代码拉取完成,页面将自动刷新
同步操作将从 zys/windows-syscall-table 强制同步,此操作会覆盖自 Fork 仓库以来所做的任何修改,且无法恢复!!!
确定后同步将在后台操作,完成时将刷新页面,请耐心等待。
// ssdt table for 6.0.6000-sp0-windows-vista amd64
SDT_NODE static_ssdt_6_0_6000_sp0_windows_vista_amd64[398] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtClearAllSavepointsTransaction" , 1 } ,
/*0x08A*/ { "NtClearSavepointTransaction" , 2 } ,
/*0x08B*/ { "NtCommitComplete" , 2 } ,
/*0x08C*/ { "NtCommitEnlistment" , 2 } ,
/*0x08D*/ { "NtCommitTransaction" , 2 } ,
/*0x08E*/ { "NtCompactKeys" , 2 } ,
/*0x08F*/ { "NtCompareTokens" , 3 } ,
/*0x090*/ { "NtCompleteConnectPort" , 1 } ,
/*0x091*/ { "NtCompressKey" , 1 } ,
/*0x092*/ { "NtConnectPort" , 8 } ,
/*0x093*/ { "NtCreateDebugObject" , 4 } ,
/*0x094*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x095*/ { "NtCreateEnlistment" , 8 } ,
/*0x096*/ { "NtCreateEventPair" , 3 } ,
/*0x097*/ { "NtCreateIoCompletion" , 4 } ,
/*0x098*/ { "NtCreateJobObject" , 3 } ,
/*0x099*/ { "NtCreateJobSet" , 3 } ,
/*0x09A*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x09B*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09C*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09D*/ { "NtCreateMutant" , 4 } ,
/*0x09E*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09F*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A0*/ { "NtCreatePort" , 5 } ,
/*0x0A1*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A2*/ { "NtCreateProcess" , 8 } ,
/*0x0A3*/ { "NtCreateProfile" , 9 } ,
/*0x0A4*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A5*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A6*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A7*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A8*/ { "NtCreateTimer" , 4 } ,
/*0x0A9*/ { "NtCreateToken" , 13 } ,
/*0x0AA*/ { "NtCreateTransaction" , 10 } ,
/*0x0AB*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AC*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AD*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AE*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AF*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0B0*/ { "NtDebugContinue" , 3 } ,
/*0x0B1*/ { "NtDeleteAtom" , 1 } ,
/*0x0B2*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B3*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B4*/ { "NtDeleteFile" , 1 } ,
/*0x0B5*/ { "NtDeleteKey" , 1 } ,
/*0x0B6*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B7*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B8*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B9*/ { "NtDisplayString" , 1 } ,
/*0x0BA*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BB*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BD*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BE*/ { "NtExtendSection" , 2 } ,
/*0x0BF*/ { "NtFilterToken" , 6 } ,
/*0x0C0*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C1*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C2*/ { "NtFlushKey" , 1 } ,
/*0x0C3*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C4*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C5*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C6*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C7*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C8*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C9*/ { "NtGetContextThread" , 2 } ,
/*0x0CA*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CB*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CC*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CD*/ { "NtGetNextProcess" , 5 } ,
/*0x0CE*/ { "NtGetNextThread" , 6 } ,
/*0x0CF*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D0*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D1*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D2*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D3*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D4*/ { "NtImpersonateThread" , 3 } ,
/*0x0D5*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D6*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D7*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D8*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D9*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DA*/ { "NtListTransactions" , 3 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtMarshallTransaction" , 6 } ,
/*0x0E9*/ { "NtModifyBootEntry" , 1 } ,
/*0x0EA*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EB*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EC*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0ED*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F3*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F4*/ { "NtOpenMutant" , 3 } ,
/*0x0F5*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F6*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F7*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F8*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F9*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FA*/ { "NtOpenSession" , 3 } ,
/*0x0FB*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FC*/ { "NtOpenThread" , 4 } ,
/*0x0FD*/ { "NtOpenTimer" , 3 } ,
/*0x0FE*/ { "NtOpenTransaction" , 5 } ,
/*0x0FF*/ { "NtOpenTransactionManager" , 6 } ,
/*0x100*/ { "NtPlugPlayControl" , 3 } ,
/*0x101*/ { "NtPrePrepareComplete" , 2 } ,
/*0x102*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x103*/ { "NtPrepareComplete" , 2 } ,
/*0x104*/ { "NtPrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrivilegeCheck" , 3 } ,
/*0x106*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x107*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x108*/ { "NtPropagationComplete" , 4 } ,
/*0x109*/ { "NtPropagationFailed" , 3 } ,
/*0x10A*/ { "NtPullTransaction" , 7 } ,
/*0x10B*/ { "NtPulseEvent" , 2 } ,
/*0x10C*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10D*/ { "NtQueryBootOptions" , 2 } ,
/*0x10E*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10F*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x110*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x111*/ { "NtQueryEaFile" , 9 } ,
/*0x112*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x113*/ { "NtQueryInformationAtom" , 5 } ,
/*0x114*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x115*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x116*/ { "NtQueryInformationPort" , 5 } ,
/*0x117*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x118*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x119*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11A*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11B*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11C*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11D*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11E*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11F*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x120*/ { "NtQueryMutant" , 5 } ,
/*0x121*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x122*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x123*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x124*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x125*/ { "NtQuerySecurityObject" , 5 } ,
/*0x126*/ { "NtQuerySemaphore" , 5 } ,
/*0x127*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x128*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x129*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12A*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12B*/ { "NtRaiseException" , 3 } ,
/*0x12C*/ { "NtRaiseHardError" , 6 } ,
/*0x12D*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x12E*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12F*/ { "NtRecoverResourceManager" , 1 } ,
/*0x130*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x131*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x132*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x133*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x134*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x135*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x136*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x137*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x138*/ { "NtRenameKey" , 2 } ,
/*0x139*/ { "NtReplaceKey" , 3 } ,
/*0x13A*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x13B*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x13C*/ { "NtRequestPort" , 2 } ,
/*0x13D*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13E*/ { "NtResetEvent" , 2 } ,
/*0x13F*/ { "NtResetWriteWatch" , 3 } ,
/*0x140*/ { "NtRestoreKey" , 3 } ,
/*0x141*/ { "NtResumeProcess" , 1 } ,
/*0x142*/ { "NtRollbackComplete" , 2 } ,
/*0x143*/ { "NtRollbackEnlistment" , 2 } ,
/*0x144*/ { "NtRollbackSavepointTransaction" , 2 } ,
/*0x145*/ { "NtRollbackTransaction" , 2 } ,
/*0x146*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x147*/ { "NtSaveKey" , 2 } ,
/*0x148*/ { "NtSaveKeyEx" , 3 } ,
/*0x149*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14A*/ { "NtSavepointComplete" , 2 } ,
/*0x14B*/ { "NtSavepointTransaction" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14E*/ { "NtSetBootOptions" , 2 } ,
/*0x14F*/ { "NtSetContextThread" , 2 } ,
/*0x150*/ { "NtSetDebugFilterState" , 3 } ,
/*0x151*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x152*/ { "NtSetDefaultLocale" , 2 } ,
/*0x153*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x154*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x155*/ { "NtSetEaFile" , 4 } ,
/*0x156*/ { "NtSetHighEventPair" , 1 } ,
/*0x157*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x158*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x159*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15A*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15B*/ { "NtSetInformationKey" , 4 } ,
/*0x15C*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15D*/ { "NtSetInformationToken" , 4 } ,
/*0x15E*/ { "NtSetInformationTransaction" , 4 } ,
/*0x15F*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x160*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x161*/ { "NtSetIntervalProfile" , 2 } ,
/*0x162*/ { "NtSetIoCompletion" , 5 } ,
/*0x163*/ { "NtSetLdtEntries" , 6 } ,
/*0x164*/ { "NtSetLowEventPair" , 1 } ,
/*0x165*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x166*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x167*/ { "NtSetSecurityObject" , 3 } ,
/*0x168*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x169*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16A*/ { "NtSetSystemInformation" , 3 } ,
/*0x16B*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16C*/ { "NtSetSystemTime" , 2 } ,
/*0x16D*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x16E*/ { "NtSetTimerResolution" , 3 } ,
/*0x16F*/ { "NtSetUuidSeed" , 1 } ,
/*0x170*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x171*/ { "NtShutdownSystem" , 1 } ,
/*0x172*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x173*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x174*/ { "NtSinglePhaseReject" , 2 } ,
/*0x175*/ { "NtStartProfile" , 1 } ,
/*0x176*/ { "NtStartTm" , 0 } ,
/*0x177*/ { "NtStopProfile" , 1 } ,
/*0x178*/ { "NtSuspendProcess" , 1 } ,
/*0x179*/ { "NtSuspendThread" , 2 } ,
/*0x17A*/ { "NtSystemDebugControl" , 6 } ,
/*0x17B*/ { "NtTerminateJobObject" , 2 } ,
/*0x17C*/ { "NtTestAlert" , 0 } ,
/*0x17D*/ { "NtThawRegistry" , 0 } ,
/*0x17E*/ { "NtThawTransactions" , 0 } ,
/*0x17F*/ { "NtTraceControl" , 6 } ,
/*0x180*/ { "NtTranslateFilePath" , 4 } ,
/*0x181*/ { "NtUnloadDriver" , 1 } ,
/*0x182*/ { "NtUnloadKey" , 1 } ,
/*0x183*/ { "NtUnloadKey2" , 2 } ,
/*0x184*/ { "NtUnloadKeyEx" , 2 } ,
/*0x185*/ { "NtUnlockFile" , 5 } ,
/*0x186*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x187*/ { "NtVdmControl" , 2 } ,
/*0x188*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x189*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18A*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18B*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18C*/ { "NtWaitLowEventPair" , 1 } ,
/*0x18D*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.0.6001-sp1-windows-vista amd64
SDT_NODE static_ssdt_6_0_6001_sp1_windows_vista_amd64[391] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtCommitComplete" , 2 } ,
/*0x08A*/ { "NtCommitEnlistment" , 2 } ,
/*0x08B*/ { "NtCommitTransaction" , 2 } ,
/*0x08C*/ { "NtCompactKeys" , 2 } ,
/*0x08D*/ { "NtCompareTokens" , 3 } ,
/*0x08E*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08F*/ { "NtCompressKey" , 1 } ,
/*0x090*/ { "NtConnectPort" , 8 } ,
/*0x091*/ { "NtCreateDebugObject" , 4 } ,
/*0x092*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x093*/ { "NtCreateEnlistment" , 8 } ,
/*0x094*/ { "NtCreateEventPair" , 3 } ,
/*0x095*/ { "NtCreateIoCompletion" , 4 } ,
/*0x096*/ { "NtCreateJobObject" , 3 } ,
/*0x097*/ { "NtCreateJobSet" , 3 } ,
/*0x098*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x099*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09B*/ { "NtCreateMutant" , 4 } ,
/*0x09C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09D*/ { "NtCreatePagingFile" , 4 } ,
/*0x09E*/ { "NtCreatePort" , 5 } ,
/*0x09F*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A0*/ { "NtCreateProcess" , 8 } ,
/*0x0A1*/ { "NtCreateProfile" , 9 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisplayString" , 1 } ,
/*0x0B8*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0B9*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BA*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BB*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BC*/ { "NtExtendSection" , 2 } ,
/*0x0BD*/ { "NtFilterToken" , 6 } ,
/*0x0BE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0BF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C0*/ { "NtFlushKey" , 1 } ,
/*0x0C1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C7*/ { "NtGetContextThread" , 2 } ,
/*0x0C8*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0C9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CB*/ { "NtGetNextProcess" , 5 } ,
/*0x0CC*/ { "NtGetNextThread" , 6 } ,
/*0x0CD*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0CE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0CF*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D0*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D1*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D2*/ { "NtImpersonateThread" , 3 } ,
/*0x0D3*/ { "NtInitializeNlsFiles" , 4 } ,
/*0x0D4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0D8*/ { "NtListenPort" , 2 } ,
/*0x0D9*/ { "NtLoadDriver" , 1 } ,
/*0x0DA*/ { "NtLoadKey" , 2 } ,
/*0x0DB*/ { "NtLoadKey2" , 3 } ,
/*0x0DC*/ { "NtLoadKeyEx" , 8 } ,
/*0x0DD*/ { "NtLockFile" , 10 } ,
/*0x0DE*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0DF*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E0*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E1*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E2*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E3*/ { "NtMapCMFModule" , 6 } ,
/*0x0E4*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E6*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0E7*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0E8*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0E9*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EA*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EB*/ { "NtOpenEventPair" , 3 } ,
/*0x0EC*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0ED*/ { "NtOpenJobObject" , 3 } ,
/*0x0EE*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0EF*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F0*/ { "NtOpenMutant" , 3 } ,
/*0x0F1*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F2*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F3*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F4*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F5*/ { "NtOpenSemaphore" , 3 } ,
/*0x0F6*/ { "NtOpenSession" , 3 } ,
/*0x0F7*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0F8*/ { "NtOpenThread" , 4 } ,
/*0x0F9*/ { "NtOpenTimer" , 3 } ,
/*0x0FA*/ { "NtOpenTransaction" , 5 } ,
/*0x0FB*/ { "NtOpenTransactionManager" , 6 } ,
/*0x0FC*/ { "NtPlugPlayControl" , 3 } ,
/*0x0FD*/ { "NtPrePrepareComplete" , 2 } ,
/*0x0FE*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x0FF*/ { "NtPrepareComplete" , 2 } ,
/*0x100*/ { "NtPrepareEnlistment" , 2 } ,
/*0x101*/ { "NtPrivilegeCheck" , 3 } ,
/*0x102*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x103*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x104*/ { "NtPropagationComplete" , 4 } ,
/*0x105*/ { "NtPropagationFailed" , 3 } ,
/*0x106*/ { "NtPulseEvent" , 2 } ,
/*0x107*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x108*/ { "NtQueryBootOptions" , 2 } ,
/*0x109*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10A*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x10B*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x10C*/ { "NtQueryEaFile" , 9 } ,
/*0x10D*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x10E*/ { "NtQueryInformationAtom" , 5 } ,
/*0x10F*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x110*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x111*/ { "NtQueryInformationPort" , 5 } ,
/*0x112*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x113*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x114*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x115*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x116*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x117*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x118*/ { "NtQueryIoCompletion" , 5 } ,
/*0x119*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11A*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x11B*/ { "NtQueryMutant" , 5 } ,
/*0x11C*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x11D*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x11E*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x11F*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x120*/ { "NtQuerySecurityObject" , 5 } ,
/*0x121*/ { "NtQuerySemaphore" , 5 } ,
/*0x122*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x124*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x125*/ { "NtQueryTimerResolution" , 3 } ,
/*0x126*/ { "NtRaiseException" , 3 } ,
/*0x127*/ { "NtRaiseHardError" , 6 } ,
/*0x128*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x129*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x12B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x12C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x12D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x12E*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x12F*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x130*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x131*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x132*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x133*/ { "NtRenameKey" , 2 } ,
/*0x134*/ { "NtRenameTransactionManager" , 2 } ,
/*0x135*/ { "NtReplaceKey" , 3 } ,
/*0x136*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x137*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x138*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x139*/ { "NtRequestPort" , 2 } ,
/*0x13A*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13B*/ { "NtResetEvent" , 2 } ,
/*0x13C*/ { "NtResetWriteWatch" , 3 } ,
/*0x13D*/ { "NtRestoreKey" , 3 } ,
/*0x13E*/ { "NtResumeProcess" , 1 } ,
/*0x13F*/ { "NtRollbackComplete" , 2 } ,
/*0x140*/ { "NtRollbackEnlistment" , 2 } ,
/*0x141*/ { "NtRollbackTransaction" , 2 } ,
/*0x142*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x143*/ { "NtSaveKey" , 2 } ,
/*0x144*/ { "NtSaveKeyEx" , 3 } ,
/*0x145*/ { "NtSaveMergedKeys" , 3 } ,
/*0x146*/ { "NtSecureConnectPort" , 9 } ,
/*0x147*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x148*/ { "NtSetBootOptions" , 2 } ,
/*0x149*/ { "NtSetContextThread" , 2 } ,
/*0x14A*/ { "NtSetDebugFilterState" , 3 } ,
/*0x14B*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x14C*/ { "NtSetDefaultLocale" , 2 } ,
/*0x14D*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x14E*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetEaFile" , 4 } ,
/*0x150*/ { "NtSetHighEventPair" , 1 } ,
/*0x151*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x152*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x153*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x154*/ { "NtSetInformationJobObject" , 4 } ,
/*0x155*/ { "NtSetInformationKey" , 4 } ,
/*0x156*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x157*/ { "NtSetInformationToken" , 4 } ,
/*0x158*/ { "NtSetInformationTransaction" , 4 } ,
/*0x159*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x15A*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x15B*/ { "NtSetIntervalProfile" , 2 } ,
/*0x15C*/ { "NtSetIoCompletion" , 5 } ,
/*0x15D*/ { "NtSetLdtEntries" , 6 } ,
/*0x15E*/ { "NtSetLowEventPair" , 1 } ,
/*0x15F*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x160*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x161*/ { "NtSetSecurityObject" , 3 } ,
/*0x162*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x163*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x164*/ { "NtSetSystemInformation" , 3 } ,
/*0x165*/ { "NtSetSystemPowerState" , 3 } ,
/*0x166*/ { "NtSetSystemTime" , 2 } ,
/*0x167*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x168*/ { "NtSetTimerResolution" , 3 } ,
/*0x169*/ { "NtSetUuidSeed" , 1 } ,
/*0x16A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x16B*/ { "NtShutdownSystem" , 1 } ,
/*0x16C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x16D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x16E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x16F*/ { "NtStartProfile" , 1 } ,
/*0x170*/ { "NtStopProfile" , 1 } ,
/*0x171*/ { "NtSuspendProcess" , 1 } ,
/*0x172*/ { "NtSuspendThread" , 2 } ,
/*0x173*/ { "NtSystemDebugControl" , 6 } ,
/*0x174*/ { "NtTerminateJobObject" , 2 } ,
/*0x175*/ { "NtTestAlert" , 0 } ,
/*0x176*/ { "NtThawRegistry" , 0 } ,
/*0x177*/ { "NtThawTransactions" , 0 } ,
/*0x178*/ { "NtTraceControl" , 6 } ,
/*0x179*/ { "NtTranslateFilePath" , 4 } ,
/*0x17A*/ { "NtUnloadDriver" , 1 } ,
/*0x17B*/ { "NtUnloadKey" , 1 } ,
/*0x17C*/ { "NtUnloadKey2" , 2 } ,
/*0x17D*/ { "NtUnloadKeyEx" , 2 } ,
/*0x17E*/ { "NtUnlockFile" , 5 } ,
/*0x17F*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x180*/ { "NtVdmControl" , 2 } ,
/*0x181*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x182*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x183*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x184*/ { "NtWaitHighEventPair" , 1 } ,
/*0x185*/ { "NtWaitLowEventPair" , 1 } ,
/*0x186*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.0.6002-sp2-windows-vista amd64
SDT_NODE static_ssdt_6_0_6002_sp2_windows_vista_amd64[391] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtCommitComplete" , 2 } ,
/*0x08A*/ { "NtCommitEnlistment" , 2 } ,
/*0x08B*/ { "NtCommitTransaction" , 2 } ,
/*0x08C*/ { "NtCompactKeys" , 2 } ,
/*0x08D*/ { "NtCompareTokens" , 3 } ,
/*0x08E*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08F*/ { "NtCompressKey" , 1 } ,
/*0x090*/ { "NtConnectPort" , 8 } ,
/*0x091*/ { "NtCreateDebugObject" , 4 } ,
/*0x092*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x093*/ { "NtCreateEnlistment" , 8 } ,
/*0x094*/ { "NtCreateEventPair" , 3 } ,
/*0x095*/ { "NtCreateIoCompletion" , 4 } ,
/*0x096*/ { "NtCreateJobObject" , 3 } ,
/*0x097*/ { "NtCreateJobSet" , 3 } ,
/*0x098*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x099*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09B*/ { "NtCreateMutant" , 4 } ,
/*0x09C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09D*/ { "NtCreatePagingFile" , 4 } ,
/*0x09E*/ { "NtCreatePort" , 5 } ,
/*0x09F*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A0*/ { "NtCreateProcess" , 8 } ,
/*0x0A1*/ { "NtCreateProfile" , 9 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisplayString" , 1 } ,
/*0x0B8*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0B9*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BA*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BB*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BC*/ { "NtExtendSection" , 2 } ,
/*0x0BD*/ { "NtFilterToken" , 6 } ,
/*0x0BE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0BF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C0*/ { "NtFlushKey" , 1 } ,
/*0x0C1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C7*/ { "NtGetContextThread" , 2 } ,
/*0x0C8*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0C9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CB*/ { "NtGetNextProcess" , 5 } ,
/*0x0CC*/ { "NtGetNextThread" , 6 } ,
/*0x0CD*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0CE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0CF*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D0*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D1*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D2*/ { "NtImpersonateThread" , 3 } ,
/*0x0D3*/ { "NtInitializeNlsFiles" , 4 } ,
/*0x0D4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0D8*/ { "NtListenPort" , 2 } ,
/*0x0D9*/ { "NtLoadDriver" , 1 } ,
/*0x0DA*/ { "NtLoadKey" , 2 } ,
/*0x0DB*/ { "NtLoadKey2" , 3 } ,
/*0x0DC*/ { "NtLoadKeyEx" , 8 } ,
/*0x0DD*/ { "NtLockFile" , 10 } ,
/*0x0DE*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0DF*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E0*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E1*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E2*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E3*/ { "NtMapCMFModule" , 6 } ,
/*0x0E4*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E6*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0E7*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0E8*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0E9*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EA*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EB*/ { "NtOpenEventPair" , 3 } ,
/*0x0EC*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0ED*/ { "NtOpenJobObject" , 3 } ,
/*0x0EE*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0EF*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F0*/ { "NtOpenMutant" , 3 } ,
/*0x0F1*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F2*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F3*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F4*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F5*/ { "NtOpenSemaphore" , 3 } ,
/*0x0F6*/ { "NtOpenSession" , 3 } ,
/*0x0F7*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0F8*/ { "NtOpenThread" , 4 } ,
/*0x0F9*/ { "NtOpenTimer" , 3 } ,
/*0x0FA*/ { "NtOpenTransaction" , 5 } ,
/*0x0FB*/ { "NtOpenTransactionManager" , 6 } ,
/*0x0FC*/ { "NtPlugPlayControl" , 3 } ,
/*0x0FD*/ { "NtPrePrepareComplete" , 2 } ,
/*0x0FE*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x0FF*/ { "NtPrepareComplete" , 2 } ,
/*0x100*/ { "NtPrepareEnlistment" , 2 } ,
/*0x101*/ { "NtPrivilegeCheck" , 3 } ,
/*0x102*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x103*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x104*/ { "NtPropagationComplete" , 4 } ,
/*0x105*/ { "NtPropagationFailed" , 3 } ,
/*0x106*/ { "NtPulseEvent" , 2 } ,
/*0x107*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x108*/ { "NtQueryBootOptions" , 2 } ,
/*0x109*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10A*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x10B*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x10C*/ { "NtQueryEaFile" , 9 } ,
/*0x10D*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x10E*/ { "NtQueryInformationAtom" , 5 } ,
/*0x10F*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x110*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x111*/ { "NtQueryInformationPort" , 5 } ,
/*0x112*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x113*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x114*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x115*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x116*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x117*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x118*/ { "NtQueryIoCompletion" , 5 } ,
/*0x119*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11A*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x11B*/ { "NtQueryMutant" , 5 } ,
/*0x11C*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x11D*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x11E*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x11F*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x120*/ { "NtQuerySecurityObject" , 5 } ,
/*0x121*/ { "NtQuerySemaphore" , 5 } ,
/*0x122*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x124*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x125*/ { "NtQueryTimerResolution" , 3 } ,
/*0x126*/ { "NtRaiseException" , 3 } ,
/*0x127*/ { "NtRaiseHardError" , 6 } ,
/*0x128*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x129*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x12B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x12C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x12D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x12E*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x12F*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x130*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x131*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x132*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x133*/ { "NtRenameKey" , 2 } ,
/*0x134*/ { "NtRenameTransactionManager" , 2 } ,
/*0x135*/ { "NtReplaceKey" , 3 } ,
/*0x136*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x137*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x138*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x139*/ { "NtRequestPort" , 2 } ,
/*0x13A*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13B*/ { "NtResetEvent" , 2 } ,
/*0x13C*/ { "NtResetWriteWatch" , 3 } ,
/*0x13D*/ { "NtRestoreKey" , 3 } ,
/*0x13E*/ { "NtResumeProcess" , 1 } ,
/*0x13F*/ { "NtRollbackComplete" , 2 } ,
/*0x140*/ { "NtRollbackEnlistment" , 2 } ,
/*0x141*/ { "NtRollbackTransaction" , 2 } ,
/*0x142*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x143*/ { "NtSaveKey" , 2 } ,
/*0x144*/ { "NtSaveKeyEx" , 3 } ,
/*0x145*/ { "NtSaveMergedKeys" , 3 } ,
/*0x146*/ { "NtSecureConnectPort" , 9 } ,
/*0x147*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x148*/ { "NtSetBootOptions" , 2 } ,
/*0x149*/ { "NtSetContextThread" , 2 } ,
/*0x14A*/ { "NtSetDebugFilterState" , 3 } ,
/*0x14B*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x14C*/ { "NtSetDefaultLocale" , 2 } ,
/*0x14D*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x14E*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetEaFile" , 4 } ,
/*0x150*/ { "NtSetHighEventPair" , 1 } ,
/*0x151*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x152*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x153*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x154*/ { "NtSetInformationJobObject" , 4 } ,
/*0x155*/ { "NtSetInformationKey" , 4 } ,
/*0x156*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x157*/ { "NtSetInformationToken" , 4 } ,
/*0x158*/ { "NtSetInformationTransaction" , 4 } ,
/*0x159*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x15A*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x15B*/ { "NtSetIntervalProfile" , 2 } ,
/*0x15C*/ { "NtSetIoCompletion" , 5 } ,
/*0x15D*/ { "NtSetLdtEntries" , 6 } ,
/*0x15E*/ { "NtSetLowEventPair" , 1 } ,
/*0x15F*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x160*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x161*/ { "NtSetSecurityObject" , 3 } ,
/*0x162*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x163*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x164*/ { "NtSetSystemInformation" , 3 } ,
/*0x165*/ { "NtSetSystemPowerState" , 3 } ,
/*0x166*/ { "NtSetSystemTime" , 2 } ,
/*0x167*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x168*/ { "NtSetTimerResolution" , 3 } ,
/*0x169*/ { "NtSetUuidSeed" , 1 } ,
/*0x16A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x16B*/ { "NtShutdownSystem" , 1 } ,
/*0x16C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x16D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x16E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x16F*/ { "NtStartProfile" , 1 } ,
/*0x170*/ { "NtStopProfile" , 1 } ,
/*0x171*/ { "NtSuspendProcess" , 1 } ,
/*0x172*/ { "NtSuspendThread" , 2 } ,
/*0x173*/ { "NtSystemDebugControl" , 6 } ,
/*0x174*/ { "NtTerminateJobObject" , 2 } ,
/*0x175*/ { "NtTestAlert" , 0 } ,
/*0x176*/ { "NtThawRegistry" , 0 } ,
/*0x177*/ { "NtThawTransactions" , 0 } ,
/*0x178*/ { "NtTraceControl" , 6 } ,
/*0x179*/ { "NtTranslateFilePath" , 4 } ,
/*0x17A*/ { "NtUnloadDriver" , 1 } ,
/*0x17B*/ { "NtUnloadKey" , 1 } ,
/*0x17C*/ { "NtUnloadKey2" , 2 } ,
/*0x17D*/ { "NtUnloadKeyEx" , 2 } ,
/*0x17E*/ { "NtUnlockFile" , 5 } ,
/*0x17F*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x180*/ { "NtVdmControl" , 2 } ,
/*0x181*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x182*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x183*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x184*/ { "NtWaitHighEventPair" , 1 } ,
/*0x185*/ { "NtWaitLowEventPair" , 1 } ,
/*0x186*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.1.7600-sp0-windows-7 amd64
SDT_NODE static_ssdt_6_1_7600_sp0_windows_7_amd64[401] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAddBootEntry" , 2 } ,
/*0x067*/ { "NtAddDriverEntry" , 2 } ,
/*0x068*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x069*/ { "NtAlertResumeThread" , 2 } ,
/*0x06A*/ { "NtAlertThread" , 1 } ,
/*0x06B*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06C*/ { "NtAllocateReserveObject" , 3 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelIoFileEx" , 3 } ,
/*0x087*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x088*/ { "NtCommitComplete" , 2 } ,
/*0x089*/ { "NtCommitEnlistment" , 2 } ,
/*0x08A*/ { "NtCommitTransaction" , 2 } ,
/*0x08B*/ { "NtCompactKeys" , 2 } ,
/*0x08C*/ { "NtCompareTokens" , 3 } ,
/*0x08D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08E*/ { "NtCompressKey" , 1 } ,
/*0x08F*/ { "NtConnectPort" , 8 } ,
/*0x090*/ { "NtCreateDebugObject" , 4 } ,
/*0x091*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x092*/ { "NtCreateEnlistment" , 8 } ,
/*0x093*/ { "NtCreateEventPair" , 3 } ,
/*0x094*/ { "NtCreateIoCompletion" , 4 } ,
/*0x095*/ { "NtCreateJobObject" , 3 } ,
/*0x096*/ { "NtCreateJobSet" , 3 } ,
/*0x097*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x098*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x099*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09A*/ { "NtCreateMutant" , 4 } ,
/*0x09B*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09C*/ { "NtCreatePagingFile" , 4 } ,
/*0x09D*/ { "NtCreatePort" , 5 } ,
/*0x09E*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x09F*/ { "NtCreateProcess" , 8 } ,
/*0x0A0*/ { "NtCreateProfile" , 9 } ,
/*0x0A1*/ { "NtCreateProfileEx" , 10 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0B8*/ { "NtDisplayString" , 1 } ,
/*0x0B9*/ { "NtDrawText" , 1 } ,
/*0x0BA*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0BB*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BD*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BE*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BF*/ { "NtExtendSection" , 2 } ,
/*0x0C0*/ { "NtFilterToken" , 6 } ,
/*0x0C1*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C2*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C3*/ { "NtFlushKey" , 1 } ,
/*0x0C4*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C5*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C6*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C7*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C8*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C9*/ { "NtFreezeTransactions" , 2 } ,
/*0x0CA*/ { "NtGetContextThread" , 2 } ,
/*0x0CB*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CC*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CD*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CE*/ { "NtGetNextProcess" , 5 } ,
/*0x0CF*/ { "NtGetNextThread" , 6 } ,
/*0x0D0*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D1*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D2*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D3*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D4*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D5*/ { "NtImpersonateThread" , 3 } ,
/*0x0D6*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D7*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D8*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D9*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0DA*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E9*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EA*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EB*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0EC*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0ED*/ { "NtNotifyChangeSession" , 8 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyEx" , 4 } ,
/*0x0F3*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F4*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x0F5*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F6*/ { "NtOpenMutant" , 3 } ,
/*0x0F7*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F8*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F9*/ { "NtOpenProcessToken" , 3 } ,
/*0x0FA*/ { "NtOpenResourceManager" , 5 } ,
/*0x0FB*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FC*/ { "NtOpenSession" , 3 } ,
/*0x0FD*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FE*/ { "NtOpenThread" , 4 } ,
/*0x0FF*/ { "NtOpenTimer" , 3 } ,
/*0x100*/ { "NtOpenTransaction" , 5 } ,
/*0x101*/ { "NtOpenTransactionManager" , 6 } ,
/*0x102*/ { "NtPlugPlayControl" , 3 } ,
/*0x103*/ { "NtPrePrepareComplete" , 2 } ,
/*0x104*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrepareComplete" , 2 } ,
/*0x106*/ { "NtPrepareEnlistment" , 2 } ,
/*0x107*/ { "NtPrivilegeCheck" , 3 } ,
/*0x108*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x109*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x10A*/ { "NtPropagationComplete" , 4 } ,
/*0x10B*/ { "NtPropagationFailed" , 3 } ,
/*0x10C*/ { "NtPulseEvent" , 2 } ,
/*0x10D*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10E*/ { "NtQueryBootOptions" , 2 } ,
/*0x10F*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x110*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x111*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x112*/ { "NtQueryEaFile" , 9 } ,
/*0x113*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x114*/ { "NtQueryInformationAtom" , 5 } ,
/*0x115*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x116*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x117*/ { "NtQueryInformationPort" , 5 } ,
/*0x118*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x119*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x11A*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11B*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11C*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11D*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11E*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11F*/ { "NtQueryLicenseValue" , 5 } ,
/*0x120*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x121*/ { "NtQueryMutant" , 5 } ,
/*0x122*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x123*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x124*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x125*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x126*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x127*/ { "NtQuerySecurityObject" , 5 } ,
/*0x128*/ { "NtQuerySemaphore" , 5 } ,
/*0x129*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x12A*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x12B*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12C*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x12D*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12E*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x12F*/ { "NtRaiseException" , 3 } ,
/*0x130*/ { "NtRaiseHardError" , 6 } ,
/*0x131*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x132*/ { "NtRecoverEnlistment" , 2 } ,
/*0x133*/ { "NtRecoverResourceManager" , 1 } ,
/*0x134*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x135*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x136*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x137*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x138*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x139*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x13A*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x13B*/ { "NtRenameKey" , 2 } ,
/*0x13C*/ { "NtRenameTransactionManager" , 2 } ,
/*0x13D*/ { "NtReplaceKey" , 3 } ,
/*0x13E*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x13F*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x140*/ { "NtRequestPort" , 2 } ,
/*0x141*/ { "NtResetEvent" , 2 } ,
/*0x142*/ { "NtResetWriteWatch" , 3 } ,
/*0x143*/ { "NtRestoreKey" , 3 } ,
/*0x144*/ { "NtResumeProcess" , 1 } ,
/*0x145*/ { "NtRollbackComplete" , 2 } ,
/*0x146*/ { "NtRollbackEnlistment" , 2 } ,
/*0x147*/ { "NtRollbackTransaction" , 2 } ,
/*0x148*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x149*/ { "NtSaveKey" , 2 } ,
/*0x14A*/ { "NtSaveKeyEx" , 3 } ,
/*0x14B*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSerializeBoot" , 0 } ,
/*0x14E*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetBootOptions" , 2 } ,
/*0x150*/ { "NtSetContextThread" , 2 } ,
/*0x151*/ { "NtSetDebugFilterState" , 3 } ,
/*0x152*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x153*/ { "NtSetDefaultLocale" , 2 } ,
/*0x154*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x155*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x156*/ { "NtSetEaFile" , 4 } ,
/*0x157*/ { "NtSetHighEventPair" , 1 } ,
/*0x158*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x159*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x15A*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15B*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15C*/ { "NtSetInformationKey" , 4 } ,
/*0x15D*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15E*/ { "NtSetInformationToken" , 4 } ,
/*0x15F*/ { "NtSetInformationTransaction" , 4 } ,
/*0x160*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x161*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x162*/ { "NtSetIntervalProfile" , 2 } ,
/*0x163*/ { "NtSetIoCompletion" , 5 } ,
/*0x164*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x165*/ { "NtSetLdtEntries" , 6 } ,
/*0x166*/ { "NtSetLowEventPair" , 1 } ,
/*0x167*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x168*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x169*/ { "NtSetSecurityObject" , 3 } ,
/*0x16A*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x16B*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16C*/ { "NtSetSystemInformation" , 3 } ,
/*0x16D*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16E*/ { "NtSetSystemTime" , 2 } ,
/*0x16F*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x170*/ { "NtSetTimerEx" , 4 } ,
/*0x171*/ { "NtSetTimerResolution" , 3 } ,
/*0x172*/ { "NtSetUuidSeed" , 1 } ,
/*0x173*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x174*/ { "NtShutdownSystem" , 1 } ,
/*0x175*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x176*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x177*/ { "NtSinglePhaseReject" , 2 } ,
/*0x178*/ { "NtStartProfile" , 1 } ,
/*0x179*/ { "NtStopProfile" , 1 } ,
/*0x17A*/ { "NtSuspendProcess" , 1 } ,
/*0x17B*/ { "NtSuspendThread" , 2 } ,
/*0x17C*/ { "NtSystemDebugControl" , 6 } ,
/*0x17D*/ { "NtTerminateJobObject" , 2 } ,
/*0x17E*/ { "NtTestAlert" , 0 } ,
/*0x17F*/ { "NtThawRegistry" , 0 } ,
/*0x180*/ { "NtThawTransactions" , 0 } ,
/*0x181*/ { "NtTraceControl" , 6 } ,
/*0x182*/ { "NtTranslateFilePath" , 4 } ,
/*0x183*/ { "NtUmsThreadYield" , 1 } ,
/*0x184*/ { "NtUnloadDriver" , 1 } ,
/*0x185*/ { "NtUnloadKey" , 1 } ,
/*0x186*/ { "NtUnloadKey2" , 2 } ,
/*0x187*/ { "NtUnloadKeyEx" , 2 } ,
/*0x188*/ { "NtUnlockFile" , 5 } ,
/*0x189*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x18A*/ { "NtVdmControl" , 2 } ,
/*0x18B*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x18C*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18D*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18E*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18F*/ { "NtWaitLowEventPair" , 1 } ,
/*0x190*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.1.7601-sp1-windows-7 amd64
SDT_NODE static_ssdt_6_1_7601_sp1_windows_7_amd64[401] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAddBootEntry" , 2 } ,
/*0x067*/ { "NtAddDriverEntry" , 2 } ,
/*0x068*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x069*/ { "NtAlertResumeThread" , 2 } ,
/*0x06A*/ { "NtAlertThread" , 1 } ,
/*0x06B*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06C*/ { "NtAllocateReserveObject" , 3 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelIoFileEx" , 3 } ,
/*0x087*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x088*/ { "NtCommitComplete" , 2 } ,
/*0x089*/ { "NtCommitEnlistment" , 2 } ,
/*0x08A*/ { "NtCommitTransaction" , 2 } ,
/*0x08B*/ { "NtCompactKeys" , 2 } ,
/*0x08C*/ { "NtCompareTokens" , 3 } ,
/*0x08D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08E*/ { "NtCompressKey" , 1 } ,
/*0x08F*/ { "NtConnectPort" , 8 } ,
/*0x090*/ { "NtCreateDebugObject" , 4 } ,
/*0x091*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x092*/ { "NtCreateEnlistment" , 8 } ,
/*0x093*/ { "NtCreateEventPair" , 3 } ,
/*0x094*/ { "NtCreateIoCompletion" , 4 } ,
/*0x095*/ { "NtCreateJobObject" , 3 } ,
/*0x096*/ { "NtCreateJobSet" , 3 } ,
/*0x097*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x098*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x099*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09A*/ { "NtCreateMutant" , 4 } ,
/*0x09B*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09C*/ { "NtCreatePagingFile" , 4 } ,
/*0x09D*/ { "NtCreatePort" , 5 } ,
/*0x09E*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x09F*/ { "NtCreateProcess" , 8 } ,
/*0x0A0*/ { "NtCreateProfile" , 9 } ,
/*0x0A1*/ { "NtCreateProfileEx" , 10 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0B8*/ { "NtDisplayString" , 1 } ,
/*0x0B9*/ { "NtDrawText" , 1 } ,
/*0x0BA*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0BB*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BD*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BE*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BF*/ { "NtExtendSection" , 2 } ,
/*0x0C0*/ { "NtFilterToken" , 6 } ,
/*0x0C1*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C2*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C3*/ { "NtFlushKey" , 1 } ,
/*0x0C4*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C5*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C6*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C7*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C8*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C9*/ { "NtFreezeTransactions" , 2 } ,
/*0x0CA*/ { "NtGetContextThread" , 2 } ,
/*0x0CB*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CC*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CD*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CE*/ { "NtGetNextProcess" , 5 } ,
/*0x0CF*/ { "NtGetNextThread" , 6 } ,
/*0x0D0*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D1*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D2*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D3*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D4*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D5*/ { "NtImpersonateThread" , 3 } ,
/*0x0D6*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D7*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D8*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D9*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0DA*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E9*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EA*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EB*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0EC*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0ED*/ { "NtNotifyChangeSession" , 8 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyEx" , 4 } ,
/*0x0F3*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F4*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x0F5*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F6*/ { "NtOpenMutant" , 3 } ,
/*0x0F7*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F8*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F9*/ { "NtOpenProcessToken" , 3 } ,
/*0x0FA*/ { "NtOpenResourceManager" , 5 } ,
/*0x0FB*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FC*/ { "NtOpenSession" , 3 } ,
/*0x0FD*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FE*/ { "NtOpenThread" , 4 } ,
/*0x0FF*/ { "NtOpenTimer" , 3 } ,
/*0x100*/ { "NtOpenTransaction" , 5 } ,
/*0x101*/ { "NtOpenTransactionManager" , 6 } ,
/*0x102*/ { "NtPlugPlayControl" , 3 } ,
/*0x103*/ { "NtPrePrepareComplete" , 2 } ,
/*0x104*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrepareComplete" , 2 } ,
/*0x106*/ { "NtPrepareEnlistment" , 2 } ,
/*0x107*/ { "NtPrivilegeCheck" , 3 } ,
/*0x108*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x109*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x10A*/ { "NtPropagationComplete" , 4 } ,
/*0x10B*/ { "NtPropagationFailed" , 3 } ,
/*0x10C*/ { "NtPulseEvent" , 2 } ,
/*0x10D*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10E*/ { "NtQueryBootOptions" , 2 } ,
/*0x10F*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x110*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x111*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x112*/ { "NtQueryEaFile" , 9 } ,
/*0x113*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x114*/ { "NtQueryInformationAtom" , 5 } ,
/*0x115*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x116*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x117*/ { "NtQueryInformationPort" , 5 } ,
/*0x118*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x119*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x11A*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11B*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11C*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11D*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11E*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11F*/ { "NtQueryLicenseValue" , 5 } ,
/*0x120*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x121*/ { "NtQueryMutant" , 5 } ,
/*0x122*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x123*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x124*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x125*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x126*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x127*/ { "NtQuerySecurityObject" , 5 } ,
/*0x128*/ { "NtQuerySemaphore" , 5 } ,
/*0x129*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x12A*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x12B*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12C*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x12D*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12E*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x12F*/ { "NtRaiseException" , 3 } ,
/*0x130*/ { "NtRaiseHardError" , 6 } ,
/*0x131*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x132*/ { "NtRecoverEnlistment" , 2 } ,
/*0x133*/ { "NtRecoverResourceManager" , 1 } ,
/*0x134*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x135*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x136*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x137*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x138*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x139*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x13A*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x13B*/ { "NtRenameKey" , 2 } ,
/*0x13C*/ { "NtRenameTransactionManager" , 2 } ,
/*0x13D*/ { "NtReplaceKey" , 3 } ,
/*0x13E*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x13F*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x140*/ { "NtRequestPort" , 2 } ,
/*0x141*/ { "NtResetEvent" , 2 } ,
/*0x142*/ { "NtResetWriteWatch" , 3 } ,
/*0x143*/ { "NtRestoreKey" , 3 } ,
/*0x144*/ { "NtResumeProcess" , 1 } ,
/*0x145*/ { "NtRollbackComplete" , 2 } ,
/*0x146*/ { "NtRollbackEnlistment" , 2 } ,
/*0x147*/ { "NtRollbackTransaction" , 2 } ,
/*0x148*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x149*/ { "NtSaveKey" , 2 } ,
/*0x14A*/ { "NtSaveKeyEx" , 3 } ,
/*0x14B*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSerializeBoot" , 0 } ,
/*0x14E*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetBootOptions" , 2 } ,
/*0x150*/ { "NtSetContextThread" , 2 } ,
/*0x151*/ { "NtSetDebugFilterState" , 3 } ,
/*0x152*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x153*/ { "NtSetDefaultLocale" , 2 } ,
/*0x154*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x155*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x156*/ { "NtSetEaFile" , 4 } ,
/*0x157*/ { "NtSetHighEventPair" , 1 } ,
/*0x158*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x159*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x15A*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15B*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15C*/ { "NtSetInformationKey" , 4 } ,
/*0x15D*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15E*/ { "NtSetInformationToken" , 4 } ,
/*0x15F*/ { "NtSetInformationTransaction" , 4 } ,
/*0x160*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x161*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x162*/ { "NtSetIntervalProfile" , 2 } ,
/*0x163*/ { "NtSetIoCompletion" , 5 } ,
/*0x164*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x165*/ { "NtSetLdtEntries" , 6 } ,
/*0x166*/ { "NtSetLowEventPair" , 1 } ,
/*0x167*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x168*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x169*/ { "NtSetSecurityObject" , 3 } ,
/*0x16A*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x16B*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16C*/ { "NtSetSystemInformation" , 3 } ,
/*0x16D*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16E*/ { "NtSetSystemTime" , 2 } ,
/*0x16F*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x170*/ { "NtSetTimerEx" , 4 } ,
/*0x171*/ { "NtSetTimerResolution" , 3 } ,
/*0x172*/ { "NtSetUuidSeed" , 1 } ,
/*0x173*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x174*/ { "NtShutdownSystem" , 1 } ,
/*0x175*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x176*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x177*/ { "NtSinglePhaseReject" , 2 } ,
/*0x178*/ { "NtStartProfile" , 1 } ,
/*0x179*/ { "NtStopProfile" , 1 } ,
/*0x17A*/ { "NtSuspendProcess" , 1 } ,
/*0x17B*/ { "NtSuspendThread" , 2 } ,
/*0x17C*/ { "NtSystemDebugControl" , 6 } ,
/*0x17D*/ { "NtTerminateJobObject" , 2 } ,
/*0x17E*/ { "NtTestAlert" , 0 } ,
/*0x17F*/ { "NtThawRegistry" , 0 } ,
/*0x180*/ { "NtThawTransactions" , 0 } ,
/*0x181*/ { "NtTraceControl" , 6 } ,
/*0x182*/ { "NtTranslateFilePath" , 4 } ,
/*0x183*/ { "NtUmsThreadYield" , 1 } ,
/*0x184*/ { "NtUnloadDriver" , 1 } ,
/*0x185*/ { "NtUnloadKey" , 1 } ,
/*0x186*/ { "NtUnloadKey2" , 2 } ,
/*0x187*/ { "NtUnloadKeyEx" , 2 } ,
/*0x188*/ { "NtUnlockFile" , 5 } ,
/*0x189*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x18A*/ { "NtVdmControl" , 2 } ,
/*0x18B*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x18C*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18D*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18E*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18F*/ { "NtWaitLowEventPair" , 1 } ,
/*0x190*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.2.9200-sp0-windows-8 amd64
SDT_NODE static_ssdt_6_2_9200_sp0_windows_8_amd64[429] = {
/*0x000*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x001*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x002*/ { "NtWaitForSingleObject" , 3 } ,
/*0x003*/ { "NtCallbackReturn" , 3 } ,
/*0x004*/ { "NtReadFile" , 9 } ,
/*0x005*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x006*/ { "NtWriteFile" , 9 } ,
/*0x007*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x008*/ { "NtReleaseSemaphore" , 3 } ,
/*0x009*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00A*/ { "NtReplyPort" , 2 } ,
/*0x00B*/ { "NtSetInformationThread" , 4 } ,
/*0x00C*/ { "NtSetEvent" , 2 } ,
/*0x00D*/ { "NtClose" , 1 } ,
/*0x00E*/ { "NtQueryObject" , 5 } ,
/*0x00F*/ { "NtQueryInformationFile" , 5 } ,
/*0x010*/ { "NtOpenKey" , 3 } ,
/*0x011*/ { "NtEnumerateValueKey" , 6 } ,
/*0x012*/ { "NtFindAtom" , 3 } ,
/*0x013*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x014*/ { "NtQueryKey" , 5 } ,
/*0x015*/ { "NtQueryValueKey" , 6 } ,
/*0x016*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x017*/ { "NtQueryInformationProcess" , 5 } ,
/*0x018*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x019*/ { "NtWriteFileGather" , 9 } ,
/*0x01A*/ { "NtSetInformationProcess" , 4 } ,
/*0x01B*/ { "NtCreateKey" , 7 } ,
/*0x01C*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01D*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01E*/ { "NtReleaseMutant" , 2 } ,
/*0x01F*/ { "NtQueryInformationToken" , 5 } ,
/*0x020*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x021*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x022*/ { "NtOpenThreadToken" , 4 } ,
/*0x023*/ { "NtQueryInformationThread" , 5 } ,
/*0x024*/ { "NtOpenProcess" , 4 } ,
/*0x025*/ { "NtSetInformationFile" , 5 } ,
/*0x026*/ { "NtMapViewOfSection" , 10 } ,
/*0x027*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x028*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x029*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02A*/ { "NtTerminateProcess" , 2 } ,
/*0x02B*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02C*/ { "NtReadFileScatter" , 9 } ,
/*0x02D*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02E*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02F*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x030*/ { "NtEnumerateKey" , 6 } ,
/*0x031*/ { "NtOpenFile" , 6 } ,
/*0x032*/ { "NtDelayExecution" , 2 } ,
/*0x033*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x034*/ { "NtQuerySystemInformation" , 4 } ,
/*0x035*/ { "NtOpenSection" , 3 } ,
/*0x036*/ { "NtQueryTimer" , 5 } ,
/*0x037*/ { "NtFsControlFile" , 10 } ,
/*0x038*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x039*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03A*/ { "NtDuplicateObject" , 7 } ,
/*0x03B*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03C*/ { "NtClearEvent" , 1 } ,
/*0x03D*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03E*/ { "NtOpenEvent" , 3 } ,
/*0x03F*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x040*/ { "NtDuplicateToken" , 6 } ,
/*0x041*/ { "NtContinue" , 2 } ,
/*0x042*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x043*/ { "NtQueueApcThread" , 5 } ,
/*0x044*/ { "NtYieldExecution" , 0 } ,
/*0x045*/ { "NtAddAtom" , 3 } ,
/*0x046*/ { "NtCreateEvent" , 5 } ,
/*0x047*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x048*/ { "NtCreateSection" , 7 } ,
/*0x049*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04A*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04B*/ { "NtCreateProcessEx" , 9 } ,
/*0x04C*/ { "NtCreateThread" , 8 } ,
/*0x04D*/ { "NtIsProcessInJob" , 2 } ,
/*0x04E*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04F*/ { "NtQuerySection" , 5 } ,
/*0x050*/ { "NtResumeThread" , 2 } ,
/*0x051*/ { "NtTerminateThread" , 2 } ,
/*0x052*/ { "NtReadRequestData" , 6 } ,
/*0x053*/ { "NtCreateFile" , 11 } ,
/*0x054*/ { "NtQueryEvent" , 5 } ,
/*0x055*/ { "NtWriteRequestData" , 6 } ,
/*0x056*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x057*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x058*/ { "NtQuerySystemTime" , 1 } ,
/*0x059*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05A*/ { "NtSetInformationObject" , 4 } ,
/*0x05B*/ { "NtCancelIoFile" , 2 } ,
/*0x05C*/ { "NtTraceEvent" , 4 } ,
/*0x05D*/ { "NtPowerInformation" , 5 } ,
/*0x05E*/ { "NtSetValueKey" , 6 } ,
/*0x05F*/ { "NtCancelTimer" , 2 } ,
/*0x060*/ { "NtSetTimer" , 7 } ,
/*0x061*/ { "NtAcceptConnectPort" , 6 } ,
/*0x062*/ { "NtAccessCheck" , 8 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x082*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x083*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x084*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x085*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x086*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x087*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x088*/ { "NtAlpcSetInformation" , 4 } ,
/*0x089*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08A*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08B*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08C*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08D*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08E*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x08F*/ { "NtCommitComplete" , 2 } ,
/*0x090*/ { "NtCommitEnlistment" , 2 } ,
/*0x091*/ { "NtCommitTransaction" , 2 } ,
/*0x092*/ { "NtCompactKeys" , 2 } ,
/*0x093*/ { "NtCompareTokens" , 3 } ,
/*0x094*/ { "NtCompleteConnectPort" , 1 } ,
/*0x095*/ { "NtCompressKey" , 1 } ,
/*0x096*/ { "NtConnectPort" , 8 } ,
/*0x097*/ { "NtCreateDebugObject" , 4 } ,
/*0x098*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x099*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09A*/ { "NtCreateEnlistment" , 8 } ,
/*0x09B*/ { "NtCreateEventPair" , 3 } ,
/*0x09C*/ { "NtCreateIRTimer" , 2 } ,
/*0x09D*/ { "NtCreateIoCompletion" , 4 } ,
/*0x09E*/ { "NtCreateJobObject" , 3 } ,
/*0x09F*/ { "NtCreateJobSet" , 3 } ,
/*0x0A0*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A1*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A2*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A3*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A4*/ { "NtCreateMutant" , 4 } ,
/*0x0A5*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0A6*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A7*/ { "NtCreatePort" , 5 } ,
/*0x0A8*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A9*/ { "NtCreateProcess" , 8 } ,
/*0x0AA*/ { "NtCreateProfile" , 9 } ,
/*0x0AB*/ { "NtCreateProfileEx" , 10 } ,
/*0x0AC*/ { "NtCreateResourceManager" , 7 } ,
/*0x0AD*/ { "NtCreateSemaphore" , 5 } ,
/*0x0AE*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0AF*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B0*/ { "NtCreateTimer" , 4 } ,
/*0x0B1*/ { "NtCreateToken" , 13 } ,
/*0x0B2*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B3*/ { "NtCreateTransaction" , 10 } ,
/*0x0B4*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0B5*/ { "NtCreateUserProcess" , 11 } ,
/*0x0B6*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0B7*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0B8*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0B9*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0BA*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0BB*/ { "NtDebugContinue" , 3 } ,
/*0x0BC*/ { "NtDeleteAtom" , 1 } ,
/*0x0BD*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0BE*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0BF*/ { "NtDeleteFile" , 1 } ,
/*0x0C0*/ { "NtDeleteKey" , 1 } ,
/*0x0C1*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C2*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C3*/ { "NtDeleteValueKey" , 2 } ,
/*0x0C4*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0C5*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0C6*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0C7*/ { "NtDisplayString" , 1 } ,
/*0x0C8*/ { "NtDrawText" , 1 } ,
/*0x0C9*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0CA*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0CB*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0CC*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0CD*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0CE*/ { "NtExtendSection" , 2 } ,
/*0x0CF*/ { "NtFilterBootOption" , 5 } ,
/*0x0D0*/ { "NtFilterToken" , 6 } ,
/*0x0D1*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D2*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D3*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0D4*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0D5*/ { "NtFlushKey" , 1 } ,
/*0x0D6*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0D7*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0D8*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0D9*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0DA*/ { "NtFreezeRegistry" , 1 } ,
/*0x0DB*/ { "NtFreezeTransactions" , 2 } ,
/*0x0DC*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0DD*/ { "NtGetContextThread" , 2 } ,
/*0x0DE*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0DF*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E0*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E1*/ { "NtGetNextProcess" , 5 } ,
/*0x0E2*/ { "NtGetNextThread" , 6 } ,
/*0x0E3*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0E4*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0E5*/ { "NtGetWriteWatch" , 7 } ,
/*0x0E6*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0E7*/ { "NtImpersonateThread" , 3 } ,
/*0x0E8*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0E9*/ { "NtInitializeRegistry" , 1 } ,
/*0x0EA*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0EB*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0EC*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0ED*/ { "NtListenPort" , 2 } ,
/*0x0EE*/ { "NtLoadDriver" , 1 } ,
/*0x0EF*/ { "NtLoadKey" , 2 } ,
/*0x0F0*/ { "NtLoadKey2" , 3 } ,
/*0x0F1*/ { "NtLoadKeyEx" , 8 } ,
/*0x0F2*/ { "NtLockFile" , 10 } ,
/*0x0F3*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0F4*/ { "NtLockRegistryKey" , 1 } ,
/*0x0F5*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0F6*/ { "NtMakePermanentObject" , 1 } ,
/*0x0F7*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0F8*/ { "NtMapCMFModule" , 6 } ,
/*0x0F9*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0FA*/ { "NtModifyBootEntry" , 1 } ,
/*0x0FB*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0FC*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0FD*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0FE*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0FF*/ { "NtNotifyChangeSession" , 8 } ,
/*0x100*/ { "NtOpenEnlistment" , 5 } ,
/*0x101*/ { "NtOpenEventPair" , 3 } ,
/*0x102*/ { "NtOpenIoCompletion" , 3 } ,
/*0x103*/ { "NtOpenJobObject" , 3 } ,
/*0x104*/ { "NtOpenKeyEx" , 4 } ,
/*0x105*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x106*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x107*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x108*/ { "NtOpenMutant" , 3 } ,
/*0x109*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x10A*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x10B*/ { "NtOpenProcessToken" , 3 } ,
/*0x10C*/ { "NtOpenResourceManager" , 5 } ,
/*0x10D*/ { "NtOpenSemaphore" , 3 } ,
/*0x10E*/ { "NtOpenSession" , 3 } ,
/*0x10F*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x110*/ { "NtOpenThread" , 4 } ,
/*0x111*/ { "NtOpenTimer" , 3 } ,
/*0x112*/ { "NtOpenTransaction" , 5 } ,
/*0x113*/ { "NtOpenTransactionManager" , 6 } ,
/*0x114*/ { "NtPlugPlayControl" , 3 } ,
/*0x115*/ { "NtPrePrepareComplete" , 2 } ,
/*0x116*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x117*/ { "NtPrepareComplete" , 2 } ,
/*0x118*/ { "NtPrepareEnlistment" , 2 } ,
/*0x119*/ { "NtPrivilegeCheck" , 3 } ,
/*0x11A*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x11B*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x11C*/ { "NtPropagationComplete" , 4 } ,
/*0x11D*/ { "NtPropagationFailed" , 3 } ,
/*0x11E*/ { "NtPulseEvent" , 2 } ,
/*0x11F*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x120*/ { "NtQueryBootOptions" , 2 } ,
/*0x121*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x122*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x123*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x124*/ { "NtQueryEaFile" , 9 } ,
/*0x125*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x126*/ { "NtQueryInformationAtom" , 5 } ,
/*0x127*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x128*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x129*/ { "NtQueryInformationPort" , 5 } ,
/*0x12A*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x12B*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x12C*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x12D*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x12E*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x12F*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x130*/ { "NtQueryIoCompletion" , 5 } ,
/*0x131*/ { "NtQueryLicenseValue" , 5 } ,
/*0x132*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x133*/ { "NtQueryMutant" , 5 } ,
/*0x134*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x135*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x136*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x137*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x138*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x139*/ { "NtQuerySecurityObject" , 5 } ,
/*0x13A*/ { "NtQuerySemaphore" , 5 } ,
/*0x13B*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x13C*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x13D*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x13E*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x13F*/ { "NtQueryTimerResolution" , 3 } ,
/*0x140*/ { "NtQueryWnfStateData" , 6 } ,
/*0x141*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x142*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x143*/ { "NtRaiseException" , 3 } ,
/*0x144*/ { "NtRaiseHardError" , 6 } ,
/*0x145*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x146*/ { "NtRecoverEnlistment" , 2 } ,
/*0x147*/ { "NtRecoverResourceManager" , 1 } ,
/*0x148*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x149*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x14A*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x14B*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x14C*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x14D*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x14E*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x14F*/ { "NtRenameKey" , 2 } ,
/*0x150*/ { "NtRenameTransactionManager" , 2 } ,
/*0x151*/ { "NtReplaceKey" , 3 } ,
/*0x152*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x153*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x154*/ { "NtRequestPort" , 2 } ,
/*0x155*/ { "NtResetEvent" , 2 } ,
/*0x156*/ { "NtResetWriteWatch" , 3 } ,
/*0x157*/ { "NtRestoreKey" , 3 } ,
/*0x158*/ { "NtResumeProcess" , 1 } ,
/*0x159*/ { "NtRollbackComplete" , 2 } ,
/*0x15A*/ { "NtRollbackEnlistment" , 2 } ,
/*0x15B*/ { "NtRollbackTransaction" , 2 } ,
/*0x15C*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x15D*/ { "NtSaveKey" , 2 } ,
/*0x15E*/ { "NtSaveKeyEx" , 3 } ,
/*0x15F*/ { "NtSaveMergedKeys" , 3 } ,
/*0x160*/ { "NtSecureConnectPort" , 9 } ,
/*0x161*/ { "NtSerializeBoot" , 0 } ,
/*0x162*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x163*/ { "NtSetBootOptions" , 2 } ,
/*0x164*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x165*/ { "NtSetContextThread" , 2 } ,
/*0x166*/ { "NtSetDebugFilterState" , 3 } ,
/*0x167*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x168*/ { "NtSetDefaultLocale" , 2 } ,
/*0x169*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x16A*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x16B*/ { "NtSetEaFile" , 4 } ,
/*0x16C*/ { "NtSetHighEventPair" , 1 } ,
/*0x16D*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x16E*/ { "NtSetIRTimer" , 2 } ,
/*0x16F*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x170*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x171*/ { "NtSetInformationJobObject" , 4 } ,
/*0x172*/ { "NtSetInformationKey" , 4 } ,
/*0x173*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x174*/ { "NtSetInformationToken" , 4 } ,
/*0x175*/ { "NtSetInformationTransaction" , 4 } ,
/*0x176*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x177*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x178*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x179*/ { "NtSetIntervalProfile" , 2 } ,
/*0x17A*/ { "NtSetIoCompletion" , 5 } ,
/*0x17B*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x17C*/ { "NtSetLdtEntries" , 6 } ,
/*0x17D*/ { "NtSetLowEventPair" , 1 } ,
/*0x17E*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x17F*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x180*/ { "NtSetSecurityObject" , 3 } ,
/*0x181*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x182*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x183*/ { "NtSetSystemInformation" , 3 } ,
/*0x184*/ { "NtSetSystemPowerState" , 3 } ,
/*0x185*/ { "NtSetSystemTime" , 2 } ,
/*0x186*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x187*/ { "NtSetTimerEx" , 4 } ,
/*0x188*/ { "NtSetTimerResolution" , 3 } ,
/*0x189*/ { "NtSetUuidSeed" , 1 } ,
/*0x18A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x18B*/ { "NtShutdownSystem" , 1 } ,
/*0x18C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x18D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x18E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x18F*/ { "NtStartProfile" , 1 } ,
/*0x190*/ { "NtStopProfile" , 1 } ,
/*0x191*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x192*/ { "NtSuspendProcess" , 1 } ,
/*0x193*/ { "NtSuspendThread" , 2 } ,
/*0x194*/ { "NtSystemDebugControl" , 6 } ,
/*0x195*/ { "NtTerminateJobObject" , 2 } ,
/*0x196*/ { "NtTestAlert" , 0 } ,
/*0x197*/ { "NtThawRegistry" , 0 } ,
/*0x198*/ { "NtThawTransactions" , 0 } ,
/*0x199*/ { "NtTraceControl" , 6 } ,
/*0x19A*/ { "NtTranslateFilePath" , 4 } ,
/*0x19B*/ { "NtUmsThreadYield" , 1 } ,
/*0x19C*/ { "NtUnloadDriver" , 1 } ,
/*0x19D*/ { "NtUnloadKey" , 1 } ,
/*0x19E*/ { "NtUnloadKey2" , 2 } ,
/*0x19F*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1A0*/ { "NtUnlockFile" , 5 } ,
/*0x1A1*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1A2*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1A3*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1A4*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1A5*/ { "NtVdmControl" , 2 } ,
/*0x1A6*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1A7*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1A8*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1A9*/ { "NtWaitForWnfNotifications" , 2 } ,
/*0x1AA*/ { "NtWaitForWorkViaWorkerFactory" , 4 } ,
/*0x1AB*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1AC*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 6.3.9600-sp0-windows-8.1 amd64
SDT_NODE static_ssdt_6_3_9600_sp0_windows_8_1_amd64[433] = {
/*0x000*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x001*/ { "NtAcceptConnectPort" , 6 } ,
/*0x002*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x003*/ { "NtWaitForSingleObject" , 3 } ,
/*0x004*/ { "NtCallbackReturn" , 3 } ,
/*0x005*/ { "NtReadFile" , 9 } ,
/*0x006*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x007*/ { "NtWriteFile" , 9 } ,
/*0x008*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x009*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00A*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00B*/ { "NtReplyPort" , 2 } ,
/*0x00C*/ { "NtSetInformationThread" , 4 } ,
/*0x00D*/ { "NtSetEvent" , 2 } ,
/*0x00E*/ { "NtClose" , 1 } ,
/*0x00F*/ { "NtQueryObject" , 5 } ,
/*0x010*/ { "NtQueryInformationFile" , 5 } ,
/*0x011*/ { "NtOpenKey" , 3 } ,
/*0x012*/ { "NtEnumerateValueKey" , 6 } ,
/*0x013*/ { "NtFindAtom" , 3 } ,
/*0x014*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x015*/ { "NtQueryKey" , 5 } ,
/*0x016*/ { "NtQueryValueKey" , 6 } ,
/*0x017*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x018*/ { "NtQueryInformationProcess" , 5 } ,
/*0x019*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01A*/ { "NtWriteFileGather" , 9 } ,
/*0x01B*/ { "NtSetInformationProcess" , 4 } ,
/*0x01C*/ { "NtCreateKey" , 7 } ,
/*0x01D*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01E*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01F*/ { "NtReleaseMutant" , 2 } ,
/*0x020*/ { "NtQueryInformationToken" , 5 } ,
/*0x021*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x022*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x023*/ { "NtOpenThreadToken" , 4 } ,
/*0x024*/ { "NtQueryInformationThread" , 5 } ,
/*0x025*/ { "NtOpenProcess" , 4 } ,
/*0x026*/ { "NtSetInformationFile" , 5 } ,
/*0x027*/ { "NtMapViewOfSection" , 10 } ,
/*0x028*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x029*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02A*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02B*/ { "NtTerminateProcess" , 2 } ,
/*0x02C*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02D*/ { "NtReadFileScatter" , 9 } ,
/*0x02E*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02F*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x030*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x031*/ { "NtEnumerateKey" , 6 } ,
/*0x032*/ { "NtOpenFile" , 6 } ,
/*0x033*/ { "NtDelayExecution" , 2 } ,
/*0x034*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x035*/ { "NtQuerySystemInformation" , 4 } ,
/*0x036*/ { "NtOpenSection" , 3 } ,
/*0x037*/ { "NtQueryTimer" , 5 } ,
/*0x038*/ { "NtFsControlFile" , 10 } ,
/*0x039*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03A*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03B*/ { "NtDuplicateObject" , 7 } ,
/*0x03C*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03D*/ { "NtClearEvent" , 1 } ,
/*0x03E*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03F*/ { "NtOpenEvent" , 3 } ,
/*0x040*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x041*/ { "NtDuplicateToken" , 6 } ,
/*0x042*/ { "NtContinue" , 2 } ,
/*0x043*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x044*/ { "NtQueueApcThread" , 5 } ,
/*0x045*/ { "NtYieldExecution" , 0 } ,
/*0x046*/ { "NtAddAtom" , 3 } ,
/*0x047*/ { "NtCreateEvent" , 5 } ,
/*0x048*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x049*/ { "NtCreateSection" , 7 } ,
/*0x04A*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04B*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04C*/ { "NtCreateProcessEx" , 9 } ,
/*0x04D*/ { "NtCreateThread" , 8 } ,
/*0x04E*/ { "NtIsProcessInJob" , 2 } ,
/*0x04F*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x050*/ { "NtQuerySection" , 5 } ,
/*0x051*/ { "NtResumeThread" , 2 } ,
/*0x052*/ { "NtTerminateThread" , 2 } ,
/*0x053*/ { "NtReadRequestData" , 6 } ,
/*0x054*/ { "NtCreateFile" , 11 } ,
/*0x055*/ { "NtQueryEvent" , 5 } ,
/*0x056*/ { "NtWriteRequestData" , 6 } ,
/*0x057*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x058*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x059*/ { "NtQuerySystemTime" , 1 } ,
/*0x05A*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05B*/ { "NtSetInformationObject" , 4 } ,
/*0x05C*/ { "NtCancelIoFile" , 2 } ,
/*0x05D*/ { "NtTraceEvent" , 4 } ,
/*0x05E*/ { "NtPowerInformation" , 5 } ,
/*0x05F*/ { "NtSetValueKey" , 6 } ,
/*0x060*/ { "NtCancelTimer" , 2 } ,
/*0x061*/ { "NtSetTimer" , 7 } ,
/*0x062*/ { "NtAccessCheck" , 8 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x082*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x083*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x084*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x085*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x086*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x087*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x088*/ { "NtAlpcSetInformation" , 4 } ,
/*0x089*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08A*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08B*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08C*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08D*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08E*/ { "NtCancelTimer2" , 2 } ,
/*0x08F*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x090*/ { "NtCommitComplete" , 2 } ,
/*0x091*/ { "NtCommitEnlistment" , 2 } ,
/*0x092*/ { "NtCommitTransaction" , 2 } ,
/*0x093*/ { "NtCompactKeys" , 2 } ,
/*0x094*/ { "NtCompareTokens" , 3 } ,
/*0x095*/ { "NtCompleteConnectPort" , 1 } ,
/*0x096*/ { "NtCompressKey" , 1 } ,
/*0x097*/ { "NtConnectPort" , 8 } ,
/*0x098*/ { "NtCreateDebugObject" , 4 } ,
/*0x099*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09A*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09B*/ { "NtCreateEnlistment" , 8 } ,
/*0x09C*/ { "NtCreateEventPair" , 3 } ,
/*0x09D*/ { "NtCreateIRTimer" , 2 } ,
/*0x09E*/ { "NtCreateIoCompletion" , 4 } ,
/*0x09F*/ { "NtCreateJobObject" , 3 } ,
/*0x0A0*/ { "NtCreateJobSet" , 3 } ,
/*0x0A1*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A2*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A3*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A4*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A5*/ { "NtCreateMutant" , 4 } ,
/*0x0A6*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0A7*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A8*/ { "NtCreatePort" , 5 } ,
/*0x0A9*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AA*/ { "NtCreateProcess" , 8 } ,
/*0x0AB*/ { "NtCreateProfile" , 9 } ,
/*0x0AC*/ { "NtCreateProfileEx" , 10 } ,
/*0x0AD*/ { "NtCreateResourceManager" , 7 } ,
/*0x0AE*/ { "NtCreateSemaphore" , 5 } ,
/*0x0AF*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B0*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B1*/ { "NtCreateTimer" , 4 } ,
/*0x0B2*/ { "NtCreateTimer2" , 5 } ,
/*0x0B3*/ { "NtCreateToken" , 13 } ,
/*0x0B4*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B5*/ { "NtCreateTransaction" , 10 } ,
/*0x0B6*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0B7*/ { "NtCreateUserProcess" , 11 } ,
/*0x0B8*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0B9*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0BA*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0BB*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0BC*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0BD*/ { "NtDebugContinue" , 3 } ,
/*0x0BE*/ { "NtDeleteAtom" , 1 } ,
/*0x0BF*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C0*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C1*/ { "NtDeleteFile" , 1 } ,
/*0x0C2*/ { "NtDeleteKey" , 1 } ,
/*0x0C3*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C4*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C5*/ { "NtDeleteValueKey" , 2 } ,
/*0x0C6*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0C7*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0C8*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0C9*/ { "NtDisplayString" , 1 } ,
/*0x0CA*/ { "NtDrawText" , 1 } ,
/*0x0CB*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0CC*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0CD*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0CE*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0CF*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D0*/ { "NtExtendSection" , 2 } ,
/*0x0D1*/ { "NtFilterBootOption" , 5 } ,
/*0x0D2*/ { "NtFilterToken" , 6 } ,
/*0x0D3*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D4*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D5*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0D6*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0D7*/ { "NtFlushKey" , 1 } ,
/*0x0D8*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0D9*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0DA*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0DB*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0DC*/ { "NtFreezeRegistry" , 1 } ,
/*0x0DD*/ { "NtFreezeTransactions" , 2 } ,
/*0x0DE*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0DF*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E0*/ { "NtGetContextThread" , 2 } ,
/*0x0E1*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E2*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E3*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E4*/ { "NtGetNextProcess" , 5 } ,
/*0x0E5*/ { "NtGetNextThread" , 6 } ,
/*0x0E6*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0E7*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0E8*/ { "NtGetWriteWatch" , 7 } ,
/*0x0E9*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0EA*/ { "NtImpersonateThread" , 3 } ,
/*0x0EB*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0EC*/ { "NtInitializeRegistry" , 1 } ,
/*0x0ED*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0EE*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0EF*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F0*/ { "NtListenPort" , 2 } ,
/*0x0F1*/ { "NtLoadDriver" , 1 } ,
/*0x0F2*/ { "NtLoadKey" , 2 } ,
/*0x0F3*/ { "NtLoadKey2" , 3 } ,
/*0x0F4*/ { "NtLoadKeyEx" , 8 } ,
/*0x0F5*/ { "NtLockFile" , 10 } ,
/*0x0F6*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0F7*/ { "NtLockRegistryKey" , 1 } ,
/*0x0F8*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0F9*/ { "NtMakePermanentObject" , 1 } ,
/*0x0FA*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0FB*/ { "NtMapCMFModule" , 6 } ,
/*0x0FC*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0FD*/ { "NtModifyBootEntry" , 1 } ,
/*0x0FE*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0FF*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x100*/ { "NtNotifyChangeKey" , 10 } ,
/*0x101*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x102*/ { "NtNotifyChangeSession" , 8 } ,
/*0x103*/ { "NtOpenEnlistment" , 5 } ,
/*0x104*/ { "NtOpenEventPair" , 3 } ,
/*0x105*/ { "NtOpenIoCompletion" , 3 } ,
/*0x106*/ { "NtOpenJobObject" , 3 } ,
/*0x107*/ { "NtOpenKeyEx" , 4 } ,
/*0x108*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x109*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x10A*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x10B*/ { "NtOpenMutant" , 3 } ,
/*0x10C*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x10D*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x10E*/ { "NtOpenProcessToken" , 3 } ,
/*0x10F*/ { "NtOpenResourceManager" , 5 } ,
/*0x110*/ { "NtOpenSemaphore" , 3 } ,
/*0x111*/ { "NtOpenSession" , 3 } ,
/*0x112*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x113*/ { "NtOpenThread" , 4 } ,
/*0x114*/ { "NtOpenTimer" , 3 } ,
/*0x115*/ { "NtOpenTransaction" , 5 } ,
/*0x116*/ { "NtOpenTransactionManager" , 6 } ,
/*0x117*/ { "NtPlugPlayControl" , 3 } ,
/*0x118*/ { "NtPrePrepareComplete" , 2 } ,
/*0x119*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x11A*/ { "NtPrepareComplete" , 2 } ,
/*0x11B*/ { "NtPrepareEnlistment" , 2 } ,
/*0x11C*/ { "NtPrivilegeCheck" , 3 } ,
/*0x11D*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x11E*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x11F*/ { "NtPropagationComplete" , 4 } ,
/*0x120*/ { "NtPropagationFailed" , 3 } ,
/*0x121*/ { "NtPulseEvent" , 2 } ,
/*0x122*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x123*/ { "NtQueryBootOptions" , 2 } ,
/*0x124*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x125*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x126*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x127*/ { "NtQueryEaFile" , 9 } ,
/*0x128*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x129*/ { "NtQueryInformationAtom" , 5 } ,
/*0x12A*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x12B*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x12C*/ { "NtQueryInformationPort" , 5 } ,
/*0x12D*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x12E*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x12F*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x130*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x131*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x132*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x133*/ { "NtQueryIoCompletion" , 5 } ,
/*0x134*/ { "NtQueryLicenseValue" , 5 } ,
/*0x135*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x136*/ { "NtQueryMutant" , 5 } ,
/*0x137*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x138*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x139*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x13A*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x13B*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x13C*/ { "NtQuerySecurityObject" , 5 } ,
/*0x13D*/ { "NtQuerySemaphore" , 5 } ,
/*0x13E*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x13F*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x140*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x141*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x142*/ { "NtQueryTimerResolution" , 3 } ,
/*0x143*/ { "NtQueryWnfStateData" , 6 } ,
/*0x144*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x145*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x146*/ { "NtRaiseException" , 3 } ,
/*0x147*/ { "NtRaiseHardError" , 6 } ,
/*0x148*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x149*/ { "NtRecoverEnlistment" , 2 } ,
/*0x14A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x14B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x14C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x14D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x14E*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x14F*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x150*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x151*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x152*/ { "NtRenameKey" , 2 } ,
/*0x153*/ { "NtRenameTransactionManager" , 2 } ,
/*0x154*/ { "NtReplaceKey" , 3 } ,
/*0x155*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x156*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x157*/ { "NtRequestPort" , 2 } ,
/*0x158*/ { "NtResetEvent" , 2 } ,
/*0x159*/ { "NtResetWriteWatch" , 3 } ,
/*0x15A*/ { "NtRestoreKey" , 3 } ,
/*0x15B*/ { "NtResumeProcess" , 1 } ,
/*0x15C*/ { "NtRollbackComplete" , 2 } ,
/*0x15D*/ { "NtRollbackEnlistment" , 2 } ,
/*0x15E*/ { "NtRollbackTransaction" , 2 } ,
/*0x15F*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x160*/ { "NtSaveKey" , 2 } ,
/*0x161*/ { "NtSaveKeyEx" , 3 } ,
/*0x162*/ { "NtSaveMergedKeys" , 3 } ,
/*0x163*/ { "NtSecureConnectPort" , 9 } ,
/*0x164*/ { "NtSerializeBoot" , 0 } ,
/*0x165*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x166*/ { "NtSetBootOptions" , 2 } ,
/*0x167*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x168*/ { "NtSetContextThread" , 2 } ,
/*0x169*/ { "NtSetDebugFilterState" , 3 } ,
/*0x16A*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x16B*/ { "NtSetDefaultLocale" , 2 } ,
/*0x16C*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x16D*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x16E*/ { "NtSetEaFile" , 4 } ,
/*0x16F*/ { "NtSetHighEventPair" , 1 } ,
/*0x170*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x171*/ { "NtSetIRTimer" , 2 } ,
/*0x172*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x173*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x174*/ { "NtSetInformationJobObject" , 4 } ,
/*0x175*/ { "NtSetInformationKey" , 4 } ,
/*0x176*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x177*/ { "NtSetInformationToken" , 4 } ,
/*0x178*/ { "NtSetInformationTransaction" , 4 } ,
/*0x179*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x17A*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x17B*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x17C*/ { "NtSetIntervalProfile" , 2 } ,
/*0x17D*/ { "NtSetIoCompletion" , 5 } ,
/*0x17E*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x17F*/ { "NtSetLdtEntries" , 6 } ,
/*0x180*/ { "NtSetLowEventPair" , 1 } ,
/*0x181*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x182*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x183*/ { "NtSetSecurityObject" , 3 } ,
/*0x184*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x185*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x186*/ { "NtSetSystemInformation" , 3 } ,
/*0x187*/ { "NtSetSystemPowerState" , 3 } ,
/*0x188*/ { "NtSetSystemTime" , 2 } ,
/*0x189*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x18A*/ { "NtSetTimer2" , 4 } ,
/*0x18B*/ { "NtSetTimerEx" , 4 } ,
/*0x18C*/ { "NtSetTimerResolution" , 3 } ,
/*0x18D*/ { "NtSetUuidSeed" , 1 } ,
/*0x18E*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x18F*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x190*/ { "NtShutdownSystem" , 1 } ,
/*0x191*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x192*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x193*/ { "NtSinglePhaseReject" , 2 } ,
/*0x194*/ { "NtStartProfile" , 1 } ,
/*0x195*/ { "NtStopProfile" , 1 } ,
/*0x196*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x197*/ { "NtSuspendProcess" , 1 } ,
/*0x198*/ { "NtSuspendThread" , 2 } ,
/*0x199*/ { "NtSystemDebugControl" , 6 } ,
/*0x19A*/ { "NtTerminateJobObject" , 2 } ,
/*0x19B*/ { "NtTestAlert" , 0 } ,
/*0x19C*/ { "NtThawRegistry" , 0 } ,
/*0x19D*/ { "NtThawTransactions" , 0 } ,
/*0x19E*/ { "NtTraceControl" , 6 } ,
/*0x19F*/ { "NtTranslateFilePath" , 4 } ,
/*0x1A0*/ { "NtUmsThreadYield" , 1 } ,
/*0x1A1*/ { "NtUnloadDriver" , 1 } ,
/*0x1A2*/ { "NtUnloadKey" , 1 } ,
/*0x1A3*/ { "NtUnloadKey2" , 2 } ,
/*0x1A4*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1A5*/ { "NtUnlockFile" , 5 } ,
/*0x1A6*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1A7*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1A8*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1A9*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1AA*/ { "NtVdmControl" , 2 } ,
/*0x1AB*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1AC*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1AD*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1AE*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1AF*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1B0*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.10240-sp0-windows-10-th1-1507 amd64
SDT_NODE static_ssdt_10_0_10240_sp0_windows_10_th1_1507_amd64[441] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x082*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x083*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x084*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x085*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x086*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x087*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x088*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x089*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08A*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08B*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08C*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08D*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08E*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08F*/ { "NtCancelTimer2" , 2 } ,
/*0x090*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x091*/ { "NtCommitComplete" , 2 } ,
/*0x092*/ { "NtCommitEnlistment" , 2 } ,
/*0x093*/ { "NtCommitTransaction" , 2 } ,
/*0x094*/ { "NtCompactKeys" , 2 } ,
/*0x095*/ { "NtCompareObjects" , 2 } ,
/*0x096*/ { "NtCompareTokens" , 3 } ,
/*0x097*/ { "NtCompleteConnectPort" , 1 } ,
/*0x098*/ { "NtCompressKey" , 1 } ,
/*0x099*/ { "NtConnectPort" , 8 } ,
/*0x09A*/ { "NtCreateDebugObject" , 4 } ,
/*0x09B*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09C*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09D*/ { "NtCreateEnlistment" , 8 } ,
/*0x09E*/ { "NtCreateEventPair" , 3 } ,
/*0x09F*/ { "NtCreateIRTimer" , 2 } ,
/*0x0A0*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A1*/ { "NtCreateJobObject" , 3 } ,
/*0x0A2*/ { "NtCreateJobSet" , 3 } ,
/*0x0A3*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A4*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A5*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A6*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A7*/ { "NtCreateMutant" , 4 } ,
/*0x0A8*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0A9*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AA*/ { "NtCreatePartition" , 5 } ,
/*0x0AB*/ { "NtCreatePort" , 5 } ,
/*0x0AC*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AD*/ { "NtCreateProcess" , 8 } ,
/*0x0AE*/ { "NtCreateProfile" , 9 } ,
/*0x0AF*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B0*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B1*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B2*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B3*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B4*/ { "NtCreateTimer" , 4 } ,
/*0x0B5*/ { "NtCreateTimer2" , 5 } ,
/*0x0B6*/ { "NtCreateToken" , 13 } ,
/*0x0B7*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B8*/ { "NtCreateTransaction" , 10 } ,
/*0x0B9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0BA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0BB*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0BC*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0BD*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0BE*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0BF*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C0*/ { "NtDebugContinue" , 3 } ,
/*0x0C1*/ { "NtDeleteAtom" , 1 } ,
/*0x0C2*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C3*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C4*/ { "NtDeleteFile" , 1 } ,
/*0x0C5*/ { "NtDeleteKey" , 1 } ,
/*0x0C6*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C7*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C8*/ { "NtDeleteValueKey" , 2 } ,
/*0x0C9*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0CA*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0CB*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0CC*/ { "NtDisplayString" , 1 } ,
/*0x0CD*/ { "NtDrawText" , 1 } ,
/*0x0CE*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0CF*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D0*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D1*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D2*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D3*/ { "NtExtendSection" , 2 } ,
/*0x0D4*/ { "NtFilterBootOption" , 5 } ,
/*0x0D5*/ { "NtFilterToken" , 6 } ,
/*0x0D6*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D7*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D8*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0D9*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0DA*/ { "NtFlushKey" , 1 } ,
/*0x0DB*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0DC*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0DD*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0DE*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0DF*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E0*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E1*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E2*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E3*/ { "NtGetContextThread" , 2 } ,
/*0x0E4*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E5*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0E6*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E7*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E8*/ { "NtGetNextProcess" , 5 } ,
/*0x0E9*/ { "NtGetNextThread" , 6 } ,
/*0x0EA*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0EB*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0EC*/ { "NtGetWriteWatch" , 7 } ,
/*0x0ED*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0EE*/ { "NtImpersonateThread" , 3 } ,
/*0x0EF*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F0*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F1*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F2*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0F3*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F4*/ { "NtListenPort" , 2 } ,
/*0x0F5*/ { "NtLoadDriver" , 1 } ,
/*0x0F6*/ { "NtLoadKey" , 2 } ,
/*0x0F7*/ { "NtLoadKey2" , 3 } ,
/*0x0F8*/ { "NtLoadKeyEx" , 8 } ,
/*0x0F9*/ { "NtLockFile" , 10 } ,
/*0x0FA*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0FB*/ { "NtLockRegistryKey" , 1 } ,
/*0x0FC*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0FD*/ { "NtMakePermanentObject" , 1 } ,
/*0x0FE*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0FF*/ { "NtManagePartition" , 5 } ,
/*0x100*/ { "NtMapCMFModule" , 6 } ,
/*0x101*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x102*/ { "NtModifyBootEntry" , 1 } ,
/*0x103*/ { "NtModifyDriverEntry" , 1 } ,
/*0x104*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x105*/ { "NtNotifyChangeKey" , 10 } ,
/*0x106*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x107*/ { "NtNotifyChangeSession" , 8 } ,
/*0x108*/ { "NtOpenEnlistment" , 5 } ,
/*0x109*/ { "NtOpenEventPair" , 3 } ,
/*0x10A*/ { "NtOpenIoCompletion" , 3 } ,
/*0x10B*/ { "NtOpenJobObject" , 3 } ,
/*0x10C*/ { "NtOpenKeyEx" , 4 } ,
/*0x10D*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x10E*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x10F*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x110*/ { "NtOpenMutant" , 3 } ,
/*0x111*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x112*/ { "NtOpenPartition" , 3 } ,
/*0x113*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x114*/ { "NtOpenProcessToken" , 3 } ,
/*0x115*/ { "NtOpenResourceManager" , 5 } ,
/*0x116*/ { "NtOpenSemaphore" , 3 } ,
/*0x117*/ { "NtOpenSession" , 3 } ,
/*0x118*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x119*/ { "NtOpenThread" , 4 } ,
/*0x11A*/ { "NtOpenTimer" , 3 } ,
/*0x11B*/ { "NtOpenTransaction" , 5 } ,
/*0x11C*/ { "NtOpenTransactionManager" , 6 } ,
/*0x11D*/ { "NtPlugPlayControl" , 3 } ,
/*0x11E*/ { "NtPrePrepareComplete" , 2 } ,
/*0x11F*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x120*/ { "NtPrepareComplete" , 2 } ,
/*0x121*/ { "NtPrepareEnlistment" , 2 } ,
/*0x122*/ { "NtPrivilegeCheck" , 3 } ,
/*0x123*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x124*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x125*/ { "NtPropagationComplete" , 4 } ,
/*0x126*/ { "NtPropagationFailed" , 3 } ,
/*0x127*/ { "NtPulseEvent" , 2 } ,
/*0x128*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x129*/ { "NtQueryBootOptions" , 2 } ,
/*0x12A*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x12B*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x12C*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x12D*/ { "NtQueryEaFile" , 9 } ,
/*0x12E*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x12F*/ { "NtQueryInformationAtom" , 5 } ,
/*0x130*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x131*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x132*/ { "NtQueryInformationPort" , 5 } ,
/*0x133*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x134*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x135*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x136*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x137*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x138*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x139*/ { "NtQueryIoCompletion" , 5 } ,
/*0x13A*/ { "NtQueryLicenseValue" , 5 } ,
/*0x13B*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x13C*/ { "NtQueryMutant" , 5 } ,
/*0x13D*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x13E*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x13F*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x140*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x141*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x142*/ { "NtQuerySecurityObject" , 5 } ,
/*0x143*/ { "NtQuerySemaphore" , 5 } ,
/*0x144*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x145*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x146*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x147*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x148*/ { "NtQueryTimerResolution" , 3 } ,
/*0x149*/ { "NtQueryWnfStateData" , 6 } ,
/*0x14A*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x14B*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x14C*/ { "NtRaiseException" , 3 } ,
/*0x14D*/ { "NtRaiseHardError" , 6 } ,
/*0x14E*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x14F*/ { "NtRecoverEnlistment" , 2 } ,
/*0x150*/ { "NtRecoverResourceManager" , 1 } ,
/*0x151*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x152*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x153*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x154*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x155*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x156*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x157*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x158*/ { "NtRenameKey" , 2 } ,
/*0x159*/ { "NtRenameTransactionManager" , 2 } ,
/*0x15A*/ { "NtReplaceKey" , 3 } ,
/*0x15B*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x15C*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x15D*/ { "NtRequestPort" , 2 } ,
/*0x15E*/ { "NtResetEvent" , 2 } ,
/*0x15F*/ { "NtResetWriteWatch" , 3 } ,
/*0x160*/ { "NtRestoreKey" , 3 } ,
/*0x161*/ { "NtResumeProcess" , 1 } ,
/*0x162*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x163*/ { "NtRollbackComplete" , 2 } ,
/*0x164*/ { "NtRollbackEnlistment" , 2 } ,
/*0x165*/ { "NtRollbackTransaction" , 2 } ,
/*0x166*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x167*/ { "NtSaveKey" , 2 } ,
/*0x168*/ { "NtSaveKeyEx" , 3 } ,
/*0x169*/ { "NtSaveMergedKeys" , 3 } ,
/*0x16A*/ { "NtSecureConnectPort" , 9 } ,
/*0x16B*/ { "NtSerializeBoot" , 0 } ,
/*0x16C*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x16D*/ { "NtSetBootOptions" , 2 } ,
/*0x16E*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x16F*/ { "NtSetContextThread" , 2 } ,
/*0x170*/ { "NtSetDebugFilterState" , 3 } ,
/*0x171*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x172*/ { "NtSetDefaultLocale" , 2 } ,
/*0x173*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x174*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x175*/ { "NtSetEaFile" , 4 } ,
/*0x176*/ { "NtSetHighEventPair" , 1 } ,
/*0x177*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x178*/ { "NtSetIRTimer" , 2 } ,
/*0x179*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x17A*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x17B*/ { "NtSetInformationJobObject" , 4 } ,
/*0x17C*/ { "NtSetInformationKey" , 4 } ,
/*0x17D*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x17E*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x17F*/ { "NtSetInformationToken" , 4 } ,
/*0x180*/ { "NtSetInformationTransaction" , 4 } ,
/*0x181*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x182*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x183*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x184*/ { "NtSetIntervalProfile" , 2 } ,
/*0x185*/ { "NtSetIoCompletion" , 5 } ,
/*0x186*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x187*/ { "NtSetLdtEntries" , 6 } ,
/*0x188*/ { "NtSetLowEventPair" , 1 } ,
/*0x189*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x18A*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x18B*/ { "NtSetSecurityObject" , 3 } ,
/*0x18C*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x18D*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x18E*/ { "NtSetSystemInformation" , 3 } ,
/*0x18F*/ { "NtSetSystemPowerState" , 3 } ,
/*0x190*/ { "NtSetSystemTime" , 2 } ,
/*0x191*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x192*/ { "NtSetTimer2" , 4 } ,
/*0x193*/ { "NtSetTimerEx" , 4 } ,
/*0x194*/ { "NtSetTimerResolution" , 3 } ,
/*0x195*/ { "NtSetUuidSeed" , 1 } ,
/*0x196*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x197*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x198*/ { "NtShutdownSystem" , 1 } ,
/*0x199*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x19A*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x19B*/ { "NtSinglePhaseReject" , 2 } ,
/*0x19C*/ { "NtStartProfile" , 1 } ,
/*0x19D*/ { "NtStopProfile" , 1 } ,
/*0x19E*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x19F*/ { "NtSuspendProcess" , 1 } ,
/*0x1A0*/ { "NtSuspendThread" , 2 } ,
/*0x1A1*/ { "NtSystemDebugControl" , 6 } ,
/*0x1A2*/ { "NtTerminateJobObject" , 2 } ,
/*0x1A3*/ { "NtTestAlert" , 0 } ,
/*0x1A4*/ { "NtThawRegistry" , 0 } ,
/*0x1A5*/ { "NtThawTransactions" , 0 } ,
/*0x1A6*/ { "NtTraceControl" , 6 } ,
/*0x1A7*/ { "NtTranslateFilePath" , 4 } ,
/*0x1A8*/ { "NtUmsThreadYield" , 1 } ,
/*0x1A9*/ { "NtUnloadDriver" , 1 } ,
/*0x1AA*/ { "NtUnloadKey" , 1 } ,
/*0x1AB*/ { "NtUnloadKey2" , 2 } ,
/*0x1AC*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1AD*/ { "NtUnlockFile" , 5 } ,
/*0x1AE*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1AF*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1B0*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1B1*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1B2*/ { "NtVdmControl" , 2 } ,
/*0x1B3*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1B4*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1B5*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1B6*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1B7*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1B8*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.10586-sp0-windows-10-th2-1511 amd64
SDT_NODE static_ssdt_10_0_10586_sp0_windows_10_th2_1511_amd64[444] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x082*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x083*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x084*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x085*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x086*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x087*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x088*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x089*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08A*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08B*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08C*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08D*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08E*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08F*/ { "NtCancelTimer2" , 2 } ,
/*0x090*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x091*/ { "NtCommitComplete" , 2 } ,
/*0x092*/ { "NtCommitEnlistment" , 2 } ,
/*0x093*/ { "NtCommitTransaction" , 2 } ,
/*0x094*/ { "NtCompactKeys" , 2 } ,
/*0x095*/ { "NtCompareObjects" , 2 } ,
/*0x096*/ { "NtCompareTokens" , 3 } ,
/*0x097*/ { "NtCompleteConnectPort" , 1 } ,
/*0x098*/ { "NtCompressKey" , 1 } ,
/*0x099*/ { "NtConnectPort" , 8 } ,
/*0x09A*/ { "NtCreateDebugObject" , 4 } ,
/*0x09B*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09C*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09D*/ { "NtCreateEnclave" , 9 } ,
/*0x09E*/ { "NtCreateEnlistment" , 8 } ,
/*0x09F*/ { "NtCreateEventPair" , 3 } ,
/*0x0A0*/ { "NtCreateIRTimer" , 2 } ,
/*0x0A1*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A2*/ { "NtCreateJobObject" , 3 } ,
/*0x0A3*/ { "NtCreateJobSet" , 3 } ,
/*0x0A4*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A5*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A6*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A7*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A8*/ { "NtCreateMutant" , 4 } ,
/*0x0A9*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0AA*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AB*/ { "NtCreatePartition" , 4 } ,
/*0x0AC*/ { "NtCreatePort" , 5 } ,
/*0x0AD*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AE*/ { "NtCreateProcess" , 8 } ,
/*0x0AF*/ { "NtCreateProfile" , 9 } ,
/*0x0B0*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B1*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B2*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B3*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B4*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B5*/ { "NtCreateTimer" , 4 } ,
/*0x0B6*/ { "NtCreateTimer2" , 5 } ,
/*0x0B7*/ { "NtCreateToken" , 13 } ,
/*0x0B8*/ { "NtCreateTokenEx" , 17 } ,
/*0x0B9*/ { "NtCreateTransaction" , 10 } ,
/*0x0BA*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0BB*/ { "NtCreateUserProcess" , 11 } ,
/*0x0BC*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0BD*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0BE*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0BF*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0C0*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C1*/ { "NtDebugContinue" , 3 } ,
/*0x0C2*/ { "NtDeleteAtom" , 1 } ,
/*0x0C3*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C4*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C5*/ { "NtDeleteFile" , 1 } ,
/*0x0C6*/ { "NtDeleteKey" , 1 } ,
/*0x0C7*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0C8*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0C9*/ { "NtDeleteValueKey" , 2 } ,
/*0x0CA*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0CB*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0CC*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0CD*/ { "NtDisplayString" , 1 } ,
/*0x0CE*/ { "NtDrawText" , 1 } ,
/*0x0CF*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0D0*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D1*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D2*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D3*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D4*/ { "NtExtendSection" , 2 } ,
/*0x0D5*/ { "NtFilterBootOption" , 5 } ,
/*0x0D6*/ { "NtFilterToken" , 6 } ,
/*0x0D7*/ { "NtFilterTokenEx" , 14 } ,
/*0x0D8*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0D9*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0DA*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0DB*/ { "NtFlushKey" , 1 } ,
/*0x0DC*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0DD*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0DE*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0DF*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0E0*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E1*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E2*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E3*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E4*/ { "NtGetContextThread" , 2 } ,
/*0x0E5*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E6*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0E7*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0E8*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0E9*/ { "NtGetNextProcess" , 5 } ,
/*0x0EA*/ { "NtGetNextThread" , 6 } ,
/*0x0EB*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0EC*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0ED*/ { "NtGetWriteWatch" , 7 } ,
/*0x0EE*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0EF*/ { "NtImpersonateThread" , 3 } ,
/*0x0F0*/ { "NtInitializeEnclave" , 5 } ,
/*0x0F1*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F2*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F3*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F4*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0F5*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F6*/ { "NtListenPort" , 2 } ,
/*0x0F7*/ { "NtLoadDriver" , 1 } ,
/*0x0F8*/ { "NtLoadEnclaveData" , 9 } ,
/*0x0F9*/ { "NtLoadKey" , 2 } ,
/*0x0FA*/ { "NtLoadKey2" , 3 } ,
/*0x0FB*/ { "NtLoadKeyEx" , 8 } ,
/*0x0FC*/ { "NtLockFile" , 10 } ,
/*0x0FD*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0FE*/ { "NtLockRegistryKey" , 1 } ,
/*0x0FF*/ { "NtLockVirtualMemory" , 4 } ,
/*0x100*/ { "NtMakePermanentObject" , 1 } ,
/*0x101*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x102*/ { "NtManagePartition" , 5 } ,
/*0x103*/ { "NtMapCMFModule" , 6 } ,
/*0x104*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x105*/ { "NtModifyBootEntry" , 1 } ,
/*0x106*/ { "NtModifyDriverEntry" , 1 } ,
/*0x107*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x108*/ { "NtNotifyChangeKey" , 10 } ,
/*0x109*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x10A*/ { "NtNotifyChangeSession" , 8 } ,
/*0x10B*/ { "NtOpenEnlistment" , 5 } ,
/*0x10C*/ { "NtOpenEventPair" , 3 } ,
/*0x10D*/ { "NtOpenIoCompletion" , 3 } ,
/*0x10E*/ { "NtOpenJobObject" , 3 } ,
/*0x10F*/ { "NtOpenKeyEx" , 4 } ,
/*0x110*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x111*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x112*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x113*/ { "NtOpenMutant" , 3 } ,
/*0x114*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x115*/ { "NtOpenPartition" , 3 } ,
/*0x116*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x117*/ { "NtOpenProcessToken" , 3 } ,
/*0x118*/ { "NtOpenResourceManager" , 5 } ,
/*0x119*/ { "NtOpenSemaphore" , 3 } ,
/*0x11A*/ { "NtOpenSession" , 3 } ,
/*0x11B*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x11C*/ { "NtOpenThread" , 4 } ,
/*0x11D*/ { "NtOpenTimer" , 3 } ,
/*0x11E*/ { "NtOpenTransaction" , 5 } ,
/*0x11F*/ { "NtOpenTransactionManager" , 6 } ,
/*0x120*/ { "NtPlugPlayControl" , 3 } ,
/*0x121*/ { "NtPrePrepareComplete" , 2 } ,
/*0x122*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x123*/ { "NtPrepareComplete" , 2 } ,
/*0x124*/ { "NtPrepareEnlistment" , 2 } ,
/*0x125*/ { "NtPrivilegeCheck" , 3 } ,
/*0x126*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x127*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x128*/ { "NtPropagationComplete" , 4 } ,
/*0x129*/ { "NtPropagationFailed" , 3 } ,
/*0x12A*/ { "NtPulseEvent" , 2 } ,
/*0x12B*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x12C*/ { "NtQueryBootOptions" , 2 } ,
/*0x12D*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x12E*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x12F*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x130*/ { "NtQueryEaFile" , 9 } ,
/*0x131*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x132*/ { "NtQueryInformationAtom" , 5 } ,
/*0x133*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x134*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x135*/ { "NtQueryInformationPort" , 5 } ,
/*0x136*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x137*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x138*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x139*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x13A*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x13B*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x13C*/ { "NtQueryIoCompletion" , 5 } ,
/*0x13D*/ { "NtQueryLicenseValue" , 5 } ,
/*0x13E*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x13F*/ { "NtQueryMutant" , 5 } ,
/*0x140*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x141*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x142*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x143*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x144*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x145*/ { "NtQuerySecurityObject" , 5 } ,
/*0x146*/ { "NtQuerySemaphore" , 5 } ,
/*0x147*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x148*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x149*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x14A*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x14B*/ { "NtQueryTimerResolution" , 3 } ,
/*0x14C*/ { "NtQueryWnfStateData" , 6 } ,
/*0x14D*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x14E*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x14F*/ { "NtRaiseException" , 3 } ,
/*0x150*/ { "NtRaiseHardError" , 6 } ,
/*0x151*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x152*/ { "NtRecoverEnlistment" , 2 } ,
/*0x153*/ { "NtRecoverResourceManager" , 1 } ,
/*0x154*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x155*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x156*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x157*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x158*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x159*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x15A*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x15B*/ { "NtRenameKey" , 2 } ,
/*0x15C*/ { "NtRenameTransactionManager" , 2 } ,
/*0x15D*/ { "NtReplaceKey" , 3 } ,
/*0x15E*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x15F*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x160*/ { "NtRequestPort" , 2 } ,
/*0x161*/ { "NtResetEvent" , 2 } ,
/*0x162*/ { "NtResetWriteWatch" , 3 } ,
/*0x163*/ { "NtRestoreKey" , 3 } ,
/*0x164*/ { "NtResumeProcess" , 1 } ,
/*0x165*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x166*/ { "NtRollbackComplete" , 2 } ,
/*0x167*/ { "NtRollbackEnlistment" , 2 } ,
/*0x168*/ { "NtRollbackTransaction" , 2 } ,
/*0x169*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x16A*/ { "NtSaveKey" , 2 } ,
/*0x16B*/ { "NtSaveKeyEx" , 3 } ,
/*0x16C*/ { "NtSaveMergedKeys" , 3 } ,
/*0x16D*/ { "NtSecureConnectPort" , 9 } ,
/*0x16E*/ { "NtSerializeBoot" , 0 } ,
/*0x16F*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x170*/ { "NtSetBootOptions" , 2 } ,
/*0x171*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x172*/ { "NtSetContextThread" , 2 } ,
/*0x173*/ { "NtSetDebugFilterState" , 3 } ,
/*0x174*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x175*/ { "NtSetDefaultLocale" , 2 } ,
/*0x176*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x177*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x178*/ { "NtSetEaFile" , 4 } ,
/*0x179*/ { "NtSetHighEventPair" , 1 } ,
/*0x17A*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x17B*/ { "NtSetIRTimer" , 2 } ,
/*0x17C*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x17D*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x17E*/ { "NtSetInformationJobObject" , 4 } ,
/*0x17F*/ { "NtSetInformationKey" , 4 } ,
/*0x180*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x181*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x182*/ { "NtSetInformationToken" , 4 } ,
/*0x183*/ { "NtSetInformationTransaction" , 4 } ,
/*0x184*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x185*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x186*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x187*/ { "NtSetIntervalProfile" , 2 } ,
/*0x188*/ { "NtSetIoCompletion" , 5 } ,
/*0x189*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x18A*/ { "NtSetLdtEntries" , 6 } ,
/*0x18B*/ { "NtSetLowEventPair" , 1 } ,
/*0x18C*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x18D*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x18E*/ { "NtSetSecurityObject" , 3 } ,
/*0x18F*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x190*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x191*/ { "NtSetSystemInformation" , 3 } ,
/*0x192*/ { "NtSetSystemPowerState" , 3 } ,
/*0x193*/ { "NtSetSystemTime" , 2 } ,
/*0x194*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x195*/ { "NtSetTimer2" , 4 } ,
/*0x196*/ { "NtSetTimerEx" , 4 } ,
/*0x197*/ { "NtSetTimerResolution" , 3 } ,
/*0x198*/ { "NtSetUuidSeed" , 1 } ,
/*0x199*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x19A*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x19B*/ { "NtShutdownSystem" , 1 } ,
/*0x19C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x19D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x19E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x19F*/ { "NtStartProfile" , 1 } ,
/*0x1A0*/ { "NtStopProfile" , 1 } ,
/*0x1A1*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x1A2*/ { "NtSuspendProcess" , 1 } ,
/*0x1A3*/ { "NtSuspendThread" , 2 } ,
/*0x1A4*/ { "NtSystemDebugControl" , 6 } ,
/*0x1A5*/ { "NtTerminateJobObject" , 2 } ,
/*0x1A6*/ { "NtTestAlert" , 0 } ,
/*0x1A7*/ { "NtThawRegistry" , 0 } ,
/*0x1A8*/ { "NtThawTransactions" , 0 } ,
/*0x1A9*/ { "NtTraceControl" , 6 } ,
/*0x1AA*/ { "NtTranslateFilePath" , 4 } ,
/*0x1AB*/ { "NtUmsThreadYield" , 1 } ,
/*0x1AC*/ { "NtUnloadDriver" , 1 } ,
/*0x1AD*/ { "NtUnloadKey" , 1 } ,
/*0x1AE*/ { "NtUnloadKey2" , 2 } ,
/*0x1AF*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1B0*/ { "NtUnlockFile" , 5 } ,
/*0x1B1*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1B2*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1B3*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1B4*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1B5*/ { "NtVdmControl" , 2 } ,
/*0x1B6*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1B7*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1B8*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1B9*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1BA*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1BB*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.14393-sp0-windows-10-rs1-1607 amd64
SDT_NODE static_ssdt_10_0_14393_sp0_windows_10_rs1_1607_amd64[450] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAddAtomEx" , 4 } ,
/*0x068*/ { "NtAddBootEntry" , 2 } ,
/*0x069*/ { "NtAddDriverEntry" , 2 } ,
/*0x06A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06B*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06C*/ { "NtAlertResumeThread" , 2 } ,
/*0x06D*/ { "NtAlertThread" , 1 } ,
/*0x06E*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x06F*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x070*/ { "NtAllocateReserveObject" , 3 } ,
/*0x071*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x072*/ { "NtAllocateUuids" , 4 } ,
/*0x073*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x074*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x075*/ { "NtAlpcConnectPort" , 11 } ,
/*0x076*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x077*/ { "NtAlpcCreatePort" , 3 } ,
/*0x078*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x079*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07A*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07B*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07C*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07D*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x080*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x081*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x082*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x083*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x084*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x085*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x086*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x087*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x088*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x089*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08A*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08B*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08C*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08D*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08E*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x08F*/ { "NtCancelTimer2" , 2 } ,
/*0x090*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x091*/ { "NtCommitComplete" , 2 } ,
/*0x092*/ { "NtCommitEnlistment" , 2 } ,
/*0x093*/ { "NtCommitRegistryTransaction" , 2 } ,
/*0x094*/ { "NtCommitTransaction" , 2 } ,
/*0x095*/ { "NtCompactKeys" , 2 } ,
/*0x096*/ { "NtCompareObjects" , 2 } ,
/*0x097*/ { "NtCompareTokens" , 3 } ,
/*0x098*/ { "NtCompleteConnectPort" , 1 } ,
/*0x099*/ { "NtCompressKey" , 1 } ,
/*0x09A*/ { "NtConnectPort" , 8 } ,
/*0x09B*/ { "NtCreateDebugObject" , 4 } ,
/*0x09C*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x09D*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x09E*/ { "NtCreateEnclave" , 9 } ,
/*0x09F*/ { "NtCreateEnlistment" , 8 } ,
/*0x0A0*/ { "NtCreateEventPair" , 3 } ,
/*0x0A1*/ { "NtCreateIRTimer" , 2 } ,
/*0x0A2*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A3*/ { "NtCreateJobObject" , 3 } ,
/*0x0A4*/ { "NtCreateJobSet" , 3 } ,
/*0x0A5*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A6*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0A7*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0A8*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0A9*/ { "NtCreateMutant" , 4 } ,
/*0x0AA*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0AB*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AC*/ { "NtCreatePartition" , 4 } ,
/*0x0AD*/ { "NtCreatePort" , 5 } ,
/*0x0AE*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0AF*/ { "NtCreateProcess" , 8 } ,
/*0x0B0*/ { "NtCreateProfile" , 9 } ,
/*0x0B1*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B2*/ { "NtCreateRegistryTransaction" , 4 } ,
/*0x0B3*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B4*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B5*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B6*/ { "NtCreateThreadEx" , 11 } ,
/*0x0B7*/ { "NtCreateTimer" , 4 } ,
/*0x0B8*/ { "NtCreateTimer2" , 5 } ,
/*0x0B9*/ { "NtCreateToken" , 13 } ,
/*0x0BA*/ { "NtCreateTokenEx" , 17 } ,
/*0x0BB*/ { "NtCreateTransaction" , 10 } ,
/*0x0BC*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0BD*/ { "NtCreateUserProcess" , 11 } ,
/*0x0BE*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0BF*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0C0*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0C1*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0C2*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C3*/ { "NtDebugContinue" , 3 } ,
/*0x0C4*/ { "NtDeleteAtom" , 1 } ,
/*0x0C5*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C6*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0C7*/ { "NtDeleteFile" , 1 } ,
/*0x0C8*/ { "NtDeleteKey" , 1 } ,
/*0x0C9*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0CA*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0CB*/ { "NtDeleteValueKey" , 2 } ,
/*0x0CC*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0CD*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0CE*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0CF*/ { "NtDisplayString" , 1 } ,
/*0x0D0*/ { "NtDrawText" , 1 } ,
/*0x0D1*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0D2*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D3*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D4*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D5*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D6*/ { "NtExtendSection" , 2 } ,
/*0x0D7*/ { "NtFilterBootOption" , 5 } ,
/*0x0D8*/ { "NtFilterToken" , 6 } ,
/*0x0D9*/ { "NtFilterTokenEx" , 14 } ,
/*0x0DA*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0DB*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0DC*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0DD*/ { "NtFlushKey" , 1 } ,
/*0x0DE*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0DF*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0E0*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0E1*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0E2*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E3*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E4*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E5*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E6*/ { "NtGetContextThread" , 2 } ,
/*0x0E7*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0E8*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0E9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0EA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0EB*/ { "NtGetNextProcess" , 5 } ,
/*0x0EC*/ { "NtGetNextThread" , 6 } ,
/*0x0ED*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0EE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0EF*/ { "NtGetWriteWatch" , 7 } ,
/*0x0F0*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0F1*/ { "NtImpersonateThread" , 3 } ,
/*0x0F2*/ { "NtInitializeEnclave" , 5 } ,
/*0x0F3*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0F7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0F8*/ { "NtListenPort" , 2 } ,
/*0x0F9*/ { "NtLoadDriver" , 1 } ,
/*0x0FA*/ { "NtLoadEnclaveData" , 9 } ,
/*0x0FB*/ { "NtLoadKey" , 2 } ,
/*0x0FC*/ { "NtLoadKey2" , 3 } ,
/*0x0FD*/ { "NtLoadKeyEx" , 8 } ,
/*0x0FE*/ { "NtLockFile" , 10 } ,
/*0x0FF*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x100*/ { "NtLockRegistryKey" , 1 } ,
/*0x101*/ { "NtLockVirtualMemory" , 4 } ,
/*0x102*/ { "NtMakePermanentObject" , 1 } ,
/*0x103*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x104*/ { "NtManagePartition" , 5 } ,
/*0x105*/ { "NtMapCMFModule" , 6 } ,
/*0x106*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x107*/ { "NtModifyBootEntry" , 1 } ,
/*0x108*/ { "NtModifyDriverEntry" , 1 } ,
/*0x109*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x10A*/ { "NtNotifyChangeKey" , 10 } ,
/*0x10B*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x10C*/ { "NtNotifyChangeSession" , 8 } ,
/*0x10D*/ { "NtOpenEnlistment" , 5 } ,
/*0x10E*/ { "NtOpenEventPair" , 3 } ,
/*0x10F*/ { "NtOpenIoCompletion" , 3 } ,
/*0x110*/ { "NtOpenJobObject" , 3 } ,
/*0x111*/ { "NtOpenKeyEx" , 4 } ,
/*0x112*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x113*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x114*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x115*/ { "NtOpenMutant" , 3 } ,
/*0x116*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x117*/ { "NtOpenPartition" , 3 } ,
/*0x118*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x119*/ { "NtOpenProcessToken" , 3 } ,
/*0x11A*/ { "NtOpenRegistryTransaction" , 3 } ,
/*0x11B*/ { "NtOpenResourceManager" , 5 } ,
/*0x11C*/ { "NtOpenSemaphore" , 3 } ,
/*0x11D*/ { "NtOpenSession" , 3 } ,
/*0x11E*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x11F*/ { "NtOpenThread" , 4 } ,
/*0x120*/ { "NtOpenTimer" , 3 } ,
/*0x121*/ { "NtOpenTransaction" , 5 } ,
/*0x122*/ { "NtOpenTransactionManager" , 6 } ,
/*0x123*/ { "NtPlugPlayControl" , 3 } ,
/*0x124*/ { "NtPrePrepareComplete" , 2 } ,
/*0x125*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x126*/ { "NtPrepareComplete" , 2 } ,
/*0x127*/ { "NtPrepareEnlistment" , 2 } ,
/*0x128*/ { "NtPrivilegeCheck" , 3 } ,
/*0x129*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x12A*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x12B*/ { "NtPropagationComplete" , 4 } ,
/*0x12C*/ { "NtPropagationFailed" , 3 } ,
/*0x12D*/ { "NtPulseEvent" , 2 } ,
/*0x12E*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x12F*/ { "NtQueryBootOptions" , 2 } ,
/*0x130*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x131*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x132*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x133*/ { "NtQueryEaFile" , 9 } ,
/*0x134*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x135*/ { "NtQueryInformationAtom" , 5 } ,
/*0x136*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x137*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x138*/ { "NtQueryInformationPort" , 5 } ,
/*0x139*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x13A*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x13B*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x13C*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x13D*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x13E*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x13F*/ { "NtQueryIoCompletion" , 5 } ,
/*0x140*/ { "NtQueryLicenseValue" , 5 } ,
/*0x141*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x142*/ { "NtQueryMutant" , 5 } ,
/*0x143*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x144*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x145*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x146*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x147*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x148*/ { "NtQuerySecurityObject" , 5 } ,
/*0x149*/ { "NtQuerySecurityPolicy" , 6 } ,
/*0x14A*/ { "NtQuerySemaphore" , 5 } ,
/*0x14B*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x14C*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x14D*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x14E*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x14F*/ { "NtQueryTimerResolution" , 3 } ,
/*0x150*/ { "NtQueryWnfStateData" , 6 } ,
/*0x151*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x152*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x153*/ { "NtRaiseException" , 3 } ,
/*0x154*/ { "NtRaiseHardError" , 6 } ,
/*0x155*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x156*/ { "NtRecoverEnlistment" , 2 } ,
/*0x157*/ { "NtRecoverResourceManager" , 1 } ,
/*0x158*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x159*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x15A*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x15B*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x15C*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x15D*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x15E*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x15F*/ { "NtRenameKey" , 2 } ,
/*0x160*/ { "NtRenameTransactionManager" , 2 } ,
/*0x161*/ { "NtReplaceKey" , 3 } ,
/*0x162*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x163*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x164*/ { "NtRequestPort" , 2 } ,
/*0x165*/ { "NtResetEvent" , 2 } ,
/*0x166*/ { "NtResetWriteWatch" , 3 } ,
/*0x167*/ { "NtRestoreKey" , 3 } ,
/*0x168*/ { "NtResumeProcess" , 1 } ,
/*0x169*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x16A*/ { "NtRollbackComplete" , 2 } ,
/*0x16B*/ { "NtRollbackEnlistment" , 2 } ,
/*0x16C*/ { "NtRollbackRegistryTransaction" , 2 } ,
/*0x16D*/ { "NtRollbackTransaction" , 2 } ,
/*0x16E*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x16F*/ { "NtSaveKey" , 2 } ,
/*0x170*/ { "NtSaveKeyEx" , 3 } ,
/*0x171*/ { "NtSaveMergedKeys" , 3 } ,
/*0x172*/ { "NtSecureConnectPort" , 9 } ,
/*0x173*/ { "NtSerializeBoot" , 0 } ,
/*0x174*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x175*/ { "NtSetBootOptions" , 2 } ,
/*0x176*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x177*/ { "NtSetCachedSigningLevel2" , 6 } ,
/*0x178*/ { "NtSetContextThread" , 2 } ,
/*0x179*/ { "NtSetDebugFilterState" , 3 } ,
/*0x17A*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x17B*/ { "NtSetDefaultLocale" , 2 } ,
/*0x17C*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x17D*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x17E*/ { "NtSetEaFile" , 4 } ,
/*0x17F*/ { "NtSetHighEventPair" , 1 } ,
/*0x180*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x181*/ { "NtSetIRTimer" , 2 } ,
/*0x182*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x183*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x184*/ { "NtSetInformationJobObject" , 4 } ,
/*0x185*/ { "NtSetInformationKey" , 4 } ,
/*0x186*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x187*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x188*/ { "NtSetInformationToken" , 4 } ,
/*0x189*/ { "NtSetInformationTransaction" , 4 } ,
/*0x18A*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x18B*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x18C*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x18D*/ { "NtSetIntervalProfile" , 2 } ,
/*0x18E*/ { "NtSetIoCompletion" , 5 } ,
/*0x18F*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x190*/ { "NtSetLdtEntries" , 6 } ,
/*0x191*/ { "NtSetLowEventPair" , 1 } ,
/*0x192*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x193*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x194*/ { "NtSetSecurityObject" , 3 } ,
/*0x195*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x196*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x197*/ { "NtSetSystemInformation" , 3 } ,
/*0x198*/ { "NtSetSystemPowerState" , 3 } ,
/*0x199*/ { "NtSetSystemTime" , 2 } ,
/*0x19A*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x19B*/ { "NtSetTimer2" , 4 } ,
/*0x19C*/ { "NtSetTimerEx" , 4 } ,
/*0x19D*/ { "NtSetTimerResolution" , 3 } ,
/*0x19E*/ { "NtSetUuidSeed" , 1 } ,
/*0x19F*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x1A0*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x1A1*/ { "NtShutdownSystem" , 1 } ,
/*0x1A2*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x1A3*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x1A4*/ { "NtSinglePhaseReject" , 2 } ,
/*0x1A5*/ { "NtStartProfile" , 1 } ,
/*0x1A6*/ { "NtStopProfile" , 1 } ,
/*0x1A7*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x1A8*/ { "NtSuspendProcess" , 1 } ,
/*0x1A9*/ { "NtSuspendThread" , 2 } ,
/*0x1AA*/ { "NtSystemDebugControl" , 6 } ,
/*0x1AB*/ { "NtTerminateJobObject" , 2 } ,
/*0x1AC*/ { "NtTestAlert" , 0 } ,
/*0x1AD*/ { "NtThawRegistry" , 0 } ,
/*0x1AE*/ { "NtThawTransactions" , 0 } ,
/*0x1AF*/ { "NtTraceControl" , 6 } ,
/*0x1B0*/ { "NtTranslateFilePath" , 4 } ,
/*0x1B1*/ { "NtUmsThreadYield" , 1 } ,
/*0x1B2*/ { "NtUnloadDriver" , 1 } ,
/*0x1B3*/ { "NtUnloadKey" , 1 } ,
/*0x1B4*/ { "NtUnloadKey2" , 2 } ,
/*0x1B5*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1B6*/ { "NtUnlockFile" , 5 } ,
/*0x1B7*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1B8*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1B9*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1BA*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1BB*/ { "NtVdmControl" , 2 } ,
/*0x1BC*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1BD*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1BE*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1BF*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1C0*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1C1*/ { "NtWaitLowEventPair" , 1 }
};
// ssdt table for 10.0.15063-sp0-windows-10-rs2-1703 amd64
SDT_NODE static_ssdt_10_0_15063_sp0_windows_10_rs2_1703_amd64[456] = {
/*0x000*/ { "NtAccessCheck" , 8 } ,
/*0x001*/ { "NtWorkerFactoryWorkerReady" , 1 } ,
/*0x002*/ { "NtAcceptConnectPort" , 6 } ,
/*0x003*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x004*/ { "NtWaitForSingleObject" , 3 } ,
/*0x005*/ { "NtCallbackReturn" , 3 } ,
/*0x006*/ { "NtReadFile" , 9 } ,
/*0x007*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x008*/ { "NtWriteFile" , 9 } ,
/*0x009*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x00A*/ { "NtReleaseSemaphore" , 3 } ,
/*0x00B*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x00C*/ { "NtReplyPort" , 2 } ,
/*0x00D*/ { "NtSetInformationThread" , 4 } ,
/*0x00E*/ { "NtSetEvent" , 2 } ,
/*0x00F*/ { "NtClose" , 1 } ,
/*0x010*/ { "NtQueryObject" , 5 } ,
/*0x011*/ { "NtQueryInformationFile" , 5 } ,
/*0x012*/ { "NtOpenKey" , 3 } ,
/*0x013*/ { "NtEnumerateValueKey" , 6 } ,
/*0x014*/ { "NtFindAtom" , 3 } ,
/*0x015*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x016*/ { "NtQueryKey" , 5 } ,
/*0x017*/ { "NtQueryValueKey" , 6 } ,
/*0x018*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x019*/ { "NtQueryInformationProcess" , 5 } ,
/*0x01A*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x01B*/ { "NtWriteFileGather" , 9 } ,
/*0x01C*/ { "NtSetInformationProcess" , 4 } ,
/*0x01D*/ { "NtCreateKey" , 7 } ,
/*0x01E*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01F*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x020*/ { "NtReleaseMutant" , 2 } ,
/*0x021*/ { "NtQueryInformationToken" , 5 } ,
/*0x022*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x023*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x024*/ { "NtOpenThreadToken" , 4 } ,
/*0x025*/ { "NtQueryInformationThread" , 5 } ,
/*0x026*/ { "NtOpenProcess" , 4 } ,
/*0x027*/ { "NtSetInformationFile" , 5 } ,
/*0x028*/ { "NtMapViewOfSection" , 10 } ,
/*0x029*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x02A*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x02B*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x02C*/ { "NtTerminateProcess" , 2 } ,
/*0x02D*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02E*/ { "NtReadFileScatter" , 9 } ,
/*0x02F*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x030*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x031*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x032*/ { "NtEnumerateKey" , 6 } ,
/*0x033*/ { "NtOpenFile" , 6 } ,
/*0x034*/ { "NtDelayExecution" , 2 } ,
/*0x035*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x036*/ { "NtQuerySystemInformation" , 4 } ,
/*0x037*/ { "NtOpenSection" , 3 } ,
/*0x038*/ { "NtQueryTimer" , 5 } ,
/*0x039*/ { "NtFsControlFile" , 10 } ,
/*0x03A*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x03B*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x03C*/ { "NtDuplicateObject" , 7 } ,
/*0x03D*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03E*/ { "NtClearEvent" , 1 } ,
/*0x03F*/ { "NtReadVirtualMemory" , 5 } ,
/*0x040*/ { "NtOpenEvent" , 3 } ,
/*0x041*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x042*/ { "NtDuplicateToken" , 6 } ,
/*0x043*/ { "NtContinue" , 2 } ,
/*0x044*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x045*/ { "NtQueueApcThread" , 5 } ,
/*0x046*/ { "NtYieldExecution" , 0 } ,
/*0x047*/ { "NtAddAtom" , 3 } ,
/*0x048*/ { "NtCreateEvent" , 5 } ,
/*0x049*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x04A*/ { "NtCreateSection" , 7 } ,
/*0x04B*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04C*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04D*/ { "NtCreateProcessEx" , 9 } ,
/*0x04E*/ { "NtCreateThread" , 8 } ,
/*0x04F*/ { "NtIsProcessInJob" , 2 } ,
/*0x050*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x051*/ { "NtQuerySection" , 5 } ,
/*0x052*/ { "NtResumeThread" , 2 } ,
/*0x053*/ { "NtTerminateThread" , 2 } ,
/*0x054*/ { "NtReadRequestData" , 6 } ,
/*0x055*/ { "NtCreateFile" , 11 } ,
/*0x056*/ { "NtQueryEvent" , 5 } ,
/*0x057*/ { "NtWriteRequestData" , 6 } ,
/*0x058*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x059*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x05A*/ { "NtQuerySystemTime" , 1 } ,
/*0x05B*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x05C*/ { "NtSetInformationObject" , 4 } ,
/*0x05D*/ { "NtCancelIoFile" , 2 } ,
/*0x05E*/ { "NtTraceEvent" , 4 } ,
/*0x05F*/ { "NtPowerInformation" , 5 } ,
/*0x060*/ { "NtSetValueKey" , 6 } ,
/*0x061*/ { "NtCancelTimer" , 2 } ,
/*0x062*/ { "NtSetTimer" , 7 } ,
/*0x063*/ { "NtAccessCheckByType" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x066*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x067*/ { "NtAcquireProcessActivityReference" , 3 } ,
/*0x068*/ { "NtAddAtomEx" , 4 } ,
/*0x069*/ { "NtAddBootEntry" , 2 } ,
/*0x06A*/ { "NtAddDriverEntry" , 2 } ,
/*0x06B*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06C*/ { "NtAdjustTokenClaimsAndDeviceGroups" , 16 } ,
/*0x06D*/ { "NtAlertResumeThread" , 2 } ,
/*0x06E*/ { "NtAlertThread" , 1 } ,
/*0x06F*/ { "NtAlertThreadByThreadId" , 1 } ,
/*0x070*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x071*/ { "NtAllocateReserveObject" , 3 } ,
/*0x072*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x073*/ { "NtAllocateUuids" , 4 } ,
/*0x074*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x075*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x076*/ { "NtAlpcConnectPort" , 11 } ,
/*0x077*/ { "NtAlpcConnectPortEx" , 11 } ,
/*0x078*/ { "NtAlpcCreatePort" , 3 } ,
/*0x079*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x07A*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x07B*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x07C*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x07D*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x07E*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x07F*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x080*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x081*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x082*/ { "NtAlpcImpersonateClientContainerOfPort" , 3 } ,
/*0x083*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x084*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x085*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x086*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x087*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x088*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x089*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x08A*/ { "NtAlpcSetInformation" , 4 } ,
/*0x08B*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x08C*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x08D*/ { "NtAssociateWaitCompletionPacket" , 8 } ,
/*0x08E*/ { "NtCancelIoFileEx" , 3 } ,
/*0x08F*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x090*/ { "NtCancelTimer2" , 2 } ,
/*0x091*/ { "NtCancelWaitCompletionPacket" , 2 } ,
/*0x092*/ { "NtCommitComplete" , 2 } ,
/*0x093*/ { "NtCommitEnlistment" , 2 } ,
/*0x094*/ { "NtCommitRegistryTransaction" , 2 } ,
/*0x095*/ { "NtCommitTransaction" , 2 } ,
/*0x096*/ { "NtCompactKeys" , 2 } ,
/*0x097*/ { "NtCompareObjects" , 2 } ,
/*0x098*/ { "NtCompareSigningLevels" , 2 } ,
/*0x099*/ { "NtCompareTokens" , 3 } ,
/*0x09A*/ { "NtCompleteConnectPort" , 1 } ,
/*0x09B*/ { "NtCompressKey" , 1 } ,
/*0x09C*/ { "NtConnectPort" , 8 } ,
/*0x09D*/ { "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter" , 4 } ,
/*0x09E*/ { "NtCreateDebugObject" , 4 } ,
/*0x09F*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x0A0*/ { "NtCreateDirectoryObjectEx" , 5 } ,
/*0x0A1*/ { "NtCreateEnclave" , 9 } ,
/*0x0A2*/ { "NtCreateEnlistment" , 8 } ,
/*0x0A3*/ { "NtCreateEventPair" , 3 } ,
/*0x0A4*/ { "NtCreateIRTimer" , 3 } ,
/*0x0A5*/ { "NtCreateIoCompletion" , 4 } ,
/*0x0A6*/ { "NtCreateJobObject" , 3 } ,
/*0x0A7*/ { "NtCreateJobSet" , 3 } ,
/*0x0A8*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x0A9*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x0AA*/ { "NtCreateLowBoxToken" , 9 } ,
/*0x0AB*/ { "NtCreateMailslotFile" , 8 } ,
/*0x0AC*/ { "NtCreateMutant" , 4 } ,
/*0x0AD*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x0AE*/ { "NtCreatePagingFile" , 4 } ,
/*0x0AF*/ { "NtCreatePartition" , 4 } ,
/*0x0B0*/ { "NtCreatePort" , 5 } ,
/*0x0B1*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0B2*/ { "NtCreateProcess" , 8 } ,
/*0x0B3*/ { "NtCreateProfile" , 9 } ,
/*0x0B4*/ { "NtCreateProfileEx" , 10 } ,
/*0x0B5*/ { "NtCreateRegistryTransaction" , 4 } ,
/*0x0B6*/ { "NtCreateResourceManager" , 7 } ,
/*0x0B7*/ { "NtCreateSemaphore" , 5 } ,
/*0x0B8*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0B9*/ { "NtCreateThreadEx" , 11 } ,
/*0x0BA*/ { "NtCreateTimer" , 4 } ,
/*0x0BB*/ { "NtCreateTimer2" , 5 } ,
/*0x0BC*/ { "NtCreateToken" , 13 } ,
/*0x0BD*/ { "NtCreateTokenEx" , 17 } ,
/*0x0BE*/ { "NtCreateTransaction" , 10 } ,
/*0x0BF*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0C0*/ { "NtCreateUserProcess" , 11 } ,
/*0x0C1*/ { "NtCreateWaitCompletionPacket" , 3 } ,
/*0x0C2*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0C3*/ { "NtCreateWnfStateName" , 7 } ,
/*0x0C4*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0C5*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0C6*/ { "NtDebugContinue" , 3 } ,
/*0x0C7*/ { "NtDeleteAtom" , 1 } ,
/*0x0C8*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0C9*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0CA*/ { "NtDeleteFile" , 1 } ,
/*0x0CB*/ { "NtDeleteKey" , 1 } ,
/*0x0CC*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0CD*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0CE*/ { "NtDeleteValueKey" , 2 } ,
/*0x0CF*/ { "NtDeleteWnfStateData" , 2 } ,
/*0x0D0*/ { "NtDeleteWnfStateName" , 1 } ,
/*0x0D1*/ { "NtDisableLastKnownGood" , 0 } ,
/*0x0D2*/ { "NtDisplayString" , 1 } ,
/*0x0D3*/ { "NtDrawText" , 1 } ,
/*0x0D4*/ { "NtEnableLastKnownGood" , 0 } ,
/*0x0D5*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0D6*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0D7*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0D8*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0D9*/ { "NtExtendSection" , 2 } ,
/*0x0DA*/ { "NtFilterBootOption" , 5 } ,
/*0x0DB*/ { "NtFilterToken" , 6 } ,
/*0x0DC*/ { "NtFilterTokenEx" , 14 } ,
/*0x0DD*/ { "NtFlushBuffersFileEx" , 5 } ,
/*0x0DE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0DF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0E0*/ { "NtFlushKey" , 1 } ,
/*0x0E1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0E2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0E3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0E4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0E6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0E7*/ { "NtGetCachedSigningLevel" , 6 } ,
/*0x0E8*/ { "NtGetCompleteWnfStateSubscription" , 6 } ,
/*0x0E9*/ { "NtGetContextThread" , 2 } ,
/*0x0EA*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0EB*/ { "NtGetCurrentProcessorNumberEx" , 1 } ,
/*0x0EC*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0ED*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0EE*/ { "NtGetNextProcess" , 5 } ,
/*0x0EF*/ { "NtGetNextThread" , 6 } ,
/*0x0F0*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0F1*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0F2*/ { "NtGetWriteWatch" , 7 } ,
/*0x0F3*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0F4*/ { "NtImpersonateThread" , 3 } ,
/*0x0F5*/ { "NtInitializeEnclave" , 5 } ,
/*0x0F6*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0F7*/ { "NtInitializeRegistry" , 1 } ,
/*0x0F8*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0F9*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0FA*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0FB*/ { "NtListenPort" , 2 } ,
/*0x0FC*/ { "NtLoadDriver" , 1 } ,
/*0x0FD*/ { "NtLoadEnclaveData" , 9 } ,
/*0x0FE*/ { "NtLoadHotPatch" , 2 } ,
/*0x0FF*/ { "NtLoadKey" , 2 } ,
/*0x100*/ { "NtLoadKey2" , 3 } ,
/*0x101*/ { "NtLoadKeyEx" , 8 } ,
/*0x102*/ { "NtLockFile" , 10 } ,
/*0x103*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x104*/ { "NtLockRegistryKey" , 1 } ,
/*0x105*/ { "NtLockVirtualMemory" , 4 } ,
/*0x106*/ { "NtMakePermanentObject" , 1 } ,
/*0x107*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x108*/ { "NtManagePartition" , 5 } ,
/*0x109*/ { "NtMapCMFModule" , 6 } ,
/*0x10A*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x10B*/ { "NtModifyBootEntry" , 1 } ,
/*0x10C*/ { "NtModifyDriverEntry" , 1 } ,
/*0x10D*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x10E*/ { "NtNotifyChangeKey" , 10 } ,
/*0x10F*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x110*/ { "NtNotifyChangeSession" , 8 } ,
/*0x111*/ { "NtOpenEnlistment" , 5 } ,
/*0x112*/ { "NtOpenEventPair" , 3 } ,
/*0x113*/ { "NtOpenIoCompletion" , 3 } ,
/*0x114*/ { "NtOpenJobObject" , 3 } ,
/*0x115*/ { "NtOpenKeyEx" , 4 } ,
/*0x116*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x117*/ { "NtOpenKeyTransactedEx" , 5 } ,
/*0x118*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x119*/ { "NtOpenMutant" , 3 } ,
/*0x11A*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x11B*/ { "NtOpenPartition" , 3 } ,
/*0x11C*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x11D*/ { "NtOpenProcessToken" , 3 } ,
/*0x11E*/ { "NtOpenRegistryTransaction" , 3 } ,
/*0x11F*/ { "NtOpenResourceManager" , 5 } ,
/*0x120*/ { "NtOpenSemaphore" , 3 } ,
/*0x121*/ { "NtOpenSession" , 3 } ,
/*0x122*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtOpenThread" , 4 } ,
/*0x124*/ { "NtOpenTimer" , 3 } ,
/*0x125*/ { "NtOpenTransaction" , 5 } ,
/*0x126*/ { "NtOpenTransactionManager" , 6 } ,
/*0x127*/ { "NtPlugPlayControl" , 3 } ,
/*0x128*/ { "NtPrePrepareComplete" , 2 } ,
/*0x129*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x12A*/ { "NtPrepareComplete" , 2 } ,
/*0x12B*/ { "NtPrepareEnlistment" , 2 } ,
/*0x12C*/ { "NtPrivilegeCheck" , 3 } ,
/*0x12D*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x12E*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x12F*/ { "NtPropagationComplete" , 4 } ,
/*0x130*/ { "NtPropagationFailed" , 3 } ,
/*0x131*/ { "NtPulseEvent" , 2 } ,
/*0x132*/ { "NtQueryAuxiliaryCounterFrequency" , 1 } ,
/*0x133*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x134*/ { "NtQueryBootOptions" , 2 } ,
/*0x135*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x136*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x137*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x138*/ { "NtQueryEaFile" , 9 } ,
/*0x139*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x13A*/ { "NtQueryInformationAtom" , 5 } ,
/*0x13B*/ { "NtQueryInformationByName" , 5 } ,
/*0x13C*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x13D*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x13E*/ { "NtQueryInformationPort" , 5 } ,
/*0x13F*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x140*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x141*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x142*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x143*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x144*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x145*/ { "NtQueryIoCompletion" , 5 } ,
/*0x146*/ { "NtQueryLicenseValue" , 5 } ,
/*0x147*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x148*/ { "NtQueryMutant" , 5 } ,
/*0x149*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x14A*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x14B*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x14C*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x14D*/ { "NtQuerySecurityAttributesToken" , 6 } ,
/*0x14E*/ { "NtQuerySecurityObject" , 5 } ,
/*0x14F*/ { "NtQuerySecurityPolicy" , 6 } ,
/*0x150*/ { "NtQuerySemaphore" , 5 } ,
/*0x151*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x152*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x153*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x154*/ { "NtQuerySystemInformationEx" , 6 } ,
/*0x155*/ { "NtQueryTimerResolution" , 3 } ,
/*0x156*/ { "NtQueryWnfStateData" , 6 } ,
/*0x157*/ { "NtQueryWnfStateNameInformation" , 5 } ,
/*0x158*/ { "NtQueueApcThreadEx" , 6 } ,
/*0x159*/ { "NtRaiseException" , 3 } ,
/*0x15A*/ { "NtRaiseHardError" , 6 } ,
/*0x15B*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x15C*/ { "NtRecoverEnlistment" , 2 } ,
/*0x15D*/ { "NtRecoverResourceManager" , 1 } ,
/*0x15E*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x15F*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x160*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x161*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x162*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x163*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x164*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x165*/ { "NtRenameKey" , 2 } ,
/*0x166*/ { "NtRenameTransactionManager" , 2 } ,
/*0x167*/ { "NtReplaceKey" , 3 } ,
/*0x168*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x169*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x16A*/ { "NtRequestPort" , 2 } ,
/*0x16B*/ { "NtResetEvent" , 2 } ,
/*0x16C*/ { "NtResetWriteWatch" , 3 } ,
/*0x16D*/ { "NtRestoreKey" , 3 } ,
/*0x16E*/ { "NtResumeProcess" , 1 } ,
/*0x16F*/ { "NtRevertContainerImpersonation" , 0 } ,
/*0x170*/ { "NtRollbackComplete" , 2 } ,
/*0x171*/ { "NtRollbackEnlistment" , 2 } ,
/*0x172*/ { "NtRollbackRegistryTransaction" , 2 } ,
/*0x173*/ { "NtRollbackTransaction" , 2 } ,
/*0x174*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x175*/ { "NtSaveKey" , 2 } ,
/*0x176*/ { "NtSaveKeyEx" , 3 } ,
/*0x177*/ { "NtSaveMergedKeys" , 3 } ,
/*0x178*/ { "NtSecureConnectPort" , 9 } ,
/*0x179*/ { "NtSerializeBoot" , 0 } ,
/*0x17A*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x17B*/ { "NtSetBootOptions" , 2 } ,
/*0x17C*/ { "NtSetCachedSigningLevel" , 5 } ,
/*0x17D*/ { "NtSetCachedSigningLevel2" , 6 } ,
/*0x17E*/ { "NtSetContextThread" , 2 } ,
/*0x17F*/ { "NtSetDebugFilterState" , 3 } ,
/*0x180*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x181*/ { "NtSetDefaultLocale" , 2 } ,
/*0x182*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x183*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x184*/ { "NtSetEaFile" , 4 } ,
/*0x185*/ { "NtSetHighEventPair" , 1 } ,
/*0x186*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x187*/ { "NtSetIRTimer" , 2 } ,
/*0x188*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x189*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x18A*/ { "NtSetInformationJobObject" , 4 } ,
/*0x18B*/ { "NtSetInformationKey" , 4 } ,
/*0x18C*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x18D*/ { "NtSetInformationSymbolicLink" , 4 } ,
/*0x18E*/ { "NtSetInformationToken" , 4 } ,
/*0x18F*/ { "NtSetInformationTransaction" , 4 } ,
/*0x190*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x191*/ { "NtSetInformationVirtualMemory" , 6 } ,
/*0x192*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x193*/ { "NtSetIntervalProfile" , 2 } ,
/*0x194*/ { "NtSetIoCompletion" , 5 } ,
/*0x195*/ { "NtSetIoCompletionEx" , 6 } ,
/*0x196*/ { "NtSetLdtEntries" , 6 } ,
/*0x197*/ { "NtSetLowEventPair" , 1 } ,
/*0x198*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x199*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x19A*/ { "NtSetSecurityObject" , 3 } ,
/*0x19B*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x19C*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x19D*/ { "NtSetSystemInformation" , 3 } ,
/*0x19E*/ { "NtSetSystemPowerState" , 3 } ,
/*0x19F*/ { "NtSetSystemTime" , 2 } ,
/*0x1A0*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x1A1*/ { "NtSetTimer2" , 4 } ,
/*0x1A2*/ { "NtSetTimerEx" , 4 } ,
/*0x1A3*/ { "NtSetTimerResolution" , 3 } ,
/*0x1A4*/ { "NtSetUuidSeed" , 1 } ,
/*0x1A5*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x1A6*/ { "NtSetWnfProcessNotificationEvent" , 1 } ,
/*0x1A7*/ { "NtShutdownSystem" , 1 } ,
/*0x1A8*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x1A9*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x1AA*/ { "NtSinglePhaseReject" , 2 } ,
/*0x1AB*/ { "NtStartProfile" , 1 } ,
/*0x1AC*/ { "NtStopProfile" , 1 } ,
/*0x1AD*/ { "NtSubscribeWnfStateChange" , 4 } ,
/*0x1AE*/ { "NtSuspendProcess" , 1 } ,
/*0x1AF*/ { "NtSuspendThread" , 2 } ,
/*0x1B0*/ { "NtSystemDebugControl" , 6 } ,
/*0x1B1*/ { "NtTerminateJobObject" , 2 } ,
/*0x1B2*/ { "NtTestAlert" , 0 } ,
/*0x1B3*/ { "NtThawRegistry" , 0 } ,
/*0x1B4*/ { "NtThawTransactions" , 0 } ,
/*0x1B5*/ { "NtTraceControl" , 6 } ,
/*0x1B6*/ { "NtTranslateFilePath" , 4 } ,
/*0x1B7*/ { "NtUmsThreadYield" , 1 } ,
/*0x1B8*/ { "NtUnloadDriver" , 1 } ,
/*0x1B9*/ { "NtUnloadKey" , 1 } ,
/*0x1BA*/ { "NtUnloadKey2" , 2 } ,
/*0x1BB*/ { "NtUnloadKeyEx" , 2 } ,
/*0x1BC*/ { "NtUnlockFile" , 5 } ,
/*0x1BD*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x1BE*/ { "NtUnmapViewOfSectionEx" , 3 } ,
/*0x1BF*/ { "NtUnsubscribeWnfStateChange" , 1 } ,
/*0x1C0*/ { "NtUpdateWnfStateData" , 7 } ,
/*0x1C1*/ { "NtVdmControl" , 2 } ,
/*0x1C2*/ { "NtWaitForAlertByThreadId" , 2 } ,
/*0x1C3*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x1C4*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x1C5*/ { "NtWaitForWorkViaWorkerFactory" , 5 } ,
/*0x1C6*/ { "NtWaitHighEventPair" , 1 } ,
/*0x1C7*/ { "NtWaitLowEventPair" , 1 }
};
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。