mirror of
https://github.com/Bw3ll/ShellWasp
synced 2026-06-08 10:31:49 +00:00
Bw3ll
1 line
388 KiB
JSON
1 line
388 KiB
JSON
{"Windows XP": {"SP1": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateUserPhysicalPages", "109": "NtAllocateUuids", "110": "NtAreMappedFilesTheSame", "111": "NtAssignProcessToJobObject", "112": "NtCancelDeviceWakeupRequest", "113": "NtCompactKeys", "114": "NtCompareTokens", "115": "NtCompleteConnectPort", "116": "NtCompressKey", "117": "NtConnectPort", "118": "NtCreateDebugObject", "119": "NtCreateDirectoryObject", "120": "NtCreateEventPair", "121": "NtCreateIoCompletion", "122": "NtCreateJobObject", "123": "NtCreateJobSet", "124": "NtCreateKeyedEvent", "125": "NtCreateMailslotFile", "126": "NtCreateMutant", "127": "NtCreateNamedPipeFile", "128": "NtCreatePagingFile", "129": "NtCreatePort", "130": "NtCreateProcess", "131": "NtCreateProfile", "132": "NtCreateSemaphore", "133": "NtCreateSymbolicLinkObject", "134": "NtCreateTimer", "135": "NtCreateToken", "136": "NtCreateWaitablePort", "137": "NtDebugActiveProcess", "138": "NtDebugContinue", "139": "NtDeleteAtom", "140": "NtDeleteBootEntry", "141": "NtDeleteDriverEntry", "142": "NtDeleteFile", "143": "NtDeleteKey", "144": "NtDeleteObjectAuditAlarm", "145": "NtDeleteValueKey", "146": "NtDisplayString", "147": "NtEnumerateBootEntries", "148": "NtEnumerateDriverEntries", "149": "NtEnumerateSystemEnvironmentValuesEx", "150": "NtExtendSection", "151": "NtFilterToken", "152": "NtFlushInstructionCache", "153": "NtFlushKey", "154": "NtFlushVirtualMemory", "155": "NtFlushWriteBuffer", "156": "NtFreeUserPhysicalPages", "157": "NtGetContextThread", "158": "NtGetCurrentProcessorNumber", "159": "NtGetDevicePowerState", "160": "NtGetPlugPlayEvent", "161": "NtGetWriteWatch", "162": "NtImpersonateAnonymousToken", "163": "NtImpersonateThread", "164": "NtInitializeRegistry", "165": "NtInitiatePowerAction", "166": "NtIsSystemResumeAutomatic", "167": "NtListenPort", "168": "NtLoadDriver", "169": "NtLoadKey", "170": "NtLoadKey2", "171": "NtLoadKeyEx", "172": "NtLockFile", "173": "NtLockProductActivationKeys", "174": "NtLockRegistryKey", "175": "NtLockVirtualMemory", "176": "NtMakePermanentObject", "177": "NtMakeTemporaryObject", "178": "NtMapUserPhysicalPages", "179": "NtModifyBootEntry", "180": "NtModifyDriverEntry", "181": "NtNotifyChangeDirectoryFile", "182": "NtNotifyChangeKey", "183": "NtNotifyChangeMultipleKeys", "184": "NtOpenEventPair", "185": "NtOpenIoCompletion", "186": "NtOpenJobObject", "187": "NtOpenKeyedEvent", "188": "NtOpenMutant", "189": "NtOpenObjectAuditAlarm", "190": "NtOpenProcessToken", "191": "NtOpenSemaphore", "192": "NtOpenSymbolicLinkObject", "193": "NtOpenThread", "194": "NtOpenTimer", "195": "NtPlugPlayControl", "196": "NtPrivilegeCheck", "197": "NtPrivilegeObjectAuditAlarm", "198": "NtPrivilegedServiceAuditAlarm", "199": "NtPulseEvent", "200": "NtQueryBootEntryOrder", "201": "NtQueryBootOptions", "202": "NtQueryDebugFilterState", "203": "NtQueryDirectoryObject", "204": "NtQueryDriverEntryOrder", "205": "NtQueryEaFile", "206": "NtQueryFullAttributesFile", "207": "NtQueryInformationAtom", "208": "NtQueryInformationJobObject", "209": "NtQueryInformationPort", "210": "NtQueryInstallUILanguage", "211": "NtQueryIntervalProfile", "212": "NtQueryIoCompletion", "213": "NtQueryMultipleValueKey", "214": "NtQueryMutant", "215": "NtQueryOpenSubKeys", "216": "NtQueryOpenSubKeysEx", "217": "NtQueryPortInformationProcess", "218": "NtQueryQuotaInformationFile", "219": "NtQuerySecurityObject", "220": "NtQuerySemaphore", "221": "NtQuerySymbolicLinkObject", "222": "NtQuerySystemEnvironmentValue", "223": "NtQuerySystemEnvironmentValueEx", "224": "NtQueryTimerResolution", "225": "NtRaiseException", "226": "NtRaiseHardError", "227": "NtRegisterThreadTerminatePort", "228": "NtReleaseKeyedEvent", "229": "NtRemoveProcessDebug", "230": "NtRenameKey", "231": "NtReplaceKey", "232": "NtReplyWaitReplyPort", "233": "NtRequestDeviceWakeup", "234": "NtRequestPort", "235": "NtRequestWakeupLatency", "236": "NtResetEvent", "237": "NtResetWriteWatch", "238": "NtRestoreKey", "239": "NtResumeProcess", "240": "NtSaveKey", "241": "NtSaveKeyEx", "242": "NtSaveMergedKeys", "243": "NtSecureConnectPort", "244": "NtSetBootEntryOrder", "245": "NtSetBootOptions", "246": "NtSetContextThread", "247": "NtSetDebugFilterState", "248": "NtSetDefaultHardErrorPort", "249": "NtSetDefaultLocale", "250": "NtSetDefaultUILanguage", "251": "NtSetDriverEntryOrder", "252": "NtSetEaFile", "253": "NtSetHighEventPair", "254": "NtSetHighWaitLowEventPair", "255": "NtSetInformationDebugObject", "256": "NtSetInformationJobObject", "257": "NtSetInformationKey", "258": "NtSetInformationToken", "259": "NtSetIntervalProfile", "260": "NtSetIoCompletion", "261": "NtSetLdtEntries", "262": "NtSetLowEventPair", "263": "NtSetLowWaitHighEventPair", "264": "NtSetQuotaInformationFile", "265": "NtSetSecurityObject", "266": "NtSetSystemEnvironmentValue", "267": "NtSetSystemEnvironmentValueEx", "268": "NtSetSystemInformation", "269": "NtSetSystemPowerState", "270": "NtSetSystemTime", "271": "NtSetThreadExecutionState", "272": "NtSetTimerResolution", "273": "NtSetUuidSeed", "274": "NtSetVolumeInformationFile", "275": "NtShutdownSystem", "276": "NtSignalAndWaitForSingleObject", "277": "NtStartProfile", "278": "NtStopProfile", "279": "NtSuspendProcess", "280": "NtSuspendThread", "281": "NtSystemDebugControl", "282": "NtTerminateJobObject", "283": "NtTestAlert", "284": "NtTranslateFilePath", "285": "NtUnloadDriver", "286": "NtUnloadKey", "287": "NtUnloadKey2", "288": "NtUnloadKeyEx", "289": "NtUnlockFile", "290": "NtUnlockVirtualMemory", "291": "NtVdmControl", "292": "NtWaitForDebugEvent", "293": "NtWaitForKeyedEvent", "294": "NtWaitHighEventPair", "295": "NtWaitLowEventPair"}, "SP2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateUserPhysicalPages", "109": "NtAllocateUuids", "110": "NtAreMappedFilesTheSame", "111": "NtAssignProcessToJobObject", "112": "NtCancelDeviceWakeupRequest", "113": "NtCompactKeys", "114": "NtCompareTokens", "115": "NtCompleteConnectPort", "116": "NtCompressKey", "117": "NtConnectPort", "118": "NtCreateDebugObject", "119": "NtCreateDirectoryObject", "120": "NtCreateEventPair", "121": "NtCreateIoCompletion", "122": "NtCreateJobObject", "123": "NtCreateJobSet", "124": "NtCreateKeyedEvent", "125": "NtCreateMailslotFile", "126": "NtCreateMutant", "127": "NtCreateNamedPipeFile", "128": "NtCreatePagingFile", "129": "NtCreatePort", "130": "NtCreateProcess", "131": "NtCreateProfile", "132": "NtCreateSemaphore", "133": "NtCreateSymbolicLinkObject", "134": "NtCreateTimer", "135": "NtCreateToken", "136": "NtCreateWaitablePort", "137": "NtDebugActiveProcess", "138": "NtDebugContinue", "139": "NtDeleteAtom", "140": "NtDeleteBootEntry", "141": "NtDeleteDriverEntry", "142": "NtDeleteFile", "143": "NtDeleteKey", "144": "NtDeleteObjectAuditAlarm", "145": "NtDeleteValueKey", "146": "NtDisplayString", "147": "NtEnumerateBootEntries", "148": "NtEnumerateDriverEntries", "149": "NtEnumerateSystemEnvironmentValuesEx", "150": "NtExtendSection", "151": "NtFilterToken", "152": "NtFlushInstructionCache", "153": "NtFlushKey", "154": "NtFlushVirtualMemory", "155": "NtFlushWriteBuffer", "156": "NtFreeUserPhysicalPages", "157": "NtGetContextThread", "158": "NtGetCurrentProcessorNumber", "159": "NtGetDevicePowerState", "160": "NtGetPlugPlayEvent", "161": "NtGetWriteWatch", "162": "NtImpersonateAnonymousToken", "163": "NtImpersonateThread", "164": "NtInitializeRegistry", "165": "NtInitiatePowerAction", "166": "NtIsSystemResumeAutomatic", "167": "NtListenPort", "168": "NtLoadDriver", "169": "NtLoadKey", "170": "NtLoadKey2", "171": "NtLoadKeyEx", "172": "NtLockFile", "173": "NtLockProductActivationKeys", "174": "NtLockRegistryKey", "175": "NtLockVirtualMemory", "176": "NtMakePermanentObject", "177": "NtMakeTemporaryObject", "178": "NtMapUserPhysicalPages", "179": "NtModifyBootEntry", "180": "NtModifyDriverEntry", "181": "NtNotifyChangeDirectoryFile", "182": "NtNotifyChangeKey", "183": "NtNotifyChangeMultipleKeys", "184": "NtOpenEventPair", "185": "NtOpenIoCompletion", "186": "NtOpenJobObject", "187": "NtOpenKeyedEvent", "188": "NtOpenMutant", "189": "NtOpenObjectAuditAlarm", "190": "NtOpenProcessToken", "191": "NtOpenSemaphore", "192": "NtOpenSymbolicLinkObject", "193": "NtOpenThread", "194": "NtOpenTimer", "195": "NtPlugPlayControl", "196": "NtPrivilegeCheck", "197": "NtPrivilegeObjectAuditAlarm", "198": "NtPrivilegedServiceAuditAlarm", "199": "NtPulseEvent", "200": "NtQueryBootEntryOrder", "201": "NtQueryBootOptions", "202": "NtQueryDebugFilterState", "203": "NtQueryDirectoryObject", "204": "NtQueryDriverEntryOrder", "205": "NtQueryEaFile", "206": "NtQueryFullAttributesFile", "207": "NtQueryInformationAtom", "208": "NtQueryInformationJobObject", "209": "NtQueryInformationPort", "210": "NtQueryInstallUILanguage", "211": "NtQueryIntervalProfile", "212": "NtQueryIoCompletion", "213": "NtQueryMultipleValueKey", "214": "NtQueryMutant", "215": "NtQueryOpenSubKeys", "216": "NtQueryOpenSubKeysEx", "217": "NtQueryPortInformationProcess", "218": "NtQueryQuotaInformationFile", "219": "NtQuerySecurityObject", "220": "NtQuerySemaphore", "221": "NtQuerySymbolicLinkObject", "222": "NtQuerySystemEnvironmentValue", "223": "NtQuerySystemEnvironmentValueEx", "224": "NtQueryTimerResolution", "225": "NtRaiseException", "226": "NtRaiseHardError", "227": "NtRegisterThreadTerminatePort", "228": "NtReleaseKeyedEvent", "229": "NtRemoveProcessDebug", "230": "NtRenameKey", "231": "NtReplaceKey", "232": "NtReplyWaitReplyPort", "233": "NtRequestDeviceWakeup", "234": "NtRequestPort", "235": "NtRequestWakeupLatency", "236": "NtResetEvent", "237": "NtResetWriteWatch", "238": "NtRestoreKey", "239": "NtResumeProcess", "240": "NtSaveKey", "241": "NtSaveKeyEx", "242": "NtSaveMergedKeys", "243": "NtSecureConnectPort", "244": "NtSetBootEntryOrder", "245": "NtSetBootOptions", "246": "NtSetContextThread", "247": "NtSetDebugFilterState", "248": "NtSetDefaultHardErrorPort", "249": "NtSetDefaultLocale", "250": "NtSetDefaultUILanguage", "251": "NtSetDriverEntryOrder", "252": "NtSetEaFile", "253": "NtSetHighEventPair", "254": "NtSetHighWaitLowEventPair", "255": "NtSetInformationDebugObject", "256": "NtSetInformationJobObject", "257": "NtSetInformationKey", "258": "NtSetInformationToken", "259": "NtSetIntervalProfile", "260": "NtSetIoCompletion", "261": "NtSetLdtEntries", "262": "NtSetLowEventPair", "263": "NtSetLowWaitHighEventPair", "264": "NtSetQuotaInformationFile", "265": "NtSetSecurityObject", "266": "NtSetSystemEnvironmentValue", "267": "NtSetSystemEnvironmentValueEx", "268": "NtSetSystemInformation", "269": "NtSetSystemPowerState", "270": "NtSetSystemTime", "271": "NtSetThreadExecutionState", "272": "NtSetTimerResolution", "273": "NtSetUuidSeed", "274": "NtSetVolumeInformationFile", "275": "NtShutdownSystem", "276": "NtSignalAndWaitForSingleObject", "277": "NtStartProfile", "278": "NtStopProfile", "279": "NtSuspendProcess", "280": "NtSuspendThread", "281": "NtSystemDebugControl", "282": "NtTerminateJobObject", "283": "NtTestAlert", "284": "NtTranslateFilePath", "285": "NtUnloadDriver", "286": "NtUnloadKey", "287": "NtUnloadKey2", "288": "NtUnloadKeyEx", "289": "NtUnlockFile", "290": "NtUnlockVirtualMemory", "291": "NtVdmControl", "292": "NtWaitForDebugEvent", "293": "NtWaitForKeyedEvent", "294": "NtWaitHighEventPair", "295": "NtWaitLowEventPair"}}, "Windows Server 2003": {"SP0": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateUserPhysicalPages", "109": "NtAllocateUuids", "110": "NtAreMappedFilesTheSame", "111": "NtAssignProcessToJobObject", "112": "NtCancelDeviceWakeupRequest", "113": "NtCompactKeys", "114": "NtCompareTokens", "115": "NtCompleteConnectPort", "116": "NtCompressKey", "117": "NtConnectPort", "118": "NtCreateDebugObject", "119": "NtCreateDirectoryObject", "120": "NtCreateEventPair", "121": "NtCreateIoCompletion", "122": "NtCreateJobObject", "123": "NtCreateJobSet", "124": "NtCreateKeyedEvent", "125": "NtCreateMailslotFile", "126": "NtCreateMutant", "127": "NtCreateNamedPipeFile", "128": "NtCreatePagingFile", "129": "NtCreatePort", "130": "NtCreateProcess", "131": "NtCreateProfile", "132": "NtCreateSemaphore", "133": "NtCreateSymbolicLinkObject", "134": "NtCreateTimer", "135": "NtCreateToken", "136": "NtCreateWaitablePort", "137": "NtDebugActiveProcess", "138": "NtDebugContinue", "139": "NtDeleteAtom", "140": "NtDeleteBootEntry", "141": "NtDeleteDriverEntry", "142": "NtDeleteFile", "143": "NtDeleteKey", "144": "NtDeleteObjectAuditAlarm", "145": "NtDeleteValueKey", "146": "NtDisplayString", "147": "NtEnumerateBootEntries", "148": "NtEnumerateDriverEntries", "149": "NtEnumerateSystemEnvironmentValuesEx", "150": "NtExtendSection", "151": "NtFilterToken", "152": "NtFlushInstructionCache", "153": "NtFlushKey", "154": "NtFlushVirtualMemory", "155": "NtFlushWriteBuffer", "156": "NtFreeUserPhysicalPages", "157": "NtGetContextThread", "158": "NtGetCurrentProcessorNumber", "159": "NtGetDevicePowerState", "160": "NtGetPlugPlayEvent", "161": "NtGetWriteWatch", "162": "NtImpersonateAnonymousToken", "163": "NtImpersonateThread", "164": "NtInitializeRegistry", "165": "NtInitiatePowerAction", "166": "NtIsSystemResumeAutomatic", "167": "NtListenPort", "168": "NtLoadDriver", "169": "NtLoadKey", "170": "NtLoadKey2", "171": "NtLoadKeyEx", "172": "NtLockFile", "173": "NtLockProductActivationKeys", "174": "NtLockRegistryKey", "175": "NtLockVirtualMemory", "176": "NtMakePermanentObject", "177": "NtMakeTemporaryObject", "178": "NtMapUserPhysicalPages", "179": "NtModifyBootEntry", "180": "NtModifyDriverEntry", "181": "NtNotifyChangeDirectoryFile", "182": "NtNotifyChangeKey", "183": "NtNotifyChangeMultipleKeys", "184": "NtOpenEventPair", "185": "NtOpenIoCompletion", "186": "NtOpenJobObject", "187": "NtOpenKeyedEvent", "188": "NtOpenMutant", "189": "NtOpenObjectAuditAlarm", "190": "NtOpenProcessToken", "191": "NtOpenSemaphore", "192": "NtOpenSymbolicLinkObject", "193": "NtOpenThread", "194": "NtOpenTimer", "195": "NtPlugPlayControl", "196": "NtPrivilegeCheck", "197": "NtPrivilegeObjectAuditAlarm", "198": "NtPrivilegedServiceAuditAlarm", "199": "NtPulseEvent", "200": "NtQueryBootEntryOrder", "201": "NtQueryBootOptions", "202": "NtQueryDebugFilterState", "203": "NtQueryDirectoryObject", "204": "NtQueryDriverEntryOrder", "205": "NtQueryEaFile", "206": "NtQueryFullAttributesFile", "207": "NtQueryInformationAtom", "208": "NtQueryInformationJobObject", "209": "NtQueryInformationPort", "210": "NtQueryInstallUILanguage", "211": "NtQueryIntervalProfile", "212": "NtQueryIoCompletion", "213": "NtQueryMultipleValueKey", "214": "NtQueryMutant", "215": "NtQueryOpenSubKeys", "216": "NtQueryOpenSubKeysEx", "217": "NtQueryPortInformationProcess", "218": "NtQueryQuotaInformationFile", "219": "NtQuerySecurityObject", "220": "NtQuerySemaphore", "221": "NtQuerySymbolicLinkObject", "222": "NtQuerySystemEnvironmentValue", "223": "NtQuerySystemEnvironmentValueEx", "224": "NtQueryTimerResolution", "225": "NtRaiseException", "226": "NtRaiseHardError", "227": "NtRegisterThreadTerminatePort", "228": "NtReleaseKeyedEvent", "229": "NtRemoveProcessDebug", "230": "NtRenameKey", "231": "NtReplaceKey", "232": "NtReplyWaitReplyPort", "233": "NtRequestDeviceWakeup", "234": "NtRequestPort", "235": "NtRequestWakeupLatency", "236": "NtResetEvent", "237": "NtResetWriteWatch", "238": "NtRestoreKey", "239": "NtResumeProcess", "240": "NtSaveKey", "241": "NtSaveKeyEx", "242": "NtSaveMergedKeys", "243": "NtSecureConnectPort", "244": "NtSetBootEntryOrder", "245": "NtSetBootOptions", "246": "NtSetContextThread", "247": "NtSetDebugFilterState", "248": "NtSetDefaultHardErrorPort", "249": "NtSetDefaultLocale", "250": "NtSetDefaultUILanguage", "251": "NtSetDriverEntryOrder", "252": "NtSetEaFile", "253": "NtSetHighEventPair", "254": "NtSetHighWaitLowEventPair", "255": "NtSetInformationDebugObject", "256": "NtSetInformationJobObject", "257": "NtSetInformationKey", "258": "NtSetInformationToken", "259": "NtSetIntervalProfile", "260": "NtSetIoCompletion", "261": "NtSetLdtEntries", "262": "NtSetLowEventPair", "263": "NtSetLowWaitHighEventPair", "264": "NtSetQuotaInformationFile", "265": "NtSetSecurityObject", "266": "NtSetSystemEnvironmentValue", "267": "NtSetSystemEnvironmentValueEx", "268": "NtSetSystemInformation", "269": "NtSetSystemPowerState", "270": "NtSetSystemTime", "271": "NtSetThreadExecutionState", "272": "NtSetTimerResolution", "273": "NtSetUuidSeed", "274": "NtSetVolumeInformationFile", "275": "NtShutdownSystem", "276": "NtSignalAndWaitForSingleObject", "277": "NtStartProfile", "278": "NtStopProfile", "279": "NtSuspendProcess", "280": "NtSuspendThread", "281": "NtSystemDebugControl", "282": "NtTerminateJobObject", "283": "NtTestAlert", "284": "NtTranslateFilePath", "285": "NtUnloadDriver", "286": "NtUnloadKey", "287": "NtUnloadKey2", "288": "NtUnloadKeyEx", "289": "NtUnlockFile", "290": "NtUnlockVirtualMemory", "291": "NtVdmControl", "292": "NtWaitForDebugEvent", "293": "NtWaitForKeyedEvent", "294": "NtWaitHighEventPair", "295": "NtWaitLowEventPair"}, "SP2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateUserPhysicalPages", "109": "NtAllocateUuids", "110": "NtAreMappedFilesTheSame", "111": "NtAssignProcessToJobObject", "112": "NtCancelDeviceWakeupRequest", "113": "NtCompactKeys", "114": "NtCompareTokens", "115": "NtCompleteConnectPort", "116": "NtCompressKey", "117": "NtConnectPort", "118": "NtCreateDebugObject", "119": "NtCreateDirectoryObject", "120": "NtCreateEventPair", "121": "NtCreateIoCompletion", "122": "NtCreateJobObject", "123": "NtCreateJobSet", "124": "NtCreateKeyedEvent", "125": "NtCreateMailslotFile", "126": "NtCreateMutant", "127": "NtCreateNamedPipeFile", "128": "NtCreatePagingFile", "129": "NtCreatePort", "130": "NtCreateProcess", "131": "NtCreateProfile", "132": "NtCreateSemaphore", "133": "NtCreateSymbolicLinkObject", "134": "NtCreateTimer", "135": "NtCreateToken", "136": "NtCreateWaitablePort", "137": "NtDebugActiveProcess", "138": "NtDebugContinue", "139": "NtDeleteAtom", "140": "NtDeleteBootEntry", "141": "NtDeleteDriverEntry", "142": "NtDeleteFile", "143": "NtDeleteKey", "144": "NtDeleteObjectAuditAlarm", "145": "NtDeleteValueKey", "146": "NtDisplayString", "147": "NtEnumerateBootEntries", "148": "NtEnumerateDriverEntries", "149": "NtEnumerateSystemEnvironmentValuesEx", "150": "NtExtendSection", "151": "NtFilterToken", "152": "NtFlushInstructionCache", "153": "NtFlushKey", "154": "NtFlushVirtualMemory", "155": "NtFlushWriteBuffer", "156": "NtFreeUserPhysicalPages", "157": "NtGetContextThread", "158": "NtGetCurrentProcessorNumber", "159": "NtGetDevicePowerState", "160": "NtGetPlugPlayEvent", "161": "NtGetWriteWatch", "162": "NtImpersonateAnonymousToken", "163": "NtImpersonateThread", "164": "NtInitializeRegistry", "165": "NtInitiatePowerAction", "166": "NtIsSystemResumeAutomatic", "167": "NtListenPort", "168": "NtLoadDriver", "169": "NtLoadKey", "170": "NtLoadKey2", "171": "NtLoadKeyEx", "172": "NtLockFile", "173": "NtLockProductActivationKeys", "174": "NtLockRegistryKey", "175": "NtLockVirtualMemory", "176": "NtMakePermanentObject", "177": "NtMakeTemporaryObject", "178": "NtMapUserPhysicalPages", "179": "NtModifyBootEntry", "180": "NtModifyDriverEntry", "181": "NtNotifyChangeDirectoryFile", "182": "NtNotifyChangeKey", "183": "NtNotifyChangeMultipleKeys", "184": "NtOpenEventPair", "185": "NtOpenIoCompletion", "186": "NtOpenJobObject", "187": "NtOpenKeyedEvent", "188": "NtOpenMutant", "189": "NtOpenObjectAuditAlarm", "190": "NtOpenProcessToken", "191": "NtOpenSemaphore", "192": "NtOpenSymbolicLinkObject", "193": "NtOpenThread", "194": "NtOpenTimer", "195": "NtPlugPlayControl", "196": "NtPrivilegeCheck", "197": "NtPrivilegeObjectAuditAlarm", "198": "NtPrivilegedServiceAuditAlarm", "199": "NtPulseEvent", "200": "NtQueryBootEntryOrder", "201": "NtQueryBootOptions", "202": "NtQueryDebugFilterState", "203": "NtQueryDirectoryObject", "204": "NtQueryDriverEntryOrder", "205": "NtQueryEaFile", "206": "NtQueryFullAttributesFile", "207": "NtQueryInformationAtom", "208": "NtQueryInformationJobObject", "209": "NtQueryInformationPort", "210": "NtQueryInstallUILanguage", "211": "NtQueryIntervalProfile", "212": "NtQueryIoCompletion", "213": "NtQueryMultipleValueKey", "214": "NtQueryMutant", "215": "NtQueryOpenSubKeys", "216": "NtQueryOpenSubKeysEx", "217": "NtQueryPortInformationProcess", "218": "NtQueryQuotaInformationFile", "219": "NtQuerySecurityObject", "220": "NtQuerySemaphore", "221": "NtQuerySymbolicLinkObject", "222": "NtQuerySystemEnvironmentValue", "223": "NtQuerySystemEnvironmentValueEx", "224": "NtQueryTimerResolution", "225": "NtRaiseException", "226": "NtRaiseHardError", "227": "NtRegisterThreadTerminatePort", "228": "NtReleaseKeyedEvent", "229": "NtRemoveProcessDebug", "230": "NtRenameKey", "231": "NtReplaceKey", "232": "NtReplyWaitReplyPort", "233": "NtRequestDeviceWakeup", "234": "NtRequestPort", "235": "NtRequestWakeupLatency", "236": "NtResetEvent", "237": "NtResetWriteWatch", "238": "NtRestoreKey", "239": "NtResumeProcess", "240": "NtSaveKey", "241": "NtSaveKeyEx", "242": "NtSaveMergedKeys", "243": "NtSecureConnectPort", "244": "NtSetBootEntryOrder", "245": "NtSetBootOptions", "246": "NtSetContextThread", "247": "NtSetDebugFilterState", "248": "NtSetDefaultHardErrorPort", "249": "NtSetDefaultLocale", "250": "NtSetDefaultUILanguage", "251": "NtSetDriverEntryOrder", "252": "NtSetEaFile", "253": "NtSetHighEventPair", "254": "NtSetHighWaitLowEventPair", "255": "NtSetInformationDebugObject", "256": "NtSetInformationJobObject", "257": "NtSetInformationKey", "258": "NtSetInformationToken", "259": "NtSetIntervalProfile", "260": "NtSetIoCompletion", "261": "NtSetLdtEntries", "262": "NtSetLowEventPair", "263": "NtSetLowWaitHighEventPair", "264": "NtSetQuotaInformationFile", "265": "NtSetSecurityObject", "266": "NtSetSystemEnvironmentValue", "267": "NtSetSystemEnvironmentValueEx", "268": "NtSetSystemInformation", "269": "NtSetSystemPowerState", "270": "NtSetSystemTime", "271": "NtSetThreadExecutionState", "272": "NtSetTimerResolution", "273": "NtSetUuidSeed", "274": "NtSetVolumeInformationFile", "275": "NtShutdownSystem", "276": "NtSignalAndWaitForSingleObject", "277": "NtStartProfile", "278": "NtStopProfile", "279": "NtSuspendProcess", "280": "NtSuspendThread", "281": "NtSystemDebugControl", "282": "NtTerminateJobObject", "283": "NtTestAlert", "284": "NtTranslateFilePath", "285": "NtUnloadDriver", "286": "NtUnloadKey", "287": "NtUnloadKey2", "288": "NtUnloadKeyEx", "289": "NtUnlockFile", "290": "NtUnlockVirtualMemory", "291": "NtVdmControl", "292": "NtWaitForDebugEvent", "293": "NtWaitForKeyedEvent", "294": "NtWaitHighEventPair", "295": "NtWaitLowEventPair"}, "R2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateUserPhysicalPages", "109": "NtAllocateUuids", "110": "NtAreMappedFilesTheSame", "111": "NtAssignProcessToJobObject", "112": "NtCancelDeviceWakeupRequest", "113": "NtCompactKeys", "114": "NtCompareTokens", "115": "NtCompleteConnectPort", "116": "NtCompressKey", "117": "NtConnectPort", "118": "NtCreateDebugObject", "119": "NtCreateDirectoryObject", "120": "NtCreateEventPair", "121": "NtCreateIoCompletion", "122": "NtCreateJobObject", "123": "NtCreateJobSet", "124": "NtCreateKeyedEvent", "125": "NtCreateMailslotFile", "126": "NtCreateMutant", "127": "NtCreateNamedPipeFile", "128": "NtCreatePagingFile", "129": "NtCreatePort", "130": "NtCreateProcess", "131": "NtCreateProfile", "132": "NtCreateSemaphore", "133": "NtCreateSymbolicLinkObject", "134": "NtCreateTimer", "135": "NtCreateToken", "136": "NtCreateWaitablePort", "137": "NtDebugActiveProcess", "138": "NtDebugContinue", "139": "NtDeleteAtom", "140": "NtDeleteBootEntry", "141": "NtDeleteDriverEntry", "142": "NtDeleteFile", "143": "NtDeleteKey", "144": "NtDeleteObjectAuditAlarm", "145": "NtDeleteValueKey", "146": "NtDisplayString", "147": "NtEnumerateBootEntries", "148": "NtEnumerateDriverEntries", "149": "NtEnumerateSystemEnvironmentValuesEx", "150": "NtExtendSection", "151": "NtFilterToken", "152": "NtFlushInstructionCache", "153": "NtFlushKey", "154": "NtFlushVirtualMemory", "155": "NtFlushWriteBuffer", "156": "NtFreeUserPhysicalPages", "157": "NtGetContextThread", "158": "NtGetCurrentProcessorNumber", "159": "NtGetDevicePowerState", "160": "NtGetPlugPlayEvent", "161": "NtGetWriteWatch", "162": "NtImpersonateAnonymousToken", "163": "NtImpersonateThread", "164": "NtInitializeRegistry", "165": "NtInitiatePowerAction", "166": "NtIsSystemResumeAutomatic", "167": "NtListenPort", "168": "NtLoadDriver", "169": "NtLoadKey", "170": "NtLoadKey2", "171": "NtLoadKeyEx", "172": "NtLockFile", "173": "NtLockProductActivationKeys", "174": "NtLockRegistryKey", "175": "NtLockVirtualMemory", "176": "NtMakePermanentObject", "177": "NtMakeTemporaryObject", "178": "NtMapUserPhysicalPages", "179": "NtModifyBootEntry", "180": "NtModifyDriverEntry", "181": "NtNotifyChangeDirectoryFile", "182": "NtNotifyChangeKey", "183": "NtNotifyChangeMultipleKeys", "184": "NtOpenEventPair", "185": "NtOpenIoCompletion", "186": "NtOpenJobObject", "187": "NtOpenKeyedEvent", "188": "NtOpenMutant", "189": "NtOpenObjectAuditAlarm", "190": "NtOpenProcessToken", "191": "NtOpenSemaphore", "192": "NtOpenSymbolicLinkObject", "193": "NtOpenThread", "194": "NtOpenTimer", "195": "NtPlugPlayControl", "196": "NtPrivilegeCheck", "197": "NtPrivilegeObjectAuditAlarm", "198": "NtPrivilegedServiceAuditAlarm", "199": "NtPulseEvent", "200": "NtQueryBootEntryOrder", "201": "NtQueryBootOptions", "202": "NtQueryDebugFilterState", "203": "NtQueryDirectoryObject", "204": "NtQueryDriverEntryOrder", "205": "NtQueryEaFile", "206": "NtQueryFullAttributesFile", "207": "NtQueryInformationAtom", "208": "NtQueryInformationJobObject", "209": "NtQueryInformationPort", "210": "NtQueryInstallUILanguage", "211": "NtQueryIntervalProfile", "212": "NtQueryIoCompletion", "213": "NtQueryMultipleValueKey", "214": "NtQueryMutant", "215": "NtQueryOpenSubKeys", "216": "NtQueryOpenSubKeysEx", "217": "NtQueryPortInformationProcess", "218": "NtQueryQuotaInformationFile", "219": "NtQuerySecurityObject", "220": "NtQuerySemaphore", "221": "NtQuerySymbolicLinkObject", "222": "NtQuerySystemEnvironmentValue", "223": "NtQuerySystemEnvironmentValueEx", "224": "NtQueryTimerResolution", "225": "NtRaiseException", "226": "NtRaiseHardError", "227": "NtRegisterThreadTerminatePort", "228": "NtReleaseKeyedEvent", "229": "NtRemoveProcessDebug", "230": "NtRenameKey", "231": "NtReplaceKey", "232": "NtReplyWaitReplyPort", "233": "NtRequestDeviceWakeup", "234": "NtRequestPort", "235": "NtRequestWakeupLatency", "236": "NtResetEvent", "237": "NtResetWriteWatch", "238": "NtRestoreKey", "239": "NtResumeProcess", "240": "NtSaveKey", "241": "NtSaveKeyEx", "242": "NtSaveMergedKeys", "243": "NtSecureConnectPort", "244": "NtSetBootEntryOrder", "245": "NtSetBootOptions", "246": "NtSetContextThread", "247": "NtSetDebugFilterState", "248": "NtSetDefaultHardErrorPort", "249": "NtSetDefaultLocale", "250": "NtSetDefaultUILanguage", "251": "NtSetDriverEntryOrder", "252": "NtSetEaFile", "253": "NtSetHighEventPair", "254": "NtSetHighWaitLowEventPair", "255": "NtSetInformationDebugObject", "256": "NtSetInformationJobObject", "257": "NtSetInformationKey", "258": "NtSetInformationToken", "259": "NtSetIntervalProfile", "260": "NtSetIoCompletion", "261": "NtSetLdtEntries", "262": "NtSetLowEventPair", "263": "NtSetLowWaitHighEventPair", "264": "NtSetQuotaInformationFile", "265": "NtSetSecurityObject", "266": "NtSetSystemEnvironmentValue", "267": "NtSetSystemEnvironmentValueEx", "268": "NtSetSystemInformation", "269": "NtSetSystemPowerState", "270": "NtSetSystemTime", "271": "NtSetThreadExecutionState", "272": "NtSetTimerResolution", "273": "NtSetUuidSeed", "274": "NtSetVolumeInformationFile", "275": "NtShutdownSystem", "276": "NtSignalAndWaitForSingleObject", "277": "NtStartProfile", "278": "NtStopProfile", "279": "NtSuspendProcess", "280": "NtSuspendThread", "281": "NtSystemDebugControl", "282": "NtTerminateJobObject", "283": "NtTestAlert", "284": "NtTranslateFilePath", "285": "NtUnloadDriver", "286": "NtUnloadKey", "287": "NtUnloadKey2", "288": "NtUnloadKeyEx", "289": "NtUnlockFile", "290": "NtUnlockVirtualMemory", "291": "NtVdmControl", "292": "NtWaitForDebugEvent", "293": "NtWaitForKeyedEvent", "294": "NtWaitHighEventPair", "295": "NtWaitLowEventPair"}, "R2 SP2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateUserPhysicalPages", "109": "NtAllocateUuids", "110": "NtAreMappedFilesTheSame", "111": "NtAssignProcessToJobObject", "112": "NtCancelDeviceWakeupRequest", "113": "NtCompactKeys", "114": "NtCompareTokens", "115": "NtCompleteConnectPort", "116": "NtCompressKey", "117": "NtConnectPort", "118": "NtCreateDebugObject", "119": "NtCreateDirectoryObject", "120": "NtCreateEventPair", "121": "NtCreateIoCompletion", "122": "NtCreateJobObject", "123": "NtCreateJobSet", "124": "NtCreateKeyedEvent", "125": "NtCreateMailslotFile", "126": "NtCreateMutant", "127": "NtCreateNamedPipeFile", "128": "NtCreatePagingFile", "129": "NtCreatePort", "130": "NtCreateProcess", "131": "NtCreateProfile", "132": "NtCreateSemaphore", "133": "NtCreateSymbolicLinkObject", "134": "NtCreateTimer", "135": "NtCreateToken", "136": "NtCreateWaitablePort", "137": "NtDebugActiveProcess", "138": "NtDebugContinue", "139": "NtDeleteAtom", "140": "NtDeleteBootEntry", "141": "NtDeleteDriverEntry", "142": "NtDeleteFile", "143": "NtDeleteKey", "144": "NtDeleteObjectAuditAlarm", "145": "NtDeleteValueKey", "146": "NtDisplayString", "147": "NtEnumerateBootEntries", "148": "NtEnumerateDriverEntries", "149": "NtEnumerateSystemEnvironmentValuesEx", "150": "NtExtendSection", "151": "NtFilterToken", "152": "NtFlushInstructionCache", "153": "NtFlushKey", "154": "NtFlushVirtualMemory", "155": "NtFlushWriteBuffer", "156": "NtFreeUserPhysicalPages", "157": "NtGetContextThread", "158": "NtGetCurrentProcessorNumber", "159": "NtGetDevicePowerState", "160": "NtGetPlugPlayEvent", "161": "NtGetWriteWatch", "162": "NtImpersonateAnonymousToken", "163": "NtImpersonateThread", "164": "NtInitializeRegistry", "165": "NtInitiatePowerAction", "166": "NtIsSystemResumeAutomatic", "167": "NtListenPort", "168": "NtLoadDriver", "169": "NtLoadKey", "170": "NtLoadKey2", "171": "NtLoadKeyEx", "172": "NtLockFile", "173": "NtLockProductActivationKeys", "174": "NtLockRegistryKey", "175": "NtLockVirtualMemory", "176": "NtMakePermanentObject", "177": "NtMakeTemporaryObject", "178": "NtMapUserPhysicalPages", "179": "NtModifyBootEntry", "180": "NtModifyDriverEntry", "181": "NtNotifyChangeDirectoryFile", "182": "NtNotifyChangeKey", "183": "NtNotifyChangeMultipleKeys", "184": "NtOpenEventPair", "185": "NtOpenIoCompletion", "186": "NtOpenJobObject", "187": "NtOpenKeyedEvent", "188": "NtOpenMutant", "189": "NtOpenObjectAuditAlarm", "190": "NtOpenProcessToken", "191": "NtOpenSemaphore", "192": "NtOpenSymbolicLinkObject", "193": "NtOpenThread", "194": "NtOpenTimer", "195": "NtPlugPlayControl", "196": "NtPrivilegeCheck", "197": "NtPrivilegeObjectAuditAlarm", "198": "NtPrivilegedServiceAuditAlarm", "199": "NtPulseEvent", "200": "NtQueryBootEntryOrder", "201": "NtQueryBootOptions", "202": "NtQueryDebugFilterState", "203": "NtQueryDirectoryObject", "204": "NtQueryDriverEntryOrder", "205": "NtQueryEaFile", "206": "NtQueryFullAttributesFile", "207": "NtQueryInformationAtom", "208": "NtQueryInformationJobObject", "209": "NtQueryInformationPort", "210": "NtQueryInstallUILanguage", "211": "NtQueryIntervalProfile", "212": "NtQueryIoCompletion", "213": "NtQueryMultipleValueKey", "214": "NtQueryMutant", "215": "NtQueryOpenSubKeys", "216": "NtQueryOpenSubKeysEx", "217": "NtQueryPortInformationProcess", "218": "NtQueryQuotaInformationFile", "219": "NtQuerySecurityObject", "220": "NtQuerySemaphore", "221": "NtQuerySymbolicLinkObject", "222": "NtQuerySystemEnvironmentValue", "223": "NtQuerySystemEnvironmentValueEx", "224": "NtQueryTimerResolution", "225": "NtRaiseException", "226": "NtRaiseHardError", "227": "NtRegisterThreadTerminatePort", "228": "NtReleaseKeyedEvent", "229": "NtRemoveProcessDebug", "230": "NtRenameKey", "231": "NtReplaceKey", "232": "NtReplyWaitReplyPort", "233": "NtRequestDeviceWakeup", "234": "NtRequestPort", "235": "NtRequestWakeupLatency", "236": "NtResetEvent", "237": "NtResetWriteWatch", "238": "NtRestoreKey", "239": "NtResumeProcess", "240": "NtSaveKey", "241": "NtSaveKeyEx", "242": "NtSaveMergedKeys", "243": "NtSecureConnectPort", "244": "NtSetBootEntryOrder", "245": "NtSetBootOptions", "246": "NtSetContextThread", "247": "NtSetDebugFilterState", "248": "NtSetDefaultHardErrorPort", "249": "NtSetDefaultLocale", "250": "NtSetDefaultUILanguage", "251": "NtSetDriverEntryOrder", "252": "NtSetEaFile", "253": "NtSetHighEventPair", "254": "NtSetHighWaitLowEventPair", "255": "NtSetInformationDebugObject", "256": "NtSetInformationJobObject", "257": "NtSetInformationKey", "258": "NtSetInformationToken", "259": "NtSetIntervalProfile", "260": "NtSetIoCompletion", "261": "NtSetLdtEntries", "262": "NtSetLowEventPair", "263": "NtSetLowWaitHighEventPair", "264": "NtSetQuotaInformationFile", "265": "NtSetSecurityObject", "266": "NtSetSystemEnvironmentValue", "267": "NtSetSystemEnvironmentValueEx", "268": "NtSetSystemInformation", "269": "NtSetSystemPowerState", "270": "NtSetSystemTime", "271": "NtSetThreadExecutionState", "272": "NtSetTimerResolution", "273": "NtSetUuidSeed", "274": "NtSetVolumeInformationFile", "275": "NtShutdownSystem", "276": "NtSignalAndWaitForSingleObject", "277": "NtStartProfile", "278": "NtStopProfile", "279": "NtSuspendProcess", "280": "NtSuspendThread", "281": "NtSystemDebugControl", "282": "NtTerminateJobObject", "283": "NtTestAlert", "284": "NtTranslateFilePath", "285": "NtUnloadDriver", "286": "NtUnloadKey", "287": "NtUnloadKey2", "288": "NtUnloadKeyEx", "289": "NtUnlockFile", "290": "NtUnlockVirtualMemory", "291": "NtVdmControl", "292": "NtWaitForDebugEvent", "293": "NtWaitForKeyedEvent", "294": "NtWaitHighEventPair", "295": "NtWaitLowEventPair"}}, "Windows Vista": {"SP0": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAcquireCMFViewOwnership", "103": "NtAddBootEntry", "104": "NtAddDriverEntry", "105": "NtAdjustGroupsToken", "106": "NtAlertResumeThread", "107": "NtAlertThread", "108": "NtAllocateLocallyUniqueId", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelDeviceWakeupRequest", "135": "NtCancelIoFileEx", "136": "NtCancelSynchronousIoFile", "137": "NtClearAllSavepointsTransaction", "138": "NtClearSavepointTransaction", "139": "NtCommitComplete", "140": "NtCommitEnlistment", "141": "NtCommitTransaction", "142": "NtCompactKeys", "143": "NtCompareTokens", "144": "NtCompleteConnectPort", "145": "NtCompressKey", "146": "NtConnectPort", "147": "NtCreateDebugObject", "148": "NtCreateDirectoryObject", "149": "NtCreateEnlistment", "150": "NtCreateEventPair", "151": "NtCreateIoCompletion", "152": "NtCreateJobObject", "153": "NtCreateJobSet", "154": "NtCreateKeyTransacted", "155": "NtCreateKeyedEvent", "156": "NtCreateMailslotFile", "157": "NtCreateMutant", "158": "NtCreateNamedPipeFile", "159": "NtCreatePagingFile", "160": "NtCreatePort", "161": "NtCreatePrivateNamespace", "162": "NtCreateProcess", "163": "NtCreateProfile", "164": "NtCreateResourceManager", "165": "NtCreateSemaphore", "166": "NtCreateSymbolicLinkObject", "167": "NtCreateThreadEx", "168": "NtCreateTimer", "169": "NtCreateToken", "170": "NtCreateTransaction", "171": "NtCreateTransactionManager", "172": "NtCreateUserProcess", "173": "NtCreateWaitablePort", "174": "NtCreateWorkerFactory", "175": "NtDebugActiveProcess", "176": "NtDebugContinue", "177": "NtDeleteAtom", "178": "NtDeleteBootEntry", "179": "NtDeleteDriverEntry", "180": "NtDeleteFile", "181": "NtDeleteKey", "182": "NtDeleteObjectAuditAlarm", "183": "NtDeletePrivateNamespace", "184": "NtDeleteValueKey", "185": "NtDisplayString", "186": "NtEnumerateBootEntries", "187": "NtEnumerateDriverEntries", "188": "NtEnumerateSystemEnvironmentValuesEx", "189": "NtEnumerateTransactionObject", "190": "NtExtendSection", "191": "NtFilterToken", "192": "NtFlushInstallUILanguage", "193": "NtFlushInstructionCache", "194": "NtFlushKey", "195": "NtFlushProcessWriteBuffers", "196": "NtFlushVirtualMemory", "197": "NtFlushWriteBuffer", "198": "NtFreeUserPhysicalPages", "199": "NtFreezeRegistry", "200": "NtFreezeTransactions", "201": "NtGetContextThread", "202": "NtGetCurrentProcessorNumber", "203": "NtGetDevicePowerState", "204": "NtGetMUIRegistryInfo", "205": "NtGetNextProcess", "206": "NtGetNextThread", "207": "NtGetNlsSectionPtr", "208": "NtGetNotificationResourceManager", "209": "NtGetPlugPlayEvent", "210": "NtGetWriteWatch", "211": "NtImpersonateAnonymousToken", "212": "NtImpersonateThread", "213": "NtInitializeNlsFiles", "214": "NtInitializeRegistry", "215": "NtInitiatePowerAction", "216": "NtIsSystemResumeAutomatic", "217": "NtIsUILanguageComitted", "218": "NtListTransactions", "219": "NtListenPort", "220": "NtLoadDriver", "221": "NtLoadKey", "222": "NtLoadKey2", "223": "NtLoadKeyEx", "224": "NtLockFile", "225": "NtLockProductActivationKeys", "226": "NtLockRegistryKey", "227": "NtLockVirtualMemory", "228": "NtMakePermanentObject", "229": "NtMakeTemporaryObject", "230": "NtMapCMFModule", "231": "NtMapUserPhysicalPages", "232": "NtMarshallTransaction", "233": "NtModifyBootEntry", "234": "NtModifyDriverEntry", "235": "NtNotifyChangeDirectoryFile", "236": "NtNotifyChangeKey", "237": "NtNotifyChangeMultipleKeys", "238": "NtOpenEnlistment", "239": "NtOpenEventPair", "240": "NtOpenIoCompletion", "241": "NtOpenJobObject", "242": "NtOpenKeyTransacted", "243": "NtOpenKeyedEvent", "244": "NtOpenMutant", "245": "NtOpenObjectAuditAlarm", "246": "NtOpenPrivateNamespace", "247": "NtOpenProcessToken", "248": "NtOpenResourceManager", "249": "NtOpenSemaphore", "250": "NtOpenSession", "251": "NtOpenSymbolicLinkObject", "252": "NtOpenThread", "253": "NtOpenTimer", "254": "NtOpenTransaction", "255": "NtOpenTransactionManager", "256": "NtPlugPlayControl", "257": "NtPrePrepareComplete", "258": "NtPrePrepareEnlistment", "259": "NtPrepareComplete", "260": "NtPrepareEnlistment", "261": "NtPrivilegeCheck", "262": "NtPrivilegeObjectAuditAlarm", "263": "NtPrivilegedServiceAuditAlarm", "264": "NtPropagationComplete", "265": "NtPropagationFailed", "266": "NtPullTransaction", "267": "NtPulseEvent", "268": "NtQueryBootEntryOrder", "269": "NtQueryBootOptions", "270": "NtQueryDebugFilterState", "271": "NtQueryDirectoryObject", "272": "NtQueryDriverEntryOrder", "273": "NtQueryEaFile", "274": "NtQueryFullAttributesFile", "275": "NtQueryInformationAtom", "276": "NtQueryInformationEnlistment", "277": "NtQueryInformationJobObject", "278": "NtQueryInformationPort", "279": "NtQueryInformationResourceManager", "280": "NtQueryInformationTransaction", "281": "NtQueryInformationTransactionManager", "282": "NtQueryInformationWorkerFactory", "283": "NtQueryInstallUILanguage", "284": "NtQueryIntervalProfile", "285": "NtQueryIoCompletion", "286": "NtQueryLicenseValue", "287": "NtQueryMultipleValueKey", "288": "NtQueryMutant", "289": "NtQueryOpenSubKeys", "290": "NtQueryOpenSubKeysEx", "291": "NtQueryPortInformationProcess", "292": "NtQueryQuotaInformationFile", "293": "NtQuerySecurityObject", "294": "NtQuerySemaphore", "295": "NtQuerySymbolicLinkObject", "296": "NtQuerySystemEnvironmentValue", "297": "NtQuerySystemEnvironmentValueEx", "298": "NtQueryTimerResolution", "299": "NtRaiseException", "300": "NtRaiseHardError", "301": "NtReadOnlyEnlistment", "302": "NtRecoverEnlistment", "303": "NtRecoverResourceManager", "304": "NtRecoverTransactionManager", "305": "NtRegisterProtocolAddressInformation", "306": "NtRegisterThreadTerminatePort", "307": "NtReleaseCMFViewOwnership", "308": "NtReleaseKeyedEvent", "309": "NtReleaseWorkerFactoryWorker", "310": "NtRemoveIoCompletionEx", "311": "NtRemoveProcessDebug", "312": "NtRenameKey", "313": "NtReplaceKey", "314": "NtReplyWaitReplyPort", "315": "NtRequestDeviceWakeup", "316": "NtRequestPort", "317": "NtRequestWakeupLatency", "318": "NtResetEvent", "319": "NtResetWriteWatch", "320": "NtRestoreKey", "321": "NtResumeProcess", "322": "NtRollbackComplete", "323": "NtRollbackEnlistment", "324": "NtRollbackSavepointTransaction", "325": "NtRollbackTransaction", "326": "NtRollforwardTransactionManager", "327": "NtSaveKey", "328": "NtSaveKeyEx", "329": "NtSaveMergedKeys", "330": "NtSavepointComplete", "331": "NtSavepointTransaction", "332": "NtSecureConnectPort", "333": "NtSetBootEntryOrder", "334": "NtSetBootOptions", "335": "NtSetContextThread", "336": "NtSetDebugFilterState", "337": "NtSetDefaultHardErrorPort", "338": "NtSetDefaultLocale", "339": "NtSetDefaultUILanguage", "340": "NtSetDriverEntryOrder", "341": "NtSetEaFile", "342": "NtSetHighEventPair", "343": "NtSetHighWaitLowEventPair", "344": "NtSetInformationDebugObject", "345": "NtSetInformationEnlistment", "346": "NtSetInformationJobObject", "347": "NtSetInformationKey", "348": "NtSetInformationResourceManager", "349": "NtSetInformationToken", "350": "NtSetInformationTransaction", "351": "NtSetInformationTransactionManager", "352": "NtSetInformationWorkerFactory", "353": "NtSetIntervalProfile", "354": "NtSetIoCompletion", "355": "NtSetLdtEntries", "356": "NtSetLowEventPair", "357": "NtSetLowWaitHighEventPair", "358": "NtSetQuotaInformationFile", "359": "NtSetSecurityObject", "360": "NtSetSystemEnvironmentValue", "361": "NtSetSystemEnvironmentValueEx", "362": "NtSetSystemInformation", "363": "NtSetSystemPowerState", "364": "NtSetSystemTime", "365": "NtSetThreadExecutionState", "366": "NtSetTimerResolution", "367": "NtSetUuidSeed", "368": "NtSetVolumeInformationFile", "369": "NtShutdownSystem", "370": "NtShutdownWorkerFactory", "371": "NtSignalAndWaitForSingleObject", "372": "NtSinglePhaseReject", "373": "NtStartProfile", "374": "NtStartTm", "375": "NtStopProfile", "376": "NtSuspendProcess", "377": "NtSuspendThread", "378": "NtSystemDebugControl", "379": "NtTerminateJobObject", "380": "NtTestAlert", "381": "NtThawRegistry", "382": "NtThawTransactions", "383": "NtTraceControl", "384": "NtTranslateFilePath", "385": "NtUnloadDriver", "386": "NtUnloadKey", "387": "NtUnloadKey2", "388": "NtUnloadKeyEx", "389": "NtUnlockFile", "390": "NtUnlockVirtualMemory", "391": "NtVdmControl", "392": "NtWaitForDebugEvent", "393": "NtWaitForKeyedEvent", "394": "NtWaitForWorkViaWorkerFactory", "395": "NtWaitHighEventPair", "396": "NtWaitLowEventPair", "397": "NtWorkerFactoryWorkerReady"}, "SP1": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAcquireCMFViewOwnership", "103": "NtAddBootEntry", "104": "NtAddDriverEntry", "105": "NtAdjustGroupsToken", "106": "NtAlertResumeThread", "107": "NtAlertThread", "108": "NtAllocateLocallyUniqueId", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelDeviceWakeupRequest", "135": "NtCancelIoFileEx", "136": "NtCancelSynchronousIoFile", "137": "NtCommitComplete", "138": "NtCommitEnlistment", "139": "NtCommitTransaction", "140": "NtCompactKeys", "141": "NtCompareTokens", "142": "NtCompleteConnectPort", "143": "NtCompressKey", "144": "NtConnectPort", "145": "NtCreateDebugObject", "146": "NtCreateDirectoryObject", "147": "NtCreateEnlistment", "148": "NtCreateEventPair", "149": "NtCreateIoCompletion", "150": "NtCreateJobObject", "151": "NtCreateJobSet", "152": "NtCreateKeyTransacted", "153": "NtCreateKeyedEvent", "154": "NtCreateMailslotFile", "155": "NtCreateMutant", "156": "NtCreateNamedPipeFile", "157": "NtCreatePagingFile", "158": "NtCreatePort", "159": "NtCreatePrivateNamespace", "160": "NtCreateProcess", "161": "NtCreateProfile", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisplayString", "184": "NtEnumerateBootEntries", "185": "NtEnumerateDriverEntries", "186": "NtEnumerateSystemEnvironmentValuesEx", "187": "NtEnumerateTransactionObject", "188": "NtExtendSection", "189": "NtFilterToken", "190": "NtFlushInstallUILanguage", "191": "NtFlushInstructionCache", "192": "NtFlushKey", "193": "NtFlushProcessWriteBuffers", "194": "NtFlushVirtualMemory", "195": "NtFlushWriteBuffer", "196": "NtFreeUserPhysicalPages", "197": "NtFreezeRegistry", "198": "NtFreezeTransactions", "199": "NtGetContextThread", "200": "NtGetCurrentProcessorNumber", "201": "NtGetDevicePowerState", "202": "NtGetMUIRegistryInfo", "203": "NtGetNextProcess", "204": "NtGetNextThread", "205": "NtGetNlsSectionPtr", "206": "NtGetNotificationResourceManager", "207": "NtGetPlugPlayEvent", "208": "NtGetWriteWatch", "209": "NtImpersonateAnonymousToken", "210": "NtImpersonateThread", "211": "NtInitializeNlsFiles", "212": "NtInitializeRegistry", "213": "NtInitiatePowerAction", "214": "NtIsSystemResumeAutomatic", "215": "NtIsUILanguageComitted", "216": "NtListenPort", "217": "NtLoadDriver", "218": "NtLoadKey", "219": "NtLoadKey2", "220": "NtLoadKeyEx", "221": "NtLockFile", "222": "NtLockProductActivationKeys", "223": "NtLockRegistryKey", "224": "NtLockVirtualMemory", "225": "NtMakePermanentObject", "226": "NtMakeTemporaryObject", "227": "NtMapCMFModule", "228": "NtMapUserPhysicalPages", "229": "NtModifyBootEntry", "230": "NtModifyDriverEntry", "231": "NtNotifyChangeDirectoryFile", "232": "NtNotifyChangeKey", "233": "NtNotifyChangeMultipleKeys", "234": "NtOpenEnlistment", "235": "NtOpenEventPair", "236": "NtOpenIoCompletion", "237": "NtOpenJobObject", "238": "NtOpenKeyTransacted", "239": "NtOpenKeyedEvent", "240": "NtOpenMutant", "241": "NtOpenObjectAuditAlarm", "242": "NtOpenPrivateNamespace", "243": "NtOpenProcessToken", "244": "NtOpenResourceManager", "245": "NtOpenSemaphore", "246": "NtOpenSession", "247": "NtOpenSymbolicLinkObject", "248": "NtOpenThread", "249": "NtOpenTimer", "250": "NtOpenTransaction", "251": "NtOpenTransactionManager", "252": "NtPlugPlayControl", "253": "NtPrePrepareComplete", "254": "NtPrePrepareEnlistment", "255": "NtPrepareComplete", "256": "NtPrepareEnlistment", "257": "NtPrivilegeCheck", "258": "NtPrivilegeObjectAuditAlarm", "259": "NtPrivilegedServiceAuditAlarm", "260": "NtPropagationComplete", "261": "NtPropagationFailed", "262": "NtPulseEvent", "263": "NtQueryBootEntryOrder", "264": "NtQueryBootOptions", "265": "NtQueryDebugFilterState", "266": "NtQueryDirectoryObject", "267": "NtQueryDriverEntryOrder", "268": "NtQueryEaFile", "269": "NtQueryFullAttributesFile", "270": "NtQueryInformationAtom", "271": "NtQueryInformationEnlistment", "272": "NtQueryInformationJobObject", "273": "NtQueryInformationPort", "274": "NtQueryInformationResourceManager", "275": "NtQueryInformationTransaction", "276": "NtQueryInformationTransactionManager", "277": "NtQueryInformationWorkerFactory", "278": "NtQueryInstallUILanguage", "279": "NtQueryIntervalProfile", "280": "NtQueryIoCompletion", "281": "NtQueryLicenseValue", "282": "NtQueryMultipleValueKey", "283": "NtQueryMutant", "284": "NtQueryOpenSubKeys", "285": "NtQueryOpenSubKeysEx", "286": "NtQueryPortInformationProcess", "287": "NtQueryQuotaInformationFile", "288": "NtQuerySecurityObject", "289": "NtQuerySemaphore", "290": "NtQuerySymbolicLinkObject", "291": "NtQuerySystemEnvironmentValue", "292": "NtQuerySystemEnvironmentValueEx", "293": "NtQueryTimerResolution", "294": "NtRaiseException", "295": "NtRaiseHardError", "296": "NtReadOnlyEnlistment", "297": "NtRecoverEnlistment", "298": "NtRecoverResourceManager", "299": "NtRecoverTransactionManager", "300": "NtRegisterProtocolAddressInformation", "301": "NtRegisterThreadTerminatePort", "302": "NtReleaseCMFViewOwnership", "303": "NtReleaseKeyedEvent", "304": "NtReleaseWorkerFactoryWorker", "305": "NtRemoveIoCompletionEx", "306": "NtRemoveProcessDebug", "307": "NtRenameKey", "308": "NtRenameTransactionManager", "309": "NtReplaceKey", "310": "NtReplacePartitionUnit", "311": "NtReplyWaitReplyPort", "312": "NtRequestDeviceWakeup", "313": "NtRequestPort", "314": "NtRequestWakeupLatency", "315": "NtResetEvent", "316": "NtResetWriteWatch", "317": "NtRestoreKey", "318": "NtResumeProcess", "319": "NtRollbackComplete", "320": "NtRollbackEnlistment", "321": "NtRollbackTransaction", "322": "NtRollforwardTransactionManager", "323": "NtSaveKey", "324": "NtSaveKeyEx", "325": "NtSaveMergedKeys", "326": "NtSecureConnectPort", "327": "NtSetBootEntryOrder", "328": "NtSetBootOptions", "329": "NtSetContextThread", "330": "NtSetDebugFilterState", "331": "NtSetDefaultHardErrorPort", "332": "NtSetDefaultLocale", "333": "NtSetDefaultUILanguage", "334": "NtSetDriverEntryOrder", "335": "NtSetEaFile", "336": "NtSetHighEventPair", "337": "NtSetHighWaitLowEventPair", "338": "NtSetInformationDebugObject", "339": "NtSetInformationEnlistment", "340": "NtSetInformationJobObject", "341": "NtSetInformationKey", "342": "NtSetInformationResourceManager", "343": "NtSetInformationToken", "344": "NtSetInformationTransaction", "345": "NtSetInformationTransactionManager", "346": "NtSetInformationWorkerFactory", "347": "NtSetIntervalProfile", "348": "NtSetIoCompletion", "349": "NtSetLdtEntries", "350": "NtSetLowEventPair", "351": "NtSetLowWaitHighEventPair", "352": "NtSetQuotaInformationFile", "353": "NtSetSecurityObject", "354": "NtSetSystemEnvironmentValue", "355": "NtSetSystemEnvironmentValueEx", "356": "NtSetSystemInformation", "357": "NtSetSystemPowerState", "358": "NtSetSystemTime", "359": "NtSetThreadExecutionState", "360": "NtSetTimerResolution", "361": "NtSetUuidSeed", "362": "NtSetVolumeInformationFile", "363": "NtShutdownSystem", "364": "NtShutdownWorkerFactory", "365": "NtSignalAndWaitForSingleObject", "366": "NtSinglePhaseReject", "367": "NtStartProfile", "368": "NtStopProfile", "369": "NtSuspendProcess", "370": "NtSuspendThread", "371": "NtSystemDebugControl", "372": "NtTerminateJobObject", "373": "NtTestAlert", "374": "NtThawRegistry", "375": "NtThawTransactions", "376": "NtTraceControl", "377": "NtTranslateFilePath", "378": "NtUnloadDriver", "379": "NtUnloadKey", "380": "NtUnloadKey2", "381": "NtUnloadKeyEx", "382": "NtUnlockFile", "383": "NtUnlockVirtualMemory", "384": "NtVdmControl", "385": "NtWaitForDebugEvent", "386": "NtWaitForKeyedEvent", "387": "NtWaitForWorkViaWorkerFactory", "388": "NtWaitHighEventPair", "389": "NtWaitLowEventPair", "390": "NtWorkerFactoryWorkerReady"}, "SP2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAcquireCMFViewOwnership", "103": "NtAddBootEntry", "104": "NtAddDriverEntry", "105": "NtAdjustGroupsToken", "106": "NtAlertResumeThread", "107": "NtAlertThread", "108": "NtAllocateLocallyUniqueId", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelDeviceWakeupRequest", "135": "NtCancelIoFileEx", "136": "NtCancelSynchronousIoFile", "137": "NtCommitComplete", "138": "NtCommitEnlistment", "139": "NtCommitTransaction", "140": "NtCompactKeys", "141": "NtCompareTokens", "142": "NtCompleteConnectPort", "143": "NtCompressKey", "144": "NtConnectPort", "145": "NtCreateDebugObject", "146": "NtCreateDirectoryObject", "147": "NtCreateEnlistment", "148": "NtCreateEventPair", "149": "NtCreateIoCompletion", "150": "NtCreateJobObject", "151": "NtCreateJobSet", "152": "NtCreateKeyTransacted", "153": "NtCreateKeyedEvent", "154": "NtCreateMailslotFile", "155": "NtCreateMutant", "156": "NtCreateNamedPipeFile", "157": "NtCreatePagingFile", "158": "NtCreatePort", "159": "NtCreatePrivateNamespace", "160": "NtCreateProcess", "161": "NtCreateProfile", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisplayString", "184": "NtEnumerateBootEntries", "185": "NtEnumerateDriverEntries", "186": "NtEnumerateSystemEnvironmentValuesEx", "187": "NtEnumerateTransactionObject", "188": "NtExtendSection", "189": "NtFilterToken", "190": "NtFlushInstallUILanguage", "191": "NtFlushInstructionCache", "192": "NtFlushKey", "193": "NtFlushProcessWriteBuffers", "194": "NtFlushVirtualMemory", "195": "NtFlushWriteBuffer", "196": "NtFreeUserPhysicalPages", "197": "NtFreezeRegistry", "198": "NtFreezeTransactions", "199": "NtGetContextThread", "200": "NtGetCurrentProcessorNumber", "201": "NtGetDevicePowerState", "202": "NtGetMUIRegistryInfo", "203": "NtGetNextProcess", "204": "NtGetNextThread", "205": "NtGetNlsSectionPtr", "206": "NtGetNotificationResourceManager", "207": "NtGetPlugPlayEvent", "208": "NtGetWriteWatch", "209": "NtImpersonateAnonymousToken", "210": "NtImpersonateThread", "211": "NtInitializeNlsFiles", "212": "NtInitializeRegistry", "213": "NtInitiatePowerAction", "214": "NtIsSystemResumeAutomatic", "215": "NtIsUILanguageComitted", "216": "NtListenPort", "217": "NtLoadDriver", "218": "NtLoadKey", "219": "NtLoadKey2", "220": "NtLoadKeyEx", "221": "NtLockFile", "222": "NtLockProductActivationKeys", "223": "NtLockRegistryKey", "224": "NtLockVirtualMemory", "225": "NtMakePermanentObject", "226": "NtMakeTemporaryObject", "227": "NtMapCMFModule", "228": "NtMapUserPhysicalPages", "229": "NtModifyBootEntry", "230": "NtModifyDriverEntry", "231": "NtNotifyChangeDirectoryFile", "232": "NtNotifyChangeKey", "233": "NtNotifyChangeMultipleKeys", "234": "NtOpenEnlistment", "235": "NtOpenEventPair", "236": "NtOpenIoCompletion", "237": "NtOpenJobObject", "238": "NtOpenKeyTransacted", "239": "NtOpenKeyedEvent", "240": "NtOpenMutant", "241": "NtOpenObjectAuditAlarm", "242": "NtOpenPrivateNamespace", "243": "NtOpenProcessToken", "244": "NtOpenResourceManager", "245": "NtOpenSemaphore", "246": "NtOpenSession", "247": "NtOpenSymbolicLinkObject", "248": "NtOpenThread", "249": "NtOpenTimer", "250": "NtOpenTransaction", "251": "NtOpenTransactionManager", "252": "NtPlugPlayControl", "253": "NtPrePrepareComplete", "254": "NtPrePrepareEnlistment", "255": "NtPrepareComplete", "256": "NtPrepareEnlistment", "257": "NtPrivilegeCheck", "258": "NtPrivilegeObjectAuditAlarm", "259": "NtPrivilegedServiceAuditAlarm", "260": "NtPropagationComplete", "261": "NtPropagationFailed", "262": "NtPulseEvent", "263": "NtQueryBootEntryOrder", "264": "NtQueryBootOptions", "265": "NtQueryDebugFilterState", "266": "NtQueryDirectoryObject", "267": "NtQueryDriverEntryOrder", "268": "NtQueryEaFile", "269": "NtQueryFullAttributesFile", "270": "NtQueryInformationAtom", "271": "NtQueryInformationEnlistment", "272": "NtQueryInformationJobObject", "273": "NtQueryInformationPort", "274": "NtQueryInformationResourceManager", "275": "NtQueryInformationTransaction", "276": "NtQueryInformationTransactionManager", "277": "NtQueryInformationWorkerFactory", "278": "NtQueryInstallUILanguage", "279": "NtQueryIntervalProfile", "280": "NtQueryIoCompletion", "281": "NtQueryLicenseValue", "282": "NtQueryMultipleValueKey", "283": "NtQueryMutant", "284": "NtQueryOpenSubKeys", "285": "NtQueryOpenSubKeysEx", "286": "NtQueryPortInformationProcess", "287": "NtQueryQuotaInformationFile", "288": "NtQuerySecurityObject", "289": "NtQuerySemaphore", "290": "NtQuerySymbolicLinkObject", "291": "NtQuerySystemEnvironmentValue", "292": "NtQuerySystemEnvironmentValueEx", "293": "NtQueryTimerResolution", "294": "NtRaiseException", "295": "NtRaiseHardError", "296": "NtReadOnlyEnlistment", "297": "NtRecoverEnlistment", "298": "NtRecoverResourceManager", "299": "NtRecoverTransactionManager", "300": "NtRegisterProtocolAddressInformation", "301": "NtRegisterThreadTerminatePort", "302": "NtReleaseCMFViewOwnership", "303": "NtReleaseKeyedEvent", "304": "NtReleaseWorkerFactoryWorker", "305": "NtRemoveIoCompletionEx", "306": "NtRemoveProcessDebug", "307": "NtRenameKey", "308": "NtRenameTransactionManager", "309": "NtReplaceKey", "310": "NtReplacePartitionUnit", "311": "NtReplyWaitReplyPort", "312": "NtRequestDeviceWakeup", "313": "NtRequestPort", "314": "NtRequestWakeupLatency", "315": "NtResetEvent", "316": "NtResetWriteWatch", "317": "NtRestoreKey", "318": "NtResumeProcess", "319": "NtRollbackComplete", "320": "NtRollbackEnlistment", "321": "NtRollbackTransaction", "322": "NtRollforwardTransactionManager", "323": "NtSaveKey", "324": "NtSaveKeyEx", "325": "NtSaveMergedKeys", "326": "NtSecureConnectPort", "327": "NtSetBootEntryOrder", "328": "NtSetBootOptions", "329": "NtSetContextThread", "330": "NtSetDebugFilterState", "331": "NtSetDefaultHardErrorPort", "332": "NtSetDefaultLocale", "333": "NtSetDefaultUILanguage", "334": "NtSetDriverEntryOrder", "335": "NtSetEaFile", "336": "NtSetHighEventPair", "337": "NtSetHighWaitLowEventPair", "338": "NtSetInformationDebugObject", "339": "NtSetInformationEnlistment", "340": "NtSetInformationJobObject", "341": "NtSetInformationKey", "342": "NtSetInformationResourceManager", "343": "NtSetInformationToken", "344": "NtSetInformationTransaction", "345": "NtSetInformationTransactionManager", "346": "NtSetInformationWorkerFactory", "347": "NtSetIntervalProfile", "348": "NtSetIoCompletion", "349": "NtSetLdtEntries", "350": "NtSetLowEventPair", "351": "NtSetLowWaitHighEventPair", "352": "NtSetQuotaInformationFile", "353": "NtSetSecurityObject", "354": "NtSetSystemEnvironmentValue", "355": "NtSetSystemEnvironmentValueEx", "356": "NtSetSystemInformation", "357": "NtSetSystemPowerState", "358": "NtSetSystemTime", "359": "NtSetThreadExecutionState", "360": "NtSetTimerResolution", "361": "NtSetUuidSeed", "362": "NtSetVolumeInformationFile", "363": "NtShutdownSystem", "364": "NtShutdownWorkerFactory", "365": "NtSignalAndWaitForSingleObject", "366": "NtSinglePhaseReject", "367": "NtStartProfile", "368": "NtStopProfile", "369": "NtSuspendProcess", "370": "NtSuspendThread", "371": "NtSystemDebugControl", "372": "NtTerminateJobObject", "373": "NtTestAlert", "374": "NtThawRegistry", "375": "NtThawTransactions", "376": "NtTraceControl", "377": "NtTranslateFilePath", "378": "NtUnloadDriver", "379": "NtUnloadKey", "380": "NtUnloadKey2", "381": "NtUnloadKeyEx", "382": "NtUnlockFile", "383": "NtUnlockVirtualMemory", "384": "NtVdmControl", "385": "NtWaitForDebugEvent", "386": "NtWaitForKeyedEvent", "387": "NtWaitForWorkViaWorkerFactory", "388": "NtWaitHighEventPair", "389": "NtWaitLowEventPair", "390": "NtWorkerFactoryWorkerReady"}}, "Windows Server 2008": {"SP0": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAcquireCMFViewOwnership", "103": "NtAddBootEntry", "104": "NtAddDriverEntry", "105": "NtAdjustGroupsToken", "106": "NtAlertResumeThread", "107": "NtAlertThread", "108": "NtAllocateLocallyUniqueId", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtRequestDeviceWakeup", "135": "NtCancelIoFileEx", "136": "NtCancelSynchronousIoFile", "137": "NtCommitComplete", "138": "NtCommitEnlistment", "139": "NtCommitTransaction", "140": "NtCompactKeys", "141": "NtCompareTokens", "142": "NtCompleteConnectPort", "143": "NtCompressKey", "144": "NtConnectPort", "145": "NtCreateDebugObject", "146": "NtCreateDirectoryObject", "147": "NtCreateEnlistment", "148": "NtCreateEventPair", "149": "NtCreateIoCompletion", "150": "NtCreateJobObject", "151": "NtCreateJobSet", "152": "NtCreateKeyTransacted", "153": "NtCreateKeyedEvent", "154": "NtCreateMailslotFile", "155": "NtCreateMutant", "156": "NtCreateNamedPipeFile", "157": "NtCreatePagingFile", "158": "NtCreatePort", "159": "NtCreatePrivateNamespace", "160": "NtCreateProcess", "161": "NtCreateProfile", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisplayString", "184": "NtEnumerateBootEntries", "185": "NtEnumerateDriverEntries", "186": "NtEnumerateSystemEnvironmentValuesEx", "187": "NtEnumerateTransactionObject", "188": "NtExtendSection", "189": "NtFilterToken", "190": "NtFlushInstallUILanguage", "191": "NtFlushInstructionCache", "192": "NtFlushKey", "193": "NtFlushProcessWriteBuffers", "194": "NtFlushVirtualMemory", "195": "NtFlushWriteBuffer", "196": "NtFreeUserPhysicalPages", "197": "NtFreezeRegistry", "198": "NtFreezeTransactions", "199": "NtGetContextThread", "200": "NtGetCurrentProcessorNumber", "201": "NtGetDevicePowerState", "202": "NtGetMUIRegistryInfo", "203": "NtGetNextProcess", "204": "NtGetNextThread", "205": "NtGetNlsSectionPtr", "206": "NtGetNotificationResourceManager", "207": "NtGetPlugPlayEvent", "208": "NtGetWriteWatch", "209": "NtImpersonateAnonymousToken", "210": "NtImpersonateThread", "211": "NtInitializeNlsFiles", "212": "NtInitializeRegistry", "213": "NtInitiatePowerAction", "214": "NtIsSystemResumeAutomatic", "215": "NtIsUILanguageComitted", "216": "NtListenPort", "217": "NtLoadDriver", "218": "NtLoadKey", "219": "NtLoadKey2", "220": "NtLoadKeyEx", "221": "NtLockFile", "222": "NtLockProductActivationKeys", "223": "NtLockRegistryKey", "224": "NtLockVirtualMemory", "225": "NtMakePermanentObject", "226": "NtMakeTemporaryObject", "227": "NtMapCMFModule", "228": "NtMapUserPhysicalPages", "229": "NtModifyBootEntry", "230": "NtModifyDriverEntry", "231": "NtNotifyChangeDirectoryFile", "232": "NtNotifyChangeKey", "233": "NtNotifyChangeMultipleKeys", "234": "NtOpenEnlistment", "235": "NtOpenEventPair", "236": "NtOpenIoCompletion", "237": "NtOpenJobObject", "238": "NtOpenKeyTransacted", "239": "NtOpenKeyedEvent", "240": "NtOpenMutant", "241": "NtOpenObjectAuditAlarm", "242": "NtOpenPrivateNamespace", "243": "NtOpenProcessToken", "244": "NtOpenResourceManager", "245": "NtOpenSemaphore", "246": "NtOpenSession", "247": "NtOpenSymbolicLinkObject", "248": "NtOpenThread", "249": "NtOpenTimer", "250": "NtOpenTransaction", "251": "NtOpenTransactionManager", "252": "NtPlugPlayControl", "253": "NtPrePrepareComplete", "254": "NtPrePrepareEnlistment", "255": "NtPrepareComplete", "256": "NtPrepareEnlistment", "257": "NtPrivilegeCheck", "258": "NtPrivilegeObjectAuditAlarm", "259": "NtPrivilegedServiceAuditAlarm", "260": "NtPropagationComplete", "261": "NtPropagationFailed", "262": "NtPulseEvent", "263": "NtQueryBootEntryOrder", "264": "NtQueryBootOptions", "265": "NtQueryDebugFilterState", "266": "NtQueryDirectoryObject", "267": "NtQueryDriverEntryOrder", "268": "NtQueryEaFile", "269": "NtQueryFullAttributesFile", "270": "NtQueryInformationAtom", "271": "NtQueryInformationEnlistment", "272": "NtQueryInformationJobObject", "273": "NtQueryInformationPort", "274": "NtQueryInformationResourceManager", "275": "NtQueryInformationTransaction", "276": "NtQueryInformationTransactionManager", "277": "NtQueryInformationWorkerFactory", "278": "NtQueryInstallUILanguage", "279": "NtQueryIntervalProfile", "280": "NtQueryIoCompletion", "281": "NtQueryLicenseValue", "282": "NtQueryMultipleValueKey", "283": "NtQueryMutant", "284": "NtQueryOpenSubKeys", "285": "NtQueryOpenSubKeysEx", "286": "NtQueryPortInformationProcess", "287": "NtQueryQuotaInformationFile", "288": "NtQuerySecurityObject", "289": "NtQuerySemaphore", "290": "NtQuerySymbolicLinkObject", "291": "NtQuerySystemEnvironmentValue", "292": "NtQuerySystemEnvironmentValueEx", "293": "NtQueryTimerResolution", "294": "NtRaiseException", "295": "NtRaiseHardError", "296": "NtReadOnlyEnlistment", "297": "NtRecoverEnlistment", "298": "NtRecoverResourceManager", "299": "NtRecoverTransactionManager", "300": "NtRegisterProtocolAddressInformation", "301": "NtRegisterThreadTerminatePort", "302": "NtReleaseCMFViewOwnership", "303": "NtReleaseKeyedEvent", "304": "NtReleaseWorkerFactoryWorker", "305": "NtRemoveIoCompletionEx", "306": "NtRemoveProcessDebug", "307": "NtRenameKey", "308": "NtRenameTransactionManager", "309": "NtReplaceKey", "310": "NtReplacePartitionUnit", "311": "NtReplyWaitReplyPort", "312": "NtCancelDeviceWakeupRequest", "313": "NtRequestPort", "314": "NtRequestWakeupLatency", "315": "NtResetEvent", "316": "NtResetWriteWatch", "317": "NtRestoreKey", "318": "NtResumeProcess", "319": "NtRollbackComplete", "320": "NtRollbackEnlistment", "321": "NtRollbackTransaction", "322": "NtRollforwardTransactionManager", "323": "NtSaveKey", "324": "NtSaveKeyEx", "325": "NtSaveMergedKeys", "326": "NtSecureConnectPort", "327": "NtSetBootEntryOrder", "328": "NtSetBootOptions", "329": "NtSetContextThread", "330": "NtSetDebugFilterState", "331": "NtSetDefaultHardErrorPort", "332": "NtSetDefaultLocale", "333": "NtSetDefaultUILanguage", "334": "NtSetDriverEntryOrder", "335": "NtSetEaFile", "336": "NtSetHighEventPair", "337": "NtSetHighWaitLowEventPair", "338": "NtSetInformationDebugObject", "339": "NtSetInformationEnlistment", "340": "NtSetInformationJobObject", "341": "NtSetInformationKey", "342": "NtSetInformationResourceManager", "343": "NtSetInformationToken", "344": "NtSetInformationTransaction", "345": "NtSetInformationTransactionManager", "346": "NtSetInformationWorkerFactory", "347": "NtSetIntervalProfile", "348": "NtSetIoCompletion", "349": "NtSetLdtEntries", "350": "NtSetLowEventPair", "351": "NtSetLowWaitHighEventPair", "352": "NtSetQuotaInformationFile", "353": "NtSetSecurityObject", "354": "NtSetSystemEnvironmentValue", "355": "NtSetSystemEnvironmentValueEx", "356": "NtSetSystemInformation", "357": "NtSetSystemPowerState", "358": "NtSetSystemTime", "359": "NtSetThreadExecutionState", "360": "NtSetTimerResolution", "361": "NtSetUuidSeed", "362": "NtSetVolumeInformationFile", "363": "NtShutdownSystem", "364": "NtShutdownWorkerFactory", "365": "NtSignalAndWaitForSingleObject", "366": "NtSinglePhaseReject", "367": "NtStartProfile", "368": "NtStopProfile", "369": "NtSuspendProcess", "370": "NtSuspendThread", "371": "NtSystemDebugControl", "372": "NtTerminateJobObject", "373": "NtTestAlert", "374": "NtThawRegistry", "375": "NtThawTransactions", "376": "NtTraceControl", "377": "NtTranslateFilePath", "378": "NtUnloadDriver", "379": "NtUnloadKey", "380": "NtUnloadKey2", "381": "NtUnloadKeyEx", "382": "NtUnlockFile", "383": "NtUnlockVirtualMemory", "384": "NtVdmControl", "385": "NtWaitForDebugEvent", "386": "NtWaitForKeyedEvent", "387": "NtWaitForWorkViaWorkerFactory", "388": "NtWaitHighEventPair", "389": "NtWaitLowEventPair", "390": "NtWorkerFactoryWorkerReady"}, "SP2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAcquireCMFViewOwnership", "103": "NtAddBootEntry", "104": "NtAddDriverEntry", "105": "NtAdjustGroupsToken", "106": "NtAlertResumeThread", "107": "NtAlertThread", "108": "NtAllocateLocallyUniqueId", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelDeviceWakeupRequest", "135": "NtCancelIoFileEx", "136": "NtCancelSynchronousIoFile", "137": "NtCommitComplete", "138": "NtCommitEnlistment", "139": "NtCommitTransaction", "140": "NtCompactKeys", "141": "NtCompareTokens", "142": "NtCompleteConnectPort", "143": "NtCompressKey", "144": "NtConnectPort", "145": "NtCreateDebugObject", "146": "NtCreateDirectoryObject", "147": "NtCreateEnlistment", "148": "NtCreateEventPair", "149": "NtCreateIoCompletion", "150": "NtCreateJobObject", "151": "NtCreateJobSet", "152": "NtCreateKeyTransacted", "153": "NtCreateKeyedEvent", "154": "NtCreateMailslotFile", "155": "NtCreateMutant", "156": "NtCreateNamedPipeFile", "157": "NtCreatePagingFile", "158": "NtCreatePort", "159": "NtCreatePrivateNamespace", "160": "NtCreateProcess", "161": "NtCreateProfile", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisplayString", "184": "NtEnumerateBootEntries", "185": "NtEnumerateDriverEntries", "186": "NtEnumerateSystemEnvironmentValuesEx", "187": "NtEnumerateTransactionObject", "188": "NtExtendSection", "189": "NtFilterToken", "190": "NtFlushInstallUILanguage", "191": "NtFlushInstructionCache", "192": "NtFlushKey", "193": "NtFlushProcessWriteBuffers", "194": "NtFlushVirtualMemory", "195": "NtFlushWriteBuffer", "196": "NtFreeUserPhysicalPages", "197": "NtFreezeRegistry", "198": "NtFreezeTransactions", "199": "NtGetContextThread", "200": "NtGetCurrentProcessorNumber", "201": "NtGetDevicePowerState", "202": "NtGetMUIRegistryInfo", "203": "NtGetNextProcess", "204": "NtGetNextThread", "205": "NtGetNlsSectionPtr", "206": "NtGetNotificationResourceManager", "207": "NtGetPlugPlayEvent", "208": "NtGetWriteWatch", "209": "NtImpersonateAnonymousToken", "210": "NtImpersonateThread", "211": "NtInitializeNlsFiles", "212": "NtInitializeRegistry", "213": "NtInitiatePowerAction", "214": "NtIsSystemResumeAutomatic", "215": "NtIsUILanguageComitted", "216": "NtListenPort", "217": "NtLoadDriver", "218": "NtLoadKey", "219": "NtLoadKey2", "220": "NtLoadKeyEx", "221": "NtLockFile", "222": "NtLockProductActivationKeys", "223": "NtLockRegistryKey", "224": "NtLockVirtualMemory", "225": "NtMakePermanentObject", "226": "NtMakeTemporaryObject", "227": "NtMapCMFModule", "228": "NtMapUserPhysicalPages", "229": "NtModifyBootEntry", "230": "NtModifyDriverEntry", "231": "NtNotifyChangeDirectoryFile", "232": "NtNotifyChangeKey", "233": "NtNotifyChangeMultipleKeys", "234": "NtOpenEnlistment", "235": "NtOpenEventPair", "236": "NtOpenIoCompletion", "237": "NtOpenJobObject", "238": "NtOpenKeyTransacted", "239": "NtOpenKeyedEvent", "240": "NtOpenMutant", "241": "NtOpenObjectAuditAlarm", "242": "NtOpenPrivateNamespace", "243": "NtOpenProcessToken", "244": "NtOpenResourceManager", "245": "NtOpenSemaphore", "246": "NtOpenSession", "247": "NtOpenSymbolicLinkObject", "248": "NtOpenThread", "249": "NtOpenTimer", "250": "NtOpenTransaction", "251": "NtOpenTransactionManager", "252": "NtPlugPlayControl", "253": "NtPrePrepareComplete", "254": "NtPrePrepareEnlistment", "255": "NtPrepareComplete", "256": "NtPrepareEnlistment", "257": "NtPrivilegeCheck", "258": "NtPrivilegeObjectAuditAlarm", "259": "NtPrivilegedServiceAuditAlarm", "260": "NtPropagationComplete", "261": "NtPropagationFailed", "262": "NtPulseEvent", "263": "NtQueryBootEntryOrder", "264": "NtQueryBootOptions", "265": "NtQueryDebugFilterState", "266": "NtQueryDirectoryObject", "267": "NtQueryDriverEntryOrder", "268": "NtQueryEaFile", "269": "NtQueryFullAttributesFile", "270": "NtQueryInformationAtom", "271": "NtQueryInformationEnlistment", "272": "NtQueryInformationJobObject", "273": "NtQueryInformationPort", "274": "NtQueryInformationResourceManager", "275": "NtQueryInformationTransaction", "276": "NtQueryInformationTransactionManager", "277": "NtQueryInformationWorkerFactory", "278": "NtQueryInstallUILanguage", "279": "NtQueryIntervalProfile", "280": "NtQueryIoCompletion", "281": "NtQueryLicenseValue", "282": "NtQueryMultipleValueKey", "283": "NtQueryMutant", "284": "NtQueryOpenSubKeys", "285": "NtQueryOpenSubKeysEx", "286": "NtQueryPortInformationProcess", "287": "NtQueryQuotaInformationFile", "288": "NtQuerySecurityObject", "289": "NtQuerySemaphore", "290": "NtQuerySymbolicLinkObject", "291": "NtQuerySystemEnvironmentValue", "292": "NtQuerySystemEnvironmentValueEx", "293": "NtQueryTimerResolution", "294": "NtRaiseException", "295": "NtRaiseHardError", "296": "NtReadOnlyEnlistment", "297": "NtRecoverEnlistment", "298": "NtRecoverResourceManager", "299": "NtRecoverTransactionManager", "300": "NtRegisterProtocolAddressInformation", "301": "NtRegisterThreadTerminatePort", "302": "NtReleaseCMFViewOwnership", "303": "NtReleaseKeyedEvent", "304": "NtReleaseWorkerFactoryWorker", "305": "NtRemoveIoCompletionEx", "306": "NtRemoveProcessDebug", "307": "NtRenameKey", "308": "NtRenameTransactionManager", "309": "NtReplaceKey", "310": "NtReplacePartitionUnit", "311": "NtReplyWaitReplyPort", "312": "NtRequestDeviceWakeup", "313": "NtRequestPort", "314": "NtRequestWakeupLatency", "315": "NtResetEvent", "316": "NtResetWriteWatch", "317": "NtRestoreKey", "318": "NtResumeProcess", "319": "NtRollbackComplete", "320": "NtRollbackEnlistment", "321": "NtRollbackTransaction", "322": "NtRollforwardTransactionManager", "323": "NtSaveKey", "324": "NtSaveKeyEx", "325": "NtSaveMergedKeys", "326": "NtSecureConnectPort", "327": "NtSetBootEntryOrder", "328": "NtSetBootOptions", "329": "NtSetContextThread", "330": "NtSetDebugFilterState", "331": "NtSetDefaultHardErrorPort", "332": "NtSetDefaultLocale", "333": "NtSetDefaultUILanguage", "334": "NtSetDriverEntryOrder", "335": "NtSetEaFile", "336": "NtSetHighEventPair", "337": "NtSetHighWaitLowEventPair", "338": "NtSetInformationDebugObject", "339": "NtSetInformationEnlistment", "340": "NtSetInformationJobObject", "341": "NtSetInformationKey", "342": "NtSetInformationResourceManager", "343": "NtSetInformationToken", "344": "NtSetInformationTransaction", "345": "NtSetInformationTransactionManager", "346": "NtSetInformationWorkerFactory", "347": "NtSetIntervalProfile", "348": "NtSetIoCompletion", "349": "NtSetLdtEntries", "350": "NtSetLowEventPair", "351": "NtSetLowWaitHighEventPair", "352": "NtSetQuotaInformationFile", "353": "NtSetSecurityObject", "354": "NtSetSystemEnvironmentValue", "355": "NtSetSystemEnvironmentValueEx", "356": "NtSetSystemInformation", "357": "NtSetSystemPowerState", "358": "NtSetSystemTime", "359": "NtSetThreadExecutionState", "360": "NtSetTimerResolution", "361": "NtSetUuidSeed", "362": "NtSetVolumeInformationFile", "363": "NtShutdownSystem", "364": "NtShutdownWorkerFactory", "365": "NtSignalAndWaitForSingleObject", "366": "NtSinglePhaseReject", "367": "NtStartProfile", "368": "NtStopProfile", "369": "NtSuspendProcess", "370": "NtSuspendThread", "371": "NtSystemDebugControl", "372": "NtTerminateJobObject", "373": "NtTestAlert", "374": "NtThawRegistry", "375": "NtThawTransactions", "376": "NtTraceControl", "377": "NtTranslateFilePath", "378": "NtUnloadDriver", "379": "NtUnloadKey", "380": "NtUnloadKey2", "381": "NtUnloadKeyEx", "382": "NtUnlockFile", "383": "NtUnlockVirtualMemory", "384": "NtVdmControl", "385": "NtWaitForDebugEvent", "386": "NtWaitForKeyedEvent", "387": "NtWaitForWorkViaWorkerFactory", "388": "NtWaitHighEventPair", "389": "NtWaitLowEventPair", "390": "NtWorkerFactoryWorkerReady"}, "R2": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateReserveObject", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelIoFileEx", "135": "NtCancelSynchronousIoFile", "136": "NtCommitComplete", "137": "NtCommitEnlistment", "138": "NtCommitTransaction", "139": "NtCompactKeys", "140": "NtCompareTokens", "141": "NtCompleteConnectPort", "142": "NtCompressKey", "143": "NtConnectPort", "144": "NtCreateDebugObject", "145": "NtCreateDirectoryObject", "146": "NtCreateEnlistment", "147": "NtCreateEventPair", "148": "NtCreateIoCompletion", "149": "NtCreateJobObject", "150": "NtCreateJobSet", "151": "NtCreateKeyTransacted", "152": "NtCreateKeyedEvent", "153": "NtCreateMailslotFile", "154": "NtCreateMutant", "155": "NtCreateNamedPipeFile", "156": "NtCreatePagingFile", "157": "NtCreatePort", "158": "NtCreatePrivateNamespace", "159": "NtCreateProcess", "160": "NtCreateProfile", "161": "NtCreateProfileEx", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisableLastKnownGood", "184": "NtDisplayString", "185": "NtDrawText", "186": "NtEnableLastKnownGood", "187": "NtEnumerateBootEntries", "188": "NtEnumerateDriverEntries", "189": "NtEnumerateSystemEnvironmentValuesEx", "190": "NtEnumerateTransactionObject", "191": "NtExtendSection", "192": "NtFilterToken", "193": "NtFlushInstallUILanguage", "194": "NtFlushInstructionCache", "195": "NtFlushKey", "196": "NtFlushProcessWriteBuffers", "197": "NtFlushVirtualMemory", "198": "NtFlushWriteBuffer", "199": "NtFreeUserPhysicalPages", "200": "NtFreezeRegistry", "201": "NtFreezeTransactions", "202": "NtGetContextThread", "203": "NtGetCurrentProcessorNumber", "204": "NtGetDevicePowerState", "205": "NtGetMUIRegistryInfo", "206": "NtGetNextProcess", "207": "NtGetNextThread", "208": "NtGetNlsSectionPtr", "209": "NtGetNotificationResourceManager", "210": "NtGetPlugPlayEvent", "211": "NtGetWriteWatch", "212": "NtImpersonateAnonymousToken", "213": "NtImpersonateThread", "214": "NtInitializeNlsFiles", "215": "NtInitializeRegistry", "216": "NtInitiatePowerAction", "217": "NtIsSystemResumeAutomatic", "218": "NtIsUILanguageComitted", "219": "NtListenPort", "220": "NtLoadDriver", "221": "NtLoadKey", "222": "NtLoadKey2", "223": "NtLoadKeyEx", "224": "NtLockFile", "225": "NtLockProductActivationKeys", "226": "NtLockRegistryKey", "227": "NtLockVirtualMemory", "228": "NtMakePermanentObject", "229": "NtMakeTemporaryObject", "230": "NtMapCMFModule", "231": "NtMapUserPhysicalPages", "232": "NtModifyBootEntry", "233": "NtModifyDriverEntry", "234": "NtNotifyChangeDirectoryFile", "235": "NtNotifyChangeKey", "236": "NtNotifyChangeMultipleKeys", "237": "NtNotifyChangeSession", "238": "NtOpenEnlistment", "239": "NtOpenEventPair", "240": "NtOpenIoCompletion", "241": "NtOpenJobObject", "242": "NtOpenKeyEx", "243": "NtOpenKeyTransacted", "244": "NtOpenKeyTransactedEx", "245": "NtOpenKeyedEvent", "246": "NtOpenMutant", "247": "NtOpenObjectAuditAlarm", "248": "NtOpenPrivateNamespace", "249": "NtOpenProcessToken", "250": "NtOpenResourceManager", "251": "NtOpenSemaphore", "252": "NtOpenSession", "253": "NtOpenSymbolicLinkObject", "254": "NtOpenThread", "255": "NtOpenTimer", "256": "NtOpenTransaction", "257": "NtOpenTransactionManager", "258": "NtPlugPlayControl", "259": "NtPrePrepareComplete", "260": "NtPrePrepareEnlistment", "261": "NtPrepareComplete", "262": "NtPrepareEnlistment", "263": "NtPrivilegeCheck", "264": "NtPrivilegeObjectAuditAlarm", "265": "NtPrivilegedServiceAuditAlarm", "266": "NtPropagationComplete", "267": "NtPropagationFailed", "268": "NtPulseEvent", "269": "NtQueryBootEntryOrder", "270": "NtQueryBootOptions", "271": "NtQueryDebugFilterState", "272": "NtQueryDirectoryObject", "273": "NtQueryDriverEntryOrder", "274": "NtQueryEaFile", "275": "NtQueryFullAttributesFile", "276": "NtQueryInformationAtom", "277": "NtQueryInformationEnlistment", "278": "NtQueryInformationJobObject", "279": "NtQueryInformationPort", "280": "NtQueryInformationResourceManager", "281": "NtQueryInformationTransaction", "282": "NtQueryInformationTransactionManager", "283": "NtQueryInformationWorkerFactory", "284": "NtQueryInstallUILanguage", "285": "NtQueryIntervalProfile", "286": "NtQueryIoCompletion", "287": "NtQueryLicenseValue", "288": "NtQueryMultipleValueKey", "289": "NtQueryMutant", "290": "NtQueryOpenSubKeys", "291": "NtQueryOpenSubKeysEx", "292": "NtQueryPortInformationProcess", "293": "NtQueryQuotaInformationFile", "294": "NtQuerySecurityAttributesToken", "295": "NtQuerySecurityObject", "296": "NtQuerySemaphore", "297": "NtQuerySymbolicLinkObject", "298": "NtQuerySystemEnvironmentValue", "299": "NtQuerySystemEnvironmentValueEx", "300": "NtQuerySystemInformationEx", "301": "NtQueryTimerResolution", "302": "NtQueueApcThreadEx", "303": "NtRaiseException", "304": "NtRaiseHardError", "305": "NtReadOnlyEnlistment", "306": "NtRecoverEnlistment", "307": "NtRecoverResourceManager", "308": "NtRecoverTransactionManager", "309": "NtRegisterProtocolAddressInformation", "310": "NtRegisterThreadTerminatePort", "311": "NtReleaseKeyedEvent", "312": "NtReleaseWorkerFactoryWorker", "313": "NtRemoveIoCompletionEx", "314": "NtRemoveProcessDebug", "315": "NtRenameKey", "316": "NtRenameTransactionManager", "317": "NtReplaceKey", "318": "NtReplacePartitionUnit", "319": "NtReplyWaitReplyPort", "320": "NtRequestPort", "321": "NtResetEvent", "322": "NtResetWriteWatch", "323": "NtRestoreKey", "324": "NtResumeProcess", "325": "NtRollbackComplete", "326": "NtRollbackEnlistment", "327": "NtRollbackTransaction", "328": "NtRollforwardTransactionManager", "329": "NtSaveKey", "330": "NtSaveKeyEx", "331": "NtSaveMergedKeys", "332": "NtSecureConnectPort", "333": "NtSerializeBoot", "334": "NtSetBootEntryOrder", "335": "NtSetBootOptions", "336": "NtSetContextThread", "337": "NtSetDebugFilterState", "338": "NtSetDefaultHardErrorPort", "339": "NtSetDefaultLocale", "340": "NtSetDefaultUILanguage", "341": "NtSetDriverEntryOrder", "342": "NtSetEaFile", "343": "NtSetHighEventPair", "344": "NtSetHighWaitLowEventPair", "345": "NtSetInformationDebugObject", "346": "NtSetInformationEnlistment", "347": "NtSetInformationJobObject", "348": "NtSetInformationKey", "349": "NtSetInformationResourceManager", "350": "NtSetInformationToken", "351": "NtSetInformationTransaction", "352": "NtSetInformationTransactionManager", "353": "NtSetInformationWorkerFactory", "354": "NtSetIntervalProfile", "355": "NtSetIoCompletion", "356": "NtSetIoCompletionEx", "357": "NtSetLdtEntries", "358": "NtSetLowEventPair", "359": "NtSetLowWaitHighEventPair", "360": "NtSetQuotaInformationFile", "361": "NtSetSecurityObject", "362": "NtSetSystemEnvironmentValue", "363": "NtSetSystemEnvironmentValueEx", "364": "NtSetSystemInformation", "365": "NtSetSystemPowerState", "366": "NtSetSystemTime", "367": "NtSetThreadExecutionState", "368": "NtSetTimerEx", "369": "NtSetTimerResolution", "370": "NtSetUuidSeed", "371": "NtSetVolumeInformationFile", "372": "NtShutdownSystem", "373": "NtShutdownWorkerFactory", "374": "NtSignalAndWaitForSingleObject", "375": "NtSinglePhaseReject", "376": "NtStartProfile", "377": "NtStopProfile", "378": "NtSuspendProcess", "379": "NtSuspendThread", "380": "NtSystemDebugControl", "381": "NtTerminateJobObject", "382": "NtTestAlert", "383": "NtThawRegistry", "384": "NtThawTransactions", "385": "NtTraceControl", "386": "NtTranslateFilePath", "387": "NtUmsThreadYield", "388": "NtUnloadDriver", "389": "NtUnloadKey", "390": "NtUnloadKey2", "391": "NtUnloadKeyEx", "392": "NtUnlockFile", "393": "NtUnlockVirtualMemory", "394": "NtVdmControl", "395": "NtWaitForDebugEvent", "396": "NtWaitForKeyedEvent", "397": "NtWaitForWorkViaWorkerFactory", "398": "NtWaitHighEventPair", "399": "NtWaitLowEventPair", "400": "NtWorkerFactoryWorkerReady"}, "R2 SP1": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateReserveObject", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelIoFileEx", "135": "NtCancelSynchronousIoFile", "136": "NtCommitComplete", "137": "NtCommitEnlistment", "138": "NtCommitTransaction", "139": "NtCompactKeys", "140": "NtCompareTokens", "141": "NtCompleteConnectPort", "142": "NtCompressKey", "143": "NtConnectPort", "144": "NtCreateDebugObject", "145": "NtCreateDirectoryObject", "146": "NtCreateEnlistment", "147": "NtCreateEventPair", "148": "NtCreateIoCompletion", "149": "NtCreateJobObject", "150": "NtCreateJobSet", "151": "NtCreateKeyTransacted", "152": "NtCreateKeyedEvent", "153": "NtCreateMailslotFile", "154": "NtCreateMutant", "155": "NtCreateNamedPipeFile", "156": "NtCreatePagingFile", "157": "NtCreatePort", "158": "NtCreatePrivateNamespace", "159": "NtCreateProcess", "160": "NtCreateProfile", "161": "NtCreateProfileEx", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisableLastKnownGood", "184": "NtDisplayString", "185": "NtDrawText", "186": "NtEnableLastKnownGood", "187": "NtEnumerateBootEntries", "188": "NtEnumerateDriverEntries", "189": "NtEnumerateSystemEnvironmentValuesEx", "190": "NtEnumerateTransactionObject", "191": "NtExtendSection", "192": "NtFilterToken", "193": "NtFlushInstallUILanguage", "194": "NtFlushInstructionCache", "195": "NtFlushKey", "196": "NtFlushProcessWriteBuffers", "197": "NtFlushVirtualMemory", "198": "NtFlushWriteBuffer", "199": "NtFreeUserPhysicalPages", "200": "NtFreezeRegistry", "201": "NtFreezeTransactions", "202": "NtGetContextThread", "203": "NtGetCurrentProcessorNumber", "204": "NtGetDevicePowerState", "205": "NtGetMUIRegistryInfo", "206": "NtGetNextProcess", "207": "NtGetNextThread", "208": "NtGetNlsSectionPtr", "209": "NtGetNotificationResourceManager", "210": "NtGetPlugPlayEvent", "211": "NtGetWriteWatch", "212": "NtImpersonateAnonymousToken", "213": "NtImpersonateThread", "214": "NtInitializeNlsFiles", "215": "NtInitializeRegistry", "216": "NtInitiatePowerAction", "217": "NtIsSystemResumeAutomatic", "218": "NtIsUILanguageComitted", "219": "NtListenPort", "220": "NtLoadDriver", "221": "NtLoadKey", "222": "NtLoadKey2", "223": "NtLoadKeyEx", "224": "NtLockFile", "225": "NtLockProductActivationKeys", "226": "NtLockRegistryKey", "227": "NtLockVirtualMemory", "228": "NtMakePermanentObject", "229": "NtMakeTemporaryObject", "230": "NtMapCMFModule", "231": "NtMapUserPhysicalPages", "232": "NtModifyBootEntry", "233": "NtModifyDriverEntry", "234": "NtNotifyChangeDirectoryFile", "235": "NtNotifyChangeKey", "236": "NtNotifyChangeMultipleKeys", "237": "NtNotifyChangeSession", "238": "NtOpenEnlistment", "239": "NtOpenEventPair", "240": "NtOpenIoCompletion", "241": "NtOpenJobObject", "242": "NtOpenKeyEx", "243": "NtOpenKeyTransacted", "244": "NtOpenKeyTransactedEx", "245": "NtOpenKeyedEvent", "246": "NtOpenMutant", "247": "NtOpenObjectAuditAlarm", "248": "NtOpenPrivateNamespace", "249": "NtOpenProcessToken", "250": "NtOpenResourceManager", "251": "NtOpenSemaphore", "252": "NtOpenSession", "253": "NtOpenSymbolicLinkObject", "254": "NtOpenThread", "255": "NtOpenTimer", "256": "NtOpenTransaction", "257": "NtOpenTransactionManager", "258": "NtPlugPlayControl", "259": "NtPrePrepareComplete", "260": "NtPrePrepareEnlistment", "261": "NtPrepareComplete", "262": "NtPrepareEnlistment", "263": "NtPrivilegeCheck", "264": "NtPrivilegeObjectAuditAlarm", "265": "NtPrivilegedServiceAuditAlarm", "266": "NtPropagationComplete", "267": "NtPropagationFailed", "268": "NtPulseEvent", "269": "NtQueryBootEntryOrder", "270": "NtQueryBootOptions", "271": "NtQueryDebugFilterState", "272": "NtQueryDirectoryObject", "273": "NtQueryDriverEntryOrder", "274": "NtQueryEaFile", "275": "NtQueryFullAttributesFile", "276": "NtQueryInformationAtom", "277": "NtQueryInformationEnlistment", "278": "NtQueryInformationJobObject", "279": "NtQueryInformationPort", "280": "NtQueryInformationResourceManager", "281": "NtQueryInformationTransaction", "282": "NtQueryInformationTransactionManager", "283": "NtQueryInformationWorkerFactory", "284": "NtQueryInstallUILanguage", "285": "NtQueryIntervalProfile", "286": "NtQueryIoCompletion", "287": "NtQueryLicenseValue", "288": "NtQueryMultipleValueKey", "289": "NtQueryMutant", "290": "NtQueryOpenSubKeys", "291": "NtQueryOpenSubKeysEx", "292": "NtQueryPortInformationProcess", "293": "NtQueryQuotaInformationFile", "294": "NtQuerySecurityAttributesToken", "295": "NtQuerySecurityObject", "296": "NtQuerySemaphore", "297": "NtQuerySymbolicLinkObject", "298": "NtQuerySystemEnvironmentValue", "299": "NtQuerySystemEnvironmentValueEx", "300": "NtQuerySystemInformationEx", "301": "NtQueryTimerResolution", "302": "NtQueueApcThreadEx", "303": "NtRaiseException", "304": "NtRaiseHardError", "305": "NtReadOnlyEnlistment", "306": "NtRecoverEnlistment", "307": "NtRecoverResourceManager", "308": "NtRecoverTransactionManager", "309": "NtRegisterProtocolAddressInformation", "310": "NtRegisterThreadTerminatePort", "311": "NtReleaseKeyedEvent", "312": "NtReleaseWorkerFactoryWorker", "313": "NtRemoveIoCompletionEx", "314": "NtRemoveProcessDebug", "315": "NtRenameKey", "316": "NtRenameTransactionManager", "317": "NtReplaceKey", "318": "NtReplacePartitionUnit", "319": "NtReplyWaitReplyPort", "320": "NtRequestPort", "321": "NtResetEvent", "322": "NtResetWriteWatch", "323": "NtRestoreKey", "324": "NtResumeProcess", "325": "NtRollbackComplete", "326": "NtRollbackEnlistment", "327": "NtRollbackTransaction", "328": "NtRollforwardTransactionManager", "329": "NtSaveKey", "330": "NtSaveKeyEx", "331": "NtSaveMergedKeys", "332": "NtSecureConnectPort", "333": "NtSerializeBoot", "334": "NtSetBootEntryOrder", "335": "NtSetBootOptions", "336": "NtSetContextThread", "337": "NtSetDebugFilterState", "338": "NtSetDefaultHardErrorPort", "339": "NtSetDefaultLocale", "340": "NtSetDefaultUILanguage", "341": "NtSetDriverEntryOrder", "342": "NtSetEaFile", "343": "NtSetHighEventPair", "344": "NtSetHighWaitLowEventPair", "345": "NtSetInformationDebugObject", "346": "NtSetInformationEnlistment", "347": "NtSetInformationJobObject", "348": "NtSetInformationKey", "349": "NtSetInformationResourceManager", "350": "NtSetInformationToken", "351": "NtSetInformationTransaction", "352": "NtSetInformationTransactionManager", "353": "NtSetInformationWorkerFactory", "354": "NtSetIntervalProfile", "355": "NtSetIoCompletion", "356": "NtSetIoCompletionEx", "357": "NtSetLdtEntries", "358": "NtSetLowEventPair", "359": "NtSetLowWaitHighEventPair", "360": "NtSetQuotaInformationFile", "361": "NtSetSecurityObject", "362": "NtSetSystemEnvironmentValue", "363": "NtSetSystemEnvironmentValueEx", "364": "NtSetSystemInformation", "365": "NtSetSystemPowerState", "366": "NtSetSystemTime", "367": "NtSetThreadExecutionState", "368": "NtSetTimerEx", "369": "NtSetTimerResolution", "370": "NtSetUuidSeed", "371": "NtSetVolumeInformationFile", "372": "NtShutdownSystem", "373": "NtShutdownWorkerFactory", "374": "NtSignalAndWaitForSingleObject", "375": "NtSinglePhaseReject", "376": "NtStartProfile", "377": "NtStopProfile", "378": "NtSuspendProcess", "379": "NtSuspendThread", "380": "NtSystemDebugControl", "381": "NtTerminateJobObject", "382": "NtTestAlert", "383": "NtThawRegistry", "384": "NtThawTransactions", "385": "NtTraceControl", "386": "NtTranslateFilePath", "387": "NtUmsThreadYield", "388": "NtUnloadDriver", "389": "NtUnloadKey", "390": "NtUnloadKey2", "391": "NtUnloadKeyEx", "392": "NtUnlockFile", "393": "NtUnlockVirtualMemory", "394": "NtVdmControl", "395": "NtWaitForDebugEvent", "396": "NtWaitForKeyedEvent", "397": "NtWaitForWorkViaWorkerFactory", "398": "NtWaitHighEventPair", "399": "NtWaitLowEventPair", "400": "NtWorkerFactoryWorkerReady"}}, "Windows 7": {"SP0": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateReserveObject", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelIoFileEx", "135": "NtCancelSynchronousIoFile", "136": "NtCommitComplete", "137": "NtCommitEnlistment", "138": "NtCommitTransaction", "139": "NtCompactKeys", "140": "NtCompareTokens", "141": "NtCompleteConnectPort", "142": "NtCompressKey", "143": "NtConnectPort", "144": "NtCreateDebugObject", "145": "NtCreateDirectoryObject", "146": "NtCreateEnlistment", "147": "NtCreateEventPair", "148": "NtCreateIoCompletion", "149": "NtCreateJobObject", "150": "NtCreateJobSet", "151": "NtCreateKeyTransacted", "152": "NtCreateKeyedEvent", "153": "NtCreateMailslotFile", "154": "NtCreateMutant", "155": "NtCreateNamedPipeFile", "156": "NtCreatePagingFile", "157": "NtCreatePort", "158": "NtCreatePrivateNamespace", "159": "NtCreateProcess", "160": "NtCreateProfile", "161": "NtCreateProfileEx", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisableLastKnownGood", "184": "NtDisplayString", "185": "NtDrawText", "186": "NtEnableLastKnownGood", "187": "NtEnumerateBootEntries", "188": "NtEnumerateDriverEntries", "189": "NtEnumerateSystemEnvironmentValuesEx", "190": "NtEnumerateTransactionObject", "191": "NtExtendSection", "192": "NtFilterToken", "193": "NtFlushInstallUILanguage", "194": "NtFlushInstructionCache", "195": "NtFlushKey", "196": "NtFlushProcessWriteBuffers", "197": "NtFlushVirtualMemory", "198": "NtFlushWriteBuffer", "199": "NtFreeUserPhysicalPages", "200": "NtFreezeRegistry", "201": "NtFreezeTransactions", "202": "NtGetContextThread", "203": "NtGetCurrentProcessorNumber", "204": "NtGetDevicePowerState", "205": "NtGetMUIRegistryInfo", "206": "NtGetNextProcess", "207": "NtGetNextThread", "208": "NtGetNlsSectionPtr", "209": "NtGetNotificationResourceManager", "210": "NtGetPlugPlayEvent", "211": "NtGetWriteWatch", "212": "NtImpersonateAnonymousToken", "213": "NtImpersonateThread", "214": "NtInitializeNlsFiles", "215": "NtInitializeRegistry", "216": "NtInitiatePowerAction", "217": "NtIsSystemResumeAutomatic", "218": "NtIsUILanguageComitted", "219": "NtListenPort", "220": "NtLoadDriver", "221": "NtLoadKey", "222": "NtLoadKey2", "223": "NtLoadKeyEx", "224": "NtLockFile", "225": "NtLockProductActivationKeys", "226": "NtLockRegistryKey", "227": "NtLockVirtualMemory", "228": "NtMakePermanentObject", "229": "NtMakeTemporaryObject", "230": "NtMapCMFModule", "231": "NtMapUserPhysicalPages", "232": "NtModifyBootEntry", "233": "NtModifyDriverEntry", "234": "NtNotifyChangeDirectoryFile", "235": "NtNotifyChangeKey", "236": "NtNotifyChangeMultipleKeys", "237": "NtNotifyChangeSession", "238": "NtOpenEnlistment", "239": "NtOpenEventPair", "240": "NtOpenIoCompletion", "241": "NtOpenJobObject", "242": "NtOpenKeyEx", "243": "NtOpenKeyTransacted", "244": "NtOpenKeyTransactedEx", "245": "NtOpenKeyedEvent", "246": "NtOpenMutant", "247": "NtOpenObjectAuditAlarm", "248": "NtOpenPrivateNamespace", "249": "NtOpenProcessToken", "250": "NtOpenResourceManager", "251": "NtOpenSemaphore", "252": "NtOpenSession", "253": "NtOpenSymbolicLinkObject", "254": "NtOpenThread", "255": "NtOpenTimer", "256": "NtOpenTransaction", "257": "NtOpenTransactionManager", "258": "NtPlugPlayControl", "259": "NtPrePrepareComplete", "260": "NtPrePrepareEnlistment", "261": "NtPrepareComplete", "262": "NtPrepareEnlistment", "263": "NtPrivilegeCheck", "264": "NtPrivilegeObjectAuditAlarm", "265": "NtPrivilegedServiceAuditAlarm", "266": "NtPropagationComplete", "267": "NtPropagationFailed", "268": "NtPulseEvent", "269": "NtQueryBootEntryOrder", "270": "NtQueryBootOptions", "271": "NtQueryDebugFilterState", "272": "NtQueryDirectoryObject", "273": "NtQueryDriverEntryOrder", "274": "NtQueryEaFile", "275": "NtQueryFullAttributesFile", "276": "NtQueryInformationAtom", "277": "NtQueryInformationEnlistment", "278": "NtQueryInformationJobObject", "279": "NtQueryInformationPort", "280": "NtQueryInformationResourceManager", "281": "NtQueryInformationTransaction", "282": "NtQueryInformationTransactionManager", "283": "NtQueryInformationWorkerFactory", "284": "NtQueryInstallUILanguage", "285": "NtQueryIntervalProfile", "286": "NtQueryIoCompletion", "287": "NtQueryLicenseValue", "288": "NtQueryMultipleValueKey", "289": "NtQueryMutant", "290": "NtQueryOpenSubKeys", "291": "NtQueryOpenSubKeysEx", "292": "NtQueryPortInformationProcess", "293": "NtQueryQuotaInformationFile", "294": "NtQuerySecurityAttributesToken", "295": "NtQuerySecurityObject", "296": "NtQuerySemaphore", "297": "NtQuerySymbolicLinkObject", "298": "NtQuerySystemEnvironmentValue", "299": "NtQuerySystemEnvironmentValueEx", "300": "NtQuerySystemInformationEx", "301": "NtQueryTimerResolution", "302": "NtQueueApcThreadEx", "303": "NtRaiseException", "304": "NtRaiseHardError", "305": "NtReadOnlyEnlistment", "306": "NtRecoverEnlistment", "307": "NtRecoverResourceManager", "308": "NtRecoverTransactionManager", "309": "NtRegisterProtocolAddressInformation", "310": "NtRegisterThreadTerminatePort", "311": "NtReleaseKeyedEvent", "312": "NtReleaseWorkerFactoryWorker", "313": "NtRemoveIoCompletionEx", "314": "NtRemoveProcessDebug", "315": "NtRenameKey", "316": "NtRenameTransactionManager", "317": "NtReplaceKey", "318": "NtReplacePartitionUnit", "319": "NtReplyWaitReplyPort", "320": "NtRequestPort", "321": "NtResetEvent", "322": "NtResetWriteWatch", "323": "NtRestoreKey", "324": "NtResumeProcess", "325": "NtRollbackComplete", "326": "NtRollbackEnlistment", "327": "NtRollbackTransaction", "328": "NtRollforwardTransactionManager", "329": "NtSaveKey", "330": "NtSaveKeyEx", "331": "NtSaveMergedKeys", "332": "NtSecureConnectPort", "333": "NtSerializeBoot", "334": "NtSetBootEntryOrder", "335": "NtSetBootOptions", "336": "NtSetContextThread", "337": "NtSetDebugFilterState", "338": "NtSetDefaultHardErrorPort", "339": "NtSetDefaultLocale", "340": "NtSetDefaultUILanguage", "341": "NtSetDriverEntryOrder", "342": "NtSetEaFile", "343": "NtSetHighEventPair", "344": "NtSetHighWaitLowEventPair", "345": "NtSetInformationDebugObject", "346": "NtSetInformationEnlistment", "347": "NtSetInformationJobObject", "348": "NtSetInformationKey", "349": "NtSetInformationResourceManager", "350": "NtSetInformationToken", "351": "NtSetInformationTransaction", "352": "NtSetInformationTransactionManager", "353": "NtSetInformationWorkerFactory", "354": "NtSetIntervalProfile", "355": "NtSetIoCompletion", "356": "NtSetIoCompletionEx", "357": "NtSetLdtEntries", "358": "NtSetLowEventPair", "359": "NtSetLowWaitHighEventPair", "360": "NtSetQuotaInformationFile", "361": "NtSetSecurityObject", "362": "NtSetSystemEnvironmentValue", "363": "NtSetSystemEnvironmentValueEx", "364": "NtSetSystemInformation", "365": "NtSetSystemPowerState", "366": "NtSetSystemTime", "367": "NtSetThreadExecutionState", "368": "NtSetTimerEx", "369": "NtSetTimerResolution", "370": "NtSetUuidSeed", "371": "NtSetVolumeInformationFile", "372": "NtShutdownSystem", "373": "NtShutdownWorkerFactory", "374": "NtSignalAndWaitForSingleObject", "375": "NtSinglePhaseReject", "376": "NtStartProfile", "377": "NtStopProfile", "378": "NtSuspendProcess", "379": "NtSuspendThread", "380": "NtSystemDebugControl", "381": "NtTerminateJobObject", "382": "NtTestAlert", "383": "NtThawRegistry", "384": "NtThawTransactions", "385": "NtTraceControl", "386": "NtTranslateFilePath", "387": "NtUmsThreadYield", "388": "NtUnloadDriver", "389": "NtUnloadKey", "390": "NtUnloadKey2", "391": "NtUnloadKeyEx", "392": "NtUnlockFile", "393": "NtUnlockVirtualMemory", "394": "NtVdmControl", "395": "NtWaitForDebugEvent", "396": "NtWaitForKeyedEvent", "397": "NtWaitForWorkViaWorkerFactory", "398": "NtWaitHighEventPair", "399": "NtWaitLowEventPair", "400": "NtWorkerFactoryWorkerReady"}, "SP1": {"0": "NtMapUserPhysicalPagesScatter", "1": "NtWaitForSingleObject", "2": "NtCallbackReturn", "3": "NtReadFile", "4": "NtDeviceIoControlFile", "5": "NtWriteFile", "6": "NtRemoveIoCompletion", "7": "NtReleaseSemaphore", "8": "NtReplyWaitReceivePort", "9": "NtReplyPort", "10": "NtSetInformationThread", "11": "NtSetEvent", "12": "NtClose", "13": "NtQueryObject", "14": "NtQueryInformationFile", "15": "NtOpenKey", "16": "NtEnumerateValueKey", "17": "NtFindAtom", "18": "NtQueryDefaultLocale", "19": "NtQueryKey", "20": "NtQueryValueKey", "21": "NtAllocateVirtualMemory", "22": "NtQueryInformationProcess", "23": "NtWaitForMultipleObjects32", "24": "NtWriteFileGather", "25": "NtSetInformationProcess", "26": "NtCreateKey", "27": "NtFreeVirtualMemory", "28": "NtImpersonateClientOfPort", "29": "NtReleaseMutant", "30": "NtQueryInformationToken", "31": "NtRequestWaitReplyPort", "32": "NtQueryVirtualMemory", "33": "NtOpenThreadToken", "34": "NtQueryInformationThread", "35": "NtOpenProcess", "36": "NtSetInformationFile", "37": "NtMapViewOfSection", "38": "NtAccessCheckAndAuditAlarm", "39": "NtUnmapViewOfSection", "40": "NtReplyWaitReceivePortEx", "41": "NtTerminateProcess", "42": "NtSetEventBoostPriority", "43": "NtReadFileScatter", "44": "NtOpenThreadTokenEx", "45": "NtOpenProcessTokenEx", "46": "NtQueryPerformanceCounter", "47": "NtEnumerateKey", "48": "NtOpenFile", "49": "NtDelayExecution", "50": "NtQueryDirectoryFile", "51": "NtQuerySystemInformation", "52": "NtOpenSection", "53": "NtQueryTimer", "54": "NtFsControlFile", "55": "NtWriteVirtualMemory", "56": "NtCloseObjectAuditAlarm", "57": "NtDuplicateObject", "58": "NtQueryAttributesFile", "59": "NtClearEvent", "60": "NtReadVirtualMemory", "61": "NtOpenEvent", "62": "NtAdjustPrivilegesToken", "63": "NtDuplicateToken", "64": "NtContinue", "65": "NtQueryDefaultUILanguage", "66": "NtQueueApcThread", "67": "NtYieldExecution", "68": "NtAddAtom", "69": "NtCreateEvent", "70": "NtQueryVolumeInformationFile", "71": "NtCreateSection", "72": "NtFlushBuffersFile", "73": "NtApphelpCacheControl", "74": "NtCreateProcessEx", "75": "NtCreateThread", "76": "NtIsProcessInJob", "77": "NtProtectVirtualMemory", "78": "NtQuerySection", "79": "NtResumeThread", "80": "NtTerminateThread", "81": "NtReadRequestData", "82": "NtCreateFile", "83": "NtQueryEvent", "84": "NtWriteRequestData", "85": "NtOpenDirectoryObject", "86": "NtAccessCheckByTypeAndAuditAlarm", "87": "NtQuerySystemTime", "88": "NtWaitForMultipleObjects", "89": "NtSetInformationObject", "90": "NtCancelIoFile", "91": "NtTraceEvent", "92": "NtPowerInformation", "93": "NtSetValueKey", "94": "NtCancelTimer", "95": "NtSetTimer", "96": "NtAcceptConnectPort", "97": "NtAccessCheck", "98": "NtAccessCheckByType", "99": "NtAccessCheckByTypeResultList", "100": "NtAccessCheckByTypeResultListAndAuditAlarm", "101": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "102": "NtAddBootEntry", "103": "NtAddDriverEntry", "104": "NtAdjustGroupsToken", "105": "NtAlertResumeThread", "106": "NtAlertThread", "107": "NtAllocateLocallyUniqueId", "108": "NtAllocateReserveObject", "109": "NtAllocateUserPhysicalPages", "110": "NtAllocateUuids", "111": "NtAlpcAcceptConnectPort", "112": "NtAlpcCancelMessage", "113": "NtAlpcConnectPort", "114": "NtAlpcCreatePort", "115": "NtAlpcCreatePortSection", "116": "NtAlpcCreateResourceReserve", "117": "NtAlpcCreateSectionView", "118": "NtAlpcCreateSecurityContext", "119": "NtAlpcDeletePortSection", "120": "NtAlpcDeleteResourceReserve", "121": "NtAlpcDeleteSectionView", "122": "NtAlpcDeleteSecurityContext", "123": "NtAlpcDisconnectPort", "124": "NtAlpcImpersonateClientOfPort", "125": "NtAlpcOpenSenderProcess", "126": "NtAlpcOpenSenderThread", "127": "NtAlpcQueryInformation", "128": "NtAlpcQueryInformationMessage", "129": "NtAlpcRevokeSecurityContext", "130": "NtAlpcSendWaitReceivePort", "131": "NtAlpcSetInformation", "132": "NtAreMappedFilesTheSame", "133": "NtAssignProcessToJobObject", "134": "NtCancelIoFileEx", "135": "NtCancelSynchronousIoFile", "136": "NtCommitComplete", "137": "NtCommitEnlistment", "138": "NtCommitTransaction", "139": "NtCompactKeys", "140": "NtCompareTokens", "141": "NtCompleteConnectPort", "142": "NtCompressKey", "143": "NtConnectPort", "144": "NtCreateDebugObject", "145": "NtCreateDirectoryObject", "146": "NtCreateEnlistment", "147": "NtCreateEventPair", "148": "NtCreateIoCompletion", "149": "NtCreateJobObject", "150": "NtCreateJobSet", "151": "NtCreateKeyTransacted", "152": "NtCreateKeyedEvent", "153": "NtCreateMailslotFile", "154": "NtCreateMutant", "155": "NtCreateNamedPipeFile", "156": "NtCreatePagingFile", "157": "NtCreatePort", "158": "NtCreatePrivateNamespace", "159": "NtCreateProcess", "160": "NtCreateProfile", "161": "NtCreateProfileEx", "162": "NtCreateResourceManager", "163": "NtCreateSemaphore", "164": "NtCreateSymbolicLinkObject", "165": "NtCreateThreadEx", "166": "NtCreateTimer", "167": "NtCreateToken", "168": "NtCreateTransaction", "169": "NtCreateTransactionManager", "170": "NtCreateUserProcess", "171": "NtCreateWaitablePort", "172": "NtCreateWorkerFactory", "173": "NtDebugActiveProcess", "174": "NtDebugContinue", "175": "NtDeleteAtom", "176": "NtDeleteBootEntry", "177": "NtDeleteDriverEntry", "178": "NtDeleteFile", "179": "NtDeleteKey", "180": "NtDeleteObjectAuditAlarm", "181": "NtDeletePrivateNamespace", "182": "NtDeleteValueKey", "183": "NtDisableLastKnownGood", "184": "NtDisplayString", "185": "NtDrawText", "186": "NtEnableLastKnownGood", "187": "NtEnumerateBootEntries", "188": "NtEnumerateDriverEntries", "189": "NtEnumerateSystemEnvironmentValuesEx", "190": "NtEnumerateTransactionObject", "191": "NtExtendSection", "192": "NtFilterToken", "193": "NtFlushInstallUILanguage", "194": "NtFlushInstructionCache", "195": "NtFlushKey", "196": "NtFlushProcessWriteBuffers", "197": "NtFlushVirtualMemory", "198": "NtFlushWriteBuffer", "199": "NtFreeUserPhysicalPages", "200": "NtFreezeRegistry", "201": "NtFreezeTransactions", "202": "NtGetContextThread", "203": "NtGetCurrentProcessorNumber", "204": "NtGetDevicePowerState", "205": "NtGetMUIRegistryInfo", "206": "NtGetNextProcess", "207": "NtGetNextThread", "208": "NtGetNlsSectionPtr", "209": "NtGetNotificationResourceManager", "210": "NtGetPlugPlayEvent", "211": "NtGetWriteWatch", "212": "NtImpersonateAnonymousToken", "213": "NtImpersonateThread", "214": "NtInitializeNlsFiles", "215": "NtInitializeRegistry", "216": "NtInitiatePowerAction", "217": "NtIsSystemResumeAutomatic", "218": "NtIsUILanguageComitted", "219": "NtListenPort", "220": "NtLoadDriver", "221": "NtLoadKey", "222": "NtLoadKey2", "223": "NtLoadKeyEx", "224": "NtLockFile", "225": "NtLockProductActivationKeys", "226": "NtLockRegistryKey", "227": "NtLockVirtualMemory", "228": "NtMakePermanentObject", "229": "NtMakeTemporaryObject", "230": "NtMapCMFModule", "231": "NtMapUserPhysicalPages", "232": "NtModifyBootEntry", "233": "NtModifyDriverEntry", "234": "NtNotifyChangeDirectoryFile", "235": "NtNotifyChangeKey", "236": "NtNotifyChangeMultipleKeys", "237": "NtNotifyChangeSession", "238": "NtOpenEnlistment", "239": "NtOpenEventPair", "240": "NtOpenIoCompletion", "241": "NtOpenJobObject", "242": "NtOpenKeyEx", "243": "NtOpenKeyTransacted", "244": "NtOpenKeyTransactedEx", "245": "NtOpenKeyedEvent", "246": "NtOpenMutant", "247": "NtOpenObjectAuditAlarm", "248": "NtOpenPrivateNamespace", "249": "NtOpenProcessToken", "250": "NtOpenResourceManager", "251": "NtOpenSemaphore", "252": "NtOpenSession", "253": "NtOpenSymbolicLinkObject", "254": "NtOpenThread", "255": "NtOpenTimer", "256": "NtOpenTransaction", "257": "NtOpenTransactionManager", "258": "NtPlugPlayControl", "259": "NtPrePrepareComplete", "260": "NtPrePrepareEnlistment", "261": "NtPrepareComplete", "262": "NtPrepareEnlistment", "263": "NtPrivilegeCheck", "264": "NtPrivilegeObjectAuditAlarm", "265": "NtPrivilegedServiceAuditAlarm", "266": "NtPropagationComplete", "267": "NtPropagationFailed", "268": "NtPulseEvent", "269": "NtQueryBootEntryOrder", "270": "NtQueryBootOptions", "271": "NtQueryDebugFilterState", "272": "NtQueryDirectoryObject", "273": "NtQueryDriverEntryOrder", "274": "NtQueryEaFile", "275": "NtQueryFullAttributesFile", "276": "NtQueryInformationAtom", "277": "NtQueryInformationEnlistment", "278": "NtQueryInformationJobObject", "279": "NtQueryInformationPort", "280": "NtQueryInformationResourceManager", "281": "NtQueryInformationTransaction", "282": "NtQueryInformationTransactionManager", "283": "NtQueryInformationWorkerFactory", "284": "NtQueryInstallUILanguage", "285": "NtQueryIntervalProfile", "286": "NtQueryIoCompletion", "287": "NtQueryLicenseValue", "288": "NtQueryMultipleValueKey", "289": "NtQueryMutant", "290": "NtQueryOpenSubKeys", "291": "NtQueryOpenSubKeysEx", "292": "NtQueryPortInformationProcess", "293": "NtQueryQuotaInformationFile", "294": "NtQuerySecurityAttributesToken", "295": "NtQuerySecurityObject", "296": "NtQuerySemaphore", "297": "NtQuerySymbolicLinkObject", "298": "NtQuerySystemEnvironmentValue", "299": "NtQuerySystemEnvironmentValueEx", "300": "NtQuerySystemInformationEx", "301": "NtQueryTimerResolution", "302": "NtQueueApcThreadEx", "303": "NtRaiseException", "304": "NtRaiseHardError", "305": "NtReadOnlyEnlistment", "306": "NtRecoverEnlistment", "307": "NtRecoverResourceManager", "308": "NtRecoverTransactionManager", "309": "NtRegisterProtocolAddressInformation", "310": "NtRegisterThreadTerminatePort", "311": "NtReleaseKeyedEvent", "312": "NtReleaseWorkerFactoryWorker", "313": "NtRemoveIoCompletionEx", "314": "NtRemoveProcessDebug", "315": "NtRenameKey", "316": "NtRenameTransactionManager", "317": "NtReplaceKey", "318": "NtReplacePartitionUnit", "319": "NtReplyWaitReplyPort", "320": "NtRequestPort", "321": "NtResetEvent", "322": "NtResetWriteWatch", "323": "NtRestoreKey", "324": "NtResumeProcess", "325": "NtRollbackComplete", "326": "NtRollbackEnlistment", "327": "NtRollbackTransaction", "328": "NtRollforwardTransactionManager", "329": "NtSaveKey", "330": "NtSaveKeyEx", "331": "NtSaveMergedKeys", "332": "NtSecureConnectPort", "333": "NtSerializeBoot", "334": "NtSetBootEntryOrder", "335": "NtSetBootOptions", "336": "NtSetContextThread", "337": "NtSetDebugFilterState", "338": "NtSetDefaultHardErrorPort", "339": "NtSetDefaultLocale", "340": "NtSetDefaultUILanguage", "341": "NtSetDriverEntryOrder", "342": "NtSetEaFile", "343": "NtSetHighEventPair", "344": "NtSetHighWaitLowEventPair", "345": "NtSetInformationDebugObject", "346": "NtSetInformationEnlistment", "347": "NtSetInformationJobObject", "348": "NtSetInformationKey", "349": "NtSetInformationResourceManager", "350": "NtSetInformationToken", "351": "NtSetInformationTransaction", "352": "NtSetInformationTransactionManager", "353": "NtSetInformationWorkerFactory", "354": "NtSetIntervalProfile", "355": "NtSetIoCompletion", "356": "NtSetIoCompletionEx", "357": "NtSetLdtEntries", "358": "NtSetLowEventPair", "359": "NtSetLowWaitHighEventPair", "360": "NtSetQuotaInformationFile", "361": "NtSetSecurityObject", "362": "NtSetSystemEnvironmentValue", "363": "NtSetSystemEnvironmentValueEx", "364": "NtSetSystemInformation", "365": "NtSetSystemPowerState", "366": "NtSetSystemTime", "367": "NtSetThreadExecutionState", "368": "NtSetTimerEx", "369": "NtSetTimerResolution", "370": "NtSetUuidSeed", "371": "NtSetVolumeInformationFile", "372": "NtShutdownSystem", "373": "NtShutdownWorkerFactory", "374": "NtSignalAndWaitForSingleObject", "375": "NtSinglePhaseReject", "376": "NtStartProfile", "377": "NtStopProfile", "378": "NtSuspendProcess", "379": "NtSuspendThread", "380": "NtSystemDebugControl", "381": "NtTerminateJobObject", "382": "NtTestAlert", "383": "NtThawRegistry", "384": "NtThawTransactions", "385": "NtTraceControl", "386": "NtTranslateFilePath", "387": "NtUmsThreadYield", "388": "NtUnloadDriver", "389": "NtUnloadKey", "390": "NtUnloadKey2", "391": "NtUnloadKeyEx", "392": "NtUnlockFile", "393": "NtUnlockVirtualMemory", "394": "NtVdmControl", "395": "NtWaitForDebugEvent", "396": "NtWaitForKeyedEvent", "397": "NtWaitForWorkViaWorkerFactory", "398": "NtWaitHighEventPair", "399": "NtWaitLowEventPair", "400": "NtWorkerFactoryWorkerReady"}}, "Windows Server 2012": {"SP0": {"0": "NtWorkerFactoryWorkerReady", "1": "NtMapUserPhysicalPagesScatter", "2": "NtWaitForSingleObject", "3": "NtCallbackReturn", "4": "NtReadFile", "5": "NtDeviceIoControlFile", "6": "NtWriteFile", "7": "NtRemoveIoCompletion", "8": "NtReleaseSemaphore", "9": "NtReplyWaitReceivePort", "10": "NtReplyPort", "11": "NtSetInformationThread", "12": "NtSetEvent", "13": "NtClose", "14": "NtQueryObject", "15": "NtQueryInformationFile", "16": "NtOpenKey", "17": "NtEnumerateValueKey", "18": "NtFindAtom", "19": "NtQueryDefaultLocale", "20": "NtQueryKey", "21": "NtQueryValueKey", "22": "NtAllocateVirtualMemory", "23": "NtQueryInformationProcess", "24": "NtWaitForMultipleObjects32", "25": "NtWriteFileGather", "26": "NtSetInformationProcess", "27": "NtCreateKey", "28": "NtFreeVirtualMemory", "29": "NtImpersonateClientOfPort", "30": "NtReleaseMutant", "31": "NtQueryInformationToken", "32": "NtRequestWaitReplyPort", "33": "NtQueryVirtualMemory", "34": "NtOpenThreadToken", "35": "NtQueryInformationThread", "36": "NtOpenProcess", "37": "NtSetInformationFile", "38": "NtMapViewOfSection", "39": "NtAccessCheckAndAuditAlarm", "40": "NtUnmapViewOfSection", "41": "NtReplyWaitReceivePortEx", "42": "NtTerminateProcess", "43": "NtSetEventBoostPriority", "44": "NtReadFileScatter", "45": "NtOpenThreadTokenEx", "46": "NtOpenProcessTokenEx", "47": "NtQueryPerformanceCounter", "48": "NtEnumerateKey", "49": "NtOpenFile", "50": "NtDelayExecution", "51": "NtQueryDirectoryFile", "52": "NtQuerySystemInformation", "53": "NtOpenSection", "54": "NtQueryTimer", "55": "NtFsControlFile", "56": "NtWriteVirtualMemory", "57": "NtCloseObjectAuditAlarm", "58": "NtDuplicateObject", "59": "NtQueryAttributesFile", "60": "NtClearEvent", "61": "NtReadVirtualMemory", "62": "NtOpenEvent", "63": "NtAdjustPrivilegesToken", "64": "NtDuplicateToken", "65": "NtContinue", "66": "NtQueryDefaultUILanguage", "67": "NtQueueApcThread", "68": "NtYieldExecution", "69": "NtAddAtom", "70": "NtCreateEvent", "71": "NtQueryVolumeInformationFile", "72": "NtCreateSection", "73": "NtFlushBuffersFile", "74": "NtApphelpCacheControl", "75": "NtCreateProcessEx", "76": "NtCreateThread", "77": "NtIsProcessInJob", "78": "NtProtectVirtualMemory", "79": "NtQuerySection", "80": "NtResumeThread", "81": "NtTerminateThread", "82": "NtReadRequestData", "83": "NtCreateFile", "84": "NtQueryEvent", "85": "NtWriteRequestData", "86": "NtOpenDirectoryObject", "87": "NtAccessCheckByTypeAndAuditAlarm", "88": "NtQuerySystemTime", "89": "NtWaitForMultipleObjects", "90": "NtSetInformationObject", "91": "NtCancelIoFile", "92": "NtTraceEvent", "93": "NtPowerInformation", "94": "NtSetValueKey", "95": "NtCancelTimer", "96": "NtSetTimer", "97": "NtAcceptConnectPort", "98": "NtAccessCheck", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientOfPort", "130": "NtAlpcOpenSenderProcess", "131": "NtAlpcOpenSenderThread", "132": "NtAlpcQueryInformation", "133": "NtAlpcQueryInformationMessage", "134": "NtAlpcRevokeSecurityContext", "135": "NtAlpcSendWaitReceivePort", "136": "NtAlpcSetInformation", "137": "NtAreMappedFilesTheSame", "138": "NtAssignProcessToJobObject", "139": "NtAssociateWaitCompletionPacket", "140": "NtCancelIoFileEx", "141": "NtCancelSynchronousIoFile", "142": "NtCancelWaitCompletionPacket", "143": "NtCommitComplete", "144": "NtCommitEnlistment", "145": "NtCommitTransaction", "146": "NtCompactKeys", "147": "NtCompareTokens", "148": "NtCompleteConnectPort", "149": "NtCompressKey", "150": "NtConnectPort", "151": "NtCreateDebugObject", "152": "NtCreateDirectoryObject", "153": "NtCreateDirectoryObjectEx", "154": "NtCreateEnlistment", "155": "NtCreateEventPair", "156": "NtCreateIRTimer", "157": "NtCreateIoCompletion", "158": "NtCreateJobObject", "159": "NtCreateJobSet", "160": "NtCreateKeyTransacted", "161": "NtCreateKeyedEvent", "162": "NtCreateLowBoxToken", "163": "NtCreateMailslotFile", "164": "NtCreateMutant", "165": "NtCreateNamedPipeFile", "166": "NtCreatePagingFile", "167": "NtCreatePort", "168": "NtCreatePrivateNamespace", "169": "NtCreateProcess", "170": "NtCreateProfile", "171": "NtCreateProfileEx", "172": "NtCreateResourceManager", "173": "NtCreateSemaphore", "174": "NtCreateSymbolicLinkObject", "175": "NtCreateThreadEx", "176": "NtCreateTimer", "177": "NtCreateToken", "178": "NtCreateTokenEx", "179": "NtCreateTransaction", "180": "NtCreateTransactionManager", "181": "NtCreateUserProcess", "182": "NtCreateWaitCompletionPacket", "183": "NtCreateWaitablePort", "184": "NtCreateWnfStateName", "185": "NtCreateWorkerFactory", "186": "NtDebugActiveProcess", "187": "NtDebugContinue", "188": "NtDeleteAtom", "189": "NtDeleteBootEntry", "190": "NtDeleteDriverEntry", "191": "NtDeleteFile", "192": "NtDeleteKey", "193": "NtDeleteObjectAuditAlarm", "194": "NtDeletePrivateNamespace", "195": "NtDeleteValueKey", "196": "NtDeleteWnfStateData", "197": "NtDeleteWnfStateName", "198": "NtDisableLastKnownGood", "199": "NtDisplayString", "200": "NtDrawText", "201": "NtEnableLastKnownGood", "202": "NtEnumerateBootEntries", "203": "NtEnumerateDriverEntries", "204": "NtEnumerateSystemEnvironmentValuesEx", "205": "NtEnumerateTransactionObject", "206": "NtExtendSection", "207": "NtFilterBootOption", "208": "NtFilterToken", "209": "NtFilterTokenEx", "210": "NtFlushBuffersFileEx", "211": "NtFlushInstallUILanguage", "212": "NtFlushInstructionCache", "213": "NtFlushKey", "214": "NtFlushProcessWriteBuffers", "215": "NtFlushVirtualMemory", "216": "NtFlushWriteBuffer", "217": "NtFreeUserPhysicalPages", "218": "NtFreezeRegistry", "219": "NtFreezeTransactions", "220": "NtGetCachedSigningLevel", "221": "NtGetContextThread", "222": "NtGetCurrentProcessorNumber", "223": "NtGetDevicePowerState", "224": "NtGetMUIRegistryInfo", "225": "NtGetNextProcess", "226": "NtGetNextThread", "227": "NtGetNlsSectionPtr", "228": "NtGetNotificationResourceManager", "229": "NtGetWriteWatch", "230": "NtImpersonateAnonymousToken", "231": "NtImpersonateThread", "232": "NtInitializeNlsFiles", "233": "NtInitializeRegistry", "234": "NtInitiatePowerAction", "235": "NtIsSystemResumeAutomatic", "236": "NtIsUILanguageComitted", "237": "NtListenPort", "238": "NtLoadDriver", "239": "NtLoadKey", "240": "NtLoadKey2", "241": "NtLoadKeyEx", "242": "NtLockFile", "243": "NtLockProductActivationKeys", "244": "NtLockRegistryKey", "245": "NtLockVirtualMemory", "246": "NtMakePermanentObject", "247": "NtMakeTemporaryObject", "248": "NtMapCMFModule", "249": "NtMapUserPhysicalPages", "250": "NtModifyBootEntry", "251": "NtModifyDriverEntry", "252": "NtNotifyChangeDirectoryFile", "253": "NtNotifyChangeKey", "254": "NtNotifyChangeMultipleKeys", "255": "NtNotifyChangeSession", "256": "NtOpenEnlistment", "257": "NtOpenEventPair", "258": "NtOpenIoCompletion", "259": "NtOpenJobObject", "260": "NtOpenKeyEx", "261": "NtOpenKeyTransacted", "262": "NtOpenKeyTransactedEx", "263": "NtOpenKeyedEvent", "264": "NtOpenMutant", "265": "NtOpenObjectAuditAlarm", "266": "NtOpenPrivateNamespace", "267": "NtOpenProcessToken", "268": "NtOpenResourceManager", "269": "NtOpenSemaphore", "270": "NtOpenSession", "271": "NtOpenSymbolicLinkObject", "272": "NtOpenThread", "273": "NtOpenTimer", "274": "NtOpenTransaction", "275": "NtOpenTransactionManager", "276": "NtPlugPlayControl", "277": "NtPrePrepareComplete", "278": "NtPrePrepareEnlistment", "279": "NtPrepareComplete", "280": "NtPrepareEnlistment", "281": "NtPrivilegeCheck", "282": "NtPrivilegeObjectAuditAlarm", "283": "NtPrivilegedServiceAuditAlarm", "284": "NtPropagationComplete", "285": "NtPropagationFailed", "286": "NtPulseEvent", "287": "NtQueryBootEntryOrder", "288": "NtQueryBootOptions", "289": "NtQueryDebugFilterState", "290": "NtQueryDirectoryObject", "291": "NtQueryDriverEntryOrder", "292": "NtQueryEaFile", "293": "NtQueryFullAttributesFile", "294": "NtQueryInformationAtom", "295": "NtQueryInformationEnlistment", "296": "NtQueryInformationJobObject", "297": "NtQueryInformationPort", "298": "NtQueryInformationResourceManager", "299": "NtQueryInformationTransaction", "300": "NtQueryInformationTransactionManager", "301": "NtQueryInformationWorkerFactory", "302": "NtQueryInstallUILanguage", "303": "NtQueryIntervalProfile", "304": "NtQueryIoCompletion", "305": "NtQueryLicenseValue", "306": "NtQueryMultipleValueKey", "307": "NtQueryMutant", "308": "NtQueryOpenSubKeys", "309": "NtQueryOpenSubKeysEx", "310": "NtQueryPortInformationProcess", "311": "NtQueryQuotaInformationFile", "312": "NtQuerySecurityAttributesToken", "313": "NtQuerySecurityObject", "314": "NtQuerySemaphore", "315": "NtQuerySymbolicLinkObject", "316": "NtQuerySystemEnvironmentValue", "317": "NtQuerySystemEnvironmentValueEx", "318": "NtQuerySystemInformationEx", "319": "NtQueryTimerResolution", "320": "NtQueryWnfStateData", "321": "NtQueryWnfStateNameInformation", "322": "NtQueueApcThreadEx", "323": "NtRaiseException", "324": "NtRaiseHardError", "325": "NtReadOnlyEnlistment", "326": "NtRecoverEnlistment", "327": "NtRecoverResourceManager", "328": "NtRecoverTransactionManager", "329": "NtRegisterProtocolAddressInformation", "330": "NtRegisterThreadTerminatePort", "331": "NtReleaseKeyedEvent", "332": "NtReleaseWorkerFactoryWorker", "333": "NtRemoveIoCompletionEx", "334": "NtRemoveProcessDebug", "335": "NtRenameKey", "336": "NtRenameTransactionManager", "337": "NtReplaceKey", "338": "NtReplacePartitionUnit", "339": "NtReplyWaitReplyPort", "340": "NtRequestPort", "341": "NtResetEvent", "342": "NtResetWriteWatch", "343": "NtRestoreKey", "344": "NtResumeProcess", "345": "NtRollbackComplete", "346": "NtRollbackEnlistment", "347": "NtRollbackTransaction", "348": "NtRollforwardTransactionManager", "349": "NtSaveKey", "350": "NtSaveKeyEx", "351": "NtSaveMergedKeys", "352": "NtSecureConnectPort", "353": "NtSerializeBoot", "354": "NtSetBootEntryOrder", "355": "NtSetBootOptions", "356": "NtSetCachedSigningLevel", "357": "NtSetContextThread", "358": "NtSetDebugFilterState", "359": "NtSetDefaultHardErrorPort", "360": "NtSetDefaultLocale", "361": "NtSetDefaultUILanguage", "362": "NtSetDriverEntryOrder", "363": "NtSetEaFile", "364": "NtSetHighEventPair", "365": "NtSetHighWaitLowEventPair", "366": "NtSetIRTimer", "367": "NtSetInformationDebugObject", "368": "NtSetInformationEnlistment", "369": "NtSetInformationJobObject", "370": "NtSetInformationKey", "371": "NtSetInformationResourceManager", "372": "NtSetInformationToken", "373": "NtSetInformationTransaction", "374": "NtSetInformationTransactionManager", "375": "NtSetInformationVirtualMemory", "376": "NtSetInformationWorkerFactory", "377": "NtSetIntervalProfile", "378": "NtSetIoCompletion", "379": "NtSetIoCompletionEx", "380": "NtSetLdtEntries", "381": "NtSetLowEventPair", "382": "NtSetLowWaitHighEventPair", "383": "NtSetQuotaInformationFile", "384": "NtSetSecurityObject", "385": "NtSetSystemEnvironmentValue", "386": "NtSetSystemEnvironmentValueEx", "387": "NtSetSystemInformation", "388": "NtSetSystemPowerState", "389": "NtSetSystemTime", "390": "NtSetThreadExecutionState", "391": "NtSetTimerEx", "392": "NtSetTimerResolution", "393": "NtSetUuidSeed", "394": "NtSetVolumeInformationFile", "395": "NtShutdownSystem", "396": "NtShutdownWorkerFactory", "397": "NtSignalAndWaitForSingleObject", "398": "NtSinglePhaseReject", "399": "NtStartProfile", "400": "NtStopProfile", "401": "NtSubscribeWnfStateChange", "402": "NtSuspendProcess", "403": "NtSuspendThread", "404": "NtSystemDebugControl", "405": "NtTerminateJobObject", "406": "NtTestAlert", "407": "NtThawRegistry", "408": "NtThawTransactions", "409": "NtTraceControl", "410": "NtTranslateFilePath", "411": "NtUmsThreadYield", "412": "NtUnloadDriver", "413": "NtUnloadKey", "414": "NtUnloadKey2", "415": "NtUnloadKeyEx", "416": "NtUnlockFile", "417": "NtUnlockVirtualMemory", "418": "NtUnmapViewOfSectionEx", "419": "NtUnsubscribeWnfStateChange", "420": "NtUpdateWnfStateData", "421": "NtVdmControl", "422": "NtWaitForAlertByThreadId", "423": "NtWaitForDebugEvent", "424": "NtWaitForKeyedEvent", "425": "NtWaitForWnfNotifications", "426": "NtWaitForWorkViaWorkerFactory", "427": "NtWaitHighEventPair", "428": "NtWaitLowEventPair"}, "R2": {"0": "NtWorkerFactoryWorkerReady", "1": "NtAcceptConnectPort", "2": "NtMapUserPhysicalPagesScatter", "3": "NtWaitForSingleObject", "4": "NtCallbackReturn", "5": "NtReadFile", "6": "NtDeviceIoControlFile", "7": "NtWriteFile", "8": "NtRemoveIoCompletion", "9": "NtReleaseSemaphore", "10": "NtReplyWaitReceivePort", "11": "NtReplyPort", "12": "NtSetInformationThread", "13": "NtSetEvent", "14": "NtClose", "15": "NtQueryObject", "16": "NtQueryInformationFile", "17": "NtOpenKey", "18": "NtEnumerateValueKey", "19": "NtFindAtom", "20": "NtQueryDefaultLocale", "21": "NtQueryKey", "22": "NtQueryValueKey", "23": "NtAllocateVirtualMemory", "24": "NtQueryInformationProcess", "25": "NtWaitForMultipleObjects32", "26": "NtWriteFileGather", "27": "NtSetInformationProcess", "28": "NtCreateKey", "29": "NtFreeVirtualMemory", "30": "NtImpersonateClientOfPort", "31": "NtReleaseMutant", "32": "NtQueryInformationToken", "33": "NtRequestWaitReplyPort", "34": "NtQueryVirtualMemory", "35": "NtOpenThreadToken", "36": "NtQueryInformationThread", "37": "NtOpenProcess", "38": "NtSetInformationFile", "39": "NtMapViewOfSection", "40": "NtAccessCheckAndAuditAlarm", "41": "NtUnmapViewOfSection", "42": "NtReplyWaitReceivePortEx", "43": "NtTerminateProcess", "44": "NtSetEventBoostPriority", "45": "NtReadFileScatter", "46": "NtOpenThreadTokenEx", "47": "NtOpenProcessTokenEx", "48": "NtQueryPerformanceCounter", "49": "NtEnumerateKey", "50": "NtOpenFile", "51": "NtDelayExecution", "52": "NtQueryDirectoryFile", "53": "NtQuerySystemInformation", "54": "NtOpenSection", "55": "NtQueryTimer", "56": "NtFsControlFile", "57": "NtWriteVirtualMemory", "58": "NtCloseObjectAuditAlarm", "59": "NtDuplicateObject", "60": "NtQueryAttributesFile", "61": "NtClearEvent", "62": "NtReadVirtualMemory", "63": "NtOpenEvent", "64": "NtAdjustPrivilegesToken", "65": "NtDuplicateToken", "66": "NtContinue", "67": "NtQueryDefaultUILanguage", "68": "NtQueueApcThread", "69": "NtYieldExecution", "70": "NtAddAtom", "71": "NtCreateEvent", "72": "NtQueryVolumeInformationFile", "73": "NtCreateSection", "74": "NtFlushBuffersFile", "75": "NtApphelpCacheControl", "76": "NtCreateProcessEx", "77": "NtCreateThread", "78": "NtIsProcessInJob", "79": "NtProtectVirtualMemory", "80": "NtQuerySection", "81": "NtResumeThread", "82": "NtTerminateThread", "83": "NtReadRequestData", "84": "NtCreateFile", "85": "NtQueryEvent", "86": "NtWriteRequestData", "87": "NtOpenDirectoryObject", "88": "NtAccessCheckByTypeAndAuditAlarm", "89": "NtQuerySystemTime", "90": "NtWaitForMultipleObjects", "91": "NtSetInformationObject", "92": "NtCancelIoFile", "93": "NtTraceEvent", "94": "NtPowerInformation", "95": "NtSetValueKey", "96": "NtCancelTimer", "97": "NtSetTimer", "98": "NtAccessCheck", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientOfPort", "130": "NtAlpcOpenSenderProcess", "131": "NtAlpcOpenSenderThread", "132": "NtAlpcQueryInformation", "133": "NtAlpcQueryInformationMessage", "134": "NtAlpcRevokeSecurityContext", "135": "NtAlpcSendWaitReceivePort", "136": "NtAlpcSetInformation", "137": "NtAreMappedFilesTheSame", "138": "NtAssignProcessToJobObject", "139": "NtAssociateWaitCompletionPacket", "140": "NtCancelIoFileEx", "141": "NtCancelSynchronousIoFile", "142": "NtCancelTimer2", "143": "NtCancelWaitCompletionPacket", "144": "NtCommitComplete", "145": "NtCommitEnlistment", "146": "NtCommitTransaction", "147": "NtCompactKeys", "148": "NtCompareTokens", "149": "NtCompleteConnectPort", "150": "NtCompressKey", "151": "NtConnectPort", "152": "NtCreateDebugObject", "153": "NtCreateDirectoryObject", "154": "NtCreateDirectoryObjectEx", "155": "NtCreateEnlistment", "156": "NtCreateEventPair", "157": "NtCreateIRTimer", "158": "NtCreateIoCompletion", "159": "NtCreateJobObject", "160": "NtCreateJobSet", "161": "NtCreateKeyTransacted", "162": "NtCreateKeyedEvent", "163": "NtCreateLowBoxToken", "164": "NtCreateMailslotFile", "165": "NtCreateMutant", "166": "NtCreateNamedPipeFile", "167": "NtCreatePagingFile", "168": "NtCreatePort", "169": "NtCreatePrivateNamespace", "170": "NtCreateProcess", "171": "NtCreateProfile", "172": "NtCreateProfileEx", "173": "NtCreateResourceManager", "174": "NtCreateSemaphore", "175": "NtCreateSymbolicLinkObject", "176": "NtCreateThreadEx", "177": "NtCreateTimer", "178": "NtCreateTimer2", "179": "NtCreateToken", "180": "NtCreateTokenEx", "181": "NtCreateTransaction", "182": "NtCreateTransactionManager", "183": "NtCreateUserProcess", "184": "NtCreateWaitCompletionPacket", "185": "NtCreateWaitablePort", "186": "NtCreateWnfStateName", "187": "NtCreateWorkerFactory", "188": "NtDebugActiveProcess", "189": "NtDebugContinue", "190": "NtDeleteAtom", "191": "NtDeleteBootEntry", "192": "NtDeleteDriverEntry", "193": "NtDeleteFile", "194": "NtDeleteKey", "195": "NtDeleteObjectAuditAlarm", "196": "NtDeletePrivateNamespace", "197": "NtDeleteValueKey", "198": "NtDeleteWnfStateData", "199": "NtDeleteWnfStateName", "200": "NtDisableLastKnownGood", "201": "NtDisplayString", "202": "NtDrawText", "203": "NtEnableLastKnownGood", "204": "NtEnumerateBootEntries", "205": "NtEnumerateDriverEntries", "206": "NtEnumerateSystemEnvironmentValuesEx", "207": "NtEnumerateTransactionObject", "208": "NtExtendSection", "209": "NtFilterBootOption", "210": "NtFilterToken", "211": "NtFilterTokenEx", "212": "NtFlushBuffersFileEx", "213": "NtFlushInstallUILanguage", "214": "NtFlushInstructionCache", "215": "NtFlushKey", "216": "NtFlushProcessWriteBuffers", "217": "NtFlushVirtualMemory", "218": "NtFlushWriteBuffer", "219": "NtFreeUserPhysicalPages", "220": "NtFreezeRegistry", "221": "NtFreezeTransactions", "222": "NtGetCachedSigningLevel", "223": "NtGetCompleteWnfStateSubscription", "224": "NtGetContextThread", "225": "NtGetCurrentProcessorNumber", "226": "NtGetDevicePowerState", "227": "NtGetMUIRegistryInfo", "228": "NtGetNextProcess", "229": "NtGetNextThread", "230": "NtGetNlsSectionPtr", "231": "NtGetNotificationResourceManager", "232": "NtGetWriteWatch", "233": "NtImpersonateAnonymousToken", "234": "NtImpersonateThread", "235": "NtInitializeNlsFiles", "236": "NtInitializeRegistry", "237": "NtInitiatePowerAction", "238": "NtIsSystemResumeAutomatic", "239": "NtIsUILanguageComitted", "240": "NtListenPort", "241": "NtLoadDriver", "242": "NtLoadKey", "243": "NtLoadKey2", "244": "NtLoadKeyEx", "245": "NtLockFile", "246": "NtLockProductActivationKeys", "247": "NtLockRegistryKey", "248": "NtLockVirtualMemory", "249": "NtMakePermanentObject", "250": "NtMakeTemporaryObject", "251": "NtMapCMFModule", "252": "NtMapUserPhysicalPages", "253": "NtModifyBootEntry", "254": "NtModifyDriverEntry", "255": "NtNotifyChangeDirectoryFile", "256": "NtNotifyChangeKey", "257": "NtNotifyChangeMultipleKeys", "258": "NtNotifyChangeSession", "259": "NtOpenEnlistment", "260": "NtOpenEventPair", "261": "NtOpenIoCompletion", "262": "NtOpenJobObject", "263": "NtOpenKeyEx", "264": "NtOpenKeyTransacted", "265": "NtOpenKeyTransactedEx", "266": "NtOpenKeyedEvent", "267": "NtOpenMutant", "268": "NtOpenObjectAuditAlarm", "269": "NtOpenPrivateNamespace", "270": "NtOpenProcessToken", "271": "NtOpenResourceManager", "272": "NtOpenSemaphore", "273": "NtOpenSession", "274": "NtOpenSymbolicLinkObject", "275": "NtOpenThread", "276": "NtOpenTimer", "277": "NtOpenTransaction", "278": "NtOpenTransactionManager", "279": "NtPlugPlayControl", "280": "NtPrePrepareComplete", "281": "NtPrePrepareEnlistment", "282": "NtPrepareComplete", "283": "NtPrepareEnlistment", "284": "NtPrivilegeCheck", "285": "NtPrivilegeObjectAuditAlarm", "286": "NtPrivilegedServiceAuditAlarm", "287": "NtPropagationComplete", "288": "NtPropagationFailed", "289": "NtPulseEvent", "290": "NtQueryBootEntryOrder", "291": "NtQueryBootOptions", "292": "NtQueryDebugFilterState", "293": "NtQueryDirectoryObject", "294": "NtQueryDriverEntryOrder", "295": "NtQueryEaFile", "296": "NtQueryFullAttributesFile", "297": "NtQueryInformationAtom", "298": "NtQueryInformationEnlistment", "299": "NtQueryInformationJobObject", "300": "NtQueryInformationPort", "301": "NtQueryInformationResourceManager", "302": "NtQueryInformationTransaction", "303": "NtQueryInformationTransactionManager", "304": "NtQueryInformationWorkerFactory", "305": "NtQueryInstallUILanguage", "306": "NtQueryIntervalProfile", "307": "NtQueryIoCompletion", "308": "NtQueryLicenseValue", "309": "NtQueryMultipleValueKey", "310": "NtQueryMutant", "311": "NtQueryOpenSubKeys", "312": "NtQueryOpenSubKeysEx", "313": "NtQueryPortInformationProcess", "314": "NtQueryQuotaInformationFile", "315": "NtQuerySecurityAttributesToken", "316": "NtQuerySecurityObject", "317": "NtQuerySemaphore", "318": "NtQuerySymbolicLinkObject", "319": "NtQuerySystemEnvironmentValue", "320": "NtQuerySystemEnvironmentValueEx", "321": "NtQuerySystemInformationEx", "322": "NtQueryTimerResolution", "323": "NtQueryWnfStateData", "324": "NtQueryWnfStateNameInformation", "325": "NtQueueApcThreadEx", "326": "NtRaiseException", "327": "NtRaiseHardError", "328": "NtReadOnlyEnlistment", "329": "NtRecoverEnlistment", "330": "NtRecoverResourceManager", "331": "NtRecoverTransactionManager", "332": "NtRegisterProtocolAddressInformation", "333": "NtRegisterThreadTerminatePort", "334": "NtReleaseKeyedEvent", "335": "NtReleaseWorkerFactoryWorker", "336": "NtRemoveIoCompletionEx", "337": "NtRemoveProcessDebug", "338": "NtRenameKey", "339": "NtRenameTransactionManager", "340": "NtReplaceKey", "341": "NtReplacePartitionUnit", "342": "NtReplyWaitReplyPort", "343": "NtRequestPort", "344": "NtResetEvent", "345": "NtResetWriteWatch", "346": "NtRestoreKey", "347": "NtResumeProcess", "348": "NtRollbackComplete", "349": "NtRollbackEnlistment", "350": "NtRollbackTransaction", "351": "NtRollforwardTransactionManager", "352": "NtSaveKey", "353": "NtSaveKeyEx", "354": "NtSaveMergedKeys", "355": "NtSecureConnectPort", "356": "NtSerializeBoot", "357": "NtSetBootEntryOrder", "358": "NtSetBootOptions", "359": "NtSetCachedSigningLevel", "360": "NtSetContextThread", "361": "NtSetDebugFilterState", "362": "NtSetDefaultHardErrorPort", "363": "NtSetDefaultLocale", "364": "NtSetDefaultUILanguage", "365": "NtSetDriverEntryOrder", "366": "NtSetEaFile", "367": "NtSetHighEventPair", "368": "NtSetHighWaitLowEventPair", "369": "NtSetIRTimer", "370": "NtSetInformationDebugObject", "371": "NtSetInformationEnlistment", "372": "NtSetInformationJobObject", "373": "NtSetInformationKey", "374": "NtSetInformationResourceManager", "375": "NtSetInformationToken", "376": "NtSetInformationTransaction", "377": "NtSetInformationTransactionManager", "378": "NtSetInformationVirtualMemory", "379": "NtSetInformationWorkerFactory", "380": "NtSetIntervalProfile", "381": "NtSetIoCompletion", "382": "NtSetIoCompletionEx", "383": "NtSetLdtEntries", "384": "NtSetLowEventPair", "385": "NtSetLowWaitHighEventPair", "386": "NtSetQuotaInformationFile", "387": "NtSetSecurityObject", "388": "NtSetSystemEnvironmentValue", "389": "NtSetSystemEnvironmentValueEx", "390": "NtSetSystemInformation", "391": "NtSetSystemPowerState", "392": "NtSetSystemTime", "393": "NtSetThreadExecutionState", "394": "NtSetTimer2", "395": "NtSetTimerEx", "396": "NtSetTimerResolution", "397": "NtSetUuidSeed", "398": "NtSetVolumeInformationFile", "399": "NtSetWnfProcessNotificationEvent", "400": "NtShutdownSystem", "401": "NtShutdownWorkerFactory", "402": "NtSignalAndWaitForSingleObject", "403": "NtSinglePhaseReject", "404": "NtStartProfile", "405": "NtStopProfile", "406": "NtSubscribeWnfStateChange", "407": "NtSuspendProcess", "408": "NtSuspendThread", "409": "NtSystemDebugControl", "410": "NtTerminateJobObject", "411": "NtTestAlert", "412": "NtThawRegistry", "413": "NtThawTransactions", "414": "NtTraceControl", "415": "NtTranslateFilePath", "416": "NtUmsThreadYield", "417": "NtUnloadDriver", "418": "NtUnloadKey", "419": "NtUnloadKey2", "420": "NtUnloadKeyEx", "421": "NtUnlockFile", "422": "NtUnlockVirtualMemory", "423": "NtUnmapViewOfSectionEx", "424": "NtUnsubscribeWnfStateChange", "425": "NtUpdateWnfStateData", "426": "NtVdmControl", "427": "NtWaitForAlertByThreadId", "428": "NtWaitForDebugEvent", "429": "NtWaitForKeyedEvent", "430": "NtWaitForWorkViaWorkerFactory", "431": "NtWaitHighEventPair", "432": "NtWaitLowEventPair"}}, "Windows 8": {"8.0": {"0": "NtWorkerFactoryWorkerReady", "1": "NtMapUserPhysicalPagesScatter", "2": "NtWaitForSingleObject", "3": "NtCallbackReturn", "4": "NtReadFile", "5": "NtDeviceIoControlFile", "6": "NtWriteFile", "7": "NtRemoveIoCompletion", "8": "NtReleaseSemaphore", "9": "NtReplyWaitReceivePort", "10": "NtReplyPort", "11": "NtSetInformationThread", "12": "NtSetEvent", "13": "NtClose", "14": "NtQueryObject", "15": "NtQueryInformationFile", "16": "NtOpenKey", "17": "NtEnumerateValueKey", "18": "NtFindAtom", "19": "NtQueryDefaultLocale", "20": "NtQueryKey", "21": "NtQueryValueKey", "22": "NtAllocateVirtualMemory", "23": "NtQueryInformationProcess", "24": "NtWaitForMultipleObjects32", "25": "NtWriteFileGather", "26": "NtSetInformationProcess", "27": "NtCreateKey", "28": "NtFreeVirtualMemory", "29": "NtImpersonateClientOfPort", "30": "NtReleaseMutant", "31": "NtQueryInformationToken", "32": "NtRequestWaitReplyPort", "33": "NtQueryVirtualMemory", "34": "NtOpenThreadToken", "35": "NtQueryInformationThread", "36": "NtOpenProcess", "37": "NtSetInformationFile", "38": "NtMapViewOfSection", "39": "NtAccessCheckAndAuditAlarm", "40": "NtUnmapViewOfSection", "41": "NtReplyWaitReceivePortEx", "42": "NtTerminateProcess", "43": "NtSetEventBoostPriority", "44": "NtReadFileScatter", "45": "NtOpenThreadTokenEx", "46": "NtOpenProcessTokenEx", "47": "NtQueryPerformanceCounter", "48": "NtEnumerateKey", "49": "NtOpenFile", "50": "NtDelayExecution", "51": "NtQueryDirectoryFile", "52": "NtQuerySystemInformation", "53": "NtOpenSection", "54": "NtQueryTimer", "55": "NtFsControlFile", "56": "NtWriteVirtualMemory", "57": "NtCloseObjectAuditAlarm", "58": "NtDuplicateObject", "59": "NtQueryAttributesFile", "60": "NtClearEvent", "61": "NtReadVirtualMemory", "62": "NtOpenEvent", "63": "NtAdjustPrivilegesToken", "64": "NtDuplicateToken", "65": "NtContinue", "66": "NtQueryDefaultUILanguage", "67": "NtQueueApcThread", "68": "NtYieldExecution", "69": "NtAddAtom", "70": "NtCreateEvent", "71": "NtQueryVolumeInformationFile", "72": "NtCreateSection", "73": "NtFlushBuffersFile", "74": "NtApphelpCacheControl", "75": "NtCreateProcessEx", "76": "NtCreateThread", "77": "NtIsProcessInJob", "78": "NtProtectVirtualMemory", "79": "NtQuerySection", "80": "NtResumeThread", "81": "NtTerminateThread", "82": "NtReadRequestData", "83": "NtCreateFile", "84": "NtQueryEvent", "85": "NtWriteRequestData", "86": "NtOpenDirectoryObject", "87": "NtAccessCheckByTypeAndAuditAlarm", "88": "NtQuerySystemTime", "89": "NtWaitForMultipleObjects", "90": "NtSetInformationObject", "91": "NtCancelIoFile", "92": "NtTraceEvent", "93": "NtPowerInformation", "94": "NtSetValueKey", "95": "NtCancelTimer", "96": "NtSetTimer", "97": "NtAcceptConnectPort", "98": "NtAccessCheck", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientOfPort", "130": "NtAlpcOpenSenderProcess", "131": "NtAlpcOpenSenderThread", "132": "NtAlpcQueryInformation", "133": "NtAlpcQueryInformationMessage", "134": "NtAlpcRevokeSecurityContext", "135": "NtAlpcSendWaitReceivePort", "136": "NtAlpcSetInformation", "137": "NtAreMappedFilesTheSame", "138": "NtAssignProcessToJobObject", "139": "NtAssociateWaitCompletionPacket", "140": "NtCancelIoFileEx", "141": "NtCancelSynchronousIoFile", "142": "NtCancelWaitCompletionPacket", "143": "NtCommitComplete", "144": "NtCommitEnlistment", "145": "NtCommitTransaction", "146": "NtCompactKeys", "147": "NtCompareTokens", "148": "NtCompleteConnectPort", "149": "NtCompressKey", "150": "NtConnectPort", "151": "NtCreateDebugObject", "152": "NtCreateDirectoryObject", "153": "NtCreateDirectoryObjectEx", "154": "NtCreateEnlistment", "155": "NtCreateEventPair", "156": "NtCreateIRTimer", "157": "NtCreateIoCompletion", "158": "NtCreateJobObject", "159": "NtCreateJobSet", "160": "NtCreateKeyTransacted", "161": "NtCreateKeyedEvent", "162": "NtCreateLowBoxToken", "163": "NtCreateMailslotFile", "164": "NtCreateMutant", "165": "NtCreateNamedPipeFile", "166": "NtCreatePagingFile", "167": "NtCreatePort", "168": "NtCreatePrivateNamespace", "169": "NtCreateProcess", "170": "NtCreateProfile", "171": "NtCreateProfileEx", "172": "NtCreateResourceManager", "173": "NtCreateSemaphore", "174": "NtCreateSymbolicLinkObject", "175": "NtCreateThreadEx", "176": "NtCreateTimer", "177": "NtCreateToken", "178": "NtCreateTokenEx", "179": "NtCreateTransaction", "180": "NtCreateTransactionManager", "181": "NtCreateUserProcess", "182": "NtCreateWaitCompletionPacket", "183": "NtCreateWaitablePort", "184": "NtCreateWnfStateName", "185": "NtCreateWorkerFactory", "186": "NtDebugActiveProcess", "187": "NtDebugContinue", "188": "NtDeleteAtom", "189": "NtDeleteBootEntry", "190": "NtDeleteDriverEntry", "191": "NtDeleteFile", "192": "NtDeleteKey", "193": "NtDeleteObjectAuditAlarm", "194": "NtDeletePrivateNamespace", "195": "NtDeleteValueKey", "196": "NtDeleteWnfStateData", "197": "NtDeleteWnfStateName", "198": "NtDisableLastKnownGood", "199": "NtDisplayString", "200": "NtDrawText", "201": "NtEnableLastKnownGood", "202": "NtEnumerateBootEntries", "203": "NtEnumerateDriverEntries", "204": "NtEnumerateSystemEnvironmentValuesEx", "205": "NtEnumerateTransactionObject", "206": "NtExtendSection", "207": "NtFilterBootOption", "208": "NtFilterToken", "209": "NtFilterTokenEx", "210": "NtFlushBuffersFileEx", "211": "NtFlushInstallUILanguage", "212": "NtFlushInstructionCache", "213": "NtFlushKey", "214": "NtFlushProcessWriteBuffers", "215": "NtFlushVirtualMemory", "216": "NtFlushWriteBuffer", "217": "NtFreeUserPhysicalPages", "218": "NtFreezeRegistry", "219": "NtFreezeTransactions", "220": "NtGetCachedSigningLevel", "221": "NtGetContextThread", "222": "NtGetCurrentProcessorNumber", "223": "NtGetDevicePowerState", "224": "NtGetMUIRegistryInfo", "225": "NtGetNextProcess", "226": "NtGetNextThread", "227": "NtGetNlsSectionPtr", "228": "NtGetNotificationResourceManager", "229": "NtGetWriteWatch", "230": "NtImpersonateAnonymousToken", "231": "NtImpersonateThread", "232": "NtInitializeNlsFiles", "233": "NtInitializeRegistry", "234": "NtInitiatePowerAction", "235": "NtIsSystemResumeAutomatic", "236": "NtIsUILanguageComitted", "237": "NtListenPort", "238": "NtLoadDriver", "239": "NtLoadKey", "240": "NtLoadKey2", "241": "NtLoadKeyEx", "242": "NtLockFile", "243": "NtLockProductActivationKeys", "244": "NtLockRegistryKey", "245": "NtLockVirtualMemory", "246": "NtMakePermanentObject", "247": "NtMakeTemporaryObject", "248": "NtMapCMFModule", "249": "NtMapUserPhysicalPages", "250": "NtModifyBootEntry", "251": "NtModifyDriverEntry", "252": "NtNotifyChangeDirectoryFile", "253": "NtNotifyChangeKey", "254": "NtNotifyChangeMultipleKeys", "255": "NtNotifyChangeSession", "256": "NtOpenEnlistment", "257": "NtOpenEventPair", "258": "NtOpenIoCompletion", "259": "NtOpenJobObject", "260": "NtOpenKeyEx", "261": "NtOpenKeyTransacted", "262": "NtOpenKeyTransactedEx", "263": "NtOpenKeyedEvent", "264": "NtOpenMutant", "265": "NtOpenObjectAuditAlarm", "266": "NtOpenPrivateNamespace", "267": "NtOpenProcessToken", "268": "NtOpenResourceManager", "269": "NtOpenSemaphore", "270": "NtOpenSession", "271": "NtOpenSymbolicLinkObject", "272": "NtOpenThread", "273": "NtOpenTimer", "274": "NtOpenTransaction", "275": "NtOpenTransactionManager", "276": "NtPlugPlayControl", "277": "NtPrePrepareComplete", "278": "NtPrePrepareEnlistment", "279": "NtPrepareComplete", "280": "NtPrepareEnlistment", "281": "NtPrivilegeCheck", "282": "NtPrivilegeObjectAuditAlarm", "283": "NtPrivilegedServiceAuditAlarm", "284": "NtPropagationComplete", "285": "NtPropagationFailed", "286": "NtPulseEvent", "287": "NtQueryBootEntryOrder", "288": "NtQueryBootOptions", "289": "NtQueryDebugFilterState", "290": "NtQueryDirectoryObject", "291": "NtQueryDriverEntryOrder", "292": "NtQueryEaFile", "293": "NtQueryFullAttributesFile", "294": "NtQueryInformationAtom", "295": "NtQueryInformationEnlistment", "296": "NtQueryInformationJobObject", "297": "NtQueryInformationPort", "298": "NtQueryInformationResourceManager", "299": "NtQueryInformationTransaction", "300": "NtQueryInformationTransactionManager", "301": "NtQueryInformationWorkerFactory", "302": "NtQueryInstallUILanguage", "303": "NtQueryIntervalProfile", "304": "NtQueryIoCompletion", "305": "NtQueryLicenseValue", "306": "NtQueryMultipleValueKey", "307": "NtQueryMutant", "308": "NtQueryOpenSubKeys", "309": "NtQueryOpenSubKeysEx", "310": "NtQueryPortInformationProcess", "311": "NtQueryQuotaInformationFile", "312": "NtQuerySecurityAttributesToken", "313": "NtQuerySecurityObject", "314": "NtQuerySemaphore", "315": "NtQuerySymbolicLinkObject", "316": "NtQuerySystemEnvironmentValue", "317": "NtQuerySystemEnvironmentValueEx", "318": "NtQuerySystemInformationEx", "319": "NtQueryTimerResolution", "320": "NtQueryWnfStateData", "321": "NtQueryWnfStateNameInformation", "322": "NtQueueApcThreadEx", "323": "NtRaiseException", "324": "NtRaiseHardError", "325": "NtReadOnlyEnlistment", "326": "NtRecoverEnlistment", "327": "NtRecoverResourceManager", "328": "NtRecoverTransactionManager", "329": "NtRegisterProtocolAddressInformation", "330": "NtRegisterThreadTerminatePort", "331": "NtReleaseKeyedEvent", "332": "NtReleaseWorkerFactoryWorker", "333": "NtRemoveIoCompletionEx", "334": "NtRemoveProcessDebug", "335": "NtRenameKey", "336": "NtRenameTransactionManager", "337": "NtReplaceKey", "338": "NtReplacePartitionUnit", "339": "NtReplyWaitReplyPort", "340": "NtRequestPort", "341": "NtResetEvent", "342": "NtResetWriteWatch", "343": "NtRestoreKey", "344": "NtResumeProcess", "345": "NtRollbackComplete", "346": "NtRollbackEnlistment", "347": "NtRollbackTransaction", "348": "NtRollforwardTransactionManager", "349": "NtSaveKey", "350": "NtSaveKeyEx", "351": "NtSaveMergedKeys", "352": "NtSecureConnectPort", "353": "NtSerializeBoot", "354": "NtSetBootEntryOrder", "355": "NtSetBootOptions", "356": "NtSetCachedSigningLevel", "357": "NtSetContextThread", "358": "NtSetDebugFilterState", "359": "NtSetDefaultHardErrorPort", "360": "NtSetDefaultLocale", "361": "NtSetDefaultUILanguage", "362": "NtSetDriverEntryOrder", "363": "NtSetEaFile", "364": "NtSetHighEventPair", "365": "NtSetHighWaitLowEventPair", "366": "NtSetIRTimer", "367": "NtSetInformationDebugObject", "368": "NtSetInformationEnlistment", "369": "NtSetInformationJobObject", "370": "NtSetInformationKey", "371": "NtSetInformationResourceManager", "372": "NtSetInformationToken", "373": "NtSetInformationTransaction", "374": "NtSetInformationTransactionManager", "375": "NtSetInformationVirtualMemory", "376": "NtSetInformationWorkerFactory", "377": "NtSetIntervalProfile", "378": "NtSetIoCompletion", "379": "NtSetIoCompletionEx", "380": "NtSetLdtEntries", "381": "NtSetLowEventPair", "382": "NtSetLowWaitHighEventPair", "383": "NtSetQuotaInformationFile", "384": "NtSetSecurityObject", "385": "NtSetSystemEnvironmentValue", "386": "NtSetSystemEnvironmentValueEx", "387": "NtSetSystemInformation", "388": "NtSetSystemPowerState", "389": "NtSetSystemTime", "390": "NtSetThreadExecutionState", "391": "NtSetTimerEx", "392": "NtSetTimerResolution", "393": "NtSetUuidSeed", "394": "NtSetVolumeInformationFile", "395": "NtShutdownSystem", "396": "NtShutdownWorkerFactory", "397": "NtSignalAndWaitForSingleObject", "398": "NtSinglePhaseReject", "399": "NtStartProfile", "400": "NtStopProfile", "401": "NtSubscribeWnfStateChange", "402": "NtSuspendProcess", "403": "NtSuspendThread", "404": "NtSystemDebugControl", "405": "NtTerminateJobObject", "406": "NtTestAlert", "407": "NtThawRegistry", "408": "NtThawTransactions", "409": "NtTraceControl", "410": "NtTranslateFilePath", "411": "NtUmsThreadYield", "412": "NtUnloadDriver", "413": "NtUnloadKey", "414": "NtUnloadKey2", "415": "NtUnloadKeyEx", "416": "NtUnlockFile", "417": "NtUnlockVirtualMemory", "418": "NtUnmapViewOfSectionEx", "419": "NtUnsubscribeWnfStateChange", "420": "NtUpdateWnfStateData", "421": "NtVdmControl", "422": "NtWaitForAlertByThreadId", "423": "NtWaitForDebugEvent", "424": "NtWaitForKeyedEvent", "425": "NtWaitForWnfNotifications", "426": "NtWaitForWorkViaWorkerFactory", "427": "NtWaitHighEventPair", "428": "NtWaitLowEventPair"}, "8.1": {"0": "NtWorkerFactoryWorkerReady", "1": "NtAcceptConnectPort", "2": "NtMapUserPhysicalPagesScatter", "3": "NtWaitForSingleObject", "4": "NtCallbackReturn", "5": "NtReadFile", "6": "NtDeviceIoControlFile", "7": "NtWriteFile", "8": "NtRemoveIoCompletion", "9": "NtReleaseSemaphore", "10": "NtReplyWaitReceivePort", "11": "NtReplyPort", "12": "NtSetInformationThread", "13": "NtSetEvent", "14": "NtClose", "15": "NtQueryObject", "16": "NtQueryInformationFile", "17": "NtOpenKey", "18": "NtEnumerateValueKey", "19": "NtFindAtom", "20": "NtQueryDefaultLocale", "21": "NtQueryKey", "22": "NtQueryValueKey", "23": "NtAllocateVirtualMemory", "24": "NtQueryInformationProcess", "25": "NtWaitForMultipleObjects32", "26": "NtWriteFileGather", "27": "NtSetInformationProcess", "28": "NtCreateKey", "29": "NtFreeVirtualMemory", "30": "NtImpersonateClientOfPort", "31": "NtReleaseMutant", "32": "NtQueryInformationToken", "33": "NtRequestWaitReplyPort", "34": "NtQueryVirtualMemory", "35": "NtOpenThreadToken", "36": "NtQueryInformationThread", "37": "NtOpenProcess", "38": "NtSetInformationFile", "39": "NtMapViewOfSection", "40": "NtAccessCheckAndAuditAlarm", "41": "NtUnmapViewOfSection", "42": "NtReplyWaitReceivePortEx", "43": "NtTerminateProcess", "44": "NtSetEventBoostPriority", "45": "NtReadFileScatter", "46": "NtOpenThreadTokenEx", "47": "NtOpenProcessTokenEx", "48": "NtQueryPerformanceCounter", "49": "NtEnumerateKey", "50": "NtOpenFile", "51": "NtDelayExecution", "52": "NtQueryDirectoryFile", "53": "NtQuerySystemInformation", "54": "NtOpenSection", "55": "NtQueryTimer", "56": "NtFsControlFile", "57": "NtWriteVirtualMemory", "58": "NtCloseObjectAuditAlarm", "59": "NtDuplicateObject", "60": "NtQueryAttributesFile", "61": "NtClearEvent", "62": "NtReadVirtualMemory", "63": "NtOpenEvent", "64": "NtAdjustPrivilegesToken", "65": "NtDuplicateToken", "66": "NtContinue", "67": "NtQueryDefaultUILanguage", "68": "NtQueueApcThread", "69": "NtYieldExecution", "70": "NtAddAtom", "71": "NtCreateEvent", "72": "NtQueryVolumeInformationFile", "73": "NtCreateSection", "74": "NtFlushBuffersFile", "75": "NtApphelpCacheControl", "76": "NtCreateProcessEx", "77": "NtCreateThread", "78": "NtIsProcessInJob", "79": "NtProtectVirtualMemory", "80": "NtQuerySection", "81": "NtResumeThread", "82": "NtTerminateThread", "83": "NtReadRequestData", "84": "NtCreateFile", "85": "NtQueryEvent", "86": "NtWriteRequestData", "87": "NtOpenDirectoryObject", "88": "NtAccessCheckByTypeAndAuditAlarm", "89": "NtQuerySystemTime", "90": "NtWaitForMultipleObjects", "91": "NtSetInformationObject", "92": "NtCancelIoFile", "93": "NtTraceEvent", "94": "NtPowerInformation", "95": "NtSetValueKey", "96": "NtCancelTimer", "97": "NtSetTimer", "98": "NtAccessCheck", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientOfPort", "130": "NtAlpcOpenSenderProcess", "131": "NtAlpcOpenSenderThread", "132": "NtAlpcQueryInformation", "133": "NtAlpcQueryInformationMessage", "134": "NtAlpcRevokeSecurityContext", "135": "NtAlpcSendWaitReceivePort", "136": "NtAlpcSetInformation", "137": "NtAreMappedFilesTheSame", "138": "NtAssignProcessToJobObject", "139": "NtAssociateWaitCompletionPacket", "140": "NtCancelIoFileEx", "141": "NtCancelSynchronousIoFile", "142": "NtCancelTimer2", "143": "NtCancelWaitCompletionPacket", "144": "NtCommitComplete", "145": "NtCommitEnlistment", "146": "NtCommitTransaction", "147": "NtCompactKeys", "148": "NtCompareTokens", "149": "NtCompleteConnectPort", "150": "NtCompressKey", "151": "NtConnectPort", "152": "NtCreateDebugObject", "153": "NtCreateDirectoryObject", "154": "NtCreateDirectoryObjectEx", "155": "NtCreateEnlistment", "156": "NtCreateEventPair", "157": "NtCreateIRTimer", "158": "NtCreateIoCompletion", "159": "NtCreateJobObject", "160": "NtCreateJobSet", "161": "NtCreateKeyTransacted", "162": "NtCreateKeyedEvent", "163": "NtCreateLowBoxToken", "164": "NtCreateMailslotFile", "165": "NtCreateMutant", "166": "NtCreateNamedPipeFile", "167": "NtCreatePagingFile", "168": "NtCreatePort", "169": "NtCreatePrivateNamespace", "170": "NtCreateProcess", "171": "NtCreateProfile", "172": "NtCreateProfileEx", "173": "NtCreateResourceManager", "174": "NtCreateSemaphore", "175": "NtCreateSymbolicLinkObject", "176": "NtCreateThreadEx", "177": "NtCreateTimer", "178": "NtCreateTimer2", "179": "NtCreateToken", "180": "NtCreateTokenEx", "181": "NtCreateTransaction", "182": "NtCreateTransactionManager", "183": "NtCreateUserProcess", "184": "NtCreateWaitCompletionPacket", "185": "NtCreateWaitablePort", "186": "NtCreateWnfStateName", "187": "NtCreateWorkerFactory", "188": "NtDebugActiveProcess", "189": "NtDebugContinue", "190": "NtDeleteAtom", "191": "NtDeleteBootEntry", "192": "NtDeleteDriverEntry", "193": "NtDeleteFile", "194": "NtDeleteKey", "195": "NtDeleteObjectAuditAlarm", "196": "NtDeletePrivateNamespace", "197": "NtDeleteValueKey", "198": "NtDeleteWnfStateData", "199": "NtDeleteWnfStateName", "200": "NtDisableLastKnownGood", "201": "NtDisplayString", "202": "NtDrawText", "203": "NtEnableLastKnownGood", "204": "NtEnumerateBootEntries", "205": "NtEnumerateDriverEntries", "206": "NtEnumerateSystemEnvironmentValuesEx", "207": "NtEnumerateTransactionObject", "208": "NtExtendSection", "209": "NtFilterBootOption", "210": "NtFilterToken", "211": "NtFilterTokenEx", "212": "NtFlushBuffersFileEx", "213": "NtFlushInstallUILanguage", "214": "NtFlushInstructionCache", "215": "NtFlushKey", "216": "NtFlushProcessWriteBuffers", "217": "NtFlushVirtualMemory", "218": "NtFlushWriteBuffer", "219": "NtFreeUserPhysicalPages", "220": "NtFreezeRegistry", "221": "NtFreezeTransactions", "222": "NtGetCachedSigningLevel", "223": "NtGetCompleteWnfStateSubscription", "224": "NtGetContextThread", "225": "NtGetCurrentProcessorNumber", "226": "NtGetDevicePowerState", "227": "NtGetMUIRegistryInfo", "228": "NtGetNextProcess", "229": "NtGetNextThread", "230": "NtGetNlsSectionPtr", "231": "NtGetNotificationResourceManager", "232": "NtGetWriteWatch", "233": "NtImpersonateAnonymousToken", "234": "NtImpersonateThread", "235": "NtInitializeNlsFiles", "236": "NtInitializeRegistry", "237": "NtInitiatePowerAction", "238": "NtIsSystemResumeAutomatic", "239": "NtIsUILanguageComitted", "240": "NtListenPort", "241": "NtLoadDriver", "242": "NtLoadKey", "243": "NtLoadKey2", "244": "NtLoadKeyEx", "245": "NtLockFile", "246": "NtLockProductActivationKeys", "247": "NtLockRegistryKey", "248": "NtLockVirtualMemory", "249": "NtMakePermanentObject", "250": "NtMakeTemporaryObject", "251": "NtMapCMFModule", "252": "NtMapUserPhysicalPages", "253": "NtModifyBootEntry", "254": "NtModifyDriverEntry", "255": "NtNotifyChangeDirectoryFile", "256": "NtNotifyChangeKey", "257": "NtNotifyChangeMultipleKeys", "258": "NtNotifyChangeSession", "259": "NtOpenEnlistment", "260": "NtOpenEventPair", "261": "NtOpenIoCompletion", "262": "NtOpenJobObject", "263": "NtOpenKeyEx", "264": "NtOpenKeyTransacted", "265": "NtOpenKeyTransactedEx", "266": "NtOpenKeyedEvent", "267": "NtOpenMutant", "268": "NtOpenObjectAuditAlarm", "269": "NtOpenPrivateNamespace", "270": "NtOpenProcessToken", "271": "NtOpenResourceManager", "272": "NtOpenSemaphore", "273": "NtOpenSession", "274": "NtOpenSymbolicLinkObject", "275": "NtOpenThread", "276": "NtOpenTimer", "277": "NtOpenTransaction", "278": "NtOpenTransactionManager", "279": "NtPlugPlayControl", "280": "NtPrePrepareComplete", "281": "NtPrePrepareEnlistment", "282": "NtPrepareComplete", "283": "NtPrepareEnlistment", "284": "NtPrivilegeCheck", "285": "NtPrivilegeObjectAuditAlarm", "286": "NtPrivilegedServiceAuditAlarm", "287": "NtPropagationComplete", "288": "NtPropagationFailed", "289": "NtPulseEvent", "290": "NtQueryBootEntryOrder", "291": "NtQueryBootOptions", "292": "NtQueryDebugFilterState", "293": "NtQueryDirectoryObject", "294": "NtQueryDriverEntryOrder", "295": "NtQueryEaFile", "296": "NtQueryFullAttributesFile", "297": "NtQueryInformationAtom", "298": "NtQueryInformationEnlistment", "299": "NtQueryInformationJobObject", "300": "NtQueryInformationPort", "301": "NtQueryInformationResourceManager", "302": "NtQueryInformationTransaction", "303": "NtQueryInformationTransactionManager", "304": "NtQueryInformationWorkerFactory", "305": "NtQueryInstallUILanguage", "306": "NtQueryIntervalProfile", "307": "NtQueryIoCompletion", "308": "NtQueryLicenseValue", "309": "NtQueryMultipleValueKey", "310": "NtQueryMutant", "311": "NtQueryOpenSubKeys", "312": "NtQueryOpenSubKeysEx", "313": "NtQueryPortInformationProcess", "314": "NtQueryQuotaInformationFile", "315": "NtQuerySecurityAttributesToken", "316": "NtQuerySecurityObject", "317": "NtQuerySemaphore", "318": "NtQuerySymbolicLinkObject", "319": "NtQuerySystemEnvironmentValue", "320": "NtQuerySystemEnvironmentValueEx", "321": "NtQuerySystemInformationEx", "322": "NtQueryTimerResolution", "323": "NtQueryWnfStateData", "324": "NtQueryWnfStateNameInformation", "325": "NtQueueApcThreadEx", "326": "NtRaiseException", "327": "NtRaiseHardError", "328": "NtReadOnlyEnlistment", "329": "NtRecoverEnlistment", "330": "NtRecoverResourceManager", "331": "NtRecoverTransactionManager", "332": "NtRegisterProtocolAddressInformation", "333": "NtRegisterThreadTerminatePort", "334": "NtReleaseKeyedEvent", "335": "NtReleaseWorkerFactoryWorker", "336": "NtRemoveIoCompletionEx", "337": "NtRemoveProcessDebug", "338": "NtRenameKey", "339": "NtRenameTransactionManager", "340": "NtReplaceKey", "341": "NtReplacePartitionUnit", "342": "NtReplyWaitReplyPort", "343": "NtRequestPort", "344": "NtResetEvent", "345": "NtResetWriteWatch", "346": "NtRestoreKey", "347": "NtResumeProcess", "348": "NtRollbackComplete", "349": "NtRollbackEnlistment", "350": "NtRollbackTransaction", "351": "NtRollforwardTransactionManager", "352": "NtSaveKey", "353": "NtSaveKeyEx", "354": "NtSaveMergedKeys", "355": "NtSecureConnectPort", "356": "NtSerializeBoot", "357": "NtSetBootEntryOrder", "358": "NtSetBootOptions", "359": "NtSetCachedSigningLevel", "360": "NtSetContextThread", "361": "NtSetDebugFilterState", "362": "NtSetDefaultHardErrorPort", "363": "NtSetDefaultLocale", "364": "NtSetDefaultUILanguage", "365": "NtSetDriverEntryOrder", "366": "NtSetEaFile", "367": "NtSetHighEventPair", "368": "NtSetHighWaitLowEventPair", "369": "NtSetIRTimer", "370": "NtSetInformationDebugObject", "371": "NtSetInformationEnlistment", "372": "NtSetInformationJobObject", "373": "NtSetInformationKey", "374": "NtSetInformationResourceManager", "375": "NtSetInformationToken", "376": "NtSetInformationTransaction", "377": "NtSetInformationTransactionManager", "378": "NtSetInformationVirtualMemory", "379": "NtSetInformationWorkerFactory", "380": "NtSetIntervalProfile", "381": "NtSetIoCompletion", "382": "NtSetIoCompletionEx", "383": "NtSetLdtEntries", "384": "NtSetLowEventPair", "385": "NtSetLowWaitHighEventPair", "386": "NtSetQuotaInformationFile", "387": "NtSetSecurityObject", "388": "NtSetSystemEnvironmentValue", "389": "NtSetSystemEnvironmentValueEx", "390": "NtSetSystemInformation", "391": "NtSetSystemPowerState", "392": "NtSetSystemTime", "393": "NtSetThreadExecutionState", "394": "NtSetTimer2", "395": "NtSetTimerEx", "396": "NtSetTimerResolution", "397": "NtSetUuidSeed", "398": "NtSetVolumeInformationFile", "399": "NtSetWnfProcessNotificationEvent", "400": "NtShutdownSystem", "401": "NtShutdownWorkerFactory", "402": "NtSignalAndWaitForSingleObject", "403": "NtSinglePhaseReject", "404": "NtStartProfile", "405": "NtStopProfile", "406": "NtSubscribeWnfStateChange", "407": "NtSuspendProcess", "408": "NtSuspendThread", "409": "NtSystemDebugControl", "410": "NtTerminateJobObject", "411": "NtTestAlert", "412": "NtThawRegistry", "413": "NtThawTransactions", "414": "NtTraceControl", "415": "NtTranslateFilePath", "416": "NtUmsThreadYield", "417": "NtUnloadDriver", "418": "NtUnloadKey", "419": "NtUnloadKey2", "420": "NtUnloadKeyEx", "421": "NtUnlockFile", "422": "NtUnlockVirtualMemory", "423": "NtUnmapViewOfSectionEx", "424": "NtUnsubscribeWnfStateChange", "425": "NtUpdateWnfStateData", "426": "NtVdmControl", "427": "NtWaitForAlertByThreadId", "428": "NtWaitForDebugEvent", "429": "NtWaitForKeyedEvent", "430": "NtWaitForWorkViaWorkerFactory", "431": "NtWaitHighEventPair", "432": "NtWaitLowEventPair"}}, "Windows 10": {"1507": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientContainerOfPort", "130": "NtAlpcImpersonateClientOfPort", "131": "NtAlpcOpenSenderProcess", "132": "NtAlpcOpenSenderThread", "133": "NtAlpcQueryInformation", "134": "NtAlpcQueryInformationMessage", "135": "NtAlpcRevokeSecurityContext", "136": "NtAlpcSendWaitReceivePort", "137": "NtAlpcSetInformation", "138": "NtAreMappedFilesTheSame", "139": "NtAssignProcessToJobObject", "140": "NtAssociateWaitCompletionPacket", "141": "NtCancelIoFileEx", "142": "NtCancelSynchronousIoFile", "143": "NtCancelTimer2", "144": "NtCancelWaitCompletionPacket", "145": "NtCommitComplete", "146": "NtCommitEnlistment", "147": "NtCommitTransaction", "148": "NtCompactKeys", "149": "NtCompareObjects", "150": "NtCompareTokens", "151": "NtCompleteConnectPort", "152": "NtCompressKey", "153": "NtConnectPort", "154": "NtCreateDebugObject", "155": "NtCreateDirectoryObject", "156": "NtCreateDirectoryObjectEx", "157": "NtCreateEnlistment", "158": "NtCreateEventPair", "159": "NtCreateIRTimer", "160": "NtCreateIoCompletion", "161": "NtCreateJobObject", "162": "NtCreateJobSet", "163": "NtCreateKeyTransacted", "164": "NtCreateKeyedEvent", "165": "NtCreateLowBoxToken", "166": "NtCreateMailslotFile", "167": "NtCreateMutant", "168": "NtCreateNamedPipeFile", "169": "NtCreatePagingFile", "170": "NtCreatePartition", "171": "NtCreatePort", "172": "NtCreatePrivateNamespace", "173": "NtCreateProcess", "174": "NtCreateProfile", "175": "NtCreateProfileEx", "176": "NtCreateResourceManager", "177": "NtCreateSemaphore", "178": "NtCreateSymbolicLinkObject", "179": "NtCreateThreadEx", "180": "NtCreateTimer", "181": "NtCreateTimer2", "182": "NtCreateToken", "183": "NtCreateTokenEx", "184": "NtCreateTransaction", "185": "NtCreateTransactionManager", "186": "NtCreateUserProcess", "187": "NtCreateWaitCompletionPacket", "188": "NtCreateWaitablePort", "189": "NtCreateWnfStateName", "190": "NtCreateWorkerFactory", "191": "NtDebugActiveProcess", "192": "NtDebugContinue", "193": "NtDeleteAtom", "194": "NtDeleteBootEntry", "195": "NtDeleteDriverEntry", "196": "NtDeleteFile", "197": "NtDeleteKey", "198": "NtDeleteObjectAuditAlarm", "199": "NtDeletePrivateNamespace", "200": "NtDeleteValueKey", "201": "NtDeleteWnfStateData", "202": "NtDeleteWnfStateName", "203": "NtDisableLastKnownGood", "204": "NtDisplayString", "205": "NtDrawText", "206": "NtEnableLastKnownGood", "207": "NtEnumerateBootEntries", "208": "NtEnumerateDriverEntries", "209": "NtEnumerateSystemEnvironmentValuesEx", "210": "NtEnumerateTransactionObject", "211": "NtExtendSection", "212": "NtFilterBootOption", "213": "NtFilterToken", "214": "NtFilterTokenEx", "215": "NtFlushBuffersFileEx", "216": "NtFlushInstallUILanguage", "217": "NtFlushInstructionCache", "218": "NtFlushKey", "219": "NtFlushProcessWriteBuffers", "220": "NtFlushVirtualMemory", "221": "NtFlushWriteBuffer", "222": "NtFreeUserPhysicalPages", "223": "NtFreezeRegistry", "224": "NtFreezeTransactions", "225": "NtGetCachedSigningLevel", "226": "NtGetCompleteWnfStateSubscription", "227": "NtGetContextThread", "228": "NtGetCurrentProcessorNumber", "229": "NtGetCurrentProcessorNumberEx", "230": "NtGetDevicePowerState", "231": "NtGetMUIRegistryInfo", "232": "NtGetNextProcess", "233": "NtGetNextThread", "234": "NtGetNlsSectionPtr", "235": "NtGetNotificationResourceManager", "236": "NtGetWriteWatch", "237": "NtImpersonateAnonymousToken", "238": "NtImpersonateThread", "239": "NtInitializeNlsFiles", "240": "NtInitializeRegistry", "241": "NtInitiatePowerAction", "242": "NtIsSystemResumeAutomatic", "243": "NtIsUILanguageComitted", "244": "NtListenPort", "245": "NtLoadDriver", "246": "NtLoadKey", "247": "NtLoadKey2", "248": "NtLoadKeyEx", "249": "NtLockFile", "250": "NtLockProductActivationKeys", "251": "NtLockRegistryKey", "252": "NtLockVirtualMemory", "253": "NtMakePermanentObject", "254": "NtMakeTemporaryObject", "255": "NtManagePartition", "256": "NtMapCMFModule", "257": "NtMapUserPhysicalPages", "258": "NtModifyBootEntry", "259": "NtModifyDriverEntry", "260": "NtNotifyChangeDirectoryFile", "261": "NtNotifyChangeKey", "262": "NtNotifyChangeMultipleKeys", "263": "NtNotifyChangeSession", "264": "NtOpenEnlistment", "265": "NtOpenEventPair", "266": "NtOpenIoCompletion", "267": "NtOpenJobObject", "268": "NtOpenKeyEx", "269": "NtOpenKeyTransacted", "270": "NtOpenKeyTransactedEx", "271": "NtOpenKeyedEvent", "272": "NtOpenMutant", "273": "NtOpenObjectAuditAlarm", "274": "NtOpenPartition", "275": "NtOpenPrivateNamespace", "276": "NtOpenProcessToken", "277": "NtOpenResourceManager", "278": "NtOpenSemaphore", "279": "NtOpenSession", "280": "NtOpenSymbolicLinkObject", "281": "NtOpenThread", "282": "NtOpenTimer", "283": "NtOpenTransaction", "284": "NtOpenTransactionManager", "285": "NtPlugPlayControl", "286": "NtPrePrepareComplete", "287": "NtPrePrepareEnlistment", "288": "NtPrepareComplete", "289": "NtPrepareEnlistment", "290": "NtPrivilegeCheck", "291": "NtPrivilegeObjectAuditAlarm", "292": "NtPrivilegedServiceAuditAlarm", "293": "NtPropagationComplete", "294": "NtPropagationFailed", "295": "NtPulseEvent", "296": "NtQueryBootEntryOrder", "297": "NtQueryBootOptions", "298": "NtQueryDebugFilterState", "299": "NtQueryDirectoryObject", "300": "NtQueryDriverEntryOrder", "301": "NtQueryEaFile", "302": "NtQueryFullAttributesFile", "303": "NtQueryInformationAtom", "304": "NtQueryInformationEnlistment", "305": "NtQueryInformationJobObject", "306": "NtQueryInformationPort", "307": "NtQueryInformationResourceManager", "308": "NtQueryInformationTransaction", "309": "NtQueryInformationTransactionManager", "310": "NtQueryInformationWorkerFactory", "311": "NtQueryInstallUILanguage", "312": "NtQueryIntervalProfile", "313": "NtQueryIoCompletion", "314": "NtQueryLicenseValue", "315": "NtQueryMultipleValueKey", "316": "NtQueryMutant", "317": "NtQueryOpenSubKeys", "318": "NtQueryOpenSubKeysEx", "319": "NtQueryPortInformationProcess", "320": "NtQueryQuotaInformationFile", "321": "NtQuerySecurityAttributesToken", "322": "NtQuerySecurityObject", "323": "NtQuerySemaphore", "324": "NtQuerySymbolicLinkObject", "325": "NtQuerySystemEnvironmentValue", "326": "NtQuerySystemEnvironmentValueEx", "327": "NtQuerySystemInformationEx", "328": "NtQueryTimerResolution", "329": "NtQueryWnfStateData", "330": "NtQueryWnfStateNameInformation", "331": "NtQueueApcThreadEx", "332": "NtRaiseException", "333": "NtRaiseHardError", "334": "NtReadOnlyEnlistment", "335": "NtRecoverEnlistment", "336": "NtRecoverResourceManager", "337": "NtRecoverTransactionManager", "338": "NtRegisterProtocolAddressInformation", "339": "NtRegisterThreadTerminatePort", "340": "NtReleaseKeyedEvent", "341": "NtReleaseWorkerFactoryWorker", "342": "NtRemoveIoCompletionEx", "343": "NtRemoveProcessDebug", "344": "NtRenameKey", "345": "NtRenameTransactionManager", "346": "NtReplaceKey", "347": "NtReplacePartitionUnit", "348": "NtReplyWaitReplyPort", "349": "NtRequestPort", "350": "NtResetEvent", "351": "NtResetWriteWatch", "352": "NtRestoreKey", "353": "NtResumeProcess", "354": "NtRevertContainerImpersonation", "355": "NtRollbackComplete", "356": "NtRollbackEnlistment", "357": "NtRollbackTransaction", "358": "NtRollforwardTransactionManager", "359": "NtSaveKey", "360": "NtSaveKeyEx", "361": "NtSaveMergedKeys", "362": "NtSecureConnectPort", "363": "NtSerializeBoot", "364": "NtSetBootEntryOrder", "365": "NtSetBootOptions", "366": "NtSetCachedSigningLevel", "367": "NtSetContextThread", "368": "NtSetDebugFilterState", "369": "NtSetDefaultHardErrorPort", "370": "NtSetDefaultLocale", "371": "NtSetDefaultUILanguage", "372": "NtSetDriverEntryOrder", "373": "NtSetEaFile", "374": "NtSetHighEventPair", "375": "NtSetHighWaitLowEventPair", "376": "NtSetIRTimer", "377": "NtSetInformationDebugObject", "378": "NtSetInformationEnlistment", "379": "NtSetInformationJobObject", "380": "NtSetInformationKey", "381": "NtSetInformationResourceManager", "382": "NtSetInformationSymbolicLink", "383": "NtSetInformationToken", "384": "NtSetInformationTransaction", "385": "NtSetInformationTransactionManager", "386": "NtSetInformationVirtualMemory", "387": "NtSetInformationWorkerFactory", "388": "NtSetIntervalProfile", "389": "NtSetIoCompletion", "390": "NtSetIoCompletionEx", "391": "NtSetLdtEntries", "392": "NtSetLowEventPair", "393": "NtSetLowWaitHighEventPair", "394": "NtSetQuotaInformationFile", "395": "NtSetSecurityObject", "396": "NtSetSystemEnvironmentValue", "397": "NtSetSystemEnvironmentValueEx", "398": "NtSetSystemInformation", "399": "NtSetSystemPowerState", "400": "NtSetSystemTime", "401": "NtSetThreadExecutionState", "402": "NtSetTimer2", "403": "NtSetTimerEx", "404": "NtSetTimerResolution", "405": "NtSetUuidSeed", "406": "NtSetVolumeInformationFile", "407": "NtSetWnfProcessNotificationEvent", "408": "NtShutdownSystem", "409": "NtShutdownWorkerFactory", "410": "NtSignalAndWaitForSingleObject", "411": "NtSinglePhaseReject", "412": "NtStartProfile", "413": "NtStopProfile", "414": "NtSubscribeWnfStateChange", "415": "NtSuspendProcess", "416": "NtSuspendThread", "417": "NtSystemDebugControl", "418": "NtTerminateJobObject", "419": "NtTestAlert", "420": "NtThawRegistry", "421": "NtThawTransactions", "422": "NtTraceControl", "423": "NtTranslateFilePath", "424": "NtUmsThreadYield", "425": "NtUnloadDriver", "426": "NtUnloadKey", "427": "NtUnloadKey2", "428": "NtUnloadKeyEx", "429": "NtUnlockFile", "430": "NtUnlockVirtualMemory", "431": "NtUnmapViewOfSectionEx", "432": "NtUnsubscribeWnfStateChange", "433": "NtUpdateWnfStateData", "434": "NtVdmControl", "435": "NtWaitForAlertByThreadId", "436": "NtWaitForDebugEvent", "437": "NtWaitForKeyedEvent", "438": "NtWaitForWorkViaWorkerFactory", "439": "NtWaitHighEventPair", "440": "NtWaitLowEventPair"}, "1511": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientContainerOfPort", "130": "NtAlpcImpersonateClientOfPort", "131": "NtAlpcOpenSenderProcess", "132": "NtAlpcOpenSenderThread", "133": "NtAlpcQueryInformation", "134": "NtAlpcQueryInformationMessage", "135": "NtAlpcRevokeSecurityContext", "136": "NtAlpcSendWaitReceivePort", "137": "NtAlpcSetInformation", "138": "NtAreMappedFilesTheSame", "139": "NtAssignProcessToJobObject", "140": "NtAssociateWaitCompletionPacket", "141": "NtCancelIoFileEx", "142": "NtCancelSynchronousIoFile", "143": "NtCancelTimer2", "144": "NtCancelWaitCompletionPacket", "145": "NtCommitComplete", "146": "NtCommitEnlistment", "147": "NtCommitTransaction", "148": "NtCompactKeys", "149": "NtCompareObjects", "150": "NtCompareTokens", "151": "NtCompleteConnectPort", "152": "NtCompressKey", "153": "NtConnectPort", "154": "NtCreateDebugObject", "155": "NtCreateDirectoryObject", "156": "NtCreateDirectoryObjectEx", "157": "NtCreateEnclave", "158": "NtCreateEnlistment", "159": "NtCreateEventPair", "160": "NtCreateIRTimer", "161": "NtCreateIoCompletion", "162": "NtCreateJobObject", "163": "NtCreateJobSet", "164": "NtCreateKeyTransacted", "165": "NtCreateKeyedEvent", "166": "NtCreateLowBoxToken", "167": "NtCreateMailslotFile", "168": "NtCreateMutant", "169": "NtCreateNamedPipeFile", "170": "NtCreatePagingFile", "171": "NtCreatePartition", "172": "NtCreatePort", "173": "NtCreatePrivateNamespace", "174": "NtCreateProcess", "175": "NtCreateProfile", "176": "NtCreateProfileEx", "177": "NtCreateResourceManager", "178": "NtCreateSemaphore", "179": "NtCreateSymbolicLinkObject", "180": "NtCreateThreadEx", "181": "NtCreateTimer", "182": "NtCreateTimer2", "183": "NtCreateToken", "184": "NtCreateTokenEx", "185": "NtCreateTransaction", "186": "NtCreateTransactionManager", "187": "NtCreateUserProcess", "188": "NtCreateWaitCompletionPacket", "189": "NtCreateWaitablePort", "190": "NtCreateWnfStateName", "191": "NtCreateWorkerFactory", "192": "NtDebugActiveProcess", "193": "NtDebugContinue", "194": "NtDeleteAtom", "195": "NtDeleteBootEntry", "196": "NtDeleteDriverEntry", "197": "NtDeleteFile", "198": "NtDeleteKey", "199": "NtDeleteObjectAuditAlarm", "200": "NtDeletePrivateNamespace", "201": "NtDeleteValueKey", "202": "NtDeleteWnfStateData", "203": "NtDeleteWnfStateName", "204": "NtDisableLastKnownGood", "205": "NtDisplayString", "206": "NtDrawText", "207": "NtEnableLastKnownGood", "208": "NtEnumerateBootEntries", "209": "NtEnumerateDriverEntries", "210": "NtEnumerateSystemEnvironmentValuesEx", "211": "NtEnumerateTransactionObject", "212": "NtExtendSection", "213": "NtFilterBootOption", "214": "NtFilterToken", "215": "NtFilterTokenEx", "216": "NtFlushBuffersFileEx", "217": "NtFlushInstallUILanguage", "218": "NtFlushInstructionCache", "219": "NtFlushKey", "220": "NtFlushProcessWriteBuffers", "221": "NtFlushVirtualMemory", "222": "NtFlushWriteBuffer", "223": "NtFreeUserPhysicalPages", "224": "NtFreezeRegistry", "225": "NtFreezeTransactions", "226": "NtGetCachedSigningLevel", "227": "NtGetCompleteWnfStateSubscription", "228": "NtGetContextThread", "229": "NtGetCurrentProcessorNumber", "230": "NtGetCurrentProcessorNumberEx", "231": "NtGetDevicePowerState", "232": "NtGetMUIRegistryInfo", "233": "NtGetNextProcess", "234": "NtGetNextThread", "235": "NtGetNlsSectionPtr", "236": "NtGetNotificationResourceManager", "237": "NtGetWriteWatch", "238": "NtImpersonateAnonymousToken", "239": "NtImpersonateThread", "240": "NtInitializeEnclave", "241": "NtInitializeNlsFiles", "242": "NtInitializeRegistry", "243": "NtInitiatePowerAction", "244": "NtIsSystemResumeAutomatic", "245": "NtIsUILanguageComitted", "246": "NtListenPort", "247": "NtLoadDriver", "248": "NtLoadEnclaveData", "249": "NtLoadKey", "250": "NtLoadKey2", "251": "NtLoadKeyEx", "252": "NtLockFile", "253": "NtLockProductActivationKeys", "254": "NtLockRegistryKey", "255": "NtLockVirtualMemory", "256": "NtMakePermanentObject", "257": "NtMakeTemporaryObject", "258": "NtManagePartition", "259": "NtMapCMFModule", "260": "NtMapUserPhysicalPages", "261": "NtModifyBootEntry", "262": "NtModifyDriverEntry", "263": "NtNotifyChangeDirectoryFile", "264": "NtNotifyChangeKey", "265": "NtNotifyChangeMultipleKeys", "266": "NtNotifyChangeSession", "267": "NtOpenEnlistment", "268": "NtOpenEventPair", "269": "NtOpenIoCompletion", "270": "NtOpenJobObject", "271": "NtOpenKeyEx", "272": "NtOpenKeyTransacted", "273": "NtOpenKeyTransactedEx", "274": "NtOpenKeyedEvent", "275": "NtOpenMutant", "276": "NtOpenObjectAuditAlarm", "277": "NtOpenPartition", "278": "NtOpenPrivateNamespace", "279": "NtOpenProcessToken", "280": "NtOpenResourceManager", "281": "NtOpenSemaphore", "282": "NtOpenSession", "283": "NtOpenSymbolicLinkObject", "284": "NtOpenThread", "285": "NtOpenTimer", "286": "NtOpenTransaction", "287": "NtOpenTransactionManager", "288": "NtPlugPlayControl", "289": "NtPrePrepareComplete", "290": "NtPrePrepareEnlistment", "291": "NtPrepareComplete", "292": "NtPrepareEnlistment", "293": "NtPrivilegeCheck", "294": "NtPrivilegeObjectAuditAlarm", "295": "NtPrivilegedServiceAuditAlarm", "296": "NtPropagationComplete", "297": "NtPropagationFailed", "298": "NtPulseEvent", "299": "NtQueryBootEntryOrder", "300": "NtQueryBootOptions", "301": "NtQueryDebugFilterState", "302": "NtQueryDirectoryObject", "303": "NtQueryDriverEntryOrder", "304": "NtQueryEaFile", "305": "NtQueryFullAttributesFile", "306": "NtQueryInformationAtom", "307": "NtQueryInformationEnlistment", "308": "NtQueryInformationJobObject", "309": "NtQueryInformationPort", "310": "NtQueryInformationResourceManager", "311": "NtQueryInformationTransaction", "312": "NtQueryInformationTransactionManager", "313": "NtQueryInformationWorkerFactory", "314": "NtQueryInstallUILanguage", "315": "NtQueryIntervalProfile", "316": "NtQueryIoCompletion", "317": "NtQueryLicenseValue", "318": "NtQueryMultipleValueKey", "319": "NtQueryMutant", "320": "NtQueryOpenSubKeys", "321": "NtQueryOpenSubKeysEx", "322": "NtQueryPortInformationProcess", "323": "NtQueryQuotaInformationFile", "324": "NtQuerySecurityAttributesToken", "325": "NtQuerySecurityObject", "326": "NtQuerySemaphore", "327": "NtQuerySymbolicLinkObject", "328": "NtQuerySystemEnvironmentValue", "329": "NtQuerySystemEnvironmentValueEx", "330": "NtQuerySystemInformationEx", "331": "NtQueryTimerResolution", "332": "NtQueryWnfStateData", "333": "NtQueryWnfStateNameInformation", "334": "NtQueueApcThreadEx", "335": "NtRaiseException", "336": "NtRaiseHardError", "337": "NtReadOnlyEnlistment", "338": "NtRecoverEnlistment", "339": "NtRecoverResourceManager", "340": "NtRecoverTransactionManager", "341": "NtRegisterProtocolAddressInformation", "342": "NtRegisterThreadTerminatePort", "343": "NtReleaseKeyedEvent", "344": "NtReleaseWorkerFactoryWorker", "345": "NtRemoveIoCompletionEx", "346": "NtRemoveProcessDebug", "347": "NtRenameKey", "348": "NtRenameTransactionManager", "349": "NtReplaceKey", "350": "NtReplacePartitionUnit", "351": "NtReplyWaitReplyPort", "352": "NtRequestPort", "353": "NtResetEvent", "354": "NtResetWriteWatch", "355": "NtRestoreKey", "356": "NtResumeProcess", "357": "NtRevertContainerImpersonation", "358": "NtRollbackComplete", "359": "NtRollbackEnlistment", "360": "NtRollbackTransaction", "361": "NtRollforwardTransactionManager", "362": "NtSaveKey", "363": "NtSaveKeyEx", "364": "NtSaveMergedKeys", "365": "NtSecureConnectPort", "366": "NtSerializeBoot", "367": "NtSetBootEntryOrder", "368": "NtSetBootOptions", "369": "NtSetCachedSigningLevel", "370": "NtSetContextThread", "371": "NtSetDebugFilterState", "372": "NtSetDefaultHardErrorPort", "373": "NtSetDefaultLocale", "374": "NtSetDefaultUILanguage", "375": "NtSetDriverEntryOrder", "376": "NtSetEaFile", "377": "NtSetHighEventPair", "378": "NtSetHighWaitLowEventPair", "379": "NtSetIRTimer", "380": "NtSetInformationDebugObject", "381": "NtSetInformationEnlistment", "382": "NtSetInformationJobObject", "383": "NtSetInformationKey", "384": "NtSetInformationResourceManager", "385": "NtSetInformationSymbolicLink", "386": "NtSetInformationToken", "387": "NtSetInformationTransaction", "388": "NtSetInformationTransactionManager", "389": "NtSetInformationVirtualMemory", "390": "NtSetInformationWorkerFactory", "391": "NtSetIntervalProfile", "392": "NtSetIoCompletion", "393": "NtSetIoCompletionEx", "394": "NtSetLdtEntries", "395": "NtSetLowEventPair", "396": "NtSetLowWaitHighEventPair", "397": "NtSetQuotaInformationFile", "398": "NtSetSecurityObject", "399": "NtSetSystemEnvironmentValue", "400": "NtSetSystemEnvironmentValueEx", "401": "NtSetSystemInformation", "402": "NtSetSystemPowerState", "403": "NtSetSystemTime", "404": "NtSetThreadExecutionState", "405": "NtSetTimer2", "406": "NtSetTimerEx", "407": "NtSetTimerResolution", "408": "NtSetUuidSeed", "409": "NtSetVolumeInformationFile", "410": "NtSetWnfProcessNotificationEvent", "411": "NtShutdownSystem", "412": "NtShutdownWorkerFactory", "413": "NtSignalAndWaitForSingleObject", "414": "NtSinglePhaseReject", "415": "NtStartProfile", "416": "NtStopProfile", "417": "NtSubscribeWnfStateChange", "418": "NtSuspendProcess", "419": "NtSuspendThread", "420": "NtSystemDebugControl", "421": "NtTerminateJobObject", "422": "NtTestAlert", "423": "NtThawRegistry", "424": "NtThawTransactions", "425": "NtTraceControl", "426": "NtTranslateFilePath", "427": "NtUmsThreadYield", "428": "NtUnloadDriver", "429": "NtUnloadKey", "430": "NtUnloadKey2", "431": "NtUnloadKeyEx", "432": "NtUnlockFile", "433": "NtUnlockVirtualMemory", "434": "NtUnmapViewOfSectionEx", "435": "NtUnsubscribeWnfStateChange", "436": "NtUpdateWnfStateData", "437": "NtVdmControl", "438": "NtWaitForAlertByThreadId", "439": "NtWaitForDebugEvent", "440": "NtWaitForKeyedEvent", "441": "NtWaitForWorkViaWorkerFactory", "442": "NtWaitHighEventPair", "443": "NtWaitLowEventPair"}, "1607": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAddAtomEx", "104": "NtAddBootEntry", "105": "NtAddDriverEntry", "106": "NtAdjustGroupsToken", "107": "NtAdjustTokenClaimsAndDeviceGroups", "108": "NtAlertResumeThread", "109": "NtAlertThread", "110": "NtAlertThreadByThreadId", "111": "NtAllocateLocallyUniqueId", "112": "NtAllocateReserveObject", "113": "NtAllocateUserPhysicalPages", "114": "NtAllocateUuids", "115": "NtAlpcAcceptConnectPort", "116": "NtAlpcCancelMessage", "117": "NtAlpcConnectPort", "118": "NtAlpcConnectPortEx", "119": "NtAlpcCreatePort", "120": "NtAlpcCreatePortSection", "121": "NtAlpcCreateResourceReserve", "122": "NtAlpcCreateSectionView", "123": "NtAlpcCreateSecurityContext", "124": "NtAlpcDeletePortSection", "125": "NtAlpcDeleteResourceReserve", "126": "NtAlpcDeleteSectionView", "127": "NtAlpcDeleteSecurityContext", "128": "NtAlpcDisconnectPort", "129": "NtAlpcImpersonateClientContainerOfPort", "130": "NtAlpcImpersonateClientOfPort", "131": "NtAlpcOpenSenderProcess", "132": "NtAlpcOpenSenderThread", "133": "NtAlpcQueryInformation", "134": "NtAlpcQueryInformationMessage", "135": "NtAlpcRevokeSecurityContext", "136": "NtAlpcSendWaitReceivePort", "137": "NtAlpcSetInformation", "138": "NtAreMappedFilesTheSame", "139": "NtAssignProcessToJobObject", "140": "NtAssociateWaitCompletionPacket", "141": "NtCancelIoFileEx", "142": "NtCancelSynchronousIoFile", "143": "NtCancelTimer2", "144": "NtCancelWaitCompletionPacket", "145": "NtCommitComplete", "146": "NtCommitEnlistment", "147": "NtCommitRegistryTransaction", "148": "NtCommitTransaction", "149": "NtCompactKeys", "150": "NtCompareObjects", "151": "NtCompareTokens", "152": "NtCompleteConnectPort", "153": "NtCompressKey", "154": "NtConnectPort", "155": "NtCreateDebugObject", "156": "NtCreateDirectoryObject", "157": "NtCreateDirectoryObjectEx", "158": "NtCreateEnclave", "159": "NtCreateEnlistment", "160": "NtCreateEventPair", "161": "NtCreateIRTimer", "162": "NtCreateIoCompletion", "163": "NtCreateJobObject", "164": "NtCreateJobSet", "165": "NtCreateKeyTransacted", "166": "NtCreateKeyedEvent", "167": "NtCreateLowBoxToken", "168": "NtCreateMailslotFile", "169": "NtCreateMutant", "170": "NtCreateNamedPipeFile", "171": "NtCreatePagingFile", "172": "NtCreatePartition", "173": "NtCreatePort", "174": "NtCreatePrivateNamespace", "175": "NtCreateProcess", "176": "NtCreateProfile", "177": "NtCreateProfileEx", "178": "NtCreateRegistryTransaction", "179": "NtCreateResourceManager", "180": "NtCreateSemaphore", "181": "NtCreateSymbolicLinkObject", "182": "NtCreateThreadEx", "183": "NtCreateTimer", "184": "NtCreateTimer2", "185": "NtCreateToken", "186": "NtCreateTokenEx", "187": "NtCreateTransaction", "188": "NtCreateTransactionManager", "189": "NtCreateUserProcess", "190": "NtCreateWaitCompletionPacket", "191": "NtCreateWaitablePort", "192": "NtCreateWnfStateName", "193": "NtCreateWorkerFactory", "194": "NtDebugActiveProcess", "195": "NtDebugContinue", "196": "NtDeleteAtom", "197": "NtDeleteBootEntry", "198": "NtDeleteDriverEntry", "199": "NtDeleteFile", "200": "NtDeleteKey", "201": "NtDeleteObjectAuditAlarm", "202": "NtDeletePrivateNamespace", "203": "NtDeleteValueKey", "204": "NtDeleteWnfStateData", "205": "NtDeleteWnfStateName", "206": "NtDisableLastKnownGood", "207": "NtDisplayString", "208": "NtDrawText", "209": "NtEnableLastKnownGood", "210": "NtEnumerateBootEntries", "211": "NtEnumerateDriverEntries", "212": "NtEnumerateSystemEnvironmentValuesEx", "213": "NtEnumerateTransactionObject", "214": "NtExtendSection", "215": "NtFilterBootOption", "216": "NtFilterToken", "217": "NtFilterTokenEx", "218": "NtFlushBuffersFileEx", "219": "NtFlushInstallUILanguage", "220": "NtFlushInstructionCache", "221": "NtFlushKey", "222": "NtFlushProcessWriteBuffers", "223": "NtFlushVirtualMemory", "224": "NtFlushWriteBuffer", "225": "NtFreeUserPhysicalPages", "226": "NtFreezeRegistry", "227": "NtFreezeTransactions", "228": "NtGetCachedSigningLevel", "229": "NtGetCompleteWnfStateSubscription", "230": "NtGetContextThread", "231": "NtGetCurrentProcessorNumber", "232": "NtGetCurrentProcessorNumberEx", "233": "NtGetDevicePowerState", "234": "NtGetMUIRegistryInfo", "235": "NtGetNextProcess", "236": "NtGetNextThread", "237": "NtGetNlsSectionPtr", "238": "NtGetNotificationResourceManager", "239": "NtGetWriteWatch", "240": "NtImpersonateAnonymousToken", "241": "NtImpersonateThread", "242": "NtInitializeEnclave", "243": "NtInitializeNlsFiles", "244": "NtInitializeRegistry", "245": "NtInitiatePowerAction", "246": "NtIsSystemResumeAutomatic", "247": "NtIsUILanguageComitted", "248": "NtListenPort", "249": "NtLoadDriver", "250": "NtLoadEnclaveData", "251": "NtLoadKey", "252": "NtLoadKey2", "253": "NtLoadKeyEx", "254": "NtLockFile", "255": "NtLockProductActivationKeys", "256": "NtLockRegistryKey", "257": "NtLockVirtualMemory", "258": "NtMakePermanentObject", "259": "NtMakeTemporaryObject", "260": "NtManagePartition", "261": "NtMapCMFModule", "262": "NtMapUserPhysicalPages", "263": "NtModifyBootEntry", "264": "NtModifyDriverEntry", "265": "NtNotifyChangeDirectoryFile", "266": "NtNotifyChangeKey", "267": "NtNotifyChangeMultipleKeys", "268": "NtNotifyChangeSession", "269": "NtOpenEnlistment", "270": "NtOpenEventPair", "271": "NtOpenIoCompletion", "272": "NtOpenJobObject", "273": "NtOpenKeyEx", "274": "NtOpenKeyTransacted", "275": "NtOpenKeyTransactedEx", "276": "NtOpenKeyedEvent", "277": "NtOpenMutant", "278": "NtOpenObjectAuditAlarm", "279": "NtOpenPartition", "280": "NtOpenPrivateNamespace", "281": "NtOpenProcessToken", "282": "NtOpenRegistryTransaction", "283": "NtOpenResourceManager", "284": "NtOpenSemaphore", "285": "NtOpenSession", "286": "NtOpenSymbolicLinkObject", "287": "NtOpenThread", "288": "NtOpenTimer", "289": "NtOpenTransaction", "290": "NtOpenTransactionManager", "291": "NtPlugPlayControl", "292": "NtPrePrepareComplete", "293": "NtPrePrepareEnlistment", "294": "NtPrepareComplete", "295": "NtPrepareEnlistment", "296": "NtPrivilegeCheck", "297": "NtPrivilegeObjectAuditAlarm", "298": "NtPrivilegedServiceAuditAlarm", "299": "NtPropagationComplete", "300": "NtPropagationFailed", "301": "NtPulseEvent", "302": "NtQueryBootEntryOrder", "303": "NtQueryBootOptions", "304": "NtQueryDebugFilterState", "305": "NtQueryDirectoryObject", "306": "NtQueryDriverEntryOrder", "307": "NtQueryEaFile", "308": "NtQueryFullAttributesFile", "309": "NtQueryInformationAtom", "310": "NtQueryInformationEnlistment", "311": "NtQueryInformationJobObject", "312": "NtQueryInformationPort", "313": "NtQueryInformationResourceManager", "314": "NtQueryInformationTransaction", "315": "NtQueryInformationTransactionManager", "316": "NtQueryInformationWorkerFactory", "317": "NtQueryInstallUILanguage", "318": "NtQueryIntervalProfile", "319": "NtQueryIoCompletion", "320": "NtQueryLicenseValue", "321": "NtQueryMultipleValueKey", "322": "NtQueryMutant", "323": "NtQueryOpenSubKeys", "324": "NtQueryOpenSubKeysEx", "325": "NtQueryPortInformationProcess", "326": "NtQueryQuotaInformationFile", "327": "NtQuerySecurityAttributesToken", "328": "NtQuerySecurityObject", "329": "NtQuerySecurityPolicy", "330": "NtQuerySemaphore", "331": "NtQuerySymbolicLinkObject", "332": "NtQuerySystemEnvironmentValue", "333": "NtQuerySystemEnvironmentValueEx", "334": "NtQuerySystemInformationEx", "335": "NtQueryTimerResolution", "336": "NtQueryWnfStateData", "337": "NtQueryWnfStateNameInformation", "338": "NtQueueApcThreadEx", "339": "NtRaiseException", "340": "NtRaiseHardError", "341": "NtReadOnlyEnlistment", "342": "NtRecoverEnlistment", "343": "NtRecoverResourceManager", "344": "NtRecoverTransactionManager", "345": "NtRegisterProtocolAddressInformation", "346": "NtRegisterThreadTerminatePort", "347": "NtReleaseKeyedEvent", "348": "NtReleaseWorkerFactoryWorker", "349": "NtRemoveIoCompletionEx", "350": "NtRemoveProcessDebug", "351": "NtRenameKey", "352": "NtRenameTransactionManager", "353": "NtReplaceKey", "354": "NtReplacePartitionUnit", "355": "NtReplyWaitReplyPort", "356": "NtRequestPort", "357": "NtResetEvent", "358": "NtResetWriteWatch", "359": "NtRestoreKey", "360": "NtResumeProcess", "361": "NtRevertContainerImpersonation", "362": "NtRollbackComplete", "363": "NtRollbackEnlistment", "364": "NtRollbackRegistryTransaction", "365": "NtRollbackTransaction", "366": "NtRollforwardTransactionManager", "367": "NtSaveKey", "368": "NtSaveKeyEx", "369": "NtSaveMergedKeys", "370": "NtSecureConnectPort", "371": "NtSerializeBoot", "372": "NtSetBootEntryOrder", "373": "NtSetBootOptions", "374": "NtSetCachedSigningLevel", "375": "NtSetCachedSigningLevel2", "376": "NtSetContextThread", "377": "NtSetDebugFilterState", "378": "NtSetDefaultHardErrorPort", "379": "NtSetDefaultLocale", "380": "NtSetDefaultUILanguage", "381": "NtSetDriverEntryOrder", "382": "NtSetEaFile", "383": "NtSetHighEventPair", "384": "NtSetHighWaitLowEventPair", "385": "NtSetIRTimer", "386": "NtSetInformationDebugObject", "387": "NtSetInformationEnlistment", "388": "NtSetInformationJobObject", "389": "NtSetInformationKey", "390": "NtSetInformationResourceManager", "391": "NtSetInformationSymbolicLink", "392": "NtSetInformationToken", "393": "NtSetInformationTransaction", "394": "NtSetInformationTransactionManager", "395": "NtSetInformationVirtualMemory", "396": "NtSetInformationWorkerFactory", "397": "NtSetIntervalProfile", "398": "NtSetIoCompletion", "399": "NtSetIoCompletionEx", "400": "NtSetLdtEntries", "401": "NtSetLowEventPair", "402": "NtSetLowWaitHighEventPair", "403": "NtSetQuotaInformationFile", "404": "NtSetSecurityObject", "405": "NtSetSystemEnvironmentValue", "406": "NtSetSystemEnvironmentValueEx", "407": "NtSetSystemInformation", "408": "NtSetSystemPowerState", "409": "NtSetSystemTime", "410": "NtSetThreadExecutionState", "411": "NtSetTimer2", "412": "NtSetTimerEx", "413": "NtSetTimerResolution", "414": "NtSetUuidSeed", "415": "NtSetVolumeInformationFile", "416": "NtSetWnfProcessNotificationEvent", "417": "NtShutdownSystem", "418": "NtShutdownWorkerFactory", "419": "NtSignalAndWaitForSingleObject", "420": "NtSinglePhaseReject", "421": "NtStartProfile", "422": "NtStopProfile", "423": "NtSubscribeWnfStateChange", "424": "NtSuspendProcess", "425": "NtSuspendThread", "426": "NtSystemDebugControl", "427": "NtTerminateJobObject", "428": "NtTestAlert", "429": "NtThawRegistry", "430": "NtThawTransactions", "431": "NtTraceControl", "432": "NtTranslateFilePath", "433": "NtUmsThreadYield", "434": "NtUnloadDriver", "435": "NtUnloadKey", "436": "NtUnloadKey2", "437": "NtUnloadKeyEx", "438": "NtUnlockFile", "439": "NtUnlockVirtualMemory", "440": "NtUnmapViewOfSectionEx", "441": "NtUnsubscribeWnfStateChange", "442": "NtUpdateWnfStateData", "443": "NtVdmControl", "444": "NtWaitForAlertByThreadId", "445": "NtWaitForDebugEvent", "446": "NtWaitForKeyedEvent", "447": "NtWaitForWorkViaWorkerFactory", "448": "NtWaitHighEventPair", "449": "NtWaitLowEventPair"}, "1703": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireProcessActivityReference", "104": "NtAddAtomEx", "105": "NtAddBootEntry", "106": "NtAddDriverEntry", "107": "NtAdjustGroupsToken", "108": "NtAdjustTokenClaimsAndDeviceGroups", "109": "NtAlertResumeThread", "110": "NtAlertThread", "111": "NtAlertThreadByThreadId", "112": "NtAllocateLocallyUniqueId", "113": "NtAllocateReserveObject", "114": "NtAllocateUserPhysicalPages", "115": "NtAllocateUuids", "116": "NtAlpcAcceptConnectPort", "117": "NtAlpcCancelMessage", "118": "NtAlpcConnectPort", "119": "NtAlpcConnectPortEx", "120": "NtAlpcCreatePort", "121": "NtAlpcCreatePortSection", "122": "NtAlpcCreateResourceReserve", "123": "NtAlpcCreateSectionView", "124": "NtAlpcCreateSecurityContext", "125": "NtAlpcDeletePortSection", "126": "NtAlpcDeleteResourceReserve", "127": "NtAlpcDeleteSectionView", "128": "NtAlpcDeleteSecurityContext", "129": "NtAlpcDisconnectPort", "130": "NtAlpcImpersonateClientContainerOfPort", "131": "NtAlpcImpersonateClientOfPort", "132": "NtAlpcOpenSenderProcess", "133": "NtAlpcOpenSenderThread", "134": "NtAlpcQueryInformation", "135": "NtAlpcQueryInformationMessage", "136": "NtAlpcRevokeSecurityContext", "137": "NtAlpcSendWaitReceivePort", "138": "NtAlpcSetInformation", "139": "NtAreMappedFilesTheSame", "140": "NtAssignProcessToJobObject", "141": "NtAssociateWaitCompletionPacket", "142": "NtCancelIoFileEx", "143": "NtCancelSynchronousIoFile", "144": "NtCancelTimer2", "145": "NtCancelWaitCompletionPacket", "146": "NtCommitComplete", "147": "NtCommitEnlistment", "148": "NtCommitRegistryTransaction", "149": "NtCommitTransaction", "150": "NtCompactKeys", "151": "NtCompareObjects", "152": "NtCompareSigningLevels", "153": "NtCompareTokens", "154": "NtCompleteConnectPort", "155": "NtCompressKey", "156": "NtConnectPort", "157": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "158": "NtCreateDebugObject", "159": "NtCreateDirectoryObject", "160": "NtCreateDirectoryObjectEx", "161": "NtCreateEnclave", "162": "NtCreateEnlistment", "163": "NtCreateEventPair", "164": "NtCreateIRTimer", "165": "NtCreateIoCompletion", "166": "NtCreateJobObject", "167": "NtCreateJobSet", "168": "NtCreateKeyTransacted", "169": "NtCreateKeyedEvent", "170": "NtCreateLowBoxToken", "171": "NtCreateMailslotFile", "172": "NtCreateMutant", "173": "NtCreateNamedPipeFile", "174": "NtCreatePagingFile", "175": "NtCreatePartition", "176": "NtCreatePort", "177": "NtCreatePrivateNamespace", "178": "NtCreateProcess", "179": "NtCreateProfile", "180": "NtCreateProfileEx", "181": "NtCreateRegistryTransaction", "182": "NtCreateResourceManager", "183": "NtCreateSemaphore", "184": "NtCreateSymbolicLinkObject", "185": "NtCreateThreadEx", "186": "NtCreateTimer", "187": "NtCreateTimer2", "188": "NtCreateToken", "189": "NtCreateTokenEx", "190": "NtCreateTransaction", "191": "NtCreateTransactionManager", "192": "NtCreateUserProcess", "193": "NtCreateWaitCompletionPacket", "194": "NtCreateWaitablePort", "195": "NtCreateWnfStateName", "196": "NtCreateWorkerFactory", "197": "NtDebugActiveProcess", "198": "NtDebugContinue", "199": "NtDeleteAtom", "200": "NtDeleteBootEntry", "201": "NtDeleteDriverEntry", "202": "NtDeleteFile", "203": "NtDeleteKey", "204": "NtDeleteObjectAuditAlarm", "205": "NtDeletePrivateNamespace", "206": "NtDeleteValueKey", "207": "NtDeleteWnfStateData", "208": "NtDeleteWnfStateName", "209": "NtDisableLastKnownGood", "210": "NtDisplayString", "211": "NtDrawText", "212": "NtEnableLastKnownGood", "213": "NtEnumerateBootEntries", "214": "NtEnumerateDriverEntries", "215": "NtEnumerateSystemEnvironmentValuesEx", "216": "NtEnumerateTransactionObject", "217": "NtExtendSection", "218": "NtFilterBootOption", "219": "NtFilterToken", "220": "NtFilterTokenEx", "221": "NtFlushBuffersFileEx", "222": "NtFlushInstallUILanguage", "223": "NtFlushInstructionCache", "224": "NtFlushKey", "225": "NtFlushProcessWriteBuffers", "226": "NtFlushVirtualMemory", "227": "NtFlushWriteBuffer", "228": "NtFreeUserPhysicalPages", "229": "NtFreezeRegistry", "230": "NtFreezeTransactions", "231": "NtGetCachedSigningLevel", "232": "NtGetCompleteWnfStateSubscription", "233": "NtGetContextThread", "234": "NtGetCurrentProcessorNumber", "235": "NtGetCurrentProcessorNumberEx", "236": "NtGetDevicePowerState", "237": "NtGetMUIRegistryInfo", "238": "NtGetNextProcess", "239": "NtGetNextThread", "240": "NtGetNlsSectionPtr", "241": "NtGetNotificationResourceManager", "242": "NtGetWriteWatch", "243": "NtImpersonateAnonymousToken", "244": "NtImpersonateThread", "245": "NtInitializeEnclave", "246": "NtInitializeNlsFiles", "247": "NtInitializeRegistry", "248": "NtInitiatePowerAction", "249": "NtIsSystemResumeAutomatic", "250": "NtIsUILanguageComitted", "251": "NtListenPort", "252": "NtLoadDriver", "253": "NtLoadEnclaveData", "254": "NtLoadHotPatch", "255": "NtLoadKey", "256": "NtLoadKey2", "257": "NtLoadKeyEx", "258": "NtLockFile", "259": "NtLockProductActivationKeys", "260": "NtLockRegistryKey", "261": "NtLockVirtualMemory", "262": "NtMakePermanentObject", "263": "NtMakeTemporaryObject", "264": "NtManagePartition", "265": "NtMapCMFModule", "266": "NtMapUserPhysicalPages", "267": "NtModifyBootEntry", "268": "NtModifyDriverEntry", "269": "NtNotifyChangeDirectoryFile", "270": "NtNotifyChangeKey", "271": "NtNotifyChangeMultipleKeys", "272": "NtNotifyChangeSession", "273": "NtOpenEnlistment", "274": "NtOpenEventPair", "275": "NtOpenIoCompletion", "276": "NtOpenJobObject", "277": "NtOpenKeyEx", "278": "NtOpenKeyTransacted", "279": "NtOpenKeyTransactedEx", "280": "NtOpenKeyedEvent", "281": "NtOpenMutant", "282": "NtOpenObjectAuditAlarm", "283": "NtOpenPartition", "284": "NtOpenPrivateNamespace", "285": "NtOpenProcessToken", "286": "NtOpenRegistryTransaction", "287": "NtOpenResourceManager", "288": "NtOpenSemaphore", "289": "NtOpenSession", "290": "NtOpenSymbolicLinkObject", "291": "NtOpenThread", "292": "NtOpenTimer", "293": "NtOpenTransaction", "294": "NtOpenTransactionManager", "295": "NtPlugPlayControl", "296": "NtPrePrepareComplete", "297": "NtPrePrepareEnlistment", "298": "NtPrepareComplete", "299": "NtPrepareEnlistment", "300": "NtPrivilegeCheck", "301": "NtPrivilegeObjectAuditAlarm", "302": "NtPrivilegedServiceAuditAlarm", "303": "NtPropagationComplete", "304": "NtPropagationFailed", "305": "NtPulseEvent", "306": "NtQueryAuxiliaryCounterFrequency", "307": "NtQueryBootEntryOrder", "308": "NtQueryBootOptions", "309": "NtQueryDebugFilterState", "310": "NtQueryDirectoryObject", "311": "NtQueryDriverEntryOrder", "312": "NtQueryEaFile", "313": "NtQueryFullAttributesFile", "314": "NtQueryInformationAtom", "315": "NtQueryInformationByName", "316": "NtQueryInformationEnlistment", "317": "NtQueryInformationJobObject", "318": "NtQueryInformationPort", "319": "NtQueryInformationResourceManager", "320": "NtQueryInformationTransaction", "321": "NtQueryInformationTransactionManager", "322": "NtQueryInformationWorkerFactory", "323": "NtQueryInstallUILanguage", "324": "NtQueryIntervalProfile", "325": "NtQueryIoCompletion", "326": "NtQueryLicenseValue", "327": "NtQueryMultipleValueKey", "328": "NtQueryMutant", "329": "NtQueryOpenSubKeys", "330": "NtQueryOpenSubKeysEx", "331": "NtQueryPortInformationProcess", "332": "NtQueryQuotaInformationFile", "333": "NtQuerySecurityAttributesToken", "334": "NtQuerySecurityObject", "335": "NtQuerySecurityPolicy", "336": "NtQuerySemaphore", "337": "NtQuerySymbolicLinkObject", "338": "NtQuerySystemEnvironmentValue", "339": "NtQuerySystemEnvironmentValueEx", "340": "NtQuerySystemInformationEx", "341": "NtQueryTimerResolution", "342": "NtQueryWnfStateData", "343": "NtQueryWnfStateNameInformation", "344": "NtQueueApcThreadEx", "345": "NtRaiseException", "346": "NtRaiseHardError", "347": "NtReadOnlyEnlistment", "348": "NtRecoverEnlistment", "349": "NtRecoverResourceManager", "350": "NtRecoverTransactionManager", "351": "NtRegisterProtocolAddressInformation", "352": "NtRegisterThreadTerminatePort", "353": "NtReleaseKeyedEvent", "354": "NtReleaseWorkerFactoryWorker", "355": "NtRemoveIoCompletionEx", "356": "NtRemoveProcessDebug", "357": "NtRenameKey", "358": "NtRenameTransactionManager", "359": "NtReplaceKey", "360": "NtReplacePartitionUnit", "361": "NtReplyWaitReplyPort", "362": "NtRequestPort", "363": "NtResetEvent", "364": "NtResetWriteWatch", "365": "NtRestoreKey", "366": "NtResumeProcess", "367": "NtRevertContainerImpersonation", "368": "NtRollbackComplete", "369": "NtRollbackEnlistment", "370": "NtRollbackRegistryTransaction", "371": "NtRollbackTransaction", "372": "NtRollforwardTransactionManager", "373": "NtSaveKey", "374": "NtSaveKeyEx", "375": "NtSaveMergedKeys", "376": "NtSecureConnectPort", "377": "NtSerializeBoot", "378": "NtSetBootEntryOrder", "379": "NtSetBootOptions", "380": "NtSetCachedSigningLevel", "381": "NtSetCachedSigningLevel2", "382": "NtSetContextThread", "383": "NtSetDebugFilterState", "384": "NtSetDefaultHardErrorPort", "385": "NtSetDefaultLocale", "386": "NtSetDefaultUILanguage", "387": "NtSetDriverEntryOrder", "388": "NtSetEaFile", "389": "NtSetHighEventPair", "390": "NtSetHighWaitLowEventPair", "391": "NtSetIRTimer", "392": "NtSetInformationDebugObject", "393": "NtSetInformationEnlistment", "394": "NtSetInformationJobObject", "395": "NtSetInformationKey", "396": "NtSetInformationResourceManager", "397": "NtSetInformationSymbolicLink", "398": "NtSetInformationToken", "399": "NtSetInformationTransaction", "400": "NtSetInformationTransactionManager", "401": "NtSetInformationVirtualMemory", "402": "NtSetInformationWorkerFactory", "403": "NtSetIntervalProfile", "404": "NtSetIoCompletion", "405": "NtSetIoCompletionEx", "406": "NtSetLdtEntries", "407": "NtSetLowEventPair", "408": "NtSetLowWaitHighEventPair", "409": "NtSetQuotaInformationFile", "410": "NtSetSecurityObject", "411": "NtSetSystemEnvironmentValue", "412": "NtSetSystemEnvironmentValueEx", "413": "NtSetSystemInformation", "414": "NtSetSystemPowerState", "415": "NtSetSystemTime", "416": "NtSetThreadExecutionState", "417": "NtSetTimer2", "418": "NtSetTimerEx", "419": "NtSetTimerResolution", "420": "NtSetUuidSeed", "421": "NtSetVolumeInformationFile", "422": "NtSetWnfProcessNotificationEvent", "423": "NtShutdownSystem", "424": "NtShutdownWorkerFactory", "425": "NtSignalAndWaitForSingleObject", "426": "NtSinglePhaseReject", "427": "NtStartProfile", "428": "NtStopProfile", "429": "NtSubscribeWnfStateChange", "430": "NtSuspendProcess", "431": "NtSuspendThread", "432": "NtSystemDebugControl", "433": "NtTerminateJobObject", "434": "NtTestAlert", "435": "NtThawRegistry", "436": "NtThawTransactions", "437": "NtTraceControl", "438": "NtTranslateFilePath", "439": "NtUmsThreadYield", "440": "NtUnloadDriver", "441": "NtUnloadKey", "442": "NtUnloadKey2", "443": "NtUnloadKeyEx", "444": "NtUnlockFile", "445": "NtUnlockVirtualMemory", "446": "NtUnmapViewOfSectionEx", "447": "NtUnsubscribeWnfStateChange", "448": "NtUpdateWnfStateData", "449": "NtVdmControl", "450": "NtWaitForAlertByThreadId", "451": "NtWaitForDebugEvent", "452": "NtWaitForKeyedEvent", "453": "NtWaitForWorkViaWorkerFactory", "454": "NtWaitHighEventPair", "455": "NtWaitLowEventPair"}, "1709": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireProcessActivityReference", "104": "NtAddAtomEx", "105": "NtAddBootEntry", "106": "NtAddDriverEntry", "107": "NtAdjustGroupsToken", "108": "NtAdjustTokenClaimsAndDeviceGroups", "109": "NtAlertResumeThread", "110": "NtAlertThread", "111": "NtAlertThreadByThreadId", "112": "NtAllocateLocallyUniqueId", "113": "NtAllocateReserveObject", "114": "NtAllocateUserPhysicalPages", "115": "NtAllocateUuids", "116": "NtAlpcAcceptConnectPort", "117": "NtAlpcCancelMessage", "118": "NtAlpcConnectPort", "119": "NtAlpcConnectPortEx", "120": "NtAlpcCreatePort", "121": "NtAlpcCreatePortSection", "122": "NtAlpcCreateResourceReserve", "123": "NtAlpcCreateSectionView", "124": "NtAlpcCreateSecurityContext", "125": "NtAlpcDeletePortSection", "126": "NtAlpcDeleteResourceReserve", "127": "NtAlpcDeleteSectionView", "128": "NtAlpcDeleteSecurityContext", "129": "NtAlpcDisconnectPort", "130": "NtAlpcImpersonateClientContainerOfPort", "131": "NtAlpcImpersonateClientOfPort", "132": "NtAlpcOpenSenderProcess", "133": "NtAlpcOpenSenderThread", "134": "NtAlpcQueryInformation", "135": "NtAlpcQueryInformationMessage", "136": "NtAlpcRevokeSecurityContext", "137": "NtAlpcSendWaitReceivePort", "138": "NtAlpcSetInformation", "139": "NtAreMappedFilesTheSame", "140": "NtAssignProcessToJobObject", "141": "NtAssociateWaitCompletionPacket", "142": "NtCallEnclave", "143": "NtCancelIoFileEx", "144": "NtCancelSynchronousIoFile", "145": "NtCancelTimer2", "146": "NtCancelWaitCompletionPacket", "147": "NtCommitComplete", "148": "NtCommitEnlistment", "149": "NtCommitRegistryTransaction", "150": "NtCommitTransaction", "151": "NtCompactKeys", "152": "NtCompareObjects", "153": "NtCompareSigningLevels", "154": "NtCompareTokens", "155": "NtCompleteConnectPort", "156": "NtCompressKey", "157": "NtConnectPort", "158": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "159": "NtCreateDebugObject", "160": "NtCreateDirectoryObject", "161": "NtCreateDirectoryObjectEx", "162": "NtCreateEnclave", "163": "NtCreateEnlistment", "164": "NtCreateEventPair", "165": "NtCreateIRTimer", "166": "NtCreateIoCompletion", "167": "NtCreateJobObject", "168": "NtCreateJobSet", "169": "NtCreateKeyTransacted", "170": "NtCreateKeyedEvent", "171": "NtCreateLowBoxToken", "172": "NtCreateMailslotFile", "173": "NtCreateMutant", "174": "NtCreateNamedPipeFile", "175": "NtCreatePagingFile", "176": "NtCreatePartition", "177": "NtCreatePort", "178": "NtCreatePrivateNamespace", "179": "NtCreateProcess", "180": "NtCreateProfile", "181": "NtCreateProfileEx", "182": "NtCreateRegistryTransaction", "183": "NtCreateResourceManager", "184": "NtCreateSemaphore", "185": "NtCreateSymbolicLinkObject", "186": "NtCreateThreadEx", "187": "NtCreateTimer", "188": "NtCreateTimer2", "189": "NtCreateToken", "190": "NtCreateTokenEx", "191": "NtCreateTransaction", "192": "NtCreateTransactionManager", "193": "NtCreateUserProcess", "194": "NtCreateWaitCompletionPacket", "195": "NtCreateWaitablePort", "196": "NtCreateWnfStateName", "197": "NtCreateWorkerFactory", "198": "NtDebugActiveProcess", "199": "NtDebugContinue", "200": "NtDeleteAtom", "201": "NtDeleteBootEntry", "202": "NtDeleteDriverEntry", "203": "NtDeleteFile", "204": "NtDeleteKey", "205": "NtDeleteObjectAuditAlarm", "206": "NtDeletePrivateNamespace", "207": "NtDeleteValueKey", "208": "NtDeleteWnfStateData", "209": "NtDeleteWnfStateName", "210": "NtDisableLastKnownGood", "211": "NtDisplayString", "212": "NtDrawText", "213": "NtEnableLastKnownGood", "214": "NtEnumerateBootEntries", "215": "NtEnumerateDriverEntries", "216": "NtEnumerateSystemEnvironmentValuesEx", "217": "NtEnumerateTransactionObject", "218": "NtExtendSection", "219": "NtFilterBootOption", "220": "NtFilterToken", "221": "NtFilterTokenEx", "222": "NtFlushBuffersFileEx", "223": "NtFlushInstallUILanguage", "224": "NtFlushInstructionCache", "225": "NtFlushKey", "226": "NtFlushProcessWriteBuffers", "227": "NtFlushVirtualMemory", "228": "NtFlushWriteBuffer", "229": "NtFreeUserPhysicalPages", "230": "NtFreezeRegistry", "231": "NtFreezeTransactions", "232": "NtGetCachedSigningLevel", "233": "NtGetCompleteWnfStateSubscription", "234": "NtGetContextThread", "235": "NtGetCurrentProcessorNumber", "236": "NtGetCurrentProcessorNumberEx", "237": "NtGetDevicePowerState", "238": "NtGetMUIRegistryInfo", "239": "NtGetNextProcess", "240": "NtGetNextThread", "241": "NtGetNlsSectionPtr", "242": "NtGetNotificationResourceManager", "243": "NtGetWriteWatch", "244": "NtImpersonateAnonymousToken", "245": "NtImpersonateThread", "246": "NtInitializeEnclave", "247": "NtInitializeNlsFiles", "248": "NtInitializeRegistry", "249": "NtInitiatePowerAction", "250": "NtIsSystemResumeAutomatic", "251": "NtIsUILanguageComitted", "252": "NtListenPort", "253": "NtLoadDriver", "254": "NtLoadEnclaveData", "255": "NtLoadHotPatch", "256": "NtLoadKey", "257": "NtLoadKey2", "258": "NtLoadKeyEx", "259": "NtLockFile", "260": "NtLockProductActivationKeys", "261": "NtLockRegistryKey", "262": "NtLockVirtualMemory", "263": "NtMakePermanentObject", "264": "NtMakeTemporaryObject", "265": "NtManagePartition", "266": "NtMapCMFModule", "267": "NtMapUserPhysicalPages", "268": "NtModifyBootEntry", "269": "NtModifyDriverEntry", "270": "NtNotifyChangeDirectoryFile", "271": "NtNotifyChangeDirectoryFileEx", "272": "NtNotifyChangeKey", "273": "NtNotifyChangeMultipleKeys", "274": "NtNotifyChangeSession", "275": "NtOpenEnlistment", "276": "NtOpenEventPair", "277": "NtOpenIoCompletion", "278": "NtOpenJobObject", "279": "NtOpenKeyEx", "280": "NtOpenKeyTransacted", "281": "NtOpenKeyTransactedEx", "282": "NtOpenKeyedEvent", "283": "NtOpenMutant", "284": "NtOpenObjectAuditAlarm", "285": "NtOpenPartition", "286": "NtOpenPrivateNamespace", "287": "NtOpenProcessToken", "288": "NtOpenRegistryTransaction", "289": "NtOpenResourceManager", "290": "NtOpenSemaphore", "291": "NtOpenSession", "292": "NtOpenSymbolicLinkObject", "293": "NtOpenThread", "294": "NtOpenTimer", "295": "NtOpenTransaction", "296": "NtOpenTransactionManager", "297": "NtPlugPlayControl", "298": "NtPrePrepareComplete", "299": "NtPrePrepareEnlistment", "300": "NtPrepareComplete", "301": "NtPrepareEnlistment", "302": "NtPrivilegeCheck", "303": "NtPrivilegeObjectAuditAlarm", "304": "NtPrivilegedServiceAuditAlarm", "305": "NtPropagationComplete", "306": "NtPropagationFailed", "307": "NtPulseEvent", "308": "NtQueryAuxiliaryCounterFrequency", "309": "NtQueryBootEntryOrder", "310": "NtQueryBootOptions", "311": "NtQueryDebugFilterState", "312": "NtQueryDirectoryFileEx", "313": "NtQueryDirectoryObject", "314": "NtQueryDriverEntryOrder", "315": "NtQueryEaFile", "316": "NtQueryFullAttributesFile", "317": "NtQueryInformationAtom", "318": "NtQueryInformationByName", "319": "NtQueryInformationEnlistment", "320": "NtQueryInformationJobObject", "321": "NtQueryInformationPort", "322": "NtQueryInformationResourceManager", "323": "NtQueryInformationTransaction", "324": "NtQueryInformationTransactionManager", "325": "NtQueryInformationWorkerFactory", "326": "NtQueryInstallUILanguage", "327": "NtQueryIntervalProfile", "328": "NtQueryIoCompletion", "329": "NtQueryLicenseValue", "330": "NtQueryMultipleValueKey", "331": "NtQueryMutant", "332": "NtQueryOpenSubKeys", "333": "NtQueryOpenSubKeysEx", "334": "NtQueryPortInformationProcess", "335": "NtQueryQuotaInformationFile", "336": "NtQuerySecurityAttributesToken", "337": "NtQuerySecurityObject", "338": "NtQuerySecurityPolicy", "339": "NtQuerySemaphore", "340": "NtQuerySymbolicLinkObject", "341": "NtQuerySystemEnvironmentValue", "342": "NtQuerySystemEnvironmentValueEx", "343": "NtQuerySystemInformationEx", "344": "NtQueryTimerResolution", "345": "NtQueryWnfStateData", "346": "NtQueryWnfStateNameInformation", "347": "NtQueueApcThreadEx", "348": "NtRaiseException", "349": "NtRaiseHardError", "350": "NtReadOnlyEnlistment", "351": "NtRecoverEnlistment", "352": "NtRecoverResourceManager", "353": "NtRecoverTransactionManager", "354": "NtRegisterProtocolAddressInformation", "355": "NtRegisterThreadTerminatePort", "356": "NtReleaseKeyedEvent", "357": "NtReleaseWorkerFactoryWorker", "358": "NtRemoveIoCompletionEx", "359": "NtRemoveProcessDebug", "360": "NtRenameKey", "361": "NtRenameTransactionManager", "362": "NtReplaceKey", "363": "NtReplacePartitionUnit", "364": "NtReplyWaitReplyPort", "365": "NtRequestPort", "366": "NtResetEvent", "367": "NtResetWriteWatch", "368": "NtRestoreKey", "369": "NtResumeProcess", "370": "NtRevertContainerImpersonation", "371": "NtRollbackComplete", "372": "NtRollbackEnlistment", "373": "NtRollbackRegistryTransaction", "374": "NtRollbackTransaction", "375": "NtRollforwardTransactionManager", "376": "NtSaveKey", "377": "NtSaveKeyEx", "378": "NtSaveMergedKeys", "379": "NtSecureConnectPort", "380": "NtSerializeBoot", "381": "NtSetBootEntryOrder", "382": "NtSetBootOptions", "383": "NtSetCachedSigningLevel", "384": "NtSetCachedSigningLevel2", "385": "NtSetContextThread", "386": "NtSetDebugFilterState", "387": "NtSetDefaultHardErrorPort", "388": "NtSetDefaultLocale", "389": "NtSetDefaultUILanguage", "390": "NtSetDriverEntryOrder", "391": "NtSetEaFile", "392": "NtSetHighEventPair", "393": "NtSetHighWaitLowEventPair", "394": "NtSetIRTimer", "395": "NtSetInformationDebugObject", "396": "NtSetInformationEnlistment", "397": "NtSetInformationJobObject", "398": "NtSetInformationKey", "399": "NtSetInformationResourceManager", "400": "NtSetInformationSymbolicLink", "401": "NtSetInformationToken", "402": "NtSetInformationTransaction", "403": "NtSetInformationTransactionManager", "404": "NtSetInformationVirtualMemory", "405": "NtSetInformationWorkerFactory", "406": "NtSetIntervalProfile", "407": "NtSetIoCompletion", "408": "NtSetIoCompletionEx", "409": "NtSetLdtEntries", "410": "NtSetLowEventPair", "411": "NtSetLowWaitHighEventPair", "412": "NtSetQuotaInformationFile", "413": "NtSetSecurityObject", "414": "NtSetSystemEnvironmentValue", "415": "NtSetSystemEnvironmentValueEx", "416": "NtSetSystemInformation", "417": "NtSetSystemPowerState", "418": "NtSetSystemTime", "419": "NtSetThreadExecutionState", "420": "NtSetTimer2", "421": "NtSetTimerEx", "422": "NtSetTimerResolution", "423": "NtSetUuidSeed", "424": "NtSetVolumeInformationFile", "425": "NtSetWnfProcessNotificationEvent", "426": "NtShutdownSystem", "427": "NtShutdownWorkerFactory", "428": "NtSignalAndWaitForSingleObject", "429": "NtSinglePhaseReject", "430": "NtStartProfile", "431": "NtStopProfile", "432": "NtSubscribeWnfStateChange", "433": "NtSuspendProcess", "434": "NtSuspendThread", "435": "NtSystemDebugControl", "436": "NtTerminateEnclave", "437": "NtTerminateJobObject", "438": "NtTestAlert", "439": "NtThawRegistry", "440": "NtThawTransactions", "441": "NtTraceControl", "442": "NtTranslateFilePath", "443": "NtUmsThreadYield", "444": "NtUnloadDriver", "445": "NtUnloadKey", "446": "NtUnloadKey2", "447": "NtUnloadKeyEx", "448": "NtUnlockFile", "449": "NtUnlockVirtualMemory", "450": "NtUnmapViewOfSectionEx", "451": "NtUnsubscribeWnfStateChange", "452": "NtUpdateWnfStateData", "453": "NtVdmControl", "454": "NtWaitForAlertByThreadId", "455": "NtWaitForDebugEvent", "456": "NtWaitForKeyedEvent", "457": "NtWaitForWorkViaWorkerFactory", "458": "NtWaitHighEventPair", "459": "NtWaitLowEventPair"}, "1803": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireProcessActivityReference", "104": "NtAddAtomEx", "105": "NtAddBootEntry", "106": "NtAddDriverEntry", "107": "NtAdjustGroupsToken", "108": "NtAdjustTokenClaimsAndDeviceGroups", "109": "NtAlertResumeThread", "110": "NtAlertThread", "111": "NtAlertThreadByThreadId", "112": "NtAllocateLocallyUniqueId", "113": "NtAllocateReserveObject", "114": "NtAllocateUserPhysicalPages", "115": "NtAllocateUuids", "116": "NtAllocateVirtualMemoryEx", "117": "NtAlpcAcceptConnectPort", "118": "NtAlpcCancelMessage", "119": "NtAlpcConnectPort", "120": "NtAlpcConnectPortEx", "121": "NtAlpcCreatePort", "122": "NtAlpcCreatePortSection", "123": "NtAlpcCreateResourceReserve", "124": "NtAlpcCreateSectionView", "125": "NtAlpcCreateSecurityContext", "126": "NtAlpcDeletePortSection", "127": "NtAlpcDeleteResourceReserve", "128": "NtAlpcDeleteSectionView", "129": "NtAlpcDeleteSecurityContext", "130": "NtAlpcDisconnectPort", "131": "NtAlpcImpersonateClientContainerOfPort", "132": "NtAlpcImpersonateClientOfPort", "133": "NtAlpcOpenSenderProcess", "134": "NtAlpcOpenSenderThread", "135": "NtAlpcQueryInformation", "136": "NtAlpcQueryInformationMessage", "137": "NtAlpcRevokeSecurityContext", "138": "NtAlpcSendWaitReceivePort", "139": "NtAlpcSetInformation", "140": "NtAreMappedFilesTheSame", "141": "NtAssignProcessToJobObject", "142": "NtAssociateWaitCompletionPacket", "143": "NtCallEnclave", "144": "NtCancelIoFileEx", "145": "NtCancelSynchronousIoFile", "146": "NtCancelTimer2", "147": "NtCancelWaitCompletionPacket", "148": "NtCommitComplete", "149": "NtCommitEnlistment", "150": "NtCommitRegistryTransaction", "151": "NtCommitTransaction", "152": "NtCompactKeys", "153": "NtCompareObjects", "154": "NtCompareSigningLevels", "155": "NtCompareTokens", "156": "NtCompleteConnectPort", "157": "NtCompressKey", "158": "NtConnectPort", "159": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "160": "NtCreateDebugObject", "161": "NtCreateDirectoryObject", "162": "NtCreateDirectoryObjectEx", "163": "NtCreateEnclave", "164": "NtCreateEnlistment", "165": "NtCreateEventPair", "166": "NtCreateIRTimer", "167": "NtCreateIoCompletion", "168": "NtCreateJobObject", "169": "NtCreateJobSet", "170": "NtCreateKeyTransacted", "171": "NtCreateKeyedEvent", "172": "NtCreateLowBoxToken", "173": "NtCreateMailslotFile", "174": "NtCreateMutant", "175": "NtCreateNamedPipeFile", "176": "NtCreatePagingFile", "177": "NtCreatePartition", "178": "NtCreatePort", "179": "NtCreatePrivateNamespace", "180": "NtCreateProcess", "181": "NtCreateProfile", "182": "NtCreateProfileEx", "183": "NtCreateRegistryTransaction", "184": "NtCreateResourceManager", "185": "NtCreateSemaphore", "186": "NtCreateSymbolicLinkObject", "187": "NtCreateThreadEx", "188": "NtCreateTimer", "189": "NtCreateTimer2", "190": "NtCreateToken", "191": "NtCreateTokenEx", "192": "NtCreateTransaction", "193": "NtCreateTransactionManager", "194": "NtCreateUserProcess", "195": "NtCreateWaitCompletionPacket", "196": "NtCreateWaitablePort", "197": "NtCreateWnfStateName", "198": "NtCreateWorkerFactory", "199": "NtDebugActiveProcess", "200": "NtDebugContinue", "201": "NtDeleteAtom", "202": "NtDeleteBootEntry", "203": "NtDeleteDriverEntry", "204": "NtDeleteFile", "205": "NtDeleteKey", "206": "NtDeleteObjectAuditAlarm", "207": "NtDeletePrivateNamespace", "208": "NtDeleteValueKey", "209": "NtDeleteWnfStateData", "210": "NtDeleteWnfStateName", "211": "NtDisableLastKnownGood", "212": "NtDisplayString", "213": "NtDrawText", "214": "NtEnableLastKnownGood", "215": "NtEnumerateBootEntries", "216": "NtEnumerateDriverEntries", "217": "NtEnumerateSystemEnvironmentValuesEx", "218": "NtEnumerateTransactionObject", "219": "NtExtendSection", "220": "NtFilterBootOption", "221": "NtFilterToken", "222": "NtFilterTokenEx", "223": "NtFlushBuffersFileEx", "224": "NtFlushInstallUILanguage", "225": "NtFlushInstructionCache", "226": "NtFlushKey", "227": "NtFlushProcessWriteBuffers", "228": "NtFlushVirtualMemory", "229": "NtFlushWriteBuffer", "230": "NtFreeUserPhysicalPages", "231": "NtFreezeRegistry", "232": "NtFreezeTransactions", "233": "NtGetCachedSigningLevel", "234": "NtGetCompleteWnfStateSubscription", "235": "NtGetContextThread", "236": "NtGetCurrentProcessorNumber", "237": "NtGetCurrentProcessorNumberEx", "238": "NtGetDevicePowerState", "239": "NtGetMUIRegistryInfo", "240": "NtGetNextProcess", "241": "NtGetNextThread", "242": "NtGetNlsSectionPtr", "243": "NtGetNotificationResourceManager", "244": "NtGetWriteWatch", "245": "NtImpersonateAnonymousToken", "246": "NtImpersonateThread", "247": "NtInitializeEnclave", "248": "NtInitializeNlsFiles", "249": "NtInitializeRegistry", "250": "NtInitiatePowerAction", "251": "NtIsSystemResumeAutomatic", "252": "NtIsUILanguageComitted", "253": "NtListenPort", "254": "NtLoadDriver", "255": "NtLoadEnclaveData", "256": "NtLoadHotPatch", "257": "NtLoadKey", "258": "NtLoadKey2", "259": "NtLoadKeyEx", "260": "NtLockFile", "261": "NtLockProductActivationKeys", "262": "NtLockRegistryKey", "263": "NtLockVirtualMemory", "264": "NtMakePermanentObject", "265": "NtMakeTemporaryObject", "266": "NtManagePartition", "267": "NtMapCMFModule", "268": "NtMapUserPhysicalPages", "269": "NtMapViewOfSectionEx", "270": "NtModifyBootEntry", "271": "NtModifyDriverEntry", "272": "NtNotifyChangeDirectoryFile", "273": "NtNotifyChangeDirectoryFileEx", "274": "NtNotifyChangeKey", "275": "NtNotifyChangeMultipleKeys", "276": "NtNotifyChangeSession", "277": "NtOpenEnlistment", "278": "NtOpenEventPair", "279": "NtOpenIoCompletion", "280": "NtOpenJobObject", "281": "NtOpenKeyEx", "282": "NtOpenKeyTransacted", "283": "NtOpenKeyTransactedEx", "284": "NtOpenKeyedEvent", "285": "NtOpenMutant", "286": "NtOpenObjectAuditAlarm", "287": "NtOpenPartition", "288": "NtOpenPrivateNamespace", "289": "NtOpenProcessToken", "290": "NtOpenRegistryTransaction", "291": "NtOpenResourceManager", "292": "NtOpenSemaphore", "293": "NtOpenSession", "294": "NtOpenSymbolicLinkObject", "295": "NtOpenThread", "296": "NtOpenTimer", "297": "NtOpenTransaction", "298": "NtOpenTransactionManager", "299": "NtPlugPlayControl", "300": "NtPrePrepareComplete", "301": "NtPrePrepareEnlistment", "302": "NtPrepareComplete", "303": "NtPrepareEnlistment", "304": "NtPrivilegeCheck", "305": "NtPrivilegeObjectAuditAlarm", "306": "NtPrivilegedServiceAuditAlarm", "307": "NtPropagationComplete", "308": "NtPropagationFailed", "309": "NtPulseEvent", "310": "NtQueryAuxiliaryCounterFrequency", "311": "NtQueryBootEntryOrder", "312": "NtQueryBootOptions", "313": "NtQueryDebugFilterState", "314": "NtQueryDirectoryFileEx", "315": "NtQueryDirectoryObject", "316": "NtQueryDriverEntryOrder", "317": "NtQueryEaFile", "318": "NtQueryFullAttributesFile", "319": "NtQueryInformationAtom", "320": "NtQueryInformationByName", "321": "NtQueryInformationEnlistment", "322": "NtQueryInformationJobObject", "323": "NtQueryInformationPort", "324": "NtQueryInformationResourceManager", "325": "NtQueryInformationTransaction", "326": "NtQueryInformationTransactionManager", "327": "NtQueryInformationWorkerFactory", "328": "NtQueryInstallUILanguage", "329": "NtQueryIntervalProfile", "330": "NtQueryIoCompletion", "331": "NtQueryLicenseValue", "332": "NtQueryMultipleValueKey", "333": "NtQueryMutant", "334": "NtQueryOpenSubKeys", "335": "NtQueryOpenSubKeysEx", "336": "NtQueryPortInformationProcess", "337": "NtQueryQuotaInformationFile", "338": "NtQuerySecurityAttributesToken", "339": "NtQuerySecurityObject", "340": "NtQuerySecurityPolicy", "341": "NtQuerySemaphore", "342": "NtQuerySymbolicLinkObject", "343": "NtQuerySystemEnvironmentValue", "344": "NtQuerySystemEnvironmentValueEx", "345": "NtQuerySystemInformationEx", "346": "NtQueryTimerResolution", "347": "NtQueryWnfStateData", "348": "NtQueryWnfStateNameInformation", "349": "NtQueueApcThreadEx", "350": "NtRaiseException", "351": "NtRaiseHardError", "352": "NtReadOnlyEnlistment", "353": "NtRecoverEnlistment", "354": "NtRecoverResourceManager", "355": "NtRecoverTransactionManager", "356": "NtRegisterProtocolAddressInformation", "357": "NtRegisterThreadTerminatePort", "358": "NtReleaseKeyedEvent", "359": "NtReleaseWorkerFactoryWorker", "360": "NtRemoveIoCompletionEx", "361": "NtRemoveProcessDebug", "362": "NtRenameKey", "363": "NtRenameTransactionManager", "364": "NtReplaceKey", "365": "NtReplacePartitionUnit", "366": "NtReplyWaitReplyPort", "367": "NtRequestPort", "368": "NtResetEvent", "369": "NtResetWriteWatch", "370": "NtRestoreKey", "371": "NtResumeProcess", "372": "NtRevertContainerImpersonation", "373": "NtRollbackComplete", "374": "NtRollbackEnlistment", "375": "NtRollbackRegistryTransaction", "376": "NtRollbackTransaction", "377": "NtRollforwardTransactionManager", "378": "NtSaveKey", "379": "NtSaveKeyEx", "380": "NtSaveMergedKeys", "381": "NtSecureConnectPort", "382": "NtSerializeBoot", "383": "NtSetBootEntryOrder", "384": "NtSetBootOptions", "385": "NtSetCachedSigningLevel", "386": "NtSetCachedSigningLevel2", "387": "NtSetContextThread", "388": "NtSetDebugFilterState", "389": "NtSetDefaultHardErrorPort", "390": "NtSetDefaultLocale", "391": "NtSetDefaultUILanguage", "392": "NtSetDriverEntryOrder", "393": "NtSetEaFile", "394": "NtSetHighEventPair", "395": "NtSetHighWaitLowEventPair", "396": "NtSetIRTimer", "397": "NtSetInformationDebugObject", "398": "NtSetInformationEnlistment", "399": "NtSetInformationJobObject", "400": "NtSetInformationKey", "401": "NtSetInformationResourceManager", "402": "NtSetInformationSymbolicLink", "403": "NtSetInformationToken", "404": "NtSetInformationTransaction", "405": "NtSetInformationTransactionManager", "406": "NtSetInformationVirtualMemory", "407": "NtSetInformationWorkerFactory", "408": "NtSetIntervalProfile", "409": "NtSetIoCompletion", "410": "NtSetIoCompletionEx", "411": "NtSetLdtEntries", "412": "NtSetLowEventPair", "413": "NtSetLowWaitHighEventPair", "414": "NtSetQuotaInformationFile", "415": "NtSetSecurityObject", "416": "NtSetSystemEnvironmentValue", "417": "NtSetSystemEnvironmentValueEx", "418": "NtSetSystemInformation", "419": "NtSetSystemPowerState", "420": "NtSetSystemTime", "421": "NtSetThreadExecutionState", "422": "NtSetTimer2", "423": "NtSetTimerEx", "424": "NtSetTimerResolution", "425": "NtSetUuidSeed", "426": "NtSetVolumeInformationFile", "427": "NtSetWnfProcessNotificationEvent", "428": "NtShutdownSystem", "429": "NtShutdownWorkerFactory", "430": "NtSignalAndWaitForSingleObject", "431": "NtSinglePhaseReject", "432": "NtStartProfile", "433": "NtStopProfile", "434": "NtSubscribeWnfStateChange", "435": "NtSuspendProcess", "436": "NtSuspendThread", "437": "NtSystemDebugControl", "438": "NtTerminateEnclave", "439": "NtTerminateJobObject", "440": "NtTestAlert", "441": "NtThawRegistry", "442": "NtThawTransactions", "443": "NtTraceControl", "444": "NtTranslateFilePath", "445": "NtUmsThreadYield", "446": "NtUnloadDriver", "447": "NtUnloadKey", "448": "NtUnloadKey2", "449": "NtUnloadKeyEx", "450": "NtUnlockFile", "451": "NtUnlockVirtualMemory", "452": "NtUnmapViewOfSectionEx", "453": "NtUnsubscribeWnfStateChange", "454": "NtUpdateWnfStateData", "455": "NtVdmControl", "456": "NtWaitForAlertByThreadId", "457": "NtWaitForDebugEvent", "458": "NtWaitForKeyedEvent", "459": "NtWaitForWorkViaWorkerFactory", "460": "NtWaitHighEventPair", "461": "NtWaitLowEventPair"}, "1809": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireProcessActivityReference", "104": "NtAddAtomEx", "105": "NtAddBootEntry", "106": "NtAddDriverEntry", "107": "NtAdjustGroupsToken", "108": "NtAdjustTokenClaimsAndDeviceGroups", "109": "NtAlertResumeThread", "110": "NtAlertThread", "111": "NtAlertThreadByThreadId", "112": "NtAllocateLocallyUniqueId", "113": "NtAllocateReserveObject", "114": "NtAllocateUserPhysicalPages", "115": "NtAllocateUuids", "116": "NtAllocateVirtualMemoryEx", "117": "NtAlpcAcceptConnectPort", "118": "NtAlpcCancelMessage", "119": "NtAlpcConnectPort", "120": "NtAlpcConnectPortEx", "121": "NtAlpcCreatePort", "122": "NtAlpcCreatePortSection", "123": "NtAlpcCreateResourceReserve", "124": "NtAlpcCreateSectionView", "125": "NtAlpcCreateSecurityContext", "126": "NtAlpcDeletePortSection", "127": "NtAlpcDeleteResourceReserve", "128": "NtAlpcDeleteSectionView", "129": "NtAlpcDeleteSecurityContext", "130": "NtAlpcDisconnectPort", "131": "NtAlpcImpersonateClientContainerOfPort", "132": "NtAlpcImpersonateClientOfPort", "133": "NtAlpcOpenSenderProcess", "134": "NtAlpcOpenSenderThread", "135": "NtAlpcQueryInformation", "136": "NtAlpcQueryInformationMessage", "137": "NtAlpcRevokeSecurityContext", "138": "NtAlpcSendWaitReceivePort", "139": "NtAlpcSetInformation", "140": "NtAreMappedFilesTheSame", "141": "NtAssignProcessToJobObject", "142": "NtAssociateWaitCompletionPacket", "143": "NtCallEnclave", "144": "NtCancelIoFileEx", "145": "NtCancelSynchronousIoFile", "146": "NtCancelTimer2", "147": "NtCancelWaitCompletionPacket", "148": "NtCommitComplete", "149": "NtCommitEnlistment", "150": "NtCommitRegistryTransaction", "151": "NtCommitTransaction", "152": "NtCompactKeys", "153": "NtCompareObjects", "154": "NtCompareSigningLevels", "155": "NtCompareTokens", "156": "NtCompleteConnectPort", "157": "NtCompressKey", "158": "NtConnectPort", "159": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "160": "NtCreateDebugObject", "161": "NtCreateDirectoryObject", "162": "NtCreateDirectoryObjectEx", "163": "NtCreateEnclave", "164": "NtCreateEnlistment", "165": "NtCreateEventPair", "166": "NtCreateIRTimer", "167": "NtCreateIoCompletion", "168": "NtCreateJobObject", "169": "NtCreateJobSet", "170": "NtCreateKeyTransacted", "171": "NtCreateKeyedEvent", "172": "NtCreateLowBoxToken", "173": "NtCreateMailslotFile", "174": "NtCreateMutant", "175": "NtCreateNamedPipeFile", "176": "NtCreatePagingFile", "177": "NtCreatePartition", "178": "NtCreatePort", "179": "NtCreatePrivateNamespace", "180": "NtCreateProcess", "181": "NtCreateProfile", "182": "NtCreateProfileEx", "183": "NtCreateRegistryTransaction", "184": "NtCreateResourceManager", "185": "NtCreateSectionEx", "186": "NtCreateSemaphore", "187": "NtCreateSymbolicLinkObject", "188": "NtCreateThreadEx", "189": "NtCreateTimer", "190": "NtCreateTimer2", "191": "NtCreateToken", "192": "NtCreateTokenEx", "193": "NtCreateTransaction", "194": "NtCreateTransactionManager", "195": "NtCreateUserProcess", "196": "NtCreateWaitCompletionPacket", "197": "NtCreateWaitablePort", "198": "NtCreateWnfStateName", "199": "NtCreateWorkerFactory", "200": "NtDebugActiveProcess", "201": "NtDebugContinue", "202": "NtDeleteAtom", "203": "NtDeleteBootEntry", "204": "NtDeleteDriverEntry", "205": "NtDeleteFile", "206": "NtDeleteKey", "207": "NtDeleteObjectAuditAlarm", "208": "NtDeletePrivateNamespace", "209": "NtDeleteValueKey", "210": "NtDeleteWnfStateData", "211": "NtDeleteWnfStateName", "212": "NtDisableLastKnownGood", "213": "NtDisplayString", "214": "NtDrawText", "215": "NtEnableLastKnownGood", "216": "NtEnumerateBootEntries", "217": "NtEnumerateDriverEntries", "218": "NtEnumerateSystemEnvironmentValuesEx", "219": "NtEnumerateTransactionObject", "220": "NtExtendSection", "221": "NtFilterBootOption", "222": "NtFilterToken", "223": "NtFilterTokenEx", "224": "NtFlushBuffersFileEx", "225": "NtFlushInstallUILanguage", "226": "NtFlushInstructionCache", "227": "NtFlushKey", "228": "NtFlushProcessWriteBuffers", "229": "NtFlushVirtualMemory", "230": "NtFlushWriteBuffer", "231": "NtFreeUserPhysicalPages", "232": "NtFreezeRegistry", "233": "NtFreezeTransactions", "234": "NtGetCachedSigningLevel", "235": "NtGetCompleteWnfStateSubscription", "236": "NtGetContextThread", "237": "NtGetCurrentProcessorNumber", "238": "NtGetCurrentProcessorNumberEx", "239": "NtGetDevicePowerState", "240": "NtGetMUIRegistryInfo", "241": "NtGetNextProcess", "242": "NtGetNextThread", "243": "NtGetNlsSectionPtr", "244": "NtGetNotificationResourceManager", "245": "NtGetWriteWatch", "246": "NtImpersonateAnonymousToken", "247": "NtImpersonateThread", "248": "NtInitializeEnclave", "249": "NtInitializeNlsFiles", "250": "NtInitializeRegistry", "251": "NtInitiatePowerAction", "252": "NtIsSystemResumeAutomatic", "253": "NtIsUILanguageComitted", "254": "NtListenPort", "255": "NtLoadDriver", "256": "NtLoadEnclaveData", "257": "NtLoadKey", "258": "NtLoadKey2", "259": "NtLoadKeyEx", "260": "NtLockFile", "261": "NtLockProductActivationKeys", "262": "NtLockRegistryKey", "263": "NtLockVirtualMemory", "264": "NtMakePermanentObject", "265": "NtMakeTemporaryObject", "266": "NtManageHotPatch", "267": "NtManagePartition", "268": "NtMapCMFModule", "269": "NtMapUserPhysicalPages", "270": "NtMapViewOfSectionEx", "271": "NtModifyBootEntry", "272": "NtModifyDriverEntry", "273": "NtNotifyChangeDirectoryFile", "274": "NtNotifyChangeDirectoryFileEx", "275": "NtNotifyChangeKey", "276": "NtNotifyChangeMultipleKeys", "277": "NtNotifyChangeSession", "278": "NtOpenEnlistment", "279": "NtOpenEventPair", "280": "NtOpenIoCompletion", "281": "NtOpenJobObject", "282": "NtOpenKeyEx", "283": "NtOpenKeyTransacted", "284": "NtOpenKeyTransactedEx", "285": "NtOpenKeyedEvent", "286": "NtOpenMutant", "287": "NtOpenObjectAuditAlarm", "288": "NtOpenPartition", "289": "NtOpenPrivateNamespace", "290": "NtOpenProcessToken", "291": "NtOpenRegistryTransaction", "292": "NtOpenResourceManager", "293": "NtOpenSemaphore", "294": "NtOpenSession", "295": "NtOpenSymbolicLinkObject", "296": "NtOpenThread", "297": "NtOpenTimer", "298": "NtOpenTransaction", "299": "NtOpenTransactionManager", "300": "NtPlugPlayControl", "301": "NtPrePrepareComplete", "302": "NtPrePrepareEnlistment", "303": "NtPrepareComplete", "304": "NtPrepareEnlistment", "305": "NtPrivilegeCheck", "306": "NtPrivilegeObjectAuditAlarm", "307": "NtPrivilegedServiceAuditAlarm", "308": "NtPropagationComplete", "309": "NtPropagationFailed", "310": "NtPulseEvent", "311": "NtQueryAuxiliaryCounterFrequency", "312": "NtQueryBootEntryOrder", "313": "NtQueryBootOptions", "314": "NtQueryDebugFilterState", "315": "NtQueryDirectoryFileEx", "316": "NtQueryDirectoryObject", "317": "NtQueryDriverEntryOrder", "318": "NtQueryEaFile", "319": "NtQueryFullAttributesFile", "320": "NtQueryInformationAtom", "321": "NtQueryInformationByName", "322": "NtQueryInformationEnlistment", "323": "NtQueryInformationJobObject", "324": "NtQueryInformationPort", "325": "NtQueryInformationResourceManager", "326": "NtQueryInformationTransaction", "327": "NtQueryInformationTransactionManager", "328": "NtQueryInformationWorkerFactory", "329": "NtQueryInstallUILanguage", "330": "NtQueryIntervalProfile", "331": "NtQueryIoCompletion", "332": "NtQueryLicenseValue", "333": "NtQueryMultipleValueKey", "334": "NtQueryMutant", "335": "NtQueryOpenSubKeys", "336": "NtQueryOpenSubKeysEx", "337": "NtQueryPortInformationProcess", "338": "NtQueryQuotaInformationFile", "339": "NtQuerySecurityAttributesToken", "340": "NtQuerySecurityObject", "341": "NtQuerySecurityPolicy", "342": "NtQuerySemaphore", "343": "NtQuerySymbolicLinkObject", "344": "NtQuerySystemEnvironmentValue", "345": "NtQuerySystemEnvironmentValueEx", "346": "NtQuerySystemInformationEx", "347": "NtQueryTimerResolution", "348": "NtQueryWnfStateData", "349": "NtQueryWnfStateNameInformation", "350": "NtQueueApcThreadEx", "351": "NtRaiseException", "352": "NtRaiseHardError", "353": "NtReadOnlyEnlistment", "354": "NtRecoverEnlistment", "355": "NtRecoverResourceManager", "356": "NtRecoverTransactionManager", "357": "NtRegisterProtocolAddressInformation", "358": "NtRegisterThreadTerminatePort", "359": "NtReleaseKeyedEvent", "360": "NtReleaseWorkerFactoryWorker", "361": "NtRemoveIoCompletionEx", "362": "NtRemoveProcessDebug", "363": "NtRenameKey", "364": "NtRenameTransactionManager", "365": "NtReplaceKey", "366": "NtReplacePartitionUnit", "367": "NtReplyWaitReplyPort", "368": "NtRequestPort", "369": "NtResetEvent", "370": "NtResetWriteWatch", "371": "NtRestoreKey", "372": "NtResumeProcess", "373": "NtRevertContainerImpersonation", "374": "NtRollbackComplete", "375": "NtRollbackEnlistment", "376": "NtRollbackRegistryTransaction", "377": "NtRollbackTransaction", "378": "NtRollforwardTransactionManager", "379": "NtSaveKey", "380": "NtSaveKeyEx", "381": "NtSaveMergedKeys", "382": "NtSecureConnectPort", "383": "NtSerializeBoot", "384": "NtSetBootEntryOrder", "385": "NtSetBootOptions", "386": "NtSetCachedSigningLevel", "387": "NtSetCachedSigningLevel2", "388": "NtSetContextThread", "389": "NtSetDebugFilterState", "390": "NtSetDefaultHardErrorPort", "391": "NtSetDefaultLocale", "392": "NtSetDefaultUILanguage", "393": "NtSetDriverEntryOrder", "394": "NtSetEaFile", "395": "NtSetHighEventPair", "396": "NtSetHighWaitLowEventPair", "397": "NtSetIRTimer", "398": "NtSetInformationDebugObject", "399": "NtSetInformationEnlistment", "400": "NtSetInformationJobObject", "401": "NtSetInformationKey", "402": "NtSetInformationResourceManager", "403": "NtSetInformationSymbolicLink", "404": "NtSetInformationToken", "405": "NtSetInformationTransaction", "406": "NtSetInformationTransactionManager", "407": "NtSetInformationVirtualMemory", "408": "NtSetInformationWorkerFactory", "409": "NtSetIntervalProfile", "410": "NtSetIoCompletion", "411": "NtSetIoCompletionEx", "412": "NtSetLdtEntries", "413": "NtSetLowEventPair", "414": "NtSetLowWaitHighEventPair", "415": "NtSetQuotaInformationFile", "416": "NtSetSecurityObject", "417": "NtSetSystemEnvironmentValue", "418": "NtSetSystemEnvironmentValueEx", "419": "NtSetSystemInformation", "420": "NtSetSystemPowerState", "421": "NtSetSystemTime", "422": "NtSetThreadExecutionState", "423": "NtSetTimer2", "424": "NtSetTimerEx", "425": "NtSetTimerResolution", "426": "NtSetUuidSeed", "427": "NtSetVolumeInformationFile", "428": "NtSetWnfProcessNotificationEvent", "429": "NtShutdownSystem", "430": "NtShutdownWorkerFactory", "431": "NtSignalAndWaitForSingleObject", "432": "NtSinglePhaseReject", "433": "NtStartProfile", "434": "NtStopProfile", "435": "NtSubscribeWnfStateChange", "436": "NtSuspendProcess", "437": "NtSuspendThread", "438": "NtSystemDebugControl", "439": "NtTerminateEnclave", "440": "NtTerminateJobObject", "441": "NtTestAlert", "442": "NtThawRegistry", "443": "NtThawTransactions", "444": "NtTraceControl", "445": "NtTranslateFilePath", "446": "NtUmsThreadYield", "447": "NtUnloadDriver", "448": "NtUnloadKey", "449": "NtUnloadKey2", "450": "NtUnloadKeyEx", "451": "NtUnlockFile", "452": "NtUnlockVirtualMemory", "453": "NtUnmapViewOfSectionEx", "454": "NtUnsubscribeWnfStateChange", "455": "NtUpdateWnfStateData", "456": "NtVdmControl", "457": "NtWaitForAlertByThreadId", "458": "NtWaitForDebugEvent", "459": "NtWaitForKeyedEvent", "460": "NtWaitForWorkViaWorkerFactory", "461": "NtWaitHighEventPair", "462": "NtWaitLowEventPair"}, "1903": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireProcessActivityReference", "104": "NtAddAtomEx", "105": "NtAddBootEntry", "106": "NtAddDriverEntry", "107": "NtAdjustGroupsToken", "108": "NtAdjustTokenClaimsAndDeviceGroups", "109": "NtAlertResumeThread", "110": "NtAlertThread", "111": "NtAlertThreadByThreadId", "112": "NtAllocateLocallyUniqueId", "113": "NtAllocateReserveObject", "114": "NtAllocateUserPhysicalPages", "115": "NtAllocateUuids", "116": "NtAllocateVirtualMemoryEx", "117": "NtAlpcAcceptConnectPort", "118": "NtAlpcCancelMessage", "119": "NtAlpcConnectPort", "120": "NtAlpcConnectPortEx", "121": "NtAlpcCreatePort", "122": "NtAlpcCreatePortSection", "123": "NtAlpcCreateResourceReserve", "124": "NtAlpcCreateSectionView", "125": "NtAlpcCreateSecurityContext", "126": "NtAlpcDeletePortSection", "127": "NtAlpcDeleteResourceReserve", "128": "NtAlpcDeleteSectionView", "129": "NtAlpcDeleteSecurityContext", "130": "NtAlpcDisconnectPort", "131": "NtAlpcImpersonateClientContainerOfPort", "132": "NtAlpcImpersonateClientOfPort", "133": "NtAlpcOpenSenderProcess", "134": "NtAlpcOpenSenderThread", "135": "NtAlpcQueryInformation", "136": "NtAlpcQueryInformationMessage", "137": "NtAlpcRevokeSecurityContext", "138": "NtAlpcSendWaitReceivePort", "139": "NtAlpcSetInformation", "140": "NtAreMappedFilesTheSame", "141": "NtAssignProcessToJobObject", "142": "NtAssociateWaitCompletionPacket", "143": "NtCallEnclave", "144": "NtCancelIoFileEx", "145": "NtCancelSynchronousIoFile", "146": "NtCancelTimer2", "147": "NtCancelWaitCompletionPacket", "148": "NtCommitComplete", "149": "NtCommitEnlistment", "150": "NtCommitRegistryTransaction", "151": "NtCommitTransaction", "152": "NtCompactKeys", "153": "NtCompareObjects", "154": "NtCompareSigningLevels", "155": "NtCompareTokens", "156": "NtCompleteConnectPort", "157": "NtCompressKey", "158": "NtConnectPort", "159": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "160": "NtCreateCrossVmEvent", "161": "NtCreateDebugObject", "162": "NtCreateDirectoryObject", "163": "NtCreateDirectoryObjectEx", "164": "NtCreateEnclave", "165": "NtCreateEnlistment", "166": "NtCreateEventPair", "167": "NtCreateIRTimer", "168": "NtCreateIoCompletion", "169": "NtCreateJobObject", "170": "NtCreateJobSet", "171": "NtCreateKeyTransacted", "172": "NtCreateKeyedEvent", "173": "NtCreateLowBoxToken", "174": "NtCreateMailslotFile", "175": "NtCreateMutant", "176": "NtCreateNamedPipeFile", "177": "NtCreatePagingFile", "178": "NtCreatePartition", "179": "NtCreatePort", "180": "NtCreatePrivateNamespace", "181": "NtCreateProcess", "182": "NtCreateProfile", "183": "NtCreateProfileEx", "184": "NtCreateRegistryTransaction", "185": "NtCreateResourceManager", "186": "NtCreateSectionEx", "187": "NtCreateSemaphore", "188": "NtCreateSymbolicLinkObject", "189": "NtCreateThreadEx", "190": "NtCreateTimer", "191": "NtCreateTimer2", "192": "NtCreateToken", "193": "NtCreateTokenEx", "194": "NtCreateTransaction", "195": "NtCreateTransactionManager", "196": "NtCreateUserProcess", "197": "NtCreateWaitCompletionPacket", "198": "NtCreateWaitablePort", "199": "NtCreateWnfStateName", "200": "NtCreateWorkerFactory", "201": "NtDebugActiveProcess", "202": "NtDebugContinue", "203": "NtDeleteAtom", "204": "NtDeleteBootEntry", "205": "NtDeleteDriverEntry", "206": "NtDeleteFile", "207": "NtDeleteKey", "208": "NtDeleteObjectAuditAlarm", "209": "NtDeletePrivateNamespace", "210": "NtDeleteValueKey", "211": "NtDeleteWnfStateData", "212": "NtDeleteWnfStateName", "213": "NtDisableLastKnownGood", "214": "NtDisplayString", "215": "NtDrawText", "216": "NtEnableLastKnownGood", "217": "NtEnumerateBootEntries", "218": "NtEnumerateDriverEntries", "219": "NtEnumerateSystemEnvironmentValuesEx", "220": "NtEnumerateTransactionObject", "221": "NtExtendSection", "222": "NtFilterBootOption", "223": "NtFilterToken", "224": "NtFilterTokenEx", "225": "NtFlushBuffersFileEx", "226": "NtFlushInstallUILanguage", "227": "NtFlushInstructionCache", "228": "NtFlushKey", "229": "NtFlushProcessWriteBuffers", "230": "NtFlushVirtualMemory", "231": "NtFlushWriteBuffer", "232": "NtFreeUserPhysicalPages", "233": "NtFreezeRegistry", "234": "NtFreezeTransactions", "235": "NtGetCachedSigningLevel", "236": "NtGetCompleteWnfStateSubscription", "237": "NtGetContextThread", "238": "NtGetCurrentProcessorNumber", "239": "NtGetCurrentProcessorNumberEx", "240": "NtGetDevicePowerState", "241": "NtGetMUIRegistryInfo", "242": "NtGetNextProcess", "243": "NtGetNextThread", "244": "NtGetNlsSectionPtr", "245": "NtGetNotificationResourceManager", "246": "NtGetWriteWatch", "247": "NtImpersonateAnonymousToken", "248": "NtImpersonateThread", "249": "NtInitializeEnclave", "250": "NtInitializeNlsFiles", "251": "NtInitializeRegistry", "252": "NtInitiatePowerAction", "253": "NtIsSystemResumeAutomatic", "254": "NtIsUILanguageComitted", "255": "NtListenPort", "256": "NtLoadDriver", "257": "NtLoadEnclaveData", "258": "NtLoadKey", "259": "NtLoadKey2", "260": "NtLoadKeyEx", "261": "NtLockFile", "262": "NtLockProductActivationKeys", "263": "NtLockRegistryKey", "264": "NtLockVirtualMemory", "265": "NtMakePermanentObject", "266": "NtMakeTemporaryObject", "267": "NtManageHotPatch", "268": "NtManagePartition", "269": "NtMapCMFModule", "270": "NtMapUserPhysicalPages", "271": "NtMapViewOfSectionEx", "272": "NtModifyBootEntry", "273": "NtModifyDriverEntry", "274": "NtNotifyChangeDirectoryFile", "275": "NtNotifyChangeDirectoryFileEx", "276": "NtNotifyChangeKey", "277": "NtNotifyChangeMultipleKeys", "278": "NtNotifyChangeSession", "279": "NtOpenEnlistment", "280": "NtOpenEventPair", "281": "NtOpenIoCompletion", "282": "NtOpenJobObject", "283": "NtOpenKeyEx", "284": "NtOpenKeyTransacted", "285": "NtOpenKeyTransactedEx", "286": "NtOpenKeyedEvent", "287": "NtOpenMutant", "288": "NtOpenObjectAuditAlarm", "289": "NtOpenPartition", "290": "NtOpenPrivateNamespace", "291": "NtOpenProcessToken", "292": "NtOpenRegistryTransaction", "293": "NtOpenResourceManager", "294": "NtOpenSemaphore", "295": "NtOpenSession", "296": "NtOpenSymbolicLinkObject", "297": "NtOpenThread", "298": "NtOpenTimer", "299": "NtOpenTransaction", "300": "NtOpenTransactionManager", "301": "NtPlugPlayControl", "302": "NtPrePrepareComplete", "303": "NtPrePrepareEnlistment", "304": "NtPrepareComplete", "305": "NtPrepareEnlistment", "306": "NtPrivilegeCheck", "307": "NtPrivilegeObjectAuditAlarm", "308": "NtPrivilegedServiceAuditAlarm", "309": "NtPropagationComplete", "310": "NtPropagationFailed", "311": "NtPulseEvent", "312": "NtQueryAuxiliaryCounterFrequency", "313": "NtQueryBootEntryOrder", "314": "NtQueryBootOptions", "315": "NtQueryDebugFilterState", "316": "NtQueryDirectoryFileEx", "317": "NtQueryDirectoryObject", "318": "NtQueryDriverEntryOrder", "319": "NtQueryEaFile", "320": "NtQueryFullAttributesFile", "321": "NtQueryInformationAtom", "322": "NtQueryInformationByName", "323": "NtQueryInformationEnlistment", "324": "NtQueryInformationJobObject", "325": "NtQueryInformationPort", "326": "NtQueryInformationResourceManager", "327": "NtQueryInformationTransaction", "328": "NtQueryInformationTransactionManager", "329": "NtQueryInformationWorkerFactory", "330": "NtQueryInstallUILanguage", "331": "NtQueryIntervalProfile", "332": "NtQueryIoCompletion", "333": "NtQueryLicenseValue", "334": "NtQueryMultipleValueKey", "335": "NtQueryMutant", "336": "NtQueryOpenSubKeys", "337": "NtQueryOpenSubKeysEx", "338": "NtQueryPortInformationProcess", "339": "NtQueryQuotaInformationFile", "340": "NtQuerySecurityAttributesToken", "341": "NtQuerySecurityObject", "342": "NtQuerySecurityPolicy", "343": "NtQuerySemaphore", "344": "NtQuerySymbolicLinkObject", "345": "NtQuerySystemEnvironmentValue", "346": "NtQuerySystemEnvironmentValueEx", "347": "NtQuerySystemInformationEx", "348": "NtQueryTimerResolution", "349": "NtQueryWnfStateData", "350": "NtQueryWnfStateNameInformation", "351": "NtQueueApcThreadEx", "352": "NtRaiseException", "353": "NtRaiseHardError", "354": "NtReadOnlyEnlistment", "355": "NtRecoverEnlistment", "356": "NtRecoverResourceManager", "357": "NtRecoverTransactionManager", "358": "NtRegisterProtocolAddressInformation", "359": "NtRegisterThreadTerminatePort", "360": "NtReleaseKeyedEvent", "361": "NtReleaseWorkerFactoryWorker", "362": "NtRemoveIoCompletionEx", "363": "NtRemoveProcessDebug", "364": "NtRenameKey", "365": "NtRenameTransactionManager", "366": "NtReplaceKey", "367": "NtReplacePartitionUnit", "368": "NtReplyWaitReplyPort", "369": "NtRequestPort", "370": "NtResetEvent", "371": "NtResetWriteWatch", "372": "NtRestoreKey", "373": "NtResumeProcess", "374": "NtRevertContainerImpersonation", "375": "NtRollbackComplete", "376": "NtRollbackEnlistment", "377": "NtRollbackRegistryTransaction", "378": "NtRollbackTransaction", "379": "NtRollforwardTransactionManager", "380": "NtSaveKey", "381": "NtSaveKeyEx", "382": "NtSaveMergedKeys", "383": "NtSecureConnectPort", "384": "NtSerializeBoot", "385": "NtSetBootEntryOrder", "386": "NtSetBootOptions", "387": "NtSetCachedSigningLevel", "388": "NtSetCachedSigningLevel2", "389": "NtSetContextThread", "390": "NtSetDebugFilterState", "391": "NtSetDefaultHardErrorPort", "392": "NtSetDefaultLocale", "393": "NtSetDefaultUILanguage", "394": "NtSetDriverEntryOrder", "395": "NtSetEaFile", "396": "NtSetHighEventPair", "397": "NtSetHighWaitLowEventPair", "398": "NtSetIRTimer", "399": "NtSetInformationDebugObject", "400": "NtSetInformationEnlistment", "401": "NtSetInformationJobObject", "402": "NtSetInformationKey", "403": "NtSetInformationResourceManager", "404": "NtSetInformationSymbolicLink", "405": "NtSetInformationToken", "406": "NtSetInformationTransaction", "407": "NtSetInformationTransactionManager", "408": "NtSetInformationVirtualMemory", "409": "NtSetInformationWorkerFactory", "410": "NtSetIntervalProfile", "411": "NtSetIoCompletion", "412": "NtSetIoCompletionEx", "413": "NtSetLdtEntries", "414": "NtSetLowEventPair", "415": "NtSetLowWaitHighEventPair", "416": "NtSetQuotaInformationFile", "417": "NtSetSecurityObject", "418": "NtSetSystemEnvironmentValue", "419": "NtSetSystemEnvironmentValueEx", "420": "NtSetSystemInformation", "421": "NtSetSystemPowerState", "422": "NtSetSystemTime", "423": "NtSetThreadExecutionState", "424": "NtSetTimer2", "425": "NtSetTimerEx", "426": "NtSetTimerResolution", "427": "NtSetUuidSeed", "428": "NtSetVolumeInformationFile", "429": "NtSetWnfProcessNotificationEvent", "430": "NtShutdownSystem", "431": "NtShutdownWorkerFactory", "432": "NtSignalAndWaitForSingleObject", "433": "NtSinglePhaseReject", "434": "NtStartProfile", "435": "NtStopProfile", "436": "NtSubscribeWnfStateChange", "437": "NtSuspendProcess", "438": "NtSuspendThread", "439": "NtSystemDebugControl", "440": "NtTerminateEnclave", "441": "NtTerminateJobObject", "442": "NtTestAlert", "443": "NtThawRegistry", "444": "NtThawTransactions", "445": "NtTraceControl", "446": "NtTranslateFilePath", "447": "NtUmsThreadYield", "448": "NtUnloadDriver", "449": "NtUnloadKey", "450": "NtUnloadKey2", "451": "NtUnloadKeyEx", "452": "NtUnlockFile", "453": "NtUnlockVirtualMemory", "454": "NtUnmapViewOfSectionEx", "455": "NtUnsubscribeWnfStateChange", "456": "NtUpdateWnfStateData", "457": "NtVdmControl", "458": "NtWaitForAlertByThreadId", "459": "NtWaitForDebugEvent", "460": "NtWaitForKeyedEvent", "461": "NtWaitForWorkViaWorkerFactory", "462": "NtWaitHighEventPair", "463": "NtWaitLowEventPair"}, "1909": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireProcessActivityReference", "104": "NtAddAtomEx", "105": "NtAddBootEntry", "106": "NtAddDriverEntry", "107": "NtAdjustGroupsToken", "108": "NtAdjustTokenClaimsAndDeviceGroups", "109": "NtAlertResumeThread", "110": "NtAlertThread", "111": "NtAlertThreadByThreadId", "112": "NtAllocateLocallyUniqueId", "113": "NtAllocateReserveObject", "114": "NtAllocateUserPhysicalPages", "115": "NtAllocateUuids", "116": "NtAllocateVirtualMemoryEx", "117": "NtAlpcAcceptConnectPort", "118": "NtAlpcCancelMessage", "119": "NtAlpcConnectPort", "120": "NtAlpcConnectPortEx", "121": "NtAlpcCreatePort", "122": "NtAlpcCreatePortSection", "123": "NtAlpcCreateResourceReserve", "124": "NtAlpcCreateSectionView", "125": "NtAlpcCreateSecurityContext", "126": "NtAlpcDeletePortSection", "127": "NtAlpcDeleteResourceReserve", "128": "NtAlpcDeleteSectionView", "129": "NtAlpcDeleteSecurityContext", "130": "NtAlpcDisconnectPort", "131": "NtAlpcImpersonateClientContainerOfPort", "132": "NtAlpcImpersonateClientOfPort", "133": "NtAlpcOpenSenderProcess", "134": "NtAlpcOpenSenderThread", "135": "NtAlpcQueryInformation", "136": "NtAlpcQueryInformationMessage", "137": "NtAlpcRevokeSecurityContext", "138": "NtAlpcSendWaitReceivePort", "139": "NtAlpcSetInformation", "140": "NtAreMappedFilesTheSame", "141": "NtAssignProcessToJobObject", "142": "NtAssociateWaitCompletionPacket", "143": "NtCallEnclave", "144": "NtCancelIoFileEx", "145": "NtCancelSynchronousIoFile", "146": "NtCancelTimer2", "147": "NtCancelWaitCompletionPacket", "148": "NtCommitComplete", "149": "NtCommitEnlistment", "150": "NtCommitRegistryTransaction", "151": "NtCommitTransaction", "152": "NtCompactKeys", "153": "NtCompareObjects", "154": "NtCompareSigningLevels", "155": "NtCompareTokens", "156": "NtCompleteConnectPort", "157": "NtCompressKey", "158": "NtConnectPort", "159": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "160": "NtCreateCrossVmEvent", "161": "NtCreateDebugObject", "162": "NtCreateDirectoryObject", "163": "NtCreateDirectoryObjectEx", "164": "NtCreateEnclave", "165": "NtCreateEnlistment", "166": "NtCreateEventPair", "167": "NtCreateIRTimer", "168": "NtCreateIoCompletion", "169": "NtCreateJobObject", "170": "NtCreateJobSet", "171": "NtCreateKeyTransacted", "172": "NtCreateKeyedEvent", "173": "NtCreateLowBoxToken", "174": "NtCreateMailslotFile", "175": "NtCreateMutant", "176": "NtCreateNamedPipeFile", "177": "NtCreatePagingFile", "178": "NtCreatePartition", "179": "NtCreatePort", "180": "NtCreatePrivateNamespace", "181": "NtCreateProcess", "182": "NtCreateProfile", "183": "NtCreateProfileEx", "184": "NtCreateRegistryTransaction", "185": "NtCreateResourceManager", "186": "NtCreateSectionEx", "187": "NtCreateSemaphore", "188": "NtCreateSymbolicLinkObject", "189": "NtCreateThreadEx", "190": "NtCreateTimer", "191": "NtCreateTimer2", "192": "NtCreateToken", "193": "NtCreateTokenEx", "194": "NtCreateTransaction", "195": "NtCreateTransactionManager", "196": "NtCreateUserProcess", "197": "NtCreateWaitCompletionPacket", "198": "NtCreateWaitablePort", "199": "NtCreateWnfStateName", "200": "NtCreateWorkerFactory", "201": "NtDebugActiveProcess", "202": "NtDebugContinue", "203": "NtDeleteAtom", "204": "NtDeleteBootEntry", "205": "NtDeleteDriverEntry", "206": "NtDeleteFile", "207": "NtDeleteKey", "208": "NtDeleteObjectAuditAlarm", "209": "NtDeletePrivateNamespace", "210": "NtDeleteValueKey", "211": "NtDeleteWnfStateData", "212": "NtDeleteWnfStateName", "213": "NtDisableLastKnownGood", "214": "NtDisplayString", "215": "NtDrawText", "216": "NtEnableLastKnownGood", "217": "NtEnumerateBootEntries", "218": "NtEnumerateDriverEntries", "219": "NtEnumerateSystemEnvironmentValuesEx", "220": "NtEnumerateTransactionObject", "221": "NtExtendSection", "222": "NtFilterBootOption", "223": "NtFilterToken", "224": "NtFilterTokenEx", "225": "NtFlushBuffersFileEx", "226": "NtFlushInstallUILanguage", "227": "NtFlushInstructionCache", "228": "NtFlushKey", "229": "NtFlushProcessWriteBuffers", "230": "NtFlushVirtualMemory", "231": "NtFlushWriteBuffer", "232": "NtFreeUserPhysicalPages", "233": "NtFreezeRegistry", "234": "NtFreezeTransactions", "235": "NtGetCachedSigningLevel", "236": "NtGetCompleteWnfStateSubscription", "237": "NtGetContextThread", "238": "NtGetCurrentProcessorNumber", "239": "NtGetCurrentProcessorNumberEx", "240": "NtGetDevicePowerState", "241": "NtGetMUIRegistryInfo", "242": "NtGetNextProcess", "243": "NtGetNextThread", "244": "NtGetNlsSectionPtr", "245": "NtGetNotificationResourceManager", "246": "NtGetWriteWatch", "247": "NtImpersonateAnonymousToken", "248": "NtImpersonateThread", "249": "NtInitializeEnclave", "250": "NtInitializeNlsFiles", "251": "NtInitializeRegistry", "252": "NtInitiatePowerAction", "253": "NtIsSystemResumeAutomatic", "254": "NtIsUILanguageComitted", "255": "NtListenPort", "256": "NtLoadDriver", "257": "NtLoadEnclaveData", "258": "NtLoadKey", "259": "NtLoadKey2", "260": "NtLoadKeyEx", "261": "NtLockFile", "262": "NtLockProductActivationKeys", "263": "NtLockRegistryKey", "264": "NtLockVirtualMemory", "265": "NtMakePermanentObject", "266": "NtMakeTemporaryObject", "267": "NtManageHotPatch", "268": "NtManagePartition", "269": "NtMapCMFModule", "270": "NtMapUserPhysicalPages", "271": "NtMapViewOfSectionEx", "272": "NtModifyBootEntry", "273": "NtModifyDriverEntry", "274": "NtNotifyChangeDirectoryFile", "275": "NtNotifyChangeDirectoryFileEx", "276": "NtNotifyChangeKey", "277": "NtNotifyChangeMultipleKeys", "278": "NtNotifyChangeSession", "279": "NtOpenEnlistment", "280": "NtOpenEventPair", "281": "NtOpenIoCompletion", "282": "NtOpenJobObject", "283": "NtOpenKeyEx", "284": "NtOpenKeyTransacted", "285": "NtOpenKeyTransactedEx", "286": "NtOpenKeyedEvent", "287": "NtOpenMutant", "288": "NtOpenObjectAuditAlarm", "289": "NtOpenPartition", "290": "NtOpenPrivateNamespace", "291": "NtOpenProcessToken", "292": "NtOpenRegistryTransaction", "293": "NtOpenResourceManager", "294": "NtOpenSemaphore", "295": "NtOpenSession", "296": "NtOpenSymbolicLinkObject", "297": "NtOpenThread", "298": "NtOpenTimer", "299": "NtOpenTransaction", "300": "NtOpenTransactionManager", "301": "NtPlugPlayControl", "302": "NtPrePrepareComplete", "303": "NtPrePrepareEnlistment", "304": "NtPrepareComplete", "305": "NtPrepareEnlistment", "306": "NtPrivilegeCheck", "307": "NtPrivilegeObjectAuditAlarm", "308": "NtPrivilegedServiceAuditAlarm", "309": "NtPropagationComplete", "310": "NtPropagationFailed", "311": "NtPulseEvent", "312": "NtQueryAuxiliaryCounterFrequency", "313": "NtQueryBootEntryOrder", "314": "NtQueryBootOptions", "315": "NtQueryDebugFilterState", "316": "NtQueryDirectoryFileEx", "317": "NtQueryDirectoryObject", "318": "NtQueryDriverEntryOrder", "319": "NtQueryEaFile", "320": "NtQueryFullAttributesFile", "321": "NtQueryInformationAtom", "322": "NtQueryInformationByName", "323": "NtQueryInformationEnlistment", "324": "NtQueryInformationJobObject", "325": "NtQueryInformationPort", "326": "NtQueryInformationResourceManager", "327": "NtQueryInformationTransaction", "328": "NtQueryInformationTransactionManager", "329": "NtQueryInformationWorkerFactory", "330": "NtQueryInstallUILanguage", "331": "NtQueryIntervalProfile", "332": "NtQueryIoCompletion", "333": "NtQueryLicenseValue", "334": "NtQueryMultipleValueKey", "335": "NtQueryMutant", "336": "NtQueryOpenSubKeys", "337": "NtQueryOpenSubKeysEx", "338": "NtQueryPortInformationProcess", "339": "NtQueryQuotaInformationFile", "340": "NtQuerySecurityAttributesToken", "341": "NtQuerySecurityObject", "342": "NtQuerySecurityPolicy", "343": "NtQuerySemaphore", "344": "NtQuerySymbolicLinkObject", "345": "NtQuerySystemEnvironmentValue", "346": "NtQuerySystemEnvironmentValueEx", "347": "NtQuerySystemInformationEx", "348": "NtQueryTimerResolution", "349": "NtQueryWnfStateData", "350": "NtQueryWnfStateNameInformation", "351": "NtQueueApcThreadEx", "352": "NtRaiseException", "353": "NtRaiseHardError", "354": "NtReadOnlyEnlistment", "355": "NtRecoverEnlistment", "356": "NtRecoverResourceManager", "357": "NtRecoverTransactionManager", "358": "NtRegisterProtocolAddressInformation", "359": "NtRegisterThreadTerminatePort", "360": "NtReleaseKeyedEvent", "361": "NtReleaseWorkerFactoryWorker", "362": "NtRemoveIoCompletionEx", "363": "NtRemoveProcessDebug", "364": "NtRenameKey", "365": "NtRenameTransactionManager", "366": "NtReplaceKey", "367": "NtReplacePartitionUnit", "368": "NtReplyWaitReplyPort", "369": "NtRequestPort", "370": "NtResetEvent", "371": "NtResetWriteWatch", "372": "NtRestoreKey", "373": "NtResumeProcess", "374": "NtRevertContainerImpersonation", "375": "NtRollbackComplete", "376": "NtRollbackEnlistment", "377": "NtRollbackRegistryTransaction", "378": "NtRollbackTransaction", "379": "NtRollforwardTransactionManager", "380": "NtSaveKey", "381": "NtSaveKeyEx", "382": "NtSaveMergedKeys", "383": "NtSecureConnectPort", "384": "NtSerializeBoot", "385": "NtSetBootEntryOrder", "386": "NtSetBootOptions", "387": "NtSetCachedSigningLevel", "388": "NtSetCachedSigningLevel2", "389": "NtSetContextThread", "390": "NtSetDebugFilterState", "391": "NtSetDefaultHardErrorPort", "392": "NtSetDefaultLocale", "393": "NtSetDefaultUILanguage", "394": "NtSetDriverEntryOrder", "395": "NtSetEaFile", "396": "NtSetHighEventPair", "397": "NtSetHighWaitLowEventPair", "398": "NtSetIRTimer", "399": "NtSetInformationDebugObject", "400": "NtSetInformationEnlistment", "401": "NtSetInformationJobObject", "402": "NtSetInformationKey", "403": "NtSetInformationResourceManager", "404": "NtSetInformationSymbolicLink", "405": "NtSetInformationToken", "406": "NtSetInformationTransaction", "407": "NtSetInformationTransactionManager", "408": "NtSetInformationVirtualMemory", "409": "NtSetInformationWorkerFactory", "410": "NtSetIntervalProfile", "411": "NtSetIoCompletion", "412": "NtSetIoCompletionEx", "413": "NtSetLdtEntries", "414": "NtSetLowEventPair", "415": "NtSetLowWaitHighEventPair", "416": "NtSetQuotaInformationFile", "417": "NtSetSecurityObject", "418": "NtSetSystemEnvironmentValue", "419": "NtSetSystemEnvironmentValueEx", "420": "NtSetSystemInformation", "421": "NtSetSystemPowerState", "422": "NtSetSystemTime", "423": "NtSetThreadExecutionState", "424": "NtSetTimer2", "425": "NtSetTimerEx", "426": "NtSetTimerResolution", "427": "NtSetUuidSeed", "428": "NtSetVolumeInformationFile", "429": "NtSetWnfProcessNotificationEvent", "430": "NtShutdownSystem", "431": "NtShutdownWorkerFactory", "432": "NtSignalAndWaitForSingleObject", "433": "NtSinglePhaseReject", "434": "NtStartProfile", "435": "NtStopProfile", "436": "NtSubscribeWnfStateChange", "437": "NtSuspendProcess", "438": "NtSuspendThread", "439": "NtSystemDebugControl", "440": "NtTerminateEnclave", "441": "NtTerminateJobObject", "442": "NtTestAlert", "443": "NtThawRegistry", "444": "NtThawTransactions", "445": "NtTraceControl", "446": "NtTranslateFilePath", "447": "NtUmsThreadYield", "448": "NtUnloadDriver", "449": "NtUnloadKey", "450": "NtUnloadKey2", "451": "NtUnloadKeyEx", "452": "NtUnlockFile", "453": "NtUnlockVirtualMemory", "454": "NtUnmapViewOfSectionEx", "455": "NtUnsubscribeWnfStateChange", "456": "NtUpdateWnfStateData", "457": "NtVdmControl", "458": "NtWaitForAlertByThreadId", "459": "NtWaitForDebugEvent", "460": "NtWaitForKeyedEvent", "461": "NtWaitForWorkViaWorkerFactory", "462": "NtWaitHighEventPair", "463": "NtWaitLowEventPair"}, "2004": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireCrossVmMutant", "104": "NtAcquireProcessActivityReference", "105": "NtAddAtomEx", "106": "NtAddBootEntry", "107": "NtAddDriverEntry", "108": "NtAdjustGroupsToken", "109": "NtAdjustTokenClaimsAndDeviceGroups", "110": "NtAlertResumeThread", "111": "NtAlertThread", "112": "NtAlertThreadByThreadId", "113": "NtAllocateLocallyUniqueId", "114": "NtAllocateReserveObject", "115": "NtAllocateUserPhysicalPages", "116": "NtAllocateUserPhysicalPagesEx", "117": "NtAllocateUuids", "118": "NtAllocateVirtualMemoryEx", "119": "NtAlpcAcceptConnectPort", "120": "NtAlpcCancelMessage", "121": "NtAlpcConnectPort", "122": "NtAlpcConnectPortEx", "123": "NtAlpcCreatePort", "124": "NtAlpcCreatePortSection", "125": "NtAlpcCreateResourceReserve", "126": "NtAlpcCreateSectionView", "127": "NtAlpcCreateSecurityContext", "128": "NtAlpcDeletePortSection", "129": "NtAlpcDeleteResourceReserve", "130": "NtAlpcDeleteSectionView", "131": "NtAlpcDeleteSecurityContext", "132": "NtAlpcDisconnectPort", "133": "NtAlpcImpersonateClientContainerOfPort", "134": "NtAlpcImpersonateClientOfPort", "135": "NtAlpcOpenSenderProcess", "136": "NtAlpcOpenSenderThread", "137": "NtAlpcQueryInformation", "138": "NtAlpcQueryInformationMessage", "139": "NtAlpcRevokeSecurityContext", "140": "NtAlpcSendWaitReceivePort", "141": "NtAlpcSetInformation", "142": "NtAreMappedFilesTheSame", "143": "NtAssignProcessToJobObject", "144": "NtAssociateWaitCompletionPacket", "145": "NtCallEnclave", "146": "NtCancelIoFileEx", "147": "NtCancelSynchronousIoFile", "148": "NtCancelTimer2", "149": "NtCancelWaitCompletionPacket", "150": "NtCommitComplete", "151": "NtCommitEnlistment", "152": "NtCommitRegistryTransaction", "153": "NtCommitTransaction", "154": "NtCompactKeys", "155": "NtCompareObjects", "156": "NtCompareSigningLevels", "157": "NtCompareTokens", "158": "NtCompleteConnectPort", "159": "NtCompressKey", "160": "NtConnectPort", "161": "NtContinueEx", "162": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "163": "NtCreateCrossVmEvent", "164": "NtCreateCrossVmMutant", "165": "NtCreateDebugObject", "166": "NtCreateDirectoryObject", "167": "NtCreateDirectoryObjectEx", "168": "NtCreateEnclave", "169": "NtCreateEnlistment", "170": "NtCreateEventPair", "171": "NtCreateIRTimer", "172": "NtCreateIoCompletion", "173": "NtCreateJobObject", "174": "NtCreateJobSet", "175": "NtCreateKeyTransacted", "176": "NtCreateKeyedEvent", "177": "NtCreateLowBoxToken", "178": "NtCreateMailslotFile", "179": "NtCreateMutant", "180": "NtCreateNamedPipeFile", "181": "NtCreatePagingFile", "182": "NtCreatePartition", "183": "NtCreatePort", "184": "NtCreatePrivateNamespace", "185": "NtCreateProcess", "186": "NtCreateProfile", "187": "NtCreateProfileEx", "188": "NtCreateRegistryTransaction", "189": "NtCreateResourceManager", "190": "NtCreateSectionEx", "191": "NtCreateSemaphore", "192": "NtCreateSymbolicLinkObject", "193": "NtCreateThreadEx", "194": "NtCreateTimer", "195": "NtCreateTimer2", "196": "NtCreateToken", "197": "NtCreateTokenEx", "198": "NtCreateTransaction", "199": "NtCreateTransactionManager", "200": "NtCreateUserProcess", "201": "NtCreateWaitCompletionPacket", "202": "NtCreateWaitablePort", "203": "NtCreateWnfStateName", "204": "NtCreateWorkerFactory", "205": "NtDebugActiveProcess", "206": "NtDebugContinue", "207": "NtDeleteAtom", "208": "NtDeleteBootEntry", "209": "NtDeleteDriverEntry", "210": "NtDeleteFile", "211": "NtDeleteKey", "212": "NtDeleteObjectAuditAlarm", "213": "NtDeletePrivateNamespace", "214": "NtDeleteValueKey", "215": "NtDeleteWnfStateData", "216": "NtDeleteWnfStateName", "217": "NtDirectGraphicsCall", "218": "NtDisableLastKnownGood", "219": "NtDisplayString", "220": "NtDrawText", "221": "NtEnableLastKnownGood", "222": "NtEnumerateBootEntries", "223": "NtEnumerateDriverEntries", "224": "NtEnumerateSystemEnvironmentValuesEx", "225": "NtEnumerateTransactionObject", "226": "NtExtendSection", "227": "NtFilterBootOption", "228": "NtFilterToken", "229": "NtFilterTokenEx", "230": "NtFlushBuffersFileEx", "231": "NtFlushInstallUILanguage", "232": "NtFlushInstructionCache", "233": "NtFlushKey", "234": "NtFlushProcessWriteBuffers", "235": "NtFlushVirtualMemory", "236": "NtFlushWriteBuffer", "237": "NtFreeUserPhysicalPages", "238": "NtFreezeRegistry", "239": "NtFreezeTransactions", "240": "NtGetCachedSigningLevel", "241": "NtGetCompleteWnfStateSubscription", "242": "NtGetContextThread", "243": "NtGetCurrentProcessorNumber", "244": "NtGetCurrentProcessorNumberEx", "245": "NtGetDevicePowerState", "246": "NtGetMUIRegistryInfo", "247": "NtGetNextProcess", "248": "NtGetNextThread", "249": "NtGetNlsSectionPtr", "250": "NtGetNotificationResourceManager", "251": "NtGetWriteWatch", "252": "NtImpersonateAnonymousToken", "253": "NtImpersonateThread", "254": "NtInitializeEnclave", "255": "NtInitializeNlsFiles", "256": "NtInitializeRegistry", "257": "NtInitiatePowerAction", "258": "NtIsSystemResumeAutomatic", "259": "NtIsUILanguageComitted", "260": "NtListenPort", "261": "NtLoadDriver", "262": "NtLoadEnclaveData", "263": "NtLoadKey", "264": "NtLoadKey2", "265": "NtLoadKeyEx", "266": "NtLockFile", "267": "NtLockProductActivationKeys", "268": "NtLockRegistryKey", "269": "NtLockVirtualMemory", "270": "NtMakePermanentObject", "271": "NtMakeTemporaryObject", "272": "NtManageHotPatch", "273": "NtManagePartition", "274": "NtMapCMFModule", "275": "NtMapUserPhysicalPages", "276": "NtMapViewOfSectionEx", "277": "NtModifyBootEntry", "278": "NtModifyDriverEntry", "279": "NtNotifyChangeDirectoryFile", "280": "NtNotifyChangeDirectoryFileEx", "281": "NtNotifyChangeKey", "282": "NtNotifyChangeMultipleKeys", "283": "NtNotifyChangeSession", "284": "NtOpenEnlistment", "285": "NtOpenEventPair", "286": "NtOpenIoCompletion", "287": "NtOpenJobObject", "288": "NtOpenKeyEx", "289": "NtOpenKeyTransacted", "290": "NtOpenKeyTransactedEx", "291": "NtOpenKeyedEvent", "292": "NtOpenMutant", "293": "NtOpenObjectAuditAlarm", "294": "NtOpenPartition", "295": "NtOpenPrivateNamespace", "296": "NtOpenProcessToken", "297": "NtOpenRegistryTransaction", "298": "NtOpenResourceManager", "299": "NtOpenSemaphore", "300": "NtOpenSession", "301": "NtOpenSymbolicLinkObject", "302": "NtOpenThread", "303": "NtOpenTimer", "304": "NtOpenTransaction", "305": "NtOpenTransactionManager", "306": "NtPlugPlayControl", "307": "NtPrePrepareComplete", "308": "NtPrePrepareEnlistment", "309": "NtPrepareComplete", "310": "NtPrepareEnlistment", "311": "NtPrivilegeCheck", "312": "NtPrivilegeObjectAuditAlarm", "313": "NtPrivilegedServiceAuditAlarm", "314": "NtPropagationComplete", "315": "NtPropagationFailed", "316": "NtPssCaptureVaSpaceBulk", "317": "NtPulseEvent", "318": "NtQueryAuxiliaryCounterFrequency", "319": "NtQueryBootEntryOrder", "320": "NtQueryBootOptions", "321": "NtQueryDebugFilterState", "322": "NtQueryDirectoryFileEx", "323": "NtQueryDirectoryObject", "324": "NtQueryDriverEntryOrder", "325": "NtQueryEaFile", "326": "NtQueryFullAttributesFile", "327": "NtQueryInformationAtom", "328": "NtQueryInformationByName", "329": "NtQueryInformationEnlistment", "330": "NtQueryInformationJobObject", "331": "NtQueryInformationPort", "332": "NtQueryInformationResourceManager", "333": "NtQueryInformationTransaction", "334": "NtQueryInformationTransactionManager", "335": "NtQueryInformationWorkerFactory", "336": "NtQueryInstallUILanguage", "337": "NtQueryIntervalProfile", "338": "NtQueryIoCompletion", "339": "NtQueryLicenseValue", "340": "NtQueryMultipleValueKey", "341": "NtQueryMutant", "342": "NtQueryOpenSubKeys", "343": "NtQueryOpenSubKeysEx", "344": "NtQueryPortInformationProcess", "345": "NtQueryQuotaInformationFile", "346": "NtQuerySecurityAttributesToken", "347": "NtQuerySecurityObject", "348": "NtQuerySecurityPolicy", "349": "NtQuerySemaphore", "350": "NtQuerySymbolicLinkObject", "351": "NtQuerySystemEnvironmentValue", "352": "NtQuerySystemEnvironmentValueEx", "353": "NtQuerySystemInformationEx", "354": "NtQueryTimerResolution", "355": "NtQueryWnfStateData", "356": "NtQueryWnfStateNameInformation", "357": "NtQueueApcThreadEx", "358": "NtRaiseException", "359": "NtRaiseHardError", "360": "NtReadOnlyEnlistment", "361": "NtRecoverEnlistment", "362": "NtRecoverResourceManager", "363": "NtRecoverTransactionManager", "364": "NtRegisterProtocolAddressInformation", "365": "NtRegisterThreadTerminatePort", "366": "NtReleaseKeyedEvent", "367": "NtReleaseWorkerFactoryWorker", "368": "NtRemoveIoCompletionEx", "369": "NtRemoveProcessDebug", "370": "NtRenameKey", "371": "NtRenameTransactionManager", "372": "NtReplaceKey", "373": "NtReplacePartitionUnit", "374": "NtReplyWaitReplyPort", "375": "NtRequestPort", "376": "NtResetEvent", "377": "NtResetWriteWatch", "378": "NtRestoreKey", "379": "NtResumeProcess", "380": "NtRevertContainerImpersonation", "381": "NtRollbackComplete", "382": "NtRollbackEnlistment", "383": "NtRollbackRegistryTransaction", "384": "NtRollbackTransaction", "385": "NtRollforwardTransactionManager", "386": "NtSaveKey", "387": "NtSaveKeyEx", "388": "NtSaveMergedKeys", "389": "NtSecureConnectPort", "390": "NtSerializeBoot", "391": "NtSetBootEntryOrder", "392": "NtSetBootOptions", "393": "NtSetCachedSigningLevel", "394": "NtSetCachedSigningLevel2", "395": "NtSetContextThread", "396": "NtSetDebugFilterState", "397": "NtSetDefaultHardErrorPort", "398": "NtSetDefaultLocale", "399": "NtSetDefaultUILanguage", "400": "NtSetDriverEntryOrder", "401": "NtSetEaFile", "402": "NtSetHighEventPair", "403": "NtSetHighWaitLowEventPair", "404": "NtSetIRTimer", "405": "NtSetInformationDebugObject", "406": "NtSetInformationEnlistment", "407": "NtSetInformationJobObject", "408": "NtSetInformationKey", "409": "NtSetInformationResourceManager", "410": "NtSetInformationSymbolicLink", "411": "NtSetInformationToken", "412": "NtSetInformationTransaction", "413": "NtSetInformationTransactionManager", "414": "NtSetInformationVirtualMemory", "415": "NtSetInformationWorkerFactory", "416": "NtSetIntervalProfile", "417": "NtSetIoCompletion", "418": "NtSetIoCompletionEx", "419": "NtSetLdtEntries", "420": "NtSetLowEventPair", "421": "NtSetLowWaitHighEventPair", "422": "NtSetQuotaInformationFile", "423": "NtSetSecurityObject", "424": "NtSetSystemEnvironmentValue", "425": "NtSetSystemEnvironmentValueEx", "426": "NtSetSystemInformation", "427": "NtSetSystemPowerState", "428": "NtSetSystemTime", "429": "NtSetThreadExecutionState", "430": "NtSetTimer2", "431": "NtSetTimerEx", "432": "NtSetTimerResolution", "433": "NtSetUuidSeed", "434": "NtSetVolumeInformationFile", "435": "NtSetWnfProcessNotificationEvent", "436": "NtShutdownSystem", "437": "NtShutdownWorkerFactory", "438": "NtSignalAndWaitForSingleObject", "439": "NtSinglePhaseReject", "440": "NtStartProfile", "441": "NtStopProfile", "442": "NtSubscribeWnfStateChange", "443": "NtSuspendProcess", "444": "NtSuspendThread", "445": "NtSystemDebugControl", "446": "NtTerminateEnclave", "447": "NtTerminateJobObject", "448": "NtTestAlert", "449": "NtThawRegistry", "450": "NtThawTransactions", "451": "NtTraceControl", "452": "NtTranslateFilePath", "453": "NtUmsThreadYield", "454": "NtUnloadDriver", "455": "NtUnloadKey", "456": "NtUnloadKey2", "457": "NtUnloadKeyEx", "458": "NtUnlockFile", "459": "NtUnlockVirtualMemory", "460": "NtUnmapViewOfSectionEx", "461": "NtUnsubscribeWnfStateChange", "462": "NtUpdateWnfStateData", "463": "NtVdmControl", "464": "NtWaitForAlertByThreadId", "465": "NtWaitForDebugEvent", "466": "NtWaitForKeyedEvent", "467": "NtWaitForWorkViaWorkerFactory", "468": "NtWaitHighEventPair", "469": "NtWaitLowEventPair", "470": "NtLoadKey3"}, "20H2": {"0": "NtAccessCheck", "1": "NtWorkerFactoryWorkerReady", "2": "NtAcceptConnectPort", "3": "NtMapUserPhysicalPagesScatter", "4": "NtWaitForSingleObject", "5": "NtCallbackReturn", "6": "NtReadFile", "7": "NtDeviceIoControlFile", "8": "NtWriteFile", "9": "NtRemoveIoCompletion", "10": "NtReleaseSemaphore", "11": "NtReplyWaitReceivePort", "12": "NtReplyPort", "13": "NtSetInformationThread", "14": "NtSetEvent", "15": "NtClose", "16": "NtQueryObject", "17": "NtQueryInformationFile", "18": "NtOpenKey", "19": "NtEnumerateValueKey", "20": "NtFindAtom", "21": "NtQueryDefaultLocale", "22": "NtQueryKey", "23": "NtQueryValueKey", "24": "NtAllocateVirtualMemory", "25": "NtQueryInformationProcess", "26": "NtWaitForMultipleObjects32", "27": "NtWriteFileGather", "28": "NtSetInformationProcess", "29": "NtCreateKey", "30": "NtFreeVirtualMemory", "31": "NtImpersonateClientOfPort", "32": "NtReleaseMutant", "33": "NtQueryInformationToken", "34": "NtRequestWaitReplyPort", "35": "NtQueryVirtualMemory", "36": "NtOpenThreadToken", "37": "NtQueryInformationThread", "38": "NtOpenProcess", "39": "NtSetInformationFile", "40": "NtMapViewOfSection", "41": "NtAccessCheckAndAuditAlarm", "42": "NtUnmapViewOfSection", "43": "NtReplyWaitReceivePortEx", "44": "NtTerminateProcess", "45": "NtSetEventBoostPriority", "46": "NtReadFileScatter", "47": "NtOpenThreadTokenEx", "48": "NtOpenProcessTokenEx", "49": "NtQueryPerformanceCounter", "50": "NtEnumerateKey", "51": "NtOpenFile", "52": "NtDelayExecution", "53": "NtQueryDirectoryFile", "54": "NtQuerySystemInformation", "55": "NtOpenSection", "56": "NtQueryTimer", "57": "NtFsControlFile", "58": "NtWriteVirtualMemory", "59": "NtCloseObjectAuditAlarm", "60": "NtDuplicateObject", "61": "NtQueryAttributesFile", "62": "NtClearEvent", "63": "NtReadVirtualMemory", "64": "NtOpenEvent", "65": "NtAdjustPrivilegesToken", "66": "NtDuplicateToken", "67": "NtContinue", "68": "NtQueryDefaultUILanguage", "69": "NtQueueApcThread", "70": "NtYieldExecution", "71": "NtAddAtom", "72": "NtCreateEvent", "73": "NtQueryVolumeInformationFile", "74": "NtCreateSection", "75": "NtFlushBuffersFile", "76": "NtApphelpCacheControl", "77": "NtCreateProcessEx", "78": "NtCreateThread", "79": "NtIsProcessInJob", "80": "NtProtectVirtualMemory", "81": "NtQuerySection", "82": "NtResumeThread", "83": "NtTerminateThread", "84": "NtReadRequestData", "85": "NtCreateFile", "86": "NtQueryEvent", "87": "NtWriteRequestData", "88": "NtOpenDirectoryObject", "89": "NtAccessCheckByTypeAndAuditAlarm", "90": "NtQuerySystemTime", "91": "NtWaitForMultipleObjects", "92": "NtSetInformationObject", "93": "NtCancelIoFile", "94": "NtTraceEvent", "95": "NtPowerInformation", "96": "NtSetValueKey", "97": "NtCancelTimer", "98": "NtSetTimer", "99": "NtAccessCheckByType", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireCrossVmMutant", "104": "NtAcquireProcessActivityReference", "105": "NtAddAtomEx", "106": "NtAddBootEntry", "107": "NtAddDriverEntry", "108": "NtAdjustGroupsToken", "109": "NtAdjustTokenClaimsAndDeviceGroups", "110": "NtAlertResumeThread", "111": "NtAlertThread", "112": "NtAlertThreadByThreadId", "113": "NtAllocateLocallyUniqueId", "114": "NtAllocateReserveObject", "115": "NtAllocateUserPhysicalPages", "116": "NtAllocateUserPhysicalPagesEx", "117": "NtAllocateUuids", "118": "NtAllocateVirtualMemoryEx", "119": "NtAlpcAcceptConnectPort", "120": "NtAlpcCancelMessage", "121": "NtAlpcConnectPort", "122": "NtAlpcConnectPortEx", "123": "NtAlpcCreatePort", "124": "NtAlpcCreatePortSection", "125": "NtAlpcCreateResourceReserve", "126": "NtAlpcCreateSectionView", "127": "NtAlpcCreateSecurityContext", "128": "NtAlpcDeletePortSection", "129": "NtAlpcDeleteResourceReserve", "130": "NtAlpcDeleteSectionView", "131": "NtAlpcDeleteSecurityContext", "132": "NtAlpcDisconnectPort", "133": "NtAlpcImpersonateClientContainerOfPort", "134": "NtAlpcImpersonateClientOfPort", "135": "NtAlpcOpenSenderProcess", "136": "NtAlpcOpenSenderThread", "137": "NtAlpcQueryInformation", "138": "NtAlpcQueryInformationMessage", "139": "NtAlpcRevokeSecurityContext", "140": "NtAlpcSendWaitReceivePort", "141": "NtAlpcSetInformation", "142": "NtAreMappedFilesTheSame", "143": "NtAssignProcessToJobObject", "144": "NtAssociateWaitCompletionPacket", "145": "NtCallEnclave", "146": "NtCancelIoFileEx", "147": "NtCancelSynchronousIoFile", "148": "NtCancelTimer2", "149": "NtCancelWaitCompletionPacket", "150": "NtCommitComplete", "151": "NtCommitEnlistment", "152": "NtCommitRegistryTransaction", "153": "NtCommitTransaction", "154": "NtCompactKeys", "155": "NtCompareObjects", "156": "NtCompareSigningLevels", "157": "NtCompareTokens", "158": "NtCompleteConnectPort", "159": "NtCompressKey", "160": "NtConnectPort", "161": "NtContinueEx", "162": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "163": "NtCreateCrossVmEvent", "164": "NtCreateCrossVmMutant", "165": "NtCreateDebugObject", "166": "NtCreateDirectoryObject", "167": "NtCreateDirectoryObjectEx", "168": "NtCreateEnclave", "169": "NtCreateEnlistment", "170": "NtCreateEventPair", "171": "NtCreateIRTimer", "172": "NtCreateIoCompletion", "173": "NtCreateJobObject", "174": "NtCreateJobSet", "175": "NtCreateKeyTransacted", "176": "NtCreateKeyedEvent", "177": "NtCreateLowBoxToken", "178": "NtCreateMailslotFile", "179": "NtCreateMutant", "180": "NtCreateNamedPipeFile", "181": "NtCreatePagingFile", "182": "NtCreatePartition", "183": "NtCreatePort", "184": "NtCreatePrivateNamespace", "185": "NtCreateProcess", "186": "NtCreateProfile", "187": "NtCreateProfileEx", "188": "NtCreateRegistryTransaction", "189": "NtCreateResourceManager", "190": "NtCreateSectionEx", "191": "NtCreateSemaphore", "192": "NtCreateSymbolicLinkObject", "193": "NtCreateThreadEx", "194": "NtCreateTimer", "195": "NtCreateTimer2", "196": "NtCreateToken", "197": "NtCreateTokenEx", "198": "NtCreateTransaction", "199": "NtCreateTransactionManager", "200": "NtCreateUserProcess", "201": "NtCreateWaitCompletionPacket", "202": "NtCreateWaitablePort", "203": "NtCreateWnfStateName", "204": "NtCreateWorkerFactory", "205": "NtDebugActiveProcess", "206": "NtDebugContinue", "207": "NtDeleteAtom", "208": "NtDeleteBootEntry", "209": "NtDeleteDriverEntry", "210": "NtDeleteFile", "211": "NtDeleteKey", "212": "NtDeleteObjectAuditAlarm", "213": "NtDeletePrivateNamespace", "214": "NtDeleteValueKey", "215": "NtDeleteWnfStateData", "216": "NtDeleteWnfStateName", "217": "NtDirectGraphicsCall", "218": "NtDisableLastKnownGood", "219": "NtDisplayString", "220": "NtDrawText", "221": "NtEnableLastKnownGood", "222": "NtEnumerateBootEntries", "223": "NtEnumerateDriverEntries", "224": "NtEnumerateSystemEnvironmentValuesEx", "225": "NtEnumerateTransactionObject", "226": "NtExtendSection", "227": "NtFilterBootOption", "228": "NtFilterToken", "229": "NtFilterTokenEx", "230": "NtFlushBuffersFileEx", "231": "NtFlushInstallUILanguage", "232": "NtFlushInstructionCache", "233": "NtFlushKey", "234": "NtFlushProcessWriteBuffers", "235": "NtFlushVirtualMemory", "236": "NtFlushWriteBuffer", "237": "NtFreeUserPhysicalPages", "238": "NtFreezeRegistry", "239": "NtFreezeTransactions", "240": "NtGetCachedSigningLevel", "241": "NtGetCompleteWnfStateSubscription", "242": "NtGetContextThread", "243": "NtGetCurrentProcessorNumber", "244": "NtGetCurrentProcessorNumberEx", "245": "NtGetDevicePowerState", "246": "NtGetMUIRegistryInfo", "247": "NtGetNextProcess", "248": "NtGetNextThread", "249": "NtGetNlsSectionPtr", "250": "NtGetNotificationResourceManager", "251": "NtGetWriteWatch", "252": "NtImpersonateAnonymousToken", "253": "NtImpersonateThread", "254": "NtInitializeEnclave", "255": "NtInitializeNlsFiles", "256": "NtInitializeRegistry", "257": "NtInitiatePowerAction", "258": "NtIsSystemResumeAutomatic", "259": "NtIsUILanguageComitted", "260": "NtListenPort", "261": "NtLoadDriver", "262": "NtLoadEnclaveData", "263": "NtLoadKey", "264": "NtLoadKey2", "265": "NtLoadKeyEx", "266": "NtLockFile", "267": "NtLockProductActivationKeys", "268": "NtLockRegistryKey", "269": "NtLockVirtualMemory", "270": "NtMakePermanentObject", "271": "NtMakeTemporaryObject", "272": "NtManageHotPatch", "273": "NtManagePartition", "274": "NtMapCMFModule", "275": "NtMapUserPhysicalPages", "276": "NtMapViewOfSectionEx", "277": "NtModifyBootEntry", "278": "NtModifyDriverEntry", "279": "NtNotifyChangeDirectoryFile", "280": "NtNotifyChangeDirectoryFileEx", "281": "NtNotifyChangeKey", "282": "NtNotifyChangeMultipleKeys", "283": "NtNotifyChangeSession", "284": "NtOpenEnlistment", "285": "NtOpenEventPair", "286": "NtOpenIoCompletion", "287": "NtOpenJobObject", "288": "NtOpenKeyEx", "289": "NtOpenKeyTransacted", "290": "NtOpenKeyTransactedEx", "291": "NtOpenKeyedEvent", "292": "NtOpenMutant", "293": "NtOpenObjectAuditAlarm", "294": "NtOpenPartition", "295": "NtOpenPrivateNamespace", "296": "NtOpenProcessToken", "297": "NtOpenRegistryTransaction", "298": "NtOpenResourceManager", "299": "NtOpenSemaphore", "300": "NtOpenSession", "301": "NtOpenSymbolicLinkObject", "302": "NtOpenThread", "303": "NtOpenTimer", "304": "NtOpenTransaction", "305": "NtOpenTransactionManager", "306": "NtPlugPlayControl", "307": "NtPrePrepareComplete", "308": "NtPrePrepareEnlistment", "309": "NtPrepareComplete", "310": "NtPrepareEnlistment", "311": "NtPrivilegeCheck", "312": "NtPrivilegeObjectAuditAlarm", "313": "NtPrivilegedServiceAuditAlarm", "314": "NtPropagationComplete", "315": "NtPropagationFailed", "316": "NtPssCaptureVaSpaceBulk", "317": "NtPulseEvent", "318": "NtQueryAuxiliaryCounterFrequency", "319": "NtQueryBootEntryOrder", "320": "NtQueryBootOptions", "321": "NtQueryDebugFilterState", "322": "NtQueryDirectoryFileEx", "323": "NtQueryDirectoryObject", "324": "NtQueryDriverEntryOrder", "325": "NtQueryEaFile", "326": "NtQueryFullAttributesFile", "327": "NtQueryInformationAtom", "328": "NtQueryInformationByName", "329": "NtQueryInformationEnlistment", "330": "NtQueryInformationJobObject", "331": "NtQueryInformationPort", "332": "NtQueryInformationResourceManager", "333": "NtQueryInformationTransaction", "334": "NtQueryInformationTransactionManager", "335": "NtQueryInformationWorkerFactory", "336": "NtQueryInstallUILanguage", "337": "NtQueryIntervalProfile", "338": "NtQueryIoCompletion", "339": "NtQueryLicenseValue", "340": "NtQueryMultipleValueKey", "341": "NtQueryMutant", "342": "NtQueryOpenSubKeys", "343": "NtQueryOpenSubKeysEx", "344": "NtQueryPortInformationProcess", "345": "NtQueryQuotaInformationFile", "346": "NtQuerySecurityAttributesToken", "347": "NtQuerySecurityObject", "348": "NtQuerySecurityPolicy", "349": "NtQuerySemaphore", "350": "NtQuerySymbolicLinkObject", "351": "NtQuerySystemEnvironmentValue", "352": "NtQuerySystemEnvironmentValueEx", "353": "NtQuerySystemInformationEx", "354": "NtQueryTimerResolution", "355": "NtQueryWnfStateData", "356": "NtQueryWnfStateNameInformation", "357": "NtQueueApcThreadEx", "358": "NtRaiseException", "359": "NtRaiseHardError", "360": "NtReadOnlyEnlistment", "361": "NtRecoverEnlistment", "362": "NtRecoverResourceManager", "363": "NtRecoverTransactionManager", "364": "NtRegisterProtocolAddressInformation", "365": "NtRegisterThreadTerminatePort", "366": "NtReleaseKeyedEvent", "367": "NtReleaseWorkerFactoryWorker", "368": "NtRemoveIoCompletionEx", "369": "NtRemoveProcessDebug", "370": "NtRenameKey", "371": "NtRenameTransactionManager", "372": "NtReplaceKey", "373": "NtReplacePartitionUnit", "374": "NtReplyWaitReplyPort", "375": "NtRequestPort", "376": "NtResetEvent", "377": "NtResetWriteWatch", "378": "NtRestoreKey", "379": "NtResumeProcess", "380": "NtRevertContainerImpersonation", "381": "NtRollbackComplete", "382": "NtRollbackEnlistment", "383": "NtRollbackRegistryTransaction", "384": "NtRollbackTransaction", "385": "NtRollforwardTransactionManager", "386": "NtSaveKey", "387": "NtSaveKeyEx", "388": "NtSaveMergedKeys", "389": "NtSecureConnectPort", "390": "NtSerializeBoot", "391": "NtSetBootEntryOrder", "392": "NtSetBootOptions", "393": "NtSetCachedSigningLevel", "394": "NtSetCachedSigningLevel2", "395": "NtSetContextThread", "396": "NtSetDebugFilterState", "397": "NtSetDefaultHardErrorPort", "398": "NtSetDefaultLocale", "399": "NtSetDefaultUILanguage", "400": "NtSetDriverEntryOrder", "401": "NtSetEaFile", "402": "NtSetHighEventPair", "403": "NtSetHighWaitLowEventPair", "404": "NtSetIRTimer", "405": "NtSetInformationDebugObject", "406": "NtSetInformationEnlistment", "407": "NtSetInformationJobObject", "408": "NtSetInformationKey", "409": "NtSetInformationResourceManager", "410": "NtSetInformationSymbolicLink", "411": "NtSetInformationToken", "412": "NtSetInformationTransaction", "413": "NtSetInformationTransactionManager", "414": "NtSetInformationVirtualMemory", "415": "NtSetInformationWorkerFactory", "416": "NtSetIntervalProfile", "417": "NtSetIoCompletion", "418": "NtSetIoCompletionEx", "419": "NtSetLdtEntries", "420": "NtSetLowEventPair", "421": "NtSetLowWaitHighEventPair", "422": "NtSetQuotaInformationFile", "423": "NtSetSecurityObject", "424": "NtSetSystemEnvironmentValue", "425": "NtSetSystemEnvironmentValueEx", "426": "NtSetSystemInformation", "427": "NtSetSystemPowerState", "428": "NtSetSystemTime", "429": "NtSetThreadExecutionState", "430": "NtSetTimer2", "431": "NtSetTimerEx", "432": "NtSetTimerResolution", "433": "NtSetUuidSeed", "434": "NtSetVolumeInformationFile", "435": "NtSetWnfProcessNotificationEvent", "436": "NtShutdownSystem", "437": "NtShutdownWorkerFactory", "438": "NtSignalAndWaitForSingleObject", "439": "NtSinglePhaseReject", "440": "NtStartProfile", "441": "NtStopProfile", "442": "NtSubscribeWnfStateChange", "443": "NtSuspendProcess", "444": "NtSuspendThread", "445": "NtSystemDebugControl", "446": "NtTerminateEnclave", "447": "NtTerminateJobObject", "448": "NtTestAlert", "449": "NtThawRegistry", "450": "NtThawTransactions", "451": "NtTraceControl", "452": "NtTranslateFilePath", "453": "NtUmsThreadYield", "454": "NtUnloadDriver", "455": "NtUnloadKey", "456": "NtUnloadKey2", "457": "NtUnloadKeyEx", "458": "NtUnlockFile", "459": "NtUnlockVirtualMemory", "460": "NtUnmapViewOfSectionEx", "461": "NtUnsubscribeWnfStateChange", "462": "NtUpdateWnfStateData", "463": "NtVdmControl", "464": "NtWaitForAlertByThreadId", "465": "NtWaitForDebugEvent", "466": "NtWaitForKeyedEvent", "467": "NtWaitForWorkViaWorkerFactory", "468": "NtWaitHighEventPair", "469": "NtWaitLowEventPair", "470": "NtLoadKey3"}, "21H2":{"0": "NtAccessCheck", "41": "NtAccessCheckAndAuditAlarm", "99": "NtAccessCheckByType", "89": "NtAccessCheckByTypeAndAuditAlarm", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireCrossVmMutant", "104": "NtAcquireProcessActivityReference", "655431": "NtAddAtom", "1114217": "NtAddAtomEx", "106": "NtAddBootEntry", "107": "NtAddDriverEntry", "108": "NtAdjustGroupsToken", "65": "NtAdjustPrivilegesToken", "109": "NtAdjustTokenClaimsAndDeviceGroups", "458862": "NtAlertResumeThread", "196719": "NtAlertThread", "262256": "NtAlertThreadByThreadId", "262257": "NtAllocateLocallyUniqueId", "114": "NtAllocateReserveObject", "115": "NtAllocateUserPhysicalPages", "116": "NtAllocateUserPhysicalPagesEx", "1114229": "NtAllocateUuids", "24": "NtAllocateVirtualMemory", "118": "NtAllocateVirtualMemoryEx", "119": "NtAlpcAcceptConnectPort", "120": "NtAlpcCancelMessage", "121": "NtAlpcConnectPort", "122": "NtAlpcConnectPortEx", "123": "NtAlpcCreatePort", "124": "NtAlpcCreatePortSection", "125": "NtAlpcCreateResourceReserve", "126": "NtAlpcCreateSectionView", "127": "NtAlpcCreateSecurityContext", "128": "NtAlpcDeletePortSection", "129": "NtAlpcDeleteResourceReserve", "130": "NtAlpcDeleteSectionView", "131": "NtAlpcDeleteSecurityContext", "132": "NtAlpcDisconnectPort", "133": "NtAlpcImpersonateClientContainerOfPort", "134": "NtAlpcImpersonateClientOfPort", "135": "NtAlpcOpenSenderProcess", "136": "NtAlpcOpenSenderThread", "137": "NtAlpcQueryInformation", "138": "NtAlpcQueryInformationMessage", "139": "NtAlpcRevokeSecurityContext", "140": "NtAlpcSendWaitReceivePort", "141": "NtAlpcSetInformation", "76": "NtApphelpCacheControl", "327822": "NtAreMappedFilesTheSame", "524431": "NtAssignProcessToJobObject", "144": "NtAssociateWaitCompletionPacket", "145": "NtCallEnclave", "5": "NtCallbackReturn", "93": "NtCancelIoFile", "146": "NtCancelIoFileEx", "147": "NtCancelSynchronousIoFile", "97": "NtCancelTimer", "148": "NtCancelTimer2", "149": "NtCancelWaitCompletionPacket", "196670": "NtClearEvent", "196623": "NtClose", "59": "NtCloseObjectAuditAlarm", "150": "NtCommitComplete", "151": "NtCommitEnlistment", "152": "NtCommitRegistryTransaction", "153": "NtCommitTransaction", "154": "NtCompactKeys", "155": "NtCompareObjects", "156": "NtCompareSigningLevels", "157": "NtCompareTokens", "158": "NtCompleteConnectPort", "196767": "NtCompressKey", "160": "NtConnectPort", "67": "NtContinue", "161": "NtContinueEx", "162": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "163": "NtCreateCrossVmEvent", "164": "NtCreateCrossVmMutant", "165": "NtCreateDebugObject", "166": "NtCreateDirectoryObject", "167": "NtCreateDirectoryObjectEx", "168": "NtCreateEnclave", "169": "NtCreateEnlistment", "72": "NtCreateEvent", "170": "NtCreateEventPair", "85": "NtCreateFile", "171": "NtCreateIRTimer", "172": "NtCreateIoCompletion", "173": "NtCreateJobObject", "174": "NtCreateJobSet", "29": "NtCreateKey", "175": "NtCreateKeyTransacted", "176": "NtCreateKeyedEvent", "177": "NtCreateLowBoxToken", "178": "NtCreateMailslotFile", "179": "NtCreateMutant", "180": "NtCreateNamedPipeFile", "181": "NtCreatePagingFile", "182": "NtCreatePartition", "183": "NtCreatePort", "184": "NtCreatePrivateNamespace", "185": "NtCreateProcess", "77": "NtCreateProcessEx", "186": "NtCreateProfile", "187": "NtCreateProfileEx", "188": "NtCreateRegistryTransaction", "189": "NtCreateResourceManager", "74": "NtCreateSection", "190": "NtCreateSectionEx", "191": "NtCreateSemaphore", "192": "NtCreateSymbolicLinkObject", "78": "NtCreateThread", "193": "NtCreateThreadEx", "194": "NtCreateTimer", "195": "NtCreateTimer2", "196": "NtCreateToken", "197": "NtCreateTokenEx", "198": "NtCreateTransaction", "199": "NtCreateTransactionManager", "200": "NtCreateUserProcess", "201": "NtCreateWaitCompletionPacket", "202": "NtCreateWaitablePort", "203": "NtCreateWnfStateName", "204": "NtCreateWorkerFactory", "524493": "NtDebugActiveProcess", "206": "NtDebugContinue", "393268": "NtDelayExecution", "262351": "NtDeleteAtom", "208": "NtDeleteBootEntry", "209": "NtDeleteDriverEntry", "210": "NtDeleteFile", "211": "NtDeleteKey", "212": "NtDeleteObjectAuditAlarm", "213": "NtDeletePrivateNamespace", "214": "NtDeleteValueKey", "215": "NtDeleteWnfStateData", "216": "NtDeleteWnfStateName", "1769479": "NtDeviceIoControlFile", "217": "NtDirectGraphicsCall", "218": "NtDisableLastKnownGood", "219": "NtDisplayString", "220": "NtDrawText", "60": "NtDuplicateObject", "66": "NtDuplicateToken", "221": "NtEnableLastKnownGood", "222": "NtEnumerateBootEntries", "223": "NtEnumerateDriverEntries", "50": "NtEnumerateKey", "224": "NtEnumerateSystemEnvironmentValuesEx", "225": "NtEnumerateTransactionObject", "19": "NtEnumerateValueKey", "226": "NtExtendSection", "227": "NtFilterBootOption", "228": "NtFilterToken", "229": "NtFilterTokenEx", "655380": "NtFindAtom", "75": "NtFlushBuffersFile", "230": "NtFlushBuffersFileEx", "231": "NtFlushInstallUILanguage", "786664": "NtFlushInstructionCache", "196841": "NtFlushKey", "234": "NtFlushProcessWriteBuffers", "235": "NtFlushVirtualMemory", "65772": "NtFlushWriteBuffer", "237": "NtFreeUserPhysicalPages", "30": "NtFreeVirtualMemory", "238": "NtFreezeRegistry", "239": "NtFreezeTransactions", "1769529": "NtFsControlFile", "240": "NtGetCachedSigningLevel", "241": "NtGetCompleteWnfStateSubscription", "242": "NtGetContextThread", "1638643": "NtGetCurrentProcessorNumber", "244": "NtGetCurrentProcessorNumberEx", "458997": "NtGetDevicePowerState", "246": "NtGetMUIRegistryInfo", "247": "NtGetNextProcess", "248": "NtGetNextThread", "249": "NtGetNlsSectionPtr", "250": "NtGetNotificationResourceManager", "251": "NtGetWriteWatch", "196860": "NtImpersonateAnonymousToken", "458783": "NtImpersonateClientOfPort", "253": "NtImpersonateThread", "254": "NtInitializeEnclave", "255": "NtInitializeNlsFiles", "256": "NtInitializeRegistry", "1114369": "NtInitiatePowerAction", "524367": "NtIsProcessInJob", "65794": "NtIsSystemResumeAutomatic", "259": "NtIsUILanguageComitted", "260": "NtListenPort", "261": "NtLoadDriver", "262": "NtLoadEnclaveData", "263": "NtLoadKey", "264": "NtLoadKey2", "470": "NtLoadKey3", "265": "NtLoadKeyEx", "266": "NtLockFile", "327947": "NtLockProductActivationKeys", "196876": "NtLockRegistryKey", "269": "NtLockVirtualMemory", "196878": "NtMakePermanentObject", "196879": "NtMakeTemporaryObject", "272": "NtQueryObject", "273": "NtManagePartition", "274": "NtMapCMFModule", "655635": "NtMapUserPhysicalPages", "655363": "NtMapUserPhysicalPagesScatter", "40": "NtMapViewOfSection", "276": "NtMapViewOfSectionEx", "277": "NtModifyBootEntry", "278": "NtModifyDriverEntry", "279": "NtNotifyChangeDirectoryFile", "280": "NtNotifyChangeDirectoryFileEx", "281": "NtNotifyChangeKey", "282": "NtNotifyChangeMultipleKeys", "283": "NtNotifyChangeSession", "88": "NtOpenDirectoryObject", "284": "NtOpenEnlistment", "64": "NtOpenEvent", "285": "NtOpenEventPair", "51": "NtOpenFile", "286": "NtOpenIoCompletion", "287": "NtOpenJobObject", "18": "NtOpenKey", "288": "NtOpenKeyEx", "289": "NtOpenKeyTransacted", "290": "NtOpenKeyTransactedEx", "291": "NtOpenKeyedEvent", "292": "NtOpenMutant", "293": "NtOpenObjectAuditAlarm", "294": "NtOpenPartition", "295": "NtOpenPrivateNamespace", "38": "NtOpenProcess", "296": "NtOpenProcessToken", "48": "NtOpenProcessTokenEx", "297": "NtOpenRegistryTransaction", "298": "NtOpenResourceManager", "55": "NtOpenSection", "299": "NtOpenSemaphore", "300": "NtOpenSession", "301": "NtOpenSymbolicLinkObject", "302": "NtOpenThread", "36": "NtOpenThreadToken", "47": "NtOpenThreadTokenEx", "303": "NtOpenTimer", "304": "NtOpenTransaction", "305": "NtOpenTransactionManager", "306": "NtPlugPlayControl", "95": "NtPowerInformation", "307": "NtPrePrepareComplete", "308": "NtPrePrepareEnlistment", "309": "NtPrepareComplete", "310": "NtPrepareEnlistment", "786743": "NtPrivilegeCheck", "312": "NtPrivilegeObjectAuditAlarm", "313": "NtPrivilegedServiceAuditAlarm", "314": "NtPropagationComplete", "315": "NtPropagationFailed", "80": "NtProtectVirtualMemory", "316": "NtPssCaptureVaSpaceBulk", "459069": "NtPulseEvent", "61": "NtQueryAttributesFile", "318": "NtQueryAuxiliaryCounterFrequency", "319": "NtQueryBootEntryOrder", "320": "NtQueryBootOptions", "328001": "NtQueryDebugFilterState", "327701": "NtQueryDefaultLocale", "262212": "NtQueryDefaultUILanguage", "53": "NtQueryDirectoryFile", "322": "NtQueryDirectoryFileEx", "323": "NtQueryDirectoryObject", "324": "NtQueryDriverEntryOrder", "325": "NtQueryEaFile", "86": "NtQueryEvent", "326": "NtQueryFullAttributesFile", "327": "NtQueryInformationAtom", "328": "NtQueryInformationByName", "329": "NtQueryInformationEnlistment", "17": "NtQueryInformationFile", "330": "NtQueryInformationJobObject", "331": "NtQueryInformationPort", "25": "NtQueryInformationProcess", "332": "NtQueryInformationResourceManager", "37": "NtQueryInformationThread", "33": "NtQueryInformationToken", "333": "NtQueryInformationTransaction", "334": "NtQueryInformationTransactionManager", "335": "NtQueryInformationWorkerFactory", "262480": "NtQueryInstallUILanguage", "328017": "NtQueryIntervalProfile", "338": "NtQueryIoCompletion", "22": "NtQueryKey", "339": "NtQueryLicenseValue", "340": "NtQueryMultipleValueKey", "341": "NtQueryMutant", "342": "NtQueryOpenSubKeys", "343": "NtQueryOpenSubKeysEx", "327729": "NtQueryPerformanceCounter", "65880": "NtQueryPortInformationProcess", "345": "NtQueryQuotaInformationFile", "81": "NtQuerySection", "346": "NtQuerySecurityAttributesToken", "347": "NtQuerySecurityObject", "348": "NtQuerySecurityPolicy", "349": "NtQuerySemaphore", "350": "NtQuerySymbolicLinkObject", "351": "NtQuerySystemEnvironmentValue", "352": "NtQuerySystemEnvironmentValueEx", "54": "RtlGetNativeSystemInformation", "353": "NtQuerySystemInformationEx", "56": "NtQueryTimer", "655714": "NtQueryTimerResolution", "23": "NtQueryValueKey", "35": "NtQueryVirtualMemory", "73": "NtQueryVolumeInformationFile", "355": "NtQueryWnfStateData", "356": "NtQueryWnfStateNameInformation", "69": "NtQueueApcThread", "357": "NtQueueApcThreadEx", "358": "NtRaiseException", "359": "NtRaiseHardError", "1703942": "NtReadFile", "1703982": "NtReadFileScatter", "360": "NtReadOnlyEnlistment", "84": "NtReadRequestData", "63": "NtReadVirtualMemory", "361": "NtRecoverEnlistment", "362": "NtRecoverResourceManager", "363": "NtRecoverTransactionManager", "364": "NtRegisterProtocolAddressInformation", "196973": "NtRegisterThreadTerminatePort", "1311086": "NtReleaseKeyedEvent", "458784": "NtReleaseMutant", "786442": "NtReleaseSemaphore", "196975": "NtReleaseWorkerFactoryWorker", "1835017": "NtRemoveIoCompletion", "368": "NtRemoveIoCompletionEx", "370": "NtRenameKey", "371": "NtRenameTransactionManager", "372": "NtReplaceKey", "373": "NtReplacePartitionUnit", "12": "NtReplyPort", "11": "NtReplyWaitReceivePort", "43": "NtReplyWaitReceivePortEx", "374": "NtReplyWaitReplyPort", "375": "NtRequestPort", "34": "NtRequestWaitReplyPort", "459128": "NtResetEvent", "786809": "NtResetWriteWatch", "378": "NtRestoreKey", "196987": "NtResumeProcess", "458834": "NtResumeThread", "380": "NtRevertContainerImpersonation", "381": "NtRollbackComplete", "382": "NtRollbackEnlistment", "383": "NtRollbackRegistryTransaction", "384": "NtRollbackTransaction", "385": "NtRollforwardTransactionManager", "524674": "NtSaveKey", "917891": "NtSaveKeyEx", "721284": "NtSaveMergedKeys", "389": "NtSecureConnectPort", "390": "NtSerializeBoot", "391": "NtSetBootEntryOrder", "392": "NtSetBootOptions", "393": "NtSetCachedSigningLevel", "394": "NtSetCachedSigningLevel2", "395": "NtSetContextThread", "655756": "NtSetDebugFilterState", "197005": "NtSetDefaultHardErrorPort", "328078": "NtSetDefaultLocale", "262543": "NtSetDefaultUILanguage", "400": "NtSetDriverEntryOrder", "401": "NtSetEaFile", "458766": "NtSetEvent", "196653": "NtSetEventBoostPriority", "197010": "NtSetHighEventPair", "197011": "NtSetHighWaitLowEventPair", "459156": "NtSetIRTimer", "405": "NtSetInformationDebugObject", "406": "NtSetInformationEnlistment", "39": "NtSetInformationFile", "407": "NtSetInformationJobObject", "408": "NtSetInformationKey", "92": "NtSetInformationObject", "28": "NtSetInformationProcess", "409": "NtSetInformationResourceManager", "410": "NtSetInformationSymbolicLink", "13": "NtSetInformationThread", "411": "NtSetInformationToken", "412": "NtSetInformationTransaction", "413": "NtSetInformationTransactionManager", "414": "NtSetInformationVirtualMemory", "415": "NtSetInformationWorkerFactory", "328096": "NtSetIntervalProfile", "417": "NtSetIoCompletion", "418": "NtSetIoCompletionEx", "419": "NtSetLdtEntries", "197028": "NtSetLowEventPair", "197029": "NtSetLowWaitHighEventPair", "422": "NtSetQuotaInformationFile", "423": "NtSetSecurityObject", "424": "NtSetSystemEnvironmentValue", "425": "NtSetSystemEnvironmentValueEx", "426": "NtSetSystemInformation", "427": "NtSetSystemPowerState", "328108": "NtSetSystemTime", "328109": "NtSetThreadExecutionState", "98": "NtSetTimer", "430": "NtSetTimer2", "431": "NtSetTimerEx", "655792": "NtSetTimerResolution", "262577": "NtSetUuidSeed", "96": "NtSetValueKey", "434": "NtSetVolumeInformationFile", "435": "NtSetWnfProcessNotificationEvent", "262580": "NtShutdownSystem", "437": "NtShutdownWorkerFactory", "197046": "NtSignalAndWaitForSingleObject", "439": "NtSinglePhaseReject", "197048": "NtStartProfile", "197049": "NtStopProfile", "442": "NtSubscribeWnfStateChange", "197051": "NtSuspendProcess", "459196": "NtSuspendThread", "445": "NtSystemDebugControl", "446": "NtTerminateEnclave", "459199": "NtTerminateJobObject", "458796": "NtTerminateProcess", "458835": "NtTerminateThread", "131520": "NtTestAlert", "449": "NtThawRegistry", "450": "NtThawTransactions", "451": "NtTraceControl", "94": "NtTraceEvent", "1114564": "NtTranslateFilePath", "453": "NtUmsThreadYield", "454": "NtUnloadDriver", "455": "NtUnloadKey", "456": "NtUnloadKey2", "457": "NtUnloadKeyEx", "458": "NtUnlockFile", "459": "NtUnlockVirtualMemory", "42": "NtUnmapViewOfSection", "460": "NtUnmapViewOfSectionEx", "461": "NtUnsubscribeWnfStateChange", "462": "NtUpdateWnfStateData", "463": "NtVdmControl", "393680": "NtWaitForAlertByThreadId", "465": "NtWaitForDebugEvent", "1376722": "NtWaitForKeyedEvent", "1900635": "NtWaitForMultipleObjects", "1966106": "NtWaitForMultipleObjects32", "851972": "NtWaitForSingleObject", "467": "NtWaitForWorkViaWorkerFactory", "197076": "NtWaitHighEventPair", "197077": "NtWaitLowEventPair", "196609": "NtWorkerFactoryWorkerReady", "1703944": "NtWriteFile", "1703963": "NtWriteFileGather", "87": "NtWriteRequestData", "58": "NtWriteVirtualMemory", "65606": "NtYieldExecution"}}, "Windows 11": {"21H2":{"0": "NtAccessCheck", "41": "NtAccessCheckAndAuditAlarm", "99": "NtAccessCheckByType", "89": "NtAccessCheckByTypeAndAuditAlarm", "100": "NtAccessCheckByTypeResultList", "101": "NtAccessCheckByTypeResultListAndAuditAlarm", "102": "NtAccessCheckByTypeResultListAndAuditAlarmByHandle", "103": "NtAcquireCrossVmMutant", "104": "NtAcquireProcessActivityReference", "71": "NtAddAtom", "1114217": "NtAddAtomEx", "106": "NtAddBootEntry", "107": "NtAddDriverEntry", "108": "NtAdjustGroupsToken", "65": "NtAdjustPrivilegesToken", "109": "NtAdjustTokenClaimsAndDeviceGroups", "458862": "NtAlertResumeThread", "196719": "NtAlertThread", "262256": "NtAlertThreadByThreadId", "262257": "NtAllocateLocallyUniqueId", "114": "NtAllocateReserveObject", "115": "NtAllocateUserPhysicalPages", "116": "NtAllocateUserPhysicalPagesEx", "1114229": "NtAllocateUuids", "24": "NtAllocateVirtualMemory", "118": "NtAllocateVirtualMemoryEx", "119": "NtAlpcAcceptConnectPort", "120": "NtAlpcCancelMessage", "121": "NtAlpcConnectPort", "122": "NtAlpcConnectPortEx", "123": "NtAlpcCreatePort", "124": "NtAlpcCreatePortSection", "125": "NtAlpcCreateResourceReserve", "126": "NtAlpcCreateSectionView", "127": "NtAlpcCreateSecurityContext", "128": "NtAlpcDeletePortSection", "129": "NtAlpcDeleteResourceReserve", "130": "NtAlpcDeleteSectionView", "131": "NtAlpcDeleteSecurityContext", "132": "NtAlpcDisconnectPort", "133": "NtAlpcImpersonateClientContainerOfPort", "134": "NtAlpcImpersonateClientOfPort", "135": "NtAlpcOpenSenderProcess", "136": "NtAlpcOpenSenderThread", "137": "NtAlpcQueryInformation", "138": "NtAlpcQueryInformationMessage", "139": "NtAlpcRevokeSecurityContext", "140": "NtAlpcSendWaitReceivePort", "141": "NtAlpcSetInformation", "76": "NtApphelpCacheControl", "327822": "NtAreMappedFilesTheSame", "524431": "NtAssignProcessToJobObject", "144": "NtAssociateWaitCompletionPacket", "145": "NtCallEnclave", "5": "NtCallbackReturn", "93": "NtCancelIoFile", "146": "NtCancelIoFileEx", "147": "NtCancelSynchronousIoFile", "458849": "NtCancelTimer", "148": "NtCancelTimer2", "149": "NtCancelWaitCompletionPacket", "150": "NtChangeProcessState", "151": "NtChangeThreadState", "196670": "NtClearEvent", "196671": "NtClose", "59": "NtCloseObjectAuditAlarm", "152": "NtCommitComplete", "153": "NtCommitEnlistment", "154": "NtCommitRegistryTransaction", "155": "NtCommitTransaction", "156": "NtCompactKeys", "157": "NtCompareObjects", "158": "NtCompareSigningLevels", "159": "NtCompareTokens", "160": "NtCompleteConnectPort", "196769": "NtCompressKey", "162": "NtConnectPort", "67": "NtContinue", "163": "NtContinueEx", "164": "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter", "165": "NtCreateCrossVmEvent", "166": "NtCreateCrossVmMutant", "167": "NtCreateDebugObject", "168": "NtCreateDirectoryObject", "169": "NtCreateDirectoryObjectEx", "170": "NtCreateEnclave", "171": "NtCreateEnlistment", "72": "NtCreateEvent", "172": "NtCreateEventPair", "85": "NtCreateFile", "173": "NtCreateIRTimer", "174": "NtCreateIoCompletion", "175": "NtCreateIoRing", "176": "NtCreateJobObject", "177": "NtCreateJobSet", "29": "NtCreateKey", "178": "NtCreateKeyTransacted", "179": "NtCreateKeyedEvent", "180": "NtCreateLowBoxToken", "181": "NtCreateMailslotFile", "182": "NtCreateMutant", "183": "NtCreateNamedPipeFile", "184": "NtCreatePagingFile", "185": "NtCreatePartition", "186": "NtCreatePort", "187": "NtCreatePrivateNamespace", "188": "NtCreateProcess", "77": "NtCreateProcessEx", "189": "NtCreateProcessStateChange", "190": "NtCreateProfile", "191": "NtCreateProfileEx", "192": "NtCreateRegistryTransaction", "193": "NtCreateResourceManager", "74": "NtCreateSection", "194": "NtCreateSectionEx", "195": "NtCreateSemaphore", "196": "NtCreateSymbolicLinkObject", "78": "NtCreateThread", "197": "NtCreateThreadEx", "198": "NtCreateThreadStateChange", "199": "NtCreateTimer", "200": "NtCreateTimer2", "201": "NtCreateToken", "202": "NtCreateTokenEx", "203": "NtCreateTransaction", "204": "NtCreateTransactionManager", "205": "NtCreateUserProcess", "206": "NtCreateWaitCompletionPacket", "207": "NtCreateWaitablePort", "208": "NtCreateWnfStateName", "209": "NtCreateWorkerFactory", "524498": "NtDebugActiveProcess", "211": "NtDebugContinue", "393268": "NtDelayExecution", "262356": "NtDeleteAtom", "213": "NtDeleteBootEntry", "214": "NtDeleteDriverEntry", "215": "NtDeleteFile", "216": "NtDeleteKey", "217": "NtDeleteObjectAuditAlarm", "218": "NtDeletePrivateNamespace", "219": "NtDeleteValueKey", "220": "NtDeleteWnfStateData", "221": "NtDeleteWnfStateName", "1769479": "NtDeviceIoControlFile", "222": "NtDirectGraphicsCall", "223": "NtDisableLastKnownGood", "224": "NtDisplayString", "225": "NtDrawText", "60": "NtDuplicateObject", "66": "NtDuplicateToken", "226": "NtEnableLastKnownGood", "227": "NtEnumerateBootEntries", "228": "NtEnumerateDriverEntries", "50": "NtEnumerateKey", "229": "NtEnumerateSystemEnvironmentValuesEx", "230": "NtEnumerateTransactionObject", "19": "NtEnumerateValueKey", "231": "NtExtendSection", "232": "NtFilterBootOption", "233": "NtFilterToken", "234": "NtFilterTokenEx", "655380": "NtFindAtom", "75": "NtFlushBuffersFile", "235": "NtFlushBuffersFileEx", "236": "NtFlushInstallUILanguage", "786669": "NtFlushInstructionCache", "196846": "NtFlushKey", "239": "NtFlushProcessWriteBuffers", "240": "NtFlushVirtualMemory", "65777": "NtFlushWriteBuffer", "242": "NtFreeUserPhysicalPages", "30": "NtFreeVirtualMemory", "243": "NtFreezeRegistry", "244": "NtFreezeTransactions", "1769529": "NtFsControlFile", "245": "NtGetCachedSigningLevel", "246": "NtGetCompleteWnfStateSubscription", "247": "NtGetContextThread", "1638648": "NtGetCurrentProcessorNumber", "249": "NtGetCurrentProcessorNumberEx", "459002": "NtGetDevicePowerState", "251": "NtGetMUIRegistryInfo", "252": "NtGetNextProcess", "253": "NtGetNextThread", "254": "NtGetNlsSectionPtr", "255": "NtGetNotificationResourceManager", "256": "NtGetWriteWatch", "196865": "NtImpersonateAnonymousToken", "458783": "NtImpersonateClientOfPort", "258": "NtImpersonateThread", "259": "NtInitializeEnclave", "260": "NtInitializeNlsFiles", "261": "NtInitializeRegistry", "1114374": "NtInitiatePowerAction", "524367": "NtIsProcessInJob", "65799": "NtIsSystemResumeAutomatic", "264": "NtIsUILanguageComitted", "265": "NtListenPort", "266": "NtLoadDriver", "267": "NtLoadEnclaveData", "268": "NtLoadKey", "269": "NtLoadKey2", "270": "NtLoadKey3", "271": "NtLoadKeyEx", "272": "NtLockFile", "327953": "NtLockProductActivationKeys", "196882": "NtLockRegistryKey", "275": "NtLockVirtualMemory", "196884": "NtMakePermanentObject", "196885": "NtMakeTemporaryObject", "278": "NtManageHotPatch", "279": "NtManagePartition", "280": "NtMapCMFModule", "655641": "NtMapUserPhysicalPages", "655363": "NtMapUserPhysicalPagesScatter", "40": "NtMapViewOfSection", "282": "NtMapViewOfSectionEx", "283": "NtModifyBootEntry", "284": "NtModifyDriverEntry", "285": "NtNotifyChangeDirectoryFile", "286": "NtNotifyChangeDirectoryFileEx", "287": "NtNotifyChangeKey", "288": "NtNotifyChangeMultipleKeys", "289": "NtNotifyChangeSession", "88": "NtOpenDirectoryObject", "290": "NtOpenEnlistment", "64": "NtOpenEvent", "291": "NtOpenEventPair", "51": "NtOpenFile", "292": "NtOpenIoCompletion", "293": "NtOpenJobObject", "18": "NtOpenKey", "294": "NtOpenKeyEx", "295": "NtOpenKeyTransacted", "296": "NtOpenKeyTransactedEx", "297": "NtOpenKeyedEvent", "298": "NtOpenMutant", "299": "NtOpenObjectAuditAlarm", "300": "NtOpenPartition", "301": "NtOpenPrivateNamespace", "38": "NtOpenProcess", "302": "NtOpenProcessToken", "48": "NtOpenProcessTokenEx", "303": "NtOpenRegistryTransaction", "304": "NtOpenResourceManager", "55": "NtOpenSection", "305": "NtOpenSemaphore", "306": "NtOpenSession", "307": "NtOpenSymbolicLinkObject", "308": "NtOpenThread", "36": "NtOpenThreadToken", "47": "NtOpenThreadTokenEx", "309": "NtOpenTimer", "310": "NtOpenTransaction", "311": "NtOpenTransactionManager", "312": "NtPlugPlayControl", "95": "NtPowerInformation", "313": "NtPrePrepareComplete", "314": "NtPrePrepareEnlistment", "315": "NtPrepareComplete", "316": "NtPrepareEnlistment", "786749": "NtPrivilegeCheck", "318": "NtPrivilegeObjectAuditAlarm", "319": "NtPrivilegedServiceAuditAlarm", "320": "NtPropagationComplete", "321": "NtPropagationFailed", "80": "NtProtectVirtualMemory", "322": "NtPssCaptureVaSpaceBulk", "459075": "NtPulseEvent", "61": "NtQueryAttributesFile", "324": "NtQueryAuxiliaryCounterFrequency", "325": "NtQueryBootEntryOrder", "326": "NtQueryBootOptions", "328007": "NtQueryDebugFilterState", "327701": "NtQueryDefaultLocale", "262212": "NtQueryDefaultUILanguage", "53": "NtQueryDirectoryFile", "328": "NtQueryDirectoryFileEx", "329": "NtQueryDirectoryObject", "330": "NtQueryDriverEntryOrder", "331": "NtQueryEaFile", "86": "NtQueryEvent", "332": "NtQueryFullAttributesFile", "333": "NtQueryInformationAtom", "334": "NtQueryInformationByName", "335": "NtQueryInformationEnlistment", "17": "NtQueryInformationFile", "336": "NtQueryInformationJobObject", "337": "NtQueryInformationPort", "25": "NtQueryInformationProcess", "338": "NtQueryInformationResourceManager", "37": "NtQueryInformationThread", "33": "NtQueryInformationToken", "339": "NtQueryInformationTransaction", "340": "NtQueryInformationTransactionManager", "341": "NtQueryInformationWorkerFactory", "262486": "NtQueryInstallUILanguage", "328023": "NtQueryIntervalProfile", "344": "NtQueryIoCompletion", "345": "NtQueryIoRingCapabilities", "22": "NtQueryKey", "346": "NtQueryLicenseValue", "347": "NtQueryMultipleValueKey", "348": "NtQueryMutant", "16": "NtQueryObject", "349": "NtQueryOpenSubKeys", "350": "NtQueryOpenSubKeysEx", "327729": "NtQueryPerformanceCounter", "65887": "NtQueryPortInformationProcess", "352": "NtQueryQuotaInformationFile", "81": "NtQuerySection", "353": "NtQuerySecurityAttributesToken", "354": "NtQuerySecurityObject", "355": "NtQuerySecurityPolicy", "356": "NtQuerySemaphore", "357": "NtQuerySymbolicLinkObject", "358": "NtQuerySystemEnvironmentValue", "359": "NtQuerySystemEnvironmentValueEx", "54": "NtQuerySystemInformation", "360": "NtQuerySystemInformationEx", "56": "NtQueryTimer", "655721": "NtQueryTimerResolution", "23": "NtQueryValueKey", "35": "NtQueryVirtualMemory", "73": "NtQueryVolumeInformationFile", "362": "NtQueryWnfStateData", "363": "NtQueryWnfStateNameInformation", "69": "NtQueueApcThread", "364": "NtQueueApcThreadEx", "365": "NtQueueApcThreadEx2", "366": "NtRaiseException", "367": "NtRaiseHardError", "1703942": "NtReadFile", "1703982": "NtReadFileScatter", "368": "NtReadOnlyEnlistment", "84": "NtReadRequestData", "63": "NtReadVirtualMemory", "369": "NtReadVirtualMemoryEx", "370": "NtRecoverEnlistment", "371": "NtRecoverResourceManager", "372": "NtRecoverTransactionManager", "373": "NtRegisterProtocolAddressInformation", "196982": "NtRegisterThreadTerminatePort", "1311095": "NtReleaseKeyedEvent", "458784": "NtReleaseMutant", "786442": "NtReleaseSemaphore", "196984": "NtReleaseWorkerFactoryWorker", "1835017": "NtRemoveIoCompletion", "377": "NtRemoveIoCompletionEx", "524666": "NtRemoveProcessDebug", "379": "NtRenameKey", "380": "NtRenameTransactionManager", "381": "NtReplaceKey", "382": "NtReplacePartitionUnit", "12": "NtReplyPort", "11": "NtReplyWaitReceivePort", "43": "NtReplyWaitReceivePortEx", "383": "NtReplyWaitReplyPort", "384": "NtRequestPort", "34": "NtRequestWaitReplyPort", "459137": "NtResetEvent", "786818": "NtResetWriteWatch", "387": "NtRestoreKey", "196996": "NtResumeProcess", "458834": "NtResumeThread", "389": "NtRevertContainerImpersonation", "390": "NtRollbackComplete", "391": "NtRollbackEnlistment", "392": "NtRollbackRegistryTransaction", "393": "NtRollbackTransaction", "394": "NtRollforwardTransactionManager", "524683": "NtSaveKey", "917900": "NtSaveKeyEx", "721293": "NtSaveMergedKeys", "398": "NtSecureConnectPort", "399": "NtSerializeBoot", "400": "NtSetBootEntryOrder", "401": "NtSetBootOptions", "402": "NtSetCachedSigningLevel", "403": "NtSetCachedSigningLevel2", "404": "NtSetContextThread", "655765": "NtSetDebugFilterState", "197014": "NtSetDefaultHardErrorPort", "328087": "NtSetDefaultLocale", "262552": "NtSetDefaultUILanguage", "409": "NtSetDriverEntryOrder", "410": "NtSetEaFile", "458766": "NtSetEvent", "196653": "NtSetEventBoostPriority", "197019": "NtSetHighEventPair", "197020": "NtSetHighWaitLowEventPair", "459165": "NtSetIRTimer", "414": "NtSetInformationDebugObject", "415": "NtSetInformationEnlistment", "39": "NtSetInformationFile", "416": "NtSetInformationIoRing", "417": "NtSetInformationJobObject", "418": "NtSetInformationKey", "92": "NtSetInformationObject", "28": "NtSetInformationProcess", "419": "NtSetInformationResourceManager", "420": "NtSetInformationSymbolicLink", "13": "NtSetInformationThread", "421": "NtSetInformationToken", "422": "NtSetInformationTransaction", "423": "NtSetInformationTransactionManager", "424": "NtSetInformationVirtualMemory", "425": "NtSetInformationWorkerFactory", "328106": "NtSetIntervalProfile", "427": "NtSetIoCompletion", "428": "NtSetIoCompletionEx", "429": "NtSetLdtEntries", "197038": "NtSetLowEventPair", "197039": "NtSetLowWaitHighEventPair", "432": "NtSetQuotaInformationFile", "433": "NtSetSecurityObject", "434": "NtSetSystemEnvironmentValue", "435": "NtSetSystemEnvironmentValueEx", "436": "NtSetSystemInformation", "437": "NtSetSystemPowerState", "328118": "NtSetSystemTime", "328119": "NtSetThreadExecutionState", "98": "NtSetTimer", "440": "NtSetTimer2", "441": "NtSetTimerEx", "655802": "NtSetTimerResolution", "262587": "NtSetUuidSeed", "96": "NtSetValueKey", "444": "NtSetVolumeInformationFile", "445": "NtSetWnfProcessNotificationEvent", "262590": "NtShutdownSystem", "447": "NtShutdownWorkerFactory", "1245632": "NtSignalAndWaitForSingleObject", "449": "NtSinglePhaseReject", "197058": "NtStartProfile", "197059": "NtStopProfile", "452": "NtSubmitIoRing", "453": "NtSubscribeWnfStateChange", "197062": "NtSuspendProcess", "459207": "NtSuspendThread", "456": "NtSystemDebugControl", "457": "NtTerminateEnclave", "459210": "NtTerminateJobObject", "458796": "NtTerminateProcess", "458835": "NtTerminateThread", "131531": "NtTestAlert", "460": "NtThawRegistry", "461": "NtThawTransactions", "462": "NtTraceControl", "94": "NtTraceEvent", "1114575": "NtTranslateFilePath", "464": "NtUmsThreadYield", "465": "NtUnloadDriver", "466": "NtUnloadKey", "467": "NtUnloadKey2", "468": "NtUnloadKeyEx", "469": "NtUnlockFile", "470": "NtUnlockVirtualMemory", "42": "NtUnmapViewOfSection", "471": "NtUnmapViewOfSectionEx", "472": "NtUnsubscribeWnfStateChange", "473": "NtUpdateWnfStateData", "474": "NtVdmControl", "393691": "NtWaitForAlertByThreadId", "476": "NtWaitForDebugEvent", "1376733": "NtWaitForKeyedEvent", "1900635": "NtWaitForMultipleObjects", "1966106": "NtWaitForMultipleObjects32", "851972": "NtWaitForSingleObject", "478": "NtWaitForWorkViaWorkerFactory", "197087": "NtWaitHighEventPair", "197088": "NtWaitLowEventPair", "196609": "NtWorkerFactoryWorkerReady", "1703944": "NtWriteFile", "1703963": "NtWriteFileGather", "87": "NtWriteRequestData", "58": "NtWriteVirtualMemory", "65606": "NtYieldExecution", "493": "RtlGetNativeSystemInformation"}}} |