-
Notifications
You must be signed in to change notification settings - Fork 110
/
Copy pathssdt_amd64.c
4723 lines (4668 loc) · 199 KB
/
ssdt_amd64.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// ssdt table for 6.0.6000-sp0-windows-vista amd64
SDT_NODE static_ssdt_6_0_6000_sp0_windows_vista_amd64[398] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtClearAllSavepointsTransaction" , 1 } ,
/*0x08A*/ { "NtClearSavepointTransaction" , 2 } ,
/*0x08B*/ { "NtCommitComplete" , 2 } ,
/*0x08C*/ { "NtCommitEnlistment" , 2 } ,
/*0x08D*/ { "NtCommitTransaction" , 2 } ,
/*0x08E*/ { "NtCompactKeys" , 2 } ,
/*0x08F*/ { "NtCompareTokens" , 3 } ,
/*0x090*/ { "NtCompleteConnectPort" , 1 } ,
/*0x091*/ { "NtCompressKey" , 1 } ,
/*0x092*/ { "NtConnectPort" , 8 } ,
/*0x093*/ { "NtCreateDebugObject" , 4 } ,
/*0x094*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x095*/ { "NtCreateEnlistment" , 8 } ,
/*0x096*/ { "NtCreateEventPair" , 3 } ,
/*0x097*/ { "NtCreateIoCompletion" , 4 } ,
/*0x098*/ { "NtCreateJobObject" , 3 } ,
/*0x099*/ { "NtCreateJobSet" , 3 } ,
/*0x09A*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x09B*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09C*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09D*/ { "NtCreateMutant" , 4 } ,
/*0x09E*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09F*/ { "NtCreatePagingFile" , 4 } ,
/*0x0A0*/ { "NtCreatePort" , 5 } ,
/*0x0A1*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A2*/ { "NtCreateProcess" , 8 } ,
/*0x0A3*/ { "NtCreateProfile" , 9 } ,
/*0x0A4*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A5*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A6*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A7*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A8*/ { "NtCreateTimer" , 4 } ,
/*0x0A9*/ { "NtCreateToken" , 13 } ,
/*0x0AA*/ { "NtCreateTransaction" , 10 } ,
/*0x0AB*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AC*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AD*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AE*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AF*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0B0*/ { "NtDebugContinue" , 3 } ,
/*0x0B1*/ { "NtDeleteAtom" , 1 } ,
/*0x0B2*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B3*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B4*/ { "NtDeleteFile" , 1 } ,
/*0x0B5*/ { "NtDeleteKey" , 1 } ,
/*0x0B6*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B7*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B8*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B9*/ { "NtDisplayString" , 1 } ,
/*0x0BA*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0BB*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BC*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BD*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BE*/ { "NtExtendSection" , 2 } ,
/*0x0BF*/ { "NtFilterToken" , 6 } ,
/*0x0C0*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0C1*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C2*/ { "NtFlushKey" , 1 } ,
/*0x0C3*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C4*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C5*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C6*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C7*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C8*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C9*/ { "NtGetContextThread" , 2 } ,
/*0x0CA*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0CB*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CC*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CD*/ { "NtGetNextProcess" , 5 } ,
/*0x0CE*/ { "NtGetNextThread" , 6 } ,
/*0x0CF*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0D0*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0D1*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D2*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D3*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D4*/ { "NtImpersonateThread" , 3 } ,
/*0x0D5*/ { "NtInitializeNlsFiles" , 3 } ,
/*0x0D6*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D7*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D8*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D9*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0DA*/ { "NtListTransactions" , 3 } ,
/*0x0DB*/ { "NtListenPort" , 2 } ,
/*0x0DC*/ { "NtLoadDriver" , 1 } ,
/*0x0DD*/ { "NtLoadKey" , 2 } ,
/*0x0DE*/ { "NtLoadKey2" , 3 } ,
/*0x0DF*/ { "NtLoadKeyEx" , 8 } ,
/*0x0E0*/ { "NtLockFile" , 10 } ,
/*0x0E1*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0E2*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E3*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E4*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E5*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E6*/ { "NtMapCMFModule" , 6 } ,
/*0x0E7*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E8*/ { "NtMarshallTransaction" , 6 } ,
/*0x0E9*/ { "NtModifyBootEntry" , 1 } ,
/*0x0EA*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0EB*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0EC*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0ED*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EE*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EF*/ { "NtOpenEventPair" , 3 } ,
/*0x0F0*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0F1*/ { "NtOpenJobObject" , 3 } ,
/*0x0F2*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0F3*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F4*/ { "NtOpenMutant" , 3 } ,
/*0x0F5*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F6*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F7*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F8*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F9*/ { "NtOpenSemaphore" , 3 } ,
/*0x0FA*/ { "NtOpenSession" , 3 } ,
/*0x0FB*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0FC*/ { "NtOpenThread" , 4 } ,
/*0x0FD*/ { "NtOpenTimer" , 3 } ,
/*0x0FE*/ { "NtOpenTransaction" , 5 } ,
/*0x0FF*/ { "NtOpenTransactionManager" , 6 } ,
/*0x100*/ { "NtPlugPlayControl" , 3 } ,
/*0x101*/ { "NtPrePrepareComplete" , 2 } ,
/*0x102*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x103*/ { "NtPrepareComplete" , 2 } ,
/*0x104*/ { "NtPrepareEnlistment" , 2 } ,
/*0x105*/ { "NtPrivilegeCheck" , 3 } ,
/*0x106*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x107*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x108*/ { "NtPropagationComplete" , 4 } ,
/*0x109*/ { "NtPropagationFailed" , 3 } ,
/*0x10A*/ { "NtPullTransaction" , 7 } ,
/*0x10B*/ { "NtPulseEvent" , 2 } ,
/*0x10C*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x10D*/ { "NtQueryBootOptions" , 2 } ,
/*0x10E*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10F*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x110*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x111*/ { "NtQueryEaFile" , 9 } ,
/*0x112*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x113*/ { "NtQueryInformationAtom" , 5 } ,
/*0x114*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x115*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x116*/ { "NtQueryInformationPort" , 5 } ,
/*0x117*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x118*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x119*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x11A*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x11B*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x11C*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x11D*/ { "NtQueryIoCompletion" , 5 } ,
/*0x11E*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11F*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x120*/ { "NtQueryMutant" , 5 } ,
/*0x121*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x122*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x123*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x124*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x125*/ { "NtQuerySecurityObject" , 5 } ,
/*0x126*/ { "NtQuerySemaphore" , 5 } ,
/*0x127*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x128*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x129*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x12A*/ { "NtQueryTimerResolution" , 3 } ,
/*0x12B*/ { "NtRaiseException" , 3 } ,
/*0x12C*/ { "NtRaiseHardError" , 6 } ,
/*0x12D*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x12E*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12F*/ { "NtRecoverResourceManager" , 1 } ,
/*0x130*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x131*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x132*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x133*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x134*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x135*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x136*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x137*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x138*/ { "NtRenameKey" , 2 } ,
/*0x139*/ { "NtReplaceKey" , 3 } ,
/*0x13A*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x13B*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x13C*/ { "NtRequestPort" , 2 } ,
/*0x13D*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13E*/ { "NtResetEvent" , 2 } ,
/*0x13F*/ { "NtResetWriteWatch" , 3 } ,
/*0x140*/ { "NtRestoreKey" , 3 } ,
/*0x141*/ { "NtResumeProcess" , 1 } ,
/*0x142*/ { "NtRollbackComplete" , 2 } ,
/*0x143*/ { "NtRollbackEnlistment" , 2 } ,
/*0x144*/ { "NtRollbackSavepointTransaction" , 2 } ,
/*0x145*/ { "NtRollbackTransaction" , 2 } ,
/*0x146*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x147*/ { "NtSaveKey" , 2 } ,
/*0x148*/ { "NtSaveKeyEx" , 3 } ,
/*0x149*/ { "NtSaveMergedKeys" , 3 } ,
/*0x14A*/ { "NtSavepointComplete" , 2 } ,
/*0x14B*/ { "NtSavepointTransaction" , 3 } ,
/*0x14C*/ { "NtSecureConnectPort" , 9 } ,
/*0x14D*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x14E*/ { "NtSetBootOptions" , 2 } ,
/*0x14F*/ { "NtSetContextThread" , 2 } ,
/*0x150*/ { "NtSetDebugFilterState" , 3 } ,
/*0x151*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x152*/ { "NtSetDefaultLocale" , 2 } ,
/*0x153*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x154*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x155*/ { "NtSetEaFile" , 4 } ,
/*0x156*/ { "NtSetHighEventPair" , 1 } ,
/*0x157*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x158*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x159*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x15A*/ { "NtSetInformationJobObject" , 4 } ,
/*0x15B*/ { "NtSetInformationKey" , 4 } ,
/*0x15C*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x15D*/ { "NtSetInformationToken" , 4 } ,
/*0x15E*/ { "NtSetInformationTransaction" , 4 } ,
/*0x15F*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x160*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x161*/ { "NtSetIntervalProfile" , 2 } ,
/*0x162*/ { "NtSetIoCompletion" , 5 } ,
/*0x163*/ { "NtSetLdtEntries" , 6 } ,
/*0x164*/ { "NtSetLowEventPair" , 1 } ,
/*0x165*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x166*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x167*/ { "NtSetSecurityObject" , 3 } ,
/*0x168*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x169*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x16A*/ { "NtSetSystemInformation" , 3 } ,
/*0x16B*/ { "NtSetSystemPowerState" , 3 } ,
/*0x16C*/ { "NtSetSystemTime" , 2 } ,
/*0x16D*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x16E*/ { "NtSetTimerResolution" , 3 } ,
/*0x16F*/ { "NtSetUuidSeed" , 1 } ,
/*0x170*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x171*/ { "NtShutdownSystem" , 1 } ,
/*0x172*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x173*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x174*/ { "NtSinglePhaseReject" , 2 } ,
/*0x175*/ { "NtStartProfile" , 1 } ,
/*0x176*/ { "NtStartTm" , 0 } ,
/*0x177*/ { "NtStopProfile" , 1 } ,
/*0x178*/ { "NtSuspendProcess" , 1 } ,
/*0x179*/ { "NtSuspendThread" , 2 } ,
/*0x17A*/ { "NtSystemDebugControl" , 6 } ,
/*0x17B*/ { "NtTerminateJobObject" , 2 } ,
/*0x17C*/ { "NtTestAlert" , 0 } ,
/*0x17D*/ { "NtThawRegistry" , 0 } ,
/*0x17E*/ { "NtThawTransactions" , 0 } ,
/*0x17F*/ { "NtTraceControl" , 6 } ,
/*0x180*/ { "NtTranslateFilePath" , 4 } ,
/*0x181*/ { "NtUnloadDriver" , 1 } ,
/*0x182*/ { "NtUnloadKey" , 1 } ,
/*0x183*/ { "NtUnloadKey2" , 2 } ,
/*0x184*/ { "NtUnloadKeyEx" , 2 } ,
/*0x185*/ { "NtUnlockFile" , 5 } ,
/*0x186*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x187*/ { "NtVdmControl" , 2 } ,
/*0x188*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x189*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x18A*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x18B*/ { "NtWaitHighEventPair" , 1 } ,
/*0x18C*/ { "NtWaitLowEventPair" , 1 } ,
/*0x18D*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.0.6001-sp1-windows-vista amd64
SDT_NODE static_ssdt_6_0_6001_sp1_windows_vista_amd64[391] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtCommitComplete" , 2 } ,
/*0x08A*/ { "NtCommitEnlistment" , 2 } ,
/*0x08B*/ { "NtCommitTransaction" , 2 } ,
/*0x08C*/ { "NtCompactKeys" , 2 } ,
/*0x08D*/ { "NtCompareTokens" , 3 } ,
/*0x08E*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08F*/ { "NtCompressKey" , 1 } ,
/*0x090*/ { "NtConnectPort" , 8 } ,
/*0x091*/ { "NtCreateDebugObject" , 4 } ,
/*0x092*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x093*/ { "NtCreateEnlistment" , 8 } ,
/*0x094*/ { "NtCreateEventPair" , 3 } ,
/*0x095*/ { "NtCreateIoCompletion" , 4 } ,
/*0x096*/ { "NtCreateJobObject" , 3 } ,
/*0x097*/ { "NtCreateJobSet" , 3 } ,
/*0x098*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x099*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09B*/ { "NtCreateMutant" , 4 } ,
/*0x09C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09D*/ { "NtCreatePagingFile" , 4 } ,
/*0x09E*/ { "NtCreatePort" , 5 } ,
/*0x09F*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A0*/ { "NtCreateProcess" , 8 } ,
/*0x0A1*/ { "NtCreateProfile" , 9 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisplayString" , 1 } ,
/*0x0B8*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0B9*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BA*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BB*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BC*/ { "NtExtendSection" , 2 } ,
/*0x0BD*/ { "NtFilterToken" , 6 } ,
/*0x0BE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0BF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C0*/ { "NtFlushKey" , 1 } ,
/*0x0C1*/ { "NtFlushProcessWriteBuffers" , 0 } ,
/*0x0C2*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x0C3*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x0C4*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x0C5*/ { "NtFreezeRegistry" , 1 } ,
/*0x0C6*/ { "NtFreezeTransactions" , 2 } ,
/*0x0C7*/ { "NtGetContextThread" , 2 } ,
/*0x0C8*/ { "NtGetCurrentProcessorNumber" , 0 } ,
/*0x0C9*/ { "NtGetDevicePowerState" , 2 } ,
/*0x0CA*/ { "NtGetMUIRegistryInfo" , 3 } ,
/*0x0CB*/ { "NtGetNextProcess" , 5 } ,
/*0x0CC*/ { "NtGetNextThread" , 6 } ,
/*0x0CD*/ { "NtGetNlsSectionPtr" , 5 } ,
/*0x0CE*/ { "NtGetNotificationResourceManager" , 7 } ,
/*0x0CF*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x0D0*/ { "NtGetWriteWatch" , 7 } ,
/*0x0D1*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x0D2*/ { "NtImpersonateThread" , 3 } ,
/*0x0D3*/ { "NtInitializeNlsFiles" , 4 } ,
/*0x0D4*/ { "NtInitializeRegistry" , 1 } ,
/*0x0D5*/ { "NtInitiatePowerAction" , 4 } ,
/*0x0D6*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x0D7*/ { "NtIsUILanguageComitted" , 0 } ,
/*0x0D8*/ { "NtListenPort" , 2 } ,
/*0x0D9*/ { "NtLoadDriver" , 1 } ,
/*0x0DA*/ { "NtLoadKey" , 2 } ,
/*0x0DB*/ { "NtLoadKey2" , 3 } ,
/*0x0DC*/ { "NtLoadKeyEx" , 8 } ,
/*0x0DD*/ { "NtLockFile" , 10 } ,
/*0x0DE*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x0DF*/ { "NtLockRegistryKey" , 1 } ,
/*0x0E0*/ { "NtLockVirtualMemory" , 4 } ,
/*0x0E1*/ { "NtMakePermanentObject" , 1 } ,
/*0x0E2*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x0E3*/ { "NtMapCMFModule" , 6 } ,
/*0x0E4*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x0E5*/ { "NtModifyBootEntry" , 1 } ,
/*0x0E6*/ { "NtModifyDriverEntry" , 1 } ,
/*0x0E7*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x0E8*/ { "NtNotifyChangeKey" , 10 } ,
/*0x0E9*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x0EA*/ { "NtOpenEnlistment" , 5 } ,
/*0x0EB*/ { "NtOpenEventPair" , 3 } ,
/*0x0EC*/ { "NtOpenIoCompletion" , 3 } ,
/*0x0ED*/ { "NtOpenJobObject" , 3 } ,
/*0x0EE*/ { "NtOpenKeyTransacted" , 4 } ,
/*0x0EF*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x0F0*/ { "NtOpenMutant" , 3 } ,
/*0x0F1*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x0F2*/ { "NtOpenPrivateNamespace" , 4 } ,
/*0x0F3*/ { "NtOpenProcessToken" , 3 } ,
/*0x0F4*/ { "NtOpenResourceManager" , 5 } ,
/*0x0F5*/ { "NtOpenSemaphore" , 3 } ,
/*0x0F6*/ { "NtOpenSession" , 3 } ,
/*0x0F7*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x0F8*/ { "NtOpenThread" , 4 } ,
/*0x0F9*/ { "NtOpenTimer" , 3 } ,
/*0x0FA*/ { "NtOpenTransaction" , 5 } ,
/*0x0FB*/ { "NtOpenTransactionManager" , 6 } ,
/*0x0FC*/ { "NtPlugPlayControl" , 3 } ,
/*0x0FD*/ { "NtPrePrepareComplete" , 2 } ,
/*0x0FE*/ { "NtPrePrepareEnlistment" , 2 } ,
/*0x0FF*/ { "NtPrepareComplete" , 2 } ,
/*0x100*/ { "NtPrepareEnlistment" , 2 } ,
/*0x101*/ { "NtPrivilegeCheck" , 3 } ,
/*0x102*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x103*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x104*/ { "NtPropagationComplete" , 4 } ,
/*0x105*/ { "NtPropagationFailed" , 3 } ,
/*0x106*/ { "NtPulseEvent" , 2 } ,
/*0x107*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x108*/ { "NtQueryBootOptions" , 2 } ,
/*0x109*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x10A*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x10B*/ { "NtQueryDriverEntryOrder" , 2 } ,
/*0x10C*/ { "NtQueryEaFile" , 9 } ,
/*0x10D*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x10E*/ { "NtQueryInformationAtom" , 5 } ,
/*0x10F*/ { "NtQueryInformationEnlistment" , 5 } ,
/*0x110*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x111*/ { "NtQueryInformationPort" , 5 } ,
/*0x112*/ { "NtQueryInformationResourceManager" , 5 } ,
/*0x113*/ { "NtQueryInformationTransaction" , 5 } ,
/*0x114*/ { "NtQueryInformationTransactionManager" , 5 } ,
/*0x115*/ { "NtQueryInformationWorkerFactory" , 5 } ,
/*0x116*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x117*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x118*/ { "NtQueryIoCompletion" , 5 } ,
/*0x119*/ { "NtQueryLicenseValue" , 5 } ,
/*0x11A*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x11B*/ { "NtQueryMutant" , 5 } ,
/*0x11C*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x11D*/ { "NtQueryOpenSubKeysEx" , 4 } ,
/*0x11E*/ { "NtQueryPortInformationProcess" , 0 } ,
/*0x11F*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x120*/ { "NtQuerySecurityObject" , 5 } ,
/*0x121*/ { "NtQuerySemaphore" , 5 } ,
/*0x122*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x123*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x124*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x125*/ { "NtQueryTimerResolution" , 3 } ,
/*0x126*/ { "NtRaiseException" , 3 } ,
/*0x127*/ { "NtRaiseHardError" , 6 } ,
/*0x128*/ { "NtReadOnlyEnlistment" , 2 } ,
/*0x129*/ { "NtRecoverEnlistment" , 2 } ,
/*0x12A*/ { "NtRecoverResourceManager" , 1 } ,
/*0x12B*/ { "NtRecoverTransactionManager" , 1 } ,
/*0x12C*/ { "NtRegisterProtocolAddressInformation" , 5 } ,
/*0x12D*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x12E*/ { "NtReleaseCMFViewOwnership" , 0 } ,
/*0x12F*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x130*/ { "NtReleaseWorkerFactoryWorker" , 1 } ,
/*0x131*/ { "NtRemoveIoCompletionEx" , 6 } ,
/*0x132*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x133*/ { "NtRenameKey" , 2 } ,
/*0x134*/ { "NtRenameTransactionManager" , 2 } ,
/*0x135*/ { "NtReplaceKey" , 3 } ,
/*0x136*/ { "NtReplacePartitionUnit" , 3 } ,
/*0x137*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x138*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x139*/ { "NtRequestPort" , 2 } ,
/*0x13A*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x13B*/ { "NtResetEvent" , 2 } ,
/*0x13C*/ { "NtResetWriteWatch" , 3 } ,
/*0x13D*/ { "NtRestoreKey" , 3 } ,
/*0x13E*/ { "NtResumeProcess" , 1 } ,
/*0x13F*/ { "NtRollbackComplete" , 2 } ,
/*0x140*/ { "NtRollbackEnlistment" , 2 } ,
/*0x141*/ { "NtRollbackTransaction" , 2 } ,
/*0x142*/ { "NtRollforwardTransactionManager" , 2 } ,
/*0x143*/ { "NtSaveKey" , 2 } ,
/*0x144*/ { "NtSaveKeyEx" , 3 } ,
/*0x145*/ { "NtSaveMergedKeys" , 3 } ,
/*0x146*/ { "NtSecureConnectPort" , 9 } ,
/*0x147*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x148*/ { "NtSetBootOptions" , 2 } ,
/*0x149*/ { "NtSetContextThread" , 2 } ,
/*0x14A*/ { "NtSetDebugFilterState" , 3 } ,
/*0x14B*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x14C*/ { "NtSetDefaultLocale" , 2 } ,
/*0x14D*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x14E*/ { "NtSetDriverEntryOrder" , 2 } ,
/*0x14F*/ { "NtSetEaFile" , 4 } ,
/*0x150*/ { "NtSetHighEventPair" , 1 } ,
/*0x151*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x152*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x153*/ { "NtSetInformationEnlistment" , 4 } ,
/*0x154*/ { "NtSetInformationJobObject" , 4 } ,
/*0x155*/ { "NtSetInformationKey" , 4 } ,
/*0x156*/ { "NtSetInformationResourceManager" , 4 } ,
/*0x157*/ { "NtSetInformationToken" , 4 } ,
/*0x158*/ { "NtSetInformationTransaction" , 4 } ,
/*0x159*/ { "NtSetInformationTransactionManager" , 4 } ,
/*0x15A*/ { "NtSetInformationWorkerFactory" , 4 } ,
/*0x15B*/ { "NtSetIntervalProfile" , 2 } ,
/*0x15C*/ { "NtSetIoCompletion" , 5 } ,
/*0x15D*/ { "NtSetLdtEntries" , 6 } ,
/*0x15E*/ { "NtSetLowEventPair" , 1 } ,
/*0x15F*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x160*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x161*/ { "NtSetSecurityObject" , 3 } ,
/*0x162*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x163*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x164*/ { "NtSetSystemInformation" , 3 } ,
/*0x165*/ { "NtSetSystemPowerState" , 3 } ,
/*0x166*/ { "NtSetSystemTime" , 2 } ,
/*0x167*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x168*/ { "NtSetTimerResolution" , 3 } ,
/*0x169*/ { "NtSetUuidSeed" , 1 } ,
/*0x16A*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x16B*/ { "NtShutdownSystem" , 1 } ,
/*0x16C*/ { "NtShutdownWorkerFactory" , 2 } ,
/*0x16D*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x16E*/ { "NtSinglePhaseReject" , 2 } ,
/*0x16F*/ { "NtStartProfile" , 1 } ,
/*0x170*/ { "NtStopProfile" , 1 } ,
/*0x171*/ { "NtSuspendProcess" , 1 } ,
/*0x172*/ { "NtSuspendThread" , 2 } ,
/*0x173*/ { "NtSystemDebugControl" , 6 } ,
/*0x174*/ { "NtTerminateJobObject" , 2 } ,
/*0x175*/ { "NtTestAlert" , 0 } ,
/*0x176*/ { "NtThawRegistry" , 0 } ,
/*0x177*/ { "NtThawTransactions" , 0 } ,
/*0x178*/ { "NtTraceControl" , 6 } ,
/*0x179*/ { "NtTranslateFilePath" , 4 } ,
/*0x17A*/ { "NtUnloadDriver" , 1 } ,
/*0x17B*/ { "NtUnloadKey" , 1 } ,
/*0x17C*/ { "NtUnloadKey2" , 2 } ,
/*0x17D*/ { "NtUnloadKeyEx" , 2 } ,
/*0x17E*/ { "NtUnlockFile" , 5 } ,
/*0x17F*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x180*/ { "NtVdmControl" , 2 } ,
/*0x181*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x182*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x183*/ { "NtWaitForWorkViaWorkerFactory" , 2 } ,
/*0x184*/ { "NtWaitHighEventPair" , 1 } ,
/*0x185*/ { "NtWaitLowEventPair" , 1 } ,
/*0x186*/ { "NtWorkerFactoryWorkerReady" , 1 }
};
// ssdt table for 6.0.6002-sp2-windows-vista amd64
SDT_NODE static_ssdt_6_0_6002_sp2_windows_vista_amd64[391] = {
/*0x000*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x001*/ { "NtWaitForSingleObject" , 3 } ,
/*0x002*/ { "NtCallbackReturn" , 3 } ,
/*0x003*/ { "NtReadFile" , 9 } ,
/*0x004*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x005*/ { "NtWriteFile" , 9 } ,
/*0x006*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x007*/ { "NtReleaseSemaphore" , 3 } ,
/*0x008*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x009*/ { "NtReplyPort" , 2 } ,
/*0x00A*/ { "NtSetInformationThread" , 4 } ,
/*0x00B*/ { "NtSetEvent" , 2 } ,
/*0x00C*/ { "NtClose" , 1 } ,
/*0x00D*/ { "NtQueryObject" , 5 } ,
/*0x00E*/ { "NtQueryInformationFile" , 5 } ,
/*0x00F*/ { "NtOpenKey" , 3 } ,
/*0x010*/ { "NtEnumerateValueKey" , 6 } ,
/*0x011*/ { "NtFindAtom" , 3 } ,
/*0x012*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x013*/ { "NtQueryKey" , 5 } ,
/*0x014*/ { "NtQueryValueKey" , 6 } ,
/*0x015*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x016*/ { "NtQueryInformationProcess" , 5 } ,
/*0x017*/ { "NtWaitForMultipleObjects32" , 5 } ,
/*0x018*/ { "NtWriteFileGather" , 9 } ,
/*0x019*/ { "NtSetInformationProcess" , 4 } ,
/*0x01A*/ { "NtCreateKey" , 7 } ,
/*0x01B*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x01C*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x01D*/ { "NtReleaseMutant" , 2 } ,
/*0x01E*/ { "NtQueryInformationToken" , 5 } ,
/*0x01F*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x020*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x021*/ { "NtOpenThreadToken" , 4 } ,
/*0x022*/ { "NtQueryInformationThread" , 5 } ,
/*0x023*/ { "NtOpenProcess" , 4 } ,
/*0x024*/ { "NtSetInformationFile" , 5 } ,
/*0x025*/ { "NtMapViewOfSection" , 10 } ,
/*0x026*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x027*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x028*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x029*/ { "NtTerminateProcess" , 2 } ,
/*0x02A*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x02B*/ { "NtReadFileScatter" , 9 } ,
/*0x02C*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x02D*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x02E*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x02F*/ { "NtEnumerateKey" , 6 } ,
/*0x030*/ { "NtOpenFile" , 6 } ,
/*0x031*/ { "NtDelayExecution" , 2 } ,
/*0x032*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x033*/ { "NtQuerySystemInformation" , 4 } ,
/*0x034*/ { "NtOpenSection" , 3 } ,
/*0x035*/ { "NtQueryTimer" , 5 } ,
/*0x036*/ { "NtFsControlFile" , 10 } ,
/*0x037*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x038*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x039*/ { "NtDuplicateObject" , 7 } ,
/*0x03A*/ { "NtQueryAttributesFile" , 2 } ,
/*0x03B*/ { "NtClearEvent" , 1 } ,
/*0x03C*/ { "NtReadVirtualMemory" , 5 } ,
/*0x03D*/ { "NtOpenEvent" , 3 } ,
/*0x03E*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x03F*/ { "NtDuplicateToken" , 6 } ,
/*0x040*/ { "NtContinue" , 2 } ,
/*0x041*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x042*/ { "NtQueueApcThread" , 5 } ,
/*0x043*/ { "NtYieldExecution" , 0 } ,
/*0x044*/ { "NtAddAtom" , 3 } ,
/*0x045*/ { "NtCreateEvent" , 5 } ,
/*0x046*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x047*/ { "NtCreateSection" , 7 } ,
/*0x048*/ { "NtFlushBuffersFile" , 2 } ,
/*0x049*/ { "NtApphelpCacheControl" , 2 } ,
/*0x04A*/ { "NtCreateProcessEx" , 9 } ,
/*0x04B*/ { "NtCreateThread" , 8 } ,
/*0x04C*/ { "NtIsProcessInJob" , 2 } ,
/*0x04D*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x04E*/ { "NtQuerySection" , 5 } ,
/*0x04F*/ { "NtResumeThread" , 2 } ,
/*0x050*/ { "NtTerminateThread" , 2 } ,
/*0x051*/ { "NtReadRequestData" , 6 } ,
/*0x052*/ { "NtCreateFile" , 11 } ,
/*0x053*/ { "NtQueryEvent" , 5 } ,
/*0x054*/ { "NtWriteRequestData" , 6 } ,
/*0x055*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x056*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x057*/ { "NtQuerySystemTime" , 1 } ,
/*0x058*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x059*/ { "NtSetInformationObject" , 4 } ,
/*0x05A*/ { "NtCancelIoFile" , 2 } ,
/*0x05B*/ { "NtTraceEvent" , 4 } ,
/*0x05C*/ { "NtPowerInformation" , 5 } ,
/*0x05D*/ { "NtSetValueKey" , 6 } ,
/*0x05E*/ { "NtCancelTimer" , 2 } ,
/*0x05F*/ { "NtSetTimer" , 7 } ,
/*0x060*/ { "NtAcceptConnectPort" , 6 } ,
/*0x061*/ { "NtAccessCheck" , 8 } ,
/*0x062*/ { "NtAccessCheckByType" , 11 } ,
/*0x063*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x064*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x065*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x066*/ { "NtAcquireCMFViewOwnership" , 3 } ,
/*0x067*/ { "NtAddBootEntry" , 2 } ,
/*0x068*/ { "NtAddDriverEntry" , 2 } ,
/*0x069*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x06A*/ { "NtAlertResumeThread" , 2 } ,
/*0x06B*/ { "NtAlertThread" , 1 } ,
/*0x06C*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x06D*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x06E*/ { "NtAllocateUuids" , 4 } ,
/*0x06F*/ { "NtAlpcAcceptConnectPort" , 9 } ,
/*0x070*/ { "NtAlpcCancelMessage" , 3 } ,
/*0x071*/ { "NtAlpcConnectPort" , 11 } ,
/*0x072*/ { "NtAlpcCreatePort" , 3 } ,
/*0x073*/ { "NtAlpcCreatePortSection" , 6 } ,
/*0x074*/ { "NtAlpcCreateResourceReserve" , 4 } ,
/*0x075*/ { "NtAlpcCreateSectionView" , 3 } ,
/*0x076*/ { "NtAlpcCreateSecurityContext" , 3 } ,
/*0x077*/ { "NtAlpcDeletePortSection" , 3 } ,
/*0x078*/ { "NtAlpcDeleteResourceReserve" , 3 } ,
/*0x079*/ { "NtAlpcDeleteSectionView" , 3 } ,
/*0x07A*/ { "NtAlpcDeleteSecurityContext" , 3 } ,
/*0x07B*/ { "NtAlpcDisconnectPort" , 2 } ,
/*0x07C*/ { "NtAlpcImpersonateClientOfPort" , 3 } ,
/*0x07D*/ { "NtAlpcOpenSenderProcess" , 6 } ,
/*0x07E*/ { "NtAlpcOpenSenderThread" , 6 } ,
/*0x07F*/ { "NtAlpcQueryInformation" , 5 } ,
/*0x080*/ { "NtAlpcQueryInformationMessage" , 6 } ,
/*0x081*/ { "NtAlpcRevokeSecurityContext" , 3 } ,
/*0x082*/ { "NtAlpcSendWaitReceivePort" , 8 } ,
/*0x083*/ { "NtAlpcSetInformation" , 4 } ,
/*0x084*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x085*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x086*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x087*/ { "NtCancelIoFileEx" , 3 } ,
/*0x088*/ { "NtCancelSynchronousIoFile" , 3 } ,
/*0x089*/ { "NtCommitComplete" , 2 } ,
/*0x08A*/ { "NtCommitEnlistment" , 2 } ,
/*0x08B*/ { "NtCommitTransaction" , 2 } ,
/*0x08C*/ { "NtCompactKeys" , 2 } ,
/*0x08D*/ { "NtCompareTokens" , 3 } ,
/*0x08E*/ { "NtCompleteConnectPort" , 1 } ,
/*0x08F*/ { "NtCompressKey" , 1 } ,
/*0x090*/ { "NtConnectPort" , 8 } ,
/*0x091*/ { "NtCreateDebugObject" , 4 } ,
/*0x092*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x093*/ { "NtCreateEnlistment" , 8 } ,
/*0x094*/ { "NtCreateEventPair" , 3 } ,
/*0x095*/ { "NtCreateIoCompletion" , 4 } ,
/*0x096*/ { "NtCreateJobObject" , 3 } ,
/*0x097*/ { "NtCreateJobSet" , 3 } ,
/*0x098*/ { "NtCreateKeyTransacted" , 8 } ,
/*0x099*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x09A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x09B*/ { "NtCreateMutant" , 4 } ,
/*0x09C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x09D*/ { "NtCreatePagingFile" , 4 } ,
/*0x09E*/ { "NtCreatePort" , 5 } ,
/*0x09F*/ { "NtCreatePrivateNamespace" , 4 } ,
/*0x0A0*/ { "NtCreateProcess" , 8 } ,
/*0x0A1*/ { "NtCreateProfile" , 9 } ,
/*0x0A2*/ { "NtCreateResourceManager" , 7 } ,
/*0x0A3*/ { "NtCreateSemaphore" , 5 } ,
/*0x0A4*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x0A5*/ { "NtCreateThreadEx" , 11 } ,
/*0x0A6*/ { "NtCreateTimer" , 4 } ,
/*0x0A7*/ { "NtCreateToken" , 13 } ,
/*0x0A8*/ { "NtCreateTransaction" , 10 } ,
/*0x0A9*/ { "NtCreateTransactionManager" , 6 } ,
/*0x0AA*/ { "NtCreateUserProcess" , 11 } ,
/*0x0AB*/ { "NtCreateWaitablePort" , 5 } ,
/*0x0AC*/ { "NtCreateWorkerFactory" , 10 } ,
/*0x0AD*/ { "NtDebugActiveProcess" , 2 } ,
/*0x0AE*/ { "NtDebugContinue" , 3 } ,
/*0x0AF*/ { "NtDeleteAtom" , 1 } ,
/*0x0B0*/ { "NtDeleteBootEntry" , 1 } ,
/*0x0B1*/ { "NtDeleteDriverEntry" , 1 } ,
/*0x0B2*/ { "NtDeleteFile" , 1 } ,
/*0x0B3*/ { "NtDeleteKey" , 1 } ,
/*0x0B4*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x0B5*/ { "NtDeletePrivateNamespace" , 1 } ,
/*0x0B6*/ { "NtDeleteValueKey" , 2 } ,
/*0x0B7*/ { "NtDisplayString" , 1 } ,
/*0x0B8*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x0B9*/ { "NtEnumerateDriverEntries" , 2 } ,
/*0x0BA*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x0BB*/ { "NtEnumerateTransactionObject" , 5 } ,
/*0x0BC*/ { "NtExtendSection" , 2 } ,
/*0x0BD*/ { "NtFilterToken" , 6 } ,
/*0x0BE*/ { "NtFlushInstallUILanguage" , 2 } ,
/*0x0BF*/ { "NtFlushInstructionCache" , 3 } ,
/*0x0C0*/ { "NtFlushKey" , 1 } ,