加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
克隆/下载
ssdt_amd64.c 199.27 KB
一键复制 编辑 原始数据 按行查看 历史
TinySec 提交于 2018-06-08 14:37 . add windows 10 rs4 17134 support
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138413941404141414241434144414541464147414841494150415141524153415441554156415741584159416041614162416341644165416641674168416941704171417241734174417541764177417841794180418141824183418441854186418741884189419041914192419341944195419641974198419942004201420242034204420542064207420842094210421142124213421442154216421742184219422042214222422342244225422642274228422942304231423242334234423542364237423842394240424142424243424442454246424742484249425042514252425342544255425642574258425942604261426242634264426542664267426842694270427142724273427442754276427742784279428042814282428342844285428642874288428942904291429242934294429542964297429842994300430143024303430443054306430743084309431043114312431343144315431643174318431943204321432243234324432543264327432843294330433143324333433443354336433743384339434043414342434343444345434643474348434943504351435243534354435543564357435843594360436143624363436443654366436743684369437043714372437343744375437643774378437943804381438243834384438543864387438843894390439143924393439443954396439743984399440044014402440344044405440644074408440944104411441244134414441544164417441844194420442144224423442444254426442744284429443044314432443344344435443644374438443944404441444244434444444544464447444844494450445144524453445444554456445744584459446044614462446344644465446644674468446944704471447244734474447544764477447844794480448144824483448444854486448744884489449044914492449344944495449644974498449945004501450245034504450545064507450845094510451145124513451445154516451745184519452045214522452345244525452645274528452945304531453245334534453545364537453845394540454145424543454445454546454745484549455045514552455345544555455645574558455945604561456245634564456545664567456845694570457145724573457445754576457745784579458045814582458345844585458645874588458945904591459245934594459545964597459845994600460146024603460446054606460746084609461046114612461346144615461646174618461946204621462246234624462546264627462846294630463146324633463446354636463746384639464046414642464346444645464646474648464946504651465246534654465546564657465846594660466146624663466446654666466746684669467046714672467346744675467646774678467946804681468246834684468546864687468846894690469146924693469446954696469746984699470047014702470347044705470647074708470947104711471247134714471547164717471847194720472147224723
// ssdt table for 6.0.6000-sp0-windows-vista amd64
SDT_NODE static_ssdt_6_0_6000_sp0_windows_vista_amd64[398] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtClearAllSavepointsTransaction" , 1 } ,
/*0x08A*/ { "NtClearSavepointTransaction" , 2 } ,
/*0x08B*/ { "NtCommitComplete" , 2 } ,
/*0x08C*/ { "NtCommitEnlistment" , 2 } ,
/*0x08D*/ { "NtCommitTransaction" , 2 } ,
/*0x08E*/ { "NtCompactKeys" , 2 } ,
/*0x08F*/ { "NtCompareTokens" , 3 } ,
/*0x090*/ { "NtCompleteConnectPort" , 1 } ,
/*0x091*/ { "NtCompressKey" , 1 } ,
/*0x092*/ { "NtConnectPort" , 8 } ,
/*0x093*/ { "NtCreateDebugObject" , 4 } ,
/*0x094*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x095*/ { "NtCreateEnlistment" , 8 } ,
/*0x096*/ { "NtCreateEventPair" , 3 } ,
/*0x097*/ { "NtCreateIoCompletion" , 4 } ,
/*0x098*/ { "NtCreateJobObject" , 3 } ,
/*0x099*/ { "NtCreateJobSet" , 3 } ,
/*0x09A*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x09B*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09C*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09D*/ { "NtCreateMutant" , 4 } ,
/*0x09E*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09F*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A0*/ { "NtCreatePort" , 5 } ,
/*0x0A1*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A2*/ { "NtCreateProcess" , 8 } ,
/*0x0A3*/ { "NtCreateProfile" , 9 } ,
/*0x0A4*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A5*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A6*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A7*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A8*/ { "NtCreateTimer" , 4 } ,
/*0x0A9*/ { "NtCreateToken" , 13 } ,
/*0x0AA*/ { "NtCreateTransaction" , 10 } ,
/*0x0AB*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AC*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AD*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AE*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AF*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0B0*/ { "NtDebugContinue" , 3 } ,
/*0x0B1*/ { "NtDeleteAtom" , 1 } ,
/*0x0B2*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B3*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B4*/ { "NtDeleteFile" , 1 } ,
/*0x0B5*/ { "NtDeleteKey" , 1 } ,
/*0x0B6*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B7*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B8*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B9*/ { "NtDisplayString" , 1 } ,
/*0x0BA*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BB*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BD*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BE*/ { "NtExtendSection" , 2 } ,
/*0x0BF*/ { "NtFilterToken" , 6 } ,
/*0x0C0*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C1*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C2*/ { "NtFlushKey" , 1 } ,
/*0x0C3*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C4*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C5*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C6*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C7*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C8*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C9*/ { "NtGetContextThread" , 2 } ,
/*0x0CA*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CB*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CC*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CD*/ { "NtGetNextProcess" , 5 } ,
/*0x0CE*/ { "NtGetNextThread" , 6 } ,
/*0x0CF*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D0*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D1*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D2*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D3*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D4*/ { "NtImpersonateThread" , 3 } ,
/*0x0D5*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D6*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D7*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D8*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D9*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DA*/ { "NtListTransactions" , 3 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtMarshallTransaction" , 6 } ,
/*0x0E9*/ { "NtModifyBootEntry" , 1 } ,
/*0x0EA*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EB*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EC*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0ED*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F3*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F4*/ { "NtOpenMutant" , 3 } ,
/*0x0F5*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F6*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F7*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F8*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F9*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FA*/ { "NtOpenSession" , 3 } ,
/*0x0FB*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FC*/ { "NtOpenThread" , 4 } ,
/*0x0FD*/ { "NtOpenTimer" , 3 } ,
/*0x0FE*/ { "NtOpenTransaction" , 5 } ,
/*0x0FF*/ { "NtOpenTransactionManager" , 6 } ,
/*0x100*/ { "NtPlugPlayControl" , 3 } ,
/*0x101*/ { "NtPrePrepareComplete" , 2 } ,
/*0x102*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x103*/ { "NtPrepareComplete" , 2 } ,
/*0x104*/ { "NtPrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrivilegeCheck" , 3 } ,
/*0x106*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x107*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x108*/ { "NtPropagationComplete" , 4 } ,
/*0x109*/ { "NtPropagationFailed" , 3 } ,
/*0x10A*/ { "NtPullTransaction" , 7 } ,
/*0x10B*/ { "NtPulseEvent" , 2 } ,
/*0x10C*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10D*/ { "NtQueryBootOptions" , 2 } ,
/*0x10E*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10F*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x110*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x111*/ { "NtQueryEaFile" , 9 } ,
/*0x112*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x113*/ { "NtQueryInformationAtom" , 5 } ,
/*0x114*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x115*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x116*/ { "NtQueryInformationPort" , 5 } ,
/*0x117*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x118*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x119*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11A*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11B*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11C*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11D*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11E*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11F*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x120*/ { "NtQueryMutant" , 5 } ,
/*0x121*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x122*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x123*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x124*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x125*/ { "NtQuerySecurityObject" , 5 } ,
/*0x126*/ { "NtQuerySemaphore" , 5 } ,
/*0x127*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x128*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x129*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12A*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12B*/ { "NtRaiseException" , 3 } ,
/*0x12C*/ { "NtRaiseHardError" , 6 } ,
/*0x12D*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x12E*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12F*/ { "NtRecoverResourceManager" , 1 } ,
/*0x130*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x131*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x132*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x133*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x134*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x135*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x136*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x137*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x138*/ { "NtRenameKey" , 2 } ,
/*0x139*/ { "NtReplaceKey" , 3 } ,
/*0x13A*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x13B*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x13C*/ { "NtRequestPort" , 2 } ,
/*0x13D*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13E*/ { "NtResetEvent" , 2 } ,
/*0x13F*/ { "NtResetWriteWatch" , 3 } ,
/*0x140*/ { "NtRestoreKey" , 3 } ,
/*0x141*/ { "NtResumeProcess" , 1 } ,
/*0x142*/ { "NtRollbackComplete" , 2 } ,
/*0x143*/ { "NtRollbackEnlistment" , 2 } ,
/*0x144*/ { "NtRollbackSavepointTransaction" , 2 } ,
/*0x145*/ { "NtRollbackTransaction" , 2 } ,
/*0x146*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x147*/ { "NtSaveKey" , 2 } ,
/*0x148*/ { "NtSaveKeyEx" , 3 } ,
/*0x149*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14A*/ { "NtSavepointComplete" , 2 } ,
/*0x14B*/ { "NtSavepointTransaction" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14E*/ { "NtSetBootOptions" , 2 } ,
/*0x14F*/ { "NtSetContextThread" , 2 } ,
/*0x150*/ { "NtSetDebugFilterState" , 3 } ,
/*0x151*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x152*/ { "NtSetDefaultLocale" , 2 } ,
/*0x153*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x154*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x155*/ { "NtSetEaFile" , 4 } ,
/*0x156*/ { "NtSetHighEventPair" , 1 } ,
/*0x157*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x158*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x159*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15A*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15B*/ { "NtSetInformationKey" , 4 } ,
/*0x15C*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15D*/ { "NtSetInformationToken" , 4 } ,
/*0x15E*/ { "NtSetInformationTransaction" , 4 } ,
/*0x15F*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x160*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x161*/ { "NtSetIntervalProfile" , 2 } ,
/*0x162*/ { "NtSetIoCompletion" , 5 } ,
/*0x163*/ { "NtSetLdtEntries" , 6 } ,
/*0x164*/ { "NtSetLowEventPair" , 1 } ,
/*0x165*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x166*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x167*/ { "NtSetSecurityObject" , 3 } ,
/*0x168*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x169*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16A*/ { "NtSetSystemInformation" , 3 } ,
/*0x16B*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16C*/ { "NtSetSystemTime" , 2 } ,
/*0x16D*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x16E*/ { "NtSetTimerResolution" , 3 } ,
/*0x16F*/ { "NtSetUuidSeed" , 1 } ,
/*0x170*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x171*/ { "NtShutdownSystem" , 1 } ,
/*0x172*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x173*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x174*/ { "NtSinglePhaseReject" , 2 } ,
/*0x175*/ { "NtStartProfile" , 1 } ,
/*0x176*/ { "NtStartTm" , 0 } ,
/*0x177*/ { "NtStopProfile" , 1 } ,
/*0x178*/ { "NtSuspendProcess" , 1 } ,
/*0x179*/ { "NtSuspendThread" , 2 } ,
/*0x17A*/ { "NtSystemDebugControl" , 6 } ,
/*0x17B*/ { "NtTerminateJobObject" , 2 } ,
/*0x17C*/ { "NtTestAlert" , 0 } ,
/*0x17D*/ { "NtThawRegistry" , 0 } ,
/*0x17E*/ { "NtThawTransactions" , 0 } ,
/*0x17F*/ { "NtTraceControl" , 6 } ,
/*0x180*/ { "NtTranslateFilePath" , 4 } ,
/*0x181*/ { "NtUnloadDriver" , 1 } ,
/*0x182*/ { "NtUnloadKey" , 1 } ,
/*0x183*/ { "NtUnloadKey2" , 2 } ,
/*0x184*/ { "NtUnloadKeyEx" , 2 } ,
/*0x185*/ { "NtUnlockFile" , 5 } ,
/*0x186*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x187*/ { "NtVdmControl" , 2 } ,
/*0x188*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x189*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18A*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18B*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18C*/ { "NtWaitLowEventPair" , 1 } ,
/*0x18D*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.0.6001-sp1-windows-vista amd64
SDT_NODE static_ssdt_6_0_6001_sp1_windows_vista_amd64[391] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtCommitComplete" , 2 } ,
/*0x08A*/ { "NtCommitEnlistment" , 2 } ,
/*0x08B*/ { "NtCommitTransaction" , 2 } ,
/*0x08C*/ { "NtCompactKeys" , 2 } ,
/*0x08D*/ { "NtCompareTokens" , 3 } ,
/*0x08E*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08F*/ { "NtCompressKey" , 1 } ,
/*0x090*/ { "NtConnectPort" , 8 } ,
/*0x091*/ { "NtCreateDebugObject" , 4 } ,
/*0x092*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x093*/ { "NtCreateEnlistment" , 8 } ,
/*0x094*/ { "NtCreateEventPair" , 3 } ,
/*0x095*/ { "NtCreateIoCompletion" , 4 } ,
/*0x096*/ { "NtCreateJobObject" , 3 } ,
/*0x097*/ { "NtCreateJobSet" , 3 } ,
/*0x098*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x099*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09B*/ { "NtCreateMutant" , 4 } ,
/*0x09C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09D*/ { "NtCreatePagingFile" , 4 } ,
/*0x09E*/ { "NtCreatePort" , 5 } ,
/*0x09F*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A0*/ { "NtCreateProcess" , 8 } ,
/*0x0A1*/ { "NtCreateProfile" , 9 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisplayString" , 1 } ,
/*0x0B8*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0B9*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BA*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BB*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BC*/ { "NtExtendSection" , 2 } ,
/*0x0BD*/ { "NtFilterToken" , 6 } ,
/*0x0BE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0BF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C0*/ { "NtFlushKey" , 1 } ,
/*0x0C1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C7*/ { "NtGetContextThread" , 2 } ,
/*0x0C8*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0C9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CB*/ { "NtGetNextProcess" , 5 } ,
/*0x0CC*/ { "NtGetNextThread" , 6 } ,
/*0x0CD*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0CE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0CF*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D0*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D1*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D2*/ { "NtImpersonateThread" , 3 } ,
/*0x0D3*/ { "NtInitializeNlsFiles" , 4 } ,
/*0x0D4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0D8*/ { "NtListenPort" , 2 } ,
/*0x0D9*/ { "NtLoadDriver" , 1 } ,
/*0x0DA*/ { "NtLoadKey" , 2 } ,
/*0x0DB*/ { "NtLoadKey2" , 3 } ,
/*0x0DC*/ { "NtLoadKeyEx" , 8 } ,
/*0x0DD*/ { "NtLockFile" , 10 } ,
/*0x0DE*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0DF*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E0*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E1*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E2*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E3*/ { "NtMapCMFModule" , 6 } ,
/*0x0E4*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E6*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0E7*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0E8*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0E9*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EA*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EB*/ { "NtOpenEventPair" , 3 } ,
/*0x0EC*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0ED*/ { "NtOpenJobObject" , 3 } ,
/*0x0EE*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0EF*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F0*/ { "NtOpenMutant" , 3 } ,
/*0x0F1*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F2*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F3*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F4*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F5*/ { "NtOpenSemaphore" , 3 } ,
/*0x0F6*/ { "NtOpenSession" , 3 } ,
/*0x0F7*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0F8*/ { "NtOpenThread" , 4 } ,
/*0x0F9*/ { "NtOpenTimer" , 3 } ,
/*0x0FA*/ { "NtOpenTransaction" , 5 } ,
/*0x0FB*/ { "NtOpenTransactionManager" , 6 } ,
/*0x0FC*/ { "NtPlugPlayControl" , 3 } ,
/*0x0FD*/ { "NtPrePrepareComplete" , 2 } ,
/*0x0FE*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x0FF*/ { "NtPrepareComplete" , 2 } ,
/*0x100*/ { "NtPrepareEnlistment" , 2 } ,
/*0x101*/ { "NtPrivilegeCheck" , 3 } ,
/*0x102*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x103*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x104*/ { "NtPropagationComplete" , 4 } ,
/*0x105*/ { "NtPropagationFailed" , 3 } ,
/*0x106*/ { "NtPulseEvent" , 2 } ,
/*0x107*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x108*/ { "NtQueryBootOptions" , 2 } ,
/*0x109*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10A*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x10B*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x10C*/ { "NtQueryEaFile" , 9 } ,
/*0x10D*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x10E*/ { "NtQueryInformationAtom" , 5 } ,
/*0x10F*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x110*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x111*/ { "NtQueryInformationPort" , 5 } ,
/*0x112*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x113*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x114*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x115*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x116*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x117*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x118*/ { "NtQueryIoCompletion" , 5 } ,
/*0x119*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11A*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x11B*/ { "NtQueryMutant" , 5 } ,
/*0x11C*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x11D*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x11E*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x11F*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x120*/ { "NtQuerySecurityObject" , 5 } ,
/*0x121*/ { "NtQuerySemaphore" , 5 } ,
/*0x122*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x124*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x125*/ { "NtQueryTimerResolution" , 3 } ,
/*0x126*/ { "NtRaiseException" , 3 } ,
/*0x127*/ { "NtRaiseHardError" , 6 } ,
/*0x128*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x129*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x12B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x12C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x12D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x12E*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x12F*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x130*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x131*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x132*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x133*/ { "NtRenameKey" , 2 } ,
/*0x134*/ { "NtRenameTransactionManager" , 2 } ,
/*0x135*/ { "NtReplaceKey" , 3 } ,
/*0x136*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x137*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x138*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x139*/ { "NtRequestPort" , 2 } ,
/*0x13A*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13B*/ { "NtResetEvent" , 2 } ,
/*0x13C*/ { "NtResetWriteWatch" , 3 } ,
/*0x13D*/ { "NtRestoreKey" , 3 } ,
/*0x13E*/ { "NtResumeProcess" , 1 } ,
/*0x13F*/ { "NtRollbackComplete" , 2 } ,
/*0x140*/ { "NtRollbackEnlistment" , 2 } ,
/*0x141*/ { "NtRollbackTransaction" , 2 } ,
/*0x142*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x143*/ { "NtSaveKey" , 2 } ,
/*0x144*/ { "NtSaveKeyEx" , 3 } ,
/*0x145*/ { "NtSaveMergedKeys" , 3 } ,
/*0x146*/ { "NtSecureConnectPort" , 9 } ,
/*0x147*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x148*/ { "NtSetBootOptions" , 2 } ,
/*0x149*/ { "NtSetContextThread" , 2 } ,
/*0x14A*/ { "NtSetDebugFilterState" , 3 } ,
/*0x14B*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x14C*/ { "NtSetDefaultLocale" , 2 } ,
/*0x14D*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x14E*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetEaFile" , 4 } ,
/*0x150*/ { "NtSetHighEventPair" , 1 } ,
/*0x151*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x152*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x153*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x154*/ { "NtSetInformationJobObject" , 4 } ,
/*0x155*/ { "NtSetInformationKey" , 4 } ,
/*0x156*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x157*/ { "NtSetInformationToken" , 4 } ,
/*0x158*/ { "NtSetInformationTransaction" , 4 } ,
/*0x159*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x15A*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x15B*/ { "NtSetIntervalProfile" , 2 } ,
/*0x15C*/ { "NtSetIoCompletion" , 5 } ,
/*0x15D*/ { "NtSetLdtEntries" , 6 } ,
/*0x15E*/ { "NtSetLowEventPair" , 1 } ,
/*0x15F*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x160*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x161*/ { "NtSetSecurityObject" , 3 } ,
/*0x162*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x163*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x164*/ { "NtSetSystemInformation" , 3 } ,
/*0x165*/ { "NtSetSystemPowerState" , 3 } ,
/*0x166*/ { "NtSetSystemTime" , 2 } ,
/*0x167*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x168*/ { "NtSetTimerResolution" , 3 } ,
/*0x169*/ { "NtSetUuidSeed" , 1 } ,
/*0x16A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x16B*/ { "NtShutdownSystem" , 1 } ,
/*0x16C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x16D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x16E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x16F*/ { "NtStartProfile" , 1 } ,
/*0x170*/ { "NtStopProfile" , 1 } ,
/*0x171*/ { "NtSuspendProcess" , 1 } ,
/*0x172*/ { "NtSuspendThread" , 2 } ,
/*0x173*/ { "NtSystemDebugControl" , 6 } ,
/*0x174*/ { "NtTerminateJobObject" , 2 } ,
/*0x175*/ { "NtTestAlert" , 0 } ,
/*0x176*/ { "NtThawRegistry" , 0 } ,
/*0x177*/ { "NtThawTransactions" , 0 } ,
/*0x178*/ { "NtTraceControl" , 6 } ,
/*0x179*/ { "NtTranslateFilePath" , 4 } ,
/*0x17A*/ { "NtUnloadDriver" , 1 } ,
/*0x17B*/ { "NtUnloadKey" , 1 } ,
/*0x17C*/ { "NtUnloadKey2" , 2 } ,
/*0x17D*/ { "NtUnloadKeyEx" , 2 } ,
/*0x17E*/ { "NtUnlockFile" , 5 } ,
/*0x17F*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x180*/ { "NtVdmControl" , 2 } ,
/*0x181*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x182*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x183*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x184*/ { "NtWaitHighEventPair" , 1 } ,
/*0x185*/ { "NtWaitLowEventPair" , 1 } ,
/*0x186*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.0.6002-sp2-windows-vista amd64
SDT_NODE static_ssdt_6_0_6002_sp2_windows_vista_amd64[391] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtCommitComplete" , 2 } ,
/*0x08A*/ { "NtCommitEnlistment" , 2 } ,
/*0x08B*/ { "NtCommitTransaction" , 2 } ,
/*0x08C*/ { "NtCompactKeys" , 2 } ,
/*0x08D*/ { "NtCompareTokens" , 3 } ,
/*0x08E*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08F*/ { "NtCompressKey" , 1 } ,
/*0x090*/ { "NtConnectPort" , 8 } ,
/*0x091*/ { "NtCreateDebugObject" , 4 } ,
/*0x092*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x093*/ { "NtCreateEnlistment" , 8 } ,
/*0x094*/ { "NtCreateEventPair" , 3 } ,
/*0x095*/ { "NtCreateIoCompletion" , 4 } ,
/*0x096*/ { "NtCreateJobObject" , 3 } ,
/*0x097*/ { "NtCreateJobSet" , 3 } ,
/*0x098*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x099*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09B*/ { "NtCreateMutant" , 4 } ,
/*0x09C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09D*/ { "NtCreatePagingFile" , 4 } ,
/*0x09E*/ { "NtCreatePort" , 5 } ,
/*0x09F*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A0*/ { "NtCreateProcess" , 8 } ,
/*0x0A1*/ { "NtCreateProfile" , 9 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisplayString" , 1 } ,
/*0x0B8*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0B9*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BA*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BB*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BC*/ { "NtExtendSection" , 2 } ,
/*0x0BD*/ { "NtFilterToken" , 6 } ,
/*0x0BE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0BF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C0*/ { "NtFlushKey" , 1 } ,
/*0x0C1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C7*/ { "NtGetContextThread" , 2 } ,
/*0x0C8*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0C9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CB*/ { "NtGetNextProcess" , 5 } ,
/*0x0CC*/ { "NtGetNextThread" , 6 } ,
/*0x0CD*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0CE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0CF*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D0*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D1*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D2*/ { "NtImpersonateThread" , 3 } ,
/*0x0D3*/ { "NtInitializeNlsFiles" , 4 } ,
/*0x0D4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0D8*/ { "NtListenPort" , 2 } ,
/*0x0D9*/ { "NtLoadDriver" , 1 } ,
/*0x0DA*/ { "NtLoadKey" , 2 } ,
/*0x0DB*/ { "NtLoadKey2" , 3 } ,
/*0x0DC*/ { "NtLoadKeyEx" , 8 } ,
/*0x0DD*/ { "NtLockFile" , 10 } ,
/*0x0DE*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0DF*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E0*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E1*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E2*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E3*/ { "NtMapCMFModule" , 6 } ,
/*0x0E4*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E6*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0E7*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0E8*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0E9*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EA*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EB*/ { "NtOpenEventPair" , 3 } ,
/*0x0EC*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0ED*/ { "NtOpenJobObject" , 3 } ,
/*0x0EE*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0EF*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F0*/ { "NtOpenMutant" , 3 } ,
/*0x0F1*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F2*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F3*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F4*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F5*/ { "NtOpenSemaphore" , 3 } ,
/*0x0F6*/ { "NtOpenSession" , 3 } ,
/*0x0F7*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0F8*/ { "NtOpenThread" , 4 } ,
/*0x0F9*/ { "NtOpenTimer" , 3 } ,
/*0x0FA*/ { "NtOpenTransaction" , 5 } ,
/*0x0FB*/ { "NtOpenTransactionManager" , 6 } ,
/*0x0FC*/ { "NtPlugPlayControl" , 3 } ,
/*0x0FD*/ { "NtPrePrepareComplete" , 2 } ,
/*0x0FE*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x0FF*/ { "NtPrepareComplete" , 2 } ,
/*0x100*/ { "NtPrepareEnlistment" , 2 } ,
/*0x101*/ { "NtPrivilegeCheck" , 3 } ,
/*0x102*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x103*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x104*/ { "NtPropagationComplete" , 4 } ,
/*0x105*/ { "NtPropagationFailed" , 3 } ,
/*0x106*/ { "NtPulseEvent" , 2 } ,
/*0x107*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x108*/ { "NtQueryBootOptions" , 2 } ,
/*0x109*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10A*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x10B*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x10C*/ { "NtQueryEaFile" , 9 } ,
/*0x10D*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x10E*/ { "NtQueryInformationAtom" , 5 } ,
/*0x10F*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x110*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x111*/ { "NtQueryInformationPort" , 5 } ,
/*0x112*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x113*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x114*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x115*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x116*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x117*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x118*/ { "NtQueryIoCompletion" , 5 } ,
/*0x119*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11A*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x11B*/ { "NtQueryMutant" , 5 } ,
/*0x11C*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x11D*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x11E*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x11F*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x120*/ { "NtQuerySecurityObject" , 5 } ,
/*0x121*/ { "NtQuerySemaphore" , 5 } ,
/*0x122*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x124*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x125*/ { "NtQueryTimerResolution" , 3 } ,
/*0x126*/ { "NtRaiseException" , 3 } ,
/*0x127*/ { "NtRaiseHardError" , 6 } ,
/*0x128*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x129*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x12B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x12C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x12D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x12E*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x12F*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x130*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x131*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x132*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x133*/ { "NtRenameKey" , 2 } ,
/*0x134*/ { "NtRenameTransactionManager" , 2 } ,
/*0x135*/ { "NtReplaceKey" , 3 } ,
/*0x136*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x137*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x138*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x139*/ { "NtRequestPort" , 2 } ,
/*0x13A*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13B*/ { "NtResetEvent" , 2 } ,
/*0x13C*/ { "NtResetWriteWatch" , 3 } ,
/*0x13D*/ { "NtRestoreKey" , 3 } ,
/*0x13E*/ { "NtResumeProcess" , 1 } ,
/*0x13F*/ { "NtRollbackComplete" , 2 } ,
/*0x140*/ { "NtRollbackEnlistment" , 2 } ,
/*0x141*/ { "NtRollbackTransaction" , 2 } ,
/*0x142*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x143*/ { "NtSaveKey" , 2 } ,
/*0x144*/ { "NtSaveKeyEx" , 3 } ,
/*0x145*/ { "NtSaveMergedKeys" , 3 } ,
/*0x146*/ { "NtSecureConnectPort" , 9 } ,
/*0x147*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x148*/ { "NtSetBootOptions" , 2 } ,
/*0x149*/ { "NtSetContextThread" , 2 } ,
/*0x14A*/ { "NtSetDebugFilterState" , 3 } ,
/*0x14B*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x14C*/ { "NtSetDefaultLocale" , 2 } ,
/*0x14D*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x14E*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetEaFile" , 4 } ,
/*0x150*/ { "NtSetHighEventPair" , 1 } ,
/*0x151*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x152*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x153*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x154*/ { "NtSetInformationJobObject" , 4 } ,
/*0x155*/ { "NtSetInformationKey" , 4 } ,
/*0x156*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x157*/ { "NtSetInformationToken" , 4 } ,
/*0x158*/ { "NtSetInformationTransaction" , 4 } ,
/*0x159*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x15A*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x15B*/ { "NtSetIntervalProfile" , 2 } ,
/*0x15C*/ { "NtSetIoCompletion" , 5 } ,
/*0x15D*/ { "NtSetLdtEntries" , 6 } ,
/*0x15E*/ { "NtSetLowEventPair" , 1 } ,
/*0x15F*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x160*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x161*/ { "NtSetSecurityObject" , 3 } ,
/*0x162*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x163*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x164*/ { "NtSetSystemInformation" , 3 } ,
/*0x165*/ { "NtSetSystemPowerState" , 3 } ,
/*0x166*/ { "NtSetSystemTime" , 2 } ,
/*0x167*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x168*/ { "NtSetTimerResolution" , 3 } ,
/*0x169*/ { "NtSetUuidSeed" , 1 } ,
/*0x16A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x16B*/ { "NtShutdownSystem" , 1 } ,
/*0x16C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x16D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x16E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x16F*/ { "NtStartProfile" , 1 } ,
/*0x170*/ { "NtStopProfile" , 1 } ,
/*0x171*/ { "NtSuspendProcess" , 1 } ,
/*0x172*/ { "NtSuspendThread" , 2 } ,
/*0x173*/ { "NtSystemDebugControl" , 6 } ,
/*0x174*/ { "NtTerminateJobObject" , 2 } ,
/*0x175*/ { "NtTestAlert" , 0 } ,
/*0x176*/ { "NtThawRegistry" , 0 } ,
/*0x177*/ { "NtThawTransactions" , 0 } ,
/*0x178*/ { "NtTraceControl" , 6 } ,
/*0x179*/ { "NtTranslateFilePath" , 4 } ,
/*0x17A*/ { "NtUnloadDriver" , 1 } ,
/*0x17B*/ { "NtUnloadKey" , 1 } ,
/*0x17C*/ { "NtUnloadKey2" , 2 } ,
/*0x17D*/ { "NtUnloadKeyEx" , 2 } ,
/*0x17E*/ { "NtUnlockFile" , 5 } ,
/*0x17F*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x180*/ { "NtVdmControl" , 2 } ,
/*0x181*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x182*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x183*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x184*/ { "NtWaitHighEventPair" , 1 } ,
/*0x185*/ { "NtWaitLowEventPair" , 1 } ,
/*0x186*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.1.7600-sp0-windows-7 amd64
SDT_NODE static_ssdt_6_1_7600_sp0_windows_7_amd64[401] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAddBootEntry" , 2 } ,
/*0x067*/ { "NtAddDriverEntry" , 2 } ,
/*0x068*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x069*/ { "NtAlertResumeThread" , 2 } ,
/*0x06A*/ { "NtAlertThread" , 1 } ,
/*0x06B*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06C*/ { "NtAllocateReserveObject" , 3 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelIoFileEx" , 3 } ,
/*0x087*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x088*/ { "NtCommitComplete" , 2 } ,
/*0x089*/ { "NtCommitEnlistment" , 2 } ,
/*0x08A*/ { "NtCommitTransaction" , 2 } ,
/*0x08B*/ { "NtCompactKeys" , 2 } ,
/*0x08C*/ { "NtCompareTokens" , 3 } ,
/*0x08D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08E*/ { "NtCompressKey" , 1 } ,
/*0x08F*/ { "NtConnectPort" , 8 } ,
/*0x090*/ { "NtCreateDebugObject" , 4 } ,
/*0x091*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x092*/ { "NtCreateEnlistment" , 8 } ,
/*0x093*/ { "NtCreateEventPair" , 3 } ,
/*0x094*/ { "NtCreateIoCompletion" , 4 } ,
/*0x095*/ { "NtCreateJobObject" , 3 } ,
/*0x096*/ { "NtCreateJobSet" , 3 } ,
/*0x097*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x098*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x099*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09A*/ { "NtCreateMutant" , 4 } ,
/*0x09B*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09C*/ { "NtCreatePagingFile" , 4 } ,
/*0x09D*/ { "NtCreatePort" , 5 } ,
/*0x09E*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x09F*/ { "NtCreateProcess" , 8 } ,
/*0x0A0*/ { "NtCreateProfile" , 9 } ,
/*0x0A1*/ { "NtCreateProfileEx" , 10 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0B8*/ { "NtDisplayString" , 1 } ,
/*0x0B9*/ { "NtDrawText" , 1 } ,
/*0x0BA*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0BB*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BD*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BE*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BF*/ { "NtExtendSection" , 2 } ,
/*0x0C0*/ { "NtFilterToken" , 6 } ,
/*0x0C1*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C2*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C3*/ { "NtFlushKey" , 1 } ,
/*0x0C4*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C5*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C6*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C7*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C8*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C9*/ { "NtFreezeTransactions" , 2 } ,
/*0x0CA*/ { "NtGetContextThread" , 2 } ,
/*0x0CB*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CC*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CD*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CE*/ { "NtGetNextProcess" , 5 } ,
/*0x0CF*/ { "NtGetNextThread" , 6 } ,
/*0x0D0*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D1*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D2*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D3*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D4*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D5*/ { "NtImpersonateThread" , 3 } ,
/*0x0D6*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D7*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D8*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D9*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0DA*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E9*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EA*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EB*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0EC*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0ED*/ { "NtNotifyChangeSession" , 8 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyEx" , 4 } ,
/*0x0F3*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F4*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x0F5*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F6*/ { "NtOpenMutant" , 3 } ,
/*0x0F7*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F8*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F9*/ { "NtOpenProcessToken" , 3 } ,
/*0x0FA*/ { "NtOpenResourceManager" , 5 } ,
/*0x0FB*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FC*/ { "NtOpenSession" , 3 } ,
/*0x0FD*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FE*/ { "NtOpenThread" , 4 } ,
/*0x0FF*/ { "NtOpenTimer" , 3 } ,
/*0x100*/ { "NtOpenTransaction" , 5 } ,
/*0x101*/ { "NtOpenTransactionManager" , 6 } ,
/*0x102*/ { "NtPlugPlayControl" , 3 } ,
/*0x103*/ { "NtPrePrepareComplete" , 2 } ,
/*0x104*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrepareComplete" , 2 } ,
/*0x106*/ { "NtPrepareEnlistment" , 2 } ,
/*0x107*/ { "NtPrivilegeCheck" , 3 } ,
/*0x108*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x109*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x10A*/ { "NtPropagationComplete" , 4 } ,
/*0x10B*/ { "NtPropagationFailed" , 3 } ,
/*0x10C*/ { "NtPulseEvent" , 2 } ,
/*0x10D*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10E*/ { "NtQueryBootOptions" , 2 } ,
/*0x10F*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x110*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x111*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x112*/ { "NtQueryEaFile" , 9 } ,
/*0x113*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x114*/ { "NtQueryInformationAtom" , 5 } ,
/*0x115*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x116*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x117*/ { "NtQueryInformationPort" , 5 } ,
/*0x118*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x119*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x11A*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11B*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11C*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11D*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11E*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11F*/ { "NtQueryLicenseValue" , 5 } ,
/*0x120*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x121*/ { "NtQueryMutant" , 5 } ,
/*0x122*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x123*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x124*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x125*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x126*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x127*/ { "NtQuerySecurityObject" , 5 } ,
/*0x128*/ { "NtQuerySemaphore" , 5 } ,
/*0x129*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x12A*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x12B*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12C*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x12D*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12E*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x12F*/ { "NtRaiseException" , 3 } ,
/*0x130*/ { "NtRaiseHardError" , 6 } ,
/*0x131*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x132*/ { "NtRecoverEnlistment" , 2 } ,
/*0x133*/ { "NtRecoverResourceManager" , 1 } ,
/*0x134*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x135*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x136*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x137*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x138*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x139*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x13A*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x13B*/ { "NtRenameKey" , 2 } ,
/*0x13C*/ { "NtRenameTransactionManager" , 2 } ,
/*0x13D*/ { "NtReplaceKey" , 3 } ,
/*0x13E*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x13F*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x140*/ { "NtRequestPort" , 2 } ,
/*0x141*/ { "NtResetEvent" , 2 } ,
/*0x142*/ { "NtResetWriteWatch" , 3 } ,
/*0x143*/ { "NtRestoreKey" , 3 } ,
/*0x144*/ { "NtResumeProcess" , 1 } ,
/*0x145*/ { "NtRollbackComplete" , 2 } ,
/*0x146*/ { "NtRollbackEnlistment" , 2 } ,
/*0x147*/ { "NtRollbackTransaction" , 2 } ,
/*0x148*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x149*/ { "NtSaveKey" , 2 } ,
/*0x14A*/ { "NtSaveKeyEx" , 3 } ,
/*0x14B*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSerializeBoot" , 0 } ,
/*0x14E*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetBootOptions" , 2 } ,
/*0x150*/ { "NtSetContextThread" , 2 } ,
/*0x151*/ { "NtSetDebugFilterState" , 3 } ,
/*0x152*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x153*/ { "NtSetDefaultLocale" , 2 } ,
/*0x154*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x155*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x156*/ { "NtSetEaFile" , 4 } ,
/*0x157*/ { "NtSetHighEventPair" , 1 } ,
/*0x158*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x159*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x15A*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15B*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15C*/ { "NtSetInformationKey" , 4 } ,
/*0x15D*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15E*/ { "NtSetInformationToken" , 4 } ,
/*0x15F*/ { "NtSetInformationTransaction" , 4 } ,
/*0x160*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x161*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x162*/ { "NtSetIntervalProfile" , 2 } ,
/*0x163*/ { "NtSetIoCompletion" , 5 } ,
/*0x164*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x165*/ { "NtSetLdtEntries" , 6 } ,
/*0x166*/ { "NtSetLowEventPair" , 1 } ,
/*0x167*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x168*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x169*/ { "NtSetSecurityObject" , 3 } ,
/*0x16A*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x16B*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16C*/ { "NtSetSystemInformation" , 3 } ,
/*0x16D*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16E*/ { "NtSetSystemTime" , 2 } ,
/*0x16F*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x170*/ { "NtSetTimerEx" , 4 } ,
/*0x171*/ { "NtSetTimerResolution" , 3 } ,
/*0x172*/ { "NtSetUuidSeed" , 1 } ,
/*0x173*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x174*/ { "NtShutdownSystem" , 1 } ,
/*0x175*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x176*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x177*/ { "NtSinglePhaseReject" , 2 } ,
/*0x178*/ { "NtStartProfile" , 1 } ,
/*0x179*/ { "NtStopProfile" , 1 } ,
/*0x17A*/ { "NtSuspendProcess" , 1 } ,
/*0x17B*/ { "NtSuspendThread" , 2 } ,
/*0x17C*/ { "NtSystemDebugControl" , 6 } ,
/*0x17D*/ { "NtTerminateJobObject" , 2 } ,
/*0x17E*/ { "NtTestAlert" , 0 } ,
/*0x17F*/ { "NtThawRegistry" , 0 } ,
/*0x180*/ { "NtThawTransactions" , 0 } ,
/*0x181*/ { "NtTraceControl" , 6 } ,
/*0x182*/ { "NtTranslateFilePath" , 4 } ,
/*0x183*/ { "NtUmsThreadYield" , 1 } ,
/*0x184*/ { "NtUnloadDriver" , 1 } ,
/*0x185*/ { "NtUnloadKey" , 1 } ,
/*0x186*/ { "NtUnloadKey2" , 2 } ,
/*0x187*/ { "NtUnloadKeyEx" , 2 } ,
/*0x188*/ { "NtUnlockFile" , 5 } ,
/*0x189*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x18A*/ { "NtVdmControl" , 2 } ,
/*0x18B*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x18C*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18D*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18E*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18F*/ { "NtWaitLowEventPair" , 1 } ,
/*0x190*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.1.7601-sp1-windows-7 amd64
SDT_NODE static_ssdt_6_1_7601_sp1_windows_7_amd64[401] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAddBootEntry" , 2 } ,
/*0x067*/ { "NtAddDriverEntry" , 2 } ,
/*0x068*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x069*/ { "NtAlertResumeThread" , 2 } ,
/*0x06A*/ { "NtAlertThread" , 1 } ,
/*0x06B*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06C*/ { "NtAllocateReserveObject" , 3 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelIoFileEx" , 3 } ,
/*0x087*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x088*/ { "NtCommitComplete" , 2 } ,
/*0x089*/ { "NtCommitEnlistment" , 2 } ,
/*0x08A*/ { "NtCommitTransaction" , 2 } ,
/*0x08B*/ { "NtCompactKeys" , 2 } ,
/*0x08C*/ { "NtCompareTokens" , 3 } ,
/*0x08D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08E*/ { "NtCompressKey" , 1 } ,
/*0x08F*/ { "NtConnectPort" , 8 } ,
/*0x090*/ { "NtCreateDebugObject" , 4 } ,
/*0x091*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x092*/ { "NtCreateEnlistment" , 8 } ,
/*0x093*/ { "NtCreateEventPair" , 3 } ,
/*0x094*/ { "NtCreateIoCompletion" , 4 } ,
/*0x095*/ { "NtCreateJobObject" , 3 } ,
/*0x096*/ { "NtCreateJobSet" , 3 } ,
/*0x097*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x098*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x099*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09A*/ { "NtCreateMutant" , 4 } ,
/*0x09B*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09C*/ { "NtCreatePagingFile" , 4 } ,
/*0x09D*/ { "NtCreatePort" , 5 } ,
/*0x09E*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x09F*/ { "NtCreateProcess" , 8 } ,
/*0x0A0*/ { "NtCreateProfile" , 9 } ,
/*0x0A1*/ { "NtCreateProfileEx" , 10 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0B8*/ { "NtDisplayString" , 1 } ,
/*0x0B9*/ { "NtDrawText" , 1 } ,
/*0x0BA*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0BB*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BD*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BE*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BF*/ { "NtExtendSection" , 2 } ,
/*0x0C0*/ { "NtFilterToken" , 6 } ,
/*0x0C1*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C2*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C3*/ { "NtFlushKey" , 1 } ,
/*0x0C4*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C5*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C6*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C7*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C8*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C9*/ { "NtFreezeTransactions" , 2 } ,
/*0x0CA*/ { "NtGetContextThread" , 2 } ,
/*0x0CB*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CC*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CD*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CE*/ { "NtGetNextProcess" , 5 } ,
/*0x0CF*/ { "NtGetNextThread" , 6 } ,
/*0x0D0*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D1*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D2*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D3*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D4*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D5*/ { "NtImpersonateThread" , 3 } ,
/*0x0D6*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D7*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D8*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D9*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0DA*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E9*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EA*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EB*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0EC*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0ED*/ { "NtNotifyChangeSession" , 8 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyEx" , 4 } ,
/*0x0F3*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F4*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x0F5*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F6*/ { "NtOpenMutant" , 3 } ,
/*0x0F7*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F8*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F9*/ { "NtOpenProcessToken" , 3 } ,
/*0x0FA*/ { "NtOpenResourceManager" , 5 } ,
/*0x0FB*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FC*/ { "NtOpenSession" , 3 } ,
/*0x0FD*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FE*/ { "NtOpenThread" , 4 } ,
/*0x0FF*/ { "NtOpenTimer" , 3 } ,
/*0x100*/ { "NtOpenTransaction" , 5 } ,
/*0x101*/ { "NtOpenTransactionManager" , 6 } ,
/*0x102*/ { "NtPlugPlayControl" , 3 } ,
/*0x103*/ { "NtPrePrepareComplete" , 2 } ,
/*0x104*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrepareComplete" , 2 } ,
/*0x106*/ { "NtPrepareEnlistment" , 2 } ,
/*0x107*/ { "NtPrivilegeCheck" , 3 } ,
/*0x108*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x109*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x10A*/ { "NtPropagationComplete" , 4 } ,
/*0x10B*/ { "NtPropagationFailed" , 3 } ,
/*0x10C*/ { "NtPulseEvent" , 2 } ,
/*0x10D*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10E*/ { "NtQueryBootOptions" , 2 } ,
/*0x10F*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x110*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x111*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x112*/ { "NtQueryEaFile" , 9 } ,
/*0x113*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x114*/ { "NtQueryInformationAtom" , 5 } ,
/*0x115*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x116*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x117*/ { "NtQueryInformationPort" , 5 } ,
/*0x118*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x119*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x11A*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11B*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11C*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11D*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11E*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11F*/ { "NtQueryLicenseValue" , 5 } ,
/*0x120*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x121*/ { "NtQueryMutant" , 5 } ,
/*0x122*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x123*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x124*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x125*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x126*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x127*/ { "NtQuerySecurityObject" , 5 } ,
/*0x128*/ { "NtQuerySemaphore" , 5 } ,
/*0x129*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x12A*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x12B*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12C*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x12D*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12E*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x12F*/ { "NtRaiseException" , 3 } ,
/*0x130*/ { "NtRaiseHardError" , 6 } ,
/*0x131*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x132*/ { "NtRecoverEnlistment" , 2 } ,
/*0x133*/ { "NtRecoverResourceManager" , 1 } ,
/*0x134*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x135*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x136*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x137*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x138*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x139*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x13A*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x13B*/ { "NtRenameKey" , 2 } ,
/*0x13C*/ { "NtRenameTransactionManager" , 2 } ,
/*0x13D*/ { "NtReplaceKey" , 3 } ,
/*0x13E*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x13F*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x140*/ { "NtRequestPort" , 2 } ,
/*0x141*/ { "NtResetEvent" , 2 } ,
/*0x142*/ { "NtResetWriteWatch" , 3 } ,
/*0x143*/ { "NtRestoreKey" , 3 } ,
/*0x144*/ { "NtResumeProcess" , 1 } ,
/*0x145*/ { "NtRollbackComplete" , 2 } ,
/*0x146*/ { "NtRollbackEnlistment" , 2 } ,
/*0x147*/ { "NtRollbackTransaction" , 2 } ,
/*0x148*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x149*/ { "NtSaveKey" , 2 } ,
/*0x14A*/ { "NtSaveKeyEx" , 3 } ,
/*0x14B*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSerializeBoot" , 0 } ,
/*0x14E*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetBootOptions" , 2 } ,
/*0x150*/ { "NtSetContextThread" , 2 } ,
/*0x151*/ { "NtSetDebugFilterState" , 3 } ,
/*0x152*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x153*/ { "NtSetDefaultLocale" , 2 } ,
/*0x154*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x155*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x156*/ { "NtSetEaFile" , 4 } ,
/*0x157*/ { "NtSetHighEventPair" , 1 } ,
/*0x158*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x159*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x15A*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15B*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15C*/ { "NtSetInformationKey" , 4 } ,
/*0x15D*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15E*/ { "NtSetInformationToken" , 4 } ,
/*0x15F*/ { "NtSetInformationTransaction" , 4 } ,
/*0x160*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x161*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x162*/ { "NtSetIntervalProfile" , 2 } ,
/*0x163*/ { "NtSetIoCompletion" , 5 } ,
/*0x164*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x165*/ { "NtSetLdtEntries" , 6 } ,
/*0x166*/ { "NtSetLowEventPair" , 1 } ,
/*0x167*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x168*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x169*/ { "NtSetSecurityObject" , 3 } ,
/*0x16A*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x16B*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16C*/ { "NtSetSystemInformation" , 3 } ,
/*0x16D*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16E*/ { "NtSetSystemTime" , 2 } ,
/*0x16F*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x170*/ { "NtSetTimerEx" , 4 } ,
/*0x171*/ { "NtSetTimerResolution" , 3 } ,
/*0x172*/ { "NtSetUuidSeed" , 1 } ,
/*0x173*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x174*/ { "NtShutdownSystem" , 1 } ,
/*0x175*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x176*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x177*/ { "NtSinglePhaseReject" , 2 } ,
/*0x178*/ { "NtStartProfile" , 1 } ,
/*0x179*/ { "NtStopProfile" , 1 } ,
/*0x17A*/ { "NtSuspendProcess" , 1 } ,
/*0x17B*/ { "NtSuspendThread" , 2 } ,
/*0x17C*/ { "NtSystemDebugControl" , 6 } ,
/*0x17D*/ { "NtTerminateJobObject" , 2 } ,
/*0x17E*/ { "NtTestAlert" , 0 } ,
/*0x17F*/ { "NtThawRegistry" , 0 } ,
/*0x180*/ { "NtThawTransactions" , 0 } ,
/*0x181*/ { "NtTraceControl" , 6 } ,
/*0x182*/ { "NtTranslateFilePath" , 4 } ,
/*0x183*/ { "NtUmsThreadYield" , 1 } ,
/*0x184*/ { "NtUnloadDriver" , 1 } ,
/*0x185*/ { "NtUnloadKey" , 1 } ,
/*0x186*/ { "NtUnloadKey2" , 2 } ,
/*0x187*/ { "NtUnloadKeyEx" , 2 } ,
/*0x188*/ { "NtUnlockFile" , 5 } ,
/*0x189*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x18A*/ { "NtVdmControl" , 2 } ,
/*0x18B*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x18C*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18D*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18E*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18F*/ { "NtWaitLowEventPair" , 1 } ,
/*0x190*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.2.9200-sp0-windows-8 amd64
SDT_NODE static_ssdt_6_2_9200_sp0_windows_8_amd64[429] = {
/*0x000*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x001*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x002*/ { "NtWaitForSingleObject" , 3 } ,
/*0x003*/ { "NtCallbackReturn" , 3 } ,
/*0x004*/ { "NtReadFile" , 9 } ,
/*0x005*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x006*/ { "NtWriteFile" , 9 } ,
/*0x007*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x008*/ { "NtReleaseSemaphore" , 3 } ,
/*0x009*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00A*/ { "NtReplyPort" , 2 } ,
/*0x00B*/ { "NtSetInformationThread" , 4 } ,
/*0x00C*/ { "NtSetEvent" , 2 } ,
/*0x00D*/ { "NtClose" , 1 } ,
/*0x00E*/ { "NtQueryObject" , 5 } ,
/*0x00F*/ { "NtQueryInformationFile" , 5 } ,
/*0x010*/ { "NtOpenKey" , 3 } ,
/*0x011*/ { "NtEnumerateValueKey" , 6 } ,
/*0x012*/ { "NtFindAtom" , 3 } ,
/*0x013*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x014*/ { "NtQueryKey" , 5 } ,
/*0x015*/ { "NtQueryValueKey" , 6 } ,
/*0x016*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x017*/ { "NtQueryInformationProcess" , 5 } ,
/*0x018*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x019*/ { "NtWriteFileGather" , 9 } ,
/*0x01A*/ { "NtSetInformationProcess" , 4 } ,
/*0x01B*/ { "NtCreateKey" , 7 } ,
/*0x01C*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01D*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01E*/ { "NtReleaseMutant" , 2 } ,
/*0x01F*/ { "NtQueryInformationToken" , 5 } ,
/*0x020*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x021*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x022*/ { "NtOpenThreadToken" , 4 } ,
/*0x023*/ { "NtQueryInformationThread" , 5 } ,
/*0x024*/ { "NtOpenProcess" , 4 } ,
/*0x025*/ { "NtSetInformationFile" , 5 } ,
/*0x026*/ { "NtMapViewOfSection" , 10 } ,
/*0x027*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x028*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x029*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02A*/ { "NtTerminateProcess" , 2 } ,
/*0x02B*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02C*/ { "NtReadFileScatter" , 9 } ,
/*0x02D*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02E*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02F*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x030*/ { "NtEnumerateKey" , 6 } ,
/*0x031*/ { "NtOpenFile" , 6 } ,
/*0x032*/ { "NtDelayExecution" , 2 } ,
/*0x033*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x034*/ { "NtQuerySystemInformation" , 4 } ,
/*0x035*/ { "NtOpenSection" , 3 } ,
/*0x036*/ { "NtQueryTimer" , 5 } ,
/*0x037*/ { "NtFsControlFile" , 10 } ,
/*0x038*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x039*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03A*/ { "NtDuplicateObject" , 7 } ,
/*0x03B*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03C*/ { "NtClearEvent" , 1 } ,
/*0x03D*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03E*/ { "NtOpenEvent" , 3 } ,
/*0x03F*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x040*/ { "NtDuplicateToken" , 6 } ,
/*0x041*/ { "NtContinue" , 2 } ,
/*0x042*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x043*/ { "NtQueueApcThread" , 5 } ,
/*0x044*/ { "NtYieldExecution" , 0 } ,
/*0x045*/ { "NtAddAtom" , 3 } ,
/*0x046*/ { "NtCreateEvent" , 5 } ,
/*0x047*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x048*/ { "NtCreateSection" , 7 } ,
/*0x049*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04A*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04B*/ { "NtCreateProcessEx" , 9 } ,
/*0x04C*/ { "NtCreateThread" , 8 } ,
/*0x04D*/ { "NtIsProcessInJob" , 2 } ,
/*0x04E*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04F*/ { "NtQuerySection" , 5 } ,
/*0x050*/ { "NtResumeThread" , 2 } ,
/*0x051*/ { "NtTerminateThread" , 2 } ,
/*0x052*/ { "NtReadRequestData" , 6 } ,
/*0x053*/ { "NtCreateFile" , 11 } ,
/*0x054*/ { "NtQueryEvent" , 5 } ,
/*0x055*/ { "NtWriteRequestData" , 6 } ,
/*0x056*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x057*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x058*/ { "NtQuerySystemTime" , 1 } ,
/*0x059*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05A*/ { "NtSetInformationObject" , 4 } ,
/*0x05B*/ { "NtCancelIoFile" , 2 } ,
/*0x05C*/ { "NtTraceEvent" , 4 } ,
/*0x05D*/ { "NtPowerInformation" , 5 } ,
/*0x05E*/ { "NtSetValueKey" , 6 } ,
/*0x05F*/ { "NtCancelTimer" , 2 } ,
/*0x060*/ { "NtSetTimer" , 7 } ,
/*0x061*/ { "NtAcceptConnectPort" , 6 } ,
/*0x062*/ { "NtAccessCheck" , 8 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x082*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x083*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x084*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x085*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x086*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x087*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x088*/ { "NtAlpcSetInformation" , 4 } ,
/*0x089*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08A*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08B*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08C*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08D*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08E*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x08F*/ { "NtCommitComplete" , 2 } ,
/*0x090*/ { "NtCommitEnlistment" , 2 } ,
/*0x091*/ { "NtCommitTransaction" , 2 } ,
/*0x092*/ { "NtCompactKeys" , 2 } ,
/*0x093*/ { "NtCompareTokens" , 3 } ,
/*0x094*/ { "NtCompleteConnectPort" , 1 } ,
/*0x095*/ { "NtCompressKey" , 1 } ,
/*0x096*/ { "NtConnectPort" , 8 } ,
/*0x097*/ { "NtCreateDebugObject" , 4 } ,
/*0x098*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x099*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09A*/ { "NtCreateEnlistment" , 8 } ,
/*0x09B*/ { "NtCreateEventPair" , 3 } ,
/*0x09C*/ { "NtCreateIRTimer" , 2 } ,
/*0x09D*/ { "NtCreateIoCompletion" , 4 } ,
/*0x09E*/ { "NtCreateJobObject" , 3 } ,
/*0x09F*/ { "NtCreateJobSet" , 3 } ,
/*0x0A0*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A1*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A2*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A3*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A4*/ { "NtCreateMutant" , 4 } ,
/*0x0A5*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0A6*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A7*/ { "NtCreatePort" , 5 } ,
/*0x0A8*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A9*/ { "NtCreateProcess" , 8 } ,
/*0x0AA*/ { "NtCreateProfile" , 9 } ,
/*0x0AB*/ { "NtCreateProfileEx" , 10 } ,
/*0x0AC*/ { "NtCreateResourceManager" , 7 } ,
/*0x0AD*/ { "NtCreateSemaphore" , 5 } ,
/*0x0AE*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0AF*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B0*/ { "NtCreateTimer" , 4 } ,
/*0x0B1*/ { "NtCreateToken" , 13 } ,
/*0x0B2*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B3*/ { "NtCreateTransaction" , 10 } ,
/*0x0B4*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0B5*/ { "NtCreateUserProcess" , 11 } ,
/*0x0B6*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0B7*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0B8*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0B9*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0BA*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0BB*/ { "NtDebugContinue" , 3 } ,
/*0x0BC*/ { "NtDeleteAtom" , 1 } ,
/*0x0BD*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0BE*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0BF*/ { "NtDeleteFile" , 1 } ,
/*0x0C0*/ { "NtDeleteKey" , 1 } ,
/*0x0C1*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C2*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C3*/ { "NtDeleteValueKey" , 2 } ,
/*0x0C4*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0C5*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0C6*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0C7*/ { "NtDisplayString" , 1 } ,
/*0x0C8*/ { "NtDrawText" , 1 } ,
/*0x0C9*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0CA*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0CB*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0CC*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0CD*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0CE*/ { "NtExtendSection" , 2 } ,
/*0x0CF*/ { "NtFilterBootOption" , 5 } ,
/*0x0D0*/ { "NtFilterToken" , 6 } ,
/*0x0D1*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D2*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D3*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0D4*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0D5*/ { "NtFlushKey" , 1 } ,
/*0x0D6*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0D7*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0D8*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0D9*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0DA*/ { "NtFreezeRegistry" , 1 } ,
/*0x0DB*/ { "NtFreezeTransactions" , 2 } ,
/*0x0DC*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0DD*/ { "NtGetContextThread" , 2 } ,
/*0x0DE*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0DF*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E0*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E1*/ { "NtGetNextProcess" , 5 } ,
/*0x0E2*/ { "NtGetNextThread" , 6 } ,
/*0x0E3*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0E4*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0E5*/ { "NtGetWriteWatch" , 7 } ,
/*0x0E6*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0E7*/ { "NtImpersonateThread" , 3 } ,
/*0x0E8*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0E9*/ { "NtInitializeRegistry" , 1 } ,
/*0x0EA*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0EB*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0EC*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0ED*/ { "NtListenPort" , 2 } ,
/*0x0EE*/ { "NtLoadDriver" , 1 } ,
/*0x0EF*/ { "NtLoadKey" , 2 } ,
/*0x0F0*/ { "NtLoadKey2" , 3 } ,
/*0x0F1*/ { "NtLoadKeyEx" , 8 } ,
/*0x0F2*/ { "NtLockFile" , 10 } ,
/*0x0F3*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0F4*/ { "NtLockRegistryKey" , 1 } ,
/*0x0F5*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0F6*/ { "NtMakePermanentObject" , 1 } ,
/*0x0F7*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0F8*/ { "NtMapCMFModule" , 6 } ,
/*0x0F9*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0FA*/ { "NtModifyBootEntry" , 1 } ,
/*0x0FB*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0FC*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0FD*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0FE*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0FF*/ { "NtNotifyChangeSession" , 8 } ,
/*0x100*/ { "NtOpenEnlistment" , 5 } ,
/*0x101*/ { "NtOpenEventPair" , 3 } ,
/*0x102*/ { "NtOpenIoCompletion" , 3 } ,
/*0x103*/ { "NtOpenJobObject" , 3 } ,
/*0x104*/ { "NtOpenKeyEx" , 4 } ,
/*0x105*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x106*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x107*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x108*/ { "NtOpenMutant" , 3 } ,
/*0x109*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x10A*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x10B*/ { "NtOpenProcessToken" , 3 } ,
/*0x10C*/ { "NtOpenResourceManager" , 5 } ,
/*0x10D*/ { "NtOpenSemaphore" , 3 } ,
/*0x10E*/ { "NtOpenSession" , 3 } ,
/*0x10F*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x110*/ { "NtOpenThread" , 4 } ,
/*0x111*/ { "NtOpenTimer" , 3 } ,
/*0x112*/ { "NtOpenTransaction" , 5 } ,
/*0x113*/ { "NtOpenTransactionManager" , 6 } ,
/*0x114*/ { "NtPlugPlayControl" , 3 } ,
/*0x115*/ { "NtPrePrepareComplete" , 2 } ,
/*0x116*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x117*/ { "NtPrepareComplete" , 2 } ,
/*0x118*/ { "NtPrepareEnlistment" , 2 } ,
/*0x119*/ { "NtPrivilegeCheck" , 3 } ,
/*0x11A*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x11B*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x11C*/ { "NtPropagationComplete" , 4 } ,
/*0x11D*/ { "NtPropagationFailed" , 3 } ,
/*0x11E*/ { "NtPulseEvent" , 2 } ,
/*0x11F*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x120*/ { "NtQueryBootOptions" , 2 } ,
/*0x121*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x122*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x123*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x124*/ { "NtQueryEaFile" , 9 } ,
/*0x125*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x126*/ { "NtQueryInformationAtom" , 5 } ,
/*0x127*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x128*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x129*/ { "NtQueryInformationPort" , 5 } ,
/*0x12A*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x12B*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x12C*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x12D*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x12E*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x12F*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x130*/ { "NtQueryIoCompletion" , 5 } ,
/*0x131*/ { "NtQueryLicenseValue" , 5 } ,
/*0x132*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x133*/ { "NtQueryMutant" , 5 } ,
/*0x134*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x135*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x136*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x137*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x138*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x139*/ { "NtQuerySecurityObject" , 5 } ,
/*0x13A*/ { "NtQuerySemaphore" , 5 } ,
/*0x13B*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x13C*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x13D*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x13E*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x13F*/ { "NtQueryTimerResolution" , 3 } ,
/*0x140*/ { "NtQueryWnfStateData" , 6 } ,
/*0x141*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x142*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x143*/ { "NtRaiseException" , 3 } ,
/*0x144*/ { "NtRaiseHardError" , 6 } ,
/*0x145*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x146*/ { "NtRecoverEnlistment" , 2 } ,
/*0x147*/ { "NtRecoverResourceManager" , 1 } ,
/*0x148*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x149*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x14A*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x14B*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x14C*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x14D*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x14E*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x14F*/ { "NtRenameKey" , 2 } ,
/*0x150*/ { "NtRenameTransactionManager" , 2 } ,
/*0x151*/ { "NtReplaceKey" , 3 } ,
/*0x152*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x153*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x154*/ { "NtRequestPort" , 2 } ,
/*0x155*/ { "NtResetEvent" , 2 } ,
/*0x156*/ { "NtResetWriteWatch" , 3 } ,
/*0x157*/ { "NtRestoreKey" , 3 } ,
/*0x158*/ { "NtResumeProcess" , 1 } ,
/*0x159*/ { "NtRollbackComplete" , 2 } ,
/*0x15A*/ { "NtRollbackEnlistment" , 2 } ,
/*0x15B*/ { "NtRollbackTransaction" , 2 } ,
/*0x15C*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x15D*/ { "NtSaveKey" , 2 } ,
/*0x15E*/ { "NtSaveKeyEx" , 3 } ,
/*0x15F*/ { "NtSaveMergedKeys" , 3 } ,
/*0x160*/ { "NtSecureConnectPort" , 9 } ,
/*0x161*/ { "NtSerializeBoot" , 0 } ,
/*0x162*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x163*/ { "NtSetBootOptions" , 2 } ,
/*0x164*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x165*/ { "NtSetContextThread" , 2 } ,
/*0x166*/ { "NtSetDebugFilterState" , 3 } ,
/*0x167*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x168*/ { "NtSetDefaultLocale" , 2 } ,
/*0x169*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x16A*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x16B*/ { "NtSetEaFile" , 4 } ,
/*0x16C*/ { "NtSetHighEventPair" , 1 } ,
/*0x16D*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x16E*/ { "NtSetIRTimer" , 2 } ,
/*0x16F*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x170*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x171*/ { "NtSetInformationJobObject" , 4 } ,
/*0x172*/ { "NtSetInformationKey" , 4 } ,
/*0x173*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x174*/ { "NtSetInformationToken" , 4 } ,
/*0x175*/ { "NtSetInformationTransaction" , 4 } ,
/*0x176*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x177*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x178*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x179*/ { "NtSetIntervalProfile" , 2 } ,
/*0x17A*/ { "NtSetIoCompletion" , 5 } ,
/*0x17B*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x17C*/ { "NtSetLdtEntries" , 6 } ,
/*0x17D*/ { "NtSetLowEventPair" , 1 } ,
/*0x17E*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x17F*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x180*/ { "NtSetSecurityObject" , 3 } ,
/*0x181*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x182*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x183*/ { "NtSetSystemInformation" , 3 } ,
/*0x184*/ { "NtSetSystemPowerState" , 3 } ,
/*0x185*/ { "NtSetSystemTime" , 2 } ,
/*0x186*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x187*/ { "NtSetTimerEx" , 4 } ,
/*0x188*/ { "NtSetTimerResolution" , 3 } ,
/*0x189*/ { "NtSetUuidSeed" , 1 } ,
/*0x18A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x18B*/ { "NtShutdownSystem" , 1 } ,
/*0x18C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x18D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x18E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x18F*/ { "NtStartProfile" , 1 } ,
/*0x190*/ { "NtStopProfile" , 1 } ,
/*0x191*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x192*/ { "NtSuspendProcess" , 1 } ,
/*0x193*/ { "NtSuspendThread" , 2 } ,
/*0x194*/ { "NtSystemDebugControl" , 6 } ,
/*0x195*/ { "NtTerminateJobObject" , 2 } ,
/*0x196*/ { "NtTestAlert" , 0 } ,
/*0x197*/ { "NtThawRegistry" , 0 } ,
/*0x198*/ { "NtThawTransactions" , 0 } ,
/*0x199*/ { "NtTraceControl" , 6 } ,
/*0x19A*/ { "NtTranslateFilePath" , 4 } ,
/*0x19B*/ { "NtUmsThreadYield" , 1 } ,
/*0x19C*/ { "NtUnloadDriver" , 1 } ,
/*0x19D*/ { "NtUnloadKey" , 1 } ,
/*0x19E*/ { "NtUnloadKey2" , 2 } ,
/*0x19F*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1A0*/ { "NtUnlockFile" , 5 } ,
/*0x1A1*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1A2*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1A3*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1A4*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1A5*/ { "NtVdmControl" , 2 } ,
/*0x1A6*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1A7*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1A8*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1A9*/ { "NtWaitForWnfNotifications" , 2 } ,
/*0x1AA*/ { "NtWaitForWorkViaWorkerFactory" , 4 } ,
/*0x1AB*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1AC*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 6.3.9600-sp0-windows-8.1 amd64
SDT_NODE static_ssdt_6_3_9600_sp0_windows_8_1_amd64[433] = {
/*0x000*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x001*/ { "NtAcceptConnectPort" , 6 } ,
/*0x002*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x003*/ { "NtWaitForSingleObject" , 3 } ,
/*0x004*/ { "NtCallbackReturn" , 3 } ,
/*0x005*/ { "NtReadFile" , 9 } ,
/*0x006*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x007*/ { "NtWriteFile" , 9 } ,
/*0x008*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x009*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00A*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00B*/ { "NtReplyPort" , 2 } ,
/*0x00C*/ { "NtSetInformationThread" , 4 } ,
/*0x00D*/ { "NtSetEvent" , 2 } ,
/*0x00E*/ { "NtClose" , 1 } ,
/*0x00F*/ { "NtQueryObject" , 5 } ,
/*0x010*/ { "NtQueryInformationFile" , 5 } ,
/*0x011*/ { "NtOpenKey" , 3 } ,
/*0x012*/ { "NtEnumerateValueKey" , 6 } ,
/*0x013*/ { "NtFindAtom" , 3 } ,
/*0x014*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x015*/ { "NtQueryKey" , 5 } ,
/*0x016*/ { "NtQueryValueKey" , 6 } ,
/*0x017*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x018*/ { "NtQueryInformationProcess" , 5 } ,
/*0x019*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01A*/ { "NtWriteFileGather" , 9 } ,
/*0x01B*/ { "NtSetInformationProcess" , 4 } ,
/*0x01C*/ { "NtCreateKey" , 7 } ,
/*0x01D*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01E*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01F*/ { "NtReleaseMutant" , 2 } ,
/*0x020*/ { "NtQueryInformationToken" , 5 } ,
/*0x021*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x022*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x023*/ { "NtOpenThreadToken" , 4 } ,
/*0x024*/ { "NtQueryInformationThread" , 5 } ,
/*0x025*/ { "NtOpenProcess" , 4 } ,
/*0x026*/ { "NtSetInformationFile" , 5 } ,
/*0x027*/ { "NtMapViewOfSection" , 10 } ,
/*0x028*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x029*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02A*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02B*/ { "NtTerminateProcess" , 2 } ,
/*0x02C*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02D*/ { "NtReadFileScatter" , 9 } ,
/*0x02E*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02F*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x030*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x031*/ { "NtEnumerateKey" , 6 } ,
/*0x032*/ { "NtOpenFile" , 6 } ,
/*0x033*/ { "NtDelayExecution" , 2 } ,
/*0x034*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x035*/ { "NtQuerySystemInformation" , 4 } ,
/*0x036*/ { "NtOpenSection" , 3 } ,
/*0x037*/ { "NtQueryTimer" , 5 } ,
/*0x038*/ { "NtFsControlFile" , 10 } ,
/*0x039*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03A*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03B*/ { "NtDuplicateObject" , 7 } ,
/*0x03C*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03D*/ { "NtClearEvent" , 1 } ,
/*0x03E*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03F*/ { "NtOpenEvent" , 3 } ,
/*0x040*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x041*/ { "NtDuplicateToken" , 6 } ,
/*0x042*/ { "NtContinue" , 2 } ,
/*0x043*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x044*/ { "NtQueueApcThread" , 5 } ,
/*0x045*/ { "NtYieldExecution" , 0 } ,
/*0x046*/ { "NtAddAtom" , 3 } ,
/*0x047*/ { "NtCreateEvent" , 5 } ,
/*0x048*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x049*/ { "NtCreateSection" , 7 } ,
/*0x04A*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04B*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04C*/ { "NtCreateProcessEx" , 9 } ,
/*0x04D*/ { "NtCreateThread" , 8 } ,
/*0x04E*/ { "NtIsProcessInJob" , 2 } ,
/*0x04F*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x050*/ { "NtQuerySection" , 5 } ,
/*0x051*/ { "NtResumeThread" , 2 } ,
/*0x052*/ { "NtTerminateThread" , 2 } ,
/*0x053*/ { "NtReadRequestData" , 6 } ,
/*0x054*/ { "NtCreateFile" , 11 } ,
/*0x055*/ { "NtQueryEvent" , 5 } ,
/*0x056*/ { "NtWriteRequestData" , 6 } ,
/*0x057*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x058*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x059*/ { "NtQuerySystemTime" , 1 } ,
/*0x05A*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05B*/ { "NtSetInformationObject" , 4 } ,
/*0x05C*/ { "NtCancelIoFile" , 2 } ,
/*0x05D*/ { "NtTraceEvent" , 4 } ,
/*0x05E*/ { "NtPowerInformation" , 5 } ,
/*0x05F*/ { "NtSetValueKey" , 6 } ,
/*0x060*/ { "NtCancelTimer" , 2 } ,
/*0x061*/ { "NtSetTimer" , 7 } ,
/*0x062*/ { "NtAccessCheck" , 8 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x082*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x083*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x084*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x085*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x086*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x087*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x088*/ { "NtAlpcSetInformation" , 4 } ,
/*0x089*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08A*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08B*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08C*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08D*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08E*/ { "NtCancelTimer2" , 2 } ,
/*0x08F*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x090*/ { "NtCommitComplete" , 2 } ,
/*0x091*/ { "NtCommitEnlistment" , 2 } ,
/*0x092*/ { "NtCommitTransaction" , 2 } ,
/*0x093*/ { "NtCompactKeys" , 2 } ,
/*0x094*/ { "NtCompareTokens" , 3 } ,
/*0x095*/ { "NtCompleteConnectPort" , 1 } ,
/*0x096*/ { "NtCompressKey" , 1 } ,
/*0x097*/ { "NtConnectPort" , 8 } ,
/*0x098*/ { "NtCreateDebugObject" , 4 } ,
/*0x099*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09A*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09B*/ { "NtCreateEnlistment" , 8 } ,
/*0x09C*/ { "NtCreateEventPair" , 3 } ,
/*0x09D*/ { "NtCreateIRTimer" , 2 } ,
/*0x09E*/ { "NtCreateIoCompletion" , 4 } ,
/*0x09F*/ { "NtCreateJobObject" , 3 } ,
/*0x0A0*/ { "NtCreateJobSet" , 3 } ,
/*0x0A1*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A2*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A3*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A4*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A5*/ { "NtCreateMutant" , 4 } ,
/*0x0A6*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0A7*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A8*/ { "NtCreatePort" , 5 } ,
/*0x0A9*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AA*/ { "NtCreateProcess" , 8 } ,
/*0x0AB*/ { "NtCreateProfile" , 9 } ,
/*0x0AC*/ { "NtCreateProfileEx" , 10 } ,
/*0x0AD*/ { "NtCreateResourceManager" , 7 } ,
/*0x0AE*/ { "NtCreateSemaphore" , 5 } ,
/*0x0AF*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B0*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B1*/ { "NtCreateTimer" , 4 } ,
/*0x0B2*/ { "NtCreateTimer2" , 5 } ,
/*0x0B3*/ { "NtCreateToken" , 13 } ,
/*0x0B4*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B5*/ { "NtCreateTransaction" , 10 } ,
/*0x0B6*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0B7*/ { "NtCreateUserProcess" , 11 } ,
/*0x0B8*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0B9*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0BA*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0BB*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0BC*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0BD*/ { "NtDebugContinue" , 3 } ,
/*0x0BE*/ { "NtDeleteAtom" , 1 } ,
/*0x0BF*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C0*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C1*/ { "NtDeleteFile" , 1 } ,
/*0x0C2*/ { "NtDeleteKey" , 1 } ,
/*0x0C3*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C4*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C5*/ { "NtDeleteValueKey" , 2 } ,
/*0x0C6*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0C7*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0C8*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0C9*/ { "NtDisplayString" , 1 } ,
/*0x0CA*/ { "NtDrawText" , 1 } ,
/*0x0CB*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0CC*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0CD*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0CE*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0CF*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D0*/ { "NtExtendSection" , 2 } ,
/*0x0D1*/ { "NtFilterBootOption" , 5 } ,
/*0x0D2*/ { "NtFilterToken" , 6 } ,
/*0x0D3*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D4*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D5*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0D6*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0D7*/ { "NtFlushKey" , 1 } ,
/*0x0D8*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0D9*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0DA*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0DB*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0DC*/ { "NtFreezeRegistry" , 1 } ,
/*0x0DD*/ { "NtFreezeTransactions" , 2 } ,
/*0x0DE*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0DF*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E0*/ { "NtGetContextThread" , 2 } ,
/*0x0E1*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E2*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E3*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E4*/ { "NtGetNextProcess" , 5 } ,
/*0x0E5*/ { "NtGetNextThread" , 6 } ,
/*0x0E6*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0E7*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0E8*/ { "NtGetWriteWatch" , 7 } ,
/*0x0E9*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0EA*/ { "NtImpersonateThread" , 3 } ,
/*0x0EB*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0EC*/ { "NtInitializeRegistry" , 1 } ,
/*0x0ED*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0EE*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0EF*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F0*/ { "NtListenPort" , 2 } ,
/*0x0F1*/ { "NtLoadDriver" , 1 } ,
/*0x0F2*/ { "NtLoadKey" , 2 } ,
/*0x0F3*/ { "NtLoadKey2" , 3 } ,
/*0x0F4*/ { "NtLoadKeyEx" , 8 } ,
/*0x0F5*/ { "NtLockFile" , 10 } ,
/*0x0F6*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0F7*/ { "NtLockRegistryKey" , 1 } ,
/*0x0F8*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0F9*/ { "NtMakePermanentObject" , 1 } ,
/*0x0FA*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0FB*/ { "NtMapCMFModule" , 6 } ,
/*0x0FC*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0FD*/ { "NtModifyBootEntry" , 1 } ,
/*0x0FE*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0FF*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x100*/ { "NtNotifyChangeKey" , 10 } ,
/*0x101*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x102*/ { "NtNotifyChangeSession" , 8 } ,
/*0x103*/ { "NtOpenEnlistment" , 5 } ,
/*0x104*/ { "NtOpenEventPair" , 3 } ,
/*0x105*/ { "NtOpenIoCompletion" , 3 } ,
/*0x106*/ { "NtOpenJobObject" , 3 } ,
/*0x107*/ { "NtOpenKeyEx" , 4 } ,
/*0x108*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x109*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x10A*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x10B*/ { "NtOpenMutant" , 3 } ,
/*0x10C*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x10D*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x10E*/ { "NtOpenProcessToken" , 3 } ,
/*0x10F*/ { "NtOpenResourceManager" , 5 } ,
/*0x110*/ { "NtOpenSemaphore" , 3 } ,
/*0x111*/ { "NtOpenSession" , 3 } ,
/*0x112*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x113*/ { "NtOpenThread" , 4 } ,
/*0x114*/ { "NtOpenTimer" , 3 } ,
/*0x115*/ { "NtOpenTransaction" , 5 } ,
/*0x116*/ { "NtOpenTransactionManager" , 6 } ,
/*0x117*/ { "NtPlugPlayControl" , 3 } ,
/*0x118*/ { "NtPrePrepareComplete" , 2 } ,
/*0x119*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x11A*/ { "NtPrepareComplete" , 2 } ,
/*0x11B*/ { "NtPrepareEnlistment" , 2 } ,
/*0x11C*/ { "NtPrivilegeCheck" , 3 } ,
/*0x11D*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x11E*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x11F*/ { "NtPropagationComplete" , 4 } ,
/*0x120*/ { "NtPropagationFailed" , 3 } ,
/*0x121*/ { "NtPulseEvent" , 2 } ,
/*0x122*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x123*/ { "NtQueryBootOptions" , 2 } ,
/*0x124*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x125*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x126*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x127*/ { "NtQueryEaFile" , 9 } ,
/*0x128*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x129*/ { "NtQueryInformationAtom" , 5 } ,
/*0x12A*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x12B*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x12C*/ { "NtQueryInformationPort" , 5 } ,
/*0x12D*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x12E*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x12F*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x130*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x131*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x132*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x133*/ { "NtQueryIoCompletion" , 5 } ,
/*0x134*/ { "NtQueryLicenseValue" , 5 } ,
/*0x135*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x136*/ { "NtQueryMutant" , 5 } ,
/*0x137*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x138*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x139*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x13A*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x13B*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x13C*/ { "NtQuerySecurityObject" , 5 } ,
/*0x13D*/ { "NtQuerySemaphore" , 5 } ,
/*0x13E*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x13F*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x140*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x141*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x142*/ { "NtQueryTimerResolution" , 3 } ,
/*0x143*/ { "NtQueryWnfStateData" , 6 } ,
/*0x144*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x145*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x146*/ { "NtRaiseException" , 3 } ,
/*0x147*/ { "NtRaiseHardError" , 6 } ,
/*0x148*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x149*/ { "NtRecoverEnlistment" , 2 } ,
/*0x14A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x14B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x14C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x14D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x14E*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x14F*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x150*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x151*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x152*/ { "NtRenameKey" , 2 } ,
/*0x153*/ { "NtRenameTransactionManager" , 2 } ,
/*0x154*/ { "NtReplaceKey" , 3 } ,
/*0x155*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x156*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x157*/ { "NtRequestPort" , 2 } ,
/*0x158*/ { "NtResetEvent" , 2 } ,
/*0x159*/ { "NtResetWriteWatch" , 3 } ,
/*0x15A*/ { "NtRestoreKey" , 3 } ,
/*0x15B*/ { "NtResumeProcess" , 1 } ,
/*0x15C*/ { "NtRollbackComplete" , 2 } ,
/*0x15D*/ { "NtRollbackEnlistment" , 2 } ,
/*0x15E*/ { "NtRollbackTransaction" , 2 } ,
/*0x15F*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x160*/ { "NtSaveKey" , 2 } ,
/*0x161*/ { "NtSaveKeyEx" , 3 } ,
/*0x162*/ { "NtSaveMergedKeys" , 3 } ,
/*0x163*/ { "NtSecureConnectPort" , 9 } ,
/*0x164*/ { "NtSerializeBoot" , 0 } ,
/*0x165*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x166*/ { "NtSetBootOptions" , 2 } ,
/*0x167*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x168*/ { "NtSetContextThread" , 2 } ,
/*0x169*/ { "NtSetDebugFilterState" , 3 } ,
/*0x16A*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x16B*/ { "NtSetDefaultLocale" , 2 } ,
/*0x16C*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x16D*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x16E*/ { "NtSetEaFile" , 4 } ,
/*0x16F*/ { "NtSetHighEventPair" , 1 } ,
/*0x170*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x171*/ { "NtSetIRTimer" , 2 } ,
/*0x172*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x173*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x174*/ { "NtSetInformationJobObject" , 4 } ,
/*0x175*/ { "NtSetInformationKey" , 4 } ,
/*0x176*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x177*/ { "NtSetInformationToken" , 4 } ,
/*0x178*/ { "NtSetInformationTransaction" , 4 } ,
/*0x179*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x17A*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x17B*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x17C*/ { "NtSetIntervalProfile" , 2 } ,
/*0x17D*/ { "NtSetIoCompletion" , 5 } ,
/*0x17E*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x17F*/ { "NtSetLdtEntries" , 6 } ,
/*0x180*/ { "NtSetLowEventPair" , 1 } ,
/*0x181*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x182*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x183*/ { "NtSetSecurityObject" , 3 } ,
/*0x184*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x185*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x186*/ { "NtSetSystemInformation" , 3 } ,
/*0x187*/ { "NtSetSystemPowerState" , 3 } ,
/*0x188*/ { "NtSetSystemTime" , 2 } ,
/*0x189*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x18A*/ { "NtSetTimer2" , 4 } ,
/*0x18B*/ { "NtSetTimerEx" , 4 } ,
/*0x18C*/ { "NtSetTimerResolution" , 3 } ,
/*0x18D*/ { "NtSetUuidSeed" , 1 } ,
/*0x18E*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x18F*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x190*/ { "NtShutdownSystem" , 1 } ,
/*0x191*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x192*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x193*/ { "NtSinglePhaseReject" , 2 } ,
/*0x194*/ { "NtStartProfile" , 1 } ,
/*0x195*/ { "NtStopProfile" , 1 } ,
/*0x196*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x197*/ { "NtSuspendProcess" , 1 } ,
/*0x198*/ { "NtSuspendThread" , 2 } ,
/*0x199*/ { "NtSystemDebugControl" , 6 } ,
/*0x19A*/ { "NtTerminateJobObject" , 2 } ,
/*0x19B*/ { "NtTestAlert" , 0 } ,
/*0x19C*/ { "NtThawRegistry" , 0 } ,
/*0x19D*/ { "NtThawTransactions" , 0 } ,
/*0x19E*/ { "NtTraceControl" , 6 } ,
/*0x19F*/ { "NtTranslateFilePath" , 4 } ,
/*0x1A0*/ { "NtUmsThreadYield" , 1 } ,
/*0x1A1*/ { "NtUnloadDriver" , 1 } ,
/*0x1A2*/ { "NtUnloadKey" , 1 } ,
/*0x1A3*/ { "NtUnloadKey2" , 2 } ,
/*0x1A4*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1A5*/ { "NtUnlockFile" , 5 } ,
/*0x1A6*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1A7*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1A8*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1A9*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1AA*/ { "NtVdmControl" , 2 } ,
/*0x1AB*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1AC*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1AD*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1AE*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1AF*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1B0*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.10240-sp0-windows-10-th1-1507 amd64
SDT_NODE static_ssdt_10_0_10240_sp0_windows_10_th1_1507_amd64[441] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x082*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x083*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x084*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x085*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x086*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x087*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x088*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x089*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08A*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08B*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08C*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08D*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08E*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08F*/ { "NtCancelTimer2" , 2 } ,
/*0x090*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x091*/ { "NtCommitComplete" , 2 } ,
/*0x092*/ { "NtCommitEnlistment" , 2 } ,
/*0x093*/ { "NtCommitTransaction" , 2 } ,
/*0x094*/ { "NtCompactKeys" , 2 } ,
/*0x095*/ { "NtCompareObjects" , 2 } ,
/*0x096*/ { "NtCompareTokens" , 3 } ,
/*0x097*/ { "NtCompleteConnectPort" , 1 } ,
/*0x098*/ { "NtCompressKey" , 1 } ,
/*0x099*/ { "NtConnectPort" , 8 } ,
/*0x09A*/ { "NtCreateDebugObject" , 4 } ,
/*0x09B*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09C*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09D*/ { "NtCreateEnlistment" , 8 } ,
/*0x09E*/ { "NtCreateEventPair" , 3 } ,
/*0x09F*/ { "NtCreateIRTimer" , 2 } ,
/*0x0A0*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A1*/ { "NtCreateJobObject" , 3 } ,
/*0x0A2*/ { "NtCreateJobSet" , 3 } ,
/*0x0A3*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A4*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A5*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A6*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A7*/ { "NtCreateMutant" , 4 } ,
/*0x0A8*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0A9*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AA*/ { "NtCreatePartition" , 5 } ,
/*0x0AB*/ { "NtCreatePort" , 5 } ,
/*0x0AC*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AD*/ { "NtCreateProcess" , 8 } ,
/*0x0AE*/ { "NtCreateProfile" , 9 } ,
/*0x0AF*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B0*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B1*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B2*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B3*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B4*/ { "NtCreateTimer" , 4 } ,
/*0x0B5*/ { "NtCreateTimer2" , 5 } ,
/*0x0B6*/ { "NtCreateToken" , 13 } ,
/*0x0B7*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B8*/ { "NtCreateTransaction" , 10 } ,
/*0x0B9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0BA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0BB*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0BC*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0BD*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0BE*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0BF*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C0*/ { "NtDebugContinue" , 3 } ,
/*0x0C1*/ { "NtDeleteAtom" , 1 } ,
/*0x0C2*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C3*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C4*/ { "NtDeleteFile" , 1 } ,
/*0x0C5*/ { "NtDeleteKey" , 1 } ,
/*0x0C6*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C7*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C8*/ { "NtDeleteValueKey" , 2 } ,
/*0x0C9*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0CA*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0CB*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0CC*/ { "NtDisplayString" , 1 } ,
/*0x0CD*/ { "NtDrawText" , 1 } ,
/*0x0CE*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0CF*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D0*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D1*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D2*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D3*/ { "NtExtendSection" , 2 } ,
/*0x0D4*/ { "NtFilterBootOption" , 5 } ,
/*0x0D5*/ { "NtFilterToken" , 6 } ,
/*0x0D6*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D7*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D8*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0D9*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0DA*/ { "NtFlushKey" , 1 } ,
/*0x0DB*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0DC*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0DD*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0DE*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0DF*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E0*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E1*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E2*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E3*/ { "NtGetContextThread" , 2 } ,
/*0x0E4*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E5*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0E6*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E7*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E8*/ { "NtGetNextProcess" , 5 } ,
/*0x0E9*/ { "NtGetNextThread" , 6 } ,
/*0x0EA*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0EB*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0EC*/ { "NtGetWriteWatch" , 7 } ,
/*0x0ED*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0EE*/ { "NtImpersonateThread" , 3 } ,
/*0x0EF*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F0*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F1*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F2*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0F3*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F4*/ { "NtListenPort" , 2 } ,
/*0x0F5*/ { "NtLoadDriver" , 1 } ,
/*0x0F6*/ { "NtLoadKey" , 2 } ,
/*0x0F7*/ { "NtLoadKey2" , 3 } ,
/*0x0F8*/ { "NtLoadKeyEx" , 8 } ,
/*0x0F9*/ { "NtLockFile" , 10 } ,
/*0x0FA*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0FB*/ { "NtLockRegistryKey" , 1 } ,
/*0x0FC*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0FD*/ { "NtMakePermanentObject" , 1 } ,
/*0x0FE*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0FF*/ { "NtManagePartition" , 5 } ,
/*0x100*/ { "NtMapCMFModule" , 6 } ,
/*0x101*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x102*/ { "NtModifyBootEntry" , 1 } ,
/*0x103*/ { "NtModifyDriverEntry" , 1 } ,
/*0x104*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x105*/ { "NtNotifyChangeKey" , 10 } ,
/*0x106*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x107*/ { "NtNotifyChangeSession" , 8 } ,
/*0x108*/ { "NtOpenEnlistment" , 5 } ,
/*0x109*/ { "NtOpenEventPair" , 3 } ,
/*0x10A*/ { "NtOpenIoCompletion" , 3 } ,
/*0x10B*/ { "NtOpenJobObject" , 3 } ,
/*0x10C*/ { "NtOpenKeyEx" , 4 } ,
/*0x10D*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x10E*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x10F*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x110*/ { "NtOpenMutant" , 3 } ,
/*0x111*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x112*/ { "NtOpenPartition" , 3 } ,
/*0x113*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x114*/ { "NtOpenProcessToken" , 3 } ,
/*0x115*/ { "NtOpenResourceManager" , 5 } ,
/*0x116*/ { "NtOpenSemaphore" , 3 } ,
/*0x117*/ { "NtOpenSession" , 3 } ,
/*0x118*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x119*/ { "NtOpenThread" , 4 } ,
/*0x11A*/ { "NtOpenTimer" , 3 } ,
/*0x11B*/ { "NtOpenTransaction" , 5 } ,
/*0x11C*/ { "NtOpenTransactionManager" , 6 } ,
/*0x11D*/ { "NtPlugPlayControl" , 3 } ,
/*0x11E*/ { "NtPrePrepareComplete" , 2 } ,
/*0x11F*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x120*/ { "NtPrepareComplete" , 2 } ,
/*0x121*/ { "NtPrepareEnlistment" , 2 } ,
/*0x122*/ { "NtPrivilegeCheck" , 3 } ,
/*0x123*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x124*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x125*/ { "NtPropagationComplete" , 4 } ,
/*0x126*/ { "NtPropagationFailed" , 3 } ,
/*0x127*/ { "NtPulseEvent" , 2 } ,
/*0x128*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x129*/ { "NtQueryBootOptions" , 2 } ,
/*0x12A*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x12B*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x12C*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x12D*/ { "NtQueryEaFile" , 9 } ,
/*0x12E*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x12F*/ { "NtQueryInformationAtom" , 5 } ,
/*0x130*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x131*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x132*/ { "NtQueryInformationPort" , 5 } ,
/*0x133*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x134*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x135*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x136*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x137*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x138*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x139*/ { "NtQueryIoCompletion" , 5 } ,
/*0x13A*/ { "NtQueryLicenseValue" , 5 } ,
/*0x13B*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x13C*/ { "NtQueryMutant" , 5 } ,
/*0x13D*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x13E*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x13F*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x140*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x141*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x142*/ { "NtQuerySecurityObject" , 5 } ,
/*0x143*/ { "NtQuerySemaphore" , 5 } ,
/*0x144*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x145*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x146*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x147*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x148*/ { "NtQueryTimerResolution" , 3 } ,
/*0x149*/ { "NtQueryWnfStateData" , 6 } ,
/*0x14A*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x14B*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x14C*/ { "NtRaiseException" , 3 } ,
/*0x14D*/ { "NtRaiseHardError" , 6 } ,
/*0x14E*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x14F*/ { "NtRecoverEnlistment" , 2 } ,
/*0x150*/ { "NtRecoverResourceManager" , 1 } ,
/*0x151*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x152*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x153*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x154*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x155*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x156*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x157*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x158*/ { "NtRenameKey" , 2 } ,
/*0x159*/ { "NtRenameTransactionManager" , 2 } ,
/*0x15A*/ { "NtReplaceKey" , 3 } ,
/*0x15B*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x15C*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x15D*/ { "NtRequestPort" , 2 } ,
/*0x15E*/ { "NtResetEvent" , 2 } ,
/*0x15F*/ { "NtResetWriteWatch" , 3 } ,
/*0x160*/ { "NtRestoreKey" , 3 } ,
/*0x161*/ { "NtResumeProcess" , 1 } ,
/*0x162*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x163*/ { "NtRollbackComplete" , 2 } ,
/*0x164*/ { "NtRollbackEnlistment" , 2 } ,
/*0x165*/ { "NtRollbackTransaction" , 2 } ,
/*0x166*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x167*/ { "NtSaveKey" , 2 } ,
/*0x168*/ { "NtSaveKeyEx" , 3 } ,
/*0x169*/ { "NtSaveMergedKeys" , 3 } ,
/*0x16A*/ { "NtSecureConnectPort" , 9 } ,
/*0x16B*/ { "NtSerializeBoot" , 0 } ,
/*0x16C*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x16D*/ { "NtSetBootOptions" , 2 } ,
/*0x16E*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x16F*/ { "NtSetContextThread" , 2 } ,
/*0x170*/ { "NtSetDebugFilterState" , 3 } ,
/*0x171*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x172*/ { "NtSetDefaultLocale" , 2 } ,
/*0x173*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x174*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x175*/ { "NtSetEaFile" , 4 } ,
/*0x176*/ { "NtSetHighEventPair" , 1 } ,
/*0x177*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x178*/ { "NtSetIRTimer" , 2 } ,
/*0x179*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x17A*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x17B*/ { "NtSetInformationJobObject" , 4 } ,
/*0x17C*/ { "NtSetInformationKey" , 4 } ,
/*0x17D*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x17E*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x17F*/ { "NtSetInformationToken" , 4 } ,
/*0x180*/ { "NtSetInformationTransaction" , 4 } ,
/*0x181*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x182*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x183*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x184*/ { "NtSetIntervalProfile" , 2 } ,
/*0x185*/ { "NtSetIoCompletion" , 5 } ,
/*0x186*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x187*/ { "NtSetLdtEntries" , 6 } ,
/*0x188*/ { "NtSetLowEventPair" , 1 } ,
/*0x189*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x18A*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x18B*/ { "NtSetSecurityObject" , 3 } ,
/*0x18C*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x18D*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x18E*/ { "NtSetSystemInformation" , 3 } ,
/*0x18F*/ { "NtSetSystemPowerState" , 3 } ,
/*0x190*/ { "NtSetSystemTime" , 2 } ,
/*0x191*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x192*/ { "NtSetTimer2" , 4 } ,
/*0x193*/ { "NtSetTimerEx" , 4 } ,
/*0x194*/ { "NtSetTimerResolution" , 3 } ,
/*0x195*/ { "NtSetUuidSeed" , 1 } ,
/*0x196*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x197*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x198*/ { "NtShutdownSystem" , 1 } ,
/*0x199*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x19A*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x19B*/ { "NtSinglePhaseReject" , 2 } ,
/*0x19C*/ { "NtStartProfile" , 1 } ,
/*0x19D*/ { "NtStopProfile" , 1 } ,
/*0x19E*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x19F*/ { "NtSuspendProcess" , 1 } ,
/*0x1A0*/ { "NtSuspendThread" , 2 } ,
/*0x1A1*/ { "NtSystemDebugControl" , 6 } ,
/*0x1A2*/ { "NtTerminateJobObject" , 2 } ,
/*0x1A3*/ { "NtTestAlert" , 0 } ,
/*0x1A4*/ { "NtThawRegistry" , 0 } ,
/*0x1A5*/ { "NtThawTransactions" , 0 } ,
/*0x1A6*/ { "NtTraceControl" , 6 } ,
/*0x1A7*/ { "NtTranslateFilePath" , 4 } ,
/*0x1A8*/ { "NtUmsThreadYield" , 1 } ,
/*0x1A9*/ { "NtUnloadDriver" , 1 } ,
/*0x1AA*/ { "NtUnloadKey" , 1 } ,
/*0x1AB*/ { "NtUnloadKey2" , 2 } ,
/*0x1AC*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1AD*/ { "NtUnlockFile" , 5 } ,
/*0x1AE*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1AF*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1B0*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1B1*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1B2*/ { "NtVdmControl" , 2 } ,
/*0x1B3*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1B4*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1B5*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1B6*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1B7*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1B8*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.10586-sp0-windows-10-th2-1511 amd64
SDT_NODE static_ssdt_10_0_10586_sp0_windows_10_th2_1511_amd64[444] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x082*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x083*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x084*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x085*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x086*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x087*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x088*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x089*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08A*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08B*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08C*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08D*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08E*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08F*/ { "NtCancelTimer2" , 2 } ,
/*0x090*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x091*/ { "NtCommitComplete" , 2 } ,
/*0x092*/ { "NtCommitEnlistment" , 2 } ,
/*0x093*/ { "NtCommitTransaction" , 2 } ,
/*0x094*/ { "NtCompactKeys" , 2 } ,
/*0x095*/ { "NtCompareObjects" , 2 } ,
/*0x096*/ { "NtCompareTokens" , 3 } ,
/*0x097*/ { "NtCompleteConnectPort" , 1 } ,
/*0x098*/ { "NtCompressKey" , 1 } ,
/*0x099*/ { "NtConnectPort" , 8 } ,
/*0x09A*/ { "NtCreateDebugObject" , 4 } ,
/*0x09B*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09C*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09D*/ { "NtCreateEnclave" , 9 } ,
/*0x09E*/ { "NtCreateEnlistment" , 8 } ,
/*0x09F*/ { "NtCreateEventPair" , 3 } ,
/*0x0A0*/ { "NtCreateIRTimer" , 2 } ,
/*0x0A1*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A2*/ { "NtCreateJobObject" , 3 } ,
/*0x0A3*/ { "NtCreateJobSet" , 3 } ,
/*0x0A4*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A5*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A6*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A7*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A8*/ { "NtCreateMutant" , 4 } ,
/*0x0A9*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0AA*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AB*/ { "NtCreatePartition" , 4 } ,
/*0x0AC*/ { "NtCreatePort" , 5 } ,
/*0x0AD*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AE*/ { "NtCreateProcess" , 8 } ,
/*0x0AF*/ { "NtCreateProfile" , 9 } ,
/*0x0B0*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B1*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B2*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B3*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B4*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B5*/ { "NtCreateTimer" , 4 } ,
/*0x0B6*/ { "NtCreateTimer2" , 5 } ,
/*0x0B7*/ { "NtCreateToken" , 13 } ,
/*0x0B8*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B9*/ { "NtCreateTransaction" , 10 } ,
/*0x0BA*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0BB*/ { "NtCreateUserProcess" , 11 } ,
/*0x0BC*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0BD*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0BE*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0BF*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0C0*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C1*/ { "NtDebugContinue" , 3 } ,
/*0x0C2*/ { "NtDeleteAtom" , 1 } ,
/*0x0C3*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C4*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C5*/ { "NtDeleteFile" , 1 } ,
/*0x0C6*/ { "NtDeleteKey" , 1 } ,
/*0x0C7*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C8*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C9*/ { "NtDeleteValueKey" , 2 } ,
/*0x0CA*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0CB*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0CC*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0CD*/ { "NtDisplayString" , 1 } ,
/*0x0CE*/ { "NtDrawText" , 1 } ,
/*0x0CF*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0D0*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D1*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D2*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D3*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D4*/ { "NtExtendSection" , 2 } ,
/*0x0D5*/ { "NtFilterBootOption" , 5 } ,
/*0x0D6*/ { "NtFilterToken" , 6 } ,
/*0x0D7*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D8*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D9*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0DA*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0DB*/ { "NtFlushKey" , 1 } ,
/*0x0DC*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0DD*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0DE*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0DF*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0E0*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E1*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E2*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E3*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E4*/ { "NtGetContextThread" , 2 } ,
/*0x0E5*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E6*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0E7*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E8*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E9*/ { "NtGetNextProcess" , 5 } ,
/*0x0EA*/ { "NtGetNextThread" , 6 } ,
/*0x0EB*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0EC*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0ED*/ { "NtGetWriteWatch" , 7 } ,
/*0x0EE*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0EF*/ { "NtImpersonateThread" , 3 } ,
/*0x0F0*/ { "NtInitializeEnclave" , 5 } ,
/*0x0F1*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F2*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F3*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F4*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0F5*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F6*/ { "NtListenPort" , 2 } ,
/*0x0F7*/ { "NtLoadDriver" , 1 } ,
/*0x0F8*/ { "NtLoadEnclaveData" , 9 } ,
/*0x0F9*/ { "NtLoadKey" , 2 } ,
/*0x0FA*/ { "NtLoadKey2" , 3 } ,
/*0x0FB*/ { "NtLoadKeyEx" , 8 } ,
/*0x0FC*/ { "NtLockFile" , 10 } ,
/*0x0FD*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0FE*/ { "NtLockRegistryKey" , 1 } ,
/*0x0FF*/ { "NtLockVirtualMemory" , 4 } ,
/*0x100*/ { "NtMakePermanentObject" , 1 } ,
/*0x101*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x102*/ { "NtManagePartition" , 5 } ,
/*0x103*/ { "NtMapCMFModule" , 6 } ,
/*0x104*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x105*/ { "NtModifyBootEntry" , 1 } ,
/*0x106*/ { "NtModifyDriverEntry" , 1 } ,
/*0x107*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x108*/ { "NtNotifyChangeKey" , 10 } ,
/*0x109*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x10A*/ { "NtNotifyChangeSession" , 8 } ,
/*0x10B*/ { "NtOpenEnlistment" , 5 } ,
/*0x10C*/ { "NtOpenEventPair" , 3 } ,
/*0x10D*/ { "NtOpenIoCompletion" , 3 } ,
/*0x10E*/ { "NtOpenJobObject" , 3 } ,
/*0x10F*/ { "NtOpenKeyEx" , 4 } ,
/*0x110*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x111*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x112*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x113*/ { "NtOpenMutant" , 3 } ,
/*0x114*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x115*/ { "NtOpenPartition" , 3 } ,
/*0x116*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x117*/ { "NtOpenProcessToken" , 3 } ,
/*0x118*/ { "NtOpenResourceManager" , 5 } ,
/*0x119*/ { "NtOpenSemaphore" , 3 } ,
/*0x11A*/ { "NtOpenSession" , 3 } ,
/*0x11B*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x11C*/ { "NtOpenThread" , 4 } ,
/*0x11D*/ { "NtOpenTimer" , 3 } ,
/*0x11E*/ { "NtOpenTransaction" , 5 } ,
/*0x11F*/ { "NtOpenTransactionManager" , 6 } ,
/*0x120*/ { "NtPlugPlayControl" , 3 } ,
/*0x121*/ { "NtPrePrepareComplete" , 2 } ,
/*0x122*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x123*/ { "NtPrepareComplete" , 2 } ,
/*0x124*/ { "NtPrepareEnlistment" , 2 } ,
/*0x125*/ { "NtPrivilegeCheck" , 3 } ,
/*0x126*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x127*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x128*/ { "NtPropagationComplete" , 4 } ,
/*0x129*/ { "NtPropagationFailed" , 3 } ,
/*0x12A*/ { "NtPulseEvent" , 2 } ,
/*0x12B*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x12C*/ { "NtQueryBootOptions" , 2 } ,
/*0x12D*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x12E*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x12F*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x130*/ { "NtQueryEaFile" , 9 } ,
/*0x131*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x132*/ { "NtQueryInformationAtom" , 5 } ,
/*0x133*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x134*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x135*/ { "NtQueryInformationPort" , 5 } ,
/*0x136*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x137*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x138*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x139*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x13A*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x13B*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x13C*/ { "NtQueryIoCompletion" , 5 } ,
/*0x13D*/ { "NtQueryLicenseValue" , 5 } ,
/*0x13E*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x13F*/ { "NtQueryMutant" , 5 } ,
/*0x140*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x141*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x142*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x143*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x144*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x145*/ { "NtQuerySecurityObject" , 5 } ,
/*0x146*/ { "NtQuerySemaphore" , 5 } ,
/*0x147*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x148*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x149*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x14A*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x14B*/ { "NtQueryTimerResolution" , 3 } ,
/*0x14C*/ { "NtQueryWnfStateData" , 6 } ,
/*0x14D*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x14E*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x14F*/ { "NtRaiseException" , 3 } ,
/*0x150*/ { "NtRaiseHardError" , 6 } ,
/*0x151*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x152*/ { "NtRecoverEnlistment" , 2 } ,
/*0x153*/ { "NtRecoverResourceManager" , 1 } ,
/*0x154*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x155*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x156*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x157*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x158*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x159*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x15A*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x15B*/ { "NtRenameKey" , 2 } ,
/*0x15C*/ { "NtRenameTransactionManager" , 2 } ,
/*0x15D*/ { "NtReplaceKey" , 3 } ,
/*0x15E*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x15F*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x160*/ { "NtRequestPort" , 2 } ,
/*0x161*/ { "NtResetEvent" , 2 } ,
/*0x162*/ { "NtResetWriteWatch" , 3 } ,
/*0x163*/ { "NtRestoreKey" , 3 } ,
/*0x164*/ { "NtResumeProcess" , 1 } ,
/*0x165*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x166*/ { "NtRollbackComplete" , 2 } ,
/*0x167*/ { "NtRollbackEnlistment" , 2 } ,
/*0x168*/ { "NtRollbackTransaction" , 2 } ,
/*0x169*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x16A*/ { "NtSaveKey" , 2 } ,
/*0x16B*/ { "NtSaveKeyEx" , 3 } ,
/*0x16C*/ { "NtSaveMergedKeys" , 3 } ,
/*0x16D*/ { "NtSecureConnectPort" , 9 } ,
/*0x16E*/ { "NtSerializeBoot" , 0 } ,
/*0x16F*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x170*/ { "NtSetBootOptions" , 2 } ,
/*0x171*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x172*/ { "NtSetContextThread" , 2 } ,
/*0x173*/ { "NtSetDebugFilterState" , 3 } ,
/*0x174*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x175*/ { "NtSetDefaultLocale" , 2 } ,
/*0x176*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x177*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x178*/ { "NtSetEaFile" , 4 } ,
/*0x179*/ { "NtSetHighEventPair" , 1 } ,
/*0x17A*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x17B*/ { "NtSetIRTimer" , 2 } ,
/*0x17C*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x17D*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x17E*/ { "NtSetInformationJobObject" , 4 } ,
/*0x17F*/ { "NtSetInformationKey" , 4 } ,
/*0x180*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x181*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x182*/ { "NtSetInformationToken" , 4 } ,
/*0x183*/ { "NtSetInformationTransaction" , 4 } ,
/*0x184*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x185*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x186*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x187*/ { "NtSetIntervalProfile" , 2 } ,
/*0x188*/ { "NtSetIoCompletion" , 5 } ,
/*0x189*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x18A*/ { "NtSetLdtEntries" , 6 } ,
/*0x18B*/ { "NtSetLowEventPair" , 1 } ,
/*0x18C*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x18D*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x18E*/ { "NtSetSecurityObject" , 3 } ,
/*0x18F*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x190*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x191*/ { "NtSetSystemInformation" , 3 } ,
/*0x192*/ { "NtSetSystemPowerState" , 3 } ,
/*0x193*/ { "NtSetSystemTime" , 2 } ,
/*0x194*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x195*/ { "NtSetTimer2" , 4 } ,
/*0x196*/ { "NtSetTimerEx" , 4 } ,
/*0x197*/ { "NtSetTimerResolution" , 3 } ,
/*0x198*/ { "NtSetUuidSeed" , 1 } ,
/*0x199*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x19A*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x19B*/ { "NtShutdownSystem" , 1 } ,
/*0x19C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x19D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x19E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x19F*/ { "NtStartProfile" , 1 } ,
/*0x1A0*/ { "NtStopProfile" , 1 } ,
/*0x1A1*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x1A2*/ { "NtSuspendProcess" , 1 } ,
/*0x1A3*/ { "NtSuspendThread" , 2 } ,
/*0x1A4*/ { "NtSystemDebugControl" , 6 } ,
/*0x1A5*/ { "NtTerminateJobObject" , 2 } ,
/*0x1A6*/ { "NtTestAlert" , 0 } ,
/*0x1A7*/ { "NtThawRegistry" , 0 } ,
/*0x1A8*/ { "NtThawTransactions" , 0 } ,
/*0x1A9*/ { "NtTraceControl" , 6 } ,
/*0x1AA*/ { "NtTranslateFilePath" , 4 } ,
/*0x1AB*/ { "NtUmsThreadYield" , 1 } ,
/*0x1AC*/ { "NtUnloadDriver" , 1 } ,
/*0x1AD*/ { "NtUnloadKey" , 1 } ,
/*0x1AE*/ { "NtUnloadKey2" , 2 } ,
/*0x1AF*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1B0*/ { "NtUnlockFile" , 5 } ,
/*0x1B1*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1B2*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1B3*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1B4*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1B5*/ { "NtVdmControl" , 2 } ,
/*0x1B6*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1B7*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1B8*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1B9*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1BA*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1BB*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.14393-sp0-windows-10-rs1-1607 amd64
SDT_NODE static_ssdt_10_0_14393_sp0_windows_10_rs1_1607_amd64[450] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x082*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x083*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x084*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x085*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x086*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x087*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x088*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x089*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08A*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08B*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08C*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08D*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08E*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08F*/ { "NtCancelTimer2" , 2 } ,
/*0x090*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x091*/ { "NtCommitComplete" , 2 } ,
/*0x092*/ { "NtCommitEnlistment" , 2 } ,
/*0x093*/ { "NtCommitRegistryTransaction" , 2 } ,
/*0x094*/ { "NtCommitTransaction" , 2 } ,
/*0x095*/ { "NtCompactKeys" , 2 } ,
/*0x096*/ { "NtCompareObjects" , 2 } ,
/*0x097*/ { "NtCompareTokens" , 3 } ,
/*0x098*/ { "NtCompleteConnectPort" , 1 } ,
/*0x099*/ { "NtCompressKey" , 1 } ,
/*0x09A*/ { "NtConnectPort" , 8 } ,
/*0x09B*/ { "NtCreateDebugObject" , 4 } ,
/*0x09C*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09D*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09E*/ { "NtCreateEnclave" , 9 } ,
/*0x09F*/ { "NtCreateEnlistment" , 8 } ,
/*0x0A0*/ { "NtCreateEventPair" , 3 } ,
/*0x0A1*/ { "NtCreateIRTimer" , 2 } ,
/*0x0A2*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A3*/ { "NtCreateJobObject" , 3 } ,
/*0x0A4*/ { "NtCreateJobSet" , 3 } ,
/*0x0A5*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A6*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A7*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A8*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A9*/ { "NtCreateMutant" , 4 } ,
/*0x0AA*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0AB*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AC*/ { "NtCreatePartition" , 4 } ,
/*0x0AD*/ { "NtCreatePort" , 5 } ,
/*0x0AE*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AF*/ { "NtCreateProcess" , 8 } ,
/*0x0B0*/ { "NtCreateProfile" , 9 } ,
/*0x0B1*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B2*/ { "NtCreateRegistryTransaction" , 4 } ,
/*0x0B3*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B4*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B5*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B6*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B7*/ { "NtCreateTimer" , 4 } ,
/*0x0B8*/ { "NtCreateTimer2" , 5 } ,
/*0x0B9*/ { "NtCreateToken" , 13 } ,
/*0x0BA*/ { "NtCreateTokenEx" , 17 } ,
/*0x0BB*/ { "NtCreateTransaction" , 10 } ,
/*0x0BC*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0BD*/ { "NtCreateUserProcess" , 11 } ,
/*0x0BE*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0BF*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0C0*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0C1*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0C2*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C3*/ { "NtDebugContinue" , 3 } ,
/*0x0C4*/ { "NtDeleteAtom" , 1 } ,
/*0x0C5*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C6*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C7*/ { "NtDeleteFile" , 1 } ,
/*0x0C8*/ { "NtDeleteKey" , 1 } ,
/*0x0C9*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0CA*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0CB*/ { "NtDeleteValueKey" , 2 } ,
/*0x0CC*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0CD*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0CE*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0CF*/ { "NtDisplayString" , 1 } ,
/*0x0D0*/ { "NtDrawText" , 1 } ,
/*0x0D1*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0D2*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D3*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D4*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D5*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D6*/ { "NtExtendSection" , 2 } ,
/*0x0D7*/ { "NtFilterBootOption" , 5 } ,
/*0x0D8*/ { "NtFilterToken" , 6 } ,
/*0x0D9*/ { "NtFilterTokenEx" , 14 } ,
/*0x0DA*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0DB*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0DC*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0DD*/ { "NtFlushKey" , 1 } ,
/*0x0DE*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0DF*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0E0*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0E1*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0E2*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E3*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E4*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E5*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E6*/ { "NtGetContextThread" , 2 } ,
/*0x0E7*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E8*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0E9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0EA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0EB*/ { "NtGetNextProcess" , 5 } ,
/*0x0EC*/ { "NtGetNextThread" , 6 } ,
/*0x0ED*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0EE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0EF*/ { "NtGetWriteWatch" , 7 } ,
/*0x0F0*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0F1*/ { "NtImpersonateThread" , 3 } ,
/*0x0F2*/ { "NtInitializeEnclave" , 5 } ,
/*0x0F3*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0F7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F8*/ { "NtListenPort" , 2 } ,
/*0x0F9*/ { "NtLoadDriver" , 1 } ,
/*0x0FA*/ { "NtLoadEnclaveData" , 9 } ,
/*0x0FB*/ { "NtLoadKey" , 2 } ,
/*0x0FC*/ { "NtLoadKey2" , 3 } ,
/*0x0FD*/ { "NtLoadKeyEx" , 8 } ,
/*0x0FE*/ { "NtLockFile" , 10 } ,
/*0x0FF*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x100*/ { "NtLockRegistryKey" , 1 } ,
/*0x101*/ { "NtLockVirtualMemory" , 4 } ,
/*0x102*/ { "NtMakePermanentObject" , 1 } ,
/*0x103*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x104*/ { "NtManagePartition" , 5 } ,
/*0x105*/ { "NtMapCMFModule" , 6 } ,
/*0x106*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x107*/ { "NtModifyBootEntry" , 1 } ,
/*0x108*/ { "NtModifyDriverEntry" , 1 } ,
/*0x109*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x10A*/ { "NtNotifyChangeKey" , 10 } ,
/*0x10B*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x10C*/ { "NtNotifyChangeSession" , 8 } ,
/*0x10D*/ { "NtOpenEnlistment" , 5 } ,
/*0x10E*/ { "NtOpenEventPair" , 3 } ,
/*0x10F*/ { "NtOpenIoCompletion" , 3 } ,
/*0x110*/ { "NtOpenJobObject" , 3 } ,
/*0x111*/ { "NtOpenKeyEx" , 4 } ,
/*0x112*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x113*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x114*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x115*/ { "NtOpenMutant" , 3 } ,
/*0x116*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x117*/ { "NtOpenPartition" , 3 } ,
/*0x118*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x119*/ { "NtOpenProcessToken" , 3 } ,
/*0x11A*/ { "NtOpenRegistryTransaction" , 3 } ,
/*0x11B*/ { "NtOpenResourceManager" , 5 } ,
/*0x11C*/ { "NtOpenSemaphore" , 3 } ,
/*0x11D*/ { "NtOpenSession" , 3 } ,
/*0x11E*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x11F*/ { "NtOpenThread" , 4 } ,
/*0x120*/ { "NtOpenTimer" , 3 } ,
/*0x121*/ { "NtOpenTransaction" , 5 } ,
/*0x122*/ { "NtOpenTransactionManager" , 6 } ,
/*0x123*/ { "NtPlugPlayControl" , 3 } ,
/*0x124*/ { "NtPrePrepareComplete" , 2 } ,
/*0x125*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x126*/ { "NtPrepareComplete" , 2 } ,
/*0x127*/ { "NtPrepareEnlistment" , 2 } ,
/*0x128*/ { "NtPrivilegeCheck" , 3 } ,
/*0x129*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x12A*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x12B*/ { "NtPropagationComplete" , 4 } ,
/*0x12C*/ { "NtPropagationFailed" , 3 } ,
/*0x12D*/ { "NtPulseEvent" , 2 } ,
/*0x12E*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x12F*/ { "NtQueryBootOptions" , 2 } ,
/*0x130*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x131*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x132*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x133*/ { "NtQueryEaFile" , 9 } ,
/*0x134*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x135*/ { "NtQueryInformationAtom" , 5 } ,
/*0x136*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x137*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x138*/ { "NtQueryInformationPort" , 5 } ,
/*0x139*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x13A*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x13B*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x13C*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x13D*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x13E*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x13F*/ { "NtQueryIoCompletion" , 5 } ,
/*0x140*/ { "NtQueryLicenseValue" , 5 } ,
/*0x141*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x142*/ { "NtQueryMutant" , 5 } ,
/*0x143*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x144*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x145*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x146*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x147*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x148*/ { "NtQuerySecurityObject" , 5 } ,
/*0x149*/ { "NtQuerySecurityPolicy" , 6 } ,
/*0x14A*/ { "NtQuerySemaphore" , 5 } ,
/*0x14B*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x14C*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x14D*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x14E*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x14F*/ { "NtQueryTimerResolution" , 3 } ,
/*0x150*/ { "NtQueryWnfStateData" , 6 } ,
/*0x151*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x152*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x153*/ { "NtRaiseException" , 3 } ,
/*0x154*/ { "NtRaiseHardError" , 6 } ,
/*0x155*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x156*/ { "NtRecoverEnlistment" , 2 } ,
/*0x157*/ { "NtRecoverResourceManager" , 1 } ,
/*0x158*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x159*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x15A*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x15B*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x15C*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x15D*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x15E*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x15F*/ { "NtRenameKey" , 2 } ,
/*0x160*/ { "NtRenameTransactionManager" , 2 } ,
/*0x161*/ { "NtReplaceKey" , 3 } ,
/*0x162*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x163*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x164*/ { "NtRequestPort" , 2 } ,
/*0x165*/ { "NtResetEvent" , 2 } ,
/*0x166*/ { "NtResetWriteWatch" , 3 } ,
/*0x167*/ { "NtRestoreKey" , 3 } ,
/*0x168*/ { "NtResumeProcess" , 1 } ,
/*0x169*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x16A*/ { "NtRollbackComplete" , 2 } ,
/*0x16B*/ { "NtRollbackEnlistment" , 2 } ,
/*0x16C*/ { "NtRollbackRegistryTransaction" , 2 } ,
/*0x16D*/ { "NtRollbackTransaction" , 2 } ,
/*0x16E*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x16F*/ { "NtSaveKey" , 2 } ,
/*0x170*/ { "NtSaveKeyEx" , 3 } ,
/*0x171*/ { "NtSaveMergedKeys" , 3 } ,
/*0x172*/ { "NtSecureConnectPort" , 9 } ,
/*0x173*/ { "NtSerializeBoot" , 0 } ,
/*0x174*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x175*/ { "NtSetBootOptions" , 2 } ,
/*0x176*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x177*/ { "NtSetCachedSigningLevel2" , 6 } ,
/*0x178*/ { "NtSetContextThread" , 2 } ,
/*0x179*/ { "NtSetDebugFilterState" , 3 } ,
/*0x17A*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x17B*/ { "NtSetDefaultLocale" , 2 } ,
/*0x17C*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x17D*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x17E*/ { "NtSetEaFile" , 4 } ,
/*0x17F*/ { "NtSetHighEventPair" , 1 } ,
/*0x180*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x181*/ { "NtSetIRTimer" , 2 } ,
/*0x182*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x183*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x184*/ { "NtSetInformationJobObject" , 4 } ,
/*0x185*/ { "NtSetInformationKey" , 4 } ,
/*0x186*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x187*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x188*/ { "NtSetInformationToken" , 4 } ,
/*0x189*/ { "NtSetInformationTransaction" , 4 } ,
/*0x18A*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x18B*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x18C*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x18D*/ { "NtSetIntervalProfile" , 2 } ,
/*0x18E*/ { "NtSetIoCompletion" , 5 } ,
/*0x18F*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x190*/ { "NtSetLdtEntries" , 6 } ,
/*0x191*/ { "NtSetLowEventPair" , 1 } ,
/*0x192*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x193*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x194*/ { "NtSetSecurityObject" , 3 } ,
/*0x195*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x196*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x197*/ { "NtSetSystemInformation" , 3 } ,
/*0x198*/ { "NtSetSystemPowerState" , 3 } ,
/*0x199*/ { "NtSetSystemTime" , 2 } ,
/*0x19A*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x19B*/ { "NtSetTimer2" , 4 } ,
/*0x19C*/ { "NtSetTimerEx" , 4 } ,
/*0x19D*/ { "NtSetTimerResolution" , 3 } ,
/*0x19E*/ { "NtSetUuidSeed" , 1 } ,
/*0x19F*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x1A0*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x1A1*/ { "NtShutdownSystem" , 1 } ,
/*0x1A2*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x1A3*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x1A4*/ { "NtSinglePhaseReject" , 2 } ,
/*0x1A5*/ { "NtStartProfile" , 1 } ,
/*0x1A6*/ { "NtStopProfile" , 1 } ,
/*0x1A7*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x1A8*/ { "NtSuspendProcess" , 1 } ,
/*0x1A9*/ { "NtSuspendThread" , 2 } ,
/*0x1AA*/ { "NtSystemDebugControl" , 6 } ,
/*0x1AB*/ { "NtTerminateJobObject" , 2 } ,
/*0x1AC*/ { "NtTestAlert" , 0 } ,
/*0x1AD*/ { "NtThawRegistry" , 0 } ,
/*0x1AE*/ { "NtThawTransactions" , 0 } ,
/*0x1AF*/ { "NtTraceControl" , 6 } ,
/*0x1B0*/ { "NtTranslateFilePath" , 4 } ,
/*0x1B1*/ { "NtUmsThreadYield" , 1 } ,
/*0x1B2*/ { "NtUnloadDriver" , 1 } ,
/*0x1B3*/ { "NtUnloadKey" , 1 } ,
/*0x1B4*/ { "NtUnloadKey2" , 2 } ,
/*0x1B5*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1B6*/ { "NtUnlockFile" , 5 } ,
/*0x1B7*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1B8*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1B9*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1BA*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1BB*/ { "NtVdmControl" , 2 } ,
/*0x1BC*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1BD*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1BE*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1BF*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1C0*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1C1*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.15063-sp0-windows-10-rs2-1703 amd64
SDT_NODE static_ssdt_10_0_15063_sp0_windows_10_rs2_1703_amd64[456] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAcquireProcessActivityReference" , 3 } ,
/*0x068*/ { "NtAddAtomEx" , 4 } ,
/*0x069*/ { "NtAddBootEntry" , 2 } ,
/*0x06A*/ { "NtAddDriverEntry" , 2 } ,
/*0x06B*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06C*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06D*/ { "NtAlertResumeThread" , 2 } ,
/*0x06E*/ { "NtAlertThread" , 1 } ,
/*0x06F*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x070*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x071*/ { "NtAllocateReserveObject" , 3 } ,
/*0x072*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x073*/ { "NtAllocateUuids" , 4 } ,
/*0x074*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x075*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x076*/ { "NtAlpcConnectPort" , 11 } ,
/*0x077*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x078*/ { "NtAlpcCreatePort" , 3 } ,
/*0x079*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x07A*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07B*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07C*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07D*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x080*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x081*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x082*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x083*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x084*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x085*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x086*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x087*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x088*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x089*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x08A*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08B*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08C*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08D*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08E*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08F*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x090*/ { "NtCancelTimer2" , 2 } ,
/*0x091*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x092*/ { "NtCommitComplete" , 2 } ,
/*0x093*/ { "NtCommitEnlistment" , 2 } ,
/*0x094*/ { "NtCommitRegistryTransaction" , 2 } ,
/*0x095*/ { "NtCommitTransaction" , 2 } ,
/*0x096*/ { "NtCompactKeys" , 2 } ,
/*0x097*/ { "NtCompareObjects" , 2 } ,
/*0x098*/ { "NtCompareSigningLevels" , 2 } ,
/*0x099*/ { "NtCompareTokens" , 3 } ,
/*0x09A*/ { "NtCompleteConnectPort" , 1 } ,
/*0x09B*/ { "NtCompressKey" , 1 } ,
/*0x09C*/ { "NtConnectPort" , 8 } ,
/*0x09D*/ { "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter" , 4 } ,
/*0x09E*/ { "NtCreateDebugObject" , 4 } ,
/*0x09F*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x0A0*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x0A1*/ { "NtCreateEnclave" , 9 } ,
/*0x0A2*/ { "NtCreateEnlistment" , 8 } ,
/*0x0A3*/ { "NtCreateEventPair" , 3 } ,
/*0x0A4*/ { "NtCreateIRTimer" , 3 } ,
/*0x0A5*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A6*/ { "NtCreateJobObject" , 3 } ,
/*0x0A7*/ { "NtCreateJobSet" , 3 } ,
/*0x0A8*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A9*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0AA*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0AB*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0AC*/ { "NtCreateMutant" , 4 } ,
/*0x0AD*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0AE*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AF*/ { "NtCreatePartition" , 4 } ,
/*0x0B0*/ { "NtCreatePort" , 5 } ,
/*0x0B1*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0B2*/ { "NtCreateProcess" , 8 } ,
/*0x0B3*/ { "NtCreateProfile" , 9 } ,
/*0x0B4*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B5*/ { "NtCreateRegistryTransaction" , 4 } ,
/*0x0B6*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B7*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B8*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B9*/ { "NtCreateThreadEx" , 11 } ,
/*0x0BA*/ { "NtCreateTimer" , 4 } ,
/*0x0BB*/ { "NtCreateTimer2" , 5 } ,
/*0x0BC*/ { "NtCreateToken" , 13 } ,
/*0x0BD*/ { "NtCreateTokenEx" , 17 } ,
/*0x0BE*/ { "NtCreateTransaction" , 10 } ,
/*0x0BF*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0C0*/ { "NtCreateUserProcess" , 11 } ,
/*0x0C1*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0C2*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0C3*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0C4*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0C5*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C6*/ { "NtDebugContinue" , 3 } ,
/*0x0C7*/ { "NtDeleteAtom" , 1 } ,
/*0x0C8*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C9*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0CA*/ { "NtDeleteFile" , 1 } ,
/*0x0CB*/ { "NtDeleteKey" , 1 } ,
/*0x0CC*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0CD*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0CE*/ { "NtDeleteValueKey" , 2 } ,
/*0x0CF*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0D0*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0D1*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0D2*/ { "NtDisplayString" , 1 } ,
/*0x0D3*/ { "NtDrawText" , 1 } ,
/*0x0D4*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0D5*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D6*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D7*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D8*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D9*/ { "NtExtendSection" , 2 } ,
/*0x0DA*/ { "NtFilterBootOption" , 5 } ,
/*0x0DB*/ { "NtFilterToken" , 6 } ,
/*0x0DC*/ { "NtFilterTokenEx" , 14 } ,
/*0x0DD*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0DE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0DF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0E0*/ { "NtFlushKey" , 1 } ,
/*0x0E1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0E2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0E3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0E4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E7*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E8*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E9*/ { "NtGetContextThread" , 2 } ,
/*0x0EA*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0EB*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0EC*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0ED*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0EE*/ { "NtGetNextProcess" , 5 } ,
/*0x0EF*/ { "NtGetNextThread" , 6 } ,
/*0x0F0*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0F1*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0F2*/ { "NtGetWriteWatch" , 7 } ,
/*0x0F3*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0F4*/ { "NtImpersonateThread" , 3 } ,
/*0x0F5*/ { "NtInitializeEnclave" , 5 } ,
/*0x0F6*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F7*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F8*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F9*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0FA*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0FB*/ { "NtListenPort" , 2 } ,
/*0x0FC*/ { "NtLoadDriver" , 1 } ,
/*0x0FD*/ { "NtLoadEnclaveData" , 9 } ,
/*0x0FE*/ { "NtLoadHotPatch" , 2 } ,
/*0x0FF*/ { "NtLoadKey" , 2 } ,
/*0x100*/ { "NtLoadKey2" , 3 } ,
/*0x101*/ { "NtLoadKeyEx" , 8 } ,
/*0x102*/ { "NtLockFile" , 10 } ,
/*0x103*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x104*/ { "NtLockRegistryKey" , 1 } ,
/*0x105*/ { "NtLockVirtualMemory" , 4 } ,
/*0x106*/ { "NtMakePermanentObject" , 1 } ,
/*0x107*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x108*/ { "NtManagePartition" , 5 } ,
/*0x109*/ { "NtMapCMFModule" , 6 } ,
/*0x10A*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x10B*/ { "NtModifyBootEntry" , 1 } ,
/*0x10C*/ { "NtModifyDriverEntry" , 1 } ,
/*0x10D*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x10E*/ { "NtNotifyChangeKey" , 10 } ,
/*0x10F*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x110*/ { "NtNotifyChangeSession" , 8 } ,
/*0x111*/ { "NtOpenEnlistment" , 5 } ,
/*0x112*/ { "NtOpenEventPair" , 3 } ,
/*0x113*/ { "NtOpenIoCompletion" , 3 } ,
/*0x114*/ { "NtOpenJobObject" , 3 } ,
/*0x115*/ { "NtOpenKeyEx" , 4 } ,
/*0x116*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x117*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x118*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x119*/ { "NtOpenMutant" , 3 } ,
/*0x11A*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x11B*/ { "NtOpenPartition" , 3 } ,
/*0x11C*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x11D*/ { "NtOpenProcessToken" , 3 } ,
/*0x11E*/ { "NtOpenRegistryTransaction" , 3 } ,
/*0x11F*/ { "NtOpenResourceManager" , 5 } ,
/*0x120*/ { "NtOpenSemaphore" , 3 } ,
/*0x121*/ { "NtOpenSession" , 3 } ,
/*0x122*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtOpenThread" , 4 } ,
/*0x124*/ { "NtOpenTimer" , 3 } ,
/*0x125*/ { "NtOpenTransaction" , 5 } ,
/*0x126*/ { "NtOpenTransactionManager" , 6 } ,
/*0x127*/ { "NtPlugPlayControl" , 3 } ,
/*0x128*/ { "NtPrePrepareComplete" , 2 } ,
/*0x129*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x12A*/ { "NtPrepareComplete" , 2 } ,
/*0x12B*/ { "NtPrepareEnlistment" , 2 } ,
/*0x12C*/ { "NtPrivilegeCheck" , 3 } ,
/*0x12D*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x12E*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x12F*/ { "NtPropagationComplete" , 4 } ,
/*0x130*/ { "NtPropagationFailed" , 3 } ,
/*0x131*/ { "NtPulseEvent" , 2 } ,
/*0x132*/ { "NtQueryAuxiliaryCounterFrequency" , 1 } ,
/*0x133*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x134*/ { "NtQueryBootOptions" , 2 } ,
/*0x135*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x136*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x137*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x138*/ { "NtQueryEaFile" , 9 } ,
/*0x139*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x13A*/ { "NtQueryInformationAtom" , 5 } ,
/*0x13B*/ { "NtQueryInformationByName" , 5 } ,
/*0x13C*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x13D*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x13E*/ { "NtQueryInformationPort" , 5 } ,
/*0x13F*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x140*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x141*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x142*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x143*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x144*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x145*/ { "NtQueryIoCompletion" , 5 } ,
/*0x146*/ { "NtQueryLicenseValue" , 5 } ,
/*0x147*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x148*/ { "NtQueryMutant" , 5 } ,
/*0x149*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x14A*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x14B*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x14C*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x14D*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x14E*/ { "NtQuerySecurityObject" , 5 } ,
/*0x14F*/ { "NtQuerySecurityPolicy" , 6 } ,
/*0x150*/ { "NtQuerySemaphore" , 5 } ,
/*0x151*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x152*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x153*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x154*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x155*/ { "NtQueryTimerResolution" , 3 } ,
/*0x156*/ { "NtQueryWnfStateData" , 6 } ,
/*0x157*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x158*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x159*/ { "NtRaiseException" , 3 } ,
/*0x15A*/ { "NtRaiseHardError" , 6 } ,
/*0x15B*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x15C*/ { "NtRecoverEnlistment" , 2 } ,
/*0x15D*/ { "NtRecoverResourceManager" , 1 } ,
/*0x15E*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x15F*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x160*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x161*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x162*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x163*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x164*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x165*/ { "NtRenameKey" , 2 } ,
/*0x166*/ { "NtRenameTransactionManager" , 2 } ,
/*0x167*/ { "NtReplaceKey" , 3 } ,
/*0x168*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x169*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x16A*/ { "NtRequestPort" , 2 } ,
/*0x16B*/ { "NtResetEvent" , 2 } ,
/*0x16C*/ { "NtResetWriteWatch" , 3 } ,
/*0x16D*/ { "NtRestoreKey" , 3 } ,
/*0x16E*/ { "NtResumeProcess" , 1 } ,
/*0x16F*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x170*/ { "NtRollbackComplete" , 2 } ,
/*0x171*/ { "NtRollbackEnlistment" , 2 } ,
/*0x172*/ { "NtRollbackRegistryTransaction" , 2 } ,
/*0x173*/ { "NtRollbackTransaction" , 2 } ,
/*0x174*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x175*/ { "NtSaveKey" , 2 } ,
/*0x176*/ { "NtSaveKeyEx" , 3 } ,
/*0x177*/ { "NtSaveMergedKeys" , 3 } ,
/*0x178*/ { "NtSecureConnectPort" , 9 } ,
/*0x179*/ { "NtSerializeBoot" , 0 } ,
/*0x17A*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x17B*/ { "NtSetBootOptions" , 2 } ,
/*0x17C*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x17D*/ { "NtSetCachedSigningLevel2" , 6 } ,
/*0x17E*/ { "NtSetContextThread" , 2 } ,
/*0x17F*/ { "NtSetDebugFilterState" , 3 } ,
/*0x180*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x181*/ { "NtSetDefaultLocale" , 2 } ,
/*0x182*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x183*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x184*/ { "NtSetEaFile" , 4 } ,
/*0x185*/ { "NtSetHighEventPair" , 1 } ,
/*0x186*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x187*/ { "NtSetIRTimer" , 2 } ,
/*0x188*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x189*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x18A*/ { "NtSetInformationJobObject" , 4 } ,
/*0x18B*/ { "NtSetInformationKey" , 4 } ,
/*0x18C*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x18D*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x18E*/ { "NtSetInformationToken" , 4 } ,
/*0x18F*/ { "NtSetInformationTransaction" , 4 } ,
/*0x190*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x191*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x192*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x193*/ { "NtSetIntervalProfile" , 2 } ,
/*0x194*/ { "NtSetIoCompletion" , 5 } ,
/*0x195*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x196*/ { "NtSetLdtEntries" , 6 } ,
/*0x197*/ { "NtSetLowEventPair" , 1 } ,
/*0x198*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x199*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x19A*/ { "NtSetSecurityObject" , 3 } ,
/*0x19B*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x19C*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x19D*/ { "NtSetSystemInformation" , 3 } ,
/*0x19E*/ { "NtSetSystemPowerState" , 3 } ,
/*0x19F*/ { "NtSetSystemTime" , 2 } ,
/*0x1A0*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x1A1*/ { "NtSetTimer2" , 4 } ,
/*0x1A2*/ { "NtSetTimerEx" , 4 } ,
/*0x1A3*/ { "NtSetTimerResolution" , 3 } ,
/*0x1A4*/ { "NtSetUuidSeed" , 1 } ,
/*0x1A5*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x1A6*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x1A7*/ { "NtShutdownSystem" , 1 } ,
/*0x1A8*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x1A9*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x1AA*/ { "NtSinglePhaseReject" , 2 } ,
/*0x1AB*/ { "NtStartProfile" , 1 } ,
/*0x1AC*/ { "NtStopProfile" , 1 } ,
/*0x1AD*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x1AE*/ { "NtSuspendProcess" , 1 } ,
/*0x1AF*/ { "NtSuspendThread" , 2 } ,
/*0x1B0*/ { "NtSystemDebugControl" , 6 } ,
/*0x1B1*/ { "NtTerminateJobObject" , 2 } ,
/*0x1B2*/ { "NtTestAlert" , 0 } ,
/*0x1B3*/ { "NtThawRegistry" , 0 } ,
/*0x1B4*/ { "NtThawTransactions" , 0 } ,
/*0x1B5*/ { "NtTraceControl" , 6 } ,
/*0x1B6*/ { "NtTranslateFilePath" , 4 } ,
/*0x1B7*/ { "NtUmsThreadYield" , 1 } ,
/*0x1B8*/ { "NtUnloadDriver" , 1 } ,
/*0x1B9*/ { "NtUnloadKey" , 1 } ,
/*0x1BA*/ { "NtUnloadKey2" , 2 } ,
/*0x1BB*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1BC*/ { "NtUnlockFile" , 5 } ,
/*0x1BD*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1BE*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1BF*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1C0*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1C1*/ { "NtVdmControl" , 2 } ,
/*0x1C2*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1C3*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1C4*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1C5*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1C6*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1C7*/ { "NtWaitLowEventPair" , 1 }
};
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化