admin/Bw3ll-ShellWasp
1
0
Fork 0
mirror of https://github.com/Bw3ll/ShellWasp synced 2026-06-08 10:31:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
Bw3ll-ShellWasp/start/reverseWinSyscallsInt.json
T
Bw3ll 23cebed850 Add files via upload
2023-04-19 17:17:16 -05:00

2 lines
403 KiB
JSON
Raw Permalink Blame History

{"Windows XP": {"SP1": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateUserPhysicalPages": 108, "NtAllocateUuids": 109, "NtAreMappedFilesTheSame": 110, "NtAssignProcessToJobObject": 111, "NtCancelDeviceWakeupRequest": 112, "NtCompactKeys": 113, "NtCompareTokens": 114, "NtCompleteConnectPort": 115, "NtCompressKey": 116, "NtConnectPort": 117, "NtCreateDebugObject": 118, "NtCreateDirectoryObject": 119, "NtCreateEventPair": 120, "NtCreateIoCompletion": 121, "NtCreateJobObject": 122, "NtCreateJobSet": 123, "NtCreateKeyedEvent": 124, "NtCreateMailslotFile": 125, "NtCreateMutant": 126, "NtCreateNamedPipeFile": 127, "NtCreatePagingFile": 128, "NtCreatePort": 129, "NtCreateProcess": 130, "NtCreateProfile": 131, "NtCreateSemaphore": 132, "NtCreateSymbolicLinkObject": 133, "NtCreateTimer": 134, "NtCreateToken": 135, "NtCreateWaitablePort": 136, "NtDebugActiveProcess": 137, "NtDebugContinue": 138, "NtDeleteAtom": 139, "NtDeleteBootEntry": 140, "NtDeleteDriverEntry": 141, "NtDeleteFile": 142, "NtDeleteKey": 143, "NtDeleteObjectAuditAlarm": 144, "NtDeleteValueKey": 145, "NtDisplayString": 146, "NtEnumerateBootEntries": 147, "NtEnumerateDriverEntries": 148, "NtEnumerateSystemEnvironmentValuesEx": 149, "NtExtendSection": 150, "NtFilterToken": 151, "NtFlushInstructionCache": 152, "NtFlushKey": 153, "NtFlushVirtualMemory": 154, "NtFlushWriteBuffer": 155, "NtFreeUserPhysicalPages": 156, "NtGetContextThread": 157, "NtGetCurrentProcessorNumber": 158, "NtGetDevicePowerState": 159, "NtGetPlugPlayEvent": 160, "NtGetWriteWatch": 161, "NtImpersonateAnonymousToken": 162, "NtImpersonateThread": 163, "NtInitializeRegistry": 164, "NtInitiatePowerAction": 165, "NtIsSystemResumeAutomatic": 166, "NtListenPort": 167, "NtLoadDriver": 168, "NtLoadKey": 169, "NtLoadKey2": 170, "NtLoadKeyEx": 171, "NtLockFile": 172, "NtLockProductActivationKeys": 173, "NtLockRegistryKey": 174, "NtLockVirtualMemory": 175, "NtMakePermanentObject": 176, "NtMakeTemporaryObject": 177, "NtMapUserPhysicalPages": 178, "NtModifyBootEntry": 179, "NtModifyDriverEntry": 180, "NtNotifyChangeDirectoryFile": 181, "NtNotifyChangeKey": 182, "NtNotifyChangeMultipleKeys": 183, "NtOpenEventPair": 184, "NtOpenIoCompletion": 185, "NtOpenJobObject": 186, "NtOpenKeyedEvent": 187, "NtOpenMutant": 188, "NtOpenObjectAuditAlarm": 189, "NtOpenProcessToken": 190, "NtOpenSemaphore": 191, "NtOpenSymbolicLinkObject": 192, "NtOpenThread": 193, "NtOpenTimer": 194, "NtPlugPlayControl": 195, "NtPrivilegeCheck": 196, "NtPrivilegeObjectAuditAlarm": 197, "NtPrivilegedServiceAuditAlarm": 198, "NtPulseEvent": 199, "NtQueryBootEntryOrder": 200, "NtQueryBootOptions": 201, "NtQueryDebugFilterState": 202, "NtQueryDirectoryObject": 203, "NtQueryDriverEntryOrder": 204, "NtQueryEaFile": 205, "NtQueryFullAttributesFile": 206, "NtQueryInformationAtom": 207, "NtQueryInformationJobObject": 208, "NtQueryInformationPort": 209, "NtQueryInstallUILanguage": 210, "NtQueryIntervalProfile": 211, "NtQueryIoCompletion": 212, "NtQueryMultipleValueKey": 213, "NtQueryMutant": 214, "NtQueryOpenSubKeys": 215, "NtQueryOpenSubKeysEx": 216, "NtQueryPortInformationProcess": 217, "NtQueryQuotaInformationFile": 218, "NtQuerySecurityObject": 219, "NtQuerySemaphore": 220, "NtQuerySymbolicLinkObject": 221, "NtQuerySystemEnvironmentValue": 222, "NtQuerySystemEnvironmentValueEx": 223, "NtQueryTimerResolution": 224, "NtRaiseException": 225, "NtRaiseHardError": 226, "NtRegisterThreadTerminatePort": 227, "NtReleaseKeyedEvent": 228, "NtRemoveProcessDebug": 229, "NtRenameKey": 230, "NtReplaceKey": 231, "NtReplyWaitReplyPort": 232, "NtRequestDeviceWakeup": 233, "NtRequestPort": 234, "NtRequestWakeupLatency": 235, "NtResetEvent": 236, "NtResetWriteWatch": 237, "NtRestoreKey": 238, "NtResumeProcess": 239, "NtSaveKey": 240, "NtSaveKeyEx": 241, "NtSaveMergedKeys": 242, "NtSecureConnectPort": 243, "NtSetBootEntryOrder": 244, "NtSetBootOptions": 245, "NtSetContextThread": 246, "NtSetDebugFilterState": 247, "NtSetDefaultHardErrorPort": 248, "NtSetDefaultLocale": 249, "NtSetDefaultUILanguage": 250, "NtSetDriverEntryOrder": 251, "NtSetEaFile": 252, "NtSetHighEventPair": 253, "NtSetHighWaitLowEventPair": 254, "NtSetInformationDebugObject": 255, "NtSetInformationJobObject": 256, "NtSetInformationKey": 257, "NtSetInformationToken": 258, "NtSetIntervalProfile": 259, "NtSetIoCompletion": 260, "NtSetLdtEntries": 261, "NtSetLowEventPair": 262, "NtSetLowWaitHighEventPair": 263, "NtSetQuotaInformationFile": 264, "NtSetSecurityObject": 265, "NtSetSystemEnvironmentValue": 266, "NtSetSystemEnvironmentValueEx": 267, "NtSetSystemInformation": 268, "NtSetSystemPowerState": 269, "NtSetSystemTime": 270, "NtSetThreadExecutionState": 271, "NtSetTimerResolution": 272, "NtSetUuidSeed": 273, "NtSetVolumeInformationFile": 274, "NtShutdownSystem": 275, "NtSignalAndWaitForSingleObject": 276, "NtStartProfile": 277, "NtStopProfile": 278, "NtSuspendProcess": 279, "NtSuspendThread": 280, "NtSystemDebugControl": 281, "NtTerminateJobObject": 282, "NtTestAlert": 283, "NtTranslateFilePath": 284, "NtUnloadDriver": 285, "NtUnloadKey": 286, "NtUnloadKey2": 287, "NtUnloadKeyEx": 288, "NtUnlockFile": 289, "NtUnlockVirtualMemory": 290, "NtVdmControl": 291, "NtWaitForDebugEvent": 292, "NtWaitForKeyedEvent": 293, "NtWaitHighEventPair": 294, "NtWaitLowEventPair": 295}, "SP2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateUserPhysicalPages": 108, "NtAllocateUuids": 109, "NtAreMappedFilesTheSame": 110, "NtAssignProcessToJobObject": 111, "NtCancelDeviceWakeupRequest": 112, "NtCompactKeys": 113, "NtCompareTokens": 114, "NtCompleteConnectPort": 115, "NtCompressKey": 116, "NtConnectPort": 117, "NtCreateDebugObject": 118, "NtCreateDirectoryObject": 119, "NtCreateEventPair": 120, "NtCreateIoCompletion": 121, "NtCreateJobObject": 122, "NtCreateJobSet": 123, "NtCreateKeyedEvent": 124, "NtCreateMailslotFile": 125, "NtCreateMutant": 126, "NtCreateNamedPipeFile": 127, "NtCreatePagingFile": 128, "NtCreatePort": 129, "NtCreateProcess": 130, "NtCreateProfile": 131, "NtCreateSemaphore": 132, "NtCreateSymbolicLinkObject": 133, "NtCreateTimer": 134, "NtCreateToken": 135, "NtCreateWaitablePort": 136, "NtDebugActiveProcess": 137, "NtDebugContinue": 138, "NtDeleteAtom": 139, "NtDeleteBootEntry": 140, "NtDeleteDriverEntry": 141, "NtDeleteFile": 142, "NtDeleteKey": 143, "NtDeleteObjectAuditAlarm": 144, "NtDeleteValueKey": 145, "NtDisplayString": 146, "NtEnumerateBootEntries": 147, "NtEnumerateDriverEntries": 148, "NtEnumerateSystemEnvironmentValuesEx": 149, "NtExtendSection": 150, "NtFilterToken": 151, "NtFlushInstructionCache": 152, "NtFlushKey": 153, "NtFlushVirtualMemory": 154, "NtFlushWriteBuffer": 155, "NtFreeUserPhysicalPages": 156, "NtGetContextThread": 157, "NtGetCurrentProcessorNumber": 158, "NtGetDevicePowerState": 159, "NtGetPlugPlayEvent": 160, "NtGetWriteWatch": 161, "NtImpersonateAnonymousToken": 162, "NtImpersonateThread": 163, "NtInitializeRegistry": 164, "NtInitiatePowerAction": 165, "NtIsSystemResumeAutomatic": 166, "NtListenPort": 167, "NtLoadDriver": 168, "NtLoadKey": 169, "NtLoadKey2": 170, "NtLoadKeyEx": 171, "NtLockFile": 172, "NtLockProductActivationKeys": 173, "NtLockRegistryKey": 174, "NtLockVirtualMemory": 175, "NtMakePermanentObject": 176, "NtMakeTemporaryObject": 177, "NtMapUserPhysicalPages": 178, "NtModifyBootEntry": 179, "NtModifyDriverEntry": 180, "NtNotifyChangeDirectoryFile": 181, "NtNotifyChangeKey": 182, "NtNotifyChangeMultipleKeys": 183, "NtOpenEventPair": 184, "NtOpenIoCompletion": 185, "NtOpenJobObject": 186, "NtOpenKeyedEvent": 187, "NtOpenMutant": 188, "NtOpenObjectAuditAlarm": 189, "NtOpenProcessToken": 190, "NtOpenSemaphore": 191, "NtOpenSymbolicLinkObject": 192, "NtOpenThread": 193, "NtOpenTimer": 194, "NtPlugPlayControl": 195, "NtPrivilegeCheck": 196, "NtPrivilegeObjectAuditAlarm": 197, "NtPrivilegedServiceAuditAlarm": 198, "NtPulseEvent": 199, "NtQueryBootEntryOrder": 200, "NtQueryBootOptions": 201, "NtQueryDebugFilterState": 202, "NtQueryDirectoryObject": 203, "NtQueryDriverEntryOrder": 204, "NtQueryEaFile": 205, "NtQueryFullAttributesFile": 206, "NtQueryInformationAtom": 207, "NtQueryInformationJobObject": 208, "NtQueryInformationPort": 209, "NtQueryInstallUILanguage": 210, "NtQueryIntervalProfile": 211, "NtQueryIoCompletion": 212, "NtQueryMultipleValueKey": 213, "NtQueryMutant": 214, "NtQueryOpenSubKeys": 215, "NtQueryOpenSubKeysEx": 216, "NtQueryPortInformationProcess": 217, "NtQueryQuotaInformationFile": 218, "NtQuerySecurityObject": 219, "NtQuerySemaphore": 220, "NtQuerySymbolicLinkObject": 221, "NtQuerySystemEnvironmentValue": 222, "NtQuerySystemEnvironmentValueEx": 223, "NtQueryTimerResolution": 224, "NtRaiseException": 225, "NtRaiseHardError": 226, "NtRegisterThreadTerminatePort": 227, "NtReleaseKeyedEvent": 228, "NtRemoveProcessDebug": 229, "NtRenameKey": 230, "NtReplaceKey": 231, "NtReplyWaitReplyPort": 232, "NtRequestDeviceWakeup": 233, "NtRequestPort": 234, "NtRequestWakeupLatency": 235, "NtResetEvent": 236, "NtResetWriteWatch": 237, "NtRestoreKey": 238, "NtResumeProcess": 239, "NtSaveKey": 240, "NtSaveKeyEx": 241, "NtSaveMergedKeys": 242, "NtSecureConnectPort": 243, "NtSetBootEntryOrder": 244, "NtSetBootOptions": 245, "NtSetContextThread": 246, "NtSetDebugFilterState": 247, "NtSetDefaultHardErrorPort": 248, "NtSetDefaultLocale": 249, "NtSetDefaultUILanguage": 250, "NtSetDriverEntryOrder": 251, "NtSetEaFile": 252, "NtSetHighEventPair": 253, "NtSetHighWaitLowEventPair": 254, "NtSetInformationDebugObject": 255, "NtSetInformationJobObject": 256, "NtSetInformationKey": 257, "NtSetInformationToken": 258, "NtSetIntervalProfile": 259, "NtSetIoCompletion": 260, "NtSetLdtEntries": 261, "NtSetLowEventPair": 262, "NtSetLowWaitHighEventPair": 263, "NtSetQuotaInformationFile": 264, "NtSetSecurityObject": 265, "NtSetSystemEnvironmentValue": 266, "NtSetSystemEnvironmentValueEx": 267, "NtSetSystemInformation": 268, "NtSetSystemPowerState": 269, "NtSetSystemTime": 270, "NtSetThreadExecutionState": 271, "NtSetTimerResolution": 272, "NtSetUuidSeed": 273, "NtSetVolumeInformationFile": 274, "NtShutdownSystem": 275, "NtSignalAndWaitForSingleObject": 276, "NtStartProfile": 277, "NtStopProfile": 278, "NtSuspendProcess": 279, "NtSuspendThread": 280, "NtSystemDebugControl": 281, "NtTerminateJobObject": 282, "NtTestAlert": 283, "NtTranslateFilePath": 284, "NtUnloadDriver": 285, "NtUnloadKey": 286, "NtUnloadKey2": 287, "NtUnloadKeyEx": 288, "NtUnlockFile": 289, "NtUnlockVirtualMemory": 290, "NtVdmControl": 291, "NtWaitForDebugEvent": 292, "NtWaitForKeyedEvent": 293, "NtWaitHighEventPair": 294, "NtWaitLowEventPair": 295}}, "Windows Server 2003": {"SP0": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateUserPhysicalPages": 108, "NtAllocateUuids": 109, "NtAreMappedFilesTheSame": 110, "NtAssignProcessToJobObject": 111, "NtCancelDeviceWakeupRequest": 112, "NtCompactKeys": 113, "NtCompareTokens": 114, "NtCompleteConnectPort": 115, "NtCompressKey": 116, "NtConnectPort": 117, "NtCreateDebugObject": 118, "NtCreateDirectoryObject": 119, "NtCreateEventPair": 120, "NtCreateIoCompletion": 121, "NtCreateJobObject": 122, "NtCreateJobSet": 123, "NtCreateKeyedEvent": 124, "NtCreateMailslotFile": 125, "NtCreateMutant": 126, "NtCreateNamedPipeFile": 127, "NtCreatePagingFile": 128, "NtCreatePort": 129, "NtCreateProcess": 130, "NtCreateProfile": 131, "NtCreateSemaphore": 132, "NtCreateSymbolicLinkObject": 133, "NtCreateTimer": 134, "NtCreateToken": 135, "NtCreateWaitablePort": 136, "NtDebugActiveProcess": 137, "NtDebugContinue": 138, "NtDeleteAtom": 139, "NtDeleteBootEntry": 140, "NtDeleteDriverEntry": 141, "NtDeleteFile": 142, "NtDeleteKey": 143, "NtDeleteObjectAuditAlarm": 144, "NtDeleteValueKey": 145, "NtDisplayString": 146, "NtEnumerateBootEntries": 147, "NtEnumerateDriverEntries": 148, "NtEnumerateSystemEnvironmentValuesEx": 149, "NtExtendSection": 150, "NtFilterToken": 151, "NtFlushInstructionCache": 152, "NtFlushKey": 153, "NtFlushVirtualMemory": 154, "NtFlushWriteBuffer": 155, "NtFreeUserPhysicalPages": 156, "NtGetContextThread": 157, "NtGetCurrentProcessorNumber": 158, "NtGetDevicePowerState": 159, "NtGetPlugPlayEvent": 160, "NtGetWriteWatch": 161, "NtImpersonateAnonymousToken": 162, "NtImpersonateThread": 163, "NtInitializeRegistry": 164, "NtInitiatePowerAction": 165, "NtIsSystemResumeAutomatic": 166, "NtListenPort": 167, "NtLoadDriver": 168, "NtLoadKey": 169, "NtLoadKey2": 170, "NtLoadKeyEx": 171, "NtLockFile": 172, "NtLockProductActivationKeys": 173, "NtLockRegistryKey": 174, "NtLockVirtualMemory": 175, "NtMakePermanentObject": 176, "NtMakeTemporaryObject": 177, "NtMapUserPhysicalPages": 178, "NtModifyBootEntry": 179, "NtModifyDriverEntry": 180, "NtNotifyChangeDirectoryFile": 181, "NtNotifyChangeKey": 182, "NtNotifyChangeMultipleKeys": 183, "NtOpenEventPair": 184, "NtOpenIoCompletion": 185, "NtOpenJobObject": 186, "NtOpenKeyedEvent": 187, "NtOpenMutant": 188, "NtOpenObjectAuditAlarm": 189, "NtOpenProcessToken": 190, "NtOpenSemaphore": 191, "NtOpenSymbolicLinkObject": 192, "NtOpenThread": 193, "NtOpenTimer": 194, "NtPlugPlayControl": 195, "NtPrivilegeCheck": 196, "NtPrivilegeObjectAuditAlarm": 197, "NtPrivilegedServiceAuditAlarm": 198, "NtPulseEvent": 199, "NtQueryBootEntryOrder": 200, "NtQueryBootOptions": 201, "NtQueryDebugFilterState": 202, "NtQueryDirectoryObject": 203, "NtQueryDriverEntryOrder": 204, "NtQueryEaFile": 205, "NtQueryFullAttributesFile": 206, "NtQueryInformationAtom": 207, "NtQueryInformationJobObject": 208, "NtQueryInformationPort": 209, "NtQueryInstallUILanguage": 210, "NtQueryIntervalProfile": 211, "NtQueryIoCompletion": 212, "NtQueryMultipleValueKey": 213, "NtQueryMutant": 214, "NtQueryOpenSubKeys": 215, "NtQueryOpenSubKeysEx": 216, "NtQueryPortInformationProcess": 217, "NtQueryQuotaInformationFile": 218, "NtQuerySecurityObject": 219, "NtQuerySemaphore": 220, "NtQuerySymbolicLinkObject": 221, "NtQuerySystemEnvironmentValue": 222, "NtQuerySystemEnvironmentValueEx": 223, "NtQueryTimerResolution": 224, "NtRaiseException": 225, "NtRaiseHardError": 226, "NtRegisterThreadTerminatePort": 227, "NtReleaseKeyedEvent": 228, "NtRemoveProcessDebug": 229, "NtRenameKey": 230, "NtReplaceKey": 231, "NtReplyWaitReplyPort": 232, "NtRequestDeviceWakeup": 233, "NtRequestPort": 234, "NtRequestWakeupLatency": 235, "NtResetEvent": 236, "NtResetWriteWatch": 237, "NtRestoreKey": 238, "NtResumeProcess": 239, "NtSaveKey": 240, "NtSaveKeyEx": 241, "NtSaveMergedKeys": 242, "NtSecureConnectPort": 243, "NtSetBootEntryOrder": 244, "NtSetBootOptions": 245, "NtSetContextThread": 246, "NtSetDebugFilterState": 247, "NtSetDefaultHardErrorPort": 248, "NtSetDefaultLocale": 249, "NtSetDefaultUILanguage": 250, "NtSetDriverEntryOrder": 251, "NtSetEaFile": 252, "NtSetHighEventPair": 253, "NtSetHighWaitLowEventPair": 254, "NtSetInformationDebugObject": 255, "NtSetInformationJobObject": 256, "NtSetInformationKey": 257, "NtSetInformationToken": 258, "NtSetIntervalProfile": 259, "NtSetIoCompletion": 260, "NtSetLdtEntries": 261, "NtSetLowEventPair": 262, "NtSetLowWaitHighEventPair": 263, "NtSetQuotaInformationFile": 264, "NtSetSecurityObject": 265, "NtSetSystemEnvironmentValue": 266, "NtSetSystemEnvironmentValueEx": 267, "NtSetSystemInformation": 268, "NtSetSystemPowerState": 269, "NtSetSystemTime": 270, "NtSetThreadExecutionState": 271, "NtSetTimerResolution": 272, "NtSetUuidSeed": 273, "NtSetVolumeInformationFile": 274, "NtShutdownSystem": 275, "NtSignalAndWaitForSingleObject": 276, "NtStartProfile": 277, "NtStopProfile": 278, "NtSuspendProcess": 279, "NtSuspendThread": 280, "NtSystemDebugControl": 281, "NtTerminateJobObject": 282, "NtTestAlert": 283, "NtTranslateFilePath": 284, "NtUnloadDriver": 285, "NtUnloadKey": 286, "NtUnloadKey2": 287, "NtUnloadKeyEx": 288, "NtUnlockFile": 289, "NtUnlockVirtualMemory": 290, "NtVdmControl": 291, "NtWaitForDebugEvent": 292, "NtWaitForKeyedEvent": 293, "NtWaitHighEventPair": 294, "NtWaitLowEventPair": 295}, "SP2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateUserPhysicalPages": 108, "NtAllocateUuids": 109, "NtAreMappedFilesTheSame": 110, "NtAssignProcessToJobObject": 111, "NtCancelDeviceWakeupRequest": 112, "NtCompactKeys": 113, "NtCompareTokens": 114, "NtCompleteConnectPort": 115, "NtCompressKey": 116, "NtConnectPort": 117, "NtCreateDebugObject": 118, "NtCreateDirectoryObject": 119, "NtCreateEventPair": 120, "NtCreateIoCompletion": 121, "NtCreateJobObject": 122, "NtCreateJobSet": 123, "NtCreateKeyedEvent": 124, "NtCreateMailslotFile": 125, "NtCreateMutant": 126, "NtCreateNamedPipeFile": 127, "NtCreatePagingFile": 128, "NtCreatePort": 129, "NtCreateProcess": 130, "NtCreateProfile": 131, "NtCreateSemaphore": 132, "NtCreateSymbolicLinkObject": 133, "NtCreateTimer": 134, "NtCreateToken": 135, "NtCreateWaitablePort": 136, "NtDebugActiveProcess": 137, "NtDebugContinue": 138, "NtDeleteAtom": 139, "NtDeleteBootEntry": 140, "NtDeleteDriverEntry": 141, "NtDeleteFile": 142, "NtDeleteKey": 143, "NtDeleteObjectAuditAlarm": 144, "NtDeleteValueKey": 145, "NtDisplayString": 146, "NtEnumerateBootEntries": 147, "NtEnumerateDriverEntries": 148, "NtEnumerateSystemEnvironmentValuesEx": 149, "NtExtendSection": 150, "NtFilterToken": 151, "NtFlushInstructionCache": 152, "NtFlushKey": 153, "NtFlushVirtualMemory": 154, "NtFlushWriteBuffer": 155, "NtFreeUserPhysicalPages": 156, "NtGetContextThread": 157, "NtGetCurrentProcessorNumber": 158, "NtGetDevicePowerState": 159, "NtGetPlugPlayEvent": 160, "NtGetWriteWatch": 161, "NtImpersonateAnonymousToken": 162, "NtImpersonateThread": 163, "NtInitializeRegistry": 164, "NtInitiatePowerAction": 165, "NtIsSystemResumeAutomatic": 166, "NtListenPort": 167, "NtLoadDriver": 168, "NtLoadKey": 169, "NtLoadKey2": 170, "NtLoadKeyEx": 171, "NtLockFile": 172, "NtLockProductActivationKeys": 173, "NtLockRegistryKey": 174, "NtLockVirtualMemory": 175, "NtMakePermanentObject": 176, "NtMakeTemporaryObject": 177, "NtMapUserPhysicalPages": 178, "NtModifyBootEntry": 179, "NtModifyDriverEntry": 180, "NtNotifyChangeDirectoryFile": 181, "NtNotifyChangeKey": 182, "NtNotifyChangeMultipleKeys": 183, "NtOpenEventPair": 184, "NtOpenIoCompletion": 185, "NtOpenJobObject": 186, "NtOpenKeyedEvent": 187, "NtOpenMutant": 188, "NtOpenObjectAuditAlarm": 189, "NtOpenProcessToken": 190, "NtOpenSemaphore": 191, "NtOpenSymbolicLinkObject": 192, "NtOpenThread": 193, "NtOpenTimer": 194, "NtPlugPlayControl": 195, "NtPrivilegeCheck": 196, "NtPrivilegeObjectAuditAlarm": 197, "NtPrivilegedServiceAuditAlarm": 198, "NtPulseEvent": 199, "NtQueryBootEntryOrder": 200, "NtQueryBootOptions": 201, "NtQueryDebugFilterState": 202, "NtQueryDirectoryObject": 203, "NtQueryDriverEntryOrder": 204, "NtQueryEaFile": 205, "NtQueryFullAttributesFile": 206, "NtQueryInformationAtom": 207, "NtQueryInformationJobObject": 208, "NtQueryInformationPort": 209, "NtQueryInstallUILanguage": 210, "NtQueryIntervalProfile": 211, "NtQueryIoCompletion": 212, "NtQueryMultipleValueKey": 213, "NtQueryMutant": 214, "NtQueryOpenSubKeys": 215, "NtQueryOpenSubKeysEx": 216, "NtQueryPortInformationProcess": 217, "NtQueryQuotaInformationFile": 218, "NtQuerySecurityObject": 219, "NtQuerySemaphore": 220, "NtQuerySymbolicLinkObject": 221, "NtQuerySystemEnvironmentValue": 222, "NtQuerySystemEnvironmentValueEx": 223, "NtQueryTimerResolution": 224, "NtRaiseException": 225, "NtRaiseHardError": 226, "NtRegisterThreadTerminatePort": 227, "NtReleaseKeyedEvent": 228, "NtRemoveProcessDebug": 229, "NtRenameKey": 230, "NtReplaceKey": 231, "NtReplyWaitReplyPort": 232, "NtRequestDeviceWakeup": 233, "NtRequestPort": 234, "NtRequestWakeupLatency": 235, "NtResetEvent": 236, "NtResetWriteWatch": 237, "NtRestoreKey": 238, "NtResumeProcess": 239, "NtSaveKey": 240, "NtSaveKeyEx": 241, "NtSaveMergedKeys": 242, "NtSecureConnectPort": 243, "NtSetBootEntryOrder": 244, "NtSetBootOptions": 245, "NtSetContextThread": 246, "NtSetDebugFilterState": 247, "NtSetDefaultHardErrorPort": 248, "NtSetDefaultLocale": 249, "NtSetDefaultUILanguage": 250, "NtSetDriverEntryOrder": 251, "NtSetEaFile": 252, "NtSetHighEventPair": 253, "NtSetHighWaitLowEventPair": 254, "NtSetInformationDebugObject": 255, "NtSetInformationJobObject": 256, "NtSetInformationKey": 257, "NtSetInformationToken": 258, "NtSetIntervalProfile": 259, "NtSetIoCompletion": 260, "NtSetLdtEntries": 261, "NtSetLowEventPair": 262, "NtSetLowWaitHighEventPair": 263, "NtSetQuotaInformationFile": 264, "NtSetSecurityObject": 265, "NtSetSystemEnvironmentValue": 266, "NtSetSystemEnvironmentValueEx": 267, "NtSetSystemInformation": 268, "NtSetSystemPowerState": 269, "NtSetSystemTime": 270, "NtSetThreadExecutionState": 271, "NtSetTimerResolution": 272, "NtSetUuidSeed": 273, "NtSetVolumeInformationFile": 274, "NtShutdownSystem": 275, "NtSignalAndWaitForSingleObject": 276, "NtStartProfile": 277, "NtStopProfile": 278, "NtSuspendProcess": 279, "NtSuspendThread": 280, "NtSystemDebugControl": 281, "NtTerminateJobObject": 282, "NtTestAlert": 283, "NtTranslateFilePath": 284, "NtUnloadDriver": 285, "NtUnloadKey": 286, "NtUnloadKey2": 287, "NtUnloadKeyEx": 288, "NtUnlockFile": 289, "NtUnlockVirtualMemory": 290, "NtVdmControl": 291, "NtWaitForDebugEvent": 292, "NtWaitForKeyedEvent": 293, "NtWaitHighEventPair": 294, "NtWaitLowEventPair": 295}, "R2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateUserPhysicalPages": 108, "NtAllocateUuids": 109, "NtAreMappedFilesTheSame": 110, "NtAssignProcessToJobObject": 111, "NtCancelDeviceWakeupRequest": 112, "NtCompactKeys": 113, "NtCompareTokens": 114, "NtCompleteConnectPort": 115, "NtCompressKey": 116, "NtConnectPort": 117, "NtCreateDebugObject": 118, "NtCreateDirectoryObject": 119, "NtCreateEventPair": 120, "NtCreateIoCompletion": 121, "NtCreateJobObject": 122, "NtCreateJobSet": 123, "NtCreateKeyedEvent": 124, "NtCreateMailslotFile": 125, "NtCreateMutant": 126, "NtCreateNamedPipeFile": 127, "NtCreatePagingFile": 128, "NtCreatePort": 129, "NtCreateProcess": 130, "NtCreateProfile": 131, "NtCreateSemaphore": 132, "NtCreateSymbolicLinkObject": 133, "NtCreateTimer": 134, "NtCreateToken": 135, "NtCreateWaitablePort": 136, "NtDebugActiveProcess": 137, "NtDebugContinue": 138, "NtDeleteAtom": 139, "NtDeleteBootEntry": 140, "NtDeleteDriverEntry": 141, "NtDeleteFile": 142, "NtDeleteKey": 143, "NtDeleteObjectAuditAlarm": 144, "NtDeleteValueKey": 145, "NtDisplayString": 146, "NtEnumerateBootEntries": 147, "NtEnumerateDriverEntries": 148, "NtEnumerateSystemEnvironmentValuesEx": 149, "NtExtendSection": 150, "NtFilterToken": 151, "NtFlushInstructionCache": 152, "NtFlushKey": 153, "NtFlushVirtualMemory": 154, "NtFlushWriteBuffer": 155, "NtFreeUserPhysicalPages": 156, "NtGetContextThread": 157, "NtGetCurrentProcessorNumber": 158, "NtGetDevicePowerState": 159, "NtGetPlugPlayEvent": 160, "NtGetWriteWatch": 161, "NtImpersonateAnonymousToken": 162, "NtImpersonateThread": 163, "NtInitializeRegistry": 164, "NtInitiatePowerAction": 165, "NtIsSystemResumeAutomatic": 166, "NtListenPort": 167, "NtLoadDriver": 168, "NtLoadKey": 169, "NtLoadKey2": 170, "NtLoadKeyEx": 171, "NtLockFile": 172, "NtLockProductActivationKeys": 173, "NtLockRegistryKey": 174, "NtLockVirtualMemory": 175, "NtMakePermanentObject": 176, "NtMakeTemporaryObject": 177, "NtMapUserPhysicalPages": 178, "NtModifyBootEntry": 179, "NtModifyDriverEntry": 180, "NtNotifyChangeDirectoryFile": 181, "NtNotifyChangeKey": 182, "NtNotifyChangeMultipleKeys": 183, "NtOpenEventPair": 184, "NtOpenIoCompletion": 185, "NtOpenJobObject": 186, "NtOpenKeyedEvent": 187, "NtOpenMutant": 188, "NtOpenObjectAuditAlarm": 189, "NtOpenProcessToken": 190, "NtOpenSemaphore": 191, "NtOpenSymbolicLinkObject": 192, "NtOpenThread": 193, "NtOpenTimer": 194, "NtPlugPlayControl": 195, "NtPrivilegeCheck": 196, "NtPrivilegeObjectAuditAlarm": 197, "NtPrivilegedServiceAuditAlarm": 198, "NtPulseEvent": 199, "NtQueryBootEntryOrder": 200, "NtQueryBootOptions": 201, "NtQueryDebugFilterState": 202, "NtQueryDirectoryObject": 203, "NtQueryDriverEntryOrder": 204, "NtQueryEaFile": 205, "NtQueryFullAttributesFile": 206, "NtQueryInformationAtom": 207, "NtQueryInformationJobObject": 208, "NtQueryInformationPort": 209, "NtQueryInstallUILanguage": 210, "NtQueryIntervalProfile": 211, "NtQueryIoCompletion": 212, "NtQueryMultipleValueKey": 213, "NtQueryMutant": 214, "NtQueryOpenSubKeys": 215, "NtQueryOpenSubKeysEx": 216, "NtQueryPortInformationProcess": 217, "NtQueryQuotaInformationFile": 218, "NtQuerySecurityObject": 219, "NtQuerySemaphore": 220, "NtQuerySymbolicLinkObject": 221, "NtQuerySystemEnvironmentValue": 222, "NtQuerySystemEnvironmentValueEx": 223, "NtQueryTimerResolution": 224, "NtRaiseException": 225, "NtRaiseHardError": 226, "NtRegisterThreadTerminatePort": 227, "NtReleaseKeyedEvent": 228, "NtRemoveProcessDebug": 229, "NtRenameKey": 230, "NtReplaceKey": 231, "NtReplyWaitReplyPort": 232, "NtRequestDeviceWakeup": 233, "NtRequestPort": 234, "NtRequestWakeupLatency": 235, "NtResetEvent": 236, "NtResetWriteWatch": 237, "NtRestoreKey": 238, "NtResumeProcess": 239, "NtSaveKey": 240, "NtSaveKeyEx": 241, "NtSaveMergedKeys": 242, "NtSecureConnectPort": 243, "NtSetBootEntryOrder": 244, "NtSetBootOptions": 245, "NtSetContextThread": 246, "NtSetDebugFilterState": 247, "NtSetDefaultHardErrorPort": 248, "NtSetDefaultLocale": 249, "NtSetDefaultUILanguage": 250, "NtSetDriverEntryOrder": 251, "NtSetEaFile": 252, "NtSetHighEventPair": 253, "NtSetHighWaitLowEventPair": 254, "NtSetInformationDebugObject": 255, "NtSetInformationJobObject": 256, "NtSetInformationKey": 257, "NtSetInformationToken": 258, "NtSetIntervalProfile": 259, "NtSetIoCompletion": 260, "NtSetLdtEntries": 261, "NtSetLowEventPair": 262, "NtSetLowWaitHighEventPair": 263, "NtSetQuotaInformationFile": 264, "NtSetSecurityObject": 265, "NtSetSystemEnvironmentValue": 266, "NtSetSystemEnvironmentValueEx": 267, "NtSetSystemInformation": 268, "NtSetSystemPowerState": 269, "NtSetSystemTime": 270, "NtSetThreadExecutionState": 271, "NtSetTimerResolution": 272, "NtSetUuidSeed": 273, "NtSetVolumeInformationFile": 274, "NtShutdownSystem": 275, "NtSignalAndWaitForSingleObject": 276, "NtStartProfile": 277, "NtStopProfile": 278, "NtSuspendProcess": 279, "NtSuspendThread": 280, "NtSystemDebugControl": 281, "NtTerminateJobObject": 282, "NtTestAlert": 283, "NtTranslateFilePath": 284, "NtUnloadDriver": 285, "NtUnloadKey": 286, "NtUnloadKey2": 287, "NtUnloadKeyEx": 288, "NtUnlockFile": 289, "NtUnlockVirtualMemory": 290, "NtVdmControl": 291, "NtWaitForDebugEvent": 292, "NtWaitForKeyedEvent": 293, "NtWaitHighEventPair": 294, "NtWaitLowEventPair": 295}, "R2 SP2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateUserPhysicalPages": 108, "NtAllocateUuids": 109, "NtAreMappedFilesTheSame": 110, "NtAssignProcessToJobObject": 111, "NtCancelDeviceWakeupRequest": 112, "NtCompactKeys": 113, "NtCompareTokens": 114, "NtCompleteConnectPort": 115, "NtCompressKey": 116, "NtConnectPort": 117, "NtCreateDebugObject": 118, "NtCreateDirectoryObject": 119, "NtCreateEventPair": 120, "NtCreateIoCompletion": 121, "NtCreateJobObject": 122, "NtCreateJobSet": 123, "NtCreateKeyedEvent": 124, "NtCreateMailslotFile": 125, "NtCreateMutant": 126, "NtCreateNamedPipeFile": 127, "NtCreatePagingFile": 128, "NtCreatePort": 129, "NtCreateProcess": 130, "NtCreateProfile": 131, "NtCreateSemaphore": 132, "NtCreateSymbolicLinkObject": 133, "NtCreateTimer": 134, "NtCreateToken": 135, "NtCreateWaitablePort": 136, "NtDebugActiveProcess": 137, "NtDebugContinue": 138, "NtDeleteAtom": 139, "NtDeleteBootEntry": 140, "NtDeleteDriverEntry": 141, "NtDeleteFile": 142, "NtDeleteKey": 143, "NtDeleteObjectAuditAlarm": 144, "NtDeleteValueKey": 145, "NtDisplayString": 146, "NtEnumerateBootEntries": 147, "NtEnumerateDriverEntries": 148, "NtEnumerateSystemEnvironmentValuesEx": 149, "NtExtendSection": 150, "NtFilterToken": 151, "NtFlushInstructionCache": 152, "NtFlushKey": 153, "NtFlushVirtualMemory": 154, "NtFlushWriteBuffer": 155, "NtFreeUserPhysicalPages": 156, "NtGetContextThread": 157, "NtGetCurrentProcessorNumber": 158, "NtGetDevicePowerState": 159, "NtGetPlugPlayEvent": 160, "NtGetWriteWatch": 161, "NtImpersonateAnonymousToken": 162, "NtImpersonateThread": 163, "NtInitializeRegistry": 164, "NtInitiatePowerAction": 165, "NtIsSystemResumeAutomatic": 166, "NtListenPort": 167, "NtLoadDriver": 168, "NtLoadKey": 169, "NtLoadKey2": 170, "NtLoadKeyEx": 171, "NtLockFile": 172, "NtLockProductActivationKeys": 173, "NtLockRegistryKey": 174, "NtLockVirtualMemory": 175, "NtMakePermanentObject": 176, "NtMakeTemporaryObject": 177, "NtMapUserPhysicalPages": 178, "NtModifyBootEntry": 179, "NtModifyDriverEntry": 180, "NtNotifyChangeDirectoryFile": 181, "NtNotifyChangeKey": 182, "NtNotifyChangeMultipleKeys": 183, "NtOpenEventPair": 184, "NtOpenIoCompletion": 185, "NtOpenJobObject": 186, "NtOpenKeyedEvent": 187, "NtOpenMutant": 188, "NtOpenObjectAuditAlarm": 189, "NtOpenProcessToken": 190, "NtOpenSemaphore": 191, "NtOpenSymbolicLinkObject": 192, "NtOpenThread": 193, "NtOpenTimer": 194, "NtPlugPlayControl": 195, "NtPrivilegeCheck": 196, "NtPrivilegeObjectAuditAlarm": 197, "NtPrivilegedServiceAuditAlarm": 198, "NtPulseEvent": 199, "NtQueryBootEntryOrder": 200, "NtQueryBootOptions": 201, "NtQueryDebugFilterState": 202, "NtQueryDirectoryObject": 203, "NtQueryDriverEntryOrder": 204, "NtQueryEaFile": 205, "NtQueryFullAttributesFile": 206, "NtQueryInformationAtom": 207, "NtQueryInformationJobObject": 208, "NtQueryInformationPort": 209, "NtQueryInstallUILanguage": 210, "NtQueryIntervalProfile": 211, "NtQueryIoCompletion": 212, "NtQueryMultipleValueKey": 213, "NtQueryMutant": 214, "NtQueryOpenSubKeys": 215, "NtQueryOpenSubKeysEx": 216, "NtQueryPortInformationProcess": 217, "NtQueryQuotaInformationFile": 218, "NtQuerySecurityObject": 219, "NtQuerySemaphore": 220, "NtQuerySymbolicLinkObject": 221, "NtQuerySystemEnvironmentValue": 222, "NtQuerySystemEnvironmentValueEx": 223, "NtQueryTimerResolution": 224, "NtRaiseException": 225, "NtRaiseHardError": 226, "NtRegisterThreadTerminatePort": 227, "NtReleaseKeyedEvent": 228, "NtRemoveProcessDebug": 229, "NtRenameKey": 230, "NtReplaceKey": 231, "NtReplyWaitReplyPort": 232, "NtRequestDeviceWakeup": 233, "NtRequestPort": 234, "NtRequestWakeupLatency": 235, "NtResetEvent": 236, "NtResetWriteWatch": 237, "NtRestoreKey": 238, "NtResumeProcess": 239, "NtSaveKey": 240, "NtSaveKeyEx": 241, "NtSaveMergedKeys": 242, "NtSecureConnectPort": 243, "NtSetBootEntryOrder": 244, "NtSetBootOptions": 245, "NtSetContextThread": 246, "NtSetDebugFilterState": 247, "NtSetDefaultHardErrorPort": 248, "NtSetDefaultLocale": 249, "NtSetDefaultUILanguage": 250, "NtSetDriverEntryOrder": 251, "NtSetEaFile": 252, "NtSetHighEventPair": 253, "NtSetHighWaitLowEventPair": 254, "NtSetInformationDebugObject": 255, "NtSetInformationJobObject": 256, "NtSetInformationKey": 257, "NtSetInformationToken": 258, "NtSetIntervalProfile": 259, "NtSetIoCompletion": 260, "NtSetLdtEntries": 261, "NtSetLowEventPair": 262, "NtSetLowWaitHighEventPair": 263, "NtSetQuotaInformationFile": 264, "NtSetSecurityObject": 265, "NtSetSystemEnvironmentValue": 266, "NtSetSystemEnvironmentValueEx": 267, "NtSetSystemInformation": 268, "NtSetSystemPowerState": 269, "NtSetSystemTime": 270, "NtSetThreadExecutionState": 271, "NtSetTimerResolution": 272, "NtSetUuidSeed": 273, "NtSetVolumeInformationFile": 274, "NtShutdownSystem": 275, "NtSignalAndWaitForSingleObject": 276, "NtStartProfile": 277, "NtStopProfile": 278, "NtSuspendProcess": 279, "NtSuspendThread": 280, "NtSystemDebugControl": 281, "NtTerminateJobObject": 282, "NtTestAlert": 283, "NtTranslateFilePath": 284, "NtUnloadDriver": 285, "NtUnloadKey": 286, "NtUnloadKey2": 287, "NtUnloadKeyEx": 288, "NtUnlockFile": 289, "NtUnlockVirtualMemory": 290, "NtVdmControl": 291, "NtWaitForDebugEvent": 292, "NtWaitForKeyedEvent": 293, "NtWaitHighEventPair": 294, "NtWaitLowEventPair": 295}}, "Windows Vista": {"SP0": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAcquireCMFViewOwnership": 102, "NtAddBootEntry": 103, "NtAddDriverEntry": 104, "NtAdjustGroupsToken": 105, "NtAlertResumeThread": 106, "NtAlertThread": 107, "NtAllocateLocallyUniqueId": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelDeviceWakeupRequest": 134, "NtCancelIoFileEx": 135, "NtCancelSynchronousIoFile": 136, "NtClearAllSavepointsTransaction": 137, "NtClearSavepointTransaction": 138, "NtCommitComplete": 139, "NtCommitEnlistment": 140, "NtCommitTransaction": 141, "NtCompactKeys": 142, "NtCompareTokens": 143, "NtCompleteConnectPort": 144, "NtCompressKey": 145, "NtConnectPort": 146, "NtCreateDebugObject": 147, "NtCreateDirectoryObject": 148, "NtCreateEnlistment": 149, "NtCreateEventPair": 150, "NtCreateIoCompletion": 151, "NtCreateJobObject": 152, "NtCreateJobSet": 153, "NtCreateKeyTransacted": 154, "NtCreateKeyedEvent": 155, "NtCreateMailslotFile": 156, "NtCreateMutant": 157, "NtCreateNamedPipeFile": 158, "NtCreatePagingFile": 159, "NtCreatePort": 160, "NtCreatePrivateNamespace": 161, "NtCreateProcess": 162, "NtCreateProfile": 163, "NtCreateResourceManager": 164, "NtCreateSemaphore": 165, "NtCreateSymbolicLinkObject": 166, "NtCreateThreadEx": 167, "NtCreateTimer": 168, "NtCreateToken": 169, "NtCreateTransaction": 170, "NtCreateTransactionManager": 171, "NtCreateUserProcess": 172, "NtCreateWaitablePort": 173, "NtCreateWorkerFactory": 174, "NtDebugActiveProcess": 175, "NtDebugContinue": 176, "NtDeleteAtom": 177, "NtDeleteBootEntry": 178, "NtDeleteDriverEntry": 179, "NtDeleteFile": 180, "NtDeleteKey": 181, "NtDeleteObjectAuditAlarm": 182, "NtDeletePrivateNamespace": 183, "NtDeleteValueKey": 184, "NtDisplayString": 185, "NtEnumerateBootEntries": 186, "NtEnumerateDriverEntries": 187, "NtEnumerateSystemEnvironmentValuesEx": 188, "NtEnumerateTransactionObject": 189, "NtExtendSection": 190, "NtFilterToken": 191, "NtFlushInstallUILanguage": 192, "NtFlushInstructionCache": 193, "NtFlushKey": 194, "NtFlushProcessWriteBuffers": 195, "NtFlushVirtualMemory": 196, "NtFlushWriteBuffer": 197, "NtFreeUserPhysicalPages": 198, "NtFreezeRegistry": 199, "NtFreezeTransactions": 200, "NtGetContextThread": 201, "NtGetCurrentProcessorNumber": 202, "NtGetDevicePowerState": 203, "NtGetMUIRegistryInfo": 204, "NtGetNextProcess": 205, "NtGetNextThread": 206, "NtGetNlsSectionPtr": 207, "NtGetNotificationResourceManager": 208, "NtGetPlugPlayEvent": 209, "NtGetWriteWatch": 210, "NtImpersonateAnonymousToken": 211, "NtImpersonateThread": 212, "NtInitializeNlsFiles": 213, "NtInitializeRegistry": 214, "NtInitiatePowerAction": 215, "NtIsSystemResumeAutomatic": 216, "NtIsUILanguageComitted": 217, "NtListTransactions": 218, "NtListenPort": 219, "NtLoadDriver": 220, "NtLoadKey": 221, "NtLoadKey2": 222, "NtLoadKeyEx": 223, "NtLockFile": 224, "NtLockProductActivationKeys": 225, "NtLockRegistryKey": 226, "NtLockVirtualMemory": 227, "NtMakePermanentObject": 228, "NtMakeTemporaryObject": 229, "NtMapCMFModule": 230, "NtMapUserPhysicalPages": 231, "NtMarshallTransaction": 232, "NtModifyBootEntry": 233, "NtModifyDriverEntry": 234, "NtNotifyChangeDirectoryFile": 235, "NtNotifyChangeKey": 236, "NtNotifyChangeMultipleKeys": 237, "NtOpenEnlistment": 238, "NtOpenEventPair": 239, "NtOpenIoCompletion": 240, "NtOpenJobObject": 241, "NtOpenKeyTransacted": 242, "NtOpenKeyedEvent": 243, "NtOpenMutant": 244, "NtOpenObjectAuditAlarm": 245, "NtOpenPrivateNamespace": 246, "NtOpenProcessToken": 247, "NtOpenResourceManager": 248, "NtOpenSemaphore": 249, "NtOpenSession": 250, "NtOpenSymbolicLinkObject": 251, "NtOpenThread": 252, "NtOpenTimer": 253, "NtOpenTransaction": 254, "NtOpenTransactionManager": 255, "NtPlugPlayControl": 256, "NtPrePrepareComplete": 257, "NtPrePrepareEnlistment": 258, "NtPrepareComplete": 259, "NtPrepareEnlistment": 260, "NtPrivilegeCheck": 261, "NtPrivilegeObjectAuditAlarm": 262, "NtPrivilegedServiceAuditAlarm": 263, "NtPropagationComplete": 264, "NtPropagationFailed": 265, "NtPullTransaction": 266, "NtPulseEvent": 267, "NtQueryBootEntryOrder": 268, "NtQueryBootOptions": 269, "NtQueryDebugFilterState": 270, "NtQueryDirectoryObject": 271, "NtQueryDriverEntryOrder": 272, "NtQueryEaFile": 273, "NtQueryFullAttributesFile": 274, "NtQueryInformationAtom": 275, "NtQueryInformationEnlistment": 276, "NtQueryInformationJobObject": 277, "NtQueryInformationPort": 278, "NtQueryInformationResourceManager": 279, "NtQueryInformationTransaction": 280, "NtQueryInformationTransactionManager": 281, "NtQueryInformationWorkerFactory": 282, "NtQueryInstallUILanguage": 283, "NtQueryIntervalProfile": 284, "NtQueryIoCompletion": 285, "NtQueryLicenseValue": 286, "NtQueryMultipleValueKey": 287, "NtQueryMutant": 288, "NtQueryOpenSubKeys": 289, "NtQueryOpenSubKeysEx": 290, "NtQueryPortInformationProcess": 291, "NtQueryQuotaInformationFile": 292, "NtQuerySecurityObject": 293, "NtQuerySemaphore": 294, "NtQuerySymbolicLinkObject": 295, "NtQuerySystemEnvironmentValue": 296, "NtQuerySystemEnvironmentValueEx": 297, "NtQueryTimerResolution": 298, "NtRaiseException": 299, "NtRaiseHardError": 300, "NtReadOnlyEnlistment": 301, "NtRecoverEnlistment": 302, "NtRecoverResourceManager": 303, "NtRecoverTransactionManager": 304, "NtRegisterProtocolAddressInformation": 305, "NtRegisterThreadTerminatePort": 306, "NtReleaseCMFViewOwnership": 307, "NtReleaseKeyedEvent": 308, "NtReleaseWorkerFactoryWorker": 309, "NtRemoveIoCompletionEx": 310, "NtRemoveProcessDebug": 311, "NtRenameKey": 312, "NtReplaceKey": 313, "NtReplyWaitReplyPort": 314, "NtRequestDeviceWakeup": 315, "NtRequestPort": 316, "NtRequestWakeupLatency": 317, "NtResetEvent": 318, "NtResetWriteWatch": 319, "NtRestoreKey": 320, "NtResumeProcess": 321, "NtRollbackComplete": 322, "NtRollbackEnlistment": 323, "NtRollbackSavepointTransaction": 324, "NtRollbackTransaction": 325, "NtRollforwardTransactionManager": 326, "NtSaveKey": 327, "NtSaveKeyEx": 328, "NtSaveMergedKeys": 329, "NtSavepointComplete": 330, "NtSavepointTransaction": 331, "NtSecureConnectPort": 332, "NtSetBootEntryOrder": 333, "NtSetBootOptions": 334, "NtSetContextThread": 335, "NtSetDebugFilterState": 336, "NtSetDefaultHardErrorPort": 337, "NtSetDefaultLocale": 338, "NtSetDefaultUILanguage": 339, "NtSetDriverEntryOrder": 340, "NtSetEaFile": 341, "NtSetHighEventPair": 342, "NtSetHighWaitLowEventPair": 343, "NtSetInformationDebugObject": 344, "NtSetInformationEnlistment": 345, "NtSetInformationJobObject": 346, "NtSetInformationKey": 347, "NtSetInformationResourceManager": 348, "NtSetInformationToken": 349, "NtSetInformationTransaction": 350, "NtSetInformationTransactionManager": 351, "NtSetInformationWorkerFactory": 352, "NtSetIntervalProfile": 353, "NtSetIoCompletion": 354, "NtSetLdtEntries": 355, "NtSetLowEventPair": 356, "NtSetLowWaitHighEventPair": 357, "NtSetQuotaInformationFile": 358, "NtSetSecurityObject": 359, "NtSetSystemEnvironmentValue": 360, "NtSetSystemEnvironmentValueEx": 361, "NtSetSystemInformation": 362, "NtSetSystemPowerState": 363, "NtSetSystemTime": 364, "NtSetThreadExecutionState": 365, "NtSetTimerResolution": 366, "NtSetUuidSeed": 367, "NtSetVolumeInformationFile": 368, "NtShutdownSystem": 369, "NtShutdownWorkerFactory": 370, "NtSignalAndWaitForSingleObject": 371, "NtSinglePhaseReject": 372, "NtStartProfile": 373, "NtStartTm": 374, "NtStopProfile": 375, "NtSuspendProcess": 376, "NtSuspendThread": 377, "NtSystemDebugControl": 378, "NtTerminateJobObject": 379, "NtTestAlert": 380, "NtThawRegistry": 381, "NtThawTransactions": 382, "NtTraceControl": 383, "NtTranslateFilePath": 384, "NtUnloadDriver": 385, "NtUnloadKey": 386, "NtUnloadKey2": 387, "NtUnloadKeyEx": 388, "NtUnlockFile": 389, "NtUnlockVirtualMemory": 390, "NtVdmControl": 391, "NtWaitForDebugEvent": 392, "NtWaitForKeyedEvent": 393, "NtWaitForWorkViaWorkerFactory": 394, "NtWaitHighEventPair": 395, "NtWaitLowEventPair": 396, "NtWorkerFactoryWorkerReady": 397}, "SP1": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAcquireCMFViewOwnership": 102, "NtAddBootEntry": 103, "NtAddDriverEntry": 104, "NtAdjustGroupsToken": 105, "NtAlertResumeThread": 106, "NtAlertThread": 107, "NtAllocateLocallyUniqueId": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelDeviceWakeupRequest": 134, "NtCancelIoFileEx": 135, "NtCancelSynchronousIoFile": 136, "NtCommitComplete": 137, "NtCommitEnlistment": 138, "NtCommitTransaction": 139, "NtCompactKeys": 140, "NtCompareTokens": 141, "NtCompleteConnectPort": 142, "NtCompressKey": 143, "NtConnectPort": 144, "NtCreateDebugObject": 145, "NtCreateDirectoryObject": 146, "NtCreateEnlistment": 147, "NtCreateEventPair": 148, "NtCreateIoCompletion": 149, "NtCreateJobObject": 150, "NtCreateJobSet": 151, "NtCreateKeyTransacted": 152, "NtCreateKeyedEvent": 153, "NtCreateMailslotFile": 154, "NtCreateMutant": 155, "NtCreateNamedPipeFile": 156, "NtCreatePagingFile": 157, "NtCreatePort": 158, "NtCreatePrivateNamespace": 159, "NtCreateProcess": 160, "NtCreateProfile": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisplayString": 183, "NtEnumerateBootEntries": 184, "NtEnumerateDriverEntries": 185, "NtEnumerateSystemEnvironmentValuesEx": 186, "NtEnumerateTransactionObject": 187, "NtExtendSection": 188, "NtFilterToken": 189, "NtFlushInstallUILanguage": 190, "NtFlushInstructionCache": 191, "NtFlushKey": 192, "NtFlushProcessWriteBuffers": 193, "NtFlushVirtualMemory": 194, "NtFlushWriteBuffer": 195, "NtFreeUserPhysicalPages": 196, "NtFreezeRegistry": 197, "NtFreezeTransactions": 198, "NtGetContextThread": 199, "NtGetCurrentProcessorNumber": 200, "NtGetDevicePowerState": 201, "NtGetMUIRegistryInfo": 202, "NtGetNextProcess": 203, "NtGetNextThread": 204, "NtGetNlsSectionPtr": 205, "NtGetNotificationResourceManager": 206, "NtGetPlugPlayEvent": 207, "NtGetWriteWatch": 208, "NtImpersonateAnonymousToken": 209, "NtImpersonateThread": 210, "NtInitializeNlsFiles": 211, "NtInitializeRegistry": 212, "NtInitiatePowerAction": 213, "NtIsSystemResumeAutomatic": 214, "NtIsUILanguageComitted": 215, "NtListenPort": 216, "NtLoadDriver": 217, "NtLoadKey": 218, "NtLoadKey2": 219, "NtLoadKeyEx": 220, "NtLockFile": 221, "NtLockProductActivationKeys": 222, "NtLockRegistryKey": 223, "NtLockVirtualMemory": 224, "NtMakePermanentObject": 225, "NtMakeTemporaryObject": 226, "NtMapCMFModule": 227, "NtMapUserPhysicalPages": 228, "NtModifyBootEntry": 229, "NtModifyDriverEntry": 230, "NtNotifyChangeDirectoryFile": 231, "NtNotifyChangeKey": 232, "NtNotifyChangeMultipleKeys": 233, "NtOpenEnlistment": 234, "NtOpenEventPair": 235, "NtOpenIoCompletion": 236, "NtOpenJobObject": 237, "NtOpenKeyTransacted": 238, "NtOpenKeyedEvent": 239, "NtOpenMutant": 240, "NtOpenObjectAuditAlarm": 241, "NtOpenPrivateNamespace": 242, "NtOpenProcessToken": 243, "NtOpenResourceManager": 244, "NtOpenSemaphore": 245, "NtOpenSession": 246, "NtOpenSymbolicLinkObject": 247, "NtOpenThread": 248, "NtOpenTimer": 249, "NtOpenTransaction": 250, "NtOpenTransactionManager": 251, "NtPlugPlayControl": 252, "NtPrePrepareComplete": 253, "NtPrePrepareEnlistment": 254, "NtPrepareComplete": 255, "NtPrepareEnlistment": 256, "NtPrivilegeCheck": 257, "NtPrivilegeObjectAuditAlarm": 258, "NtPrivilegedServiceAuditAlarm": 259, "NtPropagationComplete": 260, "NtPropagationFailed": 261, "NtPulseEvent": 262, "NtQueryBootEntryOrder": 263, "NtQueryBootOptions": 264, "NtQueryDebugFilterState": 265, "NtQueryDirectoryObject": 266, "NtQueryDriverEntryOrder": 267, "NtQueryEaFile": 268, "NtQueryFullAttributesFile": 269, "NtQueryInformationAtom": 270, "NtQueryInformationEnlistment": 271, "NtQueryInformationJobObject": 272, "NtQueryInformationPort": 273, "NtQueryInformationResourceManager": 274, "NtQueryInformationTransaction": 275, "NtQueryInformationTransactionManager": 276, "NtQueryInformationWorkerFactory": 277, "NtQueryInstallUILanguage": 278, "NtQueryIntervalProfile": 279, "NtQueryIoCompletion": 280, "NtQueryLicenseValue": 281, "NtQueryMultipleValueKey": 282, "NtQueryMutant": 283, "NtQueryOpenSubKeys": 284, "NtQueryOpenSubKeysEx": 285, "NtQueryPortInformationProcess": 286, "NtQueryQuotaInformationFile": 287, "NtQuerySecurityObject": 288, "NtQuerySemaphore": 289, "NtQuerySymbolicLinkObject": 290, "NtQuerySystemEnvironmentValue": 291, "NtQuerySystemEnvironmentValueEx": 292, "NtQueryTimerResolution": 293, "NtRaiseException": 294, "NtRaiseHardError": 295, "NtReadOnlyEnlistment": 296, "NtRecoverEnlistment": 297, "NtRecoverResourceManager": 298, "NtRecoverTransactionManager": 299, "NtRegisterProtocolAddressInformation": 300, "NtRegisterThreadTerminatePort": 301, "NtReleaseCMFViewOwnership": 302, "NtReleaseKeyedEvent": 303, "NtReleaseWorkerFactoryWorker": 304, "NtRemoveIoCompletionEx": 305, "NtRemoveProcessDebug": 306, "NtRenameKey": 307, "NtRenameTransactionManager": 308, "NtReplaceKey": 309, "NtReplacePartitionUnit": 310, "NtReplyWaitReplyPort": 311, "NtRequestDeviceWakeup": 312, "NtRequestPort": 313, "NtRequestWakeupLatency": 314, "NtResetEvent": 315, "NtResetWriteWatch": 316, "NtRestoreKey": 317, "NtResumeProcess": 318, "NtRollbackComplete": 319, "NtRollbackEnlistment": 320, "NtRollbackTransaction": 321, "NtRollforwardTransactionManager": 322, "NtSaveKey": 323, "NtSaveKeyEx": 324, "NtSaveMergedKeys": 325, "NtSecureConnectPort": 326, "NtSetBootEntryOrder": 327, "NtSetBootOptions": 328, "NtSetContextThread": 329, "NtSetDebugFilterState": 330, "NtSetDefaultHardErrorPort": 331, "NtSetDefaultLocale": 332, "NtSetDefaultUILanguage": 333, "NtSetDriverEntryOrder": 334, "NtSetEaFile": 335, "NtSetHighEventPair": 336, "NtSetHighWaitLowEventPair": 337, "NtSetInformationDebugObject": 338, "NtSetInformationEnlistment": 339, "NtSetInformationJobObject": 340, "NtSetInformationKey": 341, "NtSetInformationResourceManager": 342, "NtSetInformationToken": 343, "NtSetInformationTransaction": 344, "NtSetInformationTransactionManager": 345, "NtSetInformationWorkerFactory": 346, "NtSetIntervalProfile": 347, "NtSetIoCompletion": 348, "NtSetLdtEntries": 349, "NtSetLowEventPair": 350, "NtSetLowWaitHighEventPair": 351, "NtSetQuotaInformationFile": 352, "NtSetSecurityObject": 353, "NtSetSystemEnvironmentValue": 354, "NtSetSystemEnvironmentValueEx": 355, "NtSetSystemInformation": 356, "NtSetSystemPowerState": 357, "NtSetSystemTime": 358, "NtSetThreadExecutionState": 359, "NtSetTimerResolution": 360, "NtSetUuidSeed": 361, "NtSetVolumeInformationFile": 362, "NtShutdownSystem": 363, "NtShutdownWorkerFactory": 364, "NtSignalAndWaitForSingleObject": 365, "NtSinglePhaseReject": 366, "NtStartProfile": 367, "NtStopProfile": 368, "NtSuspendProcess": 369, "NtSuspendThread": 370, "NtSystemDebugControl": 371, "NtTerminateJobObject": 372, "NtTestAlert": 373, "NtThawRegistry": 374, "NtThawTransactions": 375, "NtTraceControl": 376, "NtTranslateFilePath": 377, "NtUnloadDriver": 378, "NtUnloadKey": 379, "NtUnloadKey2": 380, "NtUnloadKeyEx": 381, "NtUnlockFile": 382, "NtUnlockVirtualMemory": 383, "NtVdmControl": 384, "NtWaitForDebugEvent": 385, "NtWaitForKeyedEvent": 386, "NtWaitForWorkViaWorkerFactory": 387, "NtWaitHighEventPair": 388, "NtWaitLowEventPair": 389, "NtWorkerFactoryWorkerReady": 390}, "SP2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAcquireCMFViewOwnership": 102, "NtAddBootEntry": 103, "NtAddDriverEntry": 104, "NtAdjustGroupsToken": 105, "NtAlertResumeThread": 106, "NtAlertThread": 107, "NtAllocateLocallyUniqueId": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelDeviceWakeupRequest": 134, "NtCancelIoFileEx": 135, "NtCancelSynchronousIoFile": 136, "NtCommitComplete": 137, "NtCommitEnlistment": 138, "NtCommitTransaction": 139, "NtCompactKeys": 140, "NtCompareTokens": 141, "NtCompleteConnectPort": 142, "NtCompressKey": 143, "NtConnectPort": 144, "NtCreateDebugObject": 145, "NtCreateDirectoryObject": 146, "NtCreateEnlistment": 147, "NtCreateEventPair": 148, "NtCreateIoCompletion": 149, "NtCreateJobObject": 150, "NtCreateJobSet": 151, "NtCreateKeyTransacted": 152, "NtCreateKeyedEvent": 153, "NtCreateMailslotFile": 154, "NtCreateMutant": 155, "NtCreateNamedPipeFile": 156, "NtCreatePagingFile": 157, "NtCreatePort": 158, "NtCreatePrivateNamespace": 159, "NtCreateProcess": 160, "NtCreateProfile": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisplayString": 183, "NtEnumerateBootEntries": 184, "NtEnumerateDriverEntries": 185, "NtEnumerateSystemEnvironmentValuesEx": 186, "NtEnumerateTransactionObject": 187, "NtExtendSection": 188, "NtFilterToken": 189, "NtFlushInstallUILanguage": 190, "NtFlushInstructionCache": 191, "NtFlushKey": 192, "NtFlushProcessWriteBuffers": 193, "NtFlushVirtualMemory": 194, "NtFlushWriteBuffer": 195, "NtFreeUserPhysicalPages": 196, "NtFreezeRegistry": 197, "NtFreezeTransactions": 198, "NtGetContextThread": 199, "NtGetCurrentProcessorNumber": 200, "NtGetDevicePowerState": 201, "NtGetMUIRegistryInfo": 202, "NtGetNextProcess": 203, "NtGetNextThread": 204, "NtGetNlsSectionPtr": 205, "NtGetNotificationResourceManager": 206, "NtGetPlugPlayEvent": 207, "NtGetWriteWatch": 208, "NtImpersonateAnonymousToken": 209, "NtImpersonateThread": 210, "NtInitializeNlsFiles": 211, "NtInitializeRegistry": 212, "NtInitiatePowerAction": 213, "NtIsSystemResumeAutomatic": 214, "NtIsUILanguageComitted": 215, "NtListenPort": 216, "NtLoadDriver": 217, "NtLoadKey": 218, "NtLoadKey2": 219, "NtLoadKeyEx": 220, "NtLockFile": 221, "NtLockProductActivationKeys": 222, "NtLockRegistryKey": 223, "NtLockVirtualMemory": 224, "NtMakePermanentObject": 225, "NtMakeTemporaryObject": 226, "NtMapCMFModule": 227, "NtMapUserPhysicalPages": 228, "NtModifyBootEntry": 229, "NtModifyDriverEntry": 230, "NtNotifyChangeDirectoryFile": 231, "NtNotifyChangeKey": 232, "NtNotifyChangeMultipleKeys": 233, "NtOpenEnlistment": 234, "NtOpenEventPair": 235, "NtOpenIoCompletion": 236, "NtOpenJobObject": 237, "NtOpenKeyTransacted": 238, "NtOpenKeyedEvent": 239, "NtOpenMutant": 240, "NtOpenObjectAuditAlarm": 241, "NtOpenPrivateNamespace": 242, "NtOpenProcessToken": 243, "NtOpenResourceManager": 244, "NtOpenSemaphore": 245, "NtOpenSession": 246, "NtOpenSymbolicLinkObject": 247, "NtOpenThread": 248, "NtOpenTimer": 249, "NtOpenTransaction": 250, "NtOpenTransactionManager": 251, "NtPlugPlayControl": 252, "NtPrePrepareComplete": 253, "NtPrePrepareEnlistment": 254, "NtPrepareComplete": 255, "NtPrepareEnlistment": 256, "NtPrivilegeCheck": 257, "NtPrivilegeObjectAuditAlarm": 258, "NtPrivilegedServiceAuditAlarm": 259, "NtPropagationComplete": 260, "NtPropagationFailed": 261, "NtPulseEvent": 262, "NtQueryBootEntryOrder": 263, "NtQueryBootOptions": 264, "NtQueryDebugFilterState": 265, "NtQueryDirectoryObject": 266, "NtQueryDriverEntryOrder": 267, "NtQueryEaFile": 268, "NtQueryFullAttributesFile": 269, "NtQueryInformationAtom": 270, "NtQueryInformationEnlistment": 271, "NtQueryInformationJobObject": 272, "NtQueryInformationPort": 273, "NtQueryInformationResourceManager": 274, "NtQueryInformationTransaction": 275, "NtQueryInformationTransactionManager": 276, "NtQueryInformationWorkerFactory": 277, "NtQueryInstallUILanguage": 278, "NtQueryIntervalProfile": 279, "NtQueryIoCompletion": 280, "NtQueryLicenseValue": 281, "NtQueryMultipleValueKey": 282, "NtQueryMutant": 283, "NtQueryOpenSubKeys": 284, "NtQueryOpenSubKeysEx": 285, "NtQueryPortInformationProcess": 286, "NtQueryQuotaInformationFile": 287, "NtQuerySecurityObject": 288, "NtQuerySemaphore": 289, "NtQuerySymbolicLinkObject": 290, "NtQuerySystemEnvironmentValue": 291, "NtQuerySystemEnvironmentValueEx": 292, "NtQueryTimerResolution": 293, "NtRaiseException": 294, "NtRaiseHardError": 295, "NtReadOnlyEnlistment": 296, "NtRecoverEnlistment": 297, "NtRecoverResourceManager": 298, "NtRecoverTransactionManager": 299, "NtRegisterProtocolAddressInformation": 300, "NtRegisterThreadTerminatePort": 301, "NtReleaseCMFViewOwnership": 302, "NtReleaseKeyedEvent": 303, "NtReleaseWorkerFactoryWorker": 304, "NtRemoveIoCompletionEx": 305, "NtRemoveProcessDebug": 306, "NtRenameKey": 307, "NtRenameTransactionManager": 308, "NtReplaceKey": 309, "NtReplacePartitionUnit": 310, "NtReplyWaitReplyPort": 311, "NtRequestDeviceWakeup": 312, "NtRequestPort": 313, "NtRequestWakeupLatency": 314, "NtResetEvent": 315, "NtResetWriteWatch": 316, "NtRestoreKey": 317, "NtResumeProcess": 318, "NtRollbackComplete": 319, "NtRollbackEnlistment": 320, "NtRollbackTransaction": 321, "NtRollforwardTransactionManager": 322, "NtSaveKey": 323, "NtSaveKeyEx": 324, "NtSaveMergedKeys": 325, "NtSecureConnectPort": 326, "NtSetBootEntryOrder": 327, "NtSetBootOptions": 328, "NtSetContextThread": 329, "NtSetDebugFilterState": 330, "NtSetDefaultHardErrorPort": 331, "NtSetDefaultLocale": 332, "NtSetDefaultUILanguage": 333, "NtSetDriverEntryOrder": 334, "NtSetEaFile": 335, "NtSetHighEventPair": 336, "NtSetHighWaitLowEventPair": 337, "NtSetInformationDebugObject": 338, "NtSetInformationEnlistment": 339, "NtSetInformationJobObject": 340, "NtSetInformationKey": 341, "NtSetInformationResourceManager": 342, "NtSetInformationToken": 343, "NtSetInformationTransaction": 344, "NtSetInformationTransactionManager": 345, "NtSetInformationWorkerFactory": 346, "NtSetIntervalProfile": 347, "NtSetIoCompletion": 348, "NtSetLdtEntries": 349, "NtSetLowEventPair": 350, "NtSetLowWaitHighEventPair": 351, "NtSetQuotaInformationFile": 352, "NtSetSecurityObject": 353, "NtSetSystemEnvironmentValue": 354, "NtSetSystemEnvironmentValueEx": 355, "NtSetSystemInformation": 356, "NtSetSystemPowerState": 357, "NtSetSystemTime": 358, "NtSetThreadExecutionState": 359, "NtSetTimerResolution": 360, "NtSetUuidSeed": 361, "NtSetVolumeInformationFile": 362, "NtShutdownSystem": 363, "NtShutdownWorkerFactory": 364, "NtSignalAndWaitForSingleObject": 365, "NtSinglePhaseReject": 366, "NtStartProfile": 367, "NtStopProfile": 368, "NtSuspendProcess": 369, "NtSuspendThread": 370, "NtSystemDebugControl": 371, "NtTerminateJobObject": 372, "NtTestAlert": 373, "NtThawRegistry": 374, "NtThawTransactions": 375, "NtTraceControl": 376, "NtTranslateFilePath": 377, "NtUnloadDriver": 378, "NtUnloadKey": 379, "NtUnloadKey2": 380, "NtUnloadKeyEx": 381, "NtUnlockFile": 382, "NtUnlockVirtualMemory": 383, "NtVdmControl": 384, "NtWaitForDebugEvent": 385, "NtWaitForKeyedEvent": 386, "NtWaitForWorkViaWorkerFactory": 387, "NtWaitHighEventPair": 388, "NtWaitLowEventPair": 389, "NtWorkerFactoryWorkerReady": 390}}, "Windows Server 2008": {"SP0": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAcquireCMFViewOwnership": 102, "NtAddBootEntry": 103, "NtAddDriverEntry": 104, "NtAdjustGroupsToken": 105, "NtAlertResumeThread": 106, "NtAlertThread": 107, "NtAllocateLocallyUniqueId": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtRequestDeviceWakeup": 134, "NtCancelIoFileEx": 135, "NtCancelSynchronousIoFile": 136, "NtCommitComplete": 137, "NtCommitEnlistment": 138, "NtCommitTransaction": 139, "NtCompactKeys": 140, "NtCompareTokens": 141, "NtCompleteConnectPort": 142, "NtCompressKey": 143, "NtConnectPort": 144, "NtCreateDebugObject": 145, "NtCreateDirectoryObject": 146, "NtCreateEnlistment": 147, "NtCreateEventPair": 148, "NtCreateIoCompletion": 149, "NtCreateJobObject": 150, "NtCreateJobSet": 151, "NtCreateKeyTransacted": 152, "NtCreateKeyedEvent": 153, "NtCreateMailslotFile": 154, "NtCreateMutant": 155, "NtCreateNamedPipeFile": 156, "NtCreatePagingFile": 157, "NtCreatePort": 158, "NtCreatePrivateNamespace": 159, "NtCreateProcess": 160, "NtCreateProfile": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisplayString": 183, "NtEnumerateBootEntries": 184, "NtEnumerateDriverEntries": 185, "NtEnumerateSystemEnvironmentValuesEx": 186, "NtEnumerateTransactionObject": 187, "NtExtendSection": 188, "NtFilterToken": 189, "NtFlushInstallUILanguage": 190, "NtFlushInstructionCache": 191, "NtFlushKey": 192, "NtFlushProcessWriteBuffers": 193, "NtFlushVirtualMemory": 194, "NtFlushWriteBuffer": 195, "NtFreeUserPhysicalPages": 196, "NtFreezeRegistry": 197, "NtFreezeTransactions": 198, "NtGetContextThread": 199, "NtGetCurrentProcessorNumber": 200, "NtGetDevicePowerState": 201, "NtGetMUIRegistryInfo": 202, "NtGetNextProcess": 203, "NtGetNextThread": 204, "NtGetNlsSectionPtr": 205, "NtGetNotificationResourceManager": 206, "NtGetPlugPlayEvent": 207, "NtGetWriteWatch": 208, "NtImpersonateAnonymousToken": 209, "NtImpersonateThread": 210, "NtInitializeNlsFiles": 211, "NtInitializeRegistry": 212, "NtInitiatePowerAction": 213, "NtIsSystemResumeAutomatic": 214, "NtIsUILanguageComitted": 215, "NtListenPort": 216, "NtLoadDriver": 217, "NtLoadKey": 218, "NtLoadKey2": 219, "NtLoadKeyEx": 220, "NtLockFile": 221, "NtLockProductActivationKeys": 222, "NtLockRegistryKey": 223, "NtLockVirtualMemory": 224, "NtMakePermanentObject": 225, "NtMakeTemporaryObject": 226, "NtMapCMFModule": 227, "NtMapUserPhysicalPages": 228, "NtModifyBootEntry": 229, "NtModifyDriverEntry": 230, "NtNotifyChangeDirectoryFile": 231, "NtNotifyChangeKey": 232, "NtNotifyChangeMultipleKeys": 233, "NtOpenEnlistment": 234, "NtOpenEventPair": 235, "NtOpenIoCompletion": 236, "NtOpenJobObject": 237, "NtOpenKeyTransacted": 238, "NtOpenKeyedEvent": 239, "NtOpenMutant": 240, "NtOpenObjectAuditAlarm": 241, "NtOpenPrivateNamespace": 242, "NtOpenProcessToken": 243, "NtOpenResourceManager": 244, "NtOpenSemaphore": 245, "NtOpenSession": 246, "NtOpenSymbolicLinkObject": 247, "NtOpenThread": 248, "NtOpenTimer": 249, "NtOpenTransaction": 250, "NtOpenTransactionManager": 251, "NtPlugPlayControl": 252, "NtPrePrepareComplete": 253, "NtPrePrepareEnlistment": 254, "NtPrepareComplete": 255, "NtPrepareEnlistment": 256, "NtPrivilegeCheck": 257, "NtPrivilegeObjectAuditAlarm": 258, "NtPrivilegedServiceAuditAlarm": 259, "NtPropagationComplete": 260, "NtPropagationFailed": 261, "NtPulseEvent": 262, "NtQueryBootEntryOrder": 263, "NtQueryBootOptions": 264, "NtQueryDebugFilterState": 265, "NtQueryDirectoryObject": 266, "NtQueryDriverEntryOrder": 267, "NtQueryEaFile": 268, "NtQueryFullAttributesFile": 269, "NtQueryInformationAtom": 270, "NtQueryInformationEnlistment": 271, "NtQueryInformationJobObject": 272, "NtQueryInformationPort": 273, "NtQueryInformationResourceManager": 274, "NtQueryInformationTransaction": 275, "NtQueryInformationTransactionManager": 276, "NtQueryInformationWorkerFactory": 277, "NtQueryInstallUILanguage": 278, "NtQueryIntervalProfile": 279, "NtQueryIoCompletion": 280, "NtQueryLicenseValue": 281, "NtQueryMultipleValueKey": 282, "NtQueryMutant": 283, "NtQueryOpenSubKeys": 284, "NtQueryOpenSubKeysEx": 285, "NtQueryPortInformationProcess": 286, "NtQueryQuotaInformationFile": 287, "NtQuerySecurityObject": 288, "NtQuerySemaphore": 289, "NtQuerySymbolicLinkObject": 290, "NtQuerySystemEnvironmentValue": 291, "NtQuerySystemEnvironmentValueEx": 292, "NtQueryTimerResolution": 293, "NtRaiseException": 294, "NtRaiseHardError": 295, "NtReadOnlyEnlistment": 296, "NtRecoverEnlistment": 297, "NtRecoverResourceManager": 298, "NtRecoverTransactionManager": 299, "NtRegisterProtocolAddressInformation": 300, "NtRegisterThreadTerminatePort": 301, "NtReleaseCMFViewOwnership": 302, "NtReleaseKeyedEvent": 303, "NtReleaseWorkerFactoryWorker": 304, "NtRemoveIoCompletionEx": 305, "NtRemoveProcessDebug": 306, "NtRenameKey": 307, "NtRenameTransactionManager": 308, "NtReplaceKey": 309, "NtReplacePartitionUnit": 310, "NtReplyWaitReplyPort": 311, "NtCancelDeviceWakeupRequest": 312, "NtRequestPort": 313, "NtRequestWakeupLatency": 314, "NtResetEvent": 315, "NtResetWriteWatch": 316, "NtRestoreKey": 317, "NtResumeProcess": 318, "NtRollbackComplete": 319, "NtRollbackEnlistment": 320, "NtRollbackTransaction": 321, "NtRollforwardTransactionManager": 322, "NtSaveKey": 323, "NtSaveKeyEx": 324, "NtSaveMergedKeys": 325, "NtSecureConnectPort": 326, "NtSetBootEntryOrder": 327, "NtSetBootOptions": 328, "NtSetContextThread": 329, "NtSetDebugFilterState": 330, "NtSetDefaultHardErrorPort": 331, "NtSetDefaultLocale": 332, "NtSetDefaultUILanguage": 333, "NtSetDriverEntryOrder": 334, "NtSetEaFile": 335, "NtSetHighEventPair": 336, "NtSetHighWaitLowEventPair": 337, "NtSetInformationDebugObject": 338, "NtSetInformationEnlistment": 339, "NtSetInformationJobObject": 340, "NtSetInformationKey": 341, "NtSetInformationResourceManager": 342, "NtSetInformationToken": 343, "NtSetInformationTransaction": 344, "NtSetInformationTransactionManager": 345, "NtSetInformationWorkerFactory": 346, "NtSetIntervalProfile": 347, "NtSetIoCompletion": 348, "NtSetLdtEntries": 349, "NtSetLowEventPair": 350, "NtSetLowWaitHighEventPair": 351, "NtSetQuotaInformationFile": 352, "NtSetSecurityObject": 353, "NtSetSystemEnvironmentValue": 354, "NtSetSystemEnvironmentValueEx": 355, "NtSetSystemInformation": 356, "NtSetSystemPowerState": 357, "NtSetSystemTime": 358, "NtSetThreadExecutionState": 359, "NtSetTimerResolution": 360, "NtSetUuidSeed": 361, "NtSetVolumeInformationFile": 362, "NtShutdownSystem": 363, "NtShutdownWorkerFactory": 364, "NtSignalAndWaitForSingleObject": 365, "NtSinglePhaseReject": 366, "NtStartProfile": 367, "NtStopProfile": 368, "NtSuspendProcess": 369, "NtSuspendThread": 370, "NtSystemDebugControl": 371, "NtTerminateJobObject": 372, "NtTestAlert": 373, "NtThawRegistry": 374, "NtThawTransactions": 375, "NtTraceControl": 376, "NtTranslateFilePath": 377, "NtUnloadDriver": 378, "NtUnloadKey": 379, "NtUnloadKey2": 380, "NtUnloadKeyEx": 381, "NtUnlockFile": 382, "NtUnlockVirtualMemory": 383, "NtVdmControl": 384, "NtWaitForDebugEvent": 385, "NtWaitForKeyedEvent": 386, "NtWaitForWorkViaWorkerFactory": 387, "NtWaitHighEventPair": 388, "NtWaitLowEventPair": 389, "NtWorkerFactoryWorkerReady": 390}, "SP2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAcquireCMFViewOwnership": 102, "NtAddBootEntry": 103, "NtAddDriverEntry": 104, "NtAdjustGroupsToken": 105, "NtAlertResumeThread": 106, "NtAlertThread": 107, "NtAllocateLocallyUniqueId": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelDeviceWakeupRequest": 134, "NtCancelIoFileEx": 135, "NtCancelSynchronousIoFile": 136, "NtCommitComplete": 137, "NtCommitEnlistment": 138, "NtCommitTransaction": 139, "NtCompactKeys": 140, "NtCompareTokens": 141, "NtCompleteConnectPort": 142, "NtCompressKey": 143, "NtConnectPort": 144, "NtCreateDebugObject": 145, "NtCreateDirectoryObject": 146, "NtCreateEnlistment": 147, "NtCreateEventPair": 148, "NtCreateIoCompletion": 149, "NtCreateJobObject": 150, "NtCreateJobSet": 151, "NtCreateKeyTransacted": 152, "NtCreateKeyedEvent": 153, "NtCreateMailslotFile": 154, "NtCreateMutant": 155, "NtCreateNamedPipeFile": 156, "NtCreatePagingFile": 157, "NtCreatePort": 158, "NtCreatePrivateNamespace": 159, "NtCreateProcess": 160, "NtCreateProfile": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisplayString": 183, "NtEnumerateBootEntries": 184, "NtEnumerateDriverEntries": 185, "NtEnumerateSystemEnvironmentValuesEx": 186, "NtEnumerateTransactionObject": 187, "NtExtendSection": 188, "NtFilterToken": 189, "NtFlushInstallUILanguage": 190, "NtFlushInstructionCache": 191, "NtFlushKey": 192, "NtFlushProcessWriteBuffers": 193, "NtFlushVirtualMemory": 194, "NtFlushWriteBuffer": 195, "NtFreeUserPhysicalPages": 196, "NtFreezeRegistry": 197, "NtFreezeTransactions": 198, "NtGetContextThread": 199, "NtGetCurrentProcessorNumber": 200, "NtGetDevicePowerState": 201, "NtGetMUIRegistryInfo": 202, "NtGetNextProcess": 203, "NtGetNextThread": 204, "NtGetNlsSectionPtr": 205, "NtGetNotificationResourceManager": 206, "NtGetPlugPlayEvent": 207, "NtGetWriteWatch": 208, "NtImpersonateAnonymousToken": 209, "NtImpersonateThread": 210, "NtInitializeNlsFiles": 211, "NtInitializeRegistry": 212, "NtInitiatePowerAction": 213, "NtIsSystemResumeAutomatic": 214, "NtIsUILanguageComitted": 215, "NtListenPort": 216, "NtLoadDriver": 217, "NtLoadKey": 218, "NtLoadKey2": 219, "NtLoadKeyEx": 220, "NtLockFile": 221, "NtLockProductActivationKeys": 222, "NtLockRegistryKey": 223, "NtLockVirtualMemory": 224, "NtMakePermanentObject": 225, "NtMakeTemporaryObject": 226, "NtMapCMFModule": 227, "NtMapUserPhysicalPages": 228, "NtModifyBootEntry": 229, "NtModifyDriverEntry": 230, "NtNotifyChangeDirectoryFile": 231, "NtNotifyChangeKey": 232, "NtNotifyChangeMultipleKeys": 233, "NtOpenEnlistment": 234, "NtOpenEventPair": 235, "NtOpenIoCompletion": 236, "NtOpenJobObject": 237, "NtOpenKeyTransacted": 238, "NtOpenKeyedEvent": 239, "NtOpenMutant": 240, "NtOpenObjectAuditAlarm": 241, "NtOpenPrivateNamespace": 242, "NtOpenProcessToken": 243, "NtOpenResourceManager": 244, "NtOpenSemaphore": 245, "NtOpenSession": 246, "NtOpenSymbolicLinkObject": 247, "NtOpenThread": 248, "NtOpenTimer": 249, "NtOpenTransaction": 250, "NtOpenTransactionManager": 251, "NtPlugPlayControl": 252, "NtPrePrepareComplete": 253, "NtPrePrepareEnlistment": 254, "NtPrepareComplete": 255, "NtPrepareEnlistment": 256, "NtPrivilegeCheck": 257, "NtPrivilegeObjectAuditAlarm": 258, "NtPrivilegedServiceAuditAlarm": 259, "NtPropagationComplete": 260, "NtPropagationFailed": 261, "NtPulseEvent": 262, "NtQueryBootEntryOrder": 263, "NtQueryBootOptions": 264, "NtQueryDebugFilterState": 265, "NtQueryDirectoryObject": 266, "NtQueryDriverEntryOrder": 267, "NtQueryEaFile": 268, "NtQueryFullAttributesFile": 269, "NtQueryInformationAtom": 270, "NtQueryInformationEnlistment": 271, "NtQueryInformationJobObject": 272, "NtQueryInformationPort": 273, "NtQueryInformationResourceManager": 274, "NtQueryInformationTransaction": 275, "NtQueryInformationTransactionManager": 276, "NtQueryInformationWorkerFactory": 277, "NtQueryInstallUILanguage": 278, "NtQueryIntervalProfile": 279, "NtQueryIoCompletion": 280, "NtQueryLicenseValue": 281, "NtQueryMultipleValueKey": 282, "NtQueryMutant": 283, "NtQueryOpenSubKeys": 284, "NtQueryOpenSubKeysEx": 285, "NtQueryPortInformationProcess": 286, "NtQueryQuotaInformationFile": 287, "NtQuerySecurityObject": 288, "NtQuerySemaphore": 289, "NtQuerySymbolicLinkObject": 290, "NtQuerySystemEnvironmentValue": 291, "NtQuerySystemEnvironmentValueEx": 292, "NtQueryTimerResolution": 293, "NtRaiseException": 294, "NtRaiseHardError": 295, "NtReadOnlyEnlistment": 296, "NtRecoverEnlistment": 297, "NtRecoverResourceManager": 298, "NtRecoverTransactionManager": 299, "NtRegisterProtocolAddressInformation": 300, "NtRegisterThreadTerminatePort": 301, "NtReleaseCMFViewOwnership": 302, "NtReleaseKeyedEvent": 303, "NtReleaseWorkerFactoryWorker": 304, "NtRemoveIoCompletionEx": 305, "NtRemoveProcessDebug": 306, "NtRenameKey": 307, "NtRenameTransactionManager": 308, "NtReplaceKey": 309, "NtReplacePartitionUnit": 310, "NtReplyWaitReplyPort": 311, "NtRequestDeviceWakeup": 312, "NtRequestPort": 313, "NtRequestWakeupLatency": 314, "NtResetEvent": 315, "NtResetWriteWatch": 316, "NtRestoreKey": 317, "NtResumeProcess": 318, "NtRollbackComplete": 319, "NtRollbackEnlistment": 320, "NtRollbackTransaction": 321, "NtRollforwardTransactionManager": 322, "NtSaveKey": 323, "NtSaveKeyEx": 324, "NtSaveMergedKeys": 325, "NtSecureConnectPort": 326, "NtSetBootEntryOrder": 327, "NtSetBootOptions": 328, "NtSetContextThread": 329, "NtSetDebugFilterState": 330, "NtSetDefaultHardErrorPort": 331, "NtSetDefaultLocale": 332, "NtSetDefaultUILanguage": 333, "NtSetDriverEntryOrder": 334, "NtSetEaFile": 335, "NtSetHighEventPair": 336, "NtSetHighWaitLowEventPair": 337, "NtSetInformationDebugObject": 338, "NtSetInformationEnlistment": 339, "NtSetInformationJobObject": 340, "NtSetInformationKey": 341, "NtSetInformationResourceManager": 342, "NtSetInformationToken": 343, "NtSetInformationTransaction": 344, "NtSetInformationTransactionManager": 345, "NtSetInformationWorkerFactory": 346, "NtSetIntervalProfile": 347, "NtSetIoCompletion": 348, "NtSetLdtEntries": 349, "NtSetLowEventPair": 350, "NtSetLowWaitHighEventPair": 351, "NtSetQuotaInformationFile": 352, "NtSetSecurityObject": 353, "NtSetSystemEnvironmentValue": 354, "NtSetSystemEnvironmentValueEx": 355, "NtSetSystemInformation": 356, "NtSetSystemPowerState": 357, "NtSetSystemTime": 358, "NtSetThreadExecutionState": 359, "NtSetTimerResolution": 360, "NtSetUuidSeed": 361, "NtSetVolumeInformationFile": 362, "NtShutdownSystem": 363, "NtShutdownWorkerFactory": 364, "NtSignalAndWaitForSingleObject": 365, "NtSinglePhaseReject": 366, "NtStartProfile": 367, "NtStopProfile": 368, "NtSuspendProcess": 369, "NtSuspendThread": 370, "NtSystemDebugControl": 371, "NtTerminateJobObject": 372, "NtTestAlert": 373, "NtThawRegistry": 374, "NtThawTransactions": 375, "NtTraceControl": 376, "NtTranslateFilePath": 377, "NtUnloadDriver": 378, "NtUnloadKey": 379, "NtUnloadKey2": 380, "NtUnloadKeyEx": 381, "NtUnlockFile": 382, "NtUnlockVirtualMemory": 383, "NtVdmControl": 384, "NtWaitForDebugEvent": 385, "NtWaitForKeyedEvent": 386, "NtWaitForWorkViaWorkerFactory": 387, "NtWaitHighEventPair": 388, "NtWaitLowEventPair": 389, "NtWorkerFactoryWorkerReady": 390}, "R2": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateReserveObject": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelIoFileEx": 134, "NtCancelSynchronousIoFile": 135, "NtCommitComplete": 136, "NtCommitEnlistment": 137, "NtCommitTransaction": 138, "NtCompactKeys": 139, "NtCompareTokens": 140, "NtCompleteConnectPort": 141, "NtCompressKey": 142, "NtConnectPort": 143, "NtCreateDebugObject": 144, "NtCreateDirectoryObject": 145, "NtCreateEnlistment": 146, "NtCreateEventPair": 147, "NtCreateIoCompletion": 148, "NtCreateJobObject": 149, "NtCreateJobSet": 150, "NtCreateKeyTransacted": 151, "NtCreateKeyedEvent": 152, "NtCreateMailslotFile": 153, "NtCreateMutant": 154, "NtCreateNamedPipeFile": 155, "NtCreatePagingFile": 156, "NtCreatePort": 157, "NtCreatePrivateNamespace": 158, "NtCreateProcess": 159, "NtCreateProfile": 160, "NtCreateProfileEx": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisableLastKnownGood": 183, "NtDisplayString": 184, "NtDrawText": 185, "NtEnableLastKnownGood": 186, "NtEnumerateBootEntries": 187, "NtEnumerateDriverEntries": 188, "NtEnumerateSystemEnvironmentValuesEx": 189, "NtEnumerateTransactionObject": 190, "NtExtendSection": 191, "NtFilterToken": 192, "NtFlushInstallUILanguage": 193, "NtFlushInstructionCache": 194, "NtFlushKey": 195, "NtFlushProcessWriteBuffers": 196, "NtFlushVirtualMemory": 197, "NtFlushWriteBuffer": 198, "NtFreeUserPhysicalPages": 199, "NtFreezeRegistry": 200, "NtFreezeTransactions": 201, "NtGetContextThread": 202, "NtGetCurrentProcessorNumber": 203, "NtGetDevicePowerState": 204, "NtGetMUIRegistryInfo": 205, "NtGetNextProcess": 206, "NtGetNextThread": 207, "NtGetNlsSectionPtr": 208, "NtGetNotificationResourceManager": 209, "NtGetPlugPlayEvent": 210, "NtGetWriteWatch": 211, "NtImpersonateAnonymousToken": 212, "NtImpersonateThread": 213, "NtInitializeNlsFiles": 214, "NtInitializeRegistry": 215, "NtInitiatePowerAction": 216, "NtIsSystemResumeAutomatic": 217, "NtIsUILanguageComitted": 218, "NtListenPort": 219, "NtLoadDriver": 220, "NtLoadKey": 221, "NtLoadKey2": 222, "NtLoadKeyEx": 223, "NtLockFile": 224, "NtLockProductActivationKeys": 225, "NtLockRegistryKey": 226, "NtLockVirtualMemory": 227, "NtMakePermanentObject": 228, "NtMakeTemporaryObject": 229, "NtMapCMFModule": 230, "NtMapUserPhysicalPages": 231, "NtModifyBootEntry": 232, "NtModifyDriverEntry": 233, "NtNotifyChangeDirectoryFile": 234, "NtNotifyChangeKey": 235, "NtNotifyChangeMultipleKeys": 236, "NtNotifyChangeSession": 237, "NtOpenEnlistment": 238, "NtOpenEventPair": 239, "NtOpenIoCompletion": 240, "NtOpenJobObject": 241, "NtOpenKeyEx": 242, "NtOpenKeyTransacted": 243, "NtOpenKeyTransactedEx": 244, "NtOpenKeyedEvent": 245, "NtOpenMutant": 246, "NtOpenObjectAuditAlarm": 247, "NtOpenPrivateNamespace": 248, "NtOpenProcessToken": 249, "NtOpenResourceManager": 250, "NtOpenSemaphore": 251, "NtOpenSession": 252, "NtOpenSymbolicLinkObject": 253, "NtOpenThread": 254, "NtOpenTimer": 255, "NtOpenTransaction": 256, "NtOpenTransactionManager": 257, "NtPlugPlayControl": 258, "NtPrePrepareComplete": 259, "NtPrePrepareEnlistment": 260, "NtPrepareComplete": 261, "NtPrepareEnlistment": 262, "NtPrivilegeCheck": 263, "NtPrivilegeObjectAuditAlarm": 264, "NtPrivilegedServiceAuditAlarm": 265, "NtPropagationComplete": 266, "NtPropagationFailed": 267, "NtPulseEvent": 268, "NtQueryBootEntryOrder": 269, "NtQueryBootOptions": 270, "NtQueryDebugFilterState": 271, "NtQueryDirectoryObject": 272, "NtQueryDriverEntryOrder": 273, "NtQueryEaFile": 274, "NtQueryFullAttributesFile": 275, "NtQueryInformationAtom": 276, "NtQueryInformationEnlistment": 277, "NtQueryInformationJobObject": 278, "NtQueryInformationPort": 279, "NtQueryInformationResourceManager": 280, "NtQueryInformationTransaction": 281, "NtQueryInformationTransactionManager": 282, "NtQueryInformationWorkerFactory": 283, "NtQueryInstallUILanguage": 284, "NtQueryIntervalProfile": 285, "NtQueryIoCompletion": 286, "NtQueryLicenseValue": 287, "NtQueryMultipleValueKey": 288, "NtQueryMutant": 289, "NtQueryOpenSubKeys": 290, "NtQueryOpenSubKeysEx": 291, "NtQueryPortInformationProcess": 292, "NtQueryQuotaInformationFile": 293, "NtQuerySecurityAttributesToken": 294, "NtQuerySecurityObject": 295, "NtQuerySemaphore": 296, "NtQuerySymbolicLinkObject": 297, "NtQuerySystemEnvironmentValue": 298, "NtQuerySystemEnvironmentValueEx": 299, "NtQuerySystemInformationEx": 300, "NtQueryTimerResolution": 301, "NtQueueApcThreadEx": 302, "NtRaiseException": 303, "NtRaiseHardError": 304, "NtReadOnlyEnlistment": 305, "NtRecoverEnlistment": 306, "NtRecoverResourceManager": 307, "NtRecoverTransactionManager": 308, "NtRegisterProtocolAddressInformation": 309, "NtRegisterThreadTerminatePort": 310, "NtReleaseKeyedEvent": 311, "NtReleaseWorkerFactoryWorker": 312, "NtRemoveIoCompletionEx": 313, "NtRemoveProcessDebug": 314, "NtRenameKey": 315, "NtRenameTransactionManager": 316, "NtReplaceKey": 317, "NtReplacePartitionUnit": 318, "NtReplyWaitReplyPort": 319, "NtRequestPort": 320, "NtResetEvent": 321, "NtResetWriteWatch": 322, "NtRestoreKey": 323, "NtResumeProcess": 324, "NtRollbackComplete": 325, "NtRollbackEnlistment": 326, "NtRollbackTransaction": 327, "NtRollforwardTransactionManager": 328, "NtSaveKey": 329, "NtSaveKeyEx": 330, "NtSaveMergedKeys": 331, "NtSecureConnectPort": 332, "NtSerializeBoot": 333, "NtSetBootEntryOrder": 334, "NtSetBootOptions": 335, "NtSetContextThread": 336, "NtSetDebugFilterState": 337, "NtSetDefaultHardErrorPort": 338, "NtSetDefaultLocale": 339, "NtSetDefaultUILanguage": 340, "NtSetDriverEntryOrder": 341, "NtSetEaFile": 342, "NtSetHighEventPair": 343, "NtSetHighWaitLowEventPair": 344, "NtSetInformationDebugObject": 345, "NtSetInformationEnlistment": 346, "NtSetInformationJobObject": 347, "NtSetInformationKey": 348, "NtSetInformationResourceManager": 349, "NtSetInformationToken": 350, "NtSetInformationTransaction": 351, "NtSetInformationTransactionManager": 352, "NtSetInformationWorkerFactory": 353, "NtSetIntervalProfile": 354, "NtSetIoCompletion": 355, "NtSetIoCompletionEx": 356, "NtSetLdtEntries": 357, "NtSetLowEventPair": 358, "NtSetLowWaitHighEventPair": 359, "NtSetQuotaInformationFile": 360, "NtSetSecurityObject": 361, "NtSetSystemEnvironmentValue": 362, "NtSetSystemEnvironmentValueEx": 363, "NtSetSystemInformation": 364, "NtSetSystemPowerState": 365, "NtSetSystemTime": 366, "NtSetThreadExecutionState": 367, "NtSetTimerEx": 368, "NtSetTimerResolution": 369, "NtSetUuidSeed": 370, "NtSetVolumeInformationFile": 371, "NtShutdownSystem": 372, "NtShutdownWorkerFactory": 373, "NtSignalAndWaitForSingleObject": 374, "NtSinglePhaseReject": 375, "NtStartProfile": 376, "NtStopProfile": 377, "NtSuspendProcess": 378, "NtSuspendThread": 379, "NtSystemDebugControl": 380, "NtTerminateJobObject": 381, "NtTestAlert": 382, "NtThawRegistry": 383, "NtThawTransactions": 384, "NtTraceControl": 385, "NtTranslateFilePath": 386, "NtUmsThreadYield": 387, "NtUnloadDriver": 388, "NtUnloadKey": 389, "NtUnloadKey2": 390, "NtUnloadKeyEx": 391, "NtUnlockFile": 392, "NtUnlockVirtualMemory": 393, "NtVdmControl": 394, "NtWaitForDebugEvent": 395, "NtWaitForKeyedEvent": 396, "NtWaitForWorkViaWorkerFactory": 397, "NtWaitHighEventPair": 398, "NtWaitLowEventPair": 399, "NtWorkerFactoryWorkerReady": 400}, "R2 SP1": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateReserveObject": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelIoFileEx": 134, "NtCancelSynchronousIoFile": 135, "NtCommitComplete": 136, "NtCommitEnlistment": 137, "NtCommitTransaction": 138, "NtCompactKeys": 139, "NtCompareTokens": 140, "NtCompleteConnectPort": 141, "NtCompressKey": 142, "NtConnectPort": 143, "NtCreateDebugObject": 144, "NtCreateDirectoryObject": 145, "NtCreateEnlistment": 146, "NtCreateEventPair": 147, "NtCreateIoCompletion": 148, "NtCreateJobObject": 149, "NtCreateJobSet": 150, "NtCreateKeyTransacted": 151, "NtCreateKeyedEvent": 152, "NtCreateMailslotFile": 153, "NtCreateMutant": 154, "NtCreateNamedPipeFile": 155, "NtCreatePagingFile": 156, "NtCreatePort": 157, "NtCreatePrivateNamespace": 158, "NtCreateProcess": 159, "NtCreateProfile": 160, "NtCreateProfileEx": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisableLastKnownGood": 183, "NtDisplayString": 184, "NtDrawText": 185, "NtEnableLastKnownGood": 186, "NtEnumerateBootEntries": 187, "NtEnumerateDriverEntries": 188, "NtEnumerateSystemEnvironmentValuesEx": 189, "NtEnumerateTransactionObject": 190, "NtExtendSection": 191, "NtFilterToken": 192, "NtFlushInstallUILanguage": 193, "NtFlushInstructionCache": 194, "NtFlushKey": 195, "NtFlushProcessWriteBuffers": 196, "NtFlushVirtualMemory": 197, "NtFlushWriteBuffer": 198, "NtFreeUserPhysicalPages": 199, "NtFreezeRegistry": 200, "NtFreezeTransactions": 201, "NtGetContextThread": 202, "NtGetCurrentProcessorNumber": 203, "NtGetDevicePowerState": 204, "NtGetMUIRegistryInfo": 205, "NtGetNextProcess": 206, "NtGetNextThread": 207, "NtGetNlsSectionPtr": 208, "NtGetNotificationResourceManager": 209, "NtGetPlugPlayEvent": 210, "NtGetWriteWatch": 211, "NtImpersonateAnonymousToken": 212, "NtImpersonateThread": 213, "NtInitializeNlsFiles": 214, "NtInitializeRegistry": 215, "NtInitiatePowerAction": 216, "NtIsSystemResumeAutomatic": 217, "NtIsUILanguageComitted": 218, "NtListenPort": 219, "NtLoadDriver": 220, "NtLoadKey": 221, "NtLoadKey2": 222, "NtLoadKeyEx": 223, "NtLockFile": 224, "NtLockProductActivationKeys": 225, "NtLockRegistryKey": 226, "NtLockVirtualMemory": 227, "NtMakePermanentObject": 228, "NtMakeTemporaryObject": 229, "NtMapCMFModule": 230, "NtMapUserPhysicalPages": 231, "NtModifyBootEntry": 232, "NtModifyDriverEntry": 233, "NtNotifyChangeDirectoryFile": 234, "NtNotifyChangeKey": 235, "NtNotifyChangeMultipleKeys": 236, "NtNotifyChangeSession": 237, "NtOpenEnlistment": 238, "NtOpenEventPair": 239, "NtOpenIoCompletion": 240, "NtOpenJobObject": 241, "NtOpenKeyEx": 242, "NtOpenKeyTransacted": 243, "NtOpenKeyTransactedEx": 244, "NtOpenKeyedEvent": 245, "NtOpenMutant": 246, "NtOpenObjectAuditAlarm": 247, "NtOpenPrivateNamespace": 248, "NtOpenProcessToken": 249, "NtOpenResourceManager": 250, "NtOpenSemaphore": 251, "NtOpenSession": 252, "NtOpenSymbolicLinkObject": 253, "NtOpenThread": 254, "NtOpenTimer": 255, "NtOpenTransaction": 256, "NtOpenTransactionManager": 257, "NtPlugPlayControl": 258, "NtPrePrepareComplete": 259, "NtPrePrepareEnlistment": 260, "NtPrepareComplete": 261, "NtPrepareEnlistment": 262, "NtPrivilegeCheck": 263, "NtPrivilegeObjectAuditAlarm": 264, "NtPrivilegedServiceAuditAlarm": 265, "NtPropagationComplete": 266, "NtPropagationFailed": 267, "NtPulseEvent": 268, "NtQueryBootEntryOrder": 269, "NtQueryBootOptions": 270, "NtQueryDebugFilterState": 271, "NtQueryDirectoryObject": 272, "NtQueryDriverEntryOrder": 273, "NtQueryEaFile": 274, "NtQueryFullAttributesFile": 275, "NtQueryInformationAtom": 276, "NtQueryInformationEnlistment": 277, "NtQueryInformationJobObject": 278, "NtQueryInformationPort": 279, "NtQueryInformationResourceManager": 280, "NtQueryInformationTransaction": 281, "NtQueryInformationTransactionManager": 282, "NtQueryInformationWorkerFactory": 283, "NtQueryInstallUILanguage": 284, "NtQueryIntervalProfile": 285, "NtQueryIoCompletion": 286, "NtQueryLicenseValue": 287, "NtQueryMultipleValueKey": 288, "NtQueryMutant": 289, "NtQueryOpenSubKeys": 290, "NtQueryOpenSubKeysEx": 291, "NtQueryPortInformationProcess": 292, "NtQueryQuotaInformationFile": 293, "NtQuerySecurityAttributesToken": 294, "NtQuerySecurityObject": 295, "NtQuerySemaphore": 296, "NtQuerySymbolicLinkObject": 297, "NtQuerySystemEnvironmentValue": 298, "NtQuerySystemEnvironmentValueEx": 299, "NtQuerySystemInformationEx": 300, "NtQueryTimerResolution": 301, "NtQueueApcThreadEx": 302, "NtRaiseException": 303, "NtRaiseHardError": 304, "NtReadOnlyEnlistment": 305, "NtRecoverEnlistment": 306, "NtRecoverResourceManager": 307, "NtRecoverTransactionManager": 308, "NtRegisterProtocolAddressInformation": 309, "NtRegisterThreadTerminatePort": 310, "NtReleaseKeyedEvent": 311, "NtReleaseWorkerFactoryWorker": 312, "NtRemoveIoCompletionEx": 313, "NtRemoveProcessDebug": 314, "NtRenameKey": 315, "NtRenameTransactionManager": 316, "NtReplaceKey": 317, "NtReplacePartitionUnit": 318, "NtReplyWaitReplyPort": 319, "NtRequestPort": 320, "NtResetEvent": 321, "NtResetWriteWatch": 322, "NtRestoreKey": 323, "NtResumeProcess": 324, "NtRollbackComplete": 325, "NtRollbackEnlistment": 326, "NtRollbackTransaction": 327, "NtRollforwardTransactionManager": 328, "NtSaveKey": 329, "NtSaveKeyEx": 330, "NtSaveMergedKeys": 331, "NtSecureConnectPort": 332, "NtSerializeBoot": 333, "NtSetBootEntryOrder": 334, "NtSetBootOptions": 335, "NtSetContextThread": 336, "NtSetDebugFilterState": 337, "NtSetDefaultHardErrorPort": 338, "NtSetDefaultLocale": 339, "NtSetDefaultUILanguage": 340, "NtSetDriverEntryOrder": 341, "NtSetEaFile": 342, "NtSetHighEventPair": 343, "NtSetHighWaitLowEventPair": 344, "NtSetInformationDebugObject": 345, "NtSetInformationEnlistment": 346, "NtSetInformationJobObject": 347, "NtSetInformationKey": 348, "NtSetInformationResourceManager": 349, "NtSetInformationToken": 350, "NtSetInformationTransaction": 351, "NtSetInformationTransactionManager": 352, "NtSetInformationWorkerFactory": 353, "NtSetIntervalProfile": 354, "NtSetIoCompletion": 355, "NtSetIoCompletionEx": 356, "NtSetLdtEntries": 357, "NtSetLowEventPair": 358, "NtSetLowWaitHighEventPair": 359, "NtSetQuotaInformationFile": 360, "NtSetSecurityObject": 361, "NtSetSystemEnvironmentValue": 362, "NtSetSystemEnvironmentValueEx": 363, "NtSetSystemInformation": 364, "NtSetSystemPowerState": 365, "NtSetSystemTime": 366, "NtSetThreadExecutionState": 367, "NtSetTimerEx": 368, "NtSetTimerResolution": 369, "NtSetUuidSeed": 370, "NtSetVolumeInformationFile": 371, "NtShutdownSystem": 372, "NtShutdownWorkerFactory": 373, "NtSignalAndWaitForSingleObject": 374, "NtSinglePhaseReject": 375, "NtStartProfile": 376, "NtStopProfile": 377, "NtSuspendProcess": 378, "NtSuspendThread": 379, "NtSystemDebugControl": 380, "NtTerminateJobObject": 381, "NtTestAlert": 382, "NtThawRegistry": 383, "NtThawTransactions": 384, "NtTraceControl": 385, "NtTranslateFilePath": 386, "NtUmsThreadYield": 387, "NtUnloadDriver": 388, "NtUnloadKey": 389, "NtUnloadKey2": 390, "NtUnloadKeyEx": 391, "NtUnlockFile": 392, "NtUnlockVirtualMemory": 393, "NtVdmControl": 394, "NtWaitForDebugEvent": 395, "NtWaitForKeyedEvent": 396, "NtWaitForWorkViaWorkerFactory": 397, "NtWaitHighEventPair": 398, "NtWaitLowEventPair": 399, "NtWorkerFactoryWorkerReady": 400}}, "Windows 7": {"SP0": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateReserveObject": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelIoFileEx": 134, "NtCancelSynchronousIoFile": 135, "NtCommitComplete": 136, "NtCommitEnlistment": 137, "NtCommitTransaction": 138, "NtCompactKeys": 139, "NtCompareTokens": 140, "NtCompleteConnectPort": 141, "NtCompressKey": 142, "NtConnectPort": 143, "NtCreateDebugObject": 144, "NtCreateDirectoryObject": 145, "NtCreateEnlistment": 146, "NtCreateEventPair": 147, "NtCreateIoCompletion": 148, "NtCreateJobObject": 149, "NtCreateJobSet": 150, "NtCreateKeyTransacted": 151, "NtCreateKeyedEvent": 152, "NtCreateMailslotFile": 153, "NtCreateMutant": 154, "NtCreateNamedPipeFile": 155, "NtCreatePagingFile": 156, "NtCreatePort": 157, "NtCreatePrivateNamespace": 158, "NtCreateProcess": 159, "NtCreateProfile": 160, "NtCreateProfileEx": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisableLastKnownGood": 183, "NtDisplayString": 184, "NtDrawText": 185, "NtEnableLastKnownGood": 186, "NtEnumerateBootEntries": 187, "NtEnumerateDriverEntries": 188, "NtEnumerateSystemEnvironmentValuesEx": 189, "NtEnumerateTransactionObject": 190, "NtExtendSection": 191, "NtFilterToken": 192, "NtFlushInstallUILanguage": 193, "NtFlushInstructionCache": 194, "NtFlushKey": 195, "NtFlushProcessWriteBuffers": 196, "NtFlushVirtualMemory": 197, "NtFlushWriteBuffer": 198, "NtFreeUserPhysicalPages": 199, "NtFreezeRegistry": 200, "NtFreezeTransactions": 201, "NtGetContextThread": 202, "NtGetCurrentProcessorNumber": 203, "NtGetDevicePowerState": 204, "NtGetMUIRegistryInfo": 205, "NtGetNextProcess": 206, "NtGetNextThread": 207, "NtGetNlsSectionPtr": 208, "NtGetNotificationResourceManager": 209, "NtGetPlugPlayEvent": 210, "NtGetWriteWatch": 211, "NtImpersonateAnonymousToken": 212, "NtImpersonateThread": 213, "NtInitializeNlsFiles": 214, "NtInitializeRegistry": 215, "NtInitiatePowerAction": 216, "NtIsSystemResumeAutomatic": 217, "NtIsUILanguageComitted": 218, "NtListenPort": 219, "NtLoadDriver": 220, "NtLoadKey": 221, "NtLoadKey2": 222, "NtLoadKeyEx": 223, "NtLockFile": 224, "NtLockProductActivationKeys": 225, "NtLockRegistryKey": 226, "NtLockVirtualMemory": 227, "NtMakePermanentObject": 228, "NtMakeTemporaryObject": 229, "NtMapCMFModule": 230, "NtMapUserPhysicalPages": 231, "NtModifyBootEntry": 232, "NtModifyDriverEntry": 233, "NtNotifyChangeDirectoryFile": 234, "NtNotifyChangeKey": 235, "NtNotifyChangeMultipleKeys": 236, "NtNotifyChangeSession": 237, "NtOpenEnlistment": 238, "NtOpenEventPair": 239, "NtOpenIoCompletion": 240, "NtOpenJobObject": 241, "NtOpenKeyEx": 242, "NtOpenKeyTransacted": 243, "NtOpenKeyTransactedEx": 244, "NtOpenKeyedEvent": 245, "NtOpenMutant": 246, "NtOpenObjectAuditAlarm": 247, "NtOpenPrivateNamespace": 248, "NtOpenProcessToken": 249, "NtOpenResourceManager": 250, "NtOpenSemaphore": 251, "NtOpenSession": 252, "NtOpenSymbolicLinkObject": 253, "NtOpenThread": 254, "NtOpenTimer": 255, "NtOpenTransaction": 256, "NtOpenTransactionManager": 257, "NtPlugPlayControl": 258, "NtPrePrepareComplete": 259, "NtPrePrepareEnlistment": 260, "NtPrepareComplete": 261, "NtPrepareEnlistment": 262, "NtPrivilegeCheck": 263, "NtPrivilegeObjectAuditAlarm": 264, "NtPrivilegedServiceAuditAlarm": 265, "NtPropagationComplete": 266, "NtPropagationFailed": 267, "NtPulseEvent": 268, "NtQueryBootEntryOrder": 269, "NtQueryBootOptions": 270, "NtQueryDebugFilterState": 271, "NtQueryDirectoryObject": 272, "NtQueryDriverEntryOrder": 273, "NtQueryEaFile": 274, "NtQueryFullAttributesFile": 275, "NtQueryInformationAtom": 276, "NtQueryInformationEnlistment": 277, "NtQueryInformationJobObject": 278, "NtQueryInformationPort": 279, "NtQueryInformationResourceManager": 280, "NtQueryInformationTransaction": 281, "NtQueryInformationTransactionManager": 282, "NtQueryInformationWorkerFactory": 283, "NtQueryInstallUILanguage": 284, "NtQueryIntervalProfile": 285, "NtQueryIoCompletion": 286, "NtQueryLicenseValue": 287, "NtQueryMultipleValueKey": 288, "NtQueryMutant": 289, "NtQueryOpenSubKeys": 290, "NtQueryOpenSubKeysEx": 291, "NtQueryPortInformationProcess": 292, "NtQueryQuotaInformationFile": 293, "NtQuerySecurityAttributesToken": 294, "NtQuerySecurityObject": 295, "NtQuerySemaphore": 296, "NtQuerySymbolicLinkObject": 297, "NtQuerySystemEnvironmentValue": 298, "NtQuerySystemEnvironmentValueEx": 299, "NtQuerySystemInformationEx": 300, "NtQueryTimerResolution": 301, "NtQueueApcThreadEx": 302, "NtRaiseException": 303, "NtRaiseHardError": 304, "NtReadOnlyEnlistment": 305, "NtRecoverEnlistment": 306, "NtRecoverResourceManager": 307, "NtRecoverTransactionManager": 308, "NtRegisterProtocolAddressInformation": 309, "NtRegisterThreadTerminatePort": 310, "NtReleaseKeyedEvent": 311, "NtReleaseWorkerFactoryWorker": 312, "NtRemoveIoCompletionEx": 313, "NtRemoveProcessDebug": 314, "NtRenameKey": 315, "NtRenameTransactionManager": 316, "NtReplaceKey": 317, "NtReplacePartitionUnit": 318, "NtReplyWaitReplyPort": 319, "NtRequestPort": 320, "NtResetEvent": 321, "NtResetWriteWatch": 322, "NtRestoreKey": 323, "NtResumeProcess": 324, "NtRollbackComplete": 325, "NtRollbackEnlistment": 326, "NtRollbackTransaction": 327, "NtRollforwardTransactionManager": 328, "NtSaveKey": 329, "NtSaveKeyEx": 330, "NtSaveMergedKeys": 331, "NtSecureConnectPort": 332, "NtSerializeBoot": 333, "NtSetBootEntryOrder": 334, "NtSetBootOptions": 335, "NtSetContextThread": 336, "NtSetDebugFilterState": 337, "NtSetDefaultHardErrorPort": 338, "NtSetDefaultLocale": 339, "NtSetDefaultUILanguage": 340, "NtSetDriverEntryOrder": 341, "NtSetEaFile": 342, "NtSetHighEventPair": 343, "NtSetHighWaitLowEventPair": 344, "NtSetInformationDebugObject": 345, "NtSetInformationEnlistment": 346, "NtSetInformationJobObject": 347, "NtSetInformationKey": 348, "NtSetInformationResourceManager": 349, "NtSetInformationToken": 350, "NtSetInformationTransaction": 351, "NtSetInformationTransactionManager": 352, "NtSetInformationWorkerFactory": 353, "NtSetIntervalProfile": 354, "NtSetIoCompletion": 355, "NtSetIoCompletionEx": 356, "NtSetLdtEntries": 357, "NtSetLowEventPair": 358, "NtSetLowWaitHighEventPair": 359, "NtSetQuotaInformationFile": 360, "NtSetSecurityObject": 361, "NtSetSystemEnvironmentValue": 362, "NtSetSystemEnvironmentValueEx": 363, "NtSetSystemInformation": 364, "NtSetSystemPowerState": 365, "NtSetSystemTime": 366, "NtSetThreadExecutionState": 367, "NtSetTimerEx": 368, "NtSetTimerResolution": 369, "NtSetUuidSeed": 370, "NtSetVolumeInformationFile": 371, "NtShutdownSystem": 372, "NtShutdownWorkerFactory": 373, "NtSignalAndWaitForSingleObject": 374, "NtSinglePhaseReject": 375, "NtStartProfile": 376, "NtStopProfile": 377, "NtSuspendProcess": 378, "NtSuspendThread": 379, "NtSystemDebugControl": 380, "NtTerminateJobObject": 381, "NtTestAlert": 382, "NtThawRegistry": 383, "NtThawTransactions": 384, "NtTraceControl": 385, "NtTranslateFilePath": 386, "NtUmsThreadYield": 387, "NtUnloadDriver": 388, "NtUnloadKey": 389, "NtUnloadKey2": 390, "NtUnloadKeyEx": 391, "NtUnlockFile": 392, "NtUnlockVirtualMemory": 393, "NtVdmControl": 394, "NtWaitForDebugEvent": 395, "NtWaitForKeyedEvent": 396, "NtWaitForWorkViaWorkerFactory": 397, "NtWaitHighEventPair": 398, "NtWaitLowEventPair": 399, "NtWorkerFactoryWorkerReady": 400}, "SP1": {"NtMapUserPhysicalPagesScatter": 0, "NtWaitForSingleObject": 1, "NtCallbackReturn": 2, "NtReadFile": 3, "NtDeviceIoControlFile": 4, "NtWriteFile": 5, "NtRemoveIoCompletion": 6, "NtReleaseSemaphore": 7, "NtReplyWaitReceivePort": 8, "NtReplyPort": 9, "NtSetInformationThread": 10, "NtSetEvent": 11, "NtClose": 12, "NtQueryObject": 13, "NtQueryInformationFile": 14, "NtOpenKey": 15, "NtEnumerateValueKey": 16, "NtFindAtom": 17, "NtQueryDefaultLocale": 18, "NtQueryKey": 19, "NtQueryValueKey": 20, "NtAllocateVirtualMemory": 21, "NtQueryInformationProcess": 22, "NtWaitForMultipleObjects32": 23, "NtWriteFileGather": 24, "NtSetInformationProcess": 25, "NtCreateKey": 26, "NtFreeVirtualMemory": 27, "NtImpersonateClientOfPort": 28, "NtReleaseMutant": 29, "NtQueryInformationToken": 30, "NtRequestWaitReplyPort": 31, "NtQueryVirtualMemory": 32, "NtOpenThreadToken": 33, "NtQueryInformationThread": 34, "NtOpenProcess": 35, "NtSetInformationFile": 36, "NtMapViewOfSection": 37, "NtAccessCheckAndAuditAlarm": 38, "NtUnmapViewOfSection": 39, "NtReplyWaitReceivePortEx": 40, "NtTerminateProcess": 41, "NtSetEventBoostPriority": 42, "NtReadFileScatter": 43, "NtOpenThreadTokenEx": 44, "NtOpenProcessTokenEx": 45, "NtQueryPerformanceCounter": 46, "NtEnumerateKey": 47, "NtOpenFile": 48, "NtDelayExecution": 49, "NtQueryDirectoryFile": 50, "NtQuerySystemInformation": 51, "NtOpenSection": 52, "NtQueryTimer": 53, "NtFsControlFile": 54, "NtWriteVirtualMemory": 55, "NtCloseObjectAuditAlarm": 56, "NtDuplicateObject": 57, "NtQueryAttributesFile": 58, "NtClearEvent": 59, "NtReadVirtualMemory": 60, "NtOpenEvent": 61, "NtAdjustPrivilegesToken": 62, "NtDuplicateToken": 63, "NtContinue": 64, "NtQueryDefaultUILanguage": 65, "NtQueueApcThread": 66, "NtYieldExecution": 67, "NtAddAtom": 68, "NtCreateEvent": 69, "NtQueryVolumeInformationFile": 70, "NtCreateSection": 71, "NtFlushBuffersFile": 72, "NtApphelpCacheControl": 73, "NtCreateProcessEx": 74, "NtCreateThread": 75, "NtIsProcessInJob": 76, "NtProtectVirtualMemory": 77, "NtQuerySection": 78, "NtResumeThread": 79, "NtTerminateThread": 80, "NtReadRequestData": 81, "NtCreateFile": 82, "NtQueryEvent": 83, "NtWriteRequestData": 84, "NtOpenDirectoryObject": 85, "NtAccessCheckByTypeAndAuditAlarm": 86, "NtQuerySystemTime": 87, "NtWaitForMultipleObjects": 88, "NtSetInformationObject": 89, "NtCancelIoFile": 90, "NtTraceEvent": 91, "NtPowerInformation": 92, "NtSetValueKey": 93, "NtCancelTimer": 94, "NtSetTimer": 95, "NtAcceptConnectPort": 96, "NtAccessCheck": 97, "NtAccessCheckByType": 98, "NtAccessCheckByTypeResultList": 99, "NtAccessCheckByTypeResultListAndAuditAlarm": 100, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 101, "NtAddBootEntry": 102, "NtAddDriverEntry": 103, "NtAdjustGroupsToken": 104, "NtAlertResumeThread": 105, "NtAlertThread": 106, "NtAllocateLocallyUniqueId": 107, "NtAllocateReserveObject": 108, "NtAllocateUserPhysicalPages": 109, "NtAllocateUuids": 110, "NtAlpcAcceptConnectPort": 111, "NtAlpcCancelMessage": 112, "NtAlpcConnectPort": 113, "NtAlpcCreatePort": 114, "NtAlpcCreatePortSection": 115, "NtAlpcCreateResourceReserve": 116, "NtAlpcCreateSectionView": 117, "NtAlpcCreateSecurityContext": 118, "NtAlpcDeletePortSection": 119, "NtAlpcDeleteResourceReserve": 120, "NtAlpcDeleteSectionView": 121, "NtAlpcDeleteSecurityContext": 122, "NtAlpcDisconnectPort": 123, "NtAlpcImpersonateClientOfPort": 124, "NtAlpcOpenSenderProcess": 125, "NtAlpcOpenSenderThread": 126, "NtAlpcQueryInformation": 127, "NtAlpcQueryInformationMessage": 128, "NtAlpcRevokeSecurityContext": 129, "NtAlpcSendWaitReceivePort": 130, "NtAlpcSetInformation": 131, "NtAreMappedFilesTheSame": 132, "NtAssignProcessToJobObject": 133, "NtCancelIoFileEx": 134, "NtCancelSynchronousIoFile": 135, "NtCommitComplete": 136, "NtCommitEnlistment": 137, "NtCommitTransaction": 138, "NtCompactKeys": 139, "NtCompareTokens": 140, "NtCompleteConnectPort": 141, "NtCompressKey": 142, "NtConnectPort": 143, "NtCreateDebugObject": 144, "NtCreateDirectoryObject": 145, "NtCreateEnlistment": 146, "NtCreateEventPair": 147, "NtCreateIoCompletion": 148, "NtCreateJobObject": 149, "NtCreateJobSet": 150, "NtCreateKeyTransacted": 151, "NtCreateKeyedEvent": 152, "NtCreateMailslotFile": 153, "NtCreateMutant": 154, "NtCreateNamedPipeFile": 155, "NtCreatePagingFile": 156, "NtCreatePort": 157, "NtCreatePrivateNamespace": 158, "NtCreateProcess": 159, "NtCreateProfile": 160, "NtCreateProfileEx": 161, "NtCreateResourceManager": 162, "NtCreateSemaphore": 163, "NtCreateSymbolicLinkObject": 164, "NtCreateThreadEx": 165, "NtCreateTimer": 166, "NtCreateToken": 167, "NtCreateTransaction": 168, "NtCreateTransactionManager": 169, "NtCreateUserProcess": 170, "NtCreateWaitablePort": 171, "NtCreateWorkerFactory": 172, "NtDebugActiveProcess": 173, "NtDebugContinue": 174, "NtDeleteAtom": 175, "NtDeleteBootEntry": 176, "NtDeleteDriverEntry": 177, "NtDeleteFile": 178, "NtDeleteKey": 179, "NtDeleteObjectAuditAlarm": 180, "NtDeletePrivateNamespace": 181, "NtDeleteValueKey": 182, "NtDisableLastKnownGood": 183, "NtDisplayString": 184, "NtDrawText": 185, "NtEnableLastKnownGood": 186, "NtEnumerateBootEntries": 187, "NtEnumerateDriverEntries": 188, "NtEnumerateSystemEnvironmentValuesEx": 189, "NtEnumerateTransactionObject": 190, "NtExtendSection": 191, "NtFilterToken": 192, "NtFlushInstallUILanguage": 193, "NtFlushInstructionCache": 194, "NtFlushKey": 195, "NtFlushProcessWriteBuffers": 196, "NtFlushVirtualMemory": 197, "NtFlushWriteBuffer": 198, "NtFreeUserPhysicalPages": 199, "NtFreezeRegistry": 200, "NtFreezeTransactions": 201, "NtGetContextThread": 202, "NtGetCurrentProcessorNumber": 203, "NtGetDevicePowerState": 204, "NtGetMUIRegistryInfo": 205, "NtGetNextProcess": 206, "NtGetNextThread": 207, "NtGetNlsSectionPtr": 208, "NtGetNotificationResourceManager": 209, "NtGetPlugPlayEvent": 210, "NtGetWriteWatch": 211, "NtImpersonateAnonymousToken": 212, "NtImpersonateThread": 213, "NtInitializeNlsFiles": 214, "NtInitializeRegistry": 215, "NtInitiatePowerAction": 216, "NtIsSystemResumeAutomatic": 217, "NtIsUILanguageComitted": 218, "NtListenPort": 219, "NtLoadDriver": 220, "NtLoadKey": 221, "NtLoadKey2": 222, "NtLoadKeyEx": 223, "NtLockFile": 224, "NtLockProductActivationKeys": 225, "NtLockRegistryKey": 226, "NtLockVirtualMemory": 227, "NtMakePermanentObject": 228, "NtMakeTemporaryObject": 229, "NtMapCMFModule": 230, "NtMapUserPhysicalPages": 231, "NtModifyBootEntry": 232, "NtModifyDriverEntry": 233, "NtNotifyChangeDirectoryFile": 234, "NtNotifyChangeKey": 235, "NtNotifyChangeMultipleKeys": 236, "NtNotifyChangeSession": 237, "NtOpenEnlistment": 238, "NtOpenEventPair": 239, "NtOpenIoCompletion": 240, "NtOpenJobObject": 241, "NtOpenKeyEx": 242, "NtOpenKeyTransacted": 243, "NtOpenKeyTransactedEx": 244, "NtOpenKeyedEvent": 245, "NtOpenMutant": 246, "NtOpenObjectAuditAlarm": 247, "NtOpenPrivateNamespace": 248, "NtOpenProcessToken": 249, "NtOpenResourceManager": 250, "NtOpenSemaphore": 251, "NtOpenSession": 252, "NtOpenSymbolicLinkObject": 253, "NtOpenThread": 254, "NtOpenTimer": 255, "NtOpenTransaction": 256, "NtOpenTransactionManager": 257, "NtPlugPlayControl": 258, "NtPrePrepareComplete": 259, "NtPrePrepareEnlistment": 260, "NtPrepareComplete": 261, "NtPrepareEnlistment": 262, "NtPrivilegeCheck": 263, "NtPrivilegeObjectAuditAlarm": 264, "NtPrivilegedServiceAuditAlarm": 265, "NtPropagationComplete": 266, "NtPropagationFailed": 267, "NtPulseEvent": 268, "NtQueryBootEntryOrder": 269, "NtQueryBootOptions": 270, "NtQueryDebugFilterState": 271, "NtQueryDirectoryObject": 272, "NtQueryDriverEntryOrder": 273, "NtQueryEaFile": 274, "NtQueryFullAttributesFile": 275, "NtQueryInformationAtom": 276, "NtQueryInformationEnlistment": 277, "NtQueryInformationJobObject": 278, "NtQueryInformationPort": 279, "NtQueryInformationResourceManager": 280, "NtQueryInformationTransaction": 281, "NtQueryInformationTransactionManager": 282, "NtQueryInformationWorkerFactory": 283, "NtQueryInstallUILanguage": 284, "NtQueryIntervalProfile": 285, "NtQueryIoCompletion": 286, "NtQueryLicenseValue": 287, "NtQueryMultipleValueKey": 288, "NtQueryMutant": 289, "NtQueryOpenSubKeys": 290, "NtQueryOpenSubKeysEx": 291, "NtQueryPortInformationProcess": 292, "NtQueryQuotaInformationFile": 293, "NtQuerySecurityAttributesToken": 294, "NtQuerySecurityObject": 295, "NtQuerySemaphore": 296, "NtQuerySymbolicLinkObject": 297, "NtQuerySystemEnvironmentValue": 298, "NtQuerySystemEnvironmentValueEx": 299, "NtQuerySystemInformationEx": 300, "NtQueryTimerResolution": 301, "NtQueueApcThreadEx": 302, "NtRaiseException": 303, "NtRaiseHardError": 304, "NtReadOnlyEnlistment": 305, "NtRecoverEnlistment": 306, "NtRecoverResourceManager": 307, "NtRecoverTransactionManager": 308, "NtRegisterProtocolAddressInformation": 309, "NtRegisterThreadTerminatePort": 310, "NtReleaseKeyedEvent": 311, "NtReleaseWorkerFactoryWorker": 312, "NtRemoveIoCompletionEx": 313, "NtRemoveProcessDebug": 314, "NtRenameKey": 315, "NtRenameTransactionManager": 316, "NtReplaceKey": 317, "NtReplacePartitionUnit": 318, "NtReplyWaitReplyPort": 319, "NtRequestPort": 320, "NtResetEvent": 321, "NtResetWriteWatch": 322, "NtRestoreKey": 323, "NtResumeProcess": 324, "NtRollbackComplete": 325, "NtRollbackEnlistment": 326, "NtRollbackTransaction": 327, "NtRollforwardTransactionManager": 328, "NtSaveKey": 329, "NtSaveKeyEx": 330, "NtSaveMergedKeys": 331, "NtSecureConnectPort": 332, "NtSerializeBoot": 333, "NtSetBootEntryOrder": 334, "NtSetBootOptions": 335, "NtSetContextThread": 336, "NtSetDebugFilterState": 337, "NtSetDefaultHardErrorPort": 338, "NtSetDefaultLocale": 339, "NtSetDefaultUILanguage": 340, "NtSetDriverEntryOrder": 341, "NtSetEaFile": 342, "NtSetHighEventPair": 343, "NtSetHighWaitLowEventPair": 344, "NtSetInformationDebugObject": 345, "NtSetInformationEnlistment": 346, "NtSetInformationJobObject": 347, "NtSetInformationKey": 348, "NtSetInformationResourceManager": 349, "NtSetInformationToken": 350, "NtSetInformationTransaction": 351, "NtSetInformationTransactionManager": 352, "NtSetInformationWorkerFactory": 353, "NtSetIntervalProfile": 354, "NtSetIoCompletion": 355, "NtSetIoCompletionEx": 356, "NtSetLdtEntries": 357, "NtSetLowEventPair": 358, "NtSetLowWaitHighEventPair": 359, "NtSetQuotaInformationFile": 360, "NtSetSecurityObject": 361, "NtSetSystemEnvironmentValue": 362, "NtSetSystemEnvironmentValueEx": 363, "NtSetSystemInformation": 364, "NtSetSystemPowerState": 365, "NtSetSystemTime": 366, "NtSetThreadExecutionState": 367, "NtSetTimerEx": 368, "NtSetTimerResolution": 369, "NtSetUuidSeed": 370, "NtSetVolumeInformationFile": 371, "NtShutdownSystem": 372, "NtShutdownWorkerFactory": 373, "NtSignalAndWaitForSingleObject": 374, "NtSinglePhaseReject": 375, "NtStartProfile": 376, "NtStopProfile": 377, "NtSuspendProcess": 378, "NtSuspendThread": 379, "NtSystemDebugControl": 380, "NtTerminateJobObject": 381, "NtTestAlert": 382, "NtThawRegistry": 383, "NtThawTransactions": 384, "NtTraceControl": 385, "NtTranslateFilePath": 386, "NtUmsThreadYield": 387, "NtUnloadDriver": 388, "NtUnloadKey": 389, "NtUnloadKey2": 390, "NtUnloadKeyEx": 391, "NtUnlockFile": 392, "NtUnlockVirtualMemory": 393, "NtVdmControl": 394, "NtWaitForDebugEvent": 395, "NtWaitForKeyedEvent": 396, "NtWaitForWorkViaWorkerFactory": 397, "NtWaitHighEventPair": 398, "NtWaitLowEventPair": 399, "NtWorkerFactoryWorkerReady": 400}}, "Windows Server 2012": {"SP0": {"NtWorkerFactoryWorkerReady": 0, "NtMapUserPhysicalPagesScatter": 1, "NtWaitForSingleObject": 2, "NtCallbackReturn": 3, "NtReadFile": 4, "NtDeviceIoControlFile": 5, "NtWriteFile": 6, "NtRemoveIoCompletion": 7, "NtReleaseSemaphore": 8, "NtReplyWaitReceivePort": 9, "NtReplyPort": 10, "NtSetInformationThread": 11, "NtSetEvent": 12, "NtClose": 13, "NtQueryObject": 14, "NtQueryInformationFile": 15, "NtOpenKey": 16, "NtEnumerateValueKey": 17, "NtFindAtom": 18, "NtQueryDefaultLocale": 19, "NtQueryKey": 20, "NtQueryValueKey": 21, "NtAllocateVirtualMemory": 22, "NtQueryInformationProcess": 23, "NtWaitForMultipleObjects32": 24, "NtWriteFileGather": 25, "NtSetInformationProcess": 26, "NtCreateKey": 27, "NtFreeVirtualMemory": 28, "NtImpersonateClientOfPort": 29, "NtReleaseMutant": 30, "NtQueryInformationToken": 31, "NtRequestWaitReplyPort": 32, "NtQueryVirtualMemory": 33, "NtOpenThreadToken": 34, "NtQueryInformationThread": 35, "NtOpenProcess": 36, "NtSetInformationFile": 37, "NtMapViewOfSection": 38, "NtAccessCheckAndAuditAlarm": 39, "NtUnmapViewOfSection": 40, "NtReplyWaitReceivePortEx": 41, "NtTerminateProcess": 42, "NtSetEventBoostPriority": 43, "NtReadFileScatter": 44, "NtOpenThreadTokenEx": 45, "NtOpenProcessTokenEx": 46, "NtQueryPerformanceCounter": 47, "NtEnumerateKey": 48, "NtOpenFile": 49, "NtDelayExecution": 50, "NtQueryDirectoryFile": 51, "NtQuerySystemInformation": 52, "NtOpenSection": 53, "NtQueryTimer": 54, "NtFsControlFile": 55, "NtWriteVirtualMemory": 56, "NtCloseObjectAuditAlarm": 57, "NtDuplicateObject": 58, "NtQueryAttributesFile": 59, "NtClearEvent": 60, "NtReadVirtualMemory": 61, "NtOpenEvent": 62, "NtAdjustPrivilegesToken": 63, "NtDuplicateToken": 64, "NtContinue": 65, "NtQueryDefaultUILanguage": 66, "NtQueueApcThread": 67, "NtYieldExecution": 68, "NtAddAtom": 69, "NtCreateEvent": 70, "NtQueryVolumeInformationFile": 71, "NtCreateSection": 72, "NtFlushBuffersFile": 73, "NtApphelpCacheControl": 74, "NtCreateProcessEx": 75, "NtCreateThread": 76, "NtIsProcessInJob": 77, "NtProtectVirtualMemory": 78, "NtQuerySection": 79, "NtResumeThread": 80, "NtTerminateThread": 81, "NtReadRequestData": 82, "NtCreateFile": 83, "NtQueryEvent": 84, "NtWriteRequestData": 85, "NtOpenDirectoryObject": 86, "NtAccessCheckByTypeAndAuditAlarm": 87, "NtQuerySystemTime": 88, "NtWaitForMultipleObjects": 89, "NtSetInformationObject": 90, "NtCancelIoFile": 91, "NtTraceEvent": 92, "NtPowerInformation": 93, "NtSetValueKey": 94, "NtCancelTimer": 95, "NtSetTimer": 96, "NtAcceptConnectPort": 97, "NtAccessCheck": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientOfPort": 129, "NtAlpcOpenSenderProcess": 130, "NtAlpcOpenSenderThread": 131, "NtAlpcQueryInformation": 132, "NtAlpcQueryInformationMessage": 133, "NtAlpcRevokeSecurityContext": 134, "NtAlpcSendWaitReceivePort": 135, "NtAlpcSetInformation": 136, "NtAreMappedFilesTheSame": 137, "NtAssignProcessToJobObject": 138, "NtAssociateWaitCompletionPacket": 139, "NtCancelIoFileEx": 140, "NtCancelSynchronousIoFile": 141, "NtCancelWaitCompletionPacket": 142, "NtCommitComplete": 143, "NtCommitEnlistment": 144, "NtCommitTransaction": 145, "NtCompactKeys": 146, "NtCompareTokens": 147, "NtCompleteConnectPort": 148, "NtCompressKey": 149, "NtConnectPort": 150, "NtCreateDebugObject": 151, "NtCreateDirectoryObject": 152, "NtCreateDirectoryObjectEx": 153, "NtCreateEnlistment": 154, "NtCreateEventPair": 155, "NtCreateIRTimer": 156, "NtCreateIoCompletion": 157, "NtCreateJobObject": 158, "NtCreateJobSet": 159, "NtCreateKeyTransacted": 160, "NtCreateKeyedEvent": 161, "NtCreateLowBoxToken": 162, "NtCreateMailslotFile": 163, "NtCreateMutant": 164, "NtCreateNamedPipeFile": 165, "NtCreatePagingFile": 166, "NtCreatePort": 167, "NtCreatePrivateNamespace": 168, "NtCreateProcess": 169, "NtCreateProfile": 170, "NtCreateProfileEx": 171, "NtCreateResourceManager": 172, "NtCreateSemaphore": 173, "NtCreateSymbolicLinkObject": 174, "NtCreateThreadEx": 175, "NtCreateTimer": 176, "NtCreateToken": 177, "NtCreateTokenEx": 178, "NtCreateTransaction": 179, "NtCreateTransactionManager": 180, "NtCreateUserProcess": 181, "NtCreateWaitCompletionPacket": 182, "NtCreateWaitablePort": 183, "NtCreateWnfStateName": 184, "NtCreateWorkerFactory": 185, "NtDebugActiveProcess": 186, "NtDebugContinue": 187, "NtDeleteAtom": 188, "NtDeleteBootEntry": 189, "NtDeleteDriverEntry": 190, "NtDeleteFile": 191, "NtDeleteKey": 192, "NtDeleteObjectAuditAlarm": 193, "NtDeletePrivateNamespace": 194, "NtDeleteValueKey": 195, "NtDeleteWnfStateData": 196, "NtDeleteWnfStateName": 197, "NtDisableLastKnownGood": 198, "NtDisplayString": 199, "NtDrawText": 200, "NtEnableLastKnownGood": 201, "NtEnumerateBootEntries": 202, "NtEnumerateDriverEntries": 203, "NtEnumerateSystemEnvironmentValuesEx": 204, "NtEnumerateTransactionObject": 205, "NtExtendSection": 206, "NtFilterBootOption": 207, "NtFilterToken": 208, "NtFilterTokenEx": 209, "NtFlushBuffersFileEx": 210, "NtFlushInstallUILanguage": 211, "NtFlushInstructionCache": 212, "NtFlushKey": 213, "NtFlushProcessWriteBuffers": 214, "NtFlushVirtualMemory": 215, "NtFlushWriteBuffer": 216, "NtFreeUserPhysicalPages": 217, "NtFreezeRegistry": 218, "NtFreezeTransactions": 219, "NtGetCachedSigningLevel": 220, "NtGetContextThread": 221, "NtGetCurrentProcessorNumber": 222, "NtGetDevicePowerState": 223, "NtGetMUIRegistryInfo": 224, "NtGetNextProcess": 225, "NtGetNextThread": 226, "NtGetNlsSectionPtr": 227, "NtGetNotificationResourceManager": 228, "NtGetWriteWatch": 229, "NtImpersonateAnonymousToken": 230, "NtImpersonateThread": 231, "NtInitializeNlsFiles": 232, "NtInitializeRegistry": 233, "NtInitiatePowerAction": 234, "NtIsSystemResumeAutomatic": 235, "NtIsUILanguageComitted": 236, "NtListenPort": 237, "NtLoadDriver": 238, "NtLoadKey": 239, "NtLoadKey2": 240, "NtLoadKeyEx": 241, "NtLockFile": 242, "NtLockProductActivationKeys": 243, "NtLockRegistryKey": 244, "NtLockVirtualMemory": 245, "NtMakePermanentObject": 246, "NtMakeTemporaryObject": 247, "NtMapCMFModule": 248, "NtMapUserPhysicalPages": 249, "NtModifyBootEntry": 250, "NtModifyDriverEntry": 251, "NtNotifyChangeDirectoryFile": 252, "NtNotifyChangeKey": 253, "NtNotifyChangeMultipleKeys": 254, "NtNotifyChangeSession": 255, "NtOpenEnlistment": 256, "NtOpenEventPair": 257, "NtOpenIoCompletion": 258, "NtOpenJobObject": 259, "NtOpenKeyEx": 260, "NtOpenKeyTransacted": 261, "NtOpenKeyTransactedEx": 262, "NtOpenKeyedEvent": 263, "NtOpenMutant": 264, "NtOpenObjectAuditAlarm": 265, "NtOpenPrivateNamespace": 266, "NtOpenProcessToken": 267, "NtOpenResourceManager": 268, "NtOpenSemaphore": 269, "NtOpenSession": 270, "NtOpenSymbolicLinkObject": 271, "NtOpenThread": 272, "NtOpenTimer": 273, "NtOpenTransaction": 274, "NtOpenTransactionManager": 275, "NtPlugPlayControl": 276, "NtPrePrepareComplete": 277, "NtPrePrepareEnlistment": 278, "NtPrepareComplete": 279, "NtPrepareEnlistment": 280, "NtPrivilegeCheck": 281, "NtPrivilegeObjectAuditAlarm": 282, "NtPrivilegedServiceAuditAlarm": 283, "NtPropagationComplete": 284, "NtPropagationFailed": 285, "NtPulseEvent": 286, "NtQueryBootEntryOrder": 287, "NtQueryBootOptions": 288, "NtQueryDebugFilterState": 289, "NtQueryDirectoryObject": 290, "NtQueryDriverEntryOrder": 291, "NtQueryEaFile": 292, "NtQueryFullAttributesFile": 293, "NtQueryInformationAtom": 294, "NtQueryInformationEnlistment": 295, "NtQueryInformationJobObject": 296, "NtQueryInformationPort": 297, "NtQueryInformationResourceManager": 298, "NtQueryInformationTransaction": 299, "NtQueryInformationTransactionManager": 300, "NtQueryInformationWorkerFactory": 301, "NtQueryInstallUILanguage": 302, "NtQueryIntervalProfile": 303, "NtQueryIoCompletion": 304, "NtQueryLicenseValue": 305, "NtQueryMultipleValueKey": 306, "NtQueryMutant": 307, "NtQueryOpenSubKeys": 308, "NtQueryOpenSubKeysEx": 309, "NtQueryPortInformationProcess": 310, "NtQueryQuotaInformationFile": 311, "NtQuerySecurityAttributesToken": 312, "NtQuerySecurityObject": 313, "NtQuerySemaphore": 314, "NtQuerySymbolicLinkObject": 315, "NtQuerySystemEnvironmentValue": 316, "NtQuerySystemEnvironmentValueEx": 317, "NtQuerySystemInformationEx": 318, "NtQueryTimerResolution": 319, "NtQueryWnfStateData": 320, "NtQueryWnfStateNameInformation": 321, "NtQueueApcThreadEx": 322, "NtRaiseException": 323, "NtRaiseHardError": 324, "NtReadOnlyEnlistment": 325, "NtRecoverEnlistment": 326, "NtRecoverResourceManager": 327, "NtRecoverTransactionManager": 328, "NtRegisterProtocolAddressInformation": 329, "NtRegisterThreadTerminatePort": 330, "NtReleaseKeyedEvent": 331, "NtReleaseWorkerFactoryWorker": 332, "NtRemoveIoCompletionEx": 333, "NtRemoveProcessDebug": 334, "NtRenameKey": 335, "NtRenameTransactionManager": 336, "NtReplaceKey": 337, "NtReplacePartitionUnit": 338, "NtReplyWaitReplyPort": 339, "NtRequestPort": 340, "NtResetEvent": 341, "NtResetWriteWatch": 342, "NtRestoreKey": 343, "NtResumeProcess": 344, "NtRollbackComplete": 345, "NtRollbackEnlistment": 346, "NtRollbackTransaction": 347, "NtRollforwardTransactionManager": 348, "NtSaveKey": 349, "NtSaveKeyEx": 350, "NtSaveMergedKeys": 351, "NtSecureConnectPort": 352, "NtSerializeBoot": 353, "NtSetBootEntryOrder": 354, "NtSetBootOptions": 355, "NtSetCachedSigningLevel": 356, "NtSetContextThread": 357, "NtSetDebugFilterState": 358, "NtSetDefaultHardErrorPort": 359, "NtSetDefaultLocale": 360, "NtSetDefaultUILanguage": 361, "NtSetDriverEntryOrder": 362, "NtSetEaFile": 363, "NtSetHighEventPair": 364, "NtSetHighWaitLowEventPair": 365, "NtSetIRTimer": 366, "NtSetInformationDebugObject": 367, "NtSetInformationEnlistment": 368, "NtSetInformationJobObject": 369, "NtSetInformationKey": 370, "NtSetInformationResourceManager": 371, "NtSetInformationToken": 372, "NtSetInformationTransaction": 373, "NtSetInformationTransactionManager": 374, "NtSetInformationVirtualMemory": 375, "NtSetInformationWorkerFactory": 376, "NtSetIntervalProfile": 377, "NtSetIoCompletion": 378, "NtSetIoCompletionEx": 379, "NtSetLdtEntries": 380, "NtSetLowEventPair": 381, "NtSetLowWaitHighEventPair": 382, "NtSetQuotaInformationFile": 383, "NtSetSecurityObject": 384, "NtSetSystemEnvironmentValue": 385, "NtSetSystemEnvironmentValueEx": 386, "NtSetSystemInformation": 387, "NtSetSystemPowerState": 388, "NtSetSystemTime": 389, "NtSetThreadExecutionState": 390, "NtSetTimerEx": 391, "NtSetTimerResolution": 392, "NtSetUuidSeed": 393, "NtSetVolumeInformationFile": 394, "NtShutdownSystem": 395, "NtShutdownWorkerFactory": 396, "NtSignalAndWaitForSingleObject": 397, "NtSinglePhaseReject": 398, "NtStartProfile": 399, "NtStopProfile": 400, "NtSubscribeWnfStateChange": 401, "NtSuspendProcess": 402, "NtSuspendThread": 403, "NtSystemDebugControl": 404, "NtTerminateJobObject": 405, "NtTestAlert": 406, "NtThawRegistry": 407, "NtThawTransactions": 408, "NtTraceControl": 409, "NtTranslateFilePath": 410, "NtUmsThreadYield": 411, "NtUnloadDriver": 412, "NtUnloadKey": 413, "NtUnloadKey2": 414, "NtUnloadKeyEx": 415, "NtUnlockFile": 416, "NtUnlockVirtualMemory": 417, "NtUnmapViewOfSectionEx": 418, "NtUnsubscribeWnfStateChange": 419, "NtUpdateWnfStateData": 420, "NtVdmControl": 421, "NtWaitForAlertByThreadId": 422, "NtWaitForDebugEvent": 423, "NtWaitForKeyedEvent": 424, "NtWaitForWnfNotifications": 425, "NtWaitForWorkViaWorkerFactory": 426, "NtWaitHighEventPair": 427, "NtWaitLowEventPair": 428}, "R2": {"NtWorkerFactoryWorkerReady": 0, "NtAcceptConnectPort": 1, "NtMapUserPhysicalPagesScatter": 2, "NtWaitForSingleObject": 3, "NtCallbackReturn": 4, "NtReadFile": 5, "NtDeviceIoControlFile": 6, "NtWriteFile": 7, "NtRemoveIoCompletion": 8, "NtReleaseSemaphore": 9, "NtReplyWaitReceivePort": 10, "NtReplyPort": 11, "NtSetInformationThread": 12, "NtSetEvent": 13, "NtClose": 14, "NtQueryObject": 15, "NtQueryInformationFile": 16, "NtOpenKey": 17, "NtEnumerateValueKey": 18, "NtFindAtom": 19, "NtQueryDefaultLocale": 20, "NtQueryKey": 21, "NtQueryValueKey": 22, "NtAllocateVirtualMemory": 23, "NtQueryInformationProcess": 24, "NtWaitForMultipleObjects32": 25, "NtWriteFileGather": 26, "NtSetInformationProcess": 27, "NtCreateKey": 28, "NtFreeVirtualMemory": 29, "NtImpersonateClientOfPort": 30, "NtReleaseMutant": 31, "NtQueryInformationToken": 32, "NtRequestWaitReplyPort": 33, "NtQueryVirtualMemory": 34, "NtOpenThreadToken": 35, "NtQueryInformationThread": 36, "NtOpenProcess": 37, "NtSetInformationFile": 38, "NtMapViewOfSection": 39, "NtAccessCheckAndAuditAlarm": 40, "NtUnmapViewOfSection": 41, "NtReplyWaitReceivePortEx": 42, "NtTerminateProcess": 43, "NtSetEventBoostPriority": 44, "NtReadFileScatter": 45, "NtOpenThreadTokenEx": 46, "NtOpenProcessTokenEx": 47, "NtQueryPerformanceCounter": 48, "NtEnumerateKey": 49, "NtOpenFile": 50, "NtDelayExecution": 51, "NtQueryDirectoryFile": 52, "NtQuerySystemInformation": 53, "NtOpenSection": 54, "NtQueryTimer": 55, "NtFsControlFile": 56, "NtWriteVirtualMemory": 57, "NtCloseObjectAuditAlarm": 58, "NtDuplicateObject": 59, "NtQueryAttributesFile": 60, "NtClearEvent": 61, "NtReadVirtualMemory": 62, "NtOpenEvent": 63, "NtAdjustPrivilegesToken": 64, "NtDuplicateToken": 65, "NtContinue": 66, "NtQueryDefaultUILanguage": 67, "NtQueueApcThread": 68, "NtYieldExecution": 69, "NtAddAtom": 70, "NtCreateEvent": 71, "NtQueryVolumeInformationFile": 72, "NtCreateSection": 73, "NtFlushBuffersFile": 74, "NtApphelpCacheControl": 75, "NtCreateProcessEx": 76, "NtCreateThread": 77, "NtIsProcessInJob": 78, "NtProtectVirtualMemory": 79, "NtQuerySection": 80, "NtResumeThread": 81, "NtTerminateThread": 82, "NtReadRequestData": 83, "NtCreateFile": 84, "NtQueryEvent": 85, "NtWriteRequestData": 86, "NtOpenDirectoryObject": 87, "NtAccessCheckByTypeAndAuditAlarm": 88, "NtQuerySystemTime": 89, "NtWaitForMultipleObjects": 90, "NtSetInformationObject": 91, "NtCancelIoFile": 92, "NtTraceEvent": 93, "NtPowerInformation": 94, "NtSetValueKey": 95, "NtCancelTimer": 96, "NtSetTimer": 97, "NtAccessCheck": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientOfPort": 129, "NtAlpcOpenSenderProcess": 130, "NtAlpcOpenSenderThread": 131, "NtAlpcQueryInformation": 132, "NtAlpcQueryInformationMessage": 133, "NtAlpcRevokeSecurityContext": 134, "NtAlpcSendWaitReceivePort": 135, "NtAlpcSetInformation": 136, "NtAreMappedFilesTheSame": 137, "NtAssignProcessToJobObject": 138, "NtAssociateWaitCompletionPacket": 139, "NtCancelIoFileEx": 140, "NtCancelSynchronousIoFile": 141, "NtCancelTimer2": 142, "NtCancelWaitCompletionPacket": 143, "NtCommitComplete": 144, "NtCommitEnlistment": 145, "NtCommitTransaction": 146, "NtCompactKeys": 147, "NtCompareTokens": 148, "NtCompleteConnectPort": 149, "NtCompressKey": 150, "NtConnectPort": 151, "NtCreateDebugObject": 152, "NtCreateDirectoryObject": 153, "NtCreateDirectoryObjectEx": 154, "NtCreateEnlistment": 155, "NtCreateEventPair": 156, "NtCreateIRTimer": 157, "NtCreateIoCompletion": 158, "NtCreateJobObject": 159, "NtCreateJobSet": 160, "NtCreateKeyTransacted": 161, "NtCreateKeyedEvent": 162, "NtCreateLowBoxToken": 163, "NtCreateMailslotFile": 164, "NtCreateMutant": 165, "NtCreateNamedPipeFile": 166, "NtCreatePagingFile": 167, "NtCreatePort": 168, "NtCreatePrivateNamespace": 169, "NtCreateProcess": 170, "NtCreateProfile": 171, "NtCreateProfileEx": 172, "NtCreateResourceManager": 173, "NtCreateSemaphore": 174, "NtCreateSymbolicLinkObject": 175, "NtCreateThreadEx": 176, "NtCreateTimer": 177, "NtCreateTimer2": 178, "NtCreateToken": 179, "NtCreateTokenEx": 180, "NtCreateTransaction": 181, "NtCreateTransactionManager": 182, "NtCreateUserProcess": 183, "NtCreateWaitCompletionPacket": 184, "NtCreateWaitablePort": 185, "NtCreateWnfStateName": 186, "NtCreateWorkerFactory": 187, "NtDebugActiveProcess": 188, "NtDebugContinue": 189, "NtDeleteAtom": 190, "NtDeleteBootEntry": 191, "NtDeleteDriverEntry": 192, "NtDeleteFile": 193, "NtDeleteKey": 194, "NtDeleteObjectAuditAlarm": 195, "NtDeletePrivateNamespace": 196, "NtDeleteValueKey": 197, "NtDeleteWnfStateData": 198, "NtDeleteWnfStateName": 199, "NtDisableLastKnownGood": 200, "NtDisplayString": 201, "NtDrawText": 202, "NtEnableLastKnownGood": 203, "NtEnumerateBootEntries": 204, "NtEnumerateDriverEntries": 205, "NtEnumerateSystemEnvironmentValuesEx": 206, "NtEnumerateTransactionObject": 207, "NtExtendSection": 208, "NtFilterBootOption": 209, "NtFilterToken": 210, "NtFilterTokenEx": 211, "NtFlushBuffersFileEx": 212, "NtFlushInstallUILanguage": 213, "NtFlushInstructionCache": 214, "NtFlushKey": 215, "NtFlushProcessWriteBuffers": 216, "NtFlushVirtualMemory": 217, "NtFlushWriteBuffer": 218, "NtFreeUserPhysicalPages": 219, "NtFreezeRegistry": 220, "NtFreezeTransactions": 221, "NtGetCachedSigningLevel": 222, "NtGetCompleteWnfStateSubscription": 223, "NtGetContextThread": 224, "NtGetCurrentProcessorNumber": 225, "NtGetDevicePowerState": 226, "NtGetMUIRegistryInfo": 227, "NtGetNextProcess": 228, "NtGetNextThread": 229, "NtGetNlsSectionPtr": 230, "NtGetNotificationResourceManager": 231, "NtGetWriteWatch": 232, "NtImpersonateAnonymousToken": 233, "NtImpersonateThread": 234, "NtInitializeNlsFiles": 235, "NtInitializeRegistry": 236, "NtInitiatePowerAction": 237, "NtIsSystemResumeAutomatic": 238, "NtIsUILanguageComitted": 239, "NtListenPort": 240, "NtLoadDriver": 241, "NtLoadKey": 242, "NtLoadKey2": 243, "NtLoadKeyEx": 244, "NtLockFile": 245, "NtLockProductActivationKeys": 246, "NtLockRegistryKey": 247, "NtLockVirtualMemory": 248, "NtMakePermanentObject": 249, "NtMakeTemporaryObject": 250, "NtMapCMFModule": 251, "NtMapUserPhysicalPages": 252, "NtModifyBootEntry": 253, "NtModifyDriverEntry": 254, "NtNotifyChangeDirectoryFile": 255, "NtNotifyChangeKey": 256, "NtNotifyChangeMultipleKeys": 257, "NtNotifyChangeSession": 258, "NtOpenEnlistment": 259, "NtOpenEventPair": 260, "NtOpenIoCompletion": 261, "NtOpenJobObject": 262, "NtOpenKeyEx": 263, "NtOpenKeyTransacted": 264, "NtOpenKeyTransactedEx": 265, "NtOpenKeyedEvent": 266, "NtOpenMutant": 267, "NtOpenObjectAuditAlarm": 268, "NtOpenPrivateNamespace": 269, "NtOpenProcessToken": 270, "NtOpenResourceManager": 271, "NtOpenSemaphore": 272, "NtOpenSession": 273, "NtOpenSymbolicLinkObject": 274, "NtOpenThread": 275, "NtOpenTimer": 276, "NtOpenTransaction": 277, "NtOpenTransactionManager": 278, "NtPlugPlayControl": 279, "NtPrePrepareComplete": 280, "NtPrePrepareEnlistment": 281, "NtPrepareComplete": 282, "NtPrepareEnlistment": 283, "NtPrivilegeCheck": 284, "NtPrivilegeObjectAuditAlarm": 285, "NtPrivilegedServiceAuditAlarm": 286, "NtPropagationComplete": 287, "NtPropagationFailed": 288, "NtPulseEvent": 289, "NtQueryBootEntryOrder": 290, "NtQueryBootOptions": 291, "NtQueryDebugFilterState": 292, "NtQueryDirectoryObject": 293, "NtQueryDriverEntryOrder": 294, "NtQueryEaFile": 295, "NtQueryFullAttributesFile": 296, "NtQueryInformationAtom": 297, "NtQueryInformationEnlistment": 298, "NtQueryInformationJobObject": 299, "NtQueryInformationPort": 300, "NtQueryInformationResourceManager": 301, "NtQueryInformationTransaction": 302, "NtQueryInformationTransactionManager": 303, "NtQueryInformationWorkerFactory": 304, "NtQueryInstallUILanguage": 305, "NtQueryIntervalProfile": 306, "NtQueryIoCompletion": 307, "NtQueryLicenseValue": 308, "NtQueryMultipleValueKey": 309, "NtQueryMutant": 310, "NtQueryOpenSubKeys": 311, "NtQueryOpenSubKeysEx": 312, "NtQueryPortInformationProcess": 313, "NtQueryQuotaInformationFile": 314, "NtQuerySecurityAttributesToken": 315, "NtQuerySecurityObject": 316, "NtQuerySemaphore": 317, "NtQuerySymbolicLinkObject": 318, "NtQuerySystemEnvironmentValue": 319, "NtQuerySystemEnvironmentValueEx": 320, "NtQuerySystemInformationEx": 321, "NtQueryTimerResolution": 322, "NtQueryWnfStateData": 323, "NtQueryWnfStateNameInformation": 324, "NtQueueApcThreadEx": 325, "NtRaiseException": 326, "NtRaiseHardError": 327, "NtReadOnlyEnlistment": 328, "NtRecoverEnlistment": 329, "NtRecoverResourceManager": 330, "NtRecoverTransactionManager": 331, "NtRegisterProtocolAddressInformation": 332, "NtRegisterThreadTerminatePort": 333, "NtReleaseKeyedEvent": 334, "NtReleaseWorkerFactoryWorker": 335, "NtRemoveIoCompletionEx": 336, "NtRemoveProcessDebug": 337, "NtRenameKey": 338, "NtRenameTransactionManager": 339, "NtReplaceKey": 340, "NtReplacePartitionUnit": 341, "NtReplyWaitReplyPort": 342, "NtRequestPort": 343, "NtResetEvent": 344, "NtResetWriteWatch": 345, "NtRestoreKey": 346, "NtResumeProcess": 347, "NtRollbackComplete": 348, "NtRollbackEnlistment": 349, "NtRollbackTransaction": 350, "NtRollforwardTransactionManager": 351, "NtSaveKey": 352, "NtSaveKeyEx": 353, "NtSaveMergedKeys": 354, "NtSecureConnectPort": 355, "NtSerializeBoot": 356, "NtSetBootEntryOrder": 357, "NtSetBootOptions": 358, "NtSetCachedSigningLevel": 359, "NtSetContextThread": 360, "NtSetDebugFilterState": 361, "NtSetDefaultHardErrorPort": 362, "NtSetDefaultLocale": 363, "NtSetDefaultUILanguage": 364, "NtSetDriverEntryOrder": 365, "NtSetEaFile": 366, "NtSetHighEventPair": 367, "NtSetHighWaitLowEventPair": 368, "NtSetIRTimer": 369, "NtSetInformationDebugObject": 370, "NtSetInformationEnlistment": 371, "NtSetInformationJobObject": 372, "NtSetInformationKey": 373, "NtSetInformationResourceManager": 374, "NtSetInformationToken": 375, "NtSetInformationTransaction": 376, "NtSetInformationTransactionManager": 377, "NtSetInformationVirtualMemory": 378, "NtSetInformationWorkerFactory": 379, "NtSetIntervalProfile": 380, "NtSetIoCompletion": 381, "NtSetIoCompletionEx": 382, "NtSetLdtEntries": 383, "NtSetLowEventPair": 384, "NtSetLowWaitHighEventPair": 385, "NtSetQuotaInformationFile": 386, "NtSetSecurityObject": 387, "NtSetSystemEnvironmentValue": 388, "NtSetSystemEnvironmentValueEx": 389, "NtSetSystemInformation": 390, "NtSetSystemPowerState": 391, "NtSetSystemTime": 392, "NtSetThreadExecutionState": 393, "NtSetTimer2": 394, "NtSetTimerEx": 395, "NtSetTimerResolution": 396, "NtSetUuidSeed": 397, "NtSetVolumeInformationFile": 398, "NtSetWnfProcessNotificationEvent": 399, "NtShutdownSystem": 400, "NtShutdownWorkerFactory": 401, "NtSignalAndWaitForSingleObject": 402, "NtSinglePhaseReject": 403, "NtStartProfile": 404, "NtStopProfile": 405, "NtSubscribeWnfStateChange": 406, "NtSuspendProcess": 407, "NtSuspendThread": 408, "NtSystemDebugControl": 409, "NtTerminateJobObject": 410, "NtTestAlert": 411, "NtThawRegistry": 412, "NtThawTransactions": 413, "NtTraceControl": 414, "NtTranslateFilePath": 415, "NtUmsThreadYield": 416, "NtUnloadDriver": 417, "NtUnloadKey": 418, "NtUnloadKey2": 419, "NtUnloadKeyEx": 420, "NtUnlockFile": 421, "NtUnlockVirtualMemory": 422, "NtUnmapViewOfSectionEx": 423, "NtUnsubscribeWnfStateChange": 424, "NtUpdateWnfStateData": 425, "NtVdmControl": 426, "NtWaitForAlertByThreadId": 427, "NtWaitForDebugEvent": 428, "NtWaitForKeyedEvent": 429, "NtWaitForWorkViaWorkerFactory": 430, "NtWaitHighEventPair": 431, "NtWaitLowEventPair": 432}}, "Windows 8": {"8.0": {"NtWorkerFactoryWorkerReady": 0, "NtMapUserPhysicalPagesScatter": 1, "NtWaitForSingleObject": 2, "NtCallbackReturn": 3, "NtReadFile": 4, "NtDeviceIoControlFile": 5, "NtWriteFile": 6, "NtRemoveIoCompletion": 7, "NtReleaseSemaphore": 8, "NtReplyWaitReceivePort": 9, "NtReplyPort": 10, "NtSetInformationThread": 11, "NtSetEvent": 12, "NtClose": 13, "NtQueryObject": 14, "NtQueryInformationFile": 15, "NtOpenKey": 16, "NtEnumerateValueKey": 17, "NtFindAtom": 18, "NtQueryDefaultLocale": 19, "NtQueryKey": 20, "NtQueryValueKey": 21, "NtAllocateVirtualMemory": 22, "NtQueryInformationProcess": 23, "NtWaitForMultipleObjects32": 24, "NtWriteFileGather": 25, "NtSetInformationProcess": 26, "NtCreateKey": 27, "NtFreeVirtualMemory": 28, "NtImpersonateClientOfPort": 29, "NtReleaseMutant": 30, "NtQueryInformationToken": 31, "NtRequestWaitReplyPort": 32, "NtQueryVirtualMemory": 33, "NtOpenThreadToken": 34, "NtQueryInformationThread": 35, "NtOpenProcess": 36, "NtSetInformationFile": 37, "NtMapViewOfSection": 38, "NtAccessCheckAndAuditAlarm": 39, "NtUnmapViewOfSection": 40, "NtReplyWaitReceivePortEx": 41, "NtTerminateProcess": 42, "NtSetEventBoostPriority": 43, "NtReadFileScatter": 44, "NtOpenThreadTokenEx": 45, "NtOpenProcessTokenEx": 46, "NtQueryPerformanceCounter": 47, "NtEnumerateKey": 48, "NtOpenFile": 49, "NtDelayExecution": 50, "NtQueryDirectoryFile": 51, "NtQuerySystemInformation": 52, "NtOpenSection": 53, "NtQueryTimer": 54, "NtFsControlFile": 55, "NtWriteVirtualMemory": 56, "NtCloseObjectAuditAlarm": 57, "NtDuplicateObject": 58, "NtQueryAttributesFile": 59, "NtClearEvent": 60, "NtReadVirtualMemory": 61, "NtOpenEvent": 62, "NtAdjustPrivilegesToken": 63, "NtDuplicateToken": 64, "NtContinue": 65, "NtQueryDefaultUILanguage": 66, "NtQueueApcThread": 67, "NtYieldExecution": 68, "NtAddAtom": 69, "NtCreateEvent": 70, "NtQueryVolumeInformationFile": 71, "NtCreateSection": 72, "NtFlushBuffersFile": 73, "NtApphelpCacheControl": 74, "NtCreateProcessEx": 75, "NtCreateThread": 76, "NtIsProcessInJob": 77, "NtProtectVirtualMemory": 78, "NtQuerySection": 79, "NtResumeThread": 80, "NtTerminateThread": 81, "NtReadRequestData": 82, "NtCreateFile": 83, "NtQueryEvent": 84, "NtWriteRequestData": 85, "NtOpenDirectoryObject": 86, "NtAccessCheckByTypeAndAuditAlarm": 87, "NtQuerySystemTime": 88, "NtWaitForMultipleObjects": 89, "NtSetInformationObject": 90, "NtCancelIoFile": 91, "NtTraceEvent": 92, "NtPowerInformation": 93, "NtSetValueKey": 94, "NtCancelTimer": 95, "NtSetTimer": 96, "NtAcceptConnectPort": 97, "NtAccessCheck": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientOfPort": 129, "NtAlpcOpenSenderProcess": 130, "NtAlpcOpenSenderThread": 131, "NtAlpcQueryInformation": 132, "NtAlpcQueryInformationMessage": 133, "NtAlpcRevokeSecurityContext": 134, "NtAlpcSendWaitReceivePort": 135, "NtAlpcSetInformation": 136, "NtAreMappedFilesTheSame": 137, "NtAssignProcessToJobObject": 138, "NtAssociateWaitCompletionPacket": 139, "NtCancelIoFileEx": 140, "NtCancelSynchronousIoFile": 141, "NtCancelWaitCompletionPacket": 142, "NtCommitComplete": 143, "NtCommitEnlistment": 144, "NtCommitTransaction": 145, "NtCompactKeys": 146, "NtCompareTokens": 147, "NtCompleteConnectPort": 148, "NtCompressKey": 149, "NtConnectPort": 150, "NtCreateDebugObject": 151, "NtCreateDirectoryObject": 152, "NtCreateDirectoryObjectEx": 153, "NtCreateEnlistment": 154, "NtCreateEventPair": 155, "NtCreateIRTimer": 156, "NtCreateIoCompletion": 157, "NtCreateJobObject": 158, "NtCreateJobSet": 159, "NtCreateKeyTransacted": 160, "NtCreateKeyedEvent": 161, "NtCreateLowBoxToken": 162, "NtCreateMailslotFile": 163, "NtCreateMutant": 164, "NtCreateNamedPipeFile": 165, "NtCreatePagingFile": 166, "NtCreatePort": 167, "NtCreatePrivateNamespace": 168, "NtCreateProcess": 169, "NtCreateProfile": 170, "NtCreateProfileEx": 171, "NtCreateResourceManager": 172, "NtCreateSemaphore": 173, "NtCreateSymbolicLinkObject": 174, "NtCreateThreadEx": 175, "NtCreateTimer": 176, "NtCreateToken": 177, "NtCreateTokenEx": 178, "NtCreateTransaction": 179, "NtCreateTransactionManager": 180, "NtCreateUserProcess": 181, "NtCreateWaitCompletionPacket": 182, "NtCreateWaitablePort": 183, "NtCreateWnfStateName": 184, "NtCreateWorkerFactory": 185, "NtDebugActiveProcess": 186, "NtDebugContinue": 187, "NtDeleteAtom": 188, "NtDeleteBootEntry": 189, "NtDeleteDriverEntry": 190, "NtDeleteFile": 191, "NtDeleteKey": 192, "NtDeleteObjectAuditAlarm": 193, "NtDeletePrivateNamespace": 194, "NtDeleteValueKey": 195, "NtDeleteWnfStateData": 196, "NtDeleteWnfStateName": 197, "NtDisableLastKnownGood": 198, "NtDisplayString": 199, "NtDrawText": 200, "NtEnableLastKnownGood": 201, "NtEnumerateBootEntries": 202, "NtEnumerateDriverEntries": 203, "NtEnumerateSystemEnvironmentValuesEx": 204, "NtEnumerateTransactionObject": 205, "NtExtendSection": 206, "NtFilterBootOption": 207, "NtFilterToken": 208, "NtFilterTokenEx": 209, "NtFlushBuffersFileEx": 210, "NtFlushInstallUILanguage": 211, "NtFlushInstructionCache": 212, "NtFlushKey": 213, "NtFlushProcessWriteBuffers": 214, "NtFlushVirtualMemory": 215, "NtFlushWriteBuffer": 216, "NtFreeUserPhysicalPages": 217, "NtFreezeRegistry": 218, "NtFreezeTransactions": 219, "NtGetCachedSigningLevel": 220, "NtGetContextThread": 221, "NtGetCurrentProcessorNumber": 222, "NtGetDevicePowerState": 223, "NtGetMUIRegistryInfo": 224, "NtGetNextProcess": 225, "NtGetNextThread": 226, "NtGetNlsSectionPtr": 227, "NtGetNotificationResourceManager": 228, "NtGetWriteWatch": 229, "NtImpersonateAnonymousToken": 230, "NtImpersonateThread": 231, "NtInitializeNlsFiles": 232, "NtInitializeRegistry": 233, "NtInitiatePowerAction": 234, "NtIsSystemResumeAutomatic": 235, "NtIsUILanguageComitted": 236, "NtListenPort": 237, "NtLoadDriver": 238, "NtLoadKey": 239, "NtLoadKey2": 240, "NtLoadKeyEx": 241, "NtLockFile": 242, "NtLockProductActivationKeys": 243, "NtLockRegistryKey": 244, "NtLockVirtualMemory": 245, "NtMakePermanentObject": 246, "NtMakeTemporaryObject": 247, "NtMapCMFModule": 248, "NtMapUserPhysicalPages": 249, "NtModifyBootEntry": 250, "NtModifyDriverEntry": 251, "NtNotifyChangeDirectoryFile": 252, "NtNotifyChangeKey": 253, "NtNotifyChangeMultipleKeys": 254, "NtNotifyChangeSession": 255, "NtOpenEnlistment": 256, "NtOpenEventPair": 257, "NtOpenIoCompletion": 258, "NtOpenJobObject": 259, "NtOpenKeyEx": 260, "NtOpenKeyTransacted": 261, "NtOpenKeyTransactedEx": 262, "NtOpenKeyedEvent": 263, "NtOpenMutant": 264, "NtOpenObjectAuditAlarm": 265, "NtOpenPrivateNamespace": 266, "NtOpenProcessToken": 267, "NtOpenResourceManager": 268, "NtOpenSemaphore": 269, "NtOpenSession": 270, "NtOpenSymbolicLinkObject": 271, "NtOpenThread": 272, "NtOpenTimer": 273, "NtOpenTransaction": 274, "NtOpenTransactionManager": 275, "NtPlugPlayControl": 276, "NtPrePrepareComplete": 277, "NtPrePrepareEnlistment": 278, "NtPrepareComplete": 279, "NtPrepareEnlistment": 280, "NtPrivilegeCheck": 281, "NtPrivilegeObjectAuditAlarm": 282, "NtPrivilegedServiceAuditAlarm": 283, "NtPropagationComplete": 284, "NtPropagationFailed": 285, "NtPulseEvent": 286, "NtQueryBootEntryOrder": 287, "NtQueryBootOptions": 288, "NtQueryDebugFilterState": 289, "NtQueryDirectoryObject": 290, "NtQueryDriverEntryOrder": 291, "NtQueryEaFile": 292, "NtQueryFullAttributesFile": 293, "NtQueryInformationAtom": 294, "NtQueryInformationEnlistment": 295, "NtQueryInformationJobObject": 296, "NtQueryInformationPort": 297, "NtQueryInformationResourceManager": 298, "NtQueryInformationTransaction": 299, "NtQueryInformationTransactionManager": 300, "NtQueryInformationWorkerFactory": 301, "NtQueryInstallUILanguage": 302, "NtQueryIntervalProfile": 303, "NtQueryIoCompletion": 304, "NtQueryLicenseValue": 305, "NtQueryMultipleValueKey": 306, "NtQueryMutant": 307, "NtQueryOpenSubKeys": 308, "NtQueryOpenSubKeysEx": 309, "NtQueryPortInformationProcess": 310, "NtQueryQuotaInformationFile": 311, "NtQuerySecurityAttributesToken": 312, "NtQuerySecurityObject": 313, "NtQuerySemaphore": 314, "NtQuerySymbolicLinkObject": 315, "NtQuerySystemEnvironmentValue": 316, "NtQuerySystemEnvironmentValueEx": 317, "NtQuerySystemInformationEx": 318, "NtQueryTimerResolution": 319, "NtQueryWnfStateData": 320, "NtQueryWnfStateNameInformation": 321, "NtQueueApcThreadEx": 322, "NtRaiseException": 323, "NtRaiseHardError": 324, "NtReadOnlyEnlistment": 325, "NtRecoverEnlistment": 326, "NtRecoverResourceManager": 327, "NtRecoverTransactionManager": 328, "NtRegisterProtocolAddressInformation": 329, "NtRegisterThreadTerminatePort": 330, "NtReleaseKeyedEvent": 331, "NtReleaseWorkerFactoryWorker": 332, "NtRemoveIoCompletionEx": 333, "NtRemoveProcessDebug": 334, "NtRenameKey": 335, "NtRenameTransactionManager": 336, "NtReplaceKey": 337, "NtReplacePartitionUnit": 338, "NtReplyWaitReplyPort": 339, "NtRequestPort": 340, "NtResetEvent": 341, "NtResetWriteWatch": 342, "NtRestoreKey": 343, "NtResumeProcess": 344, "NtRollbackComplete": 345, "NtRollbackEnlistment": 346, "NtRollbackTransaction": 347, "NtRollforwardTransactionManager": 348, "NtSaveKey": 349, "NtSaveKeyEx": 350, "NtSaveMergedKeys": 351, "NtSecureConnectPort": 352, "NtSerializeBoot": 353, "NtSetBootEntryOrder": 354, "NtSetBootOptions": 355, "NtSetCachedSigningLevel": 356, "NtSetContextThread": 357, "NtSetDebugFilterState": 358, "NtSetDefaultHardErrorPort": 359, "NtSetDefaultLocale": 360, "NtSetDefaultUILanguage": 361, "NtSetDriverEntryOrder": 362, "NtSetEaFile": 363, "NtSetHighEventPair": 364, "NtSetHighWaitLowEventPair": 365, "NtSetIRTimer": 366, "NtSetInformationDebugObject": 367, "NtSetInformationEnlistment": 368, "NtSetInformationJobObject": 369, "NtSetInformationKey": 370, "NtSetInformationResourceManager": 371, "NtSetInformationToken": 372, "NtSetInformationTransaction": 373, "NtSetInformationTransactionManager": 374, "NtSetInformationVirtualMemory": 375, "NtSetInformationWorkerFactory": 376, "NtSetIntervalProfile": 377, "NtSetIoCompletion": 378, "NtSetIoCompletionEx": 379, "NtSetLdtEntries": 380, "NtSetLowEventPair": 381, "NtSetLowWaitHighEventPair": 382, "NtSetQuotaInformationFile": 383, "NtSetSecurityObject": 384, "NtSetSystemEnvironmentValue": 385, "NtSetSystemEnvironmentValueEx": 386, "NtSetSystemInformation": 387, "NtSetSystemPowerState": 388, "NtSetSystemTime": 389, "NtSetThreadExecutionState": 390, "NtSetTimerEx": 391, "NtSetTimerResolution": 392, "NtSetUuidSeed": 393, "NtSetVolumeInformationFile": 394, "NtShutdownSystem": 395, "NtShutdownWorkerFactory": 396, "NtSignalAndWaitForSingleObject": 397, "NtSinglePhaseReject": 398, "NtStartProfile": 399, "NtStopProfile": 400, "NtSubscribeWnfStateChange": 401, "NtSuspendProcess": 402, "NtSuspendThread": 403, "NtSystemDebugControl": 404, "NtTerminateJobObject": 405, "NtTestAlert": 406, "NtThawRegistry": 407, "NtThawTransactions": 408, "NtTraceControl": 409, "NtTranslateFilePath": 410, "NtUmsThreadYield": 411, "NtUnloadDriver": 412, "NtUnloadKey": 413, "NtUnloadKey2": 414, "NtUnloadKeyEx": 415, "NtUnlockFile": 416, "NtUnlockVirtualMemory": 417, "NtUnmapViewOfSectionEx": 418, "NtUnsubscribeWnfStateChange": 419, "NtUpdateWnfStateData": 420, "NtVdmControl": 421, "NtWaitForAlertByThreadId": 422, "NtWaitForDebugEvent": 423, "NtWaitForKeyedEvent": 424, "NtWaitForWnfNotifications": 425, "NtWaitForWorkViaWorkerFactory": 426, "NtWaitHighEventPair": 427, "NtWaitLowEventPair": 428}, "8.1": {"NtWorkerFactoryWorkerReady": 0, "NtAcceptConnectPort": 1, "NtMapUserPhysicalPagesScatter": 2, "NtWaitForSingleObject": 3, "NtCallbackReturn": 4, "NtReadFile": 5, "NtDeviceIoControlFile": 6, "NtWriteFile": 7, "NtRemoveIoCompletion": 8, "NtReleaseSemaphore": 9, "NtReplyWaitReceivePort": 10, "NtReplyPort": 11, "NtSetInformationThread": 12, "NtSetEvent": 13, "NtClose": 14, "NtQueryObject": 15, "NtQueryInformationFile": 16, "NtOpenKey": 17, "NtEnumerateValueKey": 18, "NtFindAtom": 19, "NtQueryDefaultLocale": 20, "NtQueryKey": 21, "NtQueryValueKey": 22, "NtAllocateVirtualMemory": 23, "NtQueryInformationProcess": 24, "NtWaitForMultipleObjects32": 25, "NtWriteFileGather": 26, "NtSetInformationProcess": 27, "NtCreateKey": 28, "NtFreeVirtualMemory": 29, "NtImpersonateClientOfPort": 30, "NtReleaseMutant": 31, "NtQueryInformationToken": 32, "NtRequestWaitReplyPort": 33, "NtQueryVirtualMemory": 34, "NtOpenThreadToken": 35, "NtQueryInformationThread": 36, "NtOpenProcess": 37, "NtSetInformationFile": 38, "NtMapViewOfSection": 39, "NtAccessCheckAndAuditAlarm": 40, "NtUnmapViewOfSection": 41, "NtReplyWaitReceivePortEx": 42, "NtTerminateProcess": 43, "NtSetEventBoostPriority": 44, "NtReadFileScatter": 45, "NtOpenThreadTokenEx": 46, "NtOpenProcessTokenEx": 47, "NtQueryPerformanceCounter": 48, "NtEnumerateKey": 49, "NtOpenFile": 50, "NtDelayExecution": 51, "NtQueryDirectoryFile": 52, "NtQuerySystemInformation": 53, "NtOpenSection": 54, "NtQueryTimer": 55, "NtFsControlFile": 56, "NtWriteVirtualMemory": 57, "NtCloseObjectAuditAlarm": 58, "NtDuplicateObject": 59, "NtQueryAttributesFile": 60, "NtClearEvent": 61, "NtReadVirtualMemory": 62, "NtOpenEvent": 63, "NtAdjustPrivilegesToken": 64, "NtDuplicateToken": 65, "NtContinue": 66, "NtQueryDefaultUILanguage": 67, "NtQueueApcThread": 68, "NtYieldExecution": 69, "NtAddAtom": 70, "NtCreateEvent": 71, "NtQueryVolumeInformationFile": 72, "NtCreateSection": 73, "NtFlushBuffersFile": 74, "NtApphelpCacheControl": 75, "NtCreateProcessEx": 76, "NtCreateThread": 77, "NtIsProcessInJob": 78, "NtProtectVirtualMemory": 79, "NtQuerySection": 80, "NtResumeThread": 81, "NtTerminateThread": 82, "NtReadRequestData": 83, "NtCreateFile": 84, "NtQueryEvent": 85, "NtWriteRequestData": 86, "NtOpenDirectoryObject": 87, "NtAccessCheckByTypeAndAuditAlarm": 88, "NtQuerySystemTime": 89, "NtWaitForMultipleObjects": 90, "NtSetInformationObject": 91, "NtCancelIoFile": 92, "NtTraceEvent": 93, "NtPowerInformation": 94, "NtSetValueKey": 95, "NtCancelTimer": 96, "NtSetTimer": 97, "NtAccessCheck": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientOfPort": 129, "NtAlpcOpenSenderProcess": 130, "NtAlpcOpenSenderThread": 131, "NtAlpcQueryInformation": 132, "NtAlpcQueryInformationMessage": 133, "NtAlpcRevokeSecurityContext": 134, "NtAlpcSendWaitReceivePort": 135, "NtAlpcSetInformation": 136, "NtAreMappedFilesTheSame": 137, "NtAssignProcessToJobObject": 138, "NtAssociateWaitCompletionPacket": 139, "NtCancelIoFileEx": 140, "NtCancelSynchronousIoFile": 141, "NtCancelTimer2": 142, "NtCancelWaitCompletionPacket": 143, "NtCommitComplete": 144, "NtCommitEnlistment": 145, "NtCommitTransaction": 146, "NtCompactKeys": 147, "NtCompareTokens": 148, "NtCompleteConnectPort": 149, "NtCompressKey": 150, "NtConnectPort": 151, "NtCreateDebugObject": 152, "NtCreateDirectoryObject": 153, "NtCreateDirectoryObjectEx": 154, "NtCreateEnlistment": 155, "NtCreateEventPair": 156, "NtCreateIRTimer": 157, "NtCreateIoCompletion": 158, "NtCreateJobObject": 159, "NtCreateJobSet": 160, "NtCreateKeyTransacted": 161, "NtCreateKeyedEvent": 162, "NtCreateLowBoxToken": 163, "NtCreateMailslotFile": 164, "NtCreateMutant": 165, "NtCreateNamedPipeFile": 166, "NtCreatePagingFile": 167, "NtCreatePort": 168, "NtCreatePrivateNamespace": 169, "NtCreateProcess": 170, "NtCreateProfile": 171, "NtCreateProfileEx": 172, "NtCreateResourceManager": 173, "NtCreateSemaphore": 174, "NtCreateSymbolicLinkObject": 175, "NtCreateThreadEx": 176, "NtCreateTimer": 177, "NtCreateTimer2": 178, "NtCreateToken": 179, "NtCreateTokenEx": 180, "NtCreateTransaction": 181, "NtCreateTransactionManager": 182, "NtCreateUserProcess": 183, "NtCreateWaitCompletionPacket": 184, "NtCreateWaitablePort": 185, "NtCreateWnfStateName": 186, "NtCreateWorkerFactory": 187, "NtDebugActiveProcess": 188, "NtDebugContinue": 189, "NtDeleteAtom": 190, "NtDeleteBootEntry": 191, "NtDeleteDriverEntry": 192, "NtDeleteFile": 193, "NtDeleteKey": 194, "NtDeleteObjectAuditAlarm": 195, "NtDeletePrivateNamespace": 196, "NtDeleteValueKey": 197, "NtDeleteWnfStateData": 198, "NtDeleteWnfStateName": 199, "NtDisableLastKnownGood": 200, "NtDisplayString": 201, "NtDrawText": 202, "NtEnableLastKnownGood": 203, "NtEnumerateBootEntries": 204, "NtEnumerateDriverEntries": 205, "NtEnumerateSystemEnvironmentValuesEx": 206, "NtEnumerateTransactionObject": 207, "NtExtendSection": 208, "NtFilterBootOption": 209, "NtFilterToken": 210, "NtFilterTokenEx": 211, "NtFlushBuffersFileEx": 212, "NtFlushInstallUILanguage": 213, "NtFlushInstructionCache": 214, "NtFlushKey": 215, "NtFlushProcessWriteBuffers": 216, "NtFlushVirtualMemory": 217, "NtFlushWriteBuffer": 218, "NtFreeUserPhysicalPages": 219, "NtFreezeRegistry": 220, "NtFreezeTransactions": 221, "NtGetCachedSigningLevel": 222, "NtGetCompleteWnfStateSubscription": 223, "NtGetContextThread": 224, "NtGetCurrentProcessorNumber": 225, "NtGetDevicePowerState": 226, "NtGetMUIRegistryInfo": 227, "NtGetNextProcess": 228, "NtGetNextThread": 229, "NtGetNlsSectionPtr": 230, "NtGetNotificationResourceManager": 231, "NtGetWriteWatch": 232, "NtImpersonateAnonymousToken": 233, "NtImpersonateThread": 234, "NtInitializeNlsFiles": 235, "NtInitializeRegistry": 236, "NtInitiatePowerAction": 237, "NtIsSystemResumeAutomatic": 238, "NtIsUILanguageComitted": 239, "NtListenPort": 240, "NtLoadDriver": 241, "NtLoadKey": 242, "NtLoadKey2": 243, "NtLoadKeyEx": 244, "NtLockFile": 245, "NtLockProductActivationKeys": 246, "NtLockRegistryKey": 247, "NtLockVirtualMemory": 248, "NtMakePermanentObject": 249, "NtMakeTemporaryObject": 250, "NtMapCMFModule": 251, "NtMapUserPhysicalPages": 252, "NtModifyBootEntry": 253, "NtModifyDriverEntry": 254, "NtNotifyChangeDirectoryFile": 255, "NtNotifyChangeKey": 256, "NtNotifyChangeMultipleKeys": 257, "NtNotifyChangeSession": 258, "NtOpenEnlistment": 259, "NtOpenEventPair": 260, "NtOpenIoCompletion": 261, "NtOpenJobObject": 262, "NtOpenKeyEx": 263, "NtOpenKeyTransacted": 264, "NtOpenKeyTransactedEx": 265, "NtOpenKeyedEvent": 266, "NtOpenMutant": 267, "NtOpenObjectAuditAlarm": 268, "NtOpenPrivateNamespace": 269, "NtOpenProcessToken": 270, "NtOpenResourceManager": 271, "NtOpenSemaphore": 272, "NtOpenSession": 273, "NtOpenSymbolicLinkObject": 274, "NtOpenThread": 275, "NtOpenTimer": 276, "NtOpenTransaction": 277, "NtOpenTransactionManager": 278, "NtPlugPlayControl": 279, "NtPrePrepareComplete": 280, "NtPrePrepareEnlistment": 281, "NtPrepareComplete": 282, "NtPrepareEnlistment": 283, "NtPrivilegeCheck": 284, "NtPrivilegeObjectAuditAlarm": 285, "NtPrivilegedServiceAuditAlarm": 286, "NtPropagationComplete": 287, "NtPropagationFailed": 288, "NtPulseEvent": 289, "NtQueryBootEntryOrder": 290, "NtQueryBootOptions": 291, "NtQueryDebugFilterState": 292, "NtQueryDirectoryObject": 293, "NtQueryDriverEntryOrder": 294, "NtQueryEaFile": 295, "NtQueryFullAttributesFile": 296, "NtQueryInformationAtom": 297, "NtQueryInformationEnlistment": 298, "NtQueryInformationJobObject": 299, "NtQueryInformationPort": 300, "NtQueryInformationResourceManager": 301, "NtQueryInformationTransaction": 302, "NtQueryInformationTransactionManager": 303, "NtQueryInformationWorkerFactory": 304, "NtQueryInstallUILanguage": 305, "NtQueryIntervalProfile": 306, "NtQueryIoCompletion": 307, "NtQueryLicenseValue": 308, "NtQueryMultipleValueKey": 309, "NtQueryMutant": 310, "NtQueryOpenSubKeys": 311, "NtQueryOpenSubKeysEx": 312, "NtQueryPortInformationProcess": 313, "NtQueryQuotaInformationFile": 314, "NtQuerySecurityAttributesToken": 315, "NtQuerySecurityObject": 316, "NtQuerySemaphore": 317, "NtQuerySymbolicLinkObject": 318, "NtQuerySystemEnvironmentValue": 319, "NtQuerySystemEnvironmentValueEx": 320, "NtQuerySystemInformationEx": 321, "NtQueryTimerResolution": 322, "NtQueryWnfStateData": 323, "NtQueryWnfStateNameInformation": 324, "NtQueueApcThreadEx": 325, "NtRaiseException": 326, "NtRaiseHardError": 327, "NtReadOnlyEnlistment": 328, "NtRecoverEnlistment": 329, "NtRecoverResourceManager": 330, "NtRecoverTransactionManager": 331, "NtRegisterProtocolAddressInformation": 332, "NtRegisterThreadTerminatePort": 333, "NtReleaseKeyedEvent": 334, "NtReleaseWorkerFactoryWorker": 335, "NtRemoveIoCompletionEx": 336, "NtRemoveProcessDebug": 337, "NtRenameKey": 338, "NtRenameTransactionManager": 339, "NtReplaceKey": 340, "NtReplacePartitionUnit": 341, "NtReplyWaitReplyPort": 342, "NtRequestPort": 343, "NtResetEvent": 344, "NtResetWriteWatch": 345, "NtRestoreKey": 346, "NtResumeProcess": 347, "NtRollbackComplete": 348, "NtRollbackEnlistment": 349, "NtRollbackTransaction": 350, "NtRollforwardTransactionManager": 351, "NtSaveKey": 352, "NtSaveKeyEx": 353, "NtSaveMergedKeys": 354, "NtSecureConnectPort": 355, "NtSerializeBoot": 356, "NtSetBootEntryOrder": 357, "NtSetBootOptions": 358, "NtSetCachedSigningLevel": 359, "NtSetContextThread": 360, "NtSetDebugFilterState": 361, "NtSetDefaultHardErrorPort": 362, "NtSetDefaultLocale": 363, "NtSetDefaultUILanguage": 364, "NtSetDriverEntryOrder": 365, "NtSetEaFile": 366, "NtSetHighEventPair": 367, "NtSetHighWaitLowEventPair": 368, "NtSetIRTimer": 369, "NtSetInformationDebugObject": 370, "NtSetInformationEnlistment": 371, "NtSetInformationJobObject": 372, "NtSetInformationKey": 373, "NtSetInformationResourceManager": 374, "NtSetInformationToken": 375, "NtSetInformationTransaction": 376, "NtSetInformationTransactionManager": 377, "NtSetInformationVirtualMemory": 378, "NtSetInformationWorkerFactory": 379, "NtSetIntervalProfile": 380, "NtSetIoCompletion": 381, "NtSetIoCompletionEx": 382, "NtSetLdtEntries": 383, "NtSetLowEventPair": 384, "NtSetLowWaitHighEventPair": 385, "NtSetQuotaInformationFile": 386, "NtSetSecurityObject": 387, "NtSetSystemEnvironmentValue": 388, "NtSetSystemEnvironmentValueEx": 389, "NtSetSystemInformation": 390, "NtSetSystemPowerState": 391, "NtSetSystemTime": 392, "NtSetThreadExecutionState": 393, "NtSetTimer2": 394, "NtSetTimerEx": 395, "NtSetTimerResolution": 396, "NtSetUuidSeed": 397, "NtSetVolumeInformationFile": 398, "NtSetWnfProcessNotificationEvent": 399, "NtShutdownSystem": 400, "NtShutdownWorkerFactory": 401, "NtSignalAndWaitForSingleObject": 402, "NtSinglePhaseReject": 403, "NtStartProfile": 404, "NtStopProfile": 405, "NtSubscribeWnfStateChange": 406, "NtSuspendProcess": 407, "NtSuspendThread": 408, "NtSystemDebugControl": 409, "NtTerminateJobObject": 410, "NtTestAlert": 411, "NtThawRegistry": 412, "NtThawTransactions": 413, "NtTraceControl": 414, "NtTranslateFilePath": 415, "NtUmsThreadYield": 416, "NtUnloadDriver": 417, "NtUnloadKey": 418, "NtUnloadKey2": 419, "NtUnloadKeyEx": 420, "NtUnlockFile": 421, "NtUnlockVirtualMemory": 422, "NtUnmapViewOfSectionEx": 423, "NtUnsubscribeWnfStateChange": 424, "NtUpdateWnfStateData": 425, "NtVdmControl": 426, "NtWaitForAlertByThreadId": 427, "NtWaitForDebugEvent": 428, "NtWaitForKeyedEvent": 429, "NtWaitForWorkViaWorkerFactory": 430, "NtWaitHighEventPair": 431, "NtWaitLowEventPair": 432}}, "Windows 10": {"1507": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientContainerOfPort": 129, "NtAlpcImpersonateClientOfPort": 130, "NtAlpcOpenSenderProcess": 131, "NtAlpcOpenSenderThread": 132, "NtAlpcQueryInformation": 133, "NtAlpcQueryInformationMessage": 134, "NtAlpcRevokeSecurityContext": 135, "NtAlpcSendWaitReceivePort": 136, "NtAlpcSetInformation": 137, "NtAreMappedFilesTheSame": 138, "NtAssignProcessToJobObject": 139, "NtAssociateWaitCompletionPacket": 140, "NtCancelIoFileEx": 141, "NtCancelSynchronousIoFile": 142, "NtCancelTimer2": 143, "NtCancelWaitCompletionPacket": 144, "NtCommitComplete": 145, "NtCommitEnlistment": 146, "NtCommitTransaction": 147, "NtCompactKeys": 148, "NtCompareObjects": 149, "NtCompareTokens": 150, "NtCompleteConnectPort": 151, "NtCompressKey": 152, "NtConnectPort": 153, "NtCreateDebugObject": 154, "NtCreateDirectoryObject": 155, "NtCreateDirectoryObjectEx": 156, "NtCreateEnlistment": 157, "NtCreateEventPair": 158, "NtCreateIRTimer": 159, "NtCreateIoCompletion": 160, "NtCreateJobObject": 161, "NtCreateJobSet": 162, "NtCreateKeyTransacted": 163, "NtCreateKeyedEvent": 164, "NtCreateLowBoxToken": 165, "NtCreateMailslotFile": 166, "NtCreateMutant": 167, "NtCreateNamedPipeFile": 168, "NtCreatePagingFile": 169, "NtCreatePartition": 170, "NtCreatePort": 171, "NtCreatePrivateNamespace": 172, "NtCreateProcess": 173, "NtCreateProfile": 174, "NtCreateProfileEx": 175, "NtCreateResourceManager": 176, "NtCreateSemaphore": 177, "NtCreateSymbolicLinkObject": 178, "NtCreateThreadEx": 179, "NtCreateTimer": 180, "NtCreateTimer2": 181, "NtCreateToken": 182, "NtCreateTokenEx": 183, "NtCreateTransaction": 184, "NtCreateTransactionManager": 185, "NtCreateUserProcess": 186, "NtCreateWaitCompletionPacket": 187, "NtCreateWaitablePort": 188, "NtCreateWnfStateName": 189, "NtCreateWorkerFactory": 190, "NtDebugActiveProcess": 191, "NtDebugContinue": 192, "NtDeleteAtom": 193, "NtDeleteBootEntry": 194, "NtDeleteDriverEntry": 195, "NtDeleteFile": 196, "NtDeleteKey": 197, "NtDeleteObjectAuditAlarm": 198, "NtDeletePrivateNamespace": 199, "NtDeleteValueKey": 200, "NtDeleteWnfStateData": 201, "NtDeleteWnfStateName": 202, "NtDisableLastKnownGood": 203, "NtDisplayString": 204, "NtDrawText": 205, "NtEnableLastKnownGood": 206, "NtEnumerateBootEntries": 207, "NtEnumerateDriverEntries": 208, "NtEnumerateSystemEnvironmentValuesEx": 209, "NtEnumerateTransactionObject": 210, "NtExtendSection": 211, "NtFilterBootOption": 212, "NtFilterToken": 213, "NtFilterTokenEx": 214, "NtFlushBuffersFileEx": 215, "NtFlushInstallUILanguage": 216, "NtFlushInstructionCache": 217, "NtFlushKey": 218, "NtFlushProcessWriteBuffers": 219, "NtFlushVirtualMemory": 220, "NtFlushWriteBuffer": 221, "NtFreeUserPhysicalPages": 222, "NtFreezeRegistry": 223, "NtFreezeTransactions": 224, "NtGetCachedSigningLevel": 225, "NtGetCompleteWnfStateSubscription": 226, "NtGetContextThread": 227, "NtGetCurrentProcessorNumber": 228, "NtGetCurrentProcessorNumberEx": 229, "NtGetDevicePowerState": 230, "NtGetMUIRegistryInfo": 231, "NtGetNextProcess": 232, "NtGetNextThread": 233, "NtGetNlsSectionPtr": 234, "NtGetNotificationResourceManager": 235, "NtGetWriteWatch": 236, "NtImpersonateAnonymousToken": 237, "NtImpersonateThread": 238, "NtInitializeNlsFiles": 239, "NtInitializeRegistry": 240, "NtInitiatePowerAction": 241, "NtIsSystemResumeAutomatic": 242, "NtIsUILanguageComitted": 243, "NtListenPort": 244, "NtLoadDriver": 245, "NtLoadKey": 246, "NtLoadKey2": 247, "NtLoadKeyEx": 248, "NtLockFile": 249, "NtLockProductActivationKeys": 250, "NtLockRegistryKey": 251, "NtLockVirtualMemory": 252, "NtMakePermanentObject": 253, "NtMakeTemporaryObject": 254, "NtManagePartition": 255, "NtMapCMFModule": 256, "NtMapUserPhysicalPages": 257, "NtModifyBootEntry": 258, "NtModifyDriverEntry": 259, "NtNotifyChangeDirectoryFile": 260, "NtNotifyChangeKey": 261, "NtNotifyChangeMultipleKeys": 262, "NtNotifyChangeSession": 263, "NtOpenEnlistment": 264, "NtOpenEventPair": 265, "NtOpenIoCompletion": 266, "NtOpenJobObject": 267, "NtOpenKeyEx": 268, "NtOpenKeyTransacted": 269, "NtOpenKeyTransactedEx": 270, "NtOpenKeyedEvent": 271, "NtOpenMutant": 272, "NtOpenObjectAuditAlarm": 273, "NtOpenPartition": 274, "NtOpenPrivateNamespace": 275, "NtOpenProcessToken": 276, "NtOpenResourceManager": 277, "NtOpenSemaphore": 278, "NtOpenSession": 279, "NtOpenSymbolicLinkObject": 280, "NtOpenThread": 281, "NtOpenTimer": 282, "NtOpenTransaction": 283, "NtOpenTransactionManager": 284, "NtPlugPlayControl": 285, "NtPrePrepareComplete": 286, "NtPrePrepareEnlistment": 287, "NtPrepareComplete": 288, "NtPrepareEnlistment": 289, "NtPrivilegeCheck": 290, "NtPrivilegeObjectAuditAlarm": 291, "NtPrivilegedServiceAuditAlarm": 292, "NtPropagationComplete": 293, "NtPropagationFailed": 294, "NtPulseEvent": 295, "NtQueryBootEntryOrder": 296, "NtQueryBootOptions": 297, "NtQueryDebugFilterState": 298, "NtQueryDirectoryObject": 299, "NtQueryDriverEntryOrder": 300, "NtQueryEaFile": 301, "NtQueryFullAttributesFile": 302, "NtQueryInformationAtom": 303, "NtQueryInformationEnlistment": 304, "NtQueryInformationJobObject": 305, "NtQueryInformationPort": 306, "NtQueryInformationResourceManager": 307, "NtQueryInformationTransaction": 308, "NtQueryInformationTransactionManager": 309, "NtQueryInformationWorkerFactory": 310, "NtQueryInstallUILanguage": 311, "NtQueryIntervalProfile": 312, "NtQueryIoCompletion": 313, "NtQueryLicenseValue": 314, "NtQueryMultipleValueKey": 315, "NtQueryMutant": 316, "NtQueryOpenSubKeys": 317, "NtQueryOpenSubKeysEx": 318, "NtQueryPortInformationProcess": 319, "NtQueryQuotaInformationFile": 320, "NtQuerySecurityAttributesToken": 321, "NtQuerySecurityObject": 322, "NtQuerySemaphore": 323, "NtQuerySymbolicLinkObject": 324, "NtQuerySystemEnvironmentValue": 325, "NtQuerySystemEnvironmentValueEx": 326, "NtQuerySystemInformationEx": 327, "NtQueryTimerResolution": 328, "NtQueryWnfStateData": 329, "NtQueryWnfStateNameInformation": 330, "NtQueueApcThreadEx": 331, "NtRaiseException": 332, "NtRaiseHardError": 333, "NtReadOnlyEnlistment": 334, "NtRecoverEnlistment": 335, "NtRecoverResourceManager": 336, "NtRecoverTransactionManager": 337, "NtRegisterProtocolAddressInformation": 338, "NtRegisterThreadTerminatePort": 339, "NtReleaseKeyedEvent": 340, "NtReleaseWorkerFactoryWorker": 341, "NtRemoveIoCompletionEx": 342, "NtRemoveProcessDebug": 343, "NtRenameKey": 344, "NtRenameTransactionManager": 345, "NtReplaceKey": 346, "NtReplacePartitionUnit": 347, "NtReplyWaitReplyPort": 348, "NtRequestPort": 349, "NtResetEvent": 350, "NtResetWriteWatch": 351, "NtRestoreKey": 352, "NtResumeProcess": 353, "NtRevertContainerImpersonation": 354, "NtRollbackComplete": 355, "NtRollbackEnlistment": 356, "NtRollbackTransaction": 357, "NtRollforwardTransactionManager": 358, "NtSaveKey": 359, "NtSaveKeyEx": 360, "NtSaveMergedKeys": 361, "NtSecureConnectPort": 362, "NtSerializeBoot": 363, "NtSetBootEntryOrder": 364, "NtSetBootOptions": 365, "NtSetCachedSigningLevel": 366, "NtSetContextThread": 367, "NtSetDebugFilterState": 368, "NtSetDefaultHardErrorPort": 369, "NtSetDefaultLocale": 370, "NtSetDefaultUILanguage": 371, "NtSetDriverEntryOrder": 372, "NtSetEaFile": 373, "NtSetHighEventPair": 374, "NtSetHighWaitLowEventPair": 375, "NtSetIRTimer": 376, "NtSetInformationDebugObject": 377, "NtSetInformationEnlistment": 378, "NtSetInformationJobObject": 379, "NtSetInformationKey": 380, "NtSetInformationResourceManager": 381, "NtSetInformationSymbolicLink": 382, "NtSetInformationToken": 383, "NtSetInformationTransaction": 384, "NtSetInformationTransactionManager": 385, "NtSetInformationVirtualMemory": 386, "NtSetInformationWorkerFactory": 387, "NtSetIntervalProfile": 388, "NtSetIoCompletion": 389, "NtSetIoCompletionEx": 390, "NtSetLdtEntries": 391, "NtSetLowEventPair": 392, "NtSetLowWaitHighEventPair": 393, "NtSetQuotaInformationFile": 394, "NtSetSecurityObject": 395, "NtSetSystemEnvironmentValue": 396, "NtSetSystemEnvironmentValueEx": 397, "NtSetSystemInformation": 398, "NtSetSystemPowerState": 399, "NtSetSystemTime": 400, "NtSetThreadExecutionState": 401, "NtSetTimer2": 402, "NtSetTimerEx": 403, "NtSetTimerResolution": 404, "NtSetUuidSeed": 405, "NtSetVolumeInformationFile": 406, "NtSetWnfProcessNotificationEvent": 407, "NtShutdownSystem": 408, "NtShutdownWorkerFactory": 409, "NtSignalAndWaitForSingleObject": 410, "NtSinglePhaseReject": 411, "NtStartProfile": 412, "NtStopProfile": 413, "NtSubscribeWnfStateChange": 414, "NtSuspendProcess": 415, "NtSuspendThread": 416, "NtSystemDebugControl": 417, "NtTerminateJobObject": 418, "NtTestAlert": 419, "NtThawRegistry": 420, "NtThawTransactions": 421, "NtTraceControl": 422, "NtTranslateFilePath": 423, "NtUmsThreadYield": 424, "NtUnloadDriver": 425, "NtUnloadKey": 426, "NtUnloadKey2": 427, "NtUnloadKeyEx": 428, "NtUnlockFile": 429, "NtUnlockVirtualMemory": 430, "NtUnmapViewOfSectionEx": 431, "NtUnsubscribeWnfStateChange": 432, "NtUpdateWnfStateData": 433, "NtVdmControl": 434, "NtWaitForAlertByThreadId": 435, "NtWaitForDebugEvent": 436, "NtWaitForKeyedEvent": 437, "NtWaitForWorkViaWorkerFactory": 438, "NtWaitHighEventPair": 439, "NtWaitLowEventPair": 440}, "1511": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientContainerOfPort": 129, "NtAlpcImpersonateClientOfPort": 130, "NtAlpcOpenSenderProcess": 131, "NtAlpcOpenSenderThread": 132, "NtAlpcQueryInformation": 133, "NtAlpcQueryInformationMessage": 134, "NtAlpcRevokeSecurityContext": 135, "NtAlpcSendWaitReceivePort": 136, "NtAlpcSetInformation": 137, "NtAreMappedFilesTheSame": 138, "NtAssignProcessToJobObject": 139, "NtAssociateWaitCompletionPacket": 140, "NtCancelIoFileEx": 141, "NtCancelSynchronousIoFile": 142, "NtCancelTimer2": 143, "NtCancelWaitCompletionPacket": 144, "NtCommitComplete": 145, "NtCommitEnlistment": 146, "NtCommitTransaction": 147, "NtCompactKeys": 148, "NtCompareObjects": 149, "NtCompareTokens": 150, "NtCompleteConnectPort": 151, "NtCompressKey": 152, "NtConnectPort": 153, "NtCreateDebugObject": 154, "NtCreateDirectoryObject": 155, "NtCreateDirectoryObjectEx": 156, "NtCreateEnclave": 157, "NtCreateEnlistment": 158, "NtCreateEventPair": 159, "NtCreateIRTimer": 160, "NtCreateIoCompletion": 161, "NtCreateJobObject": 162, "NtCreateJobSet": 163, "NtCreateKeyTransacted": 164, "NtCreateKeyedEvent": 165, "NtCreateLowBoxToken": 166, "NtCreateMailslotFile": 167, "NtCreateMutant": 168, "NtCreateNamedPipeFile": 169, "NtCreatePagingFile": 170, "NtCreatePartition": 171, "NtCreatePort": 172, "NtCreatePrivateNamespace": 173, "NtCreateProcess": 174, "NtCreateProfile": 175, "NtCreateProfileEx": 176, "NtCreateResourceManager": 177, "NtCreateSemaphore": 178, "NtCreateSymbolicLinkObject": 179, "NtCreateThreadEx": 180, "NtCreateTimer": 181, "NtCreateTimer2": 182, "NtCreateToken": 183, "NtCreateTokenEx": 184, "NtCreateTransaction": 185, "NtCreateTransactionManager": 186, "NtCreateUserProcess": 187, "NtCreateWaitCompletionPacket": 188, "NtCreateWaitablePort": 189, "NtCreateWnfStateName": 190, "NtCreateWorkerFactory": 191, "NtDebugActiveProcess": 192, "NtDebugContinue": 193, "NtDeleteAtom": 194, "NtDeleteBootEntry": 195, "NtDeleteDriverEntry": 196, "NtDeleteFile": 197, "NtDeleteKey": 198, "NtDeleteObjectAuditAlarm": 199, "NtDeletePrivateNamespace": 200, "NtDeleteValueKey": 201, "NtDeleteWnfStateData": 202, "NtDeleteWnfStateName": 203, "NtDisableLastKnownGood": 204, "NtDisplayString": 205, "NtDrawText": 206, "NtEnableLastKnownGood": 207, "NtEnumerateBootEntries": 208, "NtEnumerateDriverEntries": 209, "NtEnumerateSystemEnvironmentValuesEx": 210, "NtEnumerateTransactionObject": 211, "NtExtendSection": 212, "NtFilterBootOption": 213, "NtFilterToken": 214, "NtFilterTokenEx": 215, "NtFlushBuffersFileEx": 216, "NtFlushInstallUILanguage": 217, "NtFlushInstructionCache": 218, "NtFlushKey": 219, "NtFlushProcessWriteBuffers": 220, "NtFlushVirtualMemory": 221, "NtFlushWriteBuffer": 222, "NtFreeUserPhysicalPages": 223, "NtFreezeRegistry": 224, "NtFreezeTransactions": 225, "NtGetCachedSigningLevel": 226, "NtGetCompleteWnfStateSubscription": 227, "NtGetContextThread": 228, "NtGetCurrentProcessorNumber": 229, "NtGetCurrentProcessorNumberEx": 230, "NtGetDevicePowerState": 231, "NtGetMUIRegistryInfo": 232, "NtGetNextProcess": 233, "NtGetNextThread": 234, "NtGetNlsSectionPtr": 235, "NtGetNotificationResourceManager": 236, "NtGetWriteWatch": 237, "NtImpersonateAnonymousToken": 238, "NtImpersonateThread": 239, "NtInitializeEnclave": 240, "NtInitializeNlsFiles": 241, "NtInitializeRegistry": 242, "NtInitiatePowerAction": 243, "NtIsSystemResumeAutomatic": 244, "NtIsUILanguageComitted": 245, "NtListenPort": 246, "NtLoadDriver": 247, "NtLoadEnclaveData": 248, "NtLoadKey": 249, "NtLoadKey2": 250, "NtLoadKeyEx": 251, "NtLockFile": 252, "NtLockProductActivationKeys": 253, "NtLockRegistryKey": 254, "NtLockVirtualMemory": 255, "NtMakePermanentObject": 256, "NtMakeTemporaryObject": 257, "NtManagePartition": 258, "NtMapCMFModule": 259, "NtMapUserPhysicalPages": 260, "NtModifyBootEntry": 261, "NtModifyDriverEntry": 262, "NtNotifyChangeDirectoryFile": 263, "NtNotifyChangeKey": 264, "NtNotifyChangeMultipleKeys": 265, "NtNotifyChangeSession": 266, "NtOpenEnlistment": 267, "NtOpenEventPair": 268, "NtOpenIoCompletion": 269, "NtOpenJobObject": 270, "NtOpenKeyEx": 271, "NtOpenKeyTransacted": 272, "NtOpenKeyTransactedEx": 273, "NtOpenKeyedEvent": 274, "NtOpenMutant": 275, "NtOpenObjectAuditAlarm": 276, "NtOpenPartition": 277, "NtOpenPrivateNamespace": 278, "NtOpenProcessToken": 279, "NtOpenResourceManager": 280, "NtOpenSemaphore": 281, "NtOpenSession": 282, "NtOpenSymbolicLinkObject": 283, "NtOpenThread": 284, "NtOpenTimer": 285, "NtOpenTransaction": 286, "NtOpenTransactionManager": 287, "NtPlugPlayControl": 288, "NtPrePrepareComplete": 289, "NtPrePrepareEnlistment": 290, "NtPrepareComplete": 291, "NtPrepareEnlistment": 292, "NtPrivilegeCheck": 293, "NtPrivilegeObjectAuditAlarm": 294, "NtPrivilegedServiceAuditAlarm": 295, "NtPropagationComplete": 296, "NtPropagationFailed": 297, "NtPulseEvent": 298, "NtQueryBootEntryOrder": 299, "NtQueryBootOptions": 300, "NtQueryDebugFilterState": 301, "NtQueryDirectoryObject": 302, "NtQueryDriverEntryOrder": 303, "NtQueryEaFile": 304, "NtQueryFullAttributesFile": 305, "NtQueryInformationAtom": 306, "NtQueryInformationEnlistment": 307, "NtQueryInformationJobObject": 308, "NtQueryInformationPort": 309, "NtQueryInformationResourceManager": 310, "NtQueryInformationTransaction": 311, "NtQueryInformationTransactionManager": 312, "NtQueryInformationWorkerFactory": 313, "NtQueryInstallUILanguage": 314, "NtQueryIntervalProfile": 315, "NtQueryIoCompletion": 316, "NtQueryLicenseValue": 317, "NtQueryMultipleValueKey": 318, "NtQueryMutant": 319, "NtQueryOpenSubKeys": 320, "NtQueryOpenSubKeysEx": 321, "NtQueryPortInformationProcess": 322, "NtQueryQuotaInformationFile": 323, "NtQuerySecurityAttributesToken": 324, "NtQuerySecurityObject": 325, "NtQuerySemaphore": 326, "NtQuerySymbolicLinkObject": 327, "NtQuerySystemEnvironmentValue": 328, "NtQuerySystemEnvironmentValueEx": 329, "NtQuerySystemInformationEx": 330, "NtQueryTimerResolution": 331, "NtQueryWnfStateData": 332, "NtQueryWnfStateNameInformation": 333, "NtQueueApcThreadEx": 334, "NtRaiseException": 335, "NtRaiseHardError": 336, "NtReadOnlyEnlistment": 337, "NtRecoverEnlistment": 338, "NtRecoverResourceManager": 339, "NtRecoverTransactionManager": 340, "NtRegisterProtocolAddressInformation": 341, "NtRegisterThreadTerminatePort": 342, "NtReleaseKeyedEvent": 343, "NtReleaseWorkerFactoryWorker": 344, "NtRemoveIoCompletionEx": 345, "NtRemoveProcessDebug": 346, "NtRenameKey": 347, "NtRenameTransactionManager": 348, "NtReplaceKey": 349, "NtReplacePartitionUnit": 350, "NtReplyWaitReplyPort": 351, "NtRequestPort": 352, "NtResetEvent": 353, "NtResetWriteWatch": 354, "NtRestoreKey": 355, "NtResumeProcess": 356, "NtRevertContainerImpersonation": 357, "NtRollbackComplete": 358, "NtRollbackEnlistment": 359, "NtRollbackTransaction": 360, "NtRollforwardTransactionManager": 361, "NtSaveKey": 362, "NtSaveKeyEx": 363, "NtSaveMergedKeys": 364, "NtSecureConnectPort": 365, "NtSerializeBoot": 366, "NtSetBootEntryOrder": 367, "NtSetBootOptions": 368, "NtSetCachedSigningLevel": 369, "NtSetContextThread": 370, "NtSetDebugFilterState": 371, "NtSetDefaultHardErrorPort": 372, "NtSetDefaultLocale": 373, "NtSetDefaultUILanguage": 374, "NtSetDriverEntryOrder": 375, "NtSetEaFile": 376, "NtSetHighEventPair": 377, "NtSetHighWaitLowEventPair": 378, "NtSetIRTimer": 379, "NtSetInformationDebugObject": 380, "NtSetInformationEnlistment": 381, "NtSetInformationJobObject": 382, "NtSetInformationKey": 383, "NtSetInformationResourceManager": 384, "NtSetInformationSymbolicLink": 385, "NtSetInformationToken": 386, "NtSetInformationTransaction": 387, "NtSetInformationTransactionManager": 388, "NtSetInformationVirtualMemory": 389, "NtSetInformationWorkerFactory": 390, "NtSetIntervalProfile": 391, "NtSetIoCompletion": 392, "NtSetIoCompletionEx": 393, "NtSetLdtEntries": 394, "NtSetLowEventPair": 395, "NtSetLowWaitHighEventPair": 396, "NtSetQuotaInformationFile": 397, "NtSetSecurityObject": 398, "NtSetSystemEnvironmentValue": 399, "NtSetSystemEnvironmentValueEx": 400, "NtSetSystemInformation": 401, "NtSetSystemPowerState": 402, "NtSetSystemTime": 403, "NtSetThreadExecutionState": 404, "NtSetTimer2": 405, "NtSetTimerEx": 406, "NtSetTimerResolution": 407, "NtSetUuidSeed": 408, "NtSetVolumeInformationFile": 409, "NtSetWnfProcessNotificationEvent": 410, "NtShutdownSystem": 411, "NtShutdownWorkerFactory": 412, "NtSignalAndWaitForSingleObject": 413, "NtSinglePhaseReject": 414, "NtStartProfile": 415, "NtStopProfile": 416, "NtSubscribeWnfStateChange": 417, "NtSuspendProcess": 418, "NtSuspendThread": 419, "NtSystemDebugControl": 420, "NtTerminateJobObject": 421, "NtTestAlert": 422, "NtThawRegistry": 423, "NtThawTransactions": 424, "NtTraceControl": 425, "NtTranslateFilePath": 426, "NtUmsThreadYield": 427, "NtUnloadDriver": 428, "NtUnloadKey": 429, "NtUnloadKey2": 430, "NtUnloadKeyEx": 431, "NtUnlockFile": 432, "NtUnlockVirtualMemory": 433, "NtUnmapViewOfSectionEx": 434, "NtUnsubscribeWnfStateChange": 435, "NtUpdateWnfStateData": 436, "NtVdmControl": 437, "NtWaitForAlertByThreadId": 438, "NtWaitForDebugEvent": 439, "NtWaitForKeyedEvent": 440, "NtWaitForWorkViaWorkerFactory": 441, "NtWaitHighEventPair": 442, "NtWaitLowEventPair": 443}, "1607": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 103, "NtAddBootEntry": 104, "NtAddDriverEntry": 105, "NtAdjustGroupsToken": 106, "NtAdjustTokenClaimsAndDeviceGroups": 107, "NtAlertResumeThread": 108, "NtAlertThread": 109, "NtAlertThreadByThreadId": 110, "NtAllocateLocallyUniqueId": 111, "NtAllocateReserveObject": 112, "NtAllocateUserPhysicalPages": 113, "NtAllocateUuids": 114, "NtAlpcAcceptConnectPort": 115, "NtAlpcCancelMessage": 116, "NtAlpcConnectPort": 117, "NtAlpcConnectPortEx": 118, "NtAlpcCreatePort": 119, "NtAlpcCreatePortSection": 120, "NtAlpcCreateResourceReserve": 121, "NtAlpcCreateSectionView": 122, "NtAlpcCreateSecurityContext": 123, "NtAlpcDeletePortSection": 124, "NtAlpcDeleteResourceReserve": 125, "NtAlpcDeleteSectionView": 126, "NtAlpcDeleteSecurityContext": 127, "NtAlpcDisconnectPort": 128, "NtAlpcImpersonateClientContainerOfPort": 129, "NtAlpcImpersonateClientOfPort": 130, "NtAlpcOpenSenderProcess": 131, "NtAlpcOpenSenderThread": 132, "NtAlpcQueryInformation": 133, "NtAlpcQueryInformationMessage": 134, "NtAlpcRevokeSecurityContext": 135, "NtAlpcSendWaitReceivePort": 136, "NtAlpcSetInformation": 137, "NtAreMappedFilesTheSame": 138, "NtAssignProcessToJobObject": 139, "NtAssociateWaitCompletionPacket": 140, "NtCancelIoFileEx": 141, "NtCancelSynchronousIoFile": 142, "NtCancelTimer2": 143, "NtCancelWaitCompletionPacket": 144, "NtCommitComplete": 145, "NtCommitEnlistment": 146, "NtCommitRegistryTransaction": 147, "NtCommitTransaction": 148, "NtCompactKeys": 149, "NtCompareObjects": 150, "NtCompareTokens": 151, "NtCompleteConnectPort": 152, "NtCompressKey": 153, "NtConnectPort": 154, "NtCreateDebugObject": 155, "NtCreateDirectoryObject": 156, "NtCreateDirectoryObjectEx": 157, "NtCreateEnclave": 158, "NtCreateEnlistment": 159, "NtCreateEventPair": 160, "NtCreateIRTimer": 161, "NtCreateIoCompletion": 162, "NtCreateJobObject": 163, "NtCreateJobSet": 164, "NtCreateKeyTransacted": 165, "NtCreateKeyedEvent": 166, "NtCreateLowBoxToken": 167, "NtCreateMailslotFile": 168, "NtCreateMutant": 169, "NtCreateNamedPipeFile": 170, "NtCreatePagingFile": 171, "NtCreatePartition": 172, "NtCreatePort": 173, "NtCreatePrivateNamespace": 174, "NtCreateProcess": 175, "NtCreateProfile": 176, "NtCreateProfileEx": 177, "NtCreateRegistryTransaction": 178, "NtCreateResourceManager": 179, "NtCreateSemaphore": 180, "NtCreateSymbolicLinkObject": 181, "NtCreateThreadEx": 182, "NtCreateTimer": 183, "NtCreateTimer2": 184, "NtCreateToken": 185, "NtCreateTokenEx": 186, "NtCreateTransaction": 187, "NtCreateTransactionManager": 188, "NtCreateUserProcess": 189, "NtCreateWaitCompletionPacket": 190, "NtCreateWaitablePort": 191, "NtCreateWnfStateName": 192, "NtCreateWorkerFactory": 193, "NtDebugActiveProcess": 194, "NtDebugContinue": 195, "NtDeleteAtom": 196, "NtDeleteBootEntry": 197, "NtDeleteDriverEntry": 198, "NtDeleteFile": 199, "NtDeleteKey": 200, "NtDeleteObjectAuditAlarm": 201, "NtDeletePrivateNamespace": 202, "NtDeleteValueKey": 203, "NtDeleteWnfStateData": 204, "NtDeleteWnfStateName": 205, "NtDisableLastKnownGood": 206, "NtDisplayString": 207, "NtDrawText": 208, "NtEnableLastKnownGood": 209, "NtEnumerateBootEntries": 210, "NtEnumerateDriverEntries": 211, "NtEnumerateSystemEnvironmentValuesEx": 212, "NtEnumerateTransactionObject": 213, "NtExtendSection": 214, "NtFilterBootOption": 215, "NtFilterToken": 216, "NtFilterTokenEx": 217, "NtFlushBuffersFileEx": 218, "NtFlushInstallUILanguage": 219, "NtFlushInstructionCache": 220, "NtFlushKey": 221, "NtFlushProcessWriteBuffers": 222, "NtFlushVirtualMemory": 223, "NtFlushWriteBuffer": 224, "NtFreeUserPhysicalPages": 225, "NtFreezeRegistry": 226, "NtFreezeTransactions": 227, "NtGetCachedSigningLevel": 228, "NtGetCompleteWnfStateSubscription": 229, "NtGetContextThread": 230, "NtGetCurrentProcessorNumber": 231, "NtGetCurrentProcessorNumberEx": 232, "NtGetDevicePowerState": 233, "NtGetMUIRegistryInfo": 234, "NtGetNextProcess": 235, "NtGetNextThread": 236, "NtGetNlsSectionPtr": 237, "NtGetNotificationResourceManager": 238, "NtGetWriteWatch": 239, "NtImpersonateAnonymousToken": 240, "NtImpersonateThread": 241, "NtInitializeEnclave": 242, "NtInitializeNlsFiles": 243, "NtInitializeRegistry": 244, "NtInitiatePowerAction": 245, "NtIsSystemResumeAutomatic": 246, "NtIsUILanguageComitted": 247, "NtListenPort": 248, "NtLoadDriver": 249, "NtLoadEnclaveData": 250, "NtLoadKey": 251, "NtLoadKey2": 252, "NtLoadKeyEx": 253, "NtLockFile": 254, "NtLockProductActivationKeys": 255, "NtLockRegistryKey": 256, "NtLockVirtualMemory": 257, "NtMakePermanentObject": 258, "NtMakeTemporaryObject": 259, "NtManagePartition": 260, "NtMapCMFModule": 261, "NtMapUserPhysicalPages": 262, "NtModifyBootEntry": 263, "NtModifyDriverEntry": 264, "NtNotifyChangeDirectoryFile": 265, "NtNotifyChangeKey": 266, "NtNotifyChangeMultipleKeys": 267, "NtNotifyChangeSession": 268, "NtOpenEnlistment": 269, "NtOpenEventPair": 270, "NtOpenIoCompletion": 271, "NtOpenJobObject": 272, "NtOpenKeyEx": 273, "NtOpenKeyTransacted": 274, "NtOpenKeyTransactedEx": 275, "NtOpenKeyedEvent": 276, "NtOpenMutant": 277, "NtOpenObjectAuditAlarm": 278, "NtOpenPartition": 279, "NtOpenPrivateNamespace": 280, "NtOpenProcessToken": 281, "NtOpenRegistryTransaction": 282, "NtOpenResourceManager": 283, "NtOpenSemaphore": 284, "NtOpenSession": 285, "NtOpenSymbolicLinkObject": 286, "NtOpenThread": 287, "NtOpenTimer": 288, "NtOpenTransaction": 289, "NtOpenTransactionManager": 290, "NtPlugPlayControl": 291, "NtPrePrepareComplete": 292, "NtPrePrepareEnlistment": 293, "NtPrepareComplete": 294, "NtPrepareEnlistment": 295, "NtPrivilegeCheck": 296, "NtPrivilegeObjectAuditAlarm": 297, "NtPrivilegedServiceAuditAlarm": 298, "NtPropagationComplete": 299, "NtPropagationFailed": 300, "NtPulseEvent": 301, "NtQueryBootEntryOrder": 302, "NtQueryBootOptions": 303, "NtQueryDebugFilterState": 304, "NtQueryDirectoryObject": 305, "NtQueryDriverEntryOrder": 306, "NtQueryEaFile": 307, "NtQueryFullAttributesFile": 308, "NtQueryInformationAtom": 309, "NtQueryInformationEnlistment": 310, "NtQueryInformationJobObject": 311, "NtQueryInformationPort": 312, "NtQueryInformationResourceManager": 313, "NtQueryInformationTransaction": 314, "NtQueryInformationTransactionManager": 315, "NtQueryInformationWorkerFactory": 316, "NtQueryInstallUILanguage": 317, "NtQueryIntervalProfile": 318, "NtQueryIoCompletion": 319, "NtQueryLicenseValue": 320, "NtQueryMultipleValueKey": 321, "NtQueryMutant": 322, "NtQueryOpenSubKeys": 323, "NtQueryOpenSubKeysEx": 324, "NtQueryPortInformationProcess": 325, "NtQueryQuotaInformationFile": 326, "NtQuerySecurityAttributesToken": 327, "NtQuerySecurityObject": 328, "NtQuerySecurityPolicy": 329, "NtQuerySemaphore": 330, "NtQuerySymbolicLinkObject": 331, "NtQuerySystemEnvironmentValue": 332, "NtQuerySystemEnvironmentValueEx": 333, "NtQuerySystemInformationEx": 334, "NtQueryTimerResolution": 335, "NtQueryWnfStateData": 336, "NtQueryWnfStateNameInformation": 337, "NtQueueApcThreadEx": 338, "NtRaiseException": 339, "NtRaiseHardError": 340, "NtReadOnlyEnlistment": 341, "NtRecoverEnlistment": 342, "NtRecoverResourceManager": 343, "NtRecoverTransactionManager": 344, "NtRegisterProtocolAddressInformation": 345, "NtRegisterThreadTerminatePort": 346, "NtReleaseKeyedEvent": 347, "NtReleaseWorkerFactoryWorker": 348, "NtRemoveIoCompletionEx": 349, "NtRemoveProcessDebug": 350, "NtRenameKey": 351, "NtRenameTransactionManager": 352, "NtReplaceKey": 353, "NtReplacePartitionUnit": 354, "NtReplyWaitReplyPort": 355, "NtRequestPort": 356, "NtResetEvent": 357, "NtResetWriteWatch": 358, "NtRestoreKey": 359, "NtResumeProcess": 360, "NtRevertContainerImpersonation": 361, "NtRollbackComplete": 362, "NtRollbackEnlistment": 363, "NtRollbackRegistryTransaction": 364, "NtRollbackTransaction": 365, "NtRollforwardTransactionManager": 366, "NtSaveKey": 367, "NtSaveKeyEx": 368, "NtSaveMergedKeys": 369, "NtSecureConnectPort": 370, "NtSerializeBoot": 371, "NtSetBootEntryOrder": 372, "NtSetBootOptions": 373, "NtSetCachedSigningLevel": 374, "NtSetCachedSigningLevel2": 375, "NtSetContextThread": 376, "NtSetDebugFilterState": 377, "NtSetDefaultHardErrorPort": 378, "NtSetDefaultLocale": 379, "NtSetDefaultUILanguage": 380, "NtSetDriverEntryOrder": 381, "NtSetEaFile": 382, "NtSetHighEventPair": 383, "NtSetHighWaitLowEventPair": 384, "NtSetIRTimer": 385, "NtSetInformationDebugObject": 386, "NtSetInformationEnlistment": 387, "NtSetInformationJobObject": 388, "NtSetInformationKey": 389, "NtSetInformationResourceManager": 390, "NtSetInformationSymbolicLink": 391, "NtSetInformationToken": 392, "NtSetInformationTransaction": 393, "NtSetInformationTransactionManager": 394, "NtSetInformationVirtualMemory": 395, "NtSetInformationWorkerFactory": 396, "NtSetIntervalProfile": 397, "NtSetIoCompletion": 398, "NtSetIoCompletionEx": 399, "NtSetLdtEntries": 400, "NtSetLowEventPair": 401, "NtSetLowWaitHighEventPair": 402, "NtSetQuotaInformationFile": 403, "NtSetSecurityObject": 404, "NtSetSystemEnvironmentValue": 405, "NtSetSystemEnvironmentValueEx": 406, "NtSetSystemInformation": 407, "NtSetSystemPowerState": 408, "NtSetSystemTime": 409, "NtSetThreadExecutionState": 410, "NtSetTimer2": 411, "NtSetTimerEx": 412, "NtSetTimerResolution": 413, "NtSetUuidSeed": 414, "NtSetVolumeInformationFile": 415, "NtSetWnfProcessNotificationEvent": 416, "NtShutdownSystem": 417, "NtShutdownWorkerFactory": 418, "NtSignalAndWaitForSingleObject": 419, "NtSinglePhaseReject": 420, "NtStartProfile": 421, "NtStopProfile": 422, "NtSubscribeWnfStateChange": 423, "NtSuspendProcess": 424, "NtSuspendThread": 425, "NtSystemDebugControl": 426, "NtTerminateJobObject": 427, "NtTestAlert": 428, "NtThawRegistry": 429, "NtThawTransactions": 430, "NtTraceControl": 431, "NtTranslateFilePath": 432, "NtUmsThreadYield": 433, "NtUnloadDriver": 434, "NtUnloadKey": 435, "NtUnloadKey2": 436, "NtUnloadKeyEx": 437, "NtUnlockFile": 438, "NtUnlockVirtualMemory": 439, "NtUnmapViewOfSectionEx": 440, "NtUnsubscribeWnfStateChange": 441, "NtUpdateWnfStateData": 442, "NtVdmControl": 443, "NtWaitForAlertByThreadId": 444, "NtWaitForDebugEvent": 445, "NtWaitForKeyedEvent": 446, "NtWaitForWorkViaWorkerFactory": 447, "NtWaitHighEventPair": 448, "NtWaitLowEventPair": 449}, "1703": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireProcessActivityReference": 103, "NtAddAtomEx": 104, "NtAddBootEntry": 105, "NtAddDriverEntry": 106, "NtAdjustGroupsToken": 107, "NtAdjustTokenClaimsAndDeviceGroups": 108, "NtAlertResumeThread": 109, "NtAlertThread": 110, "NtAlertThreadByThreadId": 111, "NtAllocateLocallyUniqueId": 112, "NtAllocateReserveObject": 113, "NtAllocateUserPhysicalPages": 114, "NtAllocateUuids": 115, "NtAlpcAcceptConnectPort": 116, "NtAlpcCancelMessage": 117, "NtAlpcConnectPort": 118, "NtAlpcConnectPortEx": 119, "NtAlpcCreatePort": 120, "NtAlpcCreatePortSection": 121, "NtAlpcCreateResourceReserve": 122, "NtAlpcCreateSectionView": 123, "NtAlpcCreateSecurityContext": 124, "NtAlpcDeletePortSection": 125, "NtAlpcDeleteResourceReserve": 126, "NtAlpcDeleteSectionView": 127, "NtAlpcDeleteSecurityContext": 128, "NtAlpcDisconnectPort": 129, "NtAlpcImpersonateClientContainerOfPort": 130, "NtAlpcImpersonateClientOfPort": 131, "NtAlpcOpenSenderProcess": 132, "NtAlpcOpenSenderThread": 133, "NtAlpcQueryInformation": 134, "NtAlpcQueryInformationMessage": 135, "NtAlpcRevokeSecurityContext": 136, "NtAlpcSendWaitReceivePort": 137, "NtAlpcSetInformation": 138, "NtAreMappedFilesTheSame": 139, "NtAssignProcessToJobObject": 140, "NtAssociateWaitCompletionPacket": 141, "NtCancelIoFileEx": 142, "NtCancelSynchronousIoFile": 143, "NtCancelTimer2": 144, "NtCancelWaitCompletionPacket": 145, "NtCommitComplete": 146, "NtCommitEnlistment": 147, "NtCommitRegistryTransaction": 148, "NtCommitTransaction": 149, "NtCompactKeys": 150, "NtCompareObjects": 151, "NtCompareSigningLevels": 152, "NtCompareTokens": 153, "NtCompleteConnectPort": 154, "NtCompressKey": 155, "NtConnectPort": 156, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 157, "NtCreateDebugObject": 158, "NtCreateDirectoryObject": 159, "NtCreateDirectoryObjectEx": 160, "NtCreateEnclave": 161, "NtCreateEnlistment": 162, "NtCreateEventPair": 163, "NtCreateIRTimer": 164, "NtCreateIoCompletion": 165, "NtCreateJobObject": 166, "NtCreateJobSet": 167, "NtCreateKeyTransacted": 168, "NtCreateKeyedEvent": 169, "NtCreateLowBoxToken": 170, "NtCreateMailslotFile": 171, "NtCreateMutant": 172, "NtCreateNamedPipeFile": 173, "NtCreatePagingFile": 174, "NtCreatePartition": 175, "NtCreatePort": 176, "NtCreatePrivateNamespace": 177, "NtCreateProcess": 178, "NtCreateProfile": 179, "NtCreateProfileEx": 180, "NtCreateRegistryTransaction": 181, "NtCreateResourceManager": 182, "NtCreateSemaphore": 183, "NtCreateSymbolicLinkObject": 184, "NtCreateThreadEx": 185, "NtCreateTimer": 186, "NtCreateTimer2": 187, "NtCreateToken": 188, "NtCreateTokenEx": 189, "NtCreateTransaction": 190, "NtCreateTransactionManager": 191, "NtCreateUserProcess": 192, "NtCreateWaitCompletionPacket": 193, "NtCreateWaitablePort": 194, "NtCreateWnfStateName": 195, "NtCreateWorkerFactory": 196, "NtDebugActiveProcess": 197, "NtDebugContinue": 198, "NtDeleteAtom": 199, "NtDeleteBootEntry": 200, "NtDeleteDriverEntry": 201, "NtDeleteFile": 202, "NtDeleteKey": 203, "NtDeleteObjectAuditAlarm": 204, "NtDeletePrivateNamespace": 205, "NtDeleteValueKey": 206, "NtDeleteWnfStateData": 207, "NtDeleteWnfStateName": 208, "NtDisableLastKnownGood": 209, "NtDisplayString": 210, "NtDrawText": 211, "NtEnableLastKnownGood": 212, "NtEnumerateBootEntries": 213, "NtEnumerateDriverEntries": 214, "NtEnumerateSystemEnvironmentValuesEx": 215, "NtEnumerateTransactionObject": 216, "NtExtendSection": 217, "NtFilterBootOption": 218, "NtFilterToken": 219, "NtFilterTokenEx": 220, "NtFlushBuffersFileEx": 221, "NtFlushInstallUILanguage": 222, "NtFlushInstructionCache": 223, "NtFlushKey": 224, "NtFlushProcessWriteBuffers": 225, "NtFlushVirtualMemory": 226, "NtFlushWriteBuffer": 227, "NtFreeUserPhysicalPages": 228, "NtFreezeRegistry": 229, "NtFreezeTransactions": 230, "NtGetCachedSigningLevel": 231, "NtGetCompleteWnfStateSubscription": 232, "NtGetContextThread": 233, "NtGetCurrentProcessorNumber": 234, "NtGetCurrentProcessorNumberEx": 235, "NtGetDevicePowerState": 236, "NtGetMUIRegistryInfo": 237, "NtGetNextProcess": 238, "NtGetNextThread": 239, "NtGetNlsSectionPtr": 240, "NtGetNotificationResourceManager": 241, "NtGetWriteWatch": 242, "NtImpersonateAnonymousToken": 243, "NtImpersonateThread": 244, "NtInitializeEnclave": 245, "NtInitializeNlsFiles": 246, "NtInitializeRegistry": 247, "NtInitiatePowerAction": 248, "NtIsSystemResumeAutomatic": 249, "NtIsUILanguageComitted": 250, "NtListenPort": 251, "NtLoadDriver": 252, "NtLoadEnclaveData": 253, "NtLoadHotPatch": 254, "NtLoadKey": 255, "NtLoadKey2": 256, "NtLoadKeyEx": 257, "NtLockFile": 258, "NtLockProductActivationKeys": 259, "NtLockRegistryKey": 260, "NtLockVirtualMemory": 261, "NtMakePermanentObject": 262, "NtMakeTemporaryObject": 263, "NtManagePartition": 264, "NtMapCMFModule": 265, "NtMapUserPhysicalPages": 266, "NtModifyBootEntry": 267, "NtModifyDriverEntry": 268, "NtNotifyChangeDirectoryFile": 269, "NtNotifyChangeKey": 270, "NtNotifyChangeMultipleKeys": 271, "NtNotifyChangeSession": 272, "NtOpenEnlistment": 273, "NtOpenEventPair": 274, "NtOpenIoCompletion": 275, "NtOpenJobObject": 276, "NtOpenKeyEx": 277, "NtOpenKeyTransacted": 278, "NtOpenKeyTransactedEx": 279, "NtOpenKeyedEvent": 280, "NtOpenMutant": 281, "NtOpenObjectAuditAlarm": 282, "NtOpenPartition": 283, "NtOpenPrivateNamespace": 284, "NtOpenProcessToken": 285, "NtOpenRegistryTransaction": 286, "NtOpenResourceManager": 287, "NtOpenSemaphore": 288, "NtOpenSession": 289, "NtOpenSymbolicLinkObject": 290, "NtOpenThread": 291, "NtOpenTimer": 292, "NtOpenTransaction": 293, "NtOpenTransactionManager": 294, "NtPlugPlayControl": 295, "NtPrePrepareComplete": 296, "NtPrePrepareEnlistment": 297, "NtPrepareComplete": 298, "NtPrepareEnlistment": 299, "NtPrivilegeCheck": 300, "NtPrivilegeObjectAuditAlarm": 301, "NtPrivilegedServiceAuditAlarm": 302, "NtPropagationComplete": 303, "NtPropagationFailed": 304, "NtPulseEvent": 305, "NtQueryAuxiliaryCounterFrequency": 306, "NtQueryBootEntryOrder": 307, "NtQueryBootOptions": 308, "NtQueryDebugFilterState": 309, "NtQueryDirectoryObject": 310, "NtQueryDriverEntryOrder": 311, "NtQueryEaFile": 312, "NtQueryFullAttributesFile": 313, "NtQueryInformationAtom": 314, "NtQueryInformationByName": 315, "NtQueryInformationEnlistment": 316, "NtQueryInformationJobObject": 317, "NtQueryInformationPort": 318, "NtQueryInformationResourceManager": 319, "NtQueryInformationTransaction": 320, "NtQueryInformationTransactionManager": 321, "NtQueryInformationWorkerFactory": 322, "NtQueryInstallUILanguage": 323, "NtQueryIntervalProfile": 324, "NtQueryIoCompletion": 325, "NtQueryLicenseValue": 326, "NtQueryMultipleValueKey": 327, "NtQueryMutant": 328, "NtQueryOpenSubKeys": 329, "NtQueryOpenSubKeysEx": 330, "NtQueryPortInformationProcess": 331, "NtQueryQuotaInformationFile": 332, "NtQuerySecurityAttributesToken": 333, "NtQuerySecurityObject": 334, "NtQuerySecurityPolicy": 335, "NtQuerySemaphore": 336, "NtQuerySymbolicLinkObject": 337, "NtQuerySystemEnvironmentValue": 338, "NtQuerySystemEnvironmentValueEx": 339, "NtQuerySystemInformationEx": 340, "NtQueryTimerResolution": 341, "NtQueryWnfStateData": 342, "NtQueryWnfStateNameInformation": 343, "NtQueueApcThreadEx": 344, "NtRaiseException": 345, "NtRaiseHardError": 346, "NtReadOnlyEnlistment": 347, "NtRecoverEnlistment": 348, "NtRecoverResourceManager": 349, "NtRecoverTransactionManager": 350, "NtRegisterProtocolAddressInformation": 351, "NtRegisterThreadTerminatePort": 352, "NtReleaseKeyedEvent": 353, "NtReleaseWorkerFactoryWorker": 354, "NtRemoveIoCompletionEx": 355, "NtRemoveProcessDebug": 356, "NtRenameKey": 357, "NtRenameTransactionManager": 358, "NtReplaceKey": 359, "NtReplacePartitionUnit": 360, "NtReplyWaitReplyPort": 361, "NtRequestPort": 362, "NtResetEvent": 363, "NtResetWriteWatch": 364, "NtRestoreKey": 365, "NtResumeProcess": 366, "NtRevertContainerImpersonation": 367, "NtRollbackComplete": 368, "NtRollbackEnlistment": 369, "NtRollbackRegistryTransaction": 370, "NtRollbackTransaction": 371, "NtRollforwardTransactionManager": 372, "NtSaveKey": 373, "NtSaveKeyEx": 374, "NtSaveMergedKeys": 375, "NtSecureConnectPort": 376, "NtSerializeBoot": 377, "NtSetBootEntryOrder": 378, "NtSetBootOptions": 379, "NtSetCachedSigningLevel": 380, "NtSetCachedSigningLevel2": 381, "NtSetContextThread": 382, "NtSetDebugFilterState": 383, "NtSetDefaultHardErrorPort": 384, "NtSetDefaultLocale": 385, "NtSetDefaultUILanguage": 386, "NtSetDriverEntryOrder": 387, "NtSetEaFile": 388, "NtSetHighEventPair": 389, "NtSetHighWaitLowEventPair": 390, "NtSetIRTimer": 391, "NtSetInformationDebugObject": 392, "NtSetInformationEnlistment": 393, "NtSetInformationJobObject": 394, "NtSetInformationKey": 395, "NtSetInformationResourceManager": 396, "NtSetInformationSymbolicLink": 397, "NtSetInformationToken": 398, "NtSetInformationTransaction": 399, "NtSetInformationTransactionManager": 400, "NtSetInformationVirtualMemory": 401, "NtSetInformationWorkerFactory": 402, "NtSetIntervalProfile": 403, "NtSetIoCompletion": 404, "NtSetIoCompletionEx": 405, "NtSetLdtEntries": 406, "NtSetLowEventPair": 407, "NtSetLowWaitHighEventPair": 408, "NtSetQuotaInformationFile": 409, "NtSetSecurityObject": 410, "NtSetSystemEnvironmentValue": 411, "NtSetSystemEnvironmentValueEx": 412, "NtSetSystemInformation": 413, "NtSetSystemPowerState": 414, "NtSetSystemTime": 415, "NtSetThreadExecutionState": 416, "NtSetTimer2": 417, "NtSetTimerEx": 418, "NtSetTimerResolution": 419, "NtSetUuidSeed": 420, "NtSetVolumeInformationFile": 421, "NtSetWnfProcessNotificationEvent": 422, "NtShutdownSystem": 423, "NtShutdownWorkerFactory": 424, "NtSignalAndWaitForSingleObject": 425, "NtSinglePhaseReject": 426, "NtStartProfile": 427, "NtStopProfile": 428, "NtSubscribeWnfStateChange": 429, "NtSuspendProcess": 430, "NtSuspendThread": 431, "NtSystemDebugControl": 432, "NtTerminateJobObject": 433, "NtTestAlert": 434, "NtThawRegistry": 435, "NtThawTransactions": 436, "NtTraceControl": 437, "NtTranslateFilePath": 438, "NtUmsThreadYield": 439, "NtUnloadDriver": 440, "NtUnloadKey": 441, "NtUnloadKey2": 442, "NtUnloadKeyEx": 443, "NtUnlockFile": 444, "NtUnlockVirtualMemory": 445, "NtUnmapViewOfSectionEx": 446, "NtUnsubscribeWnfStateChange": 447, "NtUpdateWnfStateData": 448, "NtVdmControl": 449, "NtWaitForAlertByThreadId": 450, "NtWaitForDebugEvent": 451, "NtWaitForKeyedEvent": 452, "NtWaitForWorkViaWorkerFactory": 453, "NtWaitHighEventPair": 454, "NtWaitLowEventPair": 455}, "1709": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireProcessActivityReference": 103, "NtAddAtomEx": 104, "NtAddBootEntry": 105, "NtAddDriverEntry": 106, "NtAdjustGroupsToken": 107, "NtAdjustTokenClaimsAndDeviceGroups": 108, "NtAlertResumeThread": 109, "NtAlertThread": 110, "NtAlertThreadByThreadId": 111, "NtAllocateLocallyUniqueId": 112, "NtAllocateReserveObject": 113, "NtAllocateUserPhysicalPages": 114, "NtAllocateUuids": 115, "NtAlpcAcceptConnectPort": 116, "NtAlpcCancelMessage": 117, "NtAlpcConnectPort": 118, "NtAlpcConnectPortEx": 119, "NtAlpcCreatePort": 120, "NtAlpcCreatePortSection": 121, "NtAlpcCreateResourceReserve": 122, "NtAlpcCreateSectionView": 123, "NtAlpcCreateSecurityContext": 124, "NtAlpcDeletePortSection": 125, "NtAlpcDeleteResourceReserve": 126, "NtAlpcDeleteSectionView": 127, "NtAlpcDeleteSecurityContext": 128, "NtAlpcDisconnectPort": 129, "NtAlpcImpersonateClientContainerOfPort": 130, "NtAlpcImpersonateClientOfPort": 131, "NtAlpcOpenSenderProcess": 132, "NtAlpcOpenSenderThread": 133, "NtAlpcQueryInformation": 134, "NtAlpcQueryInformationMessage": 135, "NtAlpcRevokeSecurityContext": 136, "NtAlpcSendWaitReceivePort": 137, "NtAlpcSetInformation": 138, "NtAreMappedFilesTheSame": 139, "NtAssignProcessToJobObject": 140, "NtAssociateWaitCompletionPacket": 141, "NtCallEnclave": 142, "NtCancelIoFileEx": 143, "NtCancelSynchronousIoFile": 144, "NtCancelTimer2": 145, "NtCancelWaitCompletionPacket": 146, "NtCommitComplete": 147, "NtCommitEnlistment": 148, "NtCommitRegistryTransaction": 149, "NtCommitTransaction": 150, "NtCompactKeys": 151, "NtCompareObjects": 152, "NtCompareSigningLevels": 153, "NtCompareTokens": 154, "NtCompleteConnectPort": 155, "NtCompressKey": 156, "NtConnectPort": 157, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 158, "NtCreateDebugObject": 159, "NtCreateDirectoryObject": 160, "NtCreateDirectoryObjectEx": 161, "NtCreateEnclave": 162, "NtCreateEnlistment": 163, "NtCreateEventPair": 164, "NtCreateIRTimer": 165, "NtCreateIoCompletion": 166, "NtCreateJobObject": 167, "NtCreateJobSet": 168, "NtCreateKeyTransacted": 169, "NtCreateKeyedEvent": 170, "NtCreateLowBoxToken": 171, "NtCreateMailslotFile": 172, "NtCreateMutant": 173, "NtCreateNamedPipeFile": 174, "NtCreatePagingFile": 175, "NtCreatePartition": 176, "NtCreatePort": 177, "NtCreatePrivateNamespace": 178, "NtCreateProcess": 179, "NtCreateProfile": 180, "NtCreateProfileEx": 181, "NtCreateRegistryTransaction": 182, "NtCreateResourceManager": 183, "NtCreateSemaphore": 184, "NtCreateSymbolicLinkObject": 185, "NtCreateThreadEx": 186, "NtCreateTimer": 187, "NtCreateTimer2": 188, "NtCreateToken": 189, "NtCreateTokenEx": 190, "NtCreateTransaction": 191, "NtCreateTransactionManager": 192, "NtCreateUserProcess": 193, "NtCreateWaitCompletionPacket": 194, "NtCreateWaitablePort": 195, "NtCreateWnfStateName": 196, "NtCreateWorkerFactory": 197, "NtDebugActiveProcess": 198, "NtDebugContinue": 199, "NtDeleteAtom": 200, "NtDeleteBootEntry": 201, "NtDeleteDriverEntry": 202, "NtDeleteFile": 203, "NtDeleteKey": 204, "NtDeleteObjectAuditAlarm": 205, "NtDeletePrivateNamespace": 206, "NtDeleteValueKey": 207, "NtDeleteWnfStateData": 208, "NtDeleteWnfStateName": 209, "NtDisableLastKnownGood": 210, "NtDisplayString": 211, "NtDrawText": 212, "NtEnableLastKnownGood": 213, "NtEnumerateBootEntries": 214, "NtEnumerateDriverEntries": 215, "NtEnumerateSystemEnvironmentValuesEx": 216, "NtEnumerateTransactionObject": 217, "NtExtendSection": 218, "NtFilterBootOption": 219, "NtFilterToken": 220, "NtFilterTokenEx": 221, "NtFlushBuffersFileEx": 222, "NtFlushInstallUILanguage": 223, "NtFlushInstructionCache": 224, "NtFlushKey": 225, "NtFlushProcessWriteBuffers": 226, "NtFlushVirtualMemory": 227, "NtFlushWriteBuffer": 228, "NtFreeUserPhysicalPages": 229, "NtFreezeRegistry": 230, "NtFreezeTransactions": 231, "NtGetCachedSigningLevel": 232, "NtGetCompleteWnfStateSubscription": 233, "NtGetContextThread": 234, "NtGetCurrentProcessorNumber": 235, "NtGetCurrentProcessorNumberEx": 236, "NtGetDevicePowerState": 237, "NtGetMUIRegistryInfo": 238, "NtGetNextProcess": 239, "NtGetNextThread": 240, "NtGetNlsSectionPtr": 241, "NtGetNotificationResourceManager": 242, "NtGetWriteWatch": 243, "NtImpersonateAnonymousToken": 244, "NtImpersonateThread": 245, "NtInitializeEnclave": 246, "NtInitializeNlsFiles": 247, "NtInitializeRegistry": 248, "NtInitiatePowerAction": 249, "NtIsSystemResumeAutomatic": 250, "NtIsUILanguageComitted": 251, "NtListenPort": 252, "NtLoadDriver": 253, "NtLoadEnclaveData": 254, "NtLoadHotPatch": 255, "NtLoadKey": 256, "NtLoadKey2": 257, "NtLoadKeyEx": 258, "NtLockFile": 259, "NtLockProductActivationKeys": 260, "NtLockRegistryKey": 261, "NtLockVirtualMemory": 262, "NtMakePermanentObject": 263, "NtMakeTemporaryObject": 264, "NtManagePartition": 265, "NtMapCMFModule": 266, "NtMapUserPhysicalPages": 267, "NtModifyBootEntry": 268, "NtModifyDriverEntry": 269, "NtNotifyChangeDirectoryFile": 270, "NtNotifyChangeDirectoryFileEx": 271, "NtNotifyChangeKey": 272, "NtNotifyChangeMultipleKeys": 273, "NtNotifyChangeSession": 274, "NtOpenEnlistment": 275, "NtOpenEventPair": 276, "NtOpenIoCompletion": 277, "NtOpenJobObject": 278, "NtOpenKeyEx": 279, "NtOpenKeyTransacted": 280, "NtOpenKeyTransactedEx": 281, "NtOpenKeyedEvent": 282, "NtOpenMutant": 283, "NtOpenObjectAuditAlarm": 284, "NtOpenPartition": 285, "NtOpenPrivateNamespace": 286, "NtOpenProcessToken": 287, "NtOpenRegistryTransaction": 288, "NtOpenResourceManager": 289, "NtOpenSemaphore": 290, "NtOpenSession": 291, "NtOpenSymbolicLinkObject": 292, "NtOpenThread": 293, "NtOpenTimer": 294, "NtOpenTransaction": 295, "NtOpenTransactionManager": 296, "NtPlugPlayControl": 297, "NtPrePrepareComplete": 298, "NtPrePrepareEnlistment": 299, "NtPrepareComplete": 300, "NtPrepareEnlistment": 301, "NtPrivilegeCheck": 302, "NtPrivilegeObjectAuditAlarm": 303, "NtPrivilegedServiceAuditAlarm": 304, "NtPropagationComplete": 305, "NtPropagationFailed": 306, "NtPulseEvent": 307, "NtQueryAuxiliaryCounterFrequency": 308, "NtQueryBootEntryOrder": 309, "NtQueryBootOptions": 310, "NtQueryDebugFilterState": 311, "NtQueryDirectoryFileEx": 312, "NtQueryDirectoryObject": 313, "NtQueryDriverEntryOrder": 314, "NtQueryEaFile": 315, "NtQueryFullAttributesFile": 316, "NtQueryInformationAtom": 317, "NtQueryInformationByName": 318, "NtQueryInformationEnlistment": 319, "NtQueryInformationJobObject": 320, "NtQueryInformationPort": 321, "NtQueryInformationResourceManager": 322, "NtQueryInformationTransaction": 323, "NtQueryInformationTransactionManager": 324, "NtQueryInformationWorkerFactory": 325, "NtQueryInstallUILanguage": 326, "NtQueryIntervalProfile": 327, "NtQueryIoCompletion": 328, "NtQueryLicenseValue": 329, "NtQueryMultipleValueKey": 330, "NtQueryMutant": 331, "NtQueryOpenSubKeys": 332, "NtQueryOpenSubKeysEx": 333, "NtQueryPortInformationProcess": 334, "NtQueryQuotaInformationFile": 335, "NtQuerySecurityAttributesToken": 336, "NtQuerySecurityObject": 337, "NtQuerySecurityPolicy": 338, "NtQuerySemaphore": 339, "NtQuerySymbolicLinkObject": 340, "NtQuerySystemEnvironmentValue": 341, "NtQuerySystemEnvironmentValueEx": 342, "NtQuerySystemInformationEx": 343, "NtQueryTimerResolution": 344, "NtQueryWnfStateData": 345, "NtQueryWnfStateNameInformation": 346, "NtQueueApcThreadEx": 347, "NtRaiseException": 348, "NtRaiseHardError": 349, "NtReadOnlyEnlistment": 350, "NtRecoverEnlistment": 351, "NtRecoverResourceManager": 352, "NtRecoverTransactionManager": 353, "NtRegisterProtocolAddressInformation": 354, "NtRegisterThreadTerminatePort": 355, "NtReleaseKeyedEvent": 356, "NtReleaseWorkerFactoryWorker": 357, "NtRemoveIoCompletionEx": 358, "NtRemoveProcessDebug": 359, "NtRenameKey": 360, "NtRenameTransactionManager": 361, "NtReplaceKey": 362, "NtReplacePartitionUnit": 363, "NtReplyWaitReplyPort": 364, "NtRequestPort": 365, "NtResetEvent": 366, "NtResetWriteWatch": 367, "NtRestoreKey": 368, "NtResumeProcess": 369, "NtRevertContainerImpersonation": 370, "NtRollbackComplete": 371, "NtRollbackEnlistment": 372, "NtRollbackRegistryTransaction": 373, "NtRollbackTransaction": 374, "NtRollforwardTransactionManager": 375, "NtSaveKey": 376, "NtSaveKeyEx": 377, "NtSaveMergedKeys": 378, "NtSecureConnectPort": 379, "NtSerializeBoot": 380, "NtSetBootEntryOrder": 381, "NtSetBootOptions": 382, "NtSetCachedSigningLevel": 383, "NtSetCachedSigningLevel2": 384, "NtSetContextThread": 385, "NtSetDebugFilterState": 386, "NtSetDefaultHardErrorPort": 387, "NtSetDefaultLocale": 388, "NtSetDefaultUILanguage": 389, "NtSetDriverEntryOrder": 390, "NtSetEaFile": 391, "NtSetHighEventPair": 392, "NtSetHighWaitLowEventPair": 393, "NtSetIRTimer": 394, "NtSetInformationDebugObject": 395, "NtSetInformationEnlistment": 396, "NtSetInformationJobObject": 397, "NtSetInformationKey": 398, "NtSetInformationResourceManager": 399, "NtSetInformationSymbolicLink": 400, "NtSetInformationToken": 401, "NtSetInformationTransaction": 402, "NtSetInformationTransactionManager": 403, "NtSetInformationVirtualMemory": 404, "NtSetInformationWorkerFactory": 405, "NtSetIntervalProfile": 406, "NtSetIoCompletion": 407, "NtSetIoCompletionEx": 408, "NtSetLdtEntries": 409, "NtSetLowEventPair": 410, "NtSetLowWaitHighEventPair": 411, "NtSetQuotaInformationFile": 412, "NtSetSecurityObject": 413, "NtSetSystemEnvironmentValue": 414, "NtSetSystemEnvironmentValueEx": 415, "NtSetSystemInformation": 416, "NtSetSystemPowerState": 417, "NtSetSystemTime": 418, "NtSetThreadExecutionState": 419, "NtSetTimer2": 420, "NtSetTimerEx": 421, "NtSetTimerResolution": 422, "NtSetUuidSeed": 423, "NtSetVolumeInformationFile": 424, "NtSetWnfProcessNotificationEvent": 425, "NtShutdownSystem": 426, "NtShutdownWorkerFactory": 427, "NtSignalAndWaitForSingleObject": 428, "NtSinglePhaseReject": 429, "NtStartProfile": 430, "NtStopProfile": 431, "NtSubscribeWnfStateChange": 432, "NtSuspendProcess": 433, "NtSuspendThread": 434, "NtSystemDebugControl": 435, "NtTerminateEnclave": 436, "NtTerminateJobObject": 437, "NtTestAlert": 438, "NtThawRegistry": 439, "NtThawTransactions": 440, "NtTraceControl": 441, "NtTranslateFilePath": 442, "NtUmsThreadYield": 443, "NtUnloadDriver": 444, "NtUnloadKey": 445, "NtUnloadKey2": 446, "NtUnloadKeyEx": 447, "NtUnlockFile": 448, "NtUnlockVirtualMemory": 449, "NtUnmapViewOfSectionEx": 450, "NtUnsubscribeWnfStateChange": 451, "NtUpdateWnfStateData": 452, "NtVdmControl": 453, "NtWaitForAlertByThreadId": 454, "NtWaitForDebugEvent": 455, "NtWaitForKeyedEvent": 456, "NtWaitForWorkViaWorkerFactory": 457, "NtWaitHighEventPair": 458, "NtWaitLowEventPair": 459}, "1803": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireProcessActivityReference": 103, "NtAddAtomEx": 104, "NtAddBootEntry": 105, "NtAddDriverEntry": 106, "NtAdjustGroupsToken": 107, "NtAdjustTokenClaimsAndDeviceGroups": 108, "NtAlertResumeThread": 109, "NtAlertThread": 110, "NtAlertThreadByThreadId": 111, "NtAllocateLocallyUniqueId": 112, "NtAllocateReserveObject": 113, "NtAllocateUserPhysicalPages": 114, "NtAllocateUuids": 115, "NtAllocateVirtualMemoryEx": 116, "NtAlpcAcceptConnectPort": 117, "NtAlpcCancelMessage": 118, "NtAlpcConnectPort": 119, "NtAlpcConnectPortEx": 120, "NtAlpcCreatePort": 121, "NtAlpcCreatePortSection": 122, "NtAlpcCreateResourceReserve": 123, "NtAlpcCreateSectionView": 124, "NtAlpcCreateSecurityContext": 125, "NtAlpcDeletePortSection": 126, "NtAlpcDeleteResourceReserve": 127, "NtAlpcDeleteSectionView": 128, "NtAlpcDeleteSecurityContext": 129, "NtAlpcDisconnectPort": 130, "NtAlpcImpersonateClientContainerOfPort": 131, "NtAlpcImpersonateClientOfPort": 132, "NtAlpcOpenSenderProcess": 133, "NtAlpcOpenSenderThread": 134, "NtAlpcQueryInformation": 135, "NtAlpcQueryInformationMessage": 136, "NtAlpcRevokeSecurityContext": 137, "NtAlpcSendWaitReceivePort": 138, "NtAlpcSetInformation": 139, "NtAreMappedFilesTheSame": 140, "NtAssignProcessToJobObject": 141, "NtAssociateWaitCompletionPacket": 142, "NtCallEnclave": 143, "NtCancelIoFileEx": 144, "NtCancelSynchronousIoFile": 145, "NtCancelTimer2": 146, "NtCancelWaitCompletionPacket": 147, "NtCommitComplete": 148, "NtCommitEnlistment": 149, "NtCommitRegistryTransaction": 150, "NtCommitTransaction": 151, "NtCompactKeys": 152, "NtCompareObjects": 153, "NtCompareSigningLevels": 154, "NtCompareTokens": 155, "NtCompleteConnectPort": 156, "NtCompressKey": 157, "NtConnectPort": 158, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 159, "NtCreateDebugObject": 160, "NtCreateDirectoryObject": 161, "NtCreateDirectoryObjectEx": 162, "NtCreateEnclave": 163, "NtCreateEnlistment": 164, "NtCreateEventPair": 165, "NtCreateIRTimer": 166, "NtCreateIoCompletion": 167, "NtCreateJobObject": 168, "NtCreateJobSet": 169, "NtCreateKeyTransacted": 170, "NtCreateKeyedEvent": 171, "NtCreateLowBoxToken": 172, "NtCreateMailslotFile": 173, "NtCreateMutant": 174, "NtCreateNamedPipeFile": 175, "NtCreatePagingFile": 176, "NtCreatePartition": 177, "NtCreatePort": 178, "NtCreatePrivateNamespace": 179, "NtCreateProcess": 180, "NtCreateProfile": 181, "NtCreateProfileEx": 182, "NtCreateRegistryTransaction": 183, "NtCreateResourceManager": 184, "NtCreateSemaphore": 185, "NtCreateSymbolicLinkObject": 186, "NtCreateThreadEx": 187, "NtCreateTimer": 188, "NtCreateTimer2": 189, "NtCreateToken": 190, "NtCreateTokenEx": 191, "NtCreateTransaction": 192, "NtCreateTransactionManager": 193, "NtCreateUserProcess": 194, "NtCreateWaitCompletionPacket": 195, "NtCreateWaitablePort": 196, "NtCreateWnfStateName": 197, "NtCreateWorkerFactory": 198, "NtDebugActiveProcess": 199, "NtDebugContinue": 200, "NtDeleteAtom": 201, "NtDeleteBootEntry": 202, "NtDeleteDriverEntry": 203, "NtDeleteFile": 204, "NtDeleteKey": 205, "NtDeleteObjectAuditAlarm": 206, "NtDeletePrivateNamespace": 207, "NtDeleteValueKey": 208, "NtDeleteWnfStateData": 209, "NtDeleteWnfStateName": 210, "NtDisableLastKnownGood": 211, "NtDisplayString": 212, "NtDrawText": 213, "NtEnableLastKnownGood": 214, "NtEnumerateBootEntries": 215, "NtEnumerateDriverEntries": 216, "NtEnumerateSystemEnvironmentValuesEx": 217, "NtEnumerateTransactionObject": 218, "NtExtendSection": 219, "NtFilterBootOption": 220, "NtFilterToken": 221, "NtFilterTokenEx": 222, "NtFlushBuffersFileEx": 223, "NtFlushInstallUILanguage": 224, "NtFlushInstructionCache": 225, "NtFlushKey": 226, "NtFlushProcessWriteBuffers": 227, "NtFlushVirtualMemory": 228, "NtFlushWriteBuffer": 229, "NtFreeUserPhysicalPages": 230, "NtFreezeRegistry": 231, "NtFreezeTransactions": 232, "NtGetCachedSigningLevel": 233, "NtGetCompleteWnfStateSubscription": 234, "NtGetContextThread": 235, "NtGetCurrentProcessorNumber": 236, "NtGetCurrentProcessorNumberEx": 237, "NtGetDevicePowerState": 238, "NtGetMUIRegistryInfo": 239, "NtGetNextProcess": 240, "NtGetNextThread": 241, "NtGetNlsSectionPtr": 242, "NtGetNotificationResourceManager": 243, "NtGetWriteWatch": 244, "NtImpersonateAnonymousToken": 245, "NtImpersonateThread": 246, "NtInitializeEnclave": 247, "NtInitializeNlsFiles": 248, "NtInitializeRegistry": 249, "NtInitiatePowerAction": 250, "NtIsSystemResumeAutomatic": 251, "NtIsUILanguageComitted": 252, "NtListenPort": 253, "NtLoadDriver": 254, "NtLoadEnclaveData": 255, "NtLoadHotPatch": 256, "NtLoadKey": 257, "NtLoadKey2": 258, "NtLoadKeyEx": 259, "NtLockFile": 260, "NtLockProductActivationKeys": 261, "NtLockRegistryKey": 262, "NtLockVirtualMemory": 263, "NtMakePermanentObject": 264, "NtMakeTemporaryObject": 265, "NtManagePartition": 266, "NtMapCMFModule": 267, "NtMapUserPhysicalPages": 268, "NtMapViewOfSectionEx": 269, "NtModifyBootEntry": 270, "NtModifyDriverEntry": 271, "NtNotifyChangeDirectoryFile": 272, "NtNotifyChangeDirectoryFileEx": 273, "NtNotifyChangeKey": 274, "NtNotifyChangeMultipleKeys": 275, "NtNotifyChangeSession": 276, "NtOpenEnlistment": 277, "NtOpenEventPair": 278, "NtOpenIoCompletion": 279, "NtOpenJobObject": 280, "NtOpenKeyEx": 281, "NtOpenKeyTransacted": 282, "NtOpenKeyTransactedEx": 283, "NtOpenKeyedEvent": 284, "NtOpenMutant": 285, "NtOpenObjectAuditAlarm": 286, "NtOpenPartition": 287, "NtOpenPrivateNamespace": 288, "NtOpenProcessToken": 289, "NtOpenRegistryTransaction": 290, "NtOpenResourceManager": 291, "NtOpenSemaphore": 292, "NtOpenSession": 293, "NtOpenSymbolicLinkObject": 294, "NtOpenThread": 295, "NtOpenTimer": 296, "NtOpenTransaction": 297, "NtOpenTransactionManager": 298, "NtPlugPlayControl": 299, "NtPrePrepareComplete": 300, "NtPrePrepareEnlistment": 301, "NtPrepareComplete": 302, "NtPrepareEnlistment": 303, "NtPrivilegeCheck": 304, "NtPrivilegeObjectAuditAlarm": 305, "NtPrivilegedServiceAuditAlarm": 306, "NtPropagationComplete": 307, "NtPropagationFailed": 308, "NtPulseEvent": 309, "NtQueryAuxiliaryCounterFrequency": 310, "NtQueryBootEntryOrder": 311, "NtQueryBootOptions": 312, "NtQueryDebugFilterState": 313, "NtQueryDirectoryFileEx": 314, "NtQueryDirectoryObject": 315, "NtQueryDriverEntryOrder": 316, "NtQueryEaFile": 317, "NtQueryFullAttributesFile": 318, "NtQueryInformationAtom": 319, "NtQueryInformationByName": 320, "NtQueryInformationEnlistment": 321, "NtQueryInformationJobObject": 322, "NtQueryInformationPort": 323, "NtQueryInformationResourceManager": 324, "NtQueryInformationTransaction": 325, "NtQueryInformationTransactionManager": 326, "NtQueryInformationWorkerFactory": 327, "NtQueryInstallUILanguage": 328, "NtQueryIntervalProfile": 329, "NtQueryIoCompletion": 330, "NtQueryLicenseValue": 331, "NtQueryMultipleValueKey": 332, "NtQueryMutant": 333, "NtQueryOpenSubKeys": 334, "NtQueryOpenSubKeysEx": 335, "NtQueryPortInformationProcess": 336, "NtQueryQuotaInformationFile": 337, "NtQuerySecurityAttributesToken": 338, "NtQuerySecurityObject": 339, "NtQuerySecurityPolicy": 340, "NtQuerySemaphore": 341, "NtQuerySymbolicLinkObject": 342, "NtQuerySystemEnvironmentValue": 343, "NtQuerySystemEnvironmentValueEx": 344, "NtQuerySystemInformationEx": 345, "NtQueryTimerResolution": 346, "NtQueryWnfStateData": 347, "NtQueryWnfStateNameInformation": 348, "NtQueueApcThreadEx": 349, "NtRaiseException": 350, "NtRaiseHardError": 351, "NtReadOnlyEnlistment": 352, "NtRecoverEnlistment": 353, "NtRecoverResourceManager": 354, "NtRecoverTransactionManager": 355, "NtRegisterProtocolAddressInformation": 356, "NtRegisterThreadTerminatePort": 357, "NtReleaseKeyedEvent": 358, "NtReleaseWorkerFactoryWorker": 359, "NtRemoveIoCompletionEx": 360, "NtRemoveProcessDebug": 361, "NtRenameKey": 362, "NtRenameTransactionManager": 363, "NtReplaceKey": 364, "NtReplacePartitionUnit": 365, "NtReplyWaitReplyPort": 366, "NtRequestPort": 367, "NtResetEvent": 368, "NtResetWriteWatch": 369, "NtRestoreKey": 370, "NtResumeProcess": 371, "NtRevertContainerImpersonation": 372, "NtRollbackComplete": 373, "NtRollbackEnlistment": 374, "NtRollbackRegistryTransaction": 375, "NtRollbackTransaction": 376, "NtRollforwardTransactionManager": 377, "NtSaveKey": 378, "NtSaveKeyEx": 379, "NtSaveMergedKeys": 380, "NtSecureConnectPort": 381, "NtSerializeBoot": 382, "NtSetBootEntryOrder": 383, "NtSetBootOptions": 384, "NtSetCachedSigningLevel": 385, "NtSetCachedSigningLevel2": 386, "NtSetContextThread": 387, "NtSetDebugFilterState": 388, "NtSetDefaultHardErrorPort": 389, "NtSetDefaultLocale": 390, "NtSetDefaultUILanguage": 391, "NtSetDriverEntryOrder": 392, "NtSetEaFile": 393, "NtSetHighEventPair": 394, "NtSetHighWaitLowEventPair": 395, "NtSetIRTimer": 396, "NtSetInformationDebugObject": 397, "NtSetInformationEnlistment": 398, "NtSetInformationJobObject": 399, "NtSetInformationKey": 400, "NtSetInformationResourceManager": 401, "NtSetInformationSymbolicLink": 402, "NtSetInformationToken": 403, "NtSetInformationTransaction": 404, "NtSetInformationTransactionManager": 405, "NtSetInformationVirtualMemory": 406, "NtSetInformationWorkerFactory": 407, "NtSetIntervalProfile": 408, "NtSetIoCompletion": 409, "NtSetIoCompletionEx": 410, "NtSetLdtEntries": 411, "NtSetLowEventPair": 412, "NtSetLowWaitHighEventPair": 413, "NtSetQuotaInformationFile": 414, "NtSetSecurityObject": 415, "NtSetSystemEnvironmentValue": 416, "NtSetSystemEnvironmentValueEx": 417, "NtSetSystemInformation": 418, "NtSetSystemPowerState": 419, "NtSetSystemTime": 420, "NtSetThreadExecutionState": 421, "NtSetTimer2": 422, "NtSetTimerEx": 423, "NtSetTimerResolution": 424, "NtSetUuidSeed": 425, "NtSetVolumeInformationFile": 426, "NtSetWnfProcessNotificationEvent": 427, "NtShutdownSystem": 428, "NtShutdownWorkerFactory": 429, "NtSignalAndWaitForSingleObject": 430, "NtSinglePhaseReject": 431, "NtStartProfile": 432, "NtStopProfile": 433, "NtSubscribeWnfStateChange": 434, "NtSuspendProcess": 435, "NtSuspendThread": 436, "NtSystemDebugControl": 437, "NtTerminateEnclave": 438, "NtTerminateJobObject": 439, "NtTestAlert": 440, "NtThawRegistry": 441, "NtThawTransactions": 442, "NtTraceControl": 443, "NtTranslateFilePath": 444, "NtUmsThreadYield": 445, "NtUnloadDriver": 446, "NtUnloadKey": 447, "NtUnloadKey2": 448, "NtUnloadKeyEx": 449, "NtUnlockFile": 450, "NtUnlockVirtualMemory": 451, "NtUnmapViewOfSectionEx": 452, "NtUnsubscribeWnfStateChange": 453, "NtUpdateWnfStateData": 454, "NtVdmControl": 455, "NtWaitForAlertByThreadId": 456, "NtWaitForDebugEvent": 457, "NtWaitForKeyedEvent": 458, "NtWaitForWorkViaWorkerFactory": 459, "NtWaitHighEventPair": 460, "NtWaitLowEventPair": 461}, "1809": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireProcessActivityReference": 103, "NtAddAtomEx": 104, "NtAddBootEntry": 105, "NtAddDriverEntry": 106, "NtAdjustGroupsToken": 107, "NtAdjustTokenClaimsAndDeviceGroups": 108, "NtAlertResumeThread": 109, "NtAlertThread": 110, "NtAlertThreadByThreadId": 111, "NtAllocateLocallyUniqueId": 112, "NtAllocateReserveObject": 113, "NtAllocateUserPhysicalPages": 114, "NtAllocateUuids": 115, "NtAllocateVirtualMemoryEx": 116, "NtAlpcAcceptConnectPort": 117, "NtAlpcCancelMessage": 118, "NtAlpcConnectPort": 119, "NtAlpcConnectPortEx": 120, "NtAlpcCreatePort": 121, "NtAlpcCreatePortSection": 122, "NtAlpcCreateResourceReserve": 123, "NtAlpcCreateSectionView": 124, "NtAlpcCreateSecurityContext": 125, "NtAlpcDeletePortSection": 126, "NtAlpcDeleteResourceReserve": 127, "NtAlpcDeleteSectionView": 128, "NtAlpcDeleteSecurityContext": 129, "NtAlpcDisconnectPort": 130, "NtAlpcImpersonateClientContainerOfPort": 131, "NtAlpcImpersonateClientOfPort": 132, "NtAlpcOpenSenderProcess": 133, "NtAlpcOpenSenderThread": 134, "NtAlpcQueryInformation": 135, "NtAlpcQueryInformationMessage": 136, "NtAlpcRevokeSecurityContext": 137, "NtAlpcSendWaitReceivePort": 138, "NtAlpcSetInformation": 139, "NtAreMappedFilesTheSame": 140, "NtAssignProcessToJobObject": 141, "NtAssociateWaitCompletionPacket": 142, "NtCallEnclave": 143, "NtCancelIoFileEx": 144, "NtCancelSynchronousIoFile": 145, "NtCancelTimer2": 146, "NtCancelWaitCompletionPacket": 147, "NtCommitComplete": 148, "NtCommitEnlistment": 149, "NtCommitRegistryTransaction": 150, "NtCommitTransaction": 151, "NtCompactKeys": 152, "NtCompareObjects": 153, "NtCompareSigningLevels": 154, "NtCompareTokens": 155, "NtCompleteConnectPort": 156, "NtCompressKey": 157, "NtConnectPort": 158, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 159, "NtCreateDebugObject": 160, "NtCreateDirectoryObject": 161, "NtCreateDirectoryObjectEx": 162, "NtCreateEnclave": 163, "NtCreateEnlistment": 164, "NtCreateEventPair": 165, "NtCreateIRTimer": 166, "NtCreateIoCompletion": 167, "NtCreateJobObject": 168, "NtCreateJobSet": 169, "NtCreateKeyTransacted": 170, "NtCreateKeyedEvent": 171, "NtCreateLowBoxToken": 172, "NtCreateMailslotFile": 173, "NtCreateMutant": 174, "NtCreateNamedPipeFile": 175, "NtCreatePagingFile": 176, "NtCreatePartition": 177, "NtCreatePort": 178, "NtCreatePrivateNamespace": 179, "NtCreateProcess": 180, "NtCreateProfile": 181, "NtCreateProfileEx": 182, "NtCreateRegistryTransaction": 183, "NtCreateResourceManager": 184, "NtCreateSectionEx": 185, "NtCreateSemaphore": 186, "NtCreateSymbolicLinkObject": 187, "NtCreateThreadEx": 188, "NtCreateTimer": 189, "NtCreateTimer2": 190, "NtCreateToken": 191, "NtCreateTokenEx": 192, "NtCreateTransaction": 193, "NtCreateTransactionManager": 194, "NtCreateUserProcess": 195, "NtCreateWaitCompletionPacket": 196, "NtCreateWaitablePort": 197, "NtCreateWnfStateName": 198, "NtCreateWorkerFactory": 199, "NtDebugActiveProcess": 200, "NtDebugContinue": 201, "NtDeleteAtom": 202, "NtDeleteBootEntry": 203, "NtDeleteDriverEntry": 204, "NtDeleteFile": 205, "NtDeleteKey": 206, "NtDeleteObjectAuditAlarm": 207, "NtDeletePrivateNamespace": 208, "NtDeleteValueKey": 209, "NtDeleteWnfStateData": 210, "NtDeleteWnfStateName": 211, "NtDisableLastKnownGood": 212, "NtDisplayString": 213, "NtDrawText": 214, "NtEnableLastKnownGood": 215, "NtEnumerateBootEntries": 216, "NtEnumerateDriverEntries": 217, "NtEnumerateSystemEnvironmentValuesEx": 218, "NtEnumerateTransactionObject": 219, "NtExtendSection": 220, "NtFilterBootOption": 221, "NtFilterToken": 222, "NtFilterTokenEx": 223, "NtFlushBuffersFileEx": 224, "NtFlushInstallUILanguage": 225, "NtFlushInstructionCache": 226, "NtFlushKey": 227, "NtFlushProcessWriteBuffers": 228, "NtFlushVirtualMemory": 229, "NtFlushWriteBuffer": 230, "NtFreeUserPhysicalPages": 231, "NtFreezeRegistry": 232, "NtFreezeTransactions": 233, "NtGetCachedSigningLevel": 234, "NtGetCompleteWnfStateSubscription": 235, "NtGetContextThread": 236, "NtGetCurrentProcessorNumber": 237, "NtGetCurrentProcessorNumberEx": 238, "NtGetDevicePowerState": 239, "NtGetMUIRegistryInfo": 240, "NtGetNextProcess": 241, "NtGetNextThread": 242, "NtGetNlsSectionPtr": 243, "NtGetNotificationResourceManager": 244, "NtGetWriteWatch": 245, "NtImpersonateAnonymousToken": 246, "NtImpersonateThread": 247, "NtInitializeEnclave": 248, "NtInitializeNlsFiles": 249, "NtInitializeRegistry": 250, "NtInitiatePowerAction": 251, "NtIsSystemResumeAutomatic": 252, "NtIsUILanguageComitted": 253, "NtListenPort": 254, "NtLoadDriver": 255, "NtLoadEnclaveData": 256, "NtLoadKey": 257, "NtLoadKey2": 258, "NtLoadKeyEx": 259, "NtLockFile": 260, "NtLockProductActivationKeys": 261, "NtLockRegistryKey": 262, "NtLockVirtualMemory": 263, "NtMakePermanentObject": 264, "NtMakeTemporaryObject": 265, "NtManageHotPatch": 266, "NtManagePartition": 267, "NtMapCMFModule": 268, "NtMapUserPhysicalPages": 269, "NtMapViewOfSectionEx": 270, "NtModifyBootEntry": 271, "NtModifyDriverEntry": 272, "NtNotifyChangeDirectoryFile": 273, "NtNotifyChangeDirectoryFileEx": 274, "NtNotifyChangeKey": 275, "NtNotifyChangeMultipleKeys": 276, "NtNotifyChangeSession": 277, "NtOpenEnlistment": 278, "NtOpenEventPair": 279, "NtOpenIoCompletion": 280, "NtOpenJobObject": 281, "NtOpenKeyEx": 282, "NtOpenKeyTransacted": 283, "NtOpenKeyTransactedEx": 284, "NtOpenKeyedEvent": 285, "NtOpenMutant": 286, "NtOpenObjectAuditAlarm": 287, "NtOpenPartition": 288, "NtOpenPrivateNamespace": 289, "NtOpenProcessToken": 290, "NtOpenRegistryTransaction": 291, "NtOpenResourceManager": 292, "NtOpenSemaphore": 293, "NtOpenSession": 294, "NtOpenSymbolicLinkObject": 295, "NtOpenThread": 296, "NtOpenTimer": 297, "NtOpenTransaction": 298, "NtOpenTransactionManager": 299, "NtPlugPlayControl": 300, "NtPrePrepareComplete": 301, "NtPrePrepareEnlistment": 302, "NtPrepareComplete": 303, "NtPrepareEnlistment": 304, "NtPrivilegeCheck": 305, "NtPrivilegeObjectAuditAlarm": 306, "NtPrivilegedServiceAuditAlarm": 307, "NtPropagationComplete": 308, "NtPropagationFailed": 309, "NtPulseEvent": 310, "NtQueryAuxiliaryCounterFrequency": 311, "NtQueryBootEntryOrder": 312, "NtQueryBootOptions": 313, "NtQueryDebugFilterState": 314, "NtQueryDirectoryFileEx": 315, "NtQueryDirectoryObject": 316, "NtQueryDriverEntryOrder": 317, "NtQueryEaFile": 318, "NtQueryFullAttributesFile": 319, "NtQueryInformationAtom": 320, "NtQueryInformationByName": 321, "NtQueryInformationEnlistment": 322, "NtQueryInformationJobObject": 323, "NtQueryInformationPort": 324, "NtQueryInformationResourceManager": 325, "NtQueryInformationTransaction": 326, "NtQueryInformationTransactionManager": 327, "NtQueryInformationWorkerFactory": 328, "NtQueryInstallUILanguage": 329, "NtQueryIntervalProfile": 330, "NtQueryIoCompletion": 331, "NtQueryLicenseValue": 332, "NtQueryMultipleValueKey": 333, "NtQueryMutant": 334, "NtQueryOpenSubKeys": 335, "NtQueryOpenSubKeysEx": 336, "NtQueryPortInformationProcess": 337, "NtQueryQuotaInformationFile": 338, "NtQuerySecurityAttributesToken": 339, "NtQuerySecurityObject": 340, "NtQuerySecurityPolicy": 341, "NtQuerySemaphore": 342, "NtQuerySymbolicLinkObject": 343, "NtQuerySystemEnvironmentValue": 344, "NtQuerySystemEnvironmentValueEx": 345, "NtQuerySystemInformationEx": 346, "NtQueryTimerResolution": 347, "NtQueryWnfStateData": 348, "NtQueryWnfStateNameInformation": 349, "NtQueueApcThreadEx": 350, "NtRaiseException": 351, "NtRaiseHardError": 352, "NtReadOnlyEnlistment": 353, "NtRecoverEnlistment": 354, "NtRecoverResourceManager": 355, "NtRecoverTransactionManager": 356, "NtRegisterProtocolAddressInformation": 357, "NtRegisterThreadTerminatePort": 358, "NtReleaseKeyedEvent": 359, "NtReleaseWorkerFactoryWorker": 360, "NtRemoveIoCompletionEx": 361, "NtRemoveProcessDebug": 362, "NtRenameKey": 363, "NtRenameTransactionManager": 364, "NtReplaceKey": 365, "NtReplacePartitionUnit": 366, "NtReplyWaitReplyPort": 367, "NtRequestPort": 368, "NtResetEvent": 369, "NtResetWriteWatch": 370, "NtRestoreKey": 371, "NtResumeProcess": 372, "NtRevertContainerImpersonation": 373, "NtRollbackComplete": 374, "NtRollbackEnlistment": 375, "NtRollbackRegistryTransaction": 376, "NtRollbackTransaction": 377, "NtRollforwardTransactionManager": 378, "NtSaveKey": 379, "NtSaveKeyEx": 380, "NtSaveMergedKeys": 381, "NtSecureConnectPort": 382, "NtSerializeBoot": 383, "NtSetBootEntryOrder": 384, "NtSetBootOptions": 385, "NtSetCachedSigningLevel": 386, "NtSetCachedSigningLevel2": 387, "NtSetContextThread": 388, "NtSetDebugFilterState": 389, "NtSetDefaultHardErrorPort": 390, "NtSetDefaultLocale": 391, "NtSetDefaultUILanguage": 392, "NtSetDriverEntryOrder": 393, "NtSetEaFile": 394, "NtSetHighEventPair": 395, "NtSetHighWaitLowEventPair": 396, "NtSetIRTimer": 397, "NtSetInformationDebugObject": 398, "NtSetInformationEnlistment": 399, "NtSetInformationJobObject": 400, "NtSetInformationKey": 401, "NtSetInformationResourceManager": 402, "NtSetInformationSymbolicLink": 403, "NtSetInformationToken": 404, "NtSetInformationTransaction": 405, "NtSetInformationTransactionManager": 406, "NtSetInformationVirtualMemory": 407, "NtSetInformationWorkerFactory": 408, "NtSetIntervalProfile": 409, "NtSetIoCompletion": 410, "NtSetIoCompletionEx": 411, "NtSetLdtEntries": 412, "NtSetLowEventPair": 413, "NtSetLowWaitHighEventPair": 414, "NtSetQuotaInformationFile": 415, "NtSetSecurityObject": 416, "NtSetSystemEnvironmentValue": 417, "NtSetSystemEnvironmentValueEx": 418, "NtSetSystemInformation": 419, "NtSetSystemPowerState": 420, "NtSetSystemTime": 421, "NtSetThreadExecutionState": 422, "NtSetTimer2": 423, "NtSetTimerEx": 424, "NtSetTimerResolution": 425, "NtSetUuidSeed": 426, "NtSetVolumeInformationFile": 427, "NtSetWnfProcessNotificationEvent": 428, "NtShutdownSystem": 429, "NtShutdownWorkerFactory": 430, "NtSignalAndWaitForSingleObject": 431, "NtSinglePhaseReject": 432, "NtStartProfile": 433, "NtStopProfile": 434, "NtSubscribeWnfStateChange": 435, "NtSuspendProcess": 436, "NtSuspendThread": 437, "NtSystemDebugControl": 438, "NtTerminateEnclave": 439, "NtTerminateJobObject": 440, "NtTestAlert": 441, "NtThawRegistry": 442, "NtThawTransactions": 443, "NtTraceControl": 444, "NtTranslateFilePath": 445, "NtUmsThreadYield": 446, "NtUnloadDriver": 447, "NtUnloadKey": 448, "NtUnloadKey2": 449, "NtUnloadKeyEx": 450, "NtUnlockFile": 451, "NtUnlockVirtualMemory": 452, "NtUnmapViewOfSectionEx": 453, "NtUnsubscribeWnfStateChange": 454, "NtUpdateWnfStateData": 455, "NtVdmControl": 456, "NtWaitForAlertByThreadId": 457, "NtWaitForDebugEvent": 458, "NtWaitForKeyedEvent": 459, "NtWaitForWorkViaWorkerFactory": 460, "NtWaitHighEventPair": 461, "NtWaitLowEventPair": 462}, "1903": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireProcessActivityReference": 103, "NtAddAtomEx": 104, "NtAddBootEntry": 105, "NtAddDriverEntry": 106, "NtAdjustGroupsToken": 107, "NtAdjustTokenClaimsAndDeviceGroups": 108, "NtAlertResumeThread": 109, "NtAlertThread": 110, "NtAlertThreadByThreadId": 111, "NtAllocateLocallyUniqueId": 112, "NtAllocateReserveObject": 113, "NtAllocateUserPhysicalPages": 114, "NtAllocateUuids": 115, "NtAllocateVirtualMemoryEx": 116, "NtAlpcAcceptConnectPort": 117, "NtAlpcCancelMessage": 118, "NtAlpcConnectPort": 119, "NtAlpcConnectPortEx": 120, "NtAlpcCreatePort": 121, "NtAlpcCreatePortSection": 122, "NtAlpcCreateResourceReserve": 123, "NtAlpcCreateSectionView": 124, "NtAlpcCreateSecurityContext": 125, "NtAlpcDeletePortSection": 126, "NtAlpcDeleteResourceReserve": 127, "NtAlpcDeleteSectionView": 128, "NtAlpcDeleteSecurityContext": 129, "NtAlpcDisconnectPort": 130, "NtAlpcImpersonateClientContainerOfPort": 131, "NtAlpcImpersonateClientOfPort": 132, "NtAlpcOpenSenderProcess": 133, "NtAlpcOpenSenderThread": 134, "NtAlpcQueryInformation": 135, "NtAlpcQueryInformationMessage": 136, "NtAlpcRevokeSecurityContext": 137, "NtAlpcSendWaitReceivePort": 138, "NtAlpcSetInformation": 139, "NtAreMappedFilesTheSame": 140, "NtAssignProcessToJobObject": 141, "NtAssociateWaitCompletionPacket": 142, "NtCallEnclave": 143, "NtCancelIoFileEx": 144, "NtCancelSynchronousIoFile": 145, "NtCancelTimer2": 146, "NtCancelWaitCompletionPacket": 147, "NtCommitComplete": 148, "NtCommitEnlistment": 149, "NtCommitRegistryTransaction": 150, "NtCommitTransaction": 151, "NtCompactKeys": 152, "NtCompareObjects": 153, "NtCompareSigningLevels": 154, "NtCompareTokens": 155, "NtCompleteConnectPort": 156, "NtCompressKey": 157, "NtConnectPort": 158, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 159, "NtCreateCrossVmEvent": 160, "NtCreateDebugObject": 161, "NtCreateDirectoryObject": 162, "NtCreateDirectoryObjectEx": 163, "NtCreateEnclave": 164, "NtCreateEnlistment": 165, "NtCreateEventPair": 166, "NtCreateIRTimer": 167, "NtCreateIoCompletion": 168, "NtCreateJobObject": 169, "NtCreateJobSet": 170, "NtCreateKeyTransacted": 171, "NtCreateKeyedEvent": 172, "NtCreateLowBoxToken": 173, "NtCreateMailslotFile": 174, "NtCreateMutant": 175, "NtCreateNamedPipeFile": 176, "NtCreatePagingFile": 177, "NtCreatePartition": 178, "NtCreatePort": 179, "NtCreatePrivateNamespace": 180, "NtCreateProcess": 181, "NtCreateProfile": 182, "NtCreateProfileEx": 183, "NtCreateRegistryTransaction": 184, "NtCreateResourceManager": 185, "NtCreateSectionEx": 186, "NtCreateSemaphore": 187, "NtCreateSymbolicLinkObject": 188, "NtCreateThreadEx": 189, "NtCreateTimer": 190, "NtCreateTimer2": 191, "NtCreateToken": 192, "NtCreateTokenEx": 193, "NtCreateTransaction": 194, "NtCreateTransactionManager": 195, "NtCreateUserProcess": 196, "NtCreateWaitCompletionPacket": 197, "NtCreateWaitablePort": 198, "NtCreateWnfStateName": 199, "NtCreateWorkerFactory": 200, "NtDebugActiveProcess": 201, "NtDebugContinue": 202, "NtDeleteAtom": 203, "NtDeleteBootEntry": 204, "NtDeleteDriverEntry": 205, "NtDeleteFile": 206, "NtDeleteKey": 207, "NtDeleteObjectAuditAlarm": 208, "NtDeletePrivateNamespace": 209, "NtDeleteValueKey": 210, "NtDeleteWnfStateData": 211, "NtDeleteWnfStateName": 212, "NtDisableLastKnownGood": 213, "NtDisplayString": 214, "NtDrawText": 215, "NtEnableLastKnownGood": 216, "NtEnumerateBootEntries": 217, "NtEnumerateDriverEntries": 218, "NtEnumerateSystemEnvironmentValuesEx": 219, "NtEnumerateTransactionObject": 220, "NtExtendSection": 221, "NtFilterBootOption": 222, "NtFilterToken": 223, "NtFilterTokenEx": 224, "NtFlushBuffersFileEx": 225, "NtFlushInstallUILanguage": 226, "NtFlushInstructionCache": 227, "NtFlushKey": 228, "NtFlushProcessWriteBuffers": 229, "NtFlushVirtualMemory": 230, "NtFlushWriteBuffer": 231, "NtFreeUserPhysicalPages": 232, "NtFreezeRegistry": 233, "NtFreezeTransactions": 234, "NtGetCachedSigningLevel": 235, "NtGetCompleteWnfStateSubscription": 236, "NtGetContextThread": 237, "NtGetCurrentProcessorNumber": 238, "NtGetCurrentProcessorNumberEx": 239, "NtGetDevicePowerState": 240, "NtGetMUIRegistryInfo": 241, "NtGetNextProcess": 242, "NtGetNextThread": 243, "NtGetNlsSectionPtr": 244, "NtGetNotificationResourceManager": 245, "NtGetWriteWatch": 246, "NtImpersonateAnonymousToken": 247, "NtImpersonateThread": 248, "NtInitializeEnclave": 249, "NtInitializeNlsFiles": 250, "NtInitializeRegistry": 251, "NtInitiatePowerAction": 252, "NtIsSystemResumeAutomatic": 253, "NtIsUILanguageComitted": 254, "NtListenPort": 255, "NtLoadDriver": 256, "NtLoadEnclaveData": 257, "NtLoadKey": 258, "NtLoadKey2": 259, "NtLoadKeyEx": 260, "NtLockFile": 261, "NtLockProductActivationKeys": 262, "NtLockRegistryKey": 263, "NtLockVirtualMemory": 264, "NtMakePermanentObject": 265, "NtMakeTemporaryObject": 266, "NtManageHotPatch": 267, "NtManagePartition": 268, "NtMapCMFModule": 269, "NtMapUserPhysicalPages": 270, "NtMapViewOfSectionEx": 271, "NtModifyBootEntry": 272, "NtModifyDriverEntry": 273, "NtNotifyChangeDirectoryFile": 274, "NtNotifyChangeDirectoryFileEx": 275, "NtNotifyChangeKey": 276, "NtNotifyChangeMultipleKeys": 277, "NtNotifyChangeSession": 278, "NtOpenEnlistment": 279, "NtOpenEventPair": 280, "NtOpenIoCompletion": 281, "NtOpenJobObject": 282, "NtOpenKeyEx": 283, "NtOpenKeyTransacted": 284, "NtOpenKeyTransactedEx": 285, "NtOpenKeyedEvent": 286, "NtOpenMutant": 287, "NtOpenObjectAuditAlarm": 288, "NtOpenPartition": 289, "NtOpenPrivateNamespace": 290, "NtOpenProcessToken": 291, "NtOpenRegistryTransaction": 292, "NtOpenResourceManager": 293, "NtOpenSemaphore": 294, "NtOpenSession": 295, "NtOpenSymbolicLinkObject": 296, "NtOpenThread": 297, "NtOpenTimer": 298, "NtOpenTransaction": 299, "NtOpenTransactionManager": 300, "NtPlugPlayControl": 301, "NtPrePrepareComplete": 302, "NtPrePrepareEnlistment": 303, "NtPrepareComplete": 304, "NtPrepareEnlistment": 305, "NtPrivilegeCheck": 306, "NtPrivilegeObjectAuditAlarm": 307, "NtPrivilegedServiceAuditAlarm": 308, "NtPropagationComplete": 309, "NtPropagationFailed": 310, "NtPulseEvent": 311, "NtQueryAuxiliaryCounterFrequency": 312, "NtQueryBootEntryOrder": 313, "NtQueryBootOptions": 314, "NtQueryDebugFilterState": 315, "NtQueryDirectoryFileEx": 316, "NtQueryDirectoryObject": 317, "NtQueryDriverEntryOrder": 318, "NtQueryEaFile": 319, "NtQueryFullAttributesFile": 320, "NtQueryInformationAtom": 321, "NtQueryInformationByName": 322, "NtQueryInformationEnlistment": 323, "NtQueryInformationJobObject": 324, "NtQueryInformationPort": 325, "NtQueryInformationResourceManager": 326, "NtQueryInformationTransaction": 327, "NtQueryInformationTransactionManager": 328, "NtQueryInformationWorkerFactory": 329, "NtQueryInstallUILanguage": 330, "NtQueryIntervalProfile": 331, "NtQueryIoCompletion": 332, "NtQueryLicenseValue": 333, "NtQueryMultipleValueKey": 334, "NtQueryMutant": 335, "NtQueryOpenSubKeys": 336, "NtQueryOpenSubKeysEx": 337, "NtQueryPortInformationProcess": 338, "NtQueryQuotaInformationFile": 339, "NtQuerySecurityAttributesToken": 340, "NtQuerySecurityObject": 341, "NtQuerySecurityPolicy": 342, "NtQuerySemaphore": 343, "NtQuerySymbolicLinkObject": 344, "NtQuerySystemEnvironmentValue": 345, "NtQuerySystemEnvironmentValueEx": 346, "NtQuerySystemInformationEx": 347, "NtQueryTimerResolution": 348, "NtQueryWnfStateData": 349, "NtQueryWnfStateNameInformation": 350, "NtQueueApcThreadEx": 351, "NtRaiseException": 352, "NtRaiseHardError": 353, "NtReadOnlyEnlistment": 354, "NtRecoverEnlistment": 355, "NtRecoverResourceManager": 356, "NtRecoverTransactionManager": 357, "NtRegisterProtocolAddressInformation": 358, "NtRegisterThreadTerminatePort": 359, "NtReleaseKeyedEvent": 360, "NtReleaseWorkerFactoryWorker": 361, "NtRemoveIoCompletionEx": 362, "NtRemoveProcessDebug": 363, "NtRenameKey": 364, "NtRenameTransactionManager": 365, "NtReplaceKey": 366, "NtReplacePartitionUnit": 367, "NtReplyWaitReplyPort": 368, "NtRequestPort": 369, "NtResetEvent": 370, "NtResetWriteWatch": 371, "NtRestoreKey": 372, "NtResumeProcess": 373, "NtRevertContainerImpersonation": 374, "NtRollbackComplete": 375, "NtRollbackEnlistment": 376, "NtRollbackRegistryTransaction": 377, "NtRollbackTransaction": 378, "NtRollforwardTransactionManager": 379, "NtSaveKey": 380, "NtSaveKeyEx": 381, "NtSaveMergedKeys": 382, "NtSecureConnectPort": 383, "NtSerializeBoot": 384, "NtSetBootEntryOrder": 385, "NtSetBootOptions": 386, "NtSetCachedSigningLevel": 387, "NtSetCachedSigningLevel2": 388, "NtSetContextThread": 389, "NtSetDebugFilterState": 390, "NtSetDefaultHardErrorPort": 391, "NtSetDefaultLocale": 392, "NtSetDefaultUILanguage": 393, "NtSetDriverEntryOrder": 394, "NtSetEaFile": 395, "NtSetHighEventPair": 396, "NtSetHighWaitLowEventPair": 397, "NtSetIRTimer": 398, "NtSetInformationDebugObject": 399, "NtSetInformationEnlistment": 400, "NtSetInformationJobObject": 401, "NtSetInformationKey": 402, "NtSetInformationResourceManager": 403, "NtSetInformationSymbolicLink": 404, "NtSetInformationToken": 405, "NtSetInformationTransaction": 406, "NtSetInformationTransactionManager": 407, "NtSetInformationVirtualMemory": 408, "NtSetInformationWorkerFactory": 409, "NtSetIntervalProfile": 410, "NtSetIoCompletion": 411, "NtSetIoCompletionEx": 412, "NtSetLdtEntries": 413, "NtSetLowEventPair": 414, "NtSetLowWaitHighEventPair": 415, "NtSetQuotaInformationFile": 416, "NtSetSecurityObject": 417, "NtSetSystemEnvironmentValue": 418, "NtSetSystemEnvironmentValueEx": 419, "NtSetSystemInformation": 420, "NtSetSystemPowerState": 421, "NtSetSystemTime": 422, "NtSetThreadExecutionState": 423, "NtSetTimer2": 424, "NtSetTimerEx": 425, "NtSetTimerResolution": 426, "NtSetUuidSeed": 427, "NtSetVolumeInformationFile": 428, "NtSetWnfProcessNotificationEvent": 429, "NtShutdownSystem": 430, "NtShutdownWorkerFactory": 431, "NtSignalAndWaitForSingleObject": 432, "NtSinglePhaseReject": 433, "NtStartProfile": 434, "NtStopProfile": 435, "NtSubscribeWnfStateChange": 436, "NtSuspendProcess": 437, "NtSuspendThread": 438, "NtSystemDebugControl": 439, "NtTerminateEnclave": 440, "NtTerminateJobObject": 441, "NtTestAlert": 442, "NtThawRegistry": 443, "NtThawTransactions": 444, "NtTraceControl": 445, "NtTranslateFilePath": 446, "NtUmsThreadYield": 447, "NtUnloadDriver": 448, "NtUnloadKey": 449, "NtUnloadKey2": 450, "NtUnloadKeyEx": 451, "NtUnlockFile": 452, "NtUnlockVirtualMemory": 453, "NtUnmapViewOfSectionEx": 454, "NtUnsubscribeWnfStateChange": 455, "NtUpdateWnfStateData": 456, "NtVdmControl": 457, "NtWaitForAlertByThreadId": 458, "NtWaitForDebugEvent": 459, "NtWaitForKeyedEvent": 460, "NtWaitForWorkViaWorkerFactory": 461, "NtWaitHighEventPair": 462, "NtWaitLowEventPair": 463}, "1909": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireProcessActivityReference": 103, "NtAddAtomEx": 104, "NtAddBootEntry": 105, "NtAddDriverEntry": 106, "NtAdjustGroupsToken": 107, "NtAdjustTokenClaimsAndDeviceGroups": 108, "NtAlertResumeThread": 109, "NtAlertThread": 110, "NtAlertThreadByThreadId": 111, "NtAllocateLocallyUniqueId": 112, "NtAllocateReserveObject": 113, "NtAllocateUserPhysicalPages": 114, "NtAllocateUuids": 115, "NtAllocateVirtualMemoryEx": 116, "NtAlpcAcceptConnectPort": 117, "NtAlpcCancelMessage": 118, "NtAlpcConnectPort": 119, "NtAlpcConnectPortEx": 120, "NtAlpcCreatePort": 121, "NtAlpcCreatePortSection": 122, "NtAlpcCreateResourceReserve": 123, "NtAlpcCreateSectionView": 124, "NtAlpcCreateSecurityContext": 125, "NtAlpcDeletePortSection": 126, "NtAlpcDeleteResourceReserve": 127, "NtAlpcDeleteSectionView": 128, "NtAlpcDeleteSecurityContext": 129, "NtAlpcDisconnectPort": 130, "NtAlpcImpersonateClientContainerOfPort": 131, "NtAlpcImpersonateClientOfPort": 132, "NtAlpcOpenSenderProcess": 133, "NtAlpcOpenSenderThread": 134, "NtAlpcQueryInformation": 135, "NtAlpcQueryInformationMessage": 136, "NtAlpcRevokeSecurityContext": 137, "NtAlpcSendWaitReceivePort": 138, "NtAlpcSetInformation": 139, "NtAreMappedFilesTheSame": 140, "NtAssignProcessToJobObject": 141, "NtAssociateWaitCompletionPacket": 142, "NtCallEnclave": 143, "NtCancelIoFileEx": 144, "NtCancelSynchronousIoFile": 145, "NtCancelTimer2": 146, "NtCancelWaitCompletionPacket": 147, "NtCommitComplete": 148, "NtCommitEnlistment": 149, "NtCommitRegistryTransaction": 150, "NtCommitTransaction": 151, "NtCompactKeys": 152, "NtCompareObjects": 153, "NtCompareSigningLevels": 154, "NtCompareTokens": 155, "NtCompleteConnectPort": 156, "NtCompressKey": 157, "NtConnectPort": 158, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 159, "NtCreateCrossVmEvent": 160, "NtCreateDebugObject": 161, "NtCreateDirectoryObject": 162, "NtCreateDirectoryObjectEx": 163, "NtCreateEnclave": 164, "NtCreateEnlistment": 165, "NtCreateEventPair": 166, "NtCreateIRTimer": 167, "NtCreateIoCompletion": 168, "NtCreateJobObject": 169, "NtCreateJobSet": 170, "NtCreateKeyTransacted": 171, "NtCreateKeyedEvent": 172, "NtCreateLowBoxToken": 173, "NtCreateMailslotFile": 174, "NtCreateMutant": 175, "NtCreateNamedPipeFile": 176, "NtCreatePagingFile": 177, "NtCreatePartition": 178, "NtCreatePort": 179, "NtCreatePrivateNamespace": 180, "NtCreateProcess": 181, "NtCreateProfile": 182, "NtCreateProfileEx": 183, "NtCreateRegistryTransaction": 184, "NtCreateResourceManager": 185, "NtCreateSectionEx": 186, "NtCreateSemaphore": 187, "NtCreateSymbolicLinkObject": 188, "NtCreateThreadEx": 189, "NtCreateTimer": 190, "NtCreateTimer2": 191, "NtCreateToken": 192, "NtCreateTokenEx": 193, "NtCreateTransaction": 194, "NtCreateTransactionManager": 195, "NtCreateUserProcess": 196, "NtCreateWaitCompletionPacket": 197, "NtCreateWaitablePort": 198, "NtCreateWnfStateName": 199, "NtCreateWorkerFactory": 200, "NtDebugActiveProcess": 201, "NtDebugContinue": 202, "NtDeleteAtom": 203, "NtDeleteBootEntry": 204, "NtDeleteDriverEntry": 205, "NtDeleteFile": 206, "NtDeleteKey": 207, "NtDeleteObjectAuditAlarm": 208, "NtDeletePrivateNamespace": 209, "NtDeleteValueKey": 210, "NtDeleteWnfStateData": 211, "NtDeleteWnfStateName": 212, "NtDisableLastKnownGood": 213, "NtDisplayString": 214, "NtDrawText": 215, "NtEnableLastKnownGood": 216, "NtEnumerateBootEntries": 217, "NtEnumerateDriverEntries": 218, "NtEnumerateSystemEnvironmentValuesEx": 219, "NtEnumerateTransactionObject": 220, "NtExtendSection": 221, "NtFilterBootOption": 222, "NtFilterToken": 223, "NtFilterTokenEx": 224, "NtFlushBuffersFileEx": 225, "NtFlushInstallUILanguage": 226, "NtFlushInstructionCache": 227, "NtFlushKey": 228, "NtFlushProcessWriteBuffers": 229, "NtFlushVirtualMemory": 230, "NtFlushWriteBuffer": 231, "NtFreeUserPhysicalPages": 232, "NtFreezeRegistry": 233, "NtFreezeTransactions": 234, "NtGetCachedSigningLevel": 235, "NtGetCompleteWnfStateSubscription": 236, "NtGetContextThread": 237, "NtGetCurrentProcessorNumber": 238, "NtGetCurrentProcessorNumberEx": 239, "NtGetDevicePowerState": 240, "NtGetMUIRegistryInfo": 241, "NtGetNextProcess": 242, "NtGetNextThread": 243, "NtGetNlsSectionPtr": 244, "NtGetNotificationResourceManager": 245, "NtGetWriteWatch": 246, "NtImpersonateAnonymousToken": 247, "NtImpersonateThread": 248, "NtInitializeEnclave": 249, "NtInitializeNlsFiles": 250, "NtInitializeRegistry": 251, "NtInitiatePowerAction": 252, "NtIsSystemResumeAutomatic": 253, "NtIsUILanguageComitted": 254, "NtListenPort": 255, "NtLoadDriver": 256, "NtLoadEnclaveData": 257, "NtLoadKey": 258, "NtLoadKey2": 259, "NtLoadKeyEx": 260, "NtLockFile": 261, "NtLockProductActivationKeys": 262, "NtLockRegistryKey": 263, "NtLockVirtualMemory": 264, "NtMakePermanentObject": 265, "NtMakeTemporaryObject": 266, "NtManageHotPatch": 267, "NtManagePartition": 268, "NtMapCMFModule": 269, "NtMapUserPhysicalPages": 270, "NtMapViewOfSectionEx": 271, "NtModifyBootEntry": 272, "NtModifyDriverEntry": 273, "NtNotifyChangeDirectoryFile": 274, "NtNotifyChangeDirectoryFileEx": 275, "NtNotifyChangeKey": 276, "NtNotifyChangeMultipleKeys": 277, "NtNotifyChangeSession": 278, "NtOpenEnlistment": 279, "NtOpenEventPair": 280, "NtOpenIoCompletion": 281, "NtOpenJobObject": 282, "NtOpenKeyEx": 283, "NtOpenKeyTransacted": 284, "NtOpenKeyTransactedEx": 285, "NtOpenKeyedEvent": 286, "NtOpenMutant": 287, "NtOpenObjectAuditAlarm": 288, "NtOpenPartition": 289, "NtOpenPrivateNamespace": 290, "NtOpenProcessToken": 291, "NtOpenRegistryTransaction": 292, "NtOpenResourceManager": 293, "NtOpenSemaphore": 294, "NtOpenSession": 295, "NtOpenSymbolicLinkObject": 296, "NtOpenThread": 297, "NtOpenTimer": 298, "NtOpenTransaction": 299, "NtOpenTransactionManager": 300, "NtPlugPlayControl": 301, "NtPrePrepareComplete": 302, "NtPrePrepareEnlistment": 303, "NtPrepareComplete": 304, "NtPrepareEnlistment": 305, "NtPrivilegeCheck": 306, "NtPrivilegeObjectAuditAlarm": 307, "NtPrivilegedServiceAuditAlarm": 308, "NtPropagationComplete": 309, "NtPropagationFailed": 310, "NtPulseEvent": 311, "NtQueryAuxiliaryCounterFrequency": 312, "NtQueryBootEntryOrder": 313, "NtQueryBootOptions": 314, "NtQueryDebugFilterState": 315, "NtQueryDirectoryFileEx": 316, "NtQueryDirectoryObject": 317, "NtQueryDriverEntryOrder": 318, "NtQueryEaFile": 319, "NtQueryFullAttributesFile": 320, "NtQueryInformationAtom": 321, "NtQueryInformationByName": 322, "NtQueryInformationEnlistment": 323, "NtQueryInformationJobObject": 324, "NtQueryInformationPort": 325, "NtQueryInformationResourceManager": 326, "NtQueryInformationTransaction": 327, "NtQueryInformationTransactionManager": 328, "NtQueryInformationWorkerFactory": 329, "NtQueryInstallUILanguage": 330, "NtQueryIntervalProfile": 331, "NtQueryIoCompletion": 332, "NtQueryLicenseValue": 333, "NtQueryMultipleValueKey": 334, "NtQueryMutant": 335, "NtQueryOpenSubKeys": 336, "NtQueryOpenSubKeysEx": 337, "NtQueryPortInformationProcess": 338, "NtQueryQuotaInformationFile": 339, "NtQuerySecurityAttributesToken": 340, "NtQuerySecurityObject": 341, "NtQuerySecurityPolicy": 342, "NtQuerySemaphore": 343, "NtQuerySymbolicLinkObject": 344, "NtQuerySystemEnvironmentValue": 345, "NtQuerySystemEnvironmentValueEx": 346, "NtQuerySystemInformationEx": 347, "NtQueryTimerResolution": 348, "NtQueryWnfStateData": 349, "NtQueryWnfStateNameInformation": 350, "NtQueueApcThreadEx": 351, "NtRaiseException": 352, "NtRaiseHardError": 353, "NtReadOnlyEnlistment": 354, "NtRecoverEnlistment": 355, "NtRecoverResourceManager": 356, "NtRecoverTransactionManager": 357, "NtRegisterProtocolAddressInformation": 358, "NtRegisterThreadTerminatePort": 359, "NtReleaseKeyedEvent": 360, "NtReleaseWorkerFactoryWorker": 361, "NtRemoveIoCompletionEx": 362, "NtRemoveProcessDebug": 363, "NtRenameKey": 364, "NtRenameTransactionManager": 365, "NtReplaceKey": 366, "NtReplacePartitionUnit": 367, "NtReplyWaitReplyPort": 368, "NtRequestPort": 369, "NtResetEvent": 370, "NtResetWriteWatch": 371, "NtRestoreKey": 372, "NtResumeProcess": 373, "NtRevertContainerImpersonation": 374, "NtRollbackComplete": 375, "NtRollbackEnlistment": 376, "NtRollbackRegistryTransaction": 377, "NtRollbackTransaction": 378, "NtRollforwardTransactionManager": 379, "NtSaveKey": 380, "NtSaveKeyEx": 381, "NtSaveMergedKeys": 382, "NtSecureConnectPort": 383, "NtSerializeBoot": 384, "NtSetBootEntryOrder": 385, "NtSetBootOptions": 386, "NtSetCachedSigningLevel": 387, "NtSetCachedSigningLevel2": 388, "NtSetContextThread": 389, "NtSetDebugFilterState": 390, "NtSetDefaultHardErrorPort": 391, "NtSetDefaultLocale": 392, "NtSetDefaultUILanguage": 393, "NtSetDriverEntryOrder": 394, "NtSetEaFile": 395, "NtSetHighEventPair": 396, "NtSetHighWaitLowEventPair": 397, "NtSetIRTimer": 398, "NtSetInformationDebugObject": 399, "NtSetInformationEnlistment": 400, "NtSetInformationJobObject": 401, "NtSetInformationKey": 402, "NtSetInformationResourceManager": 403, "NtSetInformationSymbolicLink": 404, "NtSetInformationToken": 405, "NtSetInformationTransaction": 406, "NtSetInformationTransactionManager": 407, "NtSetInformationVirtualMemory": 408, "NtSetInformationWorkerFactory": 409, "NtSetIntervalProfile": 410, "NtSetIoCompletion": 411, "NtSetIoCompletionEx": 412, "NtSetLdtEntries": 413, "NtSetLowEventPair": 414, "NtSetLowWaitHighEventPair": 415, "NtSetQuotaInformationFile": 416, "NtSetSecurityObject": 417, "NtSetSystemEnvironmentValue": 418, "NtSetSystemEnvironmentValueEx": 419, "NtSetSystemInformation": 420, "NtSetSystemPowerState": 421, "NtSetSystemTime": 422, "NtSetThreadExecutionState": 423, "NtSetTimer2": 424, "NtSetTimerEx": 425, "NtSetTimerResolution": 426, "NtSetUuidSeed": 427, "NtSetVolumeInformationFile": 428, "NtSetWnfProcessNotificationEvent": 429, "NtShutdownSystem": 430, "NtShutdownWorkerFactory": 431, "NtSignalAndWaitForSingleObject": 432, "NtSinglePhaseReject": 433, "NtStartProfile": 434, "NtStopProfile": 435, "NtSubscribeWnfStateChange": 436, "NtSuspendProcess": 437, "NtSuspendThread": 438, "NtSystemDebugControl": 439, "NtTerminateEnclave": 440, "NtTerminateJobObject": 441, "NtTestAlert": 442, "NtThawRegistry": 443, "NtThawTransactions": 444, "NtTraceControl": 445, "NtTranslateFilePath": 446, "NtUmsThreadYield": 447, "NtUnloadDriver": 448, "NtUnloadKey": 449, "NtUnloadKey2": 450, "NtUnloadKeyEx": 451, "NtUnlockFile": 452, "NtUnlockVirtualMemory": 453, "NtUnmapViewOfSectionEx": 454, "NtUnsubscribeWnfStateChange": 455, "NtUpdateWnfStateData": 456, "NtVdmControl": 457, "NtWaitForAlertByThreadId": 458, "NtWaitForDebugEvent": 459, "NtWaitForKeyedEvent": 460, "NtWaitForWorkViaWorkerFactory": 461, "NtWaitHighEventPair": 462, "NtWaitLowEventPair": 463}, "2004": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireCrossVmMutant": 103, "NtAcquireProcessActivityReference": 104, "NtAddAtomEx": 105, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustGroupsToken": 108, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertResumeThread": 110, "NtAlertThread": 111, "NtAlertThreadByThreadId": 112, "NtAllocateLocallyUniqueId": 113, "NtAllocateReserveObject": 114, "NtAllocateUserPhysicalPages": 115, "NtAllocateUserPhysicalPagesEx": 116, "NtAllocateUuids": 117, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcConnectPort": 121, "NtAlpcConnectPortEx": 122, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtAreMappedFilesTheSame": 142, "NtAssignProcessToJobObject": 143, "NtAssociateWaitCompletionPacket": 144, "NtCallEnclave": 145, "NtCancelIoFileEx": 146, "NtCancelSynchronousIoFile": 147, "NtCancelTimer2": 148, "NtCancelWaitCompletionPacket": 149, "NtCommitComplete": 150, "NtCommitEnlistment": 151, "NtCommitRegistryTransaction": 152, "NtCommitTransaction": 153, "NtCompactKeys": 154, "NtCompareObjects": 155, "NtCompareSigningLevels": 156, "NtCompareTokens": 157, "NtCompleteConnectPort": 158, "NtCompressKey": 159, "NtConnectPort": 160, "NtContinueEx": 161, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 162, "NtCreateCrossVmEvent": 163, "NtCreateCrossVmMutant": 164, "NtCreateDebugObject": 165, "NtCreateDirectoryObject": 166, "NtCreateDirectoryObjectEx": 167, "NtCreateEnclave": 168, "NtCreateEnlistment": 169, "NtCreateEventPair": 170, "NtCreateIRTimer": 171, "NtCreateIoCompletion": 172, "NtCreateJobObject": 173, "NtCreateJobSet": 174, "NtCreateKeyTransacted": 175, "NtCreateKeyedEvent": 176, "NtCreateLowBoxToken": 177, "NtCreateMailslotFile": 178, "NtCreateMutant": 179, "NtCreateNamedPipeFile": 180, "NtCreatePagingFile": 181, "NtCreatePartition": 182, "NtCreatePort": 183, "NtCreatePrivateNamespace": 184, "NtCreateProcess": 185, "NtCreateProfile": 186, "NtCreateProfileEx": 187, "NtCreateRegistryTransaction": 188, "NtCreateResourceManager": 189, "NtCreateSectionEx": 190, "NtCreateSemaphore": 191, "NtCreateSymbolicLinkObject": 192, "NtCreateThreadEx": 193, "NtCreateTimer": 194, "NtCreateTimer2": 195, "NtCreateToken": 196, "NtCreateTokenEx": 197, "NtCreateTransaction": 198, "NtCreateTransactionManager": 199, "NtCreateUserProcess": 200, "NtCreateWaitCompletionPacket": 201, "NtCreateWaitablePort": 202, "NtCreateWnfStateName": 203, "NtCreateWorkerFactory": 204, "NtDebugActiveProcess": 205, "NtDebugContinue": 206, "NtDeleteAtom": 207, "NtDeleteBootEntry": 208, "NtDeleteDriverEntry": 209, "NtDeleteFile": 210, "NtDeleteKey": 211, "NtDeleteObjectAuditAlarm": 212, "NtDeletePrivateNamespace": 213, "NtDeleteValueKey": 214, "NtDeleteWnfStateData": 215, "NtDeleteWnfStateName": 216, "NtDirectGraphicsCall": 217, "NtDisableLastKnownGood": 218, "NtDisplayString": 219, "NtDrawText": 220, "NtEnableLastKnownGood": 221, "NtEnumerateBootEntries": 222, "NtEnumerateDriverEntries": 223, "NtEnumerateSystemEnvironmentValuesEx": 224, "NtEnumerateTransactionObject": 225, "NtExtendSection": 226, "NtFilterBootOption": 227, "NtFilterToken": 228, "NtFilterTokenEx": 229, "NtFlushBuffersFileEx": 230, "NtFlushInstallUILanguage": 231, "NtFlushInstructionCache": 232, "NtFlushKey": 233, "NtFlushProcessWriteBuffers": 234, "NtFlushVirtualMemory": 235, "NtFlushWriteBuffer": 236, "NtFreeUserPhysicalPages": 237, "NtFreezeRegistry": 238, "NtFreezeTransactions": 239, "NtGetCachedSigningLevel": 240, "NtGetCompleteWnfStateSubscription": 241, "NtGetContextThread": 242, "NtGetCurrentProcessorNumber": 243, "NtGetCurrentProcessorNumberEx": 244, "NtGetDevicePowerState": 245, "NtGetMUIRegistryInfo": 246, "NtGetNextProcess": 247, "NtGetNextThread": 248, "NtGetNlsSectionPtr": 249, "NtGetNotificationResourceManager": 250, "NtGetWriteWatch": 251, "NtImpersonateAnonymousToken": 252, "NtImpersonateThread": 253, "NtInitializeEnclave": 254, "NtInitializeNlsFiles": 255, "NtInitializeRegistry": 256, "NtInitiatePowerAction": 257, "NtIsSystemResumeAutomatic": 258, "NtIsUILanguageComitted": 259, "NtListenPort": 260, "NtLoadDriver": 261, "NtLoadEnclaveData": 262, "NtLoadKey": 263, "NtLoadKey2": 264, "NtLoadKeyEx": 265, "NtLockFile": 266, "NtLockProductActivationKeys": 267, "NtLockRegistryKey": 268, "NtLockVirtualMemory": 269, "NtMakePermanentObject": 270, "NtMakeTemporaryObject": 271, "NtManageHotPatch": 272, "NtManagePartition": 273, "NtMapCMFModule": 274, "NtMapUserPhysicalPages": 275, "NtMapViewOfSectionEx": 276, "NtModifyBootEntry": 277, "NtModifyDriverEntry": 278, "NtNotifyChangeDirectoryFile": 279, "NtNotifyChangeDirectoryFileEx": 280, "NtNotifyChangeKey": 281, "NtNotifyChangeMultipleKeys": 282, "NtNotifyChangeSession": 283, "NtOpenEnlistment": 284, "NtOpenEventPair": 285, "NtOpenIoCompletion": 286, "NtOpenJobObject": 287, "NtOpenKeyEx": 288, "NtOpenKeyTransacted": 289, "NtOpenKeyTransactedEx": 290, "NtOpenKeyedEvent": 291, "NtOpenMutant": 292, "NtOpenObjectAuditAlarm": 293, "NtOpenPartition": 294, "NtOpenPrivateNamespace": 295, "NtOpenProcessToken": 296, "NtOpenRegistryTransaction": 297, "NtOpenResourceManager": 298, "NtOpenSemaphore": 299, "NtOpenSession": 300, "NtOpenSymbolicLinkObject": 301, "NtOpenThread": 302, "NtOpenTimer": 303, "NtOpenTransaction": 304, "NtOpenTransactionManager": 305, "NtPlugPlayControl": 306, "NtPrePrepareComplete": 307, "NtPrePrepareEnlistment": 308, "NtPrepareComplete": 309, "NtPrepareEnlistment": 310, "NtPrivilegeCheck": 311, "NtPrivilegeObjectAuditAlarm": 312, "NtPrivilegedServiceAuditAlarm": 313, "NtPropagationComplete": 314, "NtPropagationFailed": 315, "NtPssCaptureVaSpaceBulk": 316, "NtPulseEvent": 317, "NtQueryAuxiliaryCounterFrequency": 318, "NtQueryBootEntryOrder": 319, "NtQueryBootOptions": 320, "NtQueryDebugFilterState": 321, "NtQueryDirectoryFileEx": 322, "NtQueryDirectoryObject": 323, "NtQueryDriverEntryOrder": 324, "NtQueryEaFile": 325, "NtQueryFullAttributesFile": 326, "NtQueryInformationAtom": 327, "NtQueryInformationByName": 328, "NtQueryInformationEnlistment": 329, "NtQueryInformationJobObject": 330, "NtQueryInformationPort": 331, "NtQueryInformationResourceManager": 332, "NtQueryInformationTransaction": 333, "NtQueryInformationTransactionManager": 334, "NtQueryInformationWorkerFactory": 335, "NtQueryInstallUILanguage": 336, "NtQueryIntervalProfile": 337, "NtQueryIoCompletion": 338, "NtQueryLicenseValue": 339, "NtQueryMultipleValueKey": 340, "NtQueryMutant": 341, "NtQueryOpenSubKeys": 342, "NtQueryOpenSubKeysEx": 343, "NtQueryPortInformationProcess": 344, "NtQueryQuotaInformationFile": 345, "NtQuerySecurityAttributesToken": 346, "NtQuerySecurityObject": 347, "NtQuerySecurityPolicy": 348, "NtQuerySemaphore": 349, "NtQuerySymbolicLinkObject": 350, "NtQuerySystemEnvironmentValue": 351, "NtQuerySystemEnvironmentValueEx": 352, "NtQuerySystemInformationEx": 353, "NtQueryTimerResolution": 354, "NtQueryWnfStateData": 355, "NtQueryWnfStateNameInformation": 356, "NtQueueApcThreadEx": 357, "NtRaiseException": 358, "NtRaiseHardError": 359, "NtReadOnlyEnlistment": 360, "NtRecoverEnlistment": 361, "NtRecoverResourceManager": 362, "NtRecoverTransactionManager": 363, "NtRegisterProtocolAddressInformation": 364, "NtRegisterThreadTerminatePort": 365, "NtReleaseKeyedEvent": 366, "NtReleaseWorkerFactoryWorker": 367, "NtRemoveIoCompletionEx": 368, "NtRemoveProcessDebug": 369, "NtRenameKey": 370, "NtRenameTransactionManager": 371, "NtReplaceKey": 372, "NtReplacePartitionUnit": 373, "NtReplyWaitReplyPort": 374, "NtRequestPort": 375, "NtResetEvent": 376, "NtResetWriteWatch": 377, "NtRestoreKey": 378, "NtResumeProcess": 379, "NtRevertContainerImpersonation": 380, "NtRollbackComplete": 381, "NtRollbackEnlistment": 382, "NtRollbackRegistryTransaction": 383, "NtRollbackTransaction": 384, "NtRollforwardTransactionManager": 385, "NtSaveKey": 386, "NtSaveKeyEx": 387, "NtSaveMergedKeys": 388, "NtSecureConnectPort": 389, "NtSerializeBoot": 390, "NtSetBootEntryOrder": 391, "NtSetBootOptions": 392, "NtSetCachedSigningLevel": 393, "NtSetCachedSigningLevel2": 394, "NtSetContextThread": 395, "NtSetDebugFilterState": 396, "NtSetDefaultHardErrorPort": 397, "NtSetDefaultLocale": 398, "NtSetDefaultUILanguage": 399, "NtSetDriverEntryOrder": 400, "NtSetEaFile": 401, "NtSetHighEventPair": 402, "NtSetHighWaitLowEventPair": 403, "NtSetIRTimer": 404, "NtSetInformationDebugObject": 405, "NtSetInformationEnlistment": 406, "NtSetInformationJobObject": 407, "NtSetInformationKey": 408, "NtSetInformationResourceManager": 409, "NtSetInformationSymbolicLink": 410, "NtSetInformationToken": 411, "NtSetInformationTransaction": 412, "NtSetInformationTransactionManager": 413, "NtSetInformationVirtualMemory": 414, "NtSetInformationWorkerFactory": 415, "NtSetIntervalProfile": 416, "NtSetIoCompletion": 417, "NtSetIoCompletionEx": 418, "NtSetLdtEntries": 419, "NtSetLowEventPair": 420, "NtSetLowWaitHighEventPair": 421, "NtSetQuotaInformationFile": 422, "NtSetSecurityObject": 423, "NtSetSystemEnvironmentValue": 424, "NtSetSystemEnvironmentValueEx": 425, "NtSetSystemInformation": 426, "NtSetSystemPowerState": 427, "NtSetSystemTime": 428, "NtSetThreadExecutionState": 429, "NtSetTimer2": 430, "NtSetTimerEx": 431, "NtSetTimerResolution": 432, "NtSetUuidSeed": 433, "NtSetVolumeInformationFile": 434, "NtSetWnfProcessNotificationEvent": 435, "NtShutdownSystem": 436, "NtShutdownWorkerFactory": 437, "NtSignalAndWaitForSingleObject": 438, "NtSinglePhaseReject": 439, "NtStartProfile": 440, "NtStopProfile": 441, "NtSubscribeWnfStateChange": 442, "NtSuspendProcess": 443, "NtSuspendThread": 444, "NtSystemDebugControl": 445, "NtTerminateEnclave": 446, "NtTerminateJobObject": 447, "NtTestAlert": 448, "NtThawRegistry": 449, "NtThawTransactions": 450, "NtTraceControl": 451, "NtTranslateFilePath": 452, "NtUmsThreadYield": 453, "NtUnloadDriver": 454, "NtUnloadKey": 455, "NtUnloadKey2": 456, "NtUnloadKeyEx": 457, "NtUnlockFile": 458, "NtUnlockVirtualMemory": 459, "NtUnmapViewOfSectionEx": 460, "NtUnsubscribeWnfStateChange": 461, "NtUpdateWnfStateData": 462, "NtVdmControl": 463, "NtWaitForAlertByThreadId": 464, "NtWaitForDebugEvent": 465, "NtWaitForKeyedEvent": 466, "NtWaitForWorkViaWorkerFactory": 467, "NtWaitHighEventPair": 468, "NtWaitLowEventPair": 469, "NtLoadKey3": 470}, "20h2": {"NtAccessCheck": 0, "NtWorkerFactoryWorkerReady": 1, "NtAcceptConnectPort": 2, "NtMapUserPhysicalPagesScatter": 3, "NtWaitForSingleObject": 4, "NtCallbackReturn": 5, "NtReadFile": 6, "NtDeviceIoControlFile": 7, "NtWriteFile": 8, "NtRemoveIoCompletion": 9, "NtReleaseSemaphore": 10, "NtReplyWaitReceivePort": 11, "NtReplyPort": 12, "NtSetInformationThread": 13, "NtSetEvent": 14, "NtClose": 15, "NtQueryObject": 16, "NtQueryInformationFile": 17, "NtOpenKey": 18, "NtEnumerateValueKey": 19, "NtFindAtom": 20, "NtQueryDefaultLocale": 21, "NtQueryKey": 22, "NtQueryValueKey": 23, "NtAllocateVirtualMemory": 24, "NtQueryInformationProcess": 25, "NtWaitForMultipleObjects32": 26, "NtWriteFileGather": 27, "NtSetInformationProcess": 28, "NtCreateKey": 29, "NtFreeVirtualMemory": 30, "NtImpersonateClientOfPort": 31, "NtReleaseMutant": 32, "NtQueryInformationToken": 33, "NtRequestWaitReplyPort": 34, "NtQueryVirtualMemory": 35, "NtOpenThreadToken": 36, "NtQueryInformationThread": 37, "NtOpenProcess": 38, "NtSetInformationFile": 39, "NtMapViewOfSection": 40, "NtAccessCheckAndAuditAlarm": 41, "NtUnmapViewOfSection": 42, "NtReplyWaitReceivePortEx": 43, "NtTerminateProcess": 44, "NtSetEventBoostPriority": 45, "NtReadFileScatter": 46, "NtOpenThreadTokenEx": 47, "NtOpenProcessTokenEx": 48, "NtQueryPerformanceCounter": 49, "NtEnumerateKey": 50, "NtOpenFile": 51, "NtDelayExecution": 52, "NtQueryDirectoryFile": 53, "NtQuerySystemInformation": 54, "NtOpenSection": 55, "NtQueryTimer": 56, "NtFsControlFile": 57, "NtWriteVirtualMemory": 58, "NtCloseObjectAuditAlarm": 59, "NtDuplicateObject": 60, "NtQueryAttributesFile": 61, "NtClearEvent": 62, "NtReadVirtualMemory": 63, "NtOpenEvent": 64, "NtAdjustPrivilegesToken": 65, "NtDuplicateToken": 66, "NtContinue": 67, "NtQueryDefaultUILanguage": 68, "NtQueueApcThread": 69, "NtYieldExecution": 70, "NtAddAtom": 71, "NtCreateEvent": 72, "NtQueryVolumeInformationFile": 73, "NtCreateSection": 74, "NtFlushBuffersFile": 75, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtCreateThread": 78, "NtIsProcessInJob": 79, "NtProtectVirtualMemory": 80, "NtQuerySection": 81, "NtResumeThread": 82, "NtTerminateThread": 83, "NtReadRequestData": 84, "NtCreateFile": 85, "NtQueryEvent": 86, "NtWriteRequestData": 87, "NtOpenDirectoryObject": 88, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtQuerySystemTime": 90, "NtWaitForMultipleObjects": 91, "NtSetInformationObject": 92, "NtCancelIoFile": 93, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtSetValueKey": 96, "NtCancelTimer": 97, "NtSetTimer": 98, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireCrossVmMutant": 103, "NtAcquireProcessActivityReference": 104, "NtAddAtomEx": 105, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustGroupsToken": 108, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertResumeThread": 110, "NtAlertThread": 111, "NtAlertThreadByThreadId": 112, "NtAllocateLocallyUniqueId": 113, "NtAllocateReserveObject": 114, "NtAllocateUserPhysicalPages": 115, "NtAllocateUserPhysicalPagesEx": 116, "NtAllocateUuids": 117, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcConnectPort": 121, "NtAlpcConnectPortEx": 122, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtAreMappedFilesTheSame": 142, "NtAssignProcessToJobObject": 143, "NtAssociateWaitCompletionPacket": 144, "NtCallEnclave": 145, "NtCancelIoFileEx": 146, "NtCancelSynchronousIoFile": 147, "NtCancelTimer2": 148, "NtCancelWaitCompletionPacket": 149, "NtCommitComplete": 150, "NtCommitEnlistment": 151, "NtCommitRegistryTransaction": 152, "NtCommitTransaction": 153, "NtCompactKeys": 154, "NtCompareObjects": 155, "NtCompareSigningLevels": 156, "NtCompareTokens": 157, "NtCompleteConnectPort": 158, "NtCompressKey": 159, "NtConnectPort": 160, "NtContinueEx": 161, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 162, "NtCreateCrossVmEvent": 163, "NtCreateCrossVmMutant": 164, "NtCreateDebugObject": 165, "NtCreateDirectoryObject": 166, "NtCreateDirectoryObjectEx": 167, "NtCreateEnclave": 168, "NtCreateEnlistment": 169, "NtCreateEventPair": 170, "NtCreateIRTimer": 171, "NtCreateIoCompletion": 172, "NtCreateJobObject": 173, "NtCreateJobSet": 174, "NtCreateKeyTransacted": 175, "NtCreateKeyedEvent": 176, "NtCreateLowBoxToken": 177, "NtCreateMailslotFile": 178, "NtCreateMutant": 179, "NtCreateNamedPipeFile": 180, "NtCreatePagingFile": 181, "NtCreatePartition": 182, "NtCreatePort": 183, "NtCreatePrivateNamespace": 184, "NtCreateProcess": 185, "NtCreateProfile": 186, "NtCreateProfileEx": 187, "NtCreateRegistryTransaction": 188, "NtCreateResourceManager": 189, "NtCreateSectionEx": 190, "NtCreateSemaphore": 191, "NtCreateSymbolicLinkObject": 192, "NtCreateThreadEx": 193, "NtCreateTimer": 194, "NtCreateTimer2": 195, "NtCreateToken": 196, "NtCreateTokenEx": 197, "NtCreateTransaction": 198, "NtCreateTransactionManager": 199, "NtCreateUserProcess": 200, "NtCreateWaitCompletionPacket": 201, "NtCreateWaitablePort": 202, "NtCreateWnfStateName": 203, "NtCreateWorkerFactory": 204, "NtDebugActiveProcess": 205, "NtDebugContinue": 206, "NtDeleteAtom": 207, "NtDeleteBootEntry": 208, "NtDeleteDriverEntry": 209, "NtDeleteFile": 210, "NtDeleteKey": 211, "NtDeleteObjectAuditAlarm": 212, "NtDeletePrivateNamespace": 213, "NtDeleteValueKey": 214, "NtDeleteWnfStateData": 215, "NtDeleteWnfStateName": 216, "NtDirectGraphicsCall": 217, "NtDisableLastKnownGood": 218, "NtDisplayString": 219, "NtDrawText": 220, "NtEnableLastKnownGood": 221, "NtEnumerateBootEntries": 222, "NtEnumerateDriverEntries": 223, "NtEnumerateSystemEnvironmentValuesEx": 224, "NtEnumerateTransactionObject": 225, "NtExtendSection": 226, "NtFilterBootOption": 227, "NtFilterToken": 228, "NtFilterTokenEx": 229, "NtFlushBuffersFileEx": 230, "NtFlushInstallUILanguage": 231, "NtFlushInstructionCache": 232, "NtFlushKey": 233, "NtFlushProcessWriteBuffers": 234, "NtFlushVirtualMemory": 235, "NtFlushWriteBuffer": 236, "NtFreeUserPhysicalPages": 237, "NtFreezeRegistry": 238, "NtFreezeTransactions": 239, "NtGetCachedSigningLevel": 240, "NtGetCompleteWnfStateSubscription": 241, "NtGetContextThread": 242, "NtGetCurrentProcessorNumber": 243, "NtGetCurrentProcessorNumberEx": 244, "NtGetDevicePowerState": 245, "NtGetMUIRegistryInfo": 246, "NtGetNextProcess": 247, "NtGetNextThread": 248, "NtGetNlsSectionPtr": 249, "NtGetNotificationResourceManager": 250, "NtGetWriteWatch": 251, "NtImpersonateAnonymousToken": 252, "NtImpersonateThread": 253, "NtInitializeEnclave": 254, "NtInitializeNlsFiles": 255, "NtInitializeRegistry": 256, "NtInitiatePowerAction": 257, "NtIsSystemResumeAutomatic": 258, "NtIsUILanguageComitted": 259, "NtListenPort": 260, "NtLoadDriver": 261, "NtLoadEnclaveData": 262, "NtLoadKey": 263, "NtLoadKey2": 264, "NtLoadKeyEx": 265, "NtLockFile": 266, "NtLockProductActivationKeys": 267, "NtLockRegistryKey": 268, "NtLockVirtualMemory": 269, "NtMakePermanentObject": 270, "NtMakeTemporaryObject": 271, "NtManageHotPatch": 272, "NtManagePartition": 273, "NtMapCMFModule": 274, "NtMapUserPhysicalPages": 275, "NtMapViewOfSectionEx": 276, "NtModifyBootEntry": 277, "NtModifyDriverEntry": 278, "NtNotifyChangeDirectoryFile": 279, "NtNotifyChangeDirectoryFileEx": 280, "NtNotifyChangeKey": 281, "NtNotifyChangeMultipleKeys": 282, "NtNotifyChangeSession": 283, "NtOpenEnlistment": 284, "NtOpenEventPair": 285, "NtOpenIoCompletion": 286, "NtOpenJobObject": 287, "NtOpenKeyEx": 288, "NtOpenKeyTransacted": 289, "NtOpenKeyTransactedEx": 290, "NtOpenKeyedEvent": 291, "NtOpenMutant": 292, "NtOpenObjectAuditAlarm": 293, "NtOpenPartition": 294, "NtOpenPrivateNamespace": 295, "NtOpenProcessToken": 296, "NtOpenRegistryTransaction": 297, "NtOpenResourceManager": 298, "NtOpenSemaphore": 299, "NtOpenSession": 300, "NtOpenSymbolicLinkObject": 301, "NtOpenThread": 302, "NtOpenTimer": 303, "NtOpenTransaction": 304, "NtOpenTransactionManager": 305, "NtPlugPlayControl": 306, "NtPrePrepareComplete": 307, "NtPrePrepareEnlistment": 308, "NtPrepareComplete": 309, "NtPrepareEnlistment": 310, "NtPrivilegeCheck": 311, "NtPrivilegeObjectAuditAlarm": 312, "NtPrivilegedServiceAuditAlarm": 313, "NtPropagationComplete": 314, "NtPropagationFailed": 315, "NtPssCaptureVaSpaceBulk": 316, "NtPulseEvent": 317, "NtQueryAuxiliaryCounterFrequency": 318, "NtQueryBootEntryOrder": 319, "NtQueryBootOptions": 320, "NtQueryDebugFilterState": 321, "NtQueryDirectoryFileEx": 322, "NtQueryDirectoryObject": 323, "NtQueryDriverEntryOrder": 324, "NtQueryEaFile": 325, "NtQueryFullAttributesFile": 326, "NtQueryInformationAtom": 327, "NtQueryInformationByName": 328, "NtQueryInformationEnlistment": 329, "NtQueryInformationJobObject": 330, "NtQueryInformationPort": 331, "NtQueryInformationResourceManager": 332, "NtQueryInformationTransaction": 333, "NtQueryInformationTransactionManager": 334, "NtQueryInformationWorkerFactory": 335, "NtQueryInstallUILanguage": 336, "NtQueryIntervalProfile": 337, "NtQueryIoCompletion": 338, "NtQueryLicenseValue": 339, "NtQueryMultipleValueKey": 340, "NtQueryMutant": 341, "NtQueryOpenSubKeys": 342, "NtQueryOpenSubKeysEx": 343, "NtQueryPortInformationProcess": 344, "NtQueryQuotaInformationFile": 345, "NtQuerySecurityAttributesToken": 346, "NtQuerySecurityObject": 347, "NtQuerySecurityPolicy": 348, "NtQuerySemaphore": 349, "NtQuerySymbolicLinkObject": 350, "NtQuerySystemEnvironmentValue": 351, "NtQuerySystemEnvironmentValueEx": 352, "NtQuerySystemInformationEx": 353, "NtQueryTimerResolution": 354, "NtQueryWnfStateData": 355, "NtQueryWnfStateNameInformation": 356, "NtQueueApcThreadEx": 357, "NtRaiseException": 358, "NtRaiseHardError": 359, "NtReadOnlyEnlistment": 360, "NtRecoverEnlistment": 361, "NtRecoverResourceManager": 362, "NtRecoverTransactionManager": 363, "NtRegisterProtocolAddressInformation": 364, "NtRegisterThreadTerminatePort": 365, "NtReleaseKeyedEvent": 366, "NtReleaseWorkerFactoryWorker": 367, "NtRemoveIoCompletionEx": 368, "NtRemoveProcessDebug": 369, "NtRenameKey": 370, "NtRenameTransactionManager": 371, "NtReplaceKey": 372, "NtReplacePartitionUnit": 373, "NtReplyWaitReplyPort": 374, "NtRequestPort": 375, "NtResetEvent": 376, "NtResetWriteWatch": 377, "NtRestoreKey": 378, "NtResumeProcess": 379, "NtRevertContainerImpersonation": 380, "NtRollbackComplete": 381, "NtRollbackEnlistment": 382, "NtRollbackRegistryTransaction": 383, "NtRollbackTransaction": 384, "NtRollforwardTransactionManager": 385, "NtSaveKey": 386, "NtSaveKeyEx": 387, "NtSaveMergedKeys": 388, "NtSecureConnectPort": 389, "NtSerializeBoot": 390, "NtSetBootEntryOrder": 391, "NtSetBootOptions": 392, "NtSetCachedSigningLevel": 393, "NtSetCachedSigningLevel2": 394, "NtSetContextThread": 395, "NtSetDebugFilterState": 396, "NtSetDefaultHardErrorPort": 397, "NtSetDefaultLocale": 398, "NtSetDefaultUILanguage": 399, "NtSetDriverEntryOrder": 400, "NtSetEaFile": 401, "NtSetHighEventPair": 402, "NtSetHighWaitLowEventPair": 403, "NtSetIRTimer": 404, "NtSetInformationDebugObject": 405, "NtSetInformationEnlistment": 406, "NtSetInformationJobObject": 407, "NtSetInformationKey": 408, "NtSetInformationResourceManager": 409, "NtSetInformationSymbolicLink": 410, "NtSetInformationToken": 411, "NtSetInformationTransaction": 412, "NtSetInformationTransactionManager": 413, "NtSetInformationVirtualMemory": 414, "NtSetInformationWorkerFactory": 415, "NtSetIntervalProfile": 416, "NtSetIoCompletion": 417, "NtSetIoCompletionEx": 418, "NtSetLdtEntries": 419, "NtSetLowEventPair": 420, "NtSetLowWaitHighEventPair": 421, "NtSetQuotaInformationFile": 422, "NtSetSecurityObject": 423, "NtSetSystemEnvironmentValue": 424, "NtSetSystemEnvironmentValueEx": 425, "NtSetSystemInformation": 426, "NtSetSystemPowerState": 427, "NtSetSystemTime": 428, "NtSetThreadExecutionState": 429, "NtSetTimer2": 430, "NtSetTimerEx": 431, "NtSetTimerResolution": 432, "NtSetUuidSeed": 433, "NtSetVolumeInformationFile": 434, "NtSetWnfProcessNotificationEvent": 435, "NtShutdownSystem": 436, "NtShutdownWorkerFactory": 437, "NtSignalAndWaitForSingleObject": 438, "NtSinglePhaseReject": 439, "NtStartProfile": 440, "NtStopProfile": 441, "NtSubscribeWnfStateChange": 442, "NtSuspendProcess": 443, "NtSuspendThread": 444, "NtSystemDebugControl": 445, "NtTerminateEnclave": 446, "NtTerminateJobObject": 447, "NtTestAlert": 448, "NtThawRegistry": 449, "NtThawTransactions": 450, "NtTraceControl": 451, "NtTranslateFilePath": 452, "NtUmsThreadYield": 453, "NtUnloadDriver": 454, "NtUnloadKey": 455, "NtUnloadKey2": 456, "NtUnloadKeyEx": 457, "NtUnlockFile": 458, "NtUnlockVirtualMemory": 459, "NtUnmapViewOfSectionEx": 460, "NtUnsubscribeWnfStateChange": 461, "NtUpdateWnfStateData": 462, "NtVdmControl": 463, "NtWaitForAlertByThreadId": 464, "NtWaitForDebugEvent": 465, "NtWaitForKeyedEvent": 466, "NtWaitForWorkViaWorkerFactory": 467, "NtWaitHighEventPair": 468, "NtWaitLowEventPair": 469, "NtLoadKey3": 470},"21h2":{"NtAccessCheck": 0, "NtAccessCheckAndAuditAlarm": 41, "NtAccessCheckByType": 99, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireCrossVmMutant": 103, "NtAcquireProcessActivityReference": 104, "NtAddAtom": 655431, "NtAddAtomEx": 1114217, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustGroupsToken": 108, "NtAdjustPrivilegesToken": 65, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertResumeThread": 458862, "NtAlertThread": 196719, "NtAlertThreadByThreadId": 262256, "NtAllocateLocallyUniqueId": 262257, "NtAllocateReserveObject": 114, "NtAllocateUserPhysicalPages": 115, "NtAllocateUserPhysicalPagesEx": 116, "NtAllocateUuids": 1114229, "NtAllocateVirtualMemory": 24, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcConnectPort": 121, "NtAlpcConnectPortEx": 122, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtApphelpCacheControl": 76, "NtAreMappedFilesTheSame": 327822, "NtAssignProcessToJobObject": 524431, "NtAssociateWaitCompletionPacket": 144, "NtCallEnclave": 145, "NtCallbackReturn": 5, "NtCancelIoFile": 93, "NtCancelIoFileEx": 146, "NtCancelSynchronousIoFile": 147, "NtCancelTimer": 97, "NtCancelTimer2": 148, "NtCancelWaitCompletionPacket": 149, "NtClearEvent": 196670, "NtClose": 196623, "NtCloseObjectAuditAlarm": 59, "NtCommitComplete": 150, "NtCommitEnlistment": 151, "NtCommitRegistryTransaction": 152, "NtCommitTransaction": 153, "NtCompactKeys": 154, "NtCompareObjects": 155, "NtCompareSigningLevels": 156, "NtCompareTokens": 157, "NtCompleteConnectPort": 158, "NtCompressKey": 196767, "NtConnectPort": 160, "NtContinue": 67, "NtContinueEx": 161, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 162, "NtCreateCrossVmEvent": 163, "NtCreateCrossVmMutant": 164, "NtCreateDebugObject": 165, "NtCreateDirectoryObject": 166, "NtCreateDirectoryObjectEx": 167, "NtCreateEnclave": 168, "NtCreateEnlistment": 169, "NtCreateEvent": 72, "NtCreateEventPair": 170, "NtCreateFile": 85, "NtCreateIRTimer": 171, "NtCreateIoCompletion": 172, "NtCreateJobObject": 173, "NtCreateJobSet": 174, "NtCreateKey": 29, "NtCreateKeyTransacted": 175, "NtCreateKeyedEvent": 176, "NtCreateLowBoxToken": 177, "NtCreateMailslotFile": 178, "NtCreateMutant": 179, "NtCreateNamedPipeFile": 180, "NtCreatePagingFile": 181, "NtCreatePartition": 182, "NtCreatePort": 183, "NtCreatePrivateNamespace": 184, "NtCreateProcess": 185, "NtCreateProcessEx": 77, "NtCreateProfile": 186, "NtCreateProfileEx": 187, "NtCreateRegistryTransaction": 188, "NtCreateResourceManager": 189, "NtCreateSection": 74, "NtCreateSectionEx": 190, "NtCreateSemaphore": 191, "NtCreateSymbolicLinkObject": 192, "NtCreateThread": 78, "NtCreateThreadEx": 193, "NtCreateTimer": 194, "NtCreateTimer2": 195, "NtCreateToken": 196, "NtCreateTokenEx": 197, "NtCreateTransaction": 198, "NtCreateTransactionManager": 199, "NtCreateUserProcess": 200, "NtCreateWaitCompletionPacket": 201, "NtCreateWaitablePort": 202, "NtCreateWnfStateName": 203, "NtCreateWorkerFactory": 204, "NtDebugActiveProcess": 524493, "NtDebugContinue": 206, "NtDelayExecution": 393268, "NtDeleteAtom": 262351, "NtDeleteBootEntry": 208, "NtDeleteDriverEntry": 209, "NtDeleteFile": 210, "NtDeleteKey": 211, "NtDeleteObjectAuditAlarm": 212, "NtDeletePrivateNamespace": 213, "NtDeleteValueKey": 214, "NtDeleteWnfStateData": 215, "NtDeleteWnfStateName": 216, "NtDeviceIoControlFile": 1769479, "NtDirectGraphicsCall": 217, "NtDisableLastKnownGood": 218, "NtDisplayString": 219, "NtDrawText": 220, "NtDuplicateObject": 60, "NtDuplicateToken": 66, "NtEnableLastKnownGood": 221, "NtEnumerateBootEntries": 222, "NtEnumerateDriverEntries": 223, "NtEnumerateKey": 50, "NtEnumerateSystemEnvironmentValuesEx": 224, "NtEnumerateTransactionObject": 225, "NtEnumerateValueKey": 19, "NtExtendSection": 226, "NtFilterBootOption": 227, "NtFilterToken": 228, "NtFilterTokenEx": 229, "NtFindAtom": 655380, "NtFlushBuffersFile": 75, "NtFlushBuffersFileEx": 230, "NtFlushInstallUILanguage": 231, "NtFlushInstructionCache": 786664, "NtFlushKey": 196841, "NtFlushProcessWriteBuffers": 234, "NtFlushVirtualMemory": 235, "NtFlushWriteBuffer": 65772, "NtFreeUserPhysicalPages": 237, "NtFreeVirtualMemory": 30, "NtFreezeRegistry": 238, "NtFreezeTransactions": 239, "NtFsControlFile": 1769529, "NtGetCachedSigningLevel": 240, "NtGetCompleteWnfStateSubscription": 241, "NtGetContextThread": 242, "NtGetCurrentProcessorNumber": 1638643, "NtGetCurrentProcessorNumberEx": 244, "NtGetDevicePowerState": 458997, "NtGetMUIRegistryInfo": 246, "NtGetNextProcess": 247, "NtGetNextThread": 248, "NtGetNlsSectionPtr": 249, "NtGetNotificationResourceManager": 250, "NtGetWriteWatch": 251, "NtImpersonateAnonymousToken": 196860, "NtImpersonateClientOfPort": 458783, "NtImpersonateThread": 253, "NtInitializeEnclave": 254, "NtInitializeNlsFiles": 255, "NtInitializeRegistry": 256, "NtInitiatePowerAction": 1114369, "NtIsProcessInJob": 524367, "NtIsSystemResumeAutomatic": 65794, "NtIsUILanguageComitted": 259, "NtListenPort": 260, "NtLoadDriver": 261, "NtLoadEnclaveData": 262, "NtLoadKey": 263, "NtLoadKey2": 264, "NtLoadKey3": 470, "NtLoadKeyEx": 265, "NtLockFile": 266, "NtLockProductActivationKeys": 327947, "NtLockRegistryKey": 196876, "NtLockVirtualMemory": 269, "NtMakePermanentObject": 196878, "NtMakeTemporaryObject": 196879, "NtManageHotPatch": 272, "NtManagePartition": 273, "NtMapCMFModule": 274, "NtMapUserPhysicalPages": 655635, "NtMapUserPhysicalPagesScatter": 655363, "NtMapViewOfSection": 40, "NtMapViewOfSectionEx": 276, "NtModifyBootEntry": 277, "NtModifyDriverEntry": 278, "NtNotifyChangeDirectoryFile": 279, "NtNotifyChangeDirectoryFileEx": 280, "NtNotifyChangeKey": 281, "NtNotifyChangeMultipleKeys": 282, "NtNotifyChangeSession": 283, "NtOpenDirectoryObject": 88, "NtOpenEnlistment": 284, "NtOpenEvent": 64, "NtOpenEventPair": 285, "NtOpenFile": 51, "NtOpenIoCompletion": 286, "NtOpenJobObject": 287, "NtOpenKey": 18, "NtOpenKeyEx": 288, "NtOpenKeyTransacted": 289, "NtOpenKeyTransactedEx": 290, "NtOpenKeyedEvent": 291, "NtOpenMutant": 292, "NtOpenObjectAuditAlarm": 293, "NtOpenPartition": 294, "NtOpenPrivateNamespace": 295, "NtOpenProcess": 38, "NtOpenProcessToken": 296, "NtOpenProcessTokenEx": 48, "NtOpenRegistryTransaction": 297, "NtOpenResourceManager": 298, "NtOpenSection": 55, "NtOpenSemaphore": 299, "NtOpenSession": 300, "NtOpenSymbolicLinkObject": 301, "NtOpenThread": 302, "NtOpenThreadToken": 36, "NtOpenThreadTokenEx": 47, "NtOpenTimer": 303, "NtOpenTransaction": 304, "NtOpenTransactionManager": 305, "NtPlugPlayControl": 306, "NtPowerInformation": 95, "NtPrePrepareComplete": 307, "NtPrePrepareEnlistment": 308, "NtPrepareComplete": 309, "NtPrepareEnlistment": 310, "NtPrivilegeCheck": 786743, "NtPrivilegeObjectAuditAlarm": 312, "NtPrivilegedServiceAuditAlarm": 313, "NtPropagationComplete": 314, "NtPropagationFailed": 315, "NtProtectVirtualMemory": 80, "NtPssCaptureVaSpaceBulk": 316, "NtPulseEvent": 459069, "NtQueryAttributesFile": 61, "NtQueryAuxiliaryCounterFrequency": 318, "NtQueryBootEntryOrder": 319, "NtQueryBootOptions": 320, "NtQueryDebugFilterState": 328001, "NtQueryDefaultLocale": 327701, "NtQueryDefaultUILanguage": 262212, "NtQueryDirectoryFile": 53, "NtQueryDirectoryFileEx": 322, "NtQueryDirectoryObject": 323, "NtQueryDriverEntryOrder": 324, "NtQueryEaFile": 325, "NtQueryEvent": 86, "NtQueryFullAttributesFile": 326, "NtQueryInformationAtom": 327, "NtQueryInformationByName": 328, "NtQueryInformationEnlistment": 329, "NtQueryInformationFile": 17, "NtQueryInformationJobObject": 330, "NtQueryInformationPort": 331, "NtQueryInformationProcess": 25, "NtQueryInformationResourceManager": 332, "NtQueryInformationThread": 37, "NtQueryInformationToken": 33, "NtQueryInformationTransaction": 333, "NtQueryInformationTransactionManager": 334, "NtQueryInformationWorkerFactory": 335, "NtQueryInstallUILanguage": 262480, "NtQueryIntervalProfile": 328017, "NtQueryIoCompletion": 338, "NtQueryKey": 22, "NtQueryLicenseValue": 339, "NtQueryMultipleValueKey": 340, "NtQueryMutant": 341, "NtQueryObject": 272, "NtQueryOpenSubKeys": 342, "NtQueryOpenSubKeysEx": 343, "NtQueryPerformanceCounter": 327729, "NtQueryPortInformationProcess": 65880, "NtQueryQuotaInformationFile": 345, "NtQuerySection": 81, "NtQuerySecurityAttributesToken": 346, "NtQuerySecurityObject": 347, "NtQuerySecurityPolicy": 348, "NtQuerySemaphore": 349, "NtQuerySymbolicLinkObject": 350, "NtQuerySystemEnvironmentValue": 351, "NtQuerySystemEnvironmentValueEx": 352, "NtQuerySystemInformation": 54, "NtQuerySystemInformationEx": 353, "NtQueryTimer": 56, "NtQueryTimerResolution": 655714, "NtQueryValueKey": 23, "NtQueryVirtualMemory": 35, "NtQueryVolumeInformationFile": 73, "NtQueryWnfStateData": 355, "NtQueryWnfStateNameInformation": 356, "NtQueueApcThread": 69, "NtQueueApcThreadEx": 357, "NtRaiseException": 358, "NtRaiseHardError": 359, "NtReadFile": 1703942, "NtReadFileScatter": 1703982, "NtReadOnlyEnlistment": 360, "NtReadRequestData": 84, "NtReadVirtualMemory": 63, "NtRecoverEnlistment": 361, "NtRecoverResourceManager": 362, "NtRecoverTransactionManager": 363, "NtRegisterProtocolAddressInformation": 364, "NtRegisterThreadTerminatePort": 196973, "NtReleaseKeyedEvent": 1311086, "NtReleaseMutant": 458784, "NtReleaseSemaphore": 786442, "NtReleaseWorkerFactoryWorker": 196975, "NtRemoveIoCompletion": 1835017, "NtRemoveIoCompletionEx": 368, "NtRenameKey": 370, "NtRenameTransactionManager": 371, "NtReplaceKey": 372, "NtReplacePartitionUnit": 373, "NtReplyPort": 12, "NtReplyWaitReceivePort": 11, "NtReplyWaitReceivePortEx": 43, "NtReplyWaitReplyPort": 374, "NtRequestPort": 375, "NtRequestWaitReplyPort": 34, "NtResetEvent": 459128, "NtResetWriteWatch": 786809, "NtRestoreKey": 378, "NtResumeProcess": 196987, "NtResumeThread": 458834, "NtRevertContainerImpersonation": 380, "NtRollbackComplete": 381, "NtRollbackEnlistment": 382, "NtRollbackRegistryTransaction": 383, "NtRollbackTransaction": 384, "NtRollforwardTransactionManager": 385, "NtSaveKey": 524674, "NtSaveKeyEx": 917891, "NtSaveMergedKeys": 721284, "NtSecureConnectPort": 389, "NtSerializeBoot": 390, "NtSetBootEntryOrder": 391, "NtSetBootOptions": 392, "NtSetCachedSigningLevel": 393, "NtSetCachedSigningLevel2": 394, "NtSetContextThread": 395, "NtSetDebugFilterState": 655756, "NtSetDefaultHardErrorPort": 197005, "NtSetDefaultLocale": 328078, "NtSetDefaultUILanguage": 262543, "NtSetDriverEntryOrder": 400, "NtSetEaFile": 401, "NtSetEvent": 458766, "NtSetEventBoostPriority": 196653, "NtSetHighEventPair": 197010, "NtSetHighWaitLowEventPair": 197011, "NtSetIRTimer": 459156, "NtSetInformationDebugObject": 405, "NtSetInformationEnlistment": 406, "NtSetInformationFile": 39, "NtSetInformationJobObject": 407, "NtSetInformationKey": 408, "NtSetInformationObject": 92, "NtSetInformationProcess": 28, "NtSetInformationResourceManager": 409, "NtSetInformationSymbolicLink": 410, "NtSetInformationThread": 13, "NtSetInformationToken": 411, "NtSetInformationTransaction": 412, "NtSetInformationTransactionManager": 413, "NtSetInformationVirtualMemory": 414, "NtSetInformationWorkerFactory": 415, "NtSetIntervalProfile": 328096, "NtSetIoCompletion": 417, "NtSetIoCompletionEx": 418, "NtSetLdtEntries": 419, "NtSetLowEventPair": 197028, "NtSetLowWaitHighEventPair": 197029, "NtSetQuotaInformationFile": 422, "NtSetSecurityObject": 423, "NtSetSystemEnvironmentValue": 424, "NtSetSystemEnvironmentValueEx": 425, "NtSetSystemInformation": 426, "NtSetSystemPowerState": 427, "NtSetSystemTime": 328108, "NtSetThreadExecutionState": 328109, "NtSetTimer": 98, "NtSetTimer2": 430, "NtSetTimerEx": 431, "NtSetTimerResolution": 655792, "NtSetUuidSeed": 262577, "NtSetValueKey": 96, "NtSetVolumeInformationFile": 434, "NtSetWnfProcessNotificationEvent": 435, "NtShutdownSystem": 262580, "NtShutdownWorkerFactory": 437, "NtSignalAndWaitForSingleObject": 197046, "NtSinglePhaseReject": 439, "NtStartProfile": 197048, "NtStopProfile": 197049, "NtSubscribeWnfStateChange": 442, "NtSuspendProcess": 197051, "NtSuspendThread": 459196, "NtSystemDebugControl": 445, "NtTerminateEnclave": 446, "NtTerminateJobObject": 459199, "NtTerminateProcess": 458796, "NtTerminateThread": 458835, "NtTestAlert": 131520, "NtThawRegistry": 449, "NtThawTransactions": 450, "NtTraceControl": 451, "NtTraceEvent": 94, "NtTranslateFilePath": 1114564, "NtUmsThreadYield": 453, "NtUnloadDriver": 454, "NtUnloadKey": 455, "NtUnloadKey2": 456, "NtUnloadKeyEx": 457, "NtUnlockFile": 458, "NtUnlockVirtualMemory": 459, "NtUnmapViewOfSection": 42, "NtUnmapViewOfSectionEx": 460, "NtUnsubscribeWnfStateChange": 461, "NtUpdateWnfStateData": 462, "NtVdmControl": 463, "NtWaitForAlertByThreadId": 393680, "NtWaitForDebugEvent": 465, "NtWaitForKeyedEvent": 1376722, "NtWaitForMultipleObjects": 1900635, "NtWaitForMultipleObjects32": 1966106, "NtWaitForSingleObject": 851972, "NtWaitForWorkViaWorkerFactory": 467, "NtWaitHighEventPair": 197076, "NtWaitLowEventPair": 197077, "NtWorkerFactoryWorkerReady": 196609, "NtWriteFile": 1703944, "NtWriteFileGather": 1703963, "NtWriteRequestData": 87, "NtWriteVirtualMemory": 58, "NtYieldExecution": 65606, "RtlGetNativeSystemInformation": 54}, "21h1":{"NtAccessCheck": 0, "NtAccessCheckAndAuditAlarm": 41, "NtAccessCheckByType": 99, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireCrossVmMutant": 103, "NtAcquireProcessActivityReference": 104, "NtAddAtom": 655431, "NtAddAtomEx": 1114217, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustGroupsToken": 108, "NtAdjustPrivilegesToken": 65, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertResumeThread": 458862, "NtAlertThread": 196719, "NtAlertThreadByThreadId": 262256, "NtAllocateLocallyUniqueId": 262257, "NtAllocateReserveObject": 114, "NtAllocateUserPhysicalPages": 115, "NtAllocateUserPhysicalPagesEx": 116, "NtAllocateUuids": 1114229, "NtAllocateVirtualMemory": 24, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcConnectPort": 121, "NtAlpcConnectPortEx": 122, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtApphelpCacheControl": 76, "NtAreMappedFilesTheSame": 327822, "NtAssignProcessToJobObject": 524431, "NtAssociateWaitCompletionPacket": 144, "NtCallEnclave": 145, "NtCallbackReturn": 5, "NtCancelIoFile": 93, "NtCancelIoFileEx": 146, "NtCancelSynchronousIoFile": 147, "NtCancelTimer": 458849, "NtCancelTimer2": 148, "NtCancelWaitCompletionPacket": 149, "NtClearEvent": 196670, "NtClose": 196623, "NtCloseObjectAuditAlarm": 59, "NtCommitComplete": 150, "NtCommitEnlistment": 151, "NtCommitRegistryTransaction": 152, "NtCommitTransaction": 153, "NtCompactKeys": 154, "NtCompareObjects": 155, "NtCompareSigningLevels": 156, "NtCompareTokens": 157, "NtCompleteConnectPort": 158, "NtCompressKey": 196767, "NtConnectPort": 160, "NtContinue": 67, "NtContinueEx": 161, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 162, "NtCreateCrossVmEvent": 163, "NtCreateCrossVmMutant": 164, "NtCreateDebugObject": 165, "NtCreateDirectoryObject": 166, "NtCreateDirectoryObjectEx": 167, "NtCreateEnclave": 168, "NtCreateEnlistment": 169, "NtCreateEvent": 72, "NtCreateEventPair": 170, "NtCreateFile": 85, "NtCreateIRTimer": 171, "NtCreateIoCompletion": 172, "NtCreateJobObject": 173, "NtCreateJobSet": 174, "NtCreateKey": 29, "NtCreateKeyTransacted": 175, "NtCreateKeyedEvent": 176, "NtCreateLowBoxToken": 177, "NtCreateMailslotFile": 178, "NtCreateMutant": 179, "NtCreateNamedPipeFile": 180, "NtCreatePagingFile": 181, "NtCreatePartition": 182, "NtCreatePort": 183, "NtCreatePrivateNamespace": 184, "NtCreateProcess": 185, "NtCreateProcessEx": 77, "NtCreateProfile": 186, "NtCreateProfileEx": 187, "NtCreateRegistryTransaction": 188, "NtCreateResourceManager": 189, "NtCreateSection": 74, "NtCreateSectionEx": 190, "NtCreateSemaphore": 191, "NtCreateSymbolicLinkObject": 192, "NtCreateThread": 78, "NtCreateThreadEx": 193, "NtCreateTimer": 194, "NtCreateTimer2": 195, "NtCreateToken": 196, "NtCreateTokenEx": 197, "NtCreateTransaction": 198, "NtCreateTransactionManager": 199, "NtCreateUserProcess": 200, "NtCreateWaitCompletionPacket": 201, "NtCreateWaitablePort": 202, "NtCreateWnfStateName": 203, "NtCreateWorkerFactory": 204, "NtDebugActiveProcess": 524493, "NtDebugContinue": 206, "NtDelayExecution": 393268, "NtDeleteAtom": 262351, "NtDeleteBootEntry": 208, "NtDeleteDriverEntry": 209, "NtDeleteFile": 210, "NtDeleteKey": 211, "NtDeleteObjectAuditAlarm": 212, "NtDeletePrivateNamespace": 213, "NtDeleteValueKey": 214, "NtDeleteWnfStateData": 215, "NtDeleteWnfStateName": 216, "NtDeviceIoControlFile": 1769479, "NtDirectGraphicsCall": 217, "NtDisableLastKnownGood": 218, "NtDisplayString": 219, "NtDrawText": 220, "NtDuplicateObject": 60, "NtDuplicateToken": 66, "NtEnableLastKnownGood": 221, "NtEnumerateBootEntries": 222, "NtEnumerateDriverEntries": 223, "NtEnumerateKey": 50, "NtEnumerateSystemEnvironmentValuesEx": 224, "NtEnumerateTransactionObject": 225, "NtEnumerateValueKey": 19, "NtExtendSection": 226, "NtFilterBootOption": 227, "NtFilterToken": 228, "NtFilterTokenEx": 229, "NtFindAtom": 655380, "NtFlushBuffersFile": 75, "NtFlushBuffersFileEx": 230, "NtFlushInstallUILanguage": 231, "NtFlushInstructionCache": 786664, "NtFlushKey": 196841, "NtFlushProcessWriteBuffers": 234, "NtFlushVirtualMemory": 235, "NtFlushWriteBuffer": 65772, "NtFreeUserPhysicalPages": 237, "NtFreeVirtualMemory": 30, "NtFreezeRegistry": 238, "NtFreezeTransactions": 239, "NtFsControlFile": 1769529, "NtGetCachedSigningLevel": 240, "NtGetCompleteWnfStateSubscription": 241, "NtGetContextThread": 242, "NtGetCurrentProcessorNumber": 1638643, "NtGetCurrentProcessorNumberEx": 244, "NtGetDevicePowerState": 458997, "NtGetMUIRegistryInfo": 246, "NtGetNextProcess": 247, "NtGetNextThread": 248, "NtGetNlsSectionPtr": 249, "NtGetNotificationResourceManager": 250, "NtGetWriteWatch": 251, "NtImpersonateAnonymousToken": 196860, "NtImpersonateClientOfPort": 458783, "NtImpersonateThread": 253, "NtInitializeEnclave": 254, "NtInitializeNlsFiles": 255, "NtInitializeRegistry": 256, "NtInitiatePowerAction": 1114369, "NtIsProcessInJob": 524367, "NtIsSystemResumeAutomatic": 65794, "NtIsUILanguageComitted": 259, "NtListenPort": 260, "NtLoadDriver": 261, "NtLoadEnclaveData": 262, "NtLoadKey": 263, "NtLoadKey2": 264, "NtLoadKey3": 470, "NtLoadKeyEx": 265, "NtLockFile": 266, "NtLockProductActivationKeys": 327947, "NtLockRegistryKey": 196876, "NtLockVirtualMemory": 269, "NtMakePermanentObject": 196878, "NtMakeTemporaryObject": 196879, "NtManageHotPatch": 272, "NtManagePartition": 273, "NtMapCMFModule": 274, "NtMapUserPhysicalPages": 655635, "NtMapUserPhysicalPagesScatter": 655363, "NtMapViewOfSection": 40, "NtMapViewOfSectionEx": 276, "NtModifyBootEntry": 277, "NtModifyDriverEntry": 278, "NtNotifyChangeDirectoryFile": 279, "NtNotifyChangeDirectoryFileEx": 280, "NtNotifyChangeKey": 281, "NtNotifyChangeMultipleKeys": 282, "NtNotifyChangeSession": 283, "NtOpenDirectoryObject": 88, "NtOpenEnlistment": 284, "NtOpenEvent": 64, "NtOpenEventPair": 285, "NtOpenFile": 51, "NtOpenIoCompletion": 286, "NtOpenJobObject": 287, "NtOpenKey": 18, "NtOpenKeyEx": 288, "NtOpenKeyTransacted": 289, "NtOpenKeyTransactedEx": 290, "NtOpenKeyedEvent": 291, "NtOpenMutant": 292, "NtOpenObjectAuditAlarm": 293, "NtOpenPartition": 294, "NtOpenPrivateNamespace": 295, "NtOpenProcess": 38, "NtOpenProcessToken": 296, "NtOpenProcessTokenEx": 48, "NtOpenRegistryTransaction": 297, "NtOpenResourceManager": 298, "NtOpenSection": 55, "NtOpenSemaphore": 299, "NtOpenSession": 300, "NtOpenSymbolicLinkObject": 301, "NtOpenThread": 302, "NtOpenThreadToken": 36, "NtOpenThreadTokenEx": 47, "NtOpenTimer": 303, "NtOpenTransaction": 304, "NtOpenTransactionManager": 305, "NtPlugPlayControl": 306, "NtPowerInformation": 95, "NtPrePrepareComplete": 307, "NtPrePrepareEnlistment": 308, "NtPrepareComplete": 309, "NtPrepareEnlistment": 310, "NtPrivilegeCheck": 786743, "NtPrivilegeObjectAuditAlarm": 312, "NtPrivilegedServiceAuditAlarm": 313, "NtPropagationComplete": 314, "NtPropagationFailed": 315, "NtProtectVirtualMemory": 80, "NtPssCaptureVaSpaceBulk": 316, "NtPulseEvent": 459069, "NtQueryAttributesFile": 61, "NtQueryAuxiliaryCounterFrequency": 318, "NtQueryBootEntryOrder": 319, "NtQueryBootOptions": 320, "NtQueryDebugFilterState": 328001, "NtQueryDefaultLocale": 327701, "NtQueryDefaultUILanguage": 262212, "NtQueryDirectoryFile": 53, "NtQueryDirectoryFileEx": 322, "NtQueryDirectoryObject": 323, "NtQueryDriverEntryOrder": 324, "NtQueryEaFile": 325, "NtQueryEvent": 86, "NtQueryFullAttributesFile": 326, "NtQueryInformationAtom": 327, "NtQueryInformationByName": 328, "NtQueryInformationEnlistment": 329, "NtQueryInformationFile": 17, "NtQueryInformationJobObject": 330, "NtQueryInformationPort": 331, "NtQueryInformationProcess": 25, "NtQueryInformationResourceManager": 332, "NtQueryInformationThread": 37, "NtQueryInformationToken": 33, "NtQueryInformationTransaction": 333, "NtQueryInformationTransactionManager": 334, "NtQueryInformationWorkerFactory": 335, "NtQueryInstallUILanguage": 262480, "NtQueryIntervalProfile": 328017, "NtQueryIoCompletion": 338, "NtQueryKey": 22, "NtQueryLicenseValue": 339, "NtQueryMultipleValueKey": 340, "NtQueryMutant": 341, "NtQueryObject": 16, "NtQueryOpenSubKeys": 342, "NtQueryOpenSubKeysEx": 343, "NtQueryPerformanceCounter": 327729, "NtQueryPortInformationProcess": 65880, "NtQueryQuotaInformationFile": 345, "NtQuerySection": 81, "NtQuerySecurityAttributesToken": 346, "NtQuerySecurityObject": 347, "NtQuerySecurityPolicy": 348, "NtQuerySemaphore": 349, "NtQuerySymbolicLinkObject": 350, "NtQuerySystemEnvironmentValue": 351, "NtQuerySystemEnvironmentValueEx": 352, "NtQuerySystemInformation": 54, "NtQuerySystemInformationEx": 353, "NtQueryTimer": 56, "NtQueryTimerResolution": 655714, "NtQueryValueKey": 23, "NtQueryVirtualMemory": 35, "NtQueryVolumeInformationFile": 73, "NtQueryWnfStateData": 355, "NtQueryWnfStateNameInformation": 356, "NtQueueApcThread": 69, "NtQueueApcThreadEx": 357, "NtRaiseException": 358, "NtRaiseHardError": 359, "NtReadFile": 1703942, "NtReadFileScatter": 1703982, "NtReadOnlyEnlistment": 360, "NtReadRequestData": 84, "NtReadVirtualMemory": 63, "NtRecoverEnlistment": 361, "NtRecoverResourceManager": 362, "NtRecoverTransactionManager": 363, "NtRegisterProtocolAddressInformation": 364, "NtRegisterThreadTerminatePort": 196973, "NtReleaseKeyedEvent": 1311086, "NtReleaseMutant": 458784, "NtReleaseSemaphore": 786442, "NtReleaseWorkerFactoryWorker": 196975, "NtRemoveIoCompletion": 1835017, "NtRemoveIoCompletionEx": 368, "NtRenameKey": 370, "NtRenameTransactionManager": 371, "NtReplaceKey": 372, "NtReplacePartitionUnit": 373, "NtReplyPort": 12, "NtReplyWaitReceivePort": 11, "NtReplyWaitReceivePortEx": 43, "NtReplyWaitReplyPort": 374, "NtRequestPort": 375, "NtRequestWaitReplyPort": 34, "NtResetEvent": 459128, "NtResetWriteWatch": 786809, "NtRestoreKey": 378, "NtResumeProcess": 196987, "NtResumeThread": 458834, "NtRevertContainerImpersonation": 380, "NtRollbackComplete": 381, "NtRollbackEnlistment": 382, "NtRollbackRegistryTransaction": 383, "NtRollbackTransaction": 384, "NtRollforwardTransactionManager": 385, "NtSaveKey": 524674, "NtSaveKeyEx": 917891, "NtSaveMergedKeys": 721284, "NtSecureConnectPort": 389, "NtSerializeBoot": 390, "NtSetBootEntryOrder": 391, "NtSetBootOptions": 392, "NtSetCachedSigningLevel": 393, "NtSetCachedSigningLevel2": 394, "NtSetContextThread": 395, "NtSetDebugFilterState": 655756, "NtSetDefaultHardErrorPort": 197005, "NtSetDefaultLocale": 328078, "NtSetDefaultUILanguage": 262543, "NtSetDriverEntryOrder": 400, "NtSetEaFile": 401, "NtSetEvent": 458766, "NtSetEventBoostPriority": 196653, "NtSetHighEventPair": 197010, "NtSetHighWaitLowEventPair": 197011, "NtSetIRTimer": 459156, "NtSetInformationDebugObject": 405, "NtSetInformationEnlistment": 406, "NtSetInformationFile": 39, "NtSetInformationJobObject": 407, "NtSetInformationKey": 408, "NtSetInformationObject": 92, "NtSetInformationProcess": 28, "NtSetInformationResourceManager": 409, "NtSetInformationSymbolicLink": 410, "NtSetInformationThread": 13, "NtSetInformationToken": 411, "NtSetInformationTransaction": 412, "NtSetInformationTransactionManager": 413, "NtSetInformationVirtualMemory": 414, "NtSetInformationWorkerFactory": 415, "NtSetIntervalProfile": 328096, "NtSetIoCompletion": 417, "NtSetIoCompletionEx": 418, "NtSetLdtEntries": 419, "NtSetLowEventPair": 197028, "NtSetLowWaitHighEventPair": 197029, "NtSetQuotaInformationFile": 422, "NtSetSecurityObject": 423, "NtSetSystemEnvironmentValue": 424, "NtSetSystemEnvironmentValueEx": 425, "NtSetSystemInformation": 426, "NtSetSystemPowerState": 427, "NtSetSystemTime": 328108, "NtSetThreadExecutionState": 328109, "NtSetTimer": 98, "NtSetTimer2": 430, "NtSetTimerEx": 431, "NtSetTimerResolution": 655792, "NtSetUuidSeed": 262577, "NtSetValueKey": 96, "NtSetVolumeInformationFile": 434, "NtSetWnfProcessNotificationEvent": 435, "NtShutdownSystem": 262580, "NtShutdownWorkerFactory": 437, "NtSignalAndWaitForSingleObject": 1245622, "NtSinglePhaseReject": 439, "NtStartProfile": 197048, "NtStopProfile": 197049, "NtSubscribeWnfStateChange": 442, "NtSuspendProcess": 197051, "NtSuspendThread": 459196, "NtSystemDebugControl": 445, "NtTerminateEnclave": 446, "NtTerminateJobObject": 459199, "NtTerminateProcess": 458796, "NtTerminateThread": 458835, "NtTestAlert": 131520, "NtThawRegistry": 449, "NtThawTransactions": 450, "NtTraceControl": 451, "NtTraceEvent": 94, "NtTranslateFilePath": 1114564, "NtUmsThreadYield": 453, "NtUnloadDriver": 454, "NtUnloadKey": 455, "NtUnloadKey2": 456, "NtUnloadKeyEx": 457, "NtUnlockFile": 458, "NtUnlockVirtualMemory": 459, "NtUnmapViewOfSection": 42, "NtUnmapViewOfSectionEx": 460, "NtUnsubscribeWnfStateChange": 461, "NtUpdateWnfStateData": 462, "NtVdmControl": 463, "NtWaitForAlertByThreadId": 393680, "NtWaitForDebugEvent": 465, "NtWaitForKeyedEvent": 1376722, "NtWaitForMultipleObjects": 1900635, "NtWaitForMultipleObjects32": 1966106, "NtWaitForSingleObject": 851972, "NtWaitForWorkViaWorkerFactory": 467, "NtWaitHighEventPair": 197076, "NtWaitLowEventPair": 197077, "NtWorkerFactoryWorkerReady": 196609, "NtWriteFile": 1703944, "NtWriteFileGather": 1703963, "NtWriteRequestData": 87, "NtWriteVirtualMemory": 58, "NtYieldExecution": 65606}, "22h2": {"NtWorkerFactoryWorkerReady": 196609, "NtMapUserPhysicalPagesScatter": 655363, "NtWaitForMultipleObjects32": 1966106, "NtReplyWaitReceivePortEx": 43, "NtQueryDefaultUILanguage": 262212, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtIsProcessInJob": 524367, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 1114217, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertThreadByThreadId": 262256, "NtAllocateReserveObject": 114, "NtGetNextProcess": 247, "NtGetNextThread": 248, "NtQueueApcThreadEx": 357, "NtUmsThreadYield": 453, "NtAllocateUserPhysicalPages": 115, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtEnumerateBootEntries": 222, "NtEnumerateDriverEntries": 223, "NtEnumerateSystemEnvironmentValuesEx": 224, "NtQueryBootEntryOrder": 319, "NtQueryBootOptions": 320, "NtQueryDriverEntryOrder": 324, "NtQuerySystemEnvironmentValueEx": 352, "NtSetBootEntryOrder": 391, "NtSetDriverEntryOrder": 400, "NtQuerySystemInformationEx": 353, "NtInitializeNlsFiles": 255, "NtCreateProfileEx": 187, "NtCreateWorkerFactory": 204, "NtFlushInstallUILanguage": 231, "NtGetMUIRegistryInfo": 246, "NtGetNlsSectionPtr": 249, "NtIsUILanguageComitted": 259, "NtReleaseWorkerFactoryWorker": 196975, "NtQueryInformationWorkerFactory": 335, "NtSetInformationWorkerFactory": 415, "NtWaitForWorkViaWorkerFactory": 467, "NtShutdownWorkerFactory": 437, "NtSetTimerEx": 431, "NtCancelTimer2": 148, "NtSetTimer2": 430, "NtQueryWnfStateData": 355, "NtUpdateWnfStateData": 462, "NtDisableLastKnownGood": 218, "NtEnableLastKnownGood": 221, "NtCancelSynchronousIoFile": 147, "NtSetIoCompletion": 417, "NtSetIoCompletionEx": 418, "NtRemoveIoCompletionEx": 368, "NtNotifyChangeSession": 283, "NtAssociateWaitCompletionPacket": 144, "NtFlushProcessWriteBuffers": 234, "NtCommitComplete": 150, "NtCommitEnlistment": 151, "NtCommitTransaction": 153, "NtCreateEnlistment": 169, "NtCreateResourceManager": 189, "NtCreateTransaction": 198, "NtCreateTransactionManager": 199, "NtEnumerateTransactionObject": 225, "NtFreezeTransactions": 239, "NtGetNotificationResourceManager": 250, "NtOpenEnlistment": 284, "NtOpenResourceManager": 298, "NtOpenTransaction": 304, "NtOpenTransactionManager": 305, "NtPrepareComplete": 309, "NtPrepareEnlistment": 310, "NtPrePrepareComplete": 307, "NtPrePrepareEnlistment": 308, "NtPropagationComplete": 314, "NtPropagationFailed": 315, "NtQueryInformationEnlistment": 329, "NtQueryInformationResourceManager": 332, "NtQueryInformationTransaction": 333, "NtQueryInformationTransactionManager": 334, "NtReadOnlyEnlistment": 360, "NtRecoverEnlistment": 361, "NtRecoverResourceManager": 362, "NtRecoverTransactionManager": 363, "NtRegisterProtocolAddressInformation": 364, "NtRenameTransactionManager": 371, "NtRollbackComplete": 381, "NtRollbackEnlistment": 382, "NtRollbackTransaction": 384, "NtRollforwardTransactionManager": 385, "NtSetInformationEnlistment": 406, "NtSetInformationResourceManager": 409, "NtSetInformationTransaction": 412, "NtSetInformationTransactionManager": 413, "NtSinglePhaseReject": 439, "NtThawRegistry": 449, "NtThawTransactions": 450, "NtDrawText": 220, "NtTraceControl": 451, "NtSetWnfProcessNotificationEvent": 435, "NtSetInformationVirtualMemory": 414, "NtOpenPrivateNamespace": 295, "NtCreatePrivateNamespace": 184, "NtDeletePrivateNamespace": 213, "NtReplacePartitionUnit": 373, "NtSerializeBoot": 390, "NtOpenKeyTransacted": 289, "NtOpenKeyTransactedEx": 290, "NtFreezeRegistry": 238, "NtCreateKeyTransacted": 175, "NtQuerySecurityAttributesToken": 346, "NtWow64CallFunction64": 488, "NtWow64WriteVirtualMemory64": 487, "NtAlpcConnectPortEx": 122, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAreMappedFilesTheSame": 327822, "NtAssignProcessToJobObject": 524431, "NtCreateJobSet": 174, "NtCreateJobObject": 173, "NtOpenJobObject": 287, "NtQueryInformationJobObject": 330, "NtSetInformationJobObject": 407, "NtTerminateJobObject": 459199, "NtCallEnclave": 145, "NtTerminateEnclave": 446, "NtInitializeEnclave": 254, "NtCreateEnclave": 168, "NtLoadEnclaveData": 262, "NtCreateSectionEx": 190, "NtMapViewOfSectionEx": 276, "NtUnmapViewOfSectionEx": 460, "NtCreatePartition": 182, "NtOpenPartition": 294, "NtManagePartition": 273, "NtMapUserPhysicalPages": 655635, "NtAllocateUserPhysicalPagesEx": 116, "NtGetWriteWatch": 251, "NtResetWriteWatch": 786809, "NtCreatePagingFile": 181, "NtCancelIoFileEx": 146, "NtCancelWaitCompletionPacket": 149, "NtCreateWaitCompletionPacket": 201, "NtCompareObjects": 155, "NtCompareTokens": 157, "NtContinueEx": 161, "NtCreateCrossVmEvent": 163, "NtCreateCrossVmMutant": 164, "NtCreateDirectoryObjectEx": 167, "NtCreateIRTimer": 171, "NtCreateLowBoxToken": 177, "NtCreateRegistryTransaction": 188, "NtCreateThreadEx": 193, "NtCreateTimer2": 195, "NtCreateTokenEx": 197, "NtCreateUserProcess": 200, "NtCreateWaitablePort": 202, "NtCreateWnfStateName": 203, "NtDebugContinue": 206, "NtDeleteBootEntry": 208, "NtDeleteDriverEntry": 209, "NtDeleteWnfStateData": 215, "NtDeleteWnfStateName": 216, "NtDirectGraphicsCall": 217, "NtFilterBootOption": 227, "NtFilterToken": 228, "NtFilterTokenEx": 229, "NtGetCachedSigningLevel": 240, "NtGetCompleteWnfStateSubscription": 241, "NtGetContextThread": 242, "NtGetCurrentProcessorNumber": 1638643, "NtGetCurrentProcessorNumberEx": 244, "NtGetDevicePowerState": 458997, "NtImpersonateAnonymousToken": 196860, "NtInitializeRegistry": 256, "NtInitiatePowerAction": 1114369, "NtIsSystemResumeAutomatic": 65794, "NtLoadKeyEx": 265, "NtLockProductActivationKeys": 327947, "NtLockRegistryKey": 196876, "NtMakePermanentObject": 196878, "NtManageHotPatch": 272, "NtMapCMFModule": 274, "NtModifyBootEntry": 277, "NtModifyDriverEntry": 278, "NtNotifyChangeDirectoryFileEx": 280, "NtNotifyChangeMultipleKeys": 282, "NtOpenKeyEx": 288, "NtOpenKeyedEvent": 291, "NtOpenRegistryTransaction": 297, "NtPlugPlayControl": 306, "NtPssCaptureVaSpaceBulk": 316, "NtQueryAuxiliaryCounterFrequency": 318, "NtQueryDebugFilterState": 328001, "NtQueryInformationByName": 328, "NtQueryInstallUILanguage": 262480, "NtQueryLicenseValue": 339, "NtQueryOpenSubKeys": 342, "NtQueryOpenSubKeysEx": 343, "NtQueryPortInformationProcess": 65880, "NtQuerySecurityPolicy": 348, "NtQueryWnfStateNameInformation": 356, "NtRenameKey": 370, "NtResumeProcess": 196987, "NtRevertContainerImpersonation": 380, "NtRollbackRegistryTransaction": 383, "NtSaveKeyEx": 917891, "NtSaveMergedKeys": 721284, "NtSecureConnectPort": 389, "NtSetBootOptions": 392, "NtSetCachedSigningLevel": 393, "NtSetCachedSigningLevel2": 394, "NtSetContextThread": 395, "NtSetDebugFilterState": 655756, "NtSetDefaultUILanguage": 262543, "NtSetIRTimer": 459156, "NtSetInformationDebugObject": 405, "NtSetInformationSymbolicLink": 410, "NtSetLdtEntries": 419, "NtSetSystemEnvironmentValueEx": 425, "NtSetSystemPowerState": 427, "NtSetThreadExecutionState": 328109, "NtSetUuidSeed": 262577, "NtSubscribeWnfStateChange": 442, "NtSuspendProcess": 197051, "NtTranslateFilePath": 1114564, "NtUnloadKey2": 456, "NtUnloadKeyEx": 457, "NtUnsubscribeWnfStateChange": 461, "NtVdmControl": 463, "NtWaitForAlertByThreadId": 393680, "NtWaitForDebugEvent": 465, "NtLoadKey3": 470, "NtAlpcConnectPort": 121, "NtFreeUserPhysicalPages": 237, "KiUserApcDispatcher": 0, "NtAlertThread": 196719, "NtCallbackReturn": 5, "NtQueueApcThread": 69, "NtTestAlert": 131520, "NtAddAtom": 655431, "NtDeleteAtom": 262351, "NtFindAtom": 655380, "NtQueryInformationAtom": 327, "NtSystemDebugControl": 445, "NtDisplayString": 219, "NtRaiseException": 358, "NtRaiseHardError": 359, "NtSetDefaultHardErrorPort": 197005, "NtQuerySystemEnvironmentValue": 351, "NtSetSystemEnvironmentValue": 424, "NtLoadDriver": 261, "NtUnloadDriver": 454, "NtFlushWriteBuffer": 65772, "NtShutdownSystem": 262580, "NtQueryDefaultLocale": 327701, "NtSetDefaultLocale": 328078, "NtAllocateVirtualMemory": 24, "NtFlushVirtualMemory": 235, "NtFreeVirtualMemory": 30, "NtLockVirtualMemory": 269, "NtProtectVirtualMemory": 80, "NtQueryVirtualMemory": 35, "NtReadVirtualMemory": 63, "NtUnlockVirtualMemory": 459, "NtWriteVirtualMemory": 58, "NtQuerySecurityObject": 347, "NtSetSecurityObject": 423, "NtDuplicateObject": 60, "NtMakeTemporaryObject": 196879, "NtQueryObject": 16, "NtSetInformationObject": 92, "NtSignalAndWaitForSingleObject": 1245622, "NtWaitForMultipleObjects": 1900635, "NtWaitForSingleObject": 851972, "NtCreateDebugObject": 165, "NtDebugActiveProcess": 524493, "NtRemoveProcessDebug": 524657, "NtCreateDirectoryObject": 166, "NtOpenDirectoryObject": 88, "NtQueryDirectoryObject": 323, "NtClearEvent": 196670, "NtCreateEvent": 72, "NtOpenEvent": 64, "NtPulseEvent": 459069, "NtQueryEvent": 86, "NtResetEvent": 459128, "NtSetEvent": 458766, "NtSetEventBoostPriority": 196653, "NtCreateEventPair": 170, "NtOpenEventPair": 285, "NtSetHighEventPair": 197010, "NtSetHighWaitLowEventPair": 197011, "NtSetLowEventPair": 197028, "NtSetLowWaitHighEventPair": 197029, "NtWaitHighEventPair": 197076, "NtWaitLowEventPair": 197077, "NtCancelIoFile": 93, "NtCreateFile": 85, "NtCreateMailslotFile": 178, "NtCreateNamedPipeFile": 180, "NtDeleteFile": 210, "NtDeviceIoControlFile": 1769479, "NtFlushBuffersFile": 75, "NtFsControlFile": 1769529, "NtLockFile": 266, "NtNotifyChangeDirectoryFile": 279, "NtOpenFile": 51, "NtQueryAttributesFile": 61, "NtQueryDirectoryFile": 53, "NtQueryEaFile": 325, "NtQueryFullAttributesFile": 326, "NtQueryInformationFile": 17, "NtQueryVolumeInformationFile": 73, "NtReadFile": 1703942, "NtReadFileScatter": 1703982, "NtSetEaFile": 401, "NtSetInformationFile": 39, "NtSetVolumeInformationFile": 434, "NtUnlockFile": 458, "NtWriteFile": 1703944, "NtWriteFileGather": 1703963, "NtCreateIoCompletion": 172, "NtOpenIoCompletion": 286, "NtQueryIoCompletion": 338, "NtRemoveIoCompletion": 1835017, "NtCompactKeys": 154, "NtCompressKey": 196767, "NtCreateKey": 29, "NtDeleteKey": 211, "NtDeleteValueKey": 214, "NtEnumerateKey": 50, "NtEnumerateValueKey": 19, "NtFlushKey": 196841, "NtLoadKey": 263, "NtLoadKey2": 264, "NtNotifyChangeKey": 281, "NtOpenKey": 18, "NtQueryKey": 22, "NtQueryMultipleValueKey": 340, "NtQueryValueKey": 23, "NtReplaceKey": 372, "NtRestoreKey": 378, "NtSaveKey": 524674, "NtSetInformationKey": 408, "NtSetValueKey": 96, "NtUnloadKey": 455, "NtCreateKeyedEvent": 176, "NtReleaseKeyedEvent": 1311086, "NtWaitForKeyedEvent": 1376722, "NtCreateMutant": 179, "NtOpenMutant": 292, "NtQueryMutant": 341, "NtReleaseMutant": 458784, "NtAcceptConnectPort": 2, "NtCompleteConnectPort": 158, "NtConnectPort": 160, "NtCreatePort": 183, "NtImpersonateClientOfPort": 458783, "NtListenPort": 260, "NtQueryInformationPort": 331, "NtReadRequestData": 84, "NtReplyPort": 12, "NtReplyWaitReceivePort": 11, "NtReplyWaitReplyPort": 374, "NtRequestPort": 375, "NtRequestWaitReplyPort": 34, "NtWriteRequestData": 87, "NtCreateProcess": 185, "NtFlushInstructionCache": 786664, "NtOpenProcess": 38, "NtQueryInformationProcess": 25, "NtSetInformationProcess": 28, "NtTerminateProcess": 458796, "NtCreateProfile": 186, "NtQueryIntervalProfile": 328017, "NtSetIntervalProfile": 328096, "NtStartProfile": 197048, "NtStopProfile": 197049, "NtCreateSection": 74, "NtExtendSection": 226, "NtMapViewOfSection": 40, "NtOpenSection": 55, "NtQuerySection": 81, "NtUnmapViewOfSection": 42, "NtCreateSemaphore": 191, "NtOpenSemaphore": 299, "NtQuerySemaphore": 349, "NtReleaseSemaphore": 786442, "NtCreateSymbolicLinkObject": 192, "NtOpenSymbolicLinkObject": 301, "NtQuerySymbolicLinkObject": 350, "NtAlertResumeThread": 458862, "NtContinue": 67, "NtCreateThread": 78, "NtDelayExecution": 393268, "NtImpersonateThread": 253, "NtOpenThread": 302, "NtQueryInformationThread": 37, "NtRegisterThreadTerminatePort": 196973, "NtResumeThread": 458834, "NtSetInformationThread": 13, "NtSuspendThread": 459196, "NtTerminateThread": 458835, "NtYieldExecution": 65606, "NtCancelTimer": 458849, "NtCreateTimer": 194, "NtOpenTimer": 303, "NtQueryTimer": 56, "NtSetTimer": 98, "NtAdjustGroupsToken": 108, "NtAdjustPrivilegesToken": 65, "NtCreateToken": 196, "NtDuplicateToken": 66, "NtOpenProcessToken": 296, "NtOpenThreadToken": 36, "NtQueryInformationToken": 33, "NtSetInformationToken": 411, "NtAccessCheckAndAuditAlarm": 41, "NtCloseObjectAuditAlarm": 59, "NtDeleteObjectAuditAlarm": 212, "NtOpenObjectAuditAlarm": 293, "NtPrivilegeObjectAuditAlarm": 312, "NtPrivilegedServiceAuditAlarm": 313, "NtAccessCheck": 0, "NtAllocateLocallyUniqueId": 262257, "NtAllocateUuids": 1114229, "NtPrivilegeCheck": 786743, "NtQuerySystemInformation": 54, "NtSetSystemInformation": 426, "NtQueryPerformanceCounter": 327729, "NtQuerySystemTime": 1572954, "NtQueryTimerResolution": 655714, "NtSetSystemTime": 328108, "NtSetTimerResolution": 655792, "NtClose": 196623, "NtFlushBuffersFileEx": 230, "NtOpenProcessTokenEx": 48, "NtOpenThreadTokenEx": 47, "NtQueryDirectoryFileEx": 322, "NtQueryQuotaInformationFile": 345, "NtSetQuotaInformationFile": 422}}, "Windows 11": {"21h2": {"NtAccessCheck": 0, "NtAccessCheckAndAuditAlarm": 41, "NtAccessCheckByType": 99, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAcquireCrossVmMutant": 103, "NtAcquireProcessActivityReference": 104, "NtAddAtom": 71, "NtAddAtomEx": 1114217, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustGroupsToken": 108, "NtAdjustPrivilegesToken": 65, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertResumeThread": 458862, "NtAlertThread": 196719, "NtAlertThreadByThreadId": 262256, "NtAllocateLocallyUniqueId": 262257, "NtAllocateReserveObject": 114, "NtAllocateUserPhysicalPages": 115, "NtAllocateUserPhysicalPagesEx": 116, "NtAllocateUuids": 1114229, "NtAllocateVirtualMemory": 24, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcConnectPort": 121, "NtAlpcConnectPortEx": 122, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtApphelpCacheControl": 76, "NtAreMappedFilesTheSame": 327822, "NtAssignProcessToJobObject": 524431, "NtAssociateWaitCompletionPacket": 144, "NtCallEnclave": 145, "NtCallbackReturn": 5, "NtCancelIoFile": 93, "NtCancelIoFileEx": 146, "NtCancelSynchronousIoFile": 147, "NtCancelTimer": 458849, "NtCancelTimer2": 148, "NtCancelWaitCompletionPacket": 149, "NtChangeProcessState": 150, "NtChangeThreadState": 151, "NtClearEvent": 196670, "NtClose": 196671, "NtCloseObjectAuditAlarm": 59, "NtCommitComplete": 152, "NtCommitEnlistment": 153, "NtCommitRegistryTransaction": 154, "NtCommitTransaction": 155, "NtCompactKeys": 156, "NtCompareObjects": 157, "NtCompareSigningLevels": 158, "NtCompareTokens": 159, "NtCompleteConnectPort": 160, "NtCompressKey": 196769, "NtConnectPort": 162, "NtContinue": 67, "NtContinueEx": 163, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter": 164, "NtCreateCrossVmEvent": 165, "NtCreateCrossVmMutant": 166, "NtCreateDebugObject": 167, "NtCreateDirectoryObject": 168, "NtCreateDirectoryObjectEx": 169, "NtCreateEnclave": 170, "NtCreateEnlistment": 171, "NtCreateEvent": 72, "NtCreateEventPair": 172, "NtCreateFile": 85, "NtCreateIRTimer": 173, "NtCreateIoCompletion": 174, "NtCreateIoRing": 175, "NtCreateJobObject": 176, "NtCreateJobSet": 177, "NtCreateKey": 29, "NtCreateKeyTransacted": 178, "NtCreateKeyedEvent": 179, "NtCreateLowBoxToken": 180, "NtCreateMailslotFile": 181, "NtCreateMutant": 182, "NtCreateNamedPipeFile": 183, "NtCreatePagingFile": 184, "NtCreatePartition": 185, "NtCreatePort": 186, "NtCreatePrivateNamespace": 187, "NtCreateProcess": 188, "NtCreateProcessEx": 77, "NtCreateProcessStateChange": 189, "NtCreateProfile": 190, "NtCreateProfileEx": 191, "NtCreateRegistryTransaction": 192, "NtCreateResourceManager": 193, "NtCreateSection": 74, "NtCreateSectionEx": 194, "NtCreateSemaphore": 195, "NtCreateSymbolicLinkObject": 196, "NtCreateThread": 78, "NtCreateThreadEx": 197, "NtCreateThreadStateChange": 198, "NtCreateTimer": 199, "NtCreateTimer2": 200, "NtCreateToken": 201, "NtCreateTokenEx": 202, "NtCreateTransaction": 203, "NtCreateTransactionManager": 204, "NtCreateUserProcess": 205, "NtCreateWaitCompletionPacket": 206, "NtCreateWaitablePort": 207, "NtCreateWnfStateName": 208, "NtCreateWorkerFactory": 209, "NtDebugActiveProcess": 524498, "NtDebugContinue": 211, "NtDelayExecution": 393268, "NtDeleteAtom": 262356, "NtDeleteBootEntry": 213, "NtDeleteDriverEntry": 214, "NtDeleteFile": 215, "NtDeleteKey": 216, "NtDeleteObjectAuditAlarm": 217, "NtDeletePrivateNamespace": 218, "NtDeleteValueKey": 219, "NtDeleteWnfStateData": 220, "NtDeleteWnfStateName": 221, "NtDeviceIoControlFile": 1769479, "NtDirectGraphicsCall": 222, "NtDisableLastKnownGood": 223, "NtDisplayString": 224, "NtDrawText": 225, "NtDuplicateObject": 60, "NtDuplicateToken": 66, "NtEnableLastKnownGood": 226, "NtEnumerateBootEntries": 227, "NtEnumerateDriverEntries": 228, "NtEnumerateKey": 50, "NtEnumerateSystemEnvironmentValuesEx": 229, "NtEnumerateTransactionObject": 230, "NtEnumerateValueKey": 19, "NtExtendSection": 231, "NtFilterBootOption": 232, "NtFilterToken": 233, "NtFilterTokenEx": 234, "NtFindAtom": 655380, "NtFlushBuffersFile": 75, "NtFlushBuffersFileEx": 235, "NtFlushInstallUILanguage": 236, "NtFlushInstructionCache": 786669, "NtFlushKey": 196846, "NtFlushProcessWriteBuffers": 239, "NtFlushVirtualMemory": 240, "NtFlushWriteBuffer": 65777, "NtFreeUserPhysicalPages": 242, "NtFreeVirtualMemory": 30, "NtFreezeRegistry": 243, "NtFreezeTransactions": 244, "NtFsControlFile": 1769529, "NtGetCachedSigningLevel": 245, "NtGetCompleteWnfStateSubscription": 246, "NtGetContextThread": 247, "NtGetCurrentProcessorNumber": 1638648, "NtGetCurrentProcessorNumberEx": 249, "NtGetDevicePowerState": 459002, "NtGetMUIRegistryInfo": 251, "NtGetNextProcess": 252, "NtGetNextThread": 253, "NtGetNlsSectionPtr": 254, "NtGetNotificationResourceManager": 255, "NtGetWriteWatch": 256, "NtImpersonateAnonymousToken": 196865, "NtImpersonateClientOfPort": 458783, "NtImpersonateThread": 258, "NtInitializeEnclave": 259, "NtInitializeNlsFiles": 260, "NtInitializeRegistry": 261, "NtInitiatePowerAction": 1114374, "NtIsProcessInJob": 524367, "NtIsSystemResumeAutomatic": 65799, "NtIsUILanguageComitted": 264, "NtListenPort": 265, "NtLoadDriver": 266, "NtLoadEnclaveData": 267, "NtLoadKey": 268, "NtLoadKey2": 269, "NtLoadKey3": 270, "NtLoadKeyEx": 271, "NtLockFile": 272, "NtLockProductActivationKeys": 327953, "NtLockRegistryKey": 196882, "NtLockVirtualMemory": 275, "NtMakePermanentObject": 196884, "NtMakeTemporaryObject": 196885, "NtManageHotPatch": 278, "NtManagePartition": 279, "NtMapCMFModule": 280, "NtMapUserPhysicalPages": 655641, "NtMapUserPhysicalPagesScatter": 655363, "NtMapViewOfSection": 40, "NtMapViewOfSectionEx": 282, "NtModifyBootEntry": 283, "NtModifyDriverEntry": 284, "NtNotifyChangeDirectoryFile": 285, "NtNotifyChangeDirectoryFileEx": 286, "NtNotifyChangeKey": 287, "NtNotifyChangeMultipleKeys": 288, "NtNotifyChangeSession": 289, "NtOpenDirectoryObject": 88, "NtOpenEnlistment": 290, "NtOpenEvent": 64, "NtOpenEventPair": 291, "NtOpenFile": 51, "NtOpenIoCompletion": 292, "NtOpenJobObject": 293, "NtOpenKey": 18, "NtOpenKeyEx": 294, "NtOpenKeyTransacted": 295, "NtOpenKeyTransactedEx": 296, "NtOpenKeyedEvent": 297, "NtOpenMutant": 298, "NtOpenObjectAuditAlarm": 299, "NtOpenPartition": 300, "NtOpenPrivateNamespace": 301, "NtOpenProcess": 38, "NtOpenProcessToken": 302, "NtOpenProcessTokenEx": 48, "NtOpenRegistryTransaction": 303, "NtOpenResourceManager": 304, "NtOpenSection": 55, "NtOpenSemaphore": 305, "NtOpenSession": 306, "NtOpenSymbolicLinkObject": 307, "NtOpenThread": 308, "NtOpenThreadToken": 36, "NtOpenThreadTokenEx": 47, "NtOpenTimer": 309, "NtOpenTransaction": 310, "NtOpenTransactionManager": 311, "NtPlugPlayControl": 312, "NtPowerInformation": 95, "NtPrePrepareComplete": 313, "NtPrePrepareEnlistment": 314, "NtPrepareComplete": 315, "NtPrepareEnlistment": 316, "NtPrivilegeCheck": 786749, "NtPrivilegeObjectAuditAlarm": 318, "NtPrivilegedServiceAuditAlarm": 319, "NtPropagationComplete": 320, "NtPropagationFailed": 321, "NtProtectVirtualMemory": 80, "NtPssCaptureVaSpaceBulk": 322, "NtPulseEvent": 459075, "NtQueryAttributesFile": 61, "NtQueryAuxiliaryCounterFrequency": 324, "NtQueryBootEntryOrder": 325, "NtQueryBootOptions": 326, "NtQueryDebugFilterState": 328007, "NtQueryDefaultLocale": 327701, "NtQueryDefaultUILanguage": 262212, "NtQueryDirectoryFile": 53, "NtQueryDirectoryFileEx": 328, "NtQueryDirectoryObject": 329, "NtQueryDriverEntryOrder": 330, "NtQueryEaFile": 331, "NtQueryEvent": 86, "NtQueryFullAttributesFile": 332, "NtQueryInformationAtom": 333, "NtQueryInformationByName": 334, "NtQueryInformationEnlistment": 335, "NtQueryInformationFile": 17, "NtQueryInformationJobObject": 336, "NtQueryInformationPort": 337, "NtQueryInformationProcess": 25, "NtQueryInformationResourceManager": 338, "NtQueryInformationThread": 37, "NtQueryInformationToken": 33, "NtQueryInformationTransaction": 339, "NtQueryInformationTransactionManager": 340, "NtQueryInformationWorkerFactory": 341, "NtQueryInstallUILanguage": 262486, "NtQueryIntervalProfile": 328023, "NtQueryIoCompletion": 344, "NtQueryIoRingCapabilities": 345, "NtQueryKey": 22, "NtQueryLicenseValue": 346, "NtQueryMultipleValueKey": 347, "NtQueryMutant": 348, "NtQueryObject": 16, "NtQueryOpenSubKeys": 349, "NtQueryOpenSubKeysEx": 350, "NtQueryPerformanceCounter": 327729, "NtQueryPortInformationProcess": 65887, "NtQueryQuotaInformationFile": 352, "NtQuerySection": 81, "NtQuerySecurityAttributesToken": 353, "NtQuerySecurityObject": 354, "NtQuerySecurityPolicy": 355, "NtQuerySemaphore": 356, "NtQuerySymbolicLinkObject": 357, "NtQuerySystemEnvironmentValue": 358, "NtQuerySystemEnvironmentValueEx": 359, "NtQuerySystemInformation": 54, "NtQuerySystemInformationEx": 360, "NtQueryTimer": 56, "NtQueryTimerResolution": 655721, "NtQueryValueKey": 23, "NtQueryVirtualMemory": 35, "NtQueryVolumeInformationFile": 73, "NtQueryWnfStateData": 362, "NtQueryWnfStateNameInformation": 363, "NtQueueApcThread": 69, "NtQueueApcThreadEx": 364, "NtQueueApcThreadEx2": 365, "NtRaiseException": 366, "NtRaiseHardError": 367, "NtReadFile": 1703942, "NtReadFileScatter": 1703982, "NtReadOnlyEnlistment": 368, "NtReadRequestData": 84, "NtReadVirtualMemory": 63, "NtReadVirtualMemoryEx": 369, "NtRecoverEnlistment": 370, "NtRecoverResourceManager": 371, "NtRecoverTransactionManager": 372, "NtRegisterProtocolAddressInformation": 373, "NtRegisterThreadTerminatePort": 196982, "NtReleaseKeyedEvent": 1311095, "NtReleaseMutant": 458784, "NtReleaseSemaphore": 786442, "NtReleaseWorkerFactoryWorker": 196984, "NtRemoveIoCompletion": 1835017, "NtRemoveIoCompletionEx": 377, "NtRemoveProcessDebug": 524666, "NtRenameKey": 379, "NtRenameTransactionManager": 380, "NtReplaceKey": 381, "NtReplacePartitionUnit": 382, "NtReplyPort": 12, "NtReplyWaitReceivePort": 11, "NtReplyWaitReceivePortEx": 43, "NtReplyWaitReplyPort": 383, "NtRequestPort": 384, "NtRequestWaitReplyPort": 34, "NtResetEvent": 459137, "NtResetWriteWatch": 786818, "NtRestoreKey": 387, "NtResumeProcess": 196996, "NtResumeThread": 458834, "NtRevertContainerImpersonation": 389, "NtRollbackComplete": 390, "NtRollbackEnlistment": 391, "NtRollbackRegistryTransaction": 392, "NtRollbackTransaction": 393, "NtRollforwardTransactionManager": 394, "NtSaveKey": 524683, "NtSaveKeyEx": 917900, "NtSaveMergedKeys": 721293, "NtSecureConnectPort": 398, "NtSerializeBoot": 399, "NtSetBootEntryOrder": 400, "NtSetBootOptions": 401, "NtSetCachedSigningLevel": 402, "NtSetCachedSigningLevel2": 403, "NtSetContextThread": 404, "NtSetDebugFilterState": 655765, "NtSetDefaultHardErrorPort": 197014, "NtSetDefaultLocale": 328087, "NtSetDefaultUILanguage": 262552, "NtSetDriverEntryOrder": 409, "NtSetEaFile": 410, "NtSetEvent": 458766, "NtSetEventBoostPriority": 196653, "NtSetHighEventPair": 197019, "NtSetHighWaitLowEventPair": 197020, "NtSetIRTimer": 459165, "NtSetInformationDebugObject": 414, "NtSetInformationEnlistment": 415, "NtSetInformationFile": 39, "NtSetInformationIoRing": 416, "NtSetInformationJobObject": 417, "NtSetInformationKey": 418, "NtSetInformationObject": 92, "NtSetInformationProcess": 28, "NtSetInformationResourceManager": 419, "NtSetInformationSymbolicLink": 420, "NtSetInformationThread": 13, "NtSetInformationToken": 421, "NtSetInformationTransaction": 422, "NtSetInformationTransactionManager": 423, "NtSetInformationVirtualMemory": 424, "NtSetInformationWorkerFactory": 425, "NtSetIntervalProfile": 328106, "NtSetIoCompletion": 427, "NtSetIoCompletionEx": 428, "NtSetLdtEntries": 429, "NtSetLowEventPair": 197038, "NtSetLowWaitHighEventPair": 197039, "NtSetQuotaInformationFile": 432, "NtSetSecurityObject": 433, "NtSetSystemEnvironmentValue": 434, "NtSetSystemEnvironmentValueEx": 435, "NtSetSystemInformation": 436, "NtSetSystemPowerState": 437, "NtSetSystemTime": 328118, "NtSetThreadExecutionState": 328119, "NtSetTimer": 98, "NtSetTimer2": 440, "NtSetTimerEx": 441, "NtSetTimerResolution": 655802, "NtSetUuidSeed": 262587, "NtSetValueKey": 96, "NtSetVolumeInformationFile": 444, "NtSetWnfProcessNotificationEvent": 445, "NtShutdownSystem": 262590, "NtShutdownWorkerFactory": 447, "NtSignalAndWaitForSingleObject": 1245632, "NtSinglePhaseReject": 449, "NtStartProfile": 197058, "NtStopProfile": 197059, "NtSubmitIoRing": 452, "NtSubscribeWnfStateChange": 453, "NtSuspendProcess": 197062, "NtSuspendThread": 459207, "NtSystemDebugControl": 456, "NtTerminateEnclave": 457, "NtTerminateJobObject": 459210, "NtTerminateProcess": 458796, "NtTerminateThread": 458835, "NtTestAlert": 131531, "NtThawRegistry": 460, "NtThawTransactions": 461, "NtTraceControl": 462, "NtTraceEvent": 94, "NtTranslateFilePath": 1114575, "NtUmsThreadYield": 464, "NtUnloadDriver": 465, "NtUnloadKey": 466, "NtUnloadKey2": 467, "NtUnloadKeyEx": 468, "NtUnlockFile": 469, "NtUnlockVirtualMemory": 470, "NtUnmapViewOfSection": 42, "NtUnmapViewOfSectionEx": 471, "NtUnsubscribeWnfStateChange": 472, "NtUpdateWnfStateData": 473, "NtVdmControl": 474, "NtWaitForAlertByThreadId": 393691, "NtWaitForDebugEvent": 476, "NtWaitForKeyedEvent": 1376733, "NtWaitForMultipleObjects": 1900635, "NtWaitForMultipleObjects32": 1966106, "NtWaitForSingleObject": 851972, "NtWaitForWorkViaWorkerFactory": 478, "NtWaitHighEventPair": 197087, "NtWaitLowEventPair": 197088, "NtWorkerFactoryWorkerReady": 196609, "NtWriteFile": 1703944, "NtWriteFileGather": 1703963, "NtWriteRequestData": 87, "NtWriteVirtualMemory": 58, "NtYieldExecution": 65606, "RtlGetNativeSystemInformation": 493}, "22h2": {"NtWorkerFactoryWorkerReady": 196609, "NtMapUserPhysicalPagesScatter": 655363, "NtWaitForMultipleObjects32": 1966106, "NtReplyWaitReceivePortEx": 43, "NtQueryDefaultUILanguage": 262212, "NtApphelpCacheControl": 76, "NtCreateProcessEx": 77, "NtIsProcessInJob": 524367, "NtAccessCheckByTypeAndAuditAlarm": 89, "NtTraceEvent": 94, "NtPowerInformation": 95, "NtAccessCheckByType": 99, "NtAccessCheckByTypeResultList": 100, "NtAccessCheckByTypeResultListAndAuditAlarm": 101, "NtAccessCheckByTypeResultListAndAuditAlarmByHandle": 102, "NtAddAtomEx": 1114217, "NtAddBootEntry": 106, "NtAddDriverEntry": 107, "NtAdjustTokenClaimsAndDeviceGroups": 109, "NtAlertThreadByThreadId": 262256, "NtAllocateReserveObject": 114, "NtGetNextProcess": 254, "NtGetNextThread": 255, "NtQueueApcThreadEx": 368, "NtUmsThreadYield": 469, "NtAllocateUserPhysicalPages": 115, "NtAllocateVirtualMemoryEx": 118, "NtAlpcAcceptConnectPort": 119, "NtAlpcCancelMessage": 120, "NtAlpcCreatePort": 123, "NtAlpcCreatePortSection": 124, "NtAlpcCreateResourceReserve": 125, "NtAlpcCreateSectionView": 126, "NtAlpcCreateSecurityContext": 127, "NtAlpcDeletePortSection": 128, "NtAlpcDeleteResourceReserve": 129, "NtAlpcDeleteSectionView": 130, "NtAlpcDeleteSecurityContext": 131, "NtAlpcDisconnectPort": 132, "NtAlpcImpersonateClientOfPort": 134, "NtAlpcOpenSenderProcess": 135, "NtAlpcOpenSenderThread": 136, "NtAlpcQueryInformation": 137, "NtAlpcQueryInformationMessage": 138, "NtAlpcRevokeSecurityContext": 139, "NtAlpcSendWaitReceivePort": 140, "NtAlpcSetInformation": 141, "NtEnumerateBootEntries": 229, "NtEnumerateDriverEntries": 230, "NtEnumerateSystemEnvironmentValuesEx": 231, "NtQueryBootEntryOrder": 328, "NtQueryBootOptions": 329, "NtQueryDriverEntryOrder": 333, "NtQuerySystemEnvironmentValueEx": 363, "NtSetBootEntryOrder": 404, "NtSetDriverEntryOrder": 413, "NtQuerySystemInformationEx": 364, "NtInitializeNlsFiles": 262, "NtCreateProfileEx": 193, "NtCreateWorkerFactory": 211, "NtFlushInstallUILanguage": 238, "NtGetMUIRegistryInfo": 253, "NtGetNlsSectionPtr": 256, "NtIsUILanguageComitted": 266, "NtReleaseWorkerFactoryWorker": 196988, "NtQueryInformationWorkerFactory": 345, "NtSetInformationWorkerFactory": 430, "NtWaitForWorkViaWorkerFactory": 483, "NtShutdownWorkerFactory": 452, "NtSetTimerEx": 446, "NtCancelTimer2": 148, "NtSetTimer2": 445, "NtQueryWnfStateData": 366, "NtUpdateWnfStateData": 478, "NtDisableLastKnownGood": 225, "NtEnableLastKnownGood": 228, "NtCancelSynchronousIoFile": 147, "NtSetIoCompletion": 432, "NtSetIoCompletionEx": 433, "NtRemoveIoCompletionEx": 381, "NtNotifyChangeSession": 291, "NtAssociateWaitCompletionPacket": 144, "NtFlushProcessWriteBuffers": 241, "NtCommitComplete": 152, "NtCommitEnlistment": 153, "NtCommitTransaction": 155, "NtCreateEnlistment": 173, "NtCreateResourceManager": 195, "NtCreateTransaction": 205, "NtCreateTransactionManager": 206, "NtEnumerateTransactionObject": 232, "NtFreezeTransactions": 246, "NtGetNotificationResourceManager": 257, "NtOpenEnlistment": 293, "NtOpenResourceManager": 307, "NtOpenTransaction": 313, "NtOpenTransactionManager": 314, "NtPrepareComplete": 318, "NtPrepareEnlistment": 319, "NtPrePrepareComplete": 316, "NtPrePrepareEnlistment": 317, "NtPropagationComplete": 323, "NtPropagationFailed": 324, "NtQueryInformationEnlistment": 339, "NtQueryInformationResourceManager": 342, "NtQueryInformationTransaction": 343, "NtQueryInformationTransactionManager": 344, "NtReadOnlyEnlistment": 372, "NtRecoverEnlistment": 374, "NtRecoverResourceManager": 375, "NtRecoverTransactionManager": 376, "NtRegisterProtocolAddressInformation": 377, "NtRenameTransactionManager": 384, "NtRollbackComplete": 394, "NtRollbackEnlistment": 395, "NtRollbackTransaction": 397, "NtRollforwardTransactionManager": 398, "NtSetInformationEnlistment": 420, "NtSetInformationResourceManager": 424, "NtSetInformationTransaction": 427, "NtSetInformationTransactionManager": 428, "NtSinglePhaseReject": 454, "NtThawRegistry": 465, "NtThawTransactions": 466, "NtDrawText": 227, "NtTraceControl": 467, "NtSetWnfProcessNotificationEvent": 450, "NtSetInformationVirtualMemory": 429, "NtOpenPrivateNamespace": 304, "NtCreatePrivateNamespace": 189, "NtDeletePrivateNamespace": 220, "NtReplacePartitionUnit": 386, "NtSerializeBoot": 403, "NtOpenKeyTransacted": 298, "NtOpenKeyTransactedEx": 299, "NtFreezeRegistry": 245, "NtCreateKeyTransacted": 180, "NtQuerySecurityAttributesToken": 357, "NtWow64CallFunction64": 503, "NtWow64WriteVirtualMemory64": 502, "NtAlpcConnectPortEx": 122, "NtAlpcImpersonateClientContainerOfPort": 133, "NtAreMappedFilesTheSame": 327822, "NtAssignProcessToJobObject": 524431, "NtCreateJobSet": 179, "NtCreateJobObject": 178, "NtOpenJobObject": 296, "NtQueryInformationJobObject": 340, "NtSetInformationJobObject": 422, "NtTerminateJobObject": 459215, "NtCallEnclave": 145, "NtTerminateEnclave": 462, "NtInitializeEnclave": 261, "NtCreateEnclave": 172, "NtLoadEnclaveData": 269, "NtCreateSectionEx": 196, "NtMapViewOfSectionEx": 284, "NtUnmapViewOfSectionEx": 476, "NtCreatePartition": 187, "NtOpenPartition": 303, "NtManagePartition": 281, "NtMapUserPhysicalPages": 655643, "NtAllocateUserPhysicalPagesEx": 116, "NtGetWriteWatch": 258, "NtResetWriteWatch": 786822, "NtCreatePagingFile": 186, "NtCancelIoFileEx": 146, "NtCancelWaitCompletionPacket": 149, "NtCreateWaitCompletionPacket": 208, "NtCompareObjects": 157, "NtCompareTokens": 159, "NtContinueEx": 163, "NtCreateCrossVmEvent": 167, "NtCreateCrossVmMutant": 168, "NtCreateDirectoryObjectEx": 171, "NtCreateIRTimer": 175, "NtCreateLowBoxToken": 182, "NtCreateRegistryTransaction": 194, "NtCreateThreadEx": 199, "NtCreateTimer2": 202, "NtCreateTokenEx": 204, "NtCreateUserProcess": 207, "NtCreateWaitablePort": 209, "NtCreateWnfStateName": 210, "NtDebugContinue": 213, "NtDeleteBootEntry": 215, "NtDeleteDriverEntry": 216, "NtDeleteWnfStateData": 222, "NtDeleteWnfStateName": 223, "NtDirectGraphicsCall": 224, "NtFilterBootOption": 234, "NtFilterToken": 235, "NtFilterTokenEx": 236, "NtGetCachedSigningLevel": 247, "NtGetCompleteWnfStateSubscription": 248, "NtGetContextThread": 249, "NtGetCurrentProcessorNumber": 1638650, "NtGetCurrentProcessorNumberEx": 251, "NtGetDevicePowerState": 459004, "NtImpersonateAnonymousToken": 196867, "NtInitializeRegistry": 263, "NtInitiatePowerAction": 1114376, "NtIsSystemResumeAutomatic": 65801, "NtLoadKeyEx": 273, "NtLockProductActivationKeys": 327955, "NtLockRegistryKey": 196884, "NtMakePermanentObject": 196886, "NtManageHotPatch": 280, "NtMapCMFModule": 282, "NtModifyBootEntry": 285, "NtModifyDriverEntry": 286, "NtNotifyChangeDirectoryFileEx": 288, "NtNotifyChangeMultipleKeys": 290, "NtOpenKeyEx": 297, "NtOpenKeyedEvent": 300, "NtOpenRegistryTransaction": 306, "NtPlugPlayControl": 315, "NtPssCaptureVaSpaceBulk": 325, "NtQueryAuxiliaryCounterFrequency": 327, "NtQueryDebugFilterState": 328010, "NtQueryInformationByName": 337, "NtQueryInstallUILanguage": 262490, "NtQueryLicenseValue": 350, "NtQueryOpenSubKeys": 353, "NtQueryOpenSubKeysEx": 354, "NtQueryPortInformationProcess": 65891, "NtQuerySecurityPolicy": 359, "NtQueryWnfStateNameInformation": 367, "NtRenameKey": 383, "NtResumeProcess": 197000, "NtRevertContainerImpersonation": 393, "NtRollbackRegistryTransaction": 396, "NtSaveKeyEx": 917904, "NtSaveMergedKeys": 721297, "NtSecureConnectPort": 402, "NtSetBootOptions": 405, "NtSetCachedSigningLevel": 406, "NtSetCachedSigningLevel2": 407, "NtSetContextThread": 408, "NtSetDebugFilterState": 655769, "NtSetDefaultUILanguage": 262556, "NtSetIRTimer": 459169, "NtSetInformationDebugObject": 419, "NtSetInformationSymbolicLink": 425, "NtSetLdtEntries": 434, "NtSetSystemEnvironmentValueEx": 440, "NtSetSystemPowerState": 442, "NtSetThreadExecutionState": 328124, "NtSetUuidSeed": 262592, "NtSubscribeWnfStateChange": 458, "NtSuspendProcess": 197067, "NtTranslateFilePath": 1114580, "NtUnloadKey2": 472, "NtUnloadKeyEx": 473, "NtUnsubscribeWnfStateChange": 477, "NtVdmControl": 479, "NtWaitForAlertByThreadId": 393696, "NtWaitForDebugEvent": 481, "NtLoadKey3": 272, "NtAlpcConnectPort": 121, "NtFreeUserPhysicalPages": 244, "KiUserApcDispatcher": 0, "NtAlertThread": 196719, "NtCallbackReturn": 5, "NtQueueApcThread": 69, "NtTestAlert": 131536, "NtAddAtom": 655431, "NtDeleteAtom": 262358, "NtFindAtom": 655380, "NtQueryInformationAtom": 336, "NtSystemDebugControl": 461, "NtDisplayString": 226, "NtRaiseException": 370, "NtRaiseHardError": 371, "NtSetDefaultHardErrorPort": 197018, "NtQuerySystemEnvironmentValue": 362, "NtSetSystemEnvironmentValue": 439, "NtLoadDriver": 268, "NtUnloadDriver": 470, "NtFlushWriteBuffer": 65779, "NtShutdownSystem": 262595, "NtQueryDefaultLocale": 327701, "NtSetDefaultLocale": 328091, "NtAllocateVirtualMemory": 24, "NtFlushVirtualMemory": 242, "NtFreeVirtualMemory": 30, "NtLockVirtualMemory": 277, "NtProtectVirtualMemory": 80, "NtQueryVirtualMemory": 35, "NtReadVirtualMemory": 63, "NtUnlockVirtualMemory": 475, "NtWriteVirtualMemory": 58, "NtQuerySecurityObject": 358, "NtSetSecurityObject": 438, "NtDuplicateObject": 60, "NtMakeTemporaryObject": 196887, "NtQueryObject": 16, "NtSetInformationObject": 92, "NtSignalAndWaitForSingleObject": 1245637, "NtWaitForMultipleObjects": 1900635, "NtWaitForSingleObject": 851972, "NtCreateDebugObject": 169, "NtDebugActiveProcess": 524500, "NtRemoveProcessDebug": 524670, "NtCreateDirectoryObject": 170, "NtOpenDirectoryObject": 88, "NtQueryDirectoryObject": 332, "NtClearEvent": 196670, "NtCreateEvent": 72, "NtOpenEvent": 64, "NtPulseEvent": 459078, "NtQueryEvent": 86, "NtResetEvent": 459141, "NtSetEvent": 458766, "NtSetEventBoostPriority": 196653, "NtCreateEventPair": 174, "NtOpenEventPair": 294, "NtSetHighEventPair": 197023, "NtSetHighWaitLowEventPair": 197024, "NtSetLowEventPair": 197043, "NtSetLowWaitHighEventPair": 197044, "NtWaitHighEventPair": 197092, "NtWaitLowEventPair": 197093, "NtCancelIoFile": 93, "NtCreateFile": 85, "NtCreateMailslotFile": 183, "NtCreateNamedPipeFile": 185, "NtDeleteFile": 217, "NtDeviceIoControlFile": 1769479, "NtFlushBuffersFile": 75, "NtFsControlFile": 1769529, "NtLockFile": 274, "NtNotifyChangeDirectoryFile": 287, "NtOpenFile": 51, "NtQueryAttributesFile": 61, "NtQueryDirectoryFile": 53, "NtQueryEaFile": 334, "NtQueryFullAttributesFile": 335, "NtQueryInformationFile": 17, "NtQueryVolumeInformationFile": 73, "NtReadFile": 1703942, "NtReadFileScatter": 1703982, "NtSetEaFile": 414, "NtSetInformationFile": 39, "NtSetVolumeInformationFile": 449, "NtUnlockFile": 474, "NtWriteFile": 1703944, "NtWriteFileGather": 1703963, "NtCreateIoCompletion": 176, "NtOpenIoCompletion": 295, "NtQueryIoCompletion": 348, "NtRemoveIoCompletion": 1835017, "NtCompactKeys": 156, "NtCompressKey": 196769, "NtCreateKey": 29, "NtDeleteKey": 218, "NtDeleteValueKey": 221, "NtEnumerateKey": 50, "NtEnumerateValueKey": 19, "NtFlushKey": 196848, "NtLoadKey": 270, "NtLoadKey2": 271, "NtNotifyChangeKey": 289, "NtOpenKey": 18, "NtQueryKey": 22, "NtQueryMultipleValueKey": 351, "NtQueryValueKey": 23, "NtReplaceKey": 385, "NtRestoreKey": 391, "NtSaveKey": 524687, "NtSetInformationKey": 423, "NtSetValueKey": 96, "NtUnloadKey": 471, "NtCreateKeyedEvent": 181, "NtReleaseKeyedEvent": 1311099, "NtWaitForKeyedEvent": 1376738, "NtCreateMutant": 184, "NtOpenMutant": 301, "NtQueryMutant": 352, "NtReleaseMutant": 458784, "NtAcceptConnectPort": 2, "NtCompleteConnectPort": 160, "NtConnectPort": 162, "NtCreatePort": 188, "NtImpersonateClientOfPort": 458783, "NtListenPort": 267, "NtQueryInformationPort": 341, "NtReadRequestData": 84, "NtReplyPort": 12, "NtReplyWaitReceivePort": 11, "NtReplyWaitReplyPort": 387, "NtRequestPort": 388, "NtRequestWaitReplyPort": 34, "NtWriteRequestData": 87, "NtCreateProcess": 190, "NtFlushInstructionCache": 786671, "NtOpenProcess": 38, "NtQueryInformationProcess": 25, "NtSetInformationProcess": 28, "NtTerminateProcess": 458796, "NtCreateProfile": 192, "NtQueryIntervalProfile": 328027, "NtSetIntervalProfile": 328111, "NtStartProfile": 197063, "NtStopProfile": 197064, "NtCreateSection": 74, "NtExtendSection": 233, "NtMapViewOfSection": 40, "NtOpenSection": 55, "NtQuerySection": 81, "NtUnmapViewOfSection": 42, "NtCreateSemaphore": 197, "NtOpenSemaphore": 308, "NtQuerySemaphore": 360, "NtReleaseSemaphore": 786442, "NtCreateSymbolicLinkObject": 198, "NtOpenSymbolicLinkObject": 310, "NtQuerySymbolicLinkObject": 361, "NtAlertResumeThread": 458862, "NtContinue": 67, "NtCreateThread": 78, "NtDelayExecution": 393268, "NtImpersonateThread": 260, "NtOpenThread": 311, "NtQueryInformationThread": 37, "NtRegisterThreadTerminatePort": 196986, "NtResumeThread": 458834, "NtSetInformationThread": 13, "NtSuspendThread": 459212, "NtTerminateThread": 458835, "NtYieldExecution": 65606, "NtCancelTimer": 458849, "NtCreateTimer": 201, "NtOpenTimer": 312, "NtQueryTimer": 56, "NtSetTimer": 98, "NtAdjustGroupsToken": 108, "NtAdjustPrivilegesToken": 65, "NtCreateToken": 203, "NtDuplicateToken": 66, "NtOpenProcessToken": 305, "NtOpenThreadToken": 36, "NtQueryInformationToken": 33, "NtSetInformationToken": 426, "NtAccessCheckAndAuditAlarm": 41, "NtCloseObjectAuditAlarm": 59, "NtDeleteObjectAuditAlarm": 219, "NtOpenObjectAuditAlarm": 302, "NtPrivilegeObjectAuditAlarm": 321, "NtPrivilegedServiceAuditAlarm": 322, "NtAccessCheck": 0, "NtAllocateLocallyUniqueId": 262257, "NtAllocateUuids": 1114229, "NtPrivilegeCheck": 786752, "NtQuerySystemInformation": 54, "NtSetSystemInformation": 441, "NtQueryPerformanceCounter": 327729, "NtQuerySystemTime": 1572954, "NtQueryTimerResolution": 655725, "NtSetSystemTime": 328123, "NtSetTimerResolution": 655807, "NtClose": 196623, "NtFlushBuffersFileEx": 237, "NtOpenProcessTokenEx": 48, "NtOpenThreadTokenEx": 47, "NtQueryDirectoryFileEx": 331, "NtQueryQuotaInformationFile": 356, "NtSetQuotaInformationFile": 437}}}
Reference in New Issue View Git Blame Copy Permalink