| SSDT | RET | 22621 | 07601 | 03790 |
|---|---|---|---|---|
| NtAccessCheck | 0x20 | 0x00 | 0x61 | 0x61 |
| NtWorkerFactoryWorkerReady | 0x04 | 0x01 | 0x190 | - |
| NtAcceptConnectPort | 0x18 | 0x02 | 0x60 | 0x60 |
| NtMapUserPhysicalPagesScatter | 0x0C | 0x03 | 0x00 | 0x00 |
| NtWaitForSingleObject | 0x0C | 0x04 | 0x01 | 0x01 |
| NtCallbackReturn | 0x0C | 0x05 | 0x02 | 0x02 |
| NtReadFile | 0x24 | 0x06 | 0x03 | 0x03 |
| NtDeviceIoControlFile | 0x28 | 0x07 | 0x04 | 0x04 |
| NtWriteFile | 0x24 | 0x08 | 0x05 | 0x05 |
| NtRemoveIoCompletion | 0x14 | 0x09 | 0x06 | 0x06 |
| NtReleaseSemaphore | 0x0C | 0x0A | 0x07 | 0x07 |
| NtReplyWaitReceivePort | 0x10 | 0x0B | 0x08 | 0x08 |
| NtReplyPort | 0x08 | 0x0C | 0x09 | 0x09 |
| NtSetInformationThread | 0x10 | 0x0D | 0x0A | 0x0A |
| NtSetEvent | 0x08 | 0x0E | 0x0B | 0x0B |
| NtClose | 0x04 | 0x0F | 0x0C | 0x0C |
| NtQueryObject | 0x14 | 0x10 | 0x0D | 0x0D |
| NtQueryInformationFile | 0x14 | 0x11 | 0x0E | 0x0E |
| NtOpenKey | 0x0C | 0x12 | 0x0F | 0x0F |
| NtEnumerateValueKey | 0x18 | 0x13 | 0x10 | 0x10 |
| NtFindAtom | 0x0C | 0x14 | 0x11 | 0x11 |
| NtQueryDefaultLocale | 0x08 | 0x15 | 0x12 | 0x12 |
| NtQueryKey | 0x14 | 0x16 | 0x13 | 0x13 |
| NtQueryValueKey | 0x18 | 0x17 | 0x14 | 0x14 |
| NtAllocateVirtualMemory | 0x18 | 0x18 | 0x15 | 0x15 |
| NtQueryInformationProcess | 0x14 | 0x19 | 0x16 | 0x16 |
| NtWaitForMultipleObjects32 | 0x14 | 0x1A | 0x17 | 0x17 |
| NtWriteFileGather | 0x24 | 0x1B | 0x18 | 0x18 |
| NtSetInformationProcess | 0x10 | 0x1C | 0x19 | 0x19 |
| NtCreateKey | 0x1C | 0x1D | 0x1A | 0x1A |
| NtFreeVirtualMemory | 0x10 | 0x1E | 0x1B | 0x1B |
| NtImpersonateClientOfPort | 0x08 | 0x1F | 0x1C | 0x1C |
| NtReleaseMutant | 0x08 | 0x20 | 0x1D | 0x1D |
| NtQueryInformationToken | 0x14 | 0x21 | 0x1E | 0x1E |
| NtRequestWaitReplyPort | 0x0C | 0x22 | 0x1F | 0x1F |
| NtQueryVirtualMemory | 0x18 | 0x23 | 0x20 | 0x20 |
| NtOpenThreadToken | 0x10 | 0x24 | 0x21 | 0x21 |
| NtQueryInformationThread | 0x14 | 0x25 | 0x22 | 0x22 |
| NtOpenProcess | 0x10 | 0x26 | 0x23 | 0x23 |
| NtSetInformationFile | 0x14 | 0x27 | 0x24 | 0x24 |
| NtMapViewOfSection | 0x28 | 0x28 | 0x25 | 0x25 |
| NtAccessCheckAndAuditAlarm | 0x2C | 0x29 | 0x26 | 0x26 |
| NtUnmapViewOfSection | 0x08 | 0x2A | 0x27 | 0x27 |
| NtReplyWaitReceivePortEx | 0x14 | 0x2B | 0x28 | 0x28 |
| NtTerminateProcess | 0x08 | 0x2C | 0x29 | 0x29 |
| NtSetEventBoostPriority | 0x04 | 0x2D | 0x2A | 0x2A |
| NtReadFileScatter | 0x24 | 0x2E | 0x2B | 0x2B |
| NtOpenThreadTokenEx | 0x14 | 0x2F | 0x2C | 0x2C |
| NtOpenProcessTokenEx | 0x10 | 0x30 | 0x2D | 0x2D |
| NtQueryPerformanceCounter | 0x08 | 0x31 | 0x2E | 0x2E |
| NtEnumerateKey | 0x18 | 0x32 | 0x2F | 0x2F |
| NtOpenFile | 0x18 | 0x33 | 0x30 | 0x30 |
| NtDelayExecution | 0x08 | 0x34 | 0x31 | 0x31 |
| NtQueryDirectoryFile | 0x2C | 0x35 | 0x32 | 0x32 |
| NtQuerySystemInformation | 0x10 | 0x36 | 0x33 | 0x33 |
| NtOpenSection | 0x0C | 0x37 | 0x34 | 0x34 |
| NtQueryTimer | 0x14 | 0x38 | 0x35 | 0x35 |
| NtFsControlFile | 0x28 | 0x39 | 0x36 | 0x36 |
| NtWriteVirtualMemory | 0x14 | 0x3A | 0x37 | 0x37 |
| NtCloseObjectAuditAlarm | 0x0C | 0x3B | 0x38 | 0x38 |
| NtDuplicateObject | 0x1C | 0x3C | 0x39 | 0x39 |
| NtQueryAttributesFile | 0x08 | 0x3D | 0x3A | 0x3A |
| NtClearEvent | 0x04 | 0x3E | 0x3B | 0x3B |
| NtReadVirtualMemory | 0x14 | 0x3F | 0x3C | 0x3C |
| NtOpenEvent | 0x0C | 0x40 | 0x3D | 0x3D |
| NtAdjustPrivilegesToken | 0x18 | 0x41 | 0x3E | 0x3E |
| NtDuplicateToken | 0x18 | 0x42 | 0x3F | 0x3F |
| NtContinue | 0x08 | 0x43 | 0x40 | 0x40 |
| NtQueryDefaultUILanguage | 0x04 | 0x44 | 0x41 | 0x41 |
| NtQueueApcThread | 0x14 | 0x45 | 0x42 | 0x42 |
| NtYieldExecution | 0x00 | 0x46 | 0x43 | 0x43 |
| NtAddAtom | 0x0C | 0x47 | 0x44 | 0x44 |
| NtCreateEvent | 0x14 | 0x48 | 0x45 | 0x45 |
| NtQueryVolumeInformationFile | 0x14 | 0x49 | 0x46 | 0x46 |
| NtCreateSection | 0x1C | 0x4A | 0x47 | 0x47 |
| NtFlushBuffersFile | 0x08 | 0x4B | 0x48 | 0x48 |
| NtApphelpCacheControl | 0x08 | 0x4C | 0x49 | 0x49 |
| NtCreateProcessEx | 0x24 | 0x4D | 0x4A | 0x4A |
| NtCreateThread | 0x20 | 0x4E | 0x4B | 0x4B |
| NtIsProcessInJob | 0x08 | 0x4F | 0x4C | 0x4C |
| NtProtectVirtualMemory | 0x14 | 0x50 | 0x4D | 0x4D |
| NtQuerySection | 0x14 | 0x51 | 0x4E | 0x4E |
| NtResumeThread | 0x08 | 0x52 | 0x4F | 0x4F |
| NtTerminateThread | 0x08 | 0x53 | 0x50 | 0x50 |
| NtReadRequestData | 0x18 | 0x54 | 0x51 | 0x51 |
| NtCreateFile | 0x2C | 0x55 | 0x52 | 0x52 |
| NtQueryEvent | 0x14 | 0x56 | 0x53 | 0x53 |
| NtWriteRequestData | 0x18 | 0x57 | 0x54 | 0x54 |
| NtOpenDirectoryObject | 0x0C | 0x58 | 0x55 | 0x55 |
| NtAccessCheckByTypeAndAuditAlarm | 0x40 | 0x59 | 0x56 | 0x56 |
| NtQuerySystemTime | 0x04 | 0x5A | ILINE | ILINE |
| NtWaitForMultipleObjects | 0x14 | 0x5B | 0x57 | 0x57 |
| NtSetInformationObject | 0x10 | 0x5C | 0x58 | 0x58 |
| NtCancelIoFile | 0x08 | 0x5D | 0x59 | 0x59 |
| NtTraceEvent | 0x10 | 0x5E | 0x5B | 0x5B |
| NtPowerInformation | 0x14 | 0x5F | 0x5C | 0x5C |
| NtSetValueKey | 0x18 | 0x60 | 0x5D | 0x5D |
| NtCancelTimer | 0x08 | 0x61 | 0x5E | 0x5E |
| NtSetTimer | 0x1C | 0x62 | 0x5F | 0x5F |
| NtAcceptConnectPort | see2 | 2 | 0x60 | 0x60 |
| NtAccessCheck | see0 | 0 | 0x61 | 0x61 |
| NtAccessCheckByType | 0x2C | 0x63 | 0x62 | 0x62 |
| NtAccessCheckByTypeResultList | 0x2C | 0x64 | 0x63 | 0x63 |
| NtAccessCheckByTypeResultListAndAuditAlarm | 0x40 | 0x65 | 0x64 | 0x64 |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle | 0x44 | 0x66 | 0x65 | 0x65 |
| NtAcquireCrossVmMutant | 0x08 | 0x67 | - | - |
| NtAcquireProcessActivityReference | 0x0C | 0x68 | - | - |
| NtAddAtomEx | 0x10 | 0x69 | - | - |
| NtAddBootEntry | 0x08 | 0x6A | 0x66 | 0x66 |
| NtAddDriverEntry | 0x08 | 0x6B | 0x67 | 0x67 |
| NtAdjustGroupsToken | 0x18 | 0x6C | 0x68 | 0x68 |
| NtAdjustTokenClaimsAndDeviceGroups | 0x40 | 0x6D | - | - |
| NtAlertResumeThread | 0x08 | 0x6E | 0x69 | 0x69 |
| NtAlertThread | 0x04 | 0x6F | 0x6A | 0x6A |
| NtAlertThreadByThreadId | 0x04 | 0x70 | - | - |
| NtAllocateLocallyUniqueId | 0x04 | 0x71 | 0x6B | 0x6B |
| NtAllocateReserveObject | 0x0C | 0x72 | 0x6C | - |
| NtAllocateUserPhysicalPages | 0x0C | 0x73 | 0x6D | 0x6C |
| NtAllocateUserPhysicalPagesEx | 0x14 | 0x74 | - | - |
| NtAllocateUuids | 0x10 | 0x75 | 0x6E | 0x6D |
| NtAllocateVirtualMemoryEx | 0x1C | 0x76 | - | - |
| NtAlpcAcceptConnectPort | 0x24 | 0x77 | 0x6F | - |
| NtAlpcCancelMessage | 0x0C | 0x78 | 0x70 | - |
| NtAlpcConnectPort | 0x2C | 0x79 | 0x71 | - |
| NtAlpcConnectPortEx | 0x2C | 0x7A | - | - |
| NtAlpcCreatePort | 0x0C | 0x7B | 0x72 | - |
| NtAlpcCreatePortSection | 0x18 | 0x7C | 0x73 | - |
| NtAlpcCreateResourceReserve | 0x10 | 0x7D | 0x74 | - |
| NtAlpcCreateSectionView | 0x0C | 0x7E | 0x75 | - |
| NtAlpcCreateSecurityContext | 0x0C | 0x7F | 0x76 | - |
| NtAlpcDeletePortSection | 0x0C | 0x80 | 0x77 | - |
| NtAlpcDeleteResourceReserve | 0x0C | 0x81 | 0x78 | - |
| NtAlpcDeleteSectionView | 0x0C | 0x82 | 0x79 | - |
| NtAlpcDeleteSecurityContext | 0x0C | 0x83 | 0x7A | - |
| NtAlpcDisconnectPort | 0x08 | 0x84 | 0x7B | - |
| NtAlpcImpersonateClientContainerOfPort | 0x0C | 0x85 | - | - |
| NtAlpcImpersonateClientOfPort | 0x0C | 0x86 | 0x7C | - |
| NtAlpcOpenSenderProcess | 0x18 | 0x87 | 0x7D | - |
| NtAlpcOpenSenderThread | 0x18 | 0x88 | 0x7E | - |
| NtAlpcQueryInformation | 0x14 | 0x89 | 0x7F | - |
| NtAlpcQueryInformationMessage | 0x18 | 0x8A | 0x80 | - |
| NtAlpcRevokeSecurityContext | 0x0C | 0x8B | 0x81 | - |
| NtAlpcSendWaitReceivePort | 0x20 | 0x8C | 0x82 | - |
| NtAlpcSetInformation | 0x10 | 0x8D | 0x83 | - |
| NtAreMappedFilesTheSame | 0x08 | 0x8E | 0x84 | 0x6E |
| NtAssignProcessToJobObject | 0x08 | 0x8F | 0x85 | 0x6F |
| NtAssociateWaitCompletionPacket | 0x20 | 0x90 | - | - |
| NtCallEnclave | 0x10 | 0x91 | - | - |
| NtCancelIoFileEx | 0x0C | 0x92 | 0x86 | - |
| NtCancelSynchronousIoFile | 0x0C | 0x93 | 0x87 | - |
| NtCancelTimer2 | 0x08 | 0x94 | - | - |
| NtCancelWaitCompletionPacket | 0x08 | 0x95 | - | - |
| NtChangeProcessState | 0x18 | 0x96 | - | - |
| NtChangeThreadState | 0x18 | 0x97 | - | - |
| NtCommitComplete | 0x08 | 0x98 | 0x88 | - |
| NtCommitEnlistment | 0x08 | 0x99 | 0x89 | - |
| NtCommitRegistryTransaction | 0x08 | 0x9A | - | - |
| NtCommitTransaction | 0x08 | 0x9B | 0x8A | - |
| NtCancelDeviceWakeupRequest | - | - | - | 0x70 |
| NtCompactKeys | 0x08 | 0x9C | 0x8B | 0x71 |
| NtCompareObjects | 0x08 | 0x9D | - | - |
| NtCompareSigningLevels | 0x08 | 0x9E | - | - |
| NtCompareTokens | 0x0C | 0x9F | 0x8C | 0x72 |
| NtCompleteConnectPort | 0x04 | 0xA0 | 0x8D | 0x73 |
| NtCompressKey | 0x04 | 0xA1 | 0x8E | 0x74 |
| NtConnectPort | 0x20 | 0xA2 | 0x8F | 0x75 |
| NtContinueEx | 0x08 | 0xA3 | - | - |
| NtConvertBetweenAuxiliaryCounterAndPerformanceCounter | 0x10 | 0xA4 | - | - |
| NtCopyFileChunk | 0x28 | 0xA5 | - | - |
| NtCreateCpuPartition | 0x0C | 0xA6 | - | - |
| NtCreateCrossVmEvent | 0x18 | 0xA7 | - | - |
| NtCreateCrossVmMutant | 0x18 | 0xA8 | - | - |
| NtCreateDebugObject | 0x10 | 0xA9 | 0x90 | 0x76 |
| NtCreateDirectoryObject | 0x0C | 0xAA | 0x91 | 0x77 |
| NtCreateDirectoryObjectEx | 0x14 | 0xAB | - | - |
| NtCreateEnclave | 0x24 | 0xAC | - | - |
| NtCreateEnlistment | 0x20 | 0xAD | 0x92 | - |
| NtCreateEventPair | 0x0C | 0xAE | 0x93 | 0x78 |
| NtCreateIRTimer | 0x0C | 0xAF | - | - |
| NtCreateIoCompletion | 0x10 | 0xB0 | 0x94 | 0x79 |
| NtCreateIoRing | 0x14 | 0xB1 | - | - |
| NtCreateJobObject | 0x0C | 0xB2 | 0x95 | 0x7A |
| NtCreateJobSet | 0x0C | 0xB3 | 0x96 | - |
| NtCreateKeyTransacted | 0x20 | 0xB4 | 0x97 | 0x7B |
| NtCreateKeyedEvent | 0x10 | 0xB5 | 0x98 | 0x7C |
| NtCreateLowBoxToken | 0x24 | 0xB6 | - | - |
| NtCreateMailslotFile | 0x20 | 0xB7 | 0x99 | 0x7D |
| NtCreateMutant | 0x10 | 0xB8 | 0x9A | 0x7E |
| NtCreateNamedPipeFile | 0x38 | 0xB9 | 0x9B | 0x7F |
| NtCreatePagingFile | 0x10 | 0xBA | 0x9C | 0x80 |
| NtCreatePartition | 0x10 | 0xBB | - | - |
| NtCreatePort | 0x14 | 0xBC | 0x9D | 0x81 |
| NtCreatePrivateNamespace | 0x10 | 0xBD | 0x9E | - |
| NtCreateProcess | 0x20 | 0xBE | 0x9F | 0x82 |
| NtCreateProcessStateChange | 0x14 | 0xBF | - | - |
| NtCreateProfile | 0x24 | 0xC0 | 0xA0 | 0x83 |
| NtCreateProfileEx | 0x28 | 0xC1 | 0xA1 | 0x84 |
| NtCreateRegistryTransaction | 0x10 | 0xC2 | - | - |
| NtCreateResourceManager | 0x1C | 0xC3 | 0xA2 | - |
| NtCreateSectionEx | 0x24 | 0xC4 | - | - |
| NtCreateSemaphore | 0x14 | 0xC5 | 0xA3 | - |
| NtCreateSymbolicLinkObject | 0x10 | 0xC6 | 0xA4 | 0x85 |
| NtCreateThreadEx | 0x2C | 0xC7 | 0xA5 | |
| NtCreateThreadStateChange | 0x14 | 0xC8 | - | |
| NtCreateTimer | 0x10 | 0xC9 | 0xA6 | 0x86 |
| NtCreateTimer2 | 0x14 | 0xCA | - | - |
| NtCreateToken | 0x34 | 0xCB | 0xA7 | 0x87 |
| NtCreateTokenEx | 0x44 | 0xCC | - | - |
| NtCreateTransaction | 0x28 | 0xCD | 0xA8 | - |
| NtCreateTransactionManager | 0x18 | 0xCE | 0xA9 | - |
| NtCreateUserProcess | 0x2C | 0xCF | 0xAA | - |
| NtCreateWaitCompletionPacket | 0x0C | 0xD0 | - | - |
| NtCreateWaitablePort | 0x14 | 0xD1 | 0xAB | 0x88 |
| NtCreateWnfStateName | 0x1C | 0xD2 | - | - |
| NtCreateWorkerFactory | 0x28 | 0xD3 | 0xAC | - |
| NtDebugActiveProcess | 0x08 | 0xD4 | 0xAD | 0x89 |
| NtDebugContinue | 0x0C | 0xD5 | 0xAE | 0x8A |
| NtDeleteAtom | 0x04 | 0xD6 | 0xAF | 0x8B |
| NtDeleteBootEntry | 0x04 | 0xD7 | 0xB0 | 0x8C |
| NtDeleteDriverEntry | 0x04 | 0xD8 | 0xB1 | 0x8D |
| NtDeleteFile | 0x04 | 0xD9 | 0xB2 | 0x8E |
| NtDeleteKey | 0x04 | 0xDA | 0xB3 | 0x8F |
| NtDeleteObjectAuditAlarm | 0x0C | 0xDB | 0xB4 | 0x90 |
| NtDeletePrivateNamespace | 0x04 | 0xDC | 0xB5 | - |
| NtDeleteValueKey | 0x08 | 0xDD | 0xB6 | 0x91 |
| NtDeleteWnfStateData | 0x08 | 0xDE | 0xB7 | - |
| NtDeleteWnfStateName | 0x04 | 0xDF | - | - |
| NtDirectGraphicsCall | 0x14 | 0xE0 | - | - |
| NtDisableLastKnownGood | 0x00 | 0xE1 | - | - |
| NtDisplayString | 0x04 | 0xE2 | 0xB8 | 0x92 |
| NtDrawText | 0x04 | 0xE3 | 0xB9 | - |
| NtEnableLastKnownGood | 0x00 | 0xE4 | 0xBA | - |
| NtEnumerateBootEntries | 0x08 | 0xE5 | 0xBB | 0x93 |
| NtEnumerateDriverEntries | 0x08 | 0xE6 | 0xBC | 0x94 |
| NtEnumerateSystemEnvironmentValuesEx | 0x0C | 0xE7 | 0xBD | 0x95 |
| NtEnumerateTransactionObject | 0x14 | 0xE8 | 0xBE | - |
| NtExtendSection | 0x08 | 0xE9 | 0xBF | 0x96 |
| NtFilterBootOption | 0x14 | 0xEA | - | - |
| NtFilterToken | 0x18 | 0xEB | 0xC0 | 0x97 |
| NtFilterTokenEx | 0x38 | 0xEC | - | - |
| NtFlushBuffersFileEx | 0x14 | 0xED | - | - |
| NtFlushInstallUILanguage | 0x08 | 0xEE | 0xC1 | - |
| NtFlushInstructionCache | 0x0C | 0xEF | 0xC2 | 0x98 |
| NtFlushKey | 0x04 | 0xF0 | 0xC3 | 0x99 |
| NtFlushProcessWriteBuffers | 0x00 | 0xF1 | 0xC4 | - |
| NtFlushVirtualMemory | 0x10 | 0xF2 | 0xC5 | 0x99 |
| NtFlushWriteBuffer | 0x00 | 0xF3 | 0xC6 | 0x9A |
| NtFreeUserPhysicalPages | 0x0C | 0xF4 | 0xC7 | 0x9B |
| NtFreezeRegistry | 0x04 | 0xF5 | 0xC8 | 0x9C |
| NtFreezeTransactions | 0x08 | 0xF6 | 0xC9 | - |
| NtGetCachedSigningLevel | 0x18 | 0xF7 | - | - |
| NtGetCompleteWnfStateSubscription | 0x18 | 0xF8 | - | - |
| NtGetContextThread | 0x08 | 0xF9 | 0xCA | 0x9D |
| NtGetCurrentProcessorNumber | 0x00 | 0xFA | 0xCB | 0x9E |
| NtGetCurrentProcessorNumberEx | 0x04 | 0xFB | - | - |
| NtGetDevicePowerState | 0x08 | 0xFC | 0xCC | 0x9F |
| NtGetMUIRegistryInfo | 0x0C | 0xFD | 0xCD | - |
| NtGetNextProcess | 0x14 | 0xFE | 0xCE | - |
| NtGetNextThread | 0x18 | 0xFF | 0xCF | - |
| NtGetNlsSectionPtr | 0x14 | 0x100 | 0xD0 | - |
| NtGetNotificationResourceManager | 0x1C | 0x101 | 0xD1 | - |
| NtGetPlugPlayEvent | - | - | 0xD2 | 0xA0 |
| NtGetWriteWatch | 0x1C | 0x102 | 0xD3 | 0xA1 |
| NtImpersonateAnonymousToken | 0x04 | 0x103 | 0xD4 | 0xA2 |
| NtImpersonateThread | 0x0C | 0x104 | 0xD5 | 0xA3 |
| NtInitializeEnclave | 0x14 | 0x105 | - | - |
| NtInitializeNlsFiles | 0x0C | 0x106 | 0xD6 | - |
| NtInitializeRegistry | 0x04 | 0x107 | 0xD7 | 0xA4 |
| NtInitiatePowerAction | 0x10 | 0x108 | 0xD8 | 0xA5 |
| NtIsSystemResumeAutomatic | 0x00 | 0x109 | 0xD9 | 0xA6 |
| NtIsUILanguageComitted | 0x00 | 0x10A | 0xDA | - |
| NtListenPort | 0x08 | 0x10B | 0xDB | 0xA7 |
| NtLoadDriver | 0x04 | 0x10C | 0xDC | 0xA8 |
| NtLoadEnclaveData | 0x24 | 0x10D | - | - |
| NtLoadKey | 0x08 | 0x10E | 0xDD | 0xA9 |
| NtLoadKey2 | 0x0C | 0x10F | 0xDE | 0xAA |
| NtLoadKey3 | 0x20 | 0x110 | - | - |
| NtLoadKeyEx | 0x20 | 0x111 | 0xDF | 0xAB |
| NtLockFile | 0x28 | 0x112 | 0xE0 | 0xAC |
| NtLockProductActivationKeys | 0x08 | 0x113 | 0xE1 | 0xAD |
| NtLockRegistryKey | 0x04 | 0x114 | 0xE2 | 0xAE |
| NtLockVirtualMemory | 0x10 | 0x115 | 0xE3 | 0xAF |
| NtMakePermanentObject | 0x04 | 0x116 | 0xE4 | 0xB0 |
| NtMakeTemporaryObject | 0x04 | 0x117 | 0xE5 | 0xB1 |
| NtManageHotPatch | 0x10 | 0x118 | - | - |
| NtManagePartition | 0x14 | 0x119 | - | - |
| NtMapCMFModule | 0x18 | 0x11A | 0xE6 | - |
| NtMapUserPhysicalPages | 0x0C | 0x11B | 0xE7 | 0xB2 |
| NtMapViewOfSectionEx | 0x24 | 0x11C | - | - |
| NtModifyBootEntry | 0x04 | 0x11D | 0xE8 | 0xB3 |
| NtModifyDriverEntry | 0x04 | 0x11E | 0xE9 | 0xB4 |
| NtNotifyChangeDirectoryFile | 0x24 | 0x11F | 0xEA | 0xB5 |
| NtNotifyChangeDirectoryFileEx | 0x28 | 0x120 | - | 0xB6 |
| NtNotifyChangeKey | 0x28 | 0x121 | 0xEB | 0xB7 |
| NtNotifyChangeMultipleKeys | 0x30 | 0x122 | 0xEC | - |
| NtNotifyChangeSession | 0x20 | 0x123 | 0xED | - |
| NtOpenCpuPartition | 0x0C | 0x124 | - | - |
| NtOpenEnlistment | 0x14 | 0x125 | 0xEE | - |
| NtOpenEventPair | 0x0C | 0x126 | 0xEF | 0xB8 |
| NtOpenIoCompletion | 0x0C | 0x127 | 0xF0 | 0xB9 |
| NtOpenJobObject | 0x0C | 0x128 | 0xF1 | 0xBA |
| NtOpenKeyEx | 0x10 | 0x129 | 0xF2 | - |
| NtOpenKeyTransacted | 0x10 | 0x12A | 0xF3 | - |
| NtOpenKeyTransactedEx | 0x14 | 0x12B | 0xF4 | - |
| NtOpenKeyedEvent | 0x0C | 0x12C | 0xF5 | 0xBB |
| NtOpenMutant | 0x0C | 0x12D | 0xF6 | 0xBC |
| NtOpenObjectAuditAlarm | 0x30 | 0x12E | 0xF7 | 0xBD |
| NtOpenPartition | 0x0C | 0x12F | 0xF8 | - |
| NtOpenPrivateNamespace | 0x10 | 0x130 | 0xF9 | - |
| NtOpenProcessToken | 0x0C | 0x131 | - | 0xBE |
| NtOpenRegistryTransaction | 0x0C | 0x132 | - | - |
| NtOpenResourceManager | 0x14 | 0x133 | 0xFA | - |
| NtOpenSemaphore | 0x0C | 0x134 | 0xFB | 0xBF |
| NtOpenSession | 0x0C | 0x135 | 0xFC | - |
| NtOpenSymbolicLinkObject | 0x0C | 0x136 | 0xFD | 0xC0 |
| NtOpenThread | 0x10 | 0x137 | 0xFE | 0xC1 |
| NtOpenTimer | 0x0C | 0x138 | 0xFF | 0xC2 |
| NtOpenTransaction | 0x14 | 0x139 | 0x100 | - |
| NtOpenTransactionManager | 0x18 | 0x13A | 0x101 | - |
| NtPlugPlayControl | 0x0C | 0x13B | 0x102 | 0xC3 |
| NtPrePrepareComplete | 0x08 | 0x13C | 0x103 | - |
| NtPrePrepareEnlistment | 0x08 | 0x13D | 0x104 | - |
| NtPrepareComplete | 0x08 | 0x13E | 0x105 | - |
| NtPrepareEnlistment | 0x08 | 0x13F | 0x106 | - |
| NtPrivilegeCheck | 0x0C | 0x140 | 0x107 | 0xC4 |
| NtPrivilegeObjectAuditAlarm | 0x18 | 0x141 | 0x108 | 0xC5 |
| NtPrivilegedServiceAuditAlarm | 0x14 | 0x142 | 0x109 | 0xC6 |
| NtPropagationComplete | 0x10 | 0x143 | 0x10A | - |
| NtPropagationFailed | 0x0C | 0x144 | 0x10B | - |
| NtPssCaptureVaSpaceBulk | 0x14 | 0x145 | - | - |
| NtPulseEvent | 0x08 | 0x146 | 0x10C | 0xC7 |
| NtQueryAuxiliaryCounterFrequency | 0x04 | 0x147 | - | - |
| NtQueryBootEntryOrder | 0x08 | 0x148 | 0x10D | 0xC8 |
| NtQueryBootOptions | 0x08 | 0x149 | 0x10E | 0xC9 |
| NtQueryDebugFilterState | 0x08 | 0x14A | 0x10F | 0xCA |
| NtQueryDirectoryFileEx | 0x28 | 0x14B | - | - |
| NtQueryDirectoryObject | 0x1C | 0x14C | 0x110 | 0xCB |
| NtQueryDriverEntryOrder | 0x08 | 0x14D | 0x111 | 0xCC |
| NtQueryEaFile | 0x24 | 0x14E | 0x112 | 0xCD |
| NtQueryFullAttributesFile | 0x08 | 0x14F | 0x113 | 0xCE |
| NtQueryInformationAtom | 0x14 | 0x150 | 0x114 | 0xCF |
| NtQueryInformationByName | 0x14 | 0x151 | - | 0xD0 |
| NtQueryInformationCpuPartition | 0x14 | 0x152 | - | - |
| NtQueryInformationEnlistment | 0x14 | 0x153 | 0x115 | - |
| NtQueryInformationJobObject | 0x14 | 0x154 | 0x116 | - |
| NtQueryInformationPort | 0x14 | 0x155 | 0x117 | 0xD1 |
| NtQueryInformationResourceManager | 0x14 | 0x156 | 0x118 | - |
| NtQueryInformationTransaction | 0x14 | 0x157 | 0x119 | - |
| NtQueryInformationTransactionManager | 0x14 | 0x158 | 0x11A | - |
| NtQueryInformationWorkerFactory | 0x14 | 0x159 | 0x11B | - |
| NtQueryInstallUILanguage | 0x04 | 0x15A | 0x11C | 0xD2 |
| NtQueryIntervalProfile | 0x08 | 0x15B | 0x11D | 0xD3 |
| NtQueryIoCompletion | 0x14 | 0x15C | 0x11E | 0xD4 |
| NtQueryIoRingCapabilities | 0x08 | 0x15D | - | - |
| NtQueryLicenseValue | 0x14 | 0x15E | 0x11F | - |
| NtQueryMultipleValueKey | 0x18 | 0x15F | 0x120 | 0xD5 |
| NtQueryMutant | 0x14 | 0x160 | 0x121 | 0xD6 |
| NtQueryOpenSubKeys | 0x08 | 0x161 | 0x122 | 0xD7 |
| NtQueryOpenSubKeysEx | 0x10 | 0x162 | 0x123 | 0xD8 |
| NtQueryPortInformationProcess | 0x00 | 0x163 | 0x124 | 0xD9 |
| NtQueryQuotaInformationFile | 0x24 | 0x164 | 0x125 | 0xDA |
| NtQuerySecurityAttributesToken | 0x18 | 0x165 | 0x126 | - |
| NtQuerySecurityObject | 0x14 | 0x166 | 0x127 | 0xDB |
| NtQuerySecurityPolicy | 0x18 | 0x167 | - | - |
| NtQuerySemaphore | 0x14 | 0x168 | 0x128 | 0xDC |
| NtQuerySymbolicLinkObject | 0x0C | 0x169 | 0x129 | 0xDD |
| NtQuerySystemEnvironmentValue | 0x10 | 0x16A | 0x12A | 0xDE |
| NtQuerySystemEnvironmentValueEx | 0x14 | 0x16B | 0x12B | 0xDF |
| NtQuerySystemInformationEx | 0x18 | 0x16C | 0x12C | - |
| NtQueryTimerResolution | 0x0C | 0x16D | 0x12D | 0xE0 |
| NtQueryWnfStateData | 0x18 | 0x16E | - | - |
| NtQueryWnfStateNameInformation | 0x14 | 0x16F | - | - |
| NtQueueApcThreadEx | 0x18 | 0x170 | 0x12E | - |
| NtQueueApcThreadEx2 | 0x1C | 0x171 | - | - |
| NtRaiseException | 0x0C | 0x172 | 0x12F | 0xE1 |
| NtRaiseHardError | 0x18 | 0x173 | 0x130 | 0xE2 |
| NtReadOnlyEnlistment | 0x08 | 0x174 | 0x131 | - |
| NtReadVirtualMemoryEx | 0x18 | 0x175 | - | - |
| NtRecoverEnlistment | 0x08 | 0x176 | 0x132 | - |
| NtRecoverResourceManager | 0x04 | 0x177 | 0x133 | - |
| NtRecoverTransactionManager | 0x04 | 0x178 | 0x134 | - |
| NtRegisterProtocolAddressInformation | 0x14 | 0x179 | 0x135 | - |
| NtRegisterThreadTerminatePort | 0x04 | 0x17A | 0x136 | 0xE3 |
| NtReleaseKeyedEvent | 0x10 | 0x17B | 0x137 | 0xE4 |
| NtReleaseWorkerFactoryWorker | 0x04 | 0x17C | 0x138 | - |
| NtRemoveIoCompletionEx | 0x18 | 0x17D | 0x139 | - |
| NtRemoveProcessDebug | 0x08 | 0x17E | 0x13A | 0xE5 |
| NtRenameKey | 0x08 | 0x17F | 0x13B | 0xE6 |
| NtRenameTransactionManager | 0x08 | 0x180 | 0x13C | - |
| NtReplaceKey | 0x0C | 0x181 | 0x13D | 0xE7 |
| NtReplacePartitionUnit | 0x0C | 0x182 | 0x13E | - |
| NtReplyWaitReplyPort | 0x08 | 0x183 | 0x13F | 0xE8 |
| NtRequestDeviceWakeup | - | - | - | 0xE9 |
| NtRequestPort | 0x08 | 0x184 | 0x140 | 0xEA |
| NtRequestWakeupLatency | - | - | - | 0xEB |
| NtResetEvent | 0x08 | 0x185 | 0x141 | 0xEC |
| NtResetWriteWatch | 0x0C | 0x186 | 0x142 | 0xED |
| NtRestoreKey | 0x0C | 0x187 | 0x143 | 0xEE |
| NtResumeProcess | 0x04 | 0x188 | 0x144 | 0xEF |
| NtRevertContainerImpersonation | 0x00 | 0x189 | - | - |
| NtRollbackComplete | 0x08 | 0x18A | 0x145 | - |
| NtRollbackEnlistment | 0x08 | 0x18B | 0x146 | - |
| NtRollbackRegistryTransaction | 0x08 | 0x18C | - | - |
| NtRollbackTransaction | 0x08 | 0x18D | 0x147 | - |
| NtRollforwardTransactionManager | 0x08 | 0x18E | 0x148 | - |
| NtSaveKey | 0x08 | 0x18F | 0x149 | 0xF0 |
| NtSaveKeyEx | 0x0C | 0x190 | 0x14A | 0xF1 |
| NtSaveMergedKeys | 0x0C | 0x191 | 0x14B | 0xF2 |
| NtSecureConnectPort | 0x24 | 0x192 | 0x14C | 0xF3 |
| NtSerializeBoot | 0x00 | 0x193 | 0x14D | - |
| NtSetBootEntryOrder | 0x08 | 0x194 | 0x14E | 0xF4 |
| NtSetBootOptions | 0x08 | 0x195 | 0x14F | 0xF5 |
| NtSetCachedSigningLevel | 0x14 | 0x196 | - | - |
| NtSetCachedSigningLevel2 | 0x18 | 0x197 | - | - |
| NtSetContextThread | 0x08 | 0x198 | 0x150 | 0xF6 |
| NtSetDebugFilterState | 0x0C | 0x199 | 0x151 | 0xF7 |
| NtSetDefaultHardErrorPort | 0x04 | 0x19A | 0x152 | 0xF8 |
| NtSetDefaultLocale | 0x08 | 0x19B | 0x153 | 0xF9 |
| NtSetDefaultUILanguage | 0x04 | 0x19C | 0x154 | 0xFA |
| NtSetDriverEntryOrder | 0x08 | 0x19D | 0x155 | 0xFB |
| NtSetEaFile | 0x10 | 0x19E | 0x156 | 0xFC |
| NtSetHighEventPair | 0x04 | 0x19F | 0x157 | 0xFD |
| NtSetHighWaitLowEventPair | 0x04 | 0x1A0 | 0x158 | 0xFE |
| NtSetIRTimer | 0x08 | 0x1A1 | - | - |
| NtSetInformationCpuPartition | 0x1C | 0x1A2 | - | - |
| NtSetInformationDebugObject | 0x14 | 0x1A3 | 0x159 | 0xFF |
| NtSetInformationEnlistment | 0x10 | 0x1A4 | 0x15A | 0x100 |
| NtSetInformationIoRing | 0x10 | 0x1A5 | 0x15B | 0x101 |
| NtSetInformationJobObject | 0x10 | 0x1A6 | 0x15C | 0x102 |
| NtSetInformationKey | 0x10 | 0x1A7 | 0x15D | - |
| NtSetInformationResourceManager | 0x10 | 0x1A8 | - | - |
| NtSetInformationSymbolicLink | 0x10 | 0x1A9 | - | - |
| NtSetInformationToken | 0x10 | 0x1AA | 0x15E | - |
| NtSetInformationTransaction | 0x10 | 0x1AB | 0x15F | - |
| NtSetInformationTransactionManager | 0x10 | 0x1AC | 0x160 | - |
| NtSetInformationVirtualMemory | 0x18 | 0x1AD | - | - |
| NtSetInformationWorkerFactory | 0x10 | 0x1AE | 0x161 | - |
| NtSetIntervalProfile | 0x08 | 0x1AF | 0x162 | 0x103 |
| NtSetIoCompletion | 0x14 | 0x1B0 | 0x163 | 0x104 |
| NtSetIoCompletionEx | 0x18 | 0x1B1 | 0x164 | - |
| NtSetLdtEntries | 0x18 | 0x1B2 | 0x165 | 0x105 |
| NtSetLowEventPair | 0x04 | 0x1B3 | 0x166 | 0x106 |
| NtSetLowWaitHighEventPair | 0x04 | 0x1B4 | 0x167 | 0x107 |
| NtSetQuotaInformationFile | 0x10 | 0x1B5 | 0x168 | 0x108 |
| NtSetSecurityObject | 0x0C | 0x1B6 | 0x169 | 0x109 |
| NtSetSystemEnvironmentValue | 0x08 | 0x1B7 | 0x16A | 0x10A |
| NtSetSystemEnvironmentValueEx | 0x14 | 0x1B8 | 0x16B | 0x10B |
| NtSetSystemInformation | 0x0C | 0x1B9 | 0x16C | 0x10C |
| NtSetSystemPowerState | 0x0C | 0x1BA | 0x16D | 0x10D |
| NtSetSystemTime | 0x08 | 0x1BB | 0x16E | 0x10E |
| NtSetThreadExecutionState | 0x08 | 0x1BC | 0x16F | 0x10F |
| NtSetTimer2 | 0x10 | 0x1BD | - | - |
| NtSetTimerEx | 0x10 | 0x1BE | 0x170 | - |
| NtSetTimerResolution | 0x0C | 0x1BF | 0x171 | 0x110 |
| NtSetUuidSeed | 0x04 | 0x1C0 | 0x172 | 0x111 |
| NtSetVolumeInformationFile | 0x14 | 0x1C1 | 0x173 | 0x112 |
| NtSetWnfProcessNotificationEvent | 0x04 | 0x1C2 | - | 0x113 |
| NtShutdownSystem | 0x04 | 0x1C3 | 0x174 | - |
| NtShutdownWorkerFactory | 0x08 | 0x1C4 | 0x175 | - |
| NtSinglePhaseReject | 0x10 | 0x1C6 | 0x177 | - |
| NtStartProfile | 0x08 | 0x1C7 | 0x178 | - |
| NtSignalAndWaitForSingleObject | 0x04 | 0x1C5 | 0x176 | 0x114 |
| NtStartProfile | - | - | - | 0x115 |
| NtStopProfile | 0x04 | 0x1C8 | 0x179 | 0x116 |
| NtSubmitIoRing | 0x10 | 0x1C9 | - | - |
| NtSubscribeWnfStateChange | 0x10 | 0x1CA | - | - |
| NtSuspendProcess | 0x04 | 0x1CB | 0x17A | 0x117 |
| NtSuspendThread | 0x08 | 0x1CC | 0x17B | 0x118 |
| NtSystemDebugControl | 0x18 | 0x1CD | 0x17C | 0x119 |
| NtTerminateEnclave | 0x08 | 0x1CE | - | - |
| NtTerminateJobObject | 0x08 | 0x1CF | 0x17D | 0x11A |
| NtTestAlert | 0x00 | 0x1D0 | 0x17E | 0x11B |
| NtThawRegistry | 0x00 | 0x1D1 | 0x17F | - |
| NtThawTransactions | 0x00 | 0x1D2 | 0x180 | - |
| NtTraceControl | 0x18 | 0x1D3 | 0x181 | - |
| NtTranslateFilePath | 0x10 | 0x1D4 | 0x182 | 0x11C |
| NtUmsThreadYield | 0x04 | 0x1D5 | 0x183 | - |
| NtUnloadDriver | 0x04 | 0x1D6 | 0x184 | 0x11D |
| NtUnloadKey | 0x04 | 0x1D7 | 0x185 | 0x11E |
| NtUnloadKey2 | 0x08 | 0x1D8 | 0x186 | 0x11F |
| NtUnloadKeyEx | 0x08 | 0x1D9 | 0x187 | 0x120 |
| NtUnlockFile | 0x14 | 0x1DA | 0x188 | 0x121 |
| NtUnlockVirtualMemory | 0x10 | 0x1DB | 0x189 | 0x122 |
| NtUnmapViewOfSectionEx | 0x0C | 0x1DC | - | - |
| NtUnsubscribeWnfStateChange | 0x04 | 0x1DD | - | - |
| NtUpdateWnfStateData | 0x1C | 0x1DE | - | - |
| NtVdmControl | 0x08 | 0x1DF | 0x18A | 0x123 |
| NtWaitForAlertByThreadId | 0x08 | 0x1E0 | - | - |
| NtWaitForDebugEvent | 0x10 | 0x1E1 | 0x18B | 0x124 |
| NtWaitForKeyedEvent | 0x10 | 0x1E2 | 0x18C | 0x125 |
| NtWaitForWorkViaWorkerFactory | 0x14 | 0x1E3 | 0x18D | - |
| NtWaitHighEventPair | 0x04 | 0x1E4 | 0x18E | 0x126 |
| NtWaitLowEventPair | 0x04 | 0x1E5 | 0x18F | 0x127 |
| ------------------------------------------------------- | ------- | ------- | ------- | ------- |
| NtWow64CsrClientConnectToServer | 0x14 | 0x1E6 | - | - |
| NtWow64CsrIdentifyAlertableThread | 0x00 | 0x1E7 | - | - |
| NtWow64CsrClientCallServer | 0x10 | 0x1E8 | - | - |
| NtWow64CsrAllocateCaptureBuffer | 0x08 | 0x1E9 | - | - |
| NtWow64CsrFreeCaptureBuffer | 0x04 | 0x1EA | - | - |
| NtWow64CsrAllocateMessagePointer | 0x0C | 0x1EB | - | - |
| NtWow64CsrCaptureMessageBuffer | 0x10 | 0x1EC | - | - |
| NtWow64CsrCaptureMessageString | 0x14 | 0x1ED | - | - |
| NtWow64CsrGetProcessId | 0x00 | 0x1EE | - | - |
| NtWow64CsrVerifyRegion | 0008 | 0x1EF | - | - |
| NtWow64DebuggerCall | 0014 | 0x1F0 | - | - |
| NtWow64GetCurrentProcessorNumberEx | 0004 | 0x1F1 | - | - |
| NtWow64GetNativeSystemInformation | 0010 | 0x1F2 | - | - |
| NtWow64QueryInformationProcess64 | 0014 | 0x1F3 | - | - |
| NtWow64AllocateVirtualMemory64 | 001C | 0x1F4 | - | - |
| NtWow64ReadVirtualMemory64 | 001C | 0x1F5 | - | - |
| NtWow64WriteVirtualMemory64 | 001C | 0x1F6 | - | - |
| NtWow64CallFunction64 | 001C | 0x1F7 | - | - |
| NtWow64IsProcessorFeaturePresent | 0004 | 0x1F8 | - | - |
