTestAlert 0x1CC 00007FFBF39E7870 NtThawRegistry 0x1CD 00007FFBF39E7890 NtThawTransactions 0x1CE 00007FFBF39E78B0 NtTraceControl 0x5E 00007FFBF39E4AB0 NtTraceEvent 0x1101CF 00007FFBF39E78D0 NtTranslateFilePath 0x1D0 00007FFBF39E78F0 NtUmsThreadYield 0x1D1 00007FFBF39E7910 NtUnloadDriver 0x1D2 00007FFBF39E7930 NtUnloadKey 0x1D3 00007FFBF39E7950 NtUnloadKey2 0x1D4 00007FFBF39E7970 NtUnloadKeyEx 0x1D5 00007FFBF39E7990 NtUnlockFile 0x1D6 00007FFBF39E79B0 NtUnlockVirtualMemory 0x2A 00007FFBF39E4440 NtUnmapViewOfSection 0x1D7 00007FFBF39E79D0 NtUnmapViewOfSectionEx 0x1D8 00007FFBF39E79F0 NtUnsubscribeWnfStateChange 0x1D9 00007FFBF39E7A10 NtUpdateWnfStateData 0x1DA 00007FFBF39E7A30 NtVdmControl 0x601DB 00007FFBF39E7A50 NtWaitForAlertByThreadId 0x1DC 00007FFBF39E7A70 NtWaitForDebugEvent 0x1501DD 00007FFBF39E7A90 NtWaitForKeyedEvent 0x1D005B 00007FFBF39E4A50 NtWaitForMultipleObjects 0x1E001A 00007FFBF39E4240 NtWaitForMultipleObjects32 0x0D0004 00007FFBF39E3F80 NtWaitForSingleObject 0x1DE 00007FFBF39E7AB0 NtWaitForWorkViaWorkerFactory 0x301DF 00007FFBF39E7AD0 NtWaitHighEventPair 0x301E0 00007FFBF39E7AF0 NtWaitLowEventPair 0x30001 00007FFBF39E3F20 NtWorkerFactoryWorkerReady 0x1A0008 00007FFBF39E4000 NtWriteFile 0x1A001B 00007FFBF39E4260 NtWriteFileGather 0x57 00007FFBF39E49E0 NtWriteRequestData 0x3A 00007FFBF39E4640 NtWriteVirtualMemory 0x10046 00007FFBF39E47C0 NtYieldExecution 0x1ED 00007FFBF39E45C0 RtlGetNativeSystemInformation """ t=0 win1021h2="""SYSCALL ADDRESS FUNCTION ----------------------------------------- 0x02 00007FFEFDA0CD70 NtAcceptConnectPort 0x00 00007FFEFDA0CD30 NtAccessCheck 0x29 00007FFEFDA0D250 NtAccessCheckAndAuditAlarm 0x63 00007FFEFDA0D980 NtAccessCheckByType 0x59 00007FFEFDA0D850 NtAccessCheckByTypeAndAuditAlarm 0x64 00007FFEFDA0D9A0 NtAccessCheckByTypeResultList 0x65 00007FFEFDA0D9C0 NtAccessCheckByTypeResultListAndAuditAlarm 0x66 00007FFEFDA0D9E0 NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0x67 00007FFEFDA0DA00 NtAcquireCrossVmMutant 0x68 00007FFEFDA0DA20 NtAcquireProcessActivityReference 0x0A0047 00007FFEFDA0D610 NtAddAtom 0x110069 00007FFEFDA0DA40 NtAddAtomEx 0x6A 00007FFEFDA0DA60 NtAddBootEntry 0x6B 00007FFEFDA0DA80 NtAddDriverEntry 0x6C 00007FFEFDA0DAA0 NtAdjustGroupsToken 0x41 00007FFEFDA0D550 NtAdjustPrivilegesToken 0x6D 00007FFEFDA0DAC0 NtAdjustTokenClaimsAndDeviceGroups 0x7006E 00007FFEFDA0DAE0 NtAlertResumeThread 0x3006F 00007FFEFDA0DB00 NtAlertThread 0x40070 00007FFEFDA0DB20 NtAlertThreadByThreadId 0x40071 00007FFEFDA0DB40 NtAllocateLocallyUniqueId 0x72 00007FFEFDA0DB60 NtAllocateReserveObject 0x73 00007FFEFDA0DB80 NtAllocateUserPhysicalPages 0x74 00007FFEFDA0DBA0 NtAllocateUserPhysicalPagesEx 0x110075 00007FFEFDA0DBC0 NtAllocateUuids 0x18 00007FFEFDA0D030 NtAllocateVirtualMemory 0x76 00007FFEFDA0DBE0 NtAllocateVirtualMemoryEx 0x77 00007FFEFDA0DC00 NtAlpcAcceptConnectPort 0x78 00007FFEFDA0DC20 NtAlpcCancelMessage 0x79 00007FFEFDA0DC40 NtAlpcConnectPort 0x7A 00007FFEFDA0DC60 NtAlpcConnectPortEx 0x7B 00007FFEFDA0DC80 NtAlpcCreatePort 0x7C 00007FFEFDA0DCA0 NtAlpcCreatePortSection 0x7D 00007FFEFDA0DCC0 NtAlpcCreateResourceReserve 0x7E 00007FFEFDA0DCE0 NtAlpcCreateSectionView 0x7F 00007FFEFDA0DD00 NtAlpcCreateSecurityContext 0x80 00007FFEFDA0DD20 NtAlpcDeletePortSection 0x81 00007FFEFDA0DD40 NtAlpcDeleteResourceReserve 0x82 00007FFEFDA0DD60 NtAlpcDeleteSectionView 0x83 00007FFEFDA0DD80 NtAlpcDeleteSecurityContext 0x84 00007FFEFDA0DDA0 NtAlpcDisconnectPort 0x85 00007FFEFDA0DDC0 NtAlpcImpersonateClientContainerOfPort 0x86 00007FFEFDA0DDE0 NtAlpcImpersonateClientOfPort 0x87 00007FFEFDA0DE00 NtAlpcOpenSenderProcess 0x88 00007FFEFDA0DE20 NtAlpcOpenSenderThread 0x89 00007FFEFDA0DE40 NtAlpcQueryInformation 0x8A 00007FFEFDA0DE60 NtAlpcQueryInformationMessage 0x8B 00007FFEFDA0DE80 NtAlpcRevokeSecurityContext 0x8C 00007FFEFDA0DEA0 NtAlpcSendWaitReceivePort 0x8D 00007FFEFDA0DEC0 NtAlpcSetInformation 0x4C 00007FFEFDA0D6B0 NtApphelpCacheControl 0x5008E 00007FFEFDA0DEE0 NtAreMappedFilesTheSame 0x8008F 00007FFEFDA0DF00 NtAssignProcessToJobObject 0x90 00007FFEFDA0DF20 NtAssociateWaitCompletionPacket 0x91 00007FFEFDA0DF40 NtCallEnclave 0x05 00007FFEFDA0CDD0 NtCallbackReturn 0x5D 00007FFEFDA0D8C0 NtCancelIoFile 0x92 00007FFEFDA0DF60 NtCancelIoFileEx 0x93 00007FFEFDA0DF80 NtCancelSynchronousIoFile 0x61 00007FFEFDA0D940 NtCancelTimer 0x94 00007FFEFDA0DFA0 NtCancelTimer2 0x95 00007FFEFDA0DFC0 NtCancelWaitCompletionPacket 0x3003E 00007FFEFDA0D4F0 NtClearEvent 0x3000F 00007FFEFDA0CF10 NtClose 0x3B 00007FFEFDA0D490 NtCloseObjectAuditAlarm 0x96 00007FFEFDA0DFE0 NtCommitComplete 0x97 00007FFEFDA0E000 NtCommitEnlistment 0x98 00007FFEFDA0E020 NtCommitRegistryTransaction 0x99 00007FFEFDA0E040 NtCommitTransaction 0x9A 00007FFEFDA0E060 NtCompactKeys 0x9B 00007FFEFDA0E080 NtCompareObjects 0x9C 00007FFEFDA0E0A0 NtCompareSigningLevels 0x9D 00007FFEFDA0E0C0 NtCompareTokens 0x9E 00007FFEFDA0E0E0 NtCompleteConnectPort 0x3009F 00007FFEFDA0E100 NtCompressKey 0xA0 00007FFEFDA0E120 NtConnectPort 0x43 00007FFEFDA0D590 NtContinue 0xA1 00007FFEFDA0E140 NtContinueEx 0xA2 00007FFEFDA0E160 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 0xA3 00007FFEFDA0E180 NtCreateCrossVmEvent 0xA4 00007FFEFDA0E1A0 NtCreateCrossVmMutant 0xA5 00007FFEFDA0E1C0 NtCreateDebugObject 0xA6 00007FFEFDA0E1E0 NtCreateDirectoryObject 0xA7 00007FFEFDA0E200 NtCreateDirectoryObjectEx 0xA8 00007FFEFDA0E220 NtCreateEnclave 0xA9 00007FFEFDA0E240 NtCreateEnlistment 0x48 00007FFEFDA0D630 NtCreateEvent 0xAA 00007FFEFDA0E260 NtCreateEventPair 0x55 00007FFEFDA0D7D0 NtCreateFile 0xAB 00007FFEFDA0E280 NtCreateIRTimer 0xAC 00007FFEFDA0E2A0 NtCreateIoCompletion 0xAD 00007FFEFDA0E2C0 NtCreateJobObject 0xAE 00007FFEFDA0E2E0 NtCreateJobSet 0x1D 00007FFEFDA0D0D0 NtCreateKey 0xAF 00007FFEFDA0E300 NtCreateKeyTransacted 0xB0 00007FFEFDA0E320 NtCreateKeyedEvent 0xB1 00007FFEFDA0E340 NtCreateLowBoxToken 0xB2 00007FFEFDA0E360 NtCreateMailslotFile 0xB3 00007FFEFDA0E380 NtCreateMutant 0xB4 00007FFEFDA0E3A0 NtCreateNamedPipeFile 0xB5 00007FFEFDA0E3C0 NtCreatePagingFile 0xB6 00007FFEFDA0E3E0 NtCreatePartition 0xB7 00007FFEFDA0E400 NtCreatePort 0xB8 00007FFEFDA0E420 NtCreatePrivateNamespace 0xB9 00007FFEFDA0E440 NtCreateProcess 0x4D 00007FFEFDA0D6D0 NtCreateProcessEx 0xBA 00007FFEFDA0E460 NtCreateProfile 0xBB 00007FFEFDA0E480 NtCreateProfileEx 0xBC 00007FFEFDA0E4A0 NtCreateRegistryTransaction 0xBD 00007FFEFDA0E4C0 NtCreateResourceManager 0x4A 00007FFEFDA0D670 NtCreateSection 0xBE 00007FFEFDA0E4E0 NtCreateSectionEx 0xBF 00007FFEFDA0E500 NtCreateSemaphore 0xC0 00007FFEFDA0E520 NtCreateSymbolicLinkObject 0x4E 00007FFEFDA0D6F0 NtCreateThread 0xC1 00007FFEFDA0E540 NtCreateThreadEx 0xC2 00007FFEFDA0E560 NtCreateTimer 0xC3 00007FFEFDA0E580 NtCreateTimer2 0xC4 00007FFEFDA0E5A0 NtCreateToken 0xC5 00007FFEFDA0E5C0 NtCreateTokenEx 0xC6 00007FFEFDA0E5E0 NtCreateTransaction 0xC7 00007FFEFDA0E600 NtCreateTransactionManager 0xC8 00007FFEFDA0E620 NtCreateUserProcess 0xC9 00007FFEFDA0E640 NtCreateWaitCompletionPacket 0xCA 00007FFEFDA0E660 NtCreateWaitablePort 0xCB 00007FFEFDA0E680 NtCreateWnfStateName 0xCC 00007FFEFDA0E6A0 NtCreateWorkerFactory 0x800CD 00007FFEFDA0E6C0 NtDebugActiveProcess 0xCE 00007FFEFDA0E6E0 NtDebugContinue 0x60034 00007FFEFDA0D3B0 NtDelayExecution 0x400CF 00007FFEFDA0E700 NtDeleteAtom 0xD0 00007FFEFDA0E720 NtDeleteBootEntry 0xD1 00007FFEFDA0E740 NtDeleteDriverEntry 0xD2 00007FFEFDA0E760 NtDeleteFile 0xD3 00007FFEFDA0E780 NtDeleteKey 0xD4 00007FFEFDA0E7A0 NtDeleteObjectAuditAlarm 0xD5 00007FFEFDA0E7C0 NtDeletePrivateNamespace 0xD6 00007FFEFDA0E7E0 NtDeleteValueKey 0xD7 00007FFEFDA0E800 NtDeleteWnfStateData 0xD8 00007FFEFDA0E820 NtDeleteWnfStateName 0x1B0007 00007FFEFDA0CE10 NtDeviceIoControlFile 0xD9 00007FFEFDA0E840 NtDirectGraphicsCall 0xDA 00007FFEFDA0E860 NtDisableLastKnownGood 0xDB 00007FFEFDA0E880 NtDisplayString 0xDC 00007FFEFDA0E8A0 NtDrawText 0x3C 00007FFEFDA0D4B0 NtDuplicateObject 0x42 00007FFEFDA0D570 NtDuplicateToken 0xDD 00007FFEFDA0E8C0 NtEnableLastKnownGood 0xDE 00007FFEFDA0E8E0 NtEnumerateBootEntries 0xDF 00007FFEFDA0E900 NtEnumerateDriverEntries 0x32 00007FFEFDA0D370 NtEnumerateKey 0xE0 00007FFEFDA0E920 NtEnumerateSystemEnvironmentValuesEx 0xE1 00007FFEFDA0E940 NtEnumerateTransactionObject 0x13 00007FFEFDA0CF90 NtEnumerateValueKey 0xE2 00007FFEFDA0E960 NtExtendSection 0xE3 00007FFEFDA0E980 NtFilterBootOption 0xE4 00007FFEFDA0E9A0 NtFilterToken 0xE5 00007FFEFDA0E9C0 NtFilterTokenEx 0x0A0014 00007FFEFDA0CFB0 NtFindAtom 0x4B 00007FFEFDA0D690 NtFlushBuffersFile 0xE6 00007FFEFDA0E9E0 NtFlushBuffersFileEx 0xE7 00007FFEFDA0EA00 NtFlushInstallUILanguage 0x0C00E8 00007FFEFDA0EA20 NtFlushInstructionCache 0x300E9 00007FFEFDA0EA40 NtFlushKey 0xEA 00007FFEFDA0EA60 NtFlushProcessWriteBuffers 0xEB 00007FFEFDA0EA80 NtFlushVirtualMemory 0x100EC 00007FFEFDA0EAA0 NtFlushWriteBuffer 0xED 00007FFEFDA0EAC0 NtFreeUserPhysicalPages 0x1E 00007FFEFDA0D0F0 NtFreeVirtualMemory 0xEE 00007FFEFDA0EAE0 NtFreezeRegistry 0xEF 00007FFEFDA0EB00 NtFreezeTransactions 0x1B0039 00007FFEFDA0D450 NtFsControlFile 0xF0 00007FFEFDA0EB20 NtGetCachedSigningLevel 0xF1 00007FFEFDA0EB40 NtGetCompleteWnfStateSubscription 0xF2 00007FFEFDA0EB60 NtGetContextThread 0x1900F3 00007FFEFDA0EB80 NtGetCurrentProcessorNumber 0xF4 00007FFEFDA0EBA0 NtGetCurrentProcessorNumberEx 0x700F5 00007FFEFDA0EBC0 NtGetDevicePowerState 0xF6 00007FFEFDA0EBE0 NtGetMUIRegistryInfo 0xF7 00007FFEFDA0EC00 NtGetNextProcess 0xF8 00007FFEFDA0EC20 NtGetNextThread 0xF9 00007FFEFDA0EC40 NtGetNlsSectionPtr 0xFA 00007FFEFDA0EC60 NtGetNotificationResourceManager 0xFB 00007FFEFDA0EC80 NtGetWriteWatch 0x300FC 00007FFEFDA0ECA0 NtImpersonateAnonymousToken 0x7001F 00007FFEFDA0D110 NtImpersonateClientOfPort 0xFD 00007FFEFDA0ECC0 NtImpersonateThread 0xFE 00007FFEFDA0ECE0 NtInitializeEnclave 0xFF 00007FFEFDA0ED00 NtInitializeNlsFiles 0x100 00007FFEFDA0ED20 NtInitializeRegistry 0x110101 00007FFEFDA0ED40 NtInitiatePowerAction 0x8004F 00007FFEFDA0D710 NtIsProcessInJob 0x10102 00007FFEFDA0ED60 NtIsSystemResumeAutomatic 0x103 00007FFEFDA0ED80 NtIsUILanguageComitted 0x104 00007FFEFDA0EDA0 NtListenPort 0x105 00007FFEFDA0EDC0 NtLoadDriver 0x106 00007FFEFDA0EDE0 NtLoadEnclaveData 0x107 00007FFEFDA0EE00 NtLoadKey 0x108 00007FFEFDA0EE20 NtLoadKey2 0x1D6 00007FFEFDA107E0 NtLoadKey3 0x109 00007FFEFDA0EE40 NtLoadKeyEx 0x10A 00007FFEFDA0EE60 NtLockFile 0x5010B 00007FFEFDA0EE80 NtLockProductActivationKeys 0x3010C 00007FFEFDA0EEA0 NtLockRegistryKey 0x10D 00007FFEFDA0EEC0 NtLockVirtualMemory 0x3010E 00007FFEFDA0EEE0 NtMakePermanentObject 0x3010F 00007FFEFDA0EF00 NtMakeTemporaryObject 0x110 00007FFEFDA0EF20 NtManageHotPatch 0x111 00007FFEFDA0EF40 NtManagePartition 0x112 00007FFEFDA0EF60 NtMapCMFModule 0x0A0113 00007FFEFDA0EF80 NtMapUserPhysicalPages 0x0A0003 00007FFEFDA0CD90 NtMapUserPhysicalPagesScatter 0x28 00007FFEFDA0D230 NtMapViewOfSection 0x114 00007FFEFDA0EFA0 NtMapViewOfSectionEx 0x115 00007FFEFDA0EFC0 NtModifyBootEntry 0x116 00007FFEFDA0EFE0 NtModifyDriverEntry 0x117 00007FFEFDA0F000 NtNotifyChangeDirectoryFile 0x118 00007FFEFDA0F020 NtNotifyChangeDirectoryFileEx 0x119 00007FFEFDA0F040 NtNotifyChangeKey 0x11A 00007FFEFDA0F060 NtNotifyChangeMultipleKeys 0x11B 00007FFEFDA0F080 NtNotifyChangeSession 0x58 00007FFEFDA0D830 NtOpenDirectoryObject 0x11C 00007FFEFDA0F0A0 NtOpenEnlistment 0x40 00007FFEFDA0D530 NtOpenEvent 0x11D 00007FFEFDA0F0C0 NtOpenEventPair 0x33 00007FFEFDA0D390 NtOpenFile 0x11E 00007FFEFDA0F0E0 NtOpenIoCompletion 0x11F 00007FFEFDA0F100 NtOpenJobObject 0x12 00007FFEFDA0CF70 NtOpenKey 0x120 00007FFEFDA0F120 NtOpenKeyEx 0x121 00007FFEFDA0F140 NtOpenKeyTransacted 0x122 00007FFEFDA0F160 NtOpenKeyTransactedEx 0x123 00007FFEFDA0F180 NtOpenKeyedEvent 0x124 00007FFEFDA0F1A0 NtOpenMutant 0x125 00007FFEFDA0F1C0 NtOpenObjectAuditAlarm 0x126 00007FFEFDA0F1E0 NtOpenPartition 0x127 00007FFEFDA0F200 NtOpenPrivateNamespace 0x26 00007FFEFDA0D1F0 NtOpenProcess 0x128 00007FFEFDA0F220 NtOpenProcessToken 0x30 00007FFEFDA0D330 NtOpenProcessTokenEx 0x129 00007FFEFDA0F240 NtOpenRegistryTransaction 0x12A 00007FFEFDA0F260 NtOpenResourceManager 0x37 00007FFEFDA0D410 NtOpenSection 0x12B 00007FFEFDA0F280 NtOpenSemaphore 0x12C 00007FFEFDA0F2A0 NtOpenSession 0x12D 00007FFEFDA0F2C0 NtOpenSymbolicLinkObject 0x12E 00007FFEFDA0F2E0 NtOpenThread 0x24 00007FFEFDA0D1B0 NtOpenThreadToken 0x2F 00007FFEFDA0D310 NtOpenThreadTokenEx 0x12F 00007FFEFDA0F300 NtOpenTimer 0x130 00007FFEFDA0F320 NtOpenTransaction 0x131 00007FFEFDA0F340 NtOpenTransactionManager 0x132 00007FFEFDA0F360 NtPlugPlayControl 0x5F 00007FFEFDA0D900 NtPowerInformation 0x133 00007FFEFDA0F380 NtPrePrepareComplete 0x134 00007FFEFDA0F3A0 NtPrePrepareEnlistment 0x135 00007FFEFDA0F3C0 NtPrepareComplete 0x136 00007FFEFDA0F3E0 NtPrepareEnlistment 0x0C0137 00007FFEFDA0F400 NtPrivilegeCheck 0x138 00007FFEFDA0F420 NtPrivilegeObjectAuditAlarm 0x139 00007FFEFDA0F440 NtPrivilegedServiceAuditAlarm 0x13A 00007FFEFDA0F460 NtPropagationComplete 0x13B 00007FFEFDA0F480 NtPropagationFailed 0x50 00007FFEFDA0D730 NtProtectVirtualMemory 0x13C 00007FFEFDA0F4A0 NtPssCaptureVaSpaceBulk 0x7013D 00007FFEFDA0F4C0 NtPulseEvent 0x3D 00007FFEFDA0D4D0 NtQueryAttributesFile 0x13E 00007FFEFDA0F4E0 NtQueryAuxiliaryCounterFrequency 0x13F 00007FFEFDA0F500 NtQueryBootEntryOrder 0x140 00007FFEFDA0F520 NtQueryBootOptions 0x50141 00007FFEFDA0F540 NtQueryDebugFilterState 0x50015 00007FFEFDA0CFD0 NtQueryDefaultLocale 0x40044 00007FFEFDA0D5B0 NtQueryDefaultUILanguage 0x35 00007FFEFDA0D3D0 NtQueryDirectoryFile 0x142 00007FFEFDA0F560 NtQueryDirectoryFileEx 0x143 00007FFEFDA0F580 NtQueryDirectoryObject 0x144 00007FFEFDA0F5A0 NtQueryDriverEntryOrder 0x145 00007FFEFDA0F5C0 NtQueryEaFile 0x56 00007FFEFDA0D7F0 NtQueryEvent 0x146 00007FFEFDA0F5E0 NtQueryFullAttributesFile 0x147 00007FFEFDA0F600 NtQueryInformationAtom 0x148 00007FFEFDA0F620 NtQueryInformationByName 0x149 00007FFEFDA0F640 NtQueryInformationEnlistment 0x11 00007FFEFDA0CF50 NtQueryInformationFile 0x14A 00007FFEFDA0F660 NtQueryInformationJobObject 0x14B 00007FFEFDA0F680 NtQueryInformationPort 0x19 00007FFEFDA0D050 NtQueryInformationProcess 0x14C 00007FFEFDA0F6A0 NtQueryInformationResourceManager 0x25 00007FFEFDA0D1D0 NtQueryInformationThread 0x21 00007FFEFDA0D150 NtQueryInformationToken 0x14D 00007FFEFDA0F6C0 NtQueryInformationTransaction 0x14E 00007FFEFDA0F6E0 NtQueryInformationTransactionManager 0x14F 00007FFEFDA0F700 NtQueryInformationWorkerFactory 0x40150 00007FFEFDA0F720 NtQueryInstallUILanguage 0x50151 00007FFEFDA0F740 NtQueryIntervalProfile 0x152 00007FFEFDA0F760 NtQueryIoCompletion 0x16 00007FFEFDA0CFF0 NtQueryKey 0x153 00007FFEFDA0F780 NtQueryLicenseValue 0x154 00007FFEFDA0F7A0 NtQueryMultipleValueKey 0x155 00007FFEFDA0F7C0 NtQueryMutant 0x110 00007FFEFDA0CF30 NtQueryObject 0x156 00007FFEFDA0F7E0 NtQueryOpenSubKeys 0x157 00007FFEFDA0F800 NtQueryOpenSubKeysEx 0x50031 00007FFEFDA0D350 NtQueryPerformanceCounter 0x10158 00007FFEFDA0F820 NtQueryPortInformationProcess 0x159 00007FFEFDA0F840 NtQueryQuotaInformationFile 0x51 00007FFEFDA0D750 NtQuerySection 0x15A 00007FFEFDA0F860 NtQuerySecurityAttributesToken 0x15B 00007FFEFDA0F880 NtQuerySecurityObject 0x15C 00007FFEFDA0F8A0 NtQuerySecurityPolicy 0x15D 00007FFEFDA0F8C0 NtQuerySemaphore 0x15E 00007FFEFDA0F8E0 NtQuerySymbolicLinkObject 0x15F 00007FFEFDA0F900 NtQuerySystemEnvironmentValue 0x160 00007FFEFDA0F920 NtQuerySystemEnvironmentValueEx 0x36 00007FFEFDA0D3F0 NtQuerySystemInformation 0x161 00007FFEFDA0F940 NtQuerySystemInformationEx 0x38 00007FFEFDA0D430 NtQueryTimer 0x0A0162 00007FFEFDA0F960 NtQueryTimerResolution 0x17 00007FFEFDA0D010 NtQueryValueKey 0x23 00007FFEFDA0D190 NtQueryVirtualMemory 0x49 00007FFEFDA0D650 NtQueryVolumeInformationFile 0x163 00007FFEFDA0F980 NtQueryWnfStateData 0x164 00007FFEFDA0F9A0 NtQueryWnfStateNameInformation 0x45 00007FFEFDA0D5D0 NtQueueApcThread 0x165 00007FFEFDA0F9C0 NtQueueApcThreadEx 0x166 00007FFEFDA0F9E0 NtRaiseException 0x167 00007FFEFDA0FA00 NtRaiseHardError 0x1A0006 00007FFEFDA0CDF0 NtReadFile 0x1A002E 00007FFEFDA0D2F0 NtReadFileScatter 0x168 00007FFEFDA0FA20 NtReadOnlyEnlistment 0x54 00007FFEFDA0D7B0 NtReadRequestData 0x3F 00007FFEFDA0D510 NtReadVirtualMemory 0x169 00007FFEFDA0FA40 NtRecoverEnlistment 0x16A 00007FFEFDA0FA60 NtRecoverResourceManager 0x16B 00007FFEFDA0FA80 NtRecoverTransactionManager 0x16C 00007FFEFDA0FAA0 NtRegisterProtocolAddressInformation 0x3016D 00007FFEFDA0FAC0 NtRegisterThreadTerminatePort 0x14016E 00007FFEFDA0FAE0 NtReleaseKeyedEvent 0x70020 00007FFEFDA0D130 NtReleaseMutant 0x0C000A 00007FFEFDA0CE70 NtReleaseSemaphore 0x3016F 00007FFEFDA0FB00 NtReleaseWorkerFactoryWorker 0x1C0009 00007FFEFDA0CE50 NtRemoveIoCompletion 0x170 00007FFEFDA0FB20 NtRemoveIoCompletionEx 80171h 00007FFEFDA0FB40 NtRemoveProcessDebug 0x172 00007FFEFDA0FB60 NtRenameKey 0x173 00007FFEFDA0FB80 NtRenameTransactionManager 0x174 00007FFEFDA0FBA0 NtReplaceKey 0x175 00007FFEFDA0FBC0 NtReplacePartitionUnit 0x0C 00007FFEFDA0CEB0 NtReplyPort 0x0B 00007FFEFDA0CE90 NtReplyWaitReceivePort 0x2B 00007FFEFDA0D290 NtReplyWaitReceivePortEx 0x176 00007FFEFDA0FBE0 NtReplyWaitReplyPort 0x177 00007FFEFDA0FC00 NtRequestPort 0x22 00007FFEFDA0D170 NtRequestWaitReplyPort 0x70178 00007FFEFDA0FC20 NtResetEvent 0x0C0179 00007FFEFDA0FC40 NtResetWriteWatch 0x17A 00007FFEFDA0FC60 NtRestoreKey 0x3017B 00007FFEFDA0FC80 NtResumeProcess 0x70052 00007FFEFDA0D770 NtResumeThread 0x17C 00007FFEFDA0FCA0 NtRevertContainerImpersonation 0x17D 00007FFEFDA0FCC0 NtRollbackComplete 0x17E 00007FFEFDA0FCE0 NtRollbackEnlistment 0x17F 00007FFEFDA0FD00 NtRollbackRegistryTransaction 0x180 00007FFEFDA0FD20 NtRollbackTransaction 0x181 00007FFEFDA0FD40 NtRollforwardTransactionManager 0x80182 00007FFEFDA0FD60 NtSaveKey 0x0E0183 00007FFEFDA0FD80 NtSaveKeyEx 0x0B0184 00007FFEFDA0FDA0 NtSaveMergedKeys 0x185 00007FFEFDA0FDC0 NtSecureConnectPort 0x186 00007FFEFDA0FDE0 NtSerializeBoot 0x187 00007FFEFDA0FE00 NtSetBootEntryOrder 0x188 00007FFEFDA0FE20 NtSetBootOptions 0x189 00007FFEFDA0FE40 NtSetCachedSigningLevel 0x18A 00007FFEFDA0FE60 NtSetCachedSigningLevel2 0x18B 00007FFEFDA0FE80 NtSetContextThread 0x0A018C 00007FFEFDA0FEA0 NtSetDebugFilterState 0x3018D 00007FFEFDA0FEC0 NtSetDefaultHardErrorPort 0x5018E 00007FFEFDA0FEE0 NtSetDefaultLocale 0x4018F 00007FFEFDA0FF00 NtSetDefaultUILanguage 0x190 00007FFEFDA0FF20 NtSetDriverEntryOrder 0x191 00007FFEFDA0FF40 NtSetEaFile 0x7000E 00007FFEFDA0CEF0 NtSetEvent 0x3002D 00007FFEFDA0D2D0 NtSetEventBoostPriority 0x30192 00007FFEFDA0FF60 NtSetHighEventPair 0x30193 00007FFEFDA0FF80 NtSetHighWaitLowEventPair 0x70194 00007FFEFDA0FFA0 NtSetIRTimer 0x195 00007FFEFDA0FFC0 NtSetInformationDebugObject 0x196 00007FFEFDA0FFE0 NtSetInformationEnlistment 0x27 00007FFEFDA0D210 NtSetInformationFile 0x197 00007FFEFDA10000 NtSetInformationJobObject 0x198 00007FFEFDA10020 NtSetInformationKey 0x5C 00007FFEFDA0D8A0 NtSetInformationObject 0x1C 00007FFEFDA0D0B0 NtSetInformationProcess 0x199 00007FFEFDA10040 NtSetInformationResourceManager 0x19A 00007FFEFDA10060 NtSetInformationSymbolicLink 0x0D 00007FFEFDA0CED0 NtSetInformationThread 0x19B 00007FFEFDA10080 NtSetInformationToken 0x19C 00007FFEFDA100A0 NtSetInformationTransaction 0x19D 00007FFEFDA100C0 NtSetInformationTransactionManager 0x19E 00007FFEFDA100E0 NtSetInformationVirtualMemory 0x19F 00007FFEFDA10100 NtSetInformationWorkerFactory 0x501A0 00007FFEFDA10120 NtSetIntervalProfile 0x1A1 00007FFEFDA10140 NtSetIoCompletion 0x1A2 00007FFEFDA10160 NtSetIoCompletionEx 0x1A3 00007FFEFDA10180 NtSetLdtEntries 0x301A4 00007FFEFDA101A0 NtSetLowEventPair 0x301A5 00007FFEFDA101C0 NtSetLowWaitHighEventPair 0x1A6 00007FFEFDA101E0 NtSetQuotaInformationFile 0x1A7 00007FFEFDA10200 NtSetSecurityObject 0x1A8 00007FFEFDA10220 NtSetSystemEnvironmentValue 0x1A9 00007FFEFDA10240 NtSetSystemEnvironmentValueEx 0x1AA 00007FFEFDA10260 NtSetSystemInformation 0x1AB 00007FFEFDA10280 NtSetSystemPowerState 0x501AC 00007FFEFDA102A0 NtSetSystemTime 0x501AD 00007FFEFDA102C0 NtSetThreadExecutionState 0x62 00007FFEFDA0D960 NtSetTimer 0x1AE 00007FFEFDA102E0 NtSetTimer2 0x1AF 00007FFEFDA10300 NtSetTimerEx 0x0A01B0 00007FFEFDA10320 NtSetTimerResolution 0x401B1 00007FFEFDA10340 NtSetUuidSeed 0x60 00007FFEFDA0D920 NtSetValueKey 0x1B2 00007FFEFDA10360 NtSetVolumeInformationFile 0x1B3 00007FFEFDA10380 NtSetWnfProcessNotificationEvent 0x401B4 00007FFEFDA103A0 NtShutdownSystem 0x1B5 00007FFEFDA103C0 NtShutdownWorkerFactory 0x301B6 00007FFEFDA103E0 NtSignalAndWaitForSingleObject 0x1B7 00007FFEFDA10400 NtSinglePhaseReject 0x301B8 00007FFEFDA10420 NtStartProfile 0x301B9 00007FFEFDA10440 NtStopProfile 0x1BA 00007FFEFDA10460 NtSubscribeWnfStateChange 0x301BB 00007FFEFDA10480 NtSuspendProcess 0x701BC 00007FFEFDA104A0 NtSuspendThread 0x1BD 00007FFEFDA104C0 NtSystemDebugControl 0x1BE 00007FFEFDA104E0 NtTerminateEnclave 0x701BF 00007FFEFDA10500 NtTerminateJobObject 0x7002C 00007FFEFDA0D2B0 NtTerminateProcess 0x70053 00007FFEFDA0D790 NtTerminateThread 0x201C0 00007FFEFDA10520 NtTestAlert 0x1C1 00007FFEFDA10540 NtThawRegistry 0x1C2 00007FFEFDA10560 NtThawTransactions 0x1C3 00007FFEFDA10580 NtTraceControl 0x5E 00007FFEFDA0D8E0 NtTraceEvent 0x1101C4 00007FFEFDA105A0 NtTranslateFilePath 0x1C5 00007FFEFDA105C0 NtUmsThreadYield 0x1C6 00007FFEFDA105E0 NtUnloadDriver 0x1C7 00007FFEFDA10600 NtUnloadKey 0x1C8 00007FFEFDA10620 NtUnloadKey2 0x1C9 00007FFEFDA10640 NtUnloadKeyEx 0x1CA 00007FFEFDA10660 NtUnlockFile 0x1CB 00007FFEFDA10680 NtUnlockVirtualMemory 0x2A 00007FFEFDA0D270 NtUnmapViewOfSection 0x1CC 00007FFEFDA106A0 NtUnmapViewOfSectionEx 0x1CD 00007FFEFDA106C0 NtUnsubscribeWnfStateChange 0x1CE 00007FFEFDA106E0 NtUpdateWnfStateData 0x1CF 00007FFEFDA10700 NtVdmControl 0x601D0 00007FFEFDA10720 NtWaitForAlertByThreadId 0x1D1 00007FFEFDA10740 NtWaitForDebugEvent 0x1501D2 00007FFEFDA10760 NtWaitForKeyedEvent 0x1D005B 00007FFEFDA0D880 NtWaitForMultipleObjects 0x1E001A 00007FFEFDA0D070 NtWaitForMultipleObjects32 0x0D0004 00007FFEFDA0CDB0 NtWaitForSingleObject 0x1D3 00007FFEFDA10780 NtWaitForWorkViaWorkerFactory 0x301D4 00007FFEFDA107A0 NtWaitHighEventPair 0x301D5 00007FFEFDA107C0 NtWaitLowEventPair 0x30001 00007FFEFDA0CD50 NtWorkerFactoryWorkerReady 0x1A0008 00007FFEFDA0CE30 NtWriteFile 0x1A001B 00007FFEFDA0D090 NtWriteFileGather 0x57 00007FFEFDA0D810 NtWriteRequestData 0x3A 00007FFEFDA0D470 NtWriteVirtualMemory 0x10046 00007FFEFDA0D5F0 NtYieldExecution 0x36 00007FFEFDA0D3F0 RtlGetNativeSystemInformation """ reverseDict={} normalDict={} winDbgList=[] input=win11_21H2 input=win1021h2 for each in input: # outfile = input.split(".")[0] if t >1 and t < 100000: outfile = input.split("0x") # outfile[1] try: new=(outfile[t]) syscall = new.split() print (syscall) if syscall[0] in reverseDict: print (syscall[0], " is already present!!") print ("****",reverseDict[syscall[0]]) normalDict[str(int(syscall[0],16))]=syscall[2] reverseDict[syscall[2]]=int(syscall[0],16) temp=("u ntdll!"+syscall[2] + " L2") winDbgList.append(temp) except: pass t+=1 print ("\n\nReverse Dic", len(reverseDict)) print (reverseDict) print ("\n\nNormal Dic", len(normalDict)) print (normalDict) print ("winDbgList") for each in winDbgList: print (each)