Windows System Calls Page 1 of 11 Windows System Call Table System Call Symbol NT-SP3 NT-SP4 NT-SP5 NT-SP6 2K-SP0 2K-SP1 2K-SP2 2K-SP3 2K-SP4 XP-SPO XP-SP1 XP-SP2 XP-SP3 2003-SPO 2003-SP1 VISTA-SPO SEVEN-SPO NtAcceptConnectPort 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 NtAccessCheck 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 0x0001 NtAccessCheckAndAuditAlarm 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 0x0002 NtAccessCheckByType 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 0x0003 NtAccessCheckByTypeAndAuditAlarm 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 0x0004 NtAccessCheckByTypeResultList 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 0x0005 NtAccessCheckByTypeResultListAndAuditAlarm 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 0x0006 NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 0x0007 NtAddAtom 0x0003 0x0003 0x0003 0x0003 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 0x0008 NtAddBootEntry 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 0x0009 NtAddDriverEntry OxOOOA OxOOOA OxOOOA OxOOOA NtAdjustGroupsToken 0x0004 0x0004 0x0004 0x0004 0x0009 0x0009 0x0009 0x0009 0x0009 OxOOOA OxOOOA OxOOOA OxOOOA OxOOOB OxOOOB OxOOOB OxOOOB Nt Adj ustPrivilege sToken 0x0005 0x0005 0x0005 0x0005 OxOOOA OxOOOA OxOOOA OxOOOA OxOOOA OxOOOB OxOOOB OxOOOB OxOOOB OxOOOC OxOOOC OxOOOC OxOOOC NtAlertResume Thread 0x0006 0x0006 0x0006 0x0006 OxOOOB OxOOOB OxOOOB OxOOOB OxOOOB OxOOOC OxOOOC OxOOOC OxOOOC OxOOOD OxOOOD OxOOOD OxOOOD NtAlertThread 0x0007 0x0007 0x0007 0x0007 OxOOOC OxOOOC OxOOOC OxOOOC OxOOOC OxOOOD OxOOOD OxOOOD OxOOOD OxOOOE OxOOOE OxOOOE OxOOOE NtAllocateLocallyUniqueld 0x0008 0x0008 0x0008 0x0008 OxOOOD OxOOOD OxOOOD OxOOOD OxOOOD OxOOOE OxOOOE OxOOOE OxOOOE OxOOOF OxOOOF OxOOOF OxOOOF NtAllocateReserveObject 0x0010 NtAllocateUserPhysicalPages OxOOOE OxOOOE OxOOOE OxOOOE OxOOOE OxOOOF OxOOOF OxOOOF OxOOOF 0x0010 0x0010 0x0010 0x0011 NtAllocateUuids 0x0009 0x0009 0x0009 0x0009 OxOOOF OxOOOF OxOOOF OxOOOF OxOOOF 0x0010 0x0010 0x0010 0x0010 0x0011 0x0011 0x0011 0x0012 NtAllocateVirtualMemory OxOOOA OxOOOA OxOOOA OxOOOA 0x0010 0x0010 0x0010 0x0010 0x0010 0x0011 0x0011 0x0011 0x0011 0x0012 0x0012 0x0012 0x0013 NtAlpcAcceptConnectPort 0x0013 0x0014 NtAlpcCancelMessage 0x0014 0x0015 NtAlpcConnectPort 0x0015 0x0016 NtAlpcCreatePort 0x0016 0x0017 NtAlpcCreatePortSection 0x0017 0x0018 NtAlpcCreateResourceReserve 0x0018 0x0019 NtAlpcCreateSectionView 0x0019 OxOOlA NtAlpcCreateSecurityContext OxOOlA OxOOlB NtAlpcDeletePortSection OxOOlB OxOOlC NtAlpcDeleteResourceReserve OxOOlC OxOOlD NtAlpcDeleteSectionView OxOOlD 0x00IE NtAlpcDeleteSecurityContext 0x00IE 0x00IF NtAlpcDisconnectPort 0x00IF 0x0020 NtAlpcImpersonateClientOfPort 0x0020 0x0021 NtAlpcOpenSenderProcess 0x0021 0x0022 NtAlpcOpenSenderThread 0x0022 0x0023 NtAlpcQuery Information 0x0023 0x0024 NtAlpcQuerylnformationMessage 0x0024 0x0025 NtAlpcRevokeSecurityContext 0x0026 http://miscellaneouz.googlecodexoni/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 2 of 11 NtAlpcSendWaitReceivePort 0x0025 0x0027 NtAlpcSetlnformation 0x0026 0x0028 NtApphelpCacheControl 0x0013 0x0013 0x0027 0x0029 NtAreMappedFilesTheSame 0x0011 0x0011 0x0011 0x0011 0x0011 0x0012 0x0012 0x0012 0x0012 0x0014 0x0014 0x0028 0x002A NtAssignProcessToJobObject 0x0012 0x0012 0x0012 0x0012 0x0012 0x0013 0x0013 0x0013 0x0013 0x0015 0x0015 0x0029 0x002B NtCallbackReturn OxOOOB OxOOOB OxOOOB OxOOOB 0x0013 0x0013 0x0013 0x0013 0x0013 0x0014 0x0014 0x0014 0x0014 0x0016 0x0016 0x002A 0x002C NtCancelDeviceWakeupRequest 0x0016 0x0016 0x0016 0x0016 0x0016 0x0015 0x0015 0x0015 0x0017 0x0017 0x002B NtCancelloFile OxOOOC OxOOOC OxOOOC OxOOOC 0x0014 0x0014 0x0014 0x0014 0x0014 0x0016 0x0016 0x0016 0x0016 0x0018 0x0018 0x002C 0x002D NtCancelloFileEx 0x0172 0x002E NtCancelSynchronousIoFile 0x0173 0x002F NtCancelTimer OxOOOD OxOOOD OxOOOD OxOOOD 0x0015 0x0015 0x0015 0x0015 0x0015 0x0017 0x0017 0x0017 0x0017 0x0019 0x0019 0x002D 0x0030 NtClearAUSavepointsTransaction 0x0IIB NtClearEvent OxOOOE OxOOOE OxOOOE OxOOOE 0x0017 0x0017 0x0017 0x0017 0x0017 0x0018 0x0018 0x0018 0x0018 OxOOlA OxOOlA 0x002E 0x0031 NtClearMUILicenselnfo 0x0187 NtClearSavepointTransaction 0x011A NtClose OxOOOF OxOOOF OxOOOF OxOOOF 0x0018 0x0018 0x0018 0x0018 0x0018 0x0019 0x0019 0x0019 0x0019 OxOOlB OxOOlB 0x002F 0x0032 NtCloseObjectAuditAlarm 0x0010 0x0010 0x0010 0x0010 0x0019 0x0019 0x0019 0x0019 0x0019 OxOOlA OxOOlA OxOOlA OxOOlA OxOOlC OxOOlC 0x0030 0x0033 NtCommitComplete 0x005D 0x0034 NtCommitEnlistment 0x0055 0x0035 NtCommit Transaction 0x0059 0x0036 NtCompactKeys OxOOlB OxOOlB OxOOlB OxOOlB OxOOlD OxOOlD 0x0031 0x0037 NtCompareTokens OxOOlC OxOOlC OxOOlC OxOOlC OxOOlE OxOOlE 0x0032 0x0038 NtCompleteConnectPort 0x0011 0x0011 0x0011 0x0011 OxOOlA OxOOlA OxOOlA OxOOlA OxOOlA OxOOlD OxOOlD OxOOlD OxOOlD OxOOlF OxOOlF 0x0033 0x0039 NtCompressKey OxOOlE OxOOlE OxOOlE OxOOlE 0x0020 0x0020 0x0034 0x003A NtConnectPort 0x0012 0x0012 0x0012 0x0012 OxOOlB OxOOlB OxOOlB OxOOlB OxOOlB OxOOlF OxOOlF OxOOlF OxOOlF 0x0021 0x0021 0x0035 0x003B NtContinue 0x0013 0x0013 0x0013 0x0013 OxOOlC OxOOlC OxOOlC OxOOlC OxOOlC 0x0020 0x0020 0x0020 0x0020 0x0022 0x0022 0x0036 0x003C NtCreateChannel OxOOCD OxOOCC OxOOCC OxOOCC OxOOFl OxOOFl OxOOFl OxOOFl OxOOFl NtCreateDebugObject 0x0021 0x0021 0x0021 0x0021 0x0023 0x0023 0x0037 0x003D NtCreateDirectoryObject 0x0014 0x0014 0x0014 0x0014 OxOOlD OxOOlD OxOOlD OxOOlD OxOOlD 0x0022 0x0022 0x0022 0x0022 0x0024 0x0024 0x0038 0x003E NtCreateEnlistment 0x006D 0x003F NtCreateEvent 0x0015 0x0015 0x0015 0x0015 0x00IE 0x00IE OxOOlE OxOOlE OxOOlE 0x0023 0x0023 0x0023 0x0023 0x0025 0x0025 0x0039 0x0040 NtCreateEventPair 0x0016 0x0016 0x0016 0x0016 0x00IF 0x00IF OxOOlF 0x00IF OxOOlF 0x0024 0x0024 0x0024 0x0024 0x0026 0x0026 0x003A 0x0041 NtCreateFile 0x0017 0x0017 0x0017 0x0017 0x0020 0x0020 0x0020 0x0020 0x0020 0x0025 0x0025 0x0025 0x0025 0x0027 0x0027 0x003B 0x0042 NtCreateloCompletion 0x0018 0x0018 0x0018 0x0018 0x0021 0x0021 0x0021 0x0021 0x0021 0x0026 0x0026 0x0026 0x0026 0x0028 0x0028 0x003C 0x0043 NtCreateJobObject 0x0022 0x0022 0x0022 0x0022 0x0022 0x0027 0x0027 0x0027 0x0027 0x0029 0x0029 0x003D 0x0044 NtCreateJobSet 0x0028 0x0028 0x0028 0x0028 0x002A 0x002A 0x003E 0x0045 NtCreateKey 0x0019 0x0019 0x0019 0x0019 0x0023 0x0023 0x0023 0x0023 0x0023 0x0029 0x0029 0x0029 0x0029 0x002B 0x002B 0x003F 0x0046 NtCreateKey Transacted 0x0048 NtCreateKeyedEvent 0x0117 0x0117 0x0117 0x0117 0x0121 0x0121 0x0169 0x0047 NtCreateMailslotFile OxOOlA 0x001A OxOOlA OxOOlA 0x0024 0x0024 0x0024 0x0024 0x0024 0x002A 0x002A 0x002A 0x002A 0x002C 0x002C 0x0040 0x0049 NtCreateMutant OxOOlB 0x00IB OxOOlB OxOOlB 0x0025 0x0025 0x0025 0x0025 0x0025 0x002B 0x002B 0x002B 0x002B 0x002D 0x002D 0x0041 Ox004A NtCreateNamedPipeFile OxOOlC 0x001C OxOOlC OxOOlC 0x0026 0x0026 0x0026 0x0026 0x0026 0x002C 0x002C 0x002C 0x002C 0x002E 0x002E 0x0042 Ox004B NtCreatePagingFile OxOOlD 0x00 ID OxOOlD OxOOlD 0x0027 0x0027 0x0027 0x0027 0x0027 0x002D 0x002D 0x002D 0x002D 0x002F 0x002F 0x0044 Ox004C http://miscellaneouz.googlecodexom/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 3 of 11 0x00IE 0x001C 0x00IE OxOOlE 0x0028 0x0028 0x0028 0x0028 0x0028 0x002E 0x002E 0x002E 0x002E 0x0030 0x0030 0x0045 0x004D NtCreatePrivateNamespace 0x0043 0x004E NtCreateProcess 0x00IF OxOOlF 0x00IF OxOOlF 0x0029 0x0029 0x0029 0x0029 0x0029 0x002F 0x002F 0x002F 0x002F 0x0031 0x0031 0x0046 0x004F NtCreateProcessEx 0x0030 0x0030 0x0030 0x0030 0x0032 0x0032 0x0047 0x0050 NtCreateProfile 0x0020 0x0020 0x0020 0x0020 0x002A 0x002A 0x002A 0x002A 0x002A 0x0031 0x0031 0x0031 0x0031 0x0033 0x0033 0x0048 0x0051 NtCreateProfileEx 0x0052 NtCreateResourceManager 0x0069 0x0053 NtCreateSection 0x0021 0x0021 0x0021 0x0021 0x002B 0x002B 0x002B 0x002B 0x002B 0x0032 0x0032 0x0032 0x0032 0x0034 0x0034 0x0049 0x0054 NtCreateSemaphore 0x0022 0x0022 0x0022 0x0022 0x002C 0x002C 0x002C 0x002C 0x002C 0x0033 0x0033 0x0033 0x0033 0x0035 0x0035 0x004A 0x0055 NtCreateSymbolicLinkObject 0x0023 0x0023 0x0023 0x0023 0x002D 0x002D 0x002D 0x002D 0x002D 0x0034 0x0034 0x0034 0x0034 0x0036 0x0036 0x004B 0x0056 NtCreate Thread 0x0024 0x0024 0x0024 0x0024 0x002E 0x002E 0x002E 0x002E 0x002E 0x0035 0x0035 0x0035 0x0035 0x0037 0x0037 0x004C 0x0057 NtCreateThreadEx 0x0181 0x0058 NtCreateTimer 0x0025 0x0025 0x0025 0x0025 0x002F 0x002F 0x002F 0x002F 0x002F 0x0036 0x0036 0x0036 0x0036 0x0038 0x0038 0x004D 0x0059 NtCreateToken 0x0026 0x0026 0x0026 0x0026 0x0030 0x0030 0x0030 0x0030 0x0030 0x0037 0x0037 0x0037 0x0037 0x0039 0x0039 0x004E 0x005A NtCreateTransaction 0x004F 0x005B NtCreateTransactionManager 0x0062 0x005C NtCreateUserProcess 0x005D NtCreateWaitablePort 0x0031 0x0031 0x0031 0x0031 0x0031 0x0038 0x0038 0x0038 0x0038 0x003A 0x003A 0x0072 0x005E NtCreate WinStation 0x00D3 NtCreateWorkerFactory 0x017A 0x005F NtDebugActiveProcess 0x0039 0x0039 0x0039 0x0039 0x003B 0x003B 0x0073 0x0060 NtDebugContinue 0x003A 0x003A 0x003A 0x003A 0x003C 0x003C 0x0074 0x0061 NtDelayExecution 0x0027 0x0027 0x0027 0x0027 0x0032 0x0032 0x0032 0x0032 0x0032 0x003B 0x003B 0x003B 0x003B 0x003D 0x003D 0x0075 0x0062 NtDeleteAtom 0x0028 0x0028 0x0028 0x0028 0x0033 0x0033 0x0033 0x0033 0x0033 0x003C 0x003C 0x003C 0x003C 0x003E 0x003E 0x0076 0x0063 NtDeleteBootEntry 0x003D 0x003D 0x003D 0x003F 0x003F 0x0077 0x0064 NtDeleteDriverEntry 0x0040 0x0040 0x0078 0x0065 NtDeleteFile 0x0029 0x0029 0x0029 0x0029 0x0034 0x0034 0x0034 0x0034 0x0034 0x003E 0x003E 0x003E 0x003E 0x0041 0x0041 0x0079 0x0066 NtDeleteKey 0x002A 0x002A 0x002A 0x002A 0x0035 0x0035 0x0035 0x0035 0x0035 0x003F 0x003F 0x003F 0x003F 0x0042 0x0042 0x007A 0x0067 NtDeleteObjectAuditAlarm 0x002B 0x002B 0x002B 0x002B 0x0036 0x0036 0x0036 0x0036 0x0036 0x0040 0x0040 0x0040 0x0040 0x0043 0x0043 0x007C 0x0068 NtDeletePrivateNamespace 0x007B 0x0069 NtDeleteValueKey 0x002C 0x002C 0x002C 0x002C 0x0037 0x0037 0x0037 0x0037 0x0037 0x0041 0x0041 0x0041 0x0041 0x0044 0x0044 0x007D 0x006A NtDeviceloControlFile 0x002D 0x002D 0x002D 0x002D 0x0038 0x0038 0x0038 0x0038 0x0038 0x0042 0x0042 0x0042 0x0042 0x0045 0x0045 0x007E 0x006B NtDisableLastKnownGood 0x006C NtDisplayString 0x002E 0x002E 0x002E 0x002E 0x0039 0x0039 0x0039 0x0039 0x0039 0x0043 0x0043 0x0043 0x0043 0x0046 0x0046 0x007F 0x006D NtDrawText 0x006E NtDuplicateObj ect 0x002F 0x002F 0x002F 0x002F 0x003A 0x003A 0x003A 0x003A 0x003A 0x0044 0x0044 0x0044 0x0044 0x0047 0x0047 0x0080 0x006F NtDuplicateToken 0x0030 0x0030 0x0030 0x0030 0x003B 0x003B 0x003B 0x003B 0x003B 0x0045 0x0045 0x0045 0x0045 0x0048 0x0048 0x0081 0x0070 NtEnableLastKnownGood 0x0071 NtEnumerateB ootEntrie s 0x0046 0x0046 0x0046 0x0009 0x0049 0x0049 0x0082 0x0072 NtEnumerateDriverEntries 0x004A 0x004A 0x0083 0x0073 NtEnumerateKey 0x0031 0x0031 0x0031 0x0031 0x003C 0x003C 0x003C 0x003C 0x003C 0x0047 0x0047 0x0047 0x0047 0x004B 0x004B 0x0084 0x0074 NtEnumerateSystemEnvironmentValuesEx 0x0048 0x0048 0x0048 0x0048 0x004C 0x004C 0x0085 0x0075 NtEnumerateTransactionObject 0x0076 http://miscellaneouz.googlecodexom/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 4 of 11 0x0032 0x0032 0x0032 0x0032 0x003D 0x003D 0x003D 0x003D 0x003D 0x0049 0x0049 0x0049 0x0049 0x004D 0x004D 0x0086 0x0077 NtExtendSection 0x0033 0x0033 0x0033 0x0033 0x003E 0x003E 0x003E 0x003E 0x003E 0x004A 0x004A 0x004A 0x004A 0x004E 0x004E 0x0087 0x0078 NtFilterToken 0x003F 0x003F 0x003F 0x003F 0x003F 0x004B 0x004B 0x004B 0x004B 0x004F 0x004F 0x0088 0x0079 NtFindAtom 0x0034 0x0034 0x0034 0x0034 0x0040 0x0040 0x0040 0x0040 0x0040 0x004C 0x004C 0x004C 0x004C 0x0050 0x0050 0x0089 0x007A NtFlushBuffersFile 0x0035 0x0035 0x0035 0x0035 0x0041 0x0041 0x0041 0x0041 0x0041 0x004D 0x004D 0x004D 0x004D 0x0051 0x0051 0x008A 0x007B NtFlushlnstallUILanguage 0x0189 0x007C NtFlushlnstructionCache 0x0036 0x0036 0x0036 0x0036 0x0042 0x0042 0x0042 0x0042 0x0042 0x004E 0x004E 0x004E 0x004E 0x0052 0x0052 0x008B 0x007D NtFlushKey 0x0037 0x0037 0x0037 0x0037 0x0043 0x0043 0x0043 0x0043 0x0043 0x004F 0x004F 0x004F 0x004F 0x0053 0x0053 0x008C 0x007E NtFlushProcessWriteBuffers 0x008D 0x007F NtFlushVirtualMemory 0x0038 0x0038 0x0038 0x0038 0x0044 0x0044 0x0044 0x0044 0x0044 0x0050 0x0050 0x0050 0x0050 0x0054 0x0054 0x008E 0x0080 NtFlushWriteBuffer 0x0039 0x0039 0x0039 0x0039 0x0045 0x0045 0x0045 0x0045 0x0045 0x0051 0x0051 0x0051 0x0051 0x0055 0x0055 0x008F 0x0081 NtFreeUserPhysicalPages 0x0046 0x0046 0x0046 0x0046 0x0046 0x0052 0x0052 0x0052 0x0052 0x0056 0x0056 0x0090 0x0082 NtFreeVirtualMemory 0x003A 0x003A 0x003A 0x003A 0x0047 0x0047 0x0047 0x0047 0x0047 0x0053 0x0053 0x0053 0x0053 0x0057 0x0057 0x0091 0x0083 NtFreezeRegistry 0x0092 0x0084 NtFreezeTransactions 0x0093 0x0085 NtFsControlFile 0x003B 0x003B 0x003B 0x003B 0x0048 0x0048 0x0048 0x0048 0x0048 0x0054 0x0054 0x0054 0x0054 0x0058 0x0058 0x0094 0x0086 NtGetContextThread 0x003C 0x003C 0x003C 0x003C 0x0049 0x0049 0x0049 0x0049 0x0049 0x0055 0x0055 0x0055 0x0055 0x0059 0x0059 0x0095 0x0087 NtGetCurrentProcessorNumber 0x0126 0x0126 0x016E 0x0088 NtGetDevicePowerState 0x004A 0x004A 0x004A 0x004A 0x004A 0x0056 0x0056 0x0056 0x0056 0x005A 0x005A 0x0096 0x0089 NtGetMUILicenselnfo 0x0186 NtGetMUIRegistrylnfo 0x018A 0x008A NtGetNextProcess 0x0170 0x008B NtGetNextThread 0x0171 0x008C NtGetNlsSectionPtr 0x0097 0x008D NtGetNotificationRe sourceManager 0x006B 0x008E NtGetPlugPlayEvent 0x003D 0x003D 0x003D 0x003D 0x004B 0x004B 0x004B 0x004B 0x004B 0x0057 0x0057 0x0057 0x0057 0x005B 0x005B 0x0098 0x008F NtGetTickCount 0x003E 0x003E 0x003E 0x003E 0x004C 0x004C 0x004C 0x004C 0x004C NtGetWriteWatch 0x004D 0x004D 0x004D 0x004D 0x004D 0x0058 0x0058 0x0058 0x0058 0x005C 0x005C 0x0099 0x0090 NtlmpersonateAnonymousToken 0x004E 0x004E 0x004E 0x004E 0x004E 0x0059 0x0059 0x0059 0x0059 0x005D 0x005D 0x009A 0x0091 NtlmpersonateClientOfPort 0x003F 0x003F 0x003F 0x003F 0x004F 0x004F 0x004F 0x004F 0x004F 0x005A 0x005A 0x005A 0x005A 0x005E 0x005E 0x009B 0x0092 NtlmpersonateThread 0x0040 0x0040 0x0040 0x0040 0x0050 0x0050 0x0050 0x0050 0x0050 0x005B 0x005B 0x005B 0x005B 0x005F 0x005F 0x009C 0x0093 NtlnitializeNlsFiles 0x009D 0x0094 NtlnitializeRegistry 0x0041 0x0041 0x0041 0x0041 0x0051 0x0051 0x0051 0x0051 0x0051 0x005C 0x005C 0x005C 0x005C 0x0060 0x0060 0x009E 0x0095 NtlnitiatePowerAction 0x0052 0x0052 0x0052 0x0052 0x0052 0x005D 0x005D 0x005D 0x005D 0x0061 0x0061 0x009F 0x0096 NtlsProcessInJob 0x005E 0x005E 0x005E 0x005E 0x0062 0x0062 OxOOAO 0x0097 NtlsSystemResumeAutomatic 0x0053 0x0053 0x0053 0x0053 0x0053 0x005F 0x005F 0x005F 0x005F 0x0063 0x0063 OxOOAl 0x0098 NtlsUILanguageComitted 0x0188 0x0099 NtListTransactions 0x0185 NtListenChannel OxOOCE OxOOCD OxOOCD OxOOCD 0x00F2 0x00F2 0x00F2 0x00F2 0x00F2 NtListenPort 0x0042 0x0042 0x0042 0x0042 0x0054 0x0054 0x0054 0x0054 0x0054 0x0060 0x0060 0x0060 0x0060 0x0064 0x0064 0x00A2 0x009A NtLoadDriver 0x0043 0x0043 0x0043 0x0043 0x0055 0x0055 0x0055 0x0055 0x0055 0x0061 0x0061 0x0061 0x0061 0x0065 0x0065 0x00A3 0x009B NtLoadKey 0x0044 0x0044 0x0044 0x0044 0x0056 0x0056 0x0056 0x0056 0x0056 0x0062 0x0062 0x0062 0x0062 0x0066 0x0066 0x00A4 0x009C NtLoadKey2 0x0045 0x0045 0x0045 0x0045 0x0057 0x0057 0x0057 0x0057 0x0057 0x0063 0x0063 0x0063 0x0063 0x0067 0x0067 0x00A5 0x009D http://miscellaneouz.googlecodexom/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 5 of 11 0x0068 0x0068 0x00A6 0x009E NtLockFile 0x0046 0x0046 0x0046 0x0046 0x0058 0x0058 0x0058 0x0058 0x0058 0x0064 0x0064 0x0064 0x0064 0x0069 0x0069 0x00A7 0x009F NtLockProductActivationKeys 0x0065 0x0065 0x0065 0x0065 0x006A 0x006A 0x00A8 OxOOAO NtLockRegistryKey 0x0066 0x0066 0x0066 0x0066 0x006B 0x006B 0x00A9 OxOOAl NtLockVirtualMemory 0x0047 0x0047 0x0047 0x0047 0x0059 0x0059 0x0059 0x0059 0x0059 0x0067 0x0067 0x0067 0x0067 0x006C 0x006C OxOOAA 0x00A2 NtMakePermanentObject 0x0068 0x0068 0x0068 0x0068 0x006D 0x006D OxOOAB 0x00A3 NtMakeTemporaryObject 0x0048 0x0048 0x0048 0x0048 0x005A 0x005A 0x005A 0x005A 0x005A 0x0069 0x0069 0x0069 0x0069 0x006E 0x006E OxOOAC 0x00A4 NtMapCMFModule 0x0184 0x00A5 NtMapUserPhysicalPages 0x005B 0x005B 0x005B 0x005B 0x005B 0x006A 0x006A 0x006A 0x006A 0x006F 0x006F OxOOAD 0x00A6 NtMapUserPhysicalPagesScatter 0x005C 0x005C 0x005C 0x005C 0x005C 0x006B 0x006B 0x006B 0x006B 0x0070 0x0070 OxOOAE 0x00A7 NtMapViewOfSection 0x0049 0x0049 0x0049 0x0049 0x005D 0x005D 0x005D 0x005D 0x005D 0x006C 0x006C 0x006C 0x006C 0x0071 0x0071 OxOOAF 0x00A8 NtMarshallTransaction 0x0177 NtModifyBootEntry 0x006D 0x006D 0x006D 0x0015 0x0072 0x0072 OxOOBO 0x00A9 NtModifyDriverEntry 0x0073 0x0073 OxOOBl OxOOAA NtNotifyChangeDirectoryFile 0x004A 0x004A 0x004A 0x004A 0x005E 0x005E 0x005E 0x005E 0x005E 0x006E 0x006E 0x006E 0x006E 0x0074 0x0074 0x00B2 OxOOAB NtNotifyChangeKey 0x004B 0x004B 0x004B 0x004B 0x005F 0x005F 0x005F 0x005F 0x005F 0x006F 0x006F 0x006F 0x006F 0x0075 0x0075 0x00B3 OxOOAC NtNotify ChangeMultipleKey s 0x0060 0x0060 0x0060 0x0060 0x0060 0x0070 0x0070 0x0070 0x0070 0x0076 0x0076 0x00B4 OxOOAD NtNotifyChangeSession OxOOAE NtOpenChannel OxOOCF OxOOCE OxOOCE OxOOCE 0x00F3 0x00F3 0x00F3 0x00F3 0x00F3 NtOpenDirectoryObject 0x004C 0x004C 0x004C 0x004C 0x0061 0x0061 0x0061 0x0061 0x0061 0x0071 0x0071 0x0071 0x0071 0x0077 0x0077 0x00B5 OxOOAF NtOpenEnlistment 0x006E OxOOBO NtOpenEvent 0x004D 0x004D 0x004D 0x004D 0x0062 0x0062 0x0062 0x0062 0x0062 0x0072 0x0072 0x0072 0x0072 0x0078 0x0078 0x00B6 OxOOBl NtOpenEventPair 0x004E 0x004E 0x004E 0x004E 0x0063 0x0063 0x0063 0x0063 0x0063 0x0073 0x0073 0x0073 0x0073 0x0079 0x0079 0x00B7 0x00B2 NtOpenFile 0x004F 0x004F 0x004F 0x004F 0x0064 0x0064 0x0064 0x0064 0x0064 0x0074 0x0074 0x0074 0x0074 0x007A 0x007A 0x00B8 0x00B3 NtOpenloCompletion 0x0050 0x0050 0x0050 0x0050 0x0065 0x0065 0x0065 0x0065 0x0065 0x0075 0x0075 0x0075 0x0075 0x007B 0x007B 0x00B9 0x00B4 NtOpenJobObject 0x0066 0x0066 0x0066 0x0066 0x0066 0x0076 0x0076 0x0076 0x0076 0x007C 0x007C OxOOBA 0x00B5 NtOpenKey 0x0051 0x0051 0x0051 0x0051 0x0067 0x0067 0x0067 0x0067 0x0067 0x0077 0x0077 0x0077 0x0077 0x007D 0x007D OxOOBB 0x00B6 NtOpenKeyEx 0x00B7 NtOpenKeyTransacted 0x00B9 NtOpenKeyTransactedEx OxOOBA NtOpenKeyedEvent 0x0118 0x0118 0x0118 0x0118 0x0122 0x0122 0x016A 0x00B8 NtOpenMutant 0x0052 0x0052 0x0052 0x0052 0x0068 0x0068 0x0068 0x0068 0x0068 0x0078 0x0078 0x0078 0x0078 0x007E 0x007E OxOOBC OxOOBB NtOpenObjectAuditAlami 0x0053 0x0053 0x0053 0x0053 0x0069 0x0069 0x0069 0x0069 0x0069 0x0079 0x0079 0x0079 0x0079 0x007F 0x007F OxOOBE OxOOBC NtOpenPri vateName space OxOOBD OxOOBD NtOpenProcess 0x0054 0x0054 0x0054 0x0054 0x006A 0x006A 0x006A 0x006A 0x006A 0x007A 0x007A 0x007A 0x007A 0x0080 0x0080 OxOOBF OxOOBE NtOpenProcessToken 0x0055 0x0055 0x0055 0x0055 0x006B 0x006B 0x006B 0x006B 0x006B 0x007B 0x007B 0x007B 0x007B 0x0081 0x0081 OxOOCO OxOOBF NtOpenProcessTokenEx 0x007C 0x007C 0x007C 0x007C 0x0082 0x0082 OxOOCl OxOOCO NtOpenResourceManager 0x006A OxOOCl NtOpenSection 0x0056 0x0056 0x0056 0x0056 0x006C 0x006C 0x006C 0x006C 0x006C 0x007D 0x007D 0x007D 0x007D 0x0083 0x0083 0x00C2 0x00C2 NtOpenSemaphore 0x0057 0x0057 0x0057 0x0057 0x006D 0x006D 0x006D 0x006D 0x006D 0x007E 0x007E 0x007E 0x007E 0x0084 0x0084 0x00C3 0x00C3 NtOpenSession 0x00C4 0x00C4 NtOpenSymbolicLinkObject 0x0058 0x0058 0x0058 0x0058 0x006E 0x006E 0x006E 0x006E 0x006E 0x007F 0x007F 0x007F 0x007F 0x0085 0x0085 0x00C5 0x00C5 NtOpenThread 0x0059 0x0059 0x0059 0x0059 0x006F 0x006F 0x006F 0x006F 0x006F 0x0080 0x0080 0x0080 0x0080 0x0086 0x0086 0x00C6 0x00C6 http://miscellaneouz.googlecodexom/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 6 of 11 0x005A 0x005A 0x005A 0x005A 0x0070 0x0070 0x0070 0x0070 0x0070 0x0081 0x0081 0x0081 0x0081 0x0087 0x0087 0x00C7 0x00C7 NtOpenThreadTokenEx 0x0082 0x0082 0x0082 0x0082 0x0088 0x0088 0x00C8 0x00C8 NtOpenTimer 0x005B 0x005B 0x005B 0x005B 0x0071 0x0071 0x0071 0x0071 0x0071 0x0083 0x0083 0x0083 0x0083 0x0089 0x0089 0x00C9 0x00C9 NtOpenTransaction 0x0050 OxOOCA NtOpenTransactionManager 0x0063 OxOOCB NtOpenWinStation 0x00D4 NtPlugPlayControl 0x005C 0x005C 0x005C 0x005C 0x0072 0x0072 0x0072 0x0072 0x0072 0x0084 0x0084 0x0084 0x0084 0x008A 0x008A OxOOCA OxOOCC NtPowerlnformation 0x0073 0x0073 0x0073 0x0073 0x0073 0x0085 0x0085 0x0085 0x0085 0x008B 0x008B OxOOCB OxOOCD NtPrePrepareComplete 0x005B OxOODO NtPrePrepareEnlistment 0x0053 OxOODl NtPrepareComplete 0x005C OxOOCE NtPrepareEnlistment 0x0054 OxOOCF NtPrivilegeCheck 0x005D 0x005D 0x005D 0x005D 0x0074 0x0074 0x0074 0x0074 0x0074 0x0086 0x0086 0x0086 0x0086 0x008C 0x008C OxOOCC 0x00D2 NtPrivilegeObjectAuditAlami 0x005F 0x005F 0x005F 0x005F 0x0076 0x0076 0x0076 0x0076 0x0076 0x0087 0x0087 0x0087 0x0087 0x008D 0x008D OxOOCD 0x00D4 NtPrivilegedServiceAuditAlami 0x005E 0x005E 0x005E 0x005E 0x0075 0x0075 0x0075 0x0075 0x0075 0x0088 0x0088 0x0088 0x0088 0x008E 0x008E OxOOCE 0x00D3 NtPropagationComplete 0x0178 0x00D5 NtPropagationFailed 0x0179 0x00D6 NtProtectVirtualMemory 0x0060 0x0060 0x0060 0x0060 0x0077 0x0077 0x0077 0x0077 0x0077 0x0089 0x0089 0x0089 0x0089 0x008F 0x008F OxOOCF 0x00D7 NtPullTransaction 0x0176 NtPulseEvent 0x0061 0x0061 0x0061 0x0061 0x0078 0x0078 0x0078 0x0078 0x0078 0x008A 0x008A 0x008A 0x008A 0x0090 0x0090 OxOODO 0x00D8 NtQuery Attribute sFile 0x0063 0x0063 0x0063 0x0063 0x007A 0x007A 0x007A 0x007A 0x007A 0x008B 0x008B 0x008B 0x008B 0x0091 0x0091 OxOODl 0x00D9 NtQuery B ootEntry Order 0x008C 0x008C 0x008C 0x0092 0x0092 0x00D2 OxOODA NtQuery B ootOptions 0x008D 0x008D 0x008D 0x0093 0x0093 0x00D3 OxOODB NtQuery DebugFilterState 0x008E 0x008E 0x008E 0x008E 0x0094 0x0094 0x00D4 OxOODC NtQuery DefaultLocale 0x0064 0x0064 0x0064 0x0064 0x007B 0x007B 0x007B 0x007B 0x007B 0x008F 0x008F 0x008F 0x008F 0x0095 0x0095 0x00D5 OxOODD NtQuery DefaultUILanguage 0x007C 0x007C 0x007C 0x007C 0x007C 0x0090 0x0090 0x0090 0x0090 0x0096 0x0096 0x00D6 OxOODE NtQuery DirectoryFile 0x0065 0x0065 0x0065 0x0065 0x007D 0x007D 0x007D 0x007D 0x007D 0x0091 0x0091 0x0091 0x0091 0x0097 0x0097 0x00D7 OxOODF NtQuery Directory Obj ect 0x0066 0x0066 0x0066 0x0066 0x007E 0x007E 0x007E 0x007E 0x007E 0x0092 0x0092 0x0092 0x0092 0x0098 0x0098 0x00D8 OxOOEO NtQuery DriverEntry Order 0x0099 0x0099 0x00D9 OxOOEl NtQueryEaFile 0x0067 0x0067 0x0067 0x0067 0x007F 0x007F 0x007F 0x007F 0x007F 0x0093 0x0093 0x0093 0x0093 0x009A 0x009A OxOODA 0x00E2 NtQueryEvent 0x0068 0x0068 0x0068 0x0068 0x0080 0x0080 0x0080 0x0080 0x0080 0x0094 0x0094 0x0094 0x0094 0x009B 0x009B OxOODB 0x00E3 NtQuery Full Attribute sFile 0x0069 0x0069 0x0069 0x0069 0x0081 0x0081 0x0081 0x0081 0x0081 0x0095 0x0095 0x0095 0x0095 0x009C 0x009C OxOODC 0x00E4 NtQuery InformationAtom 0x0062 0x0062 0x0062 0x0062 0x0079 0x0079 0x0079 0x0079 0x0079 0x0096 0x0096 0x0096 0x0096 0x009D 0x009D OxOODD 0x00E5 NtQuery InformationEnlistment 0x0070 0x00E6 NtQuery InformationFile 0x006A 0x006A 0x006A 0x006A 0x0082 0x0082 0x0082 0x0082 0x0082 0x0097 0x0097 0x0097 0x0097 0x009E 0x009E OxOODE 0x00E7 NtQuery InformationJobObject 0x0083 0x0083 0x0083 0x0083 0x0083 0x0098 0x0098 0x0098 0x0098 0x009F 0x009F OxOODF 0x00E8 NtQuery InformationPort 0x006C 0x006C 0x006C 0x006C 0x0085 0x0085 0x0085 0x0085 0x0085 0x0099 0x0099 0x0099 0x0099 OxOOAO OxOOAO OxOOEO 0x00E9 NtQuery InformationProcess 0x006D 0x006D 0x006D 0x006D 0x0086 0x0086 0x0086 0x0086 0x0086 0x009A 0x009A 0x009A 0x009A OxOOAl OxOOAl OxOOEl OxOOEA NtQuery InformationResourceManager 0x006C OxOOEB NtQuery InformationThread 0x006E 0x006E 0x006E 0x006E 0x0087 0x0087 0x0087 0x0087 0x0087 0x009B 0x009B 0x009B 0x009B 0x00A2 0x00A2 0x00E2 OxOOEC NtQuery InformationToken 0x006F 0x006F 0x006F 0x006F 0x0088 0x0088 0x0088 0x0088 0x0088 0x009C 0x009C 0x009C 0x009C 0x00A3 0x00A3 0x00E3 OxOOED NtQuery InformationTransaction 0x0051 OxOOEE NtQuery InformationTransactionManager 0x0052 OxOOEF http://miscellaneouz.googlecodexom/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 7 of 11 0x017E OxOOFO NtQuerylnstallUILanguage 0x0089 0x0089 0x0089 0x0089 0x0089 0x009D 0x009D 0x009D 0x009D 0x00A4 0x00A4 OxOOE4 OxOOFl NtQuerylntervalProfile 0x0070 0x0070 0x0070 0x0070 0x008A 0x008A 0x008A 0x008A 0x008A 0x009E 0x009E 0x009E 0x009E 0x00A5 0x00A5 0x00E5 0x00F2 NtQueryloCompletion 0x006B 0x006B 0x006B 0x006B 0x0084 0x0084 0x0084 0x0084 0x0084 0x009F 0x009F 0x009F 0x009F 0x00A6 0x00A6 0x00E6 0x00F3 NtQueryKey 0x0071 0x0071 0x0071 0x0071 0x008B 0x008B 0x008B 0x008B 0x008B OxOOAO OxOOAO OxOOAO OxOOAO 0x00A7 0x00A7 0x00E7 OxOOF4 NtQueryLicense Value 0x0183 0x00F5 NtQueryMultipleValueKey 0x0072 0x0072 0x0072 0x0072 0x008C 0x008C 0x008C 0x008C 0x008C OxOOAl OxOOAl OxOOAl OxOOAl 0x00A8 0x00A8 OxOOE8 0x00F6 NtQueryMutant 0x0073 0x0073 0x0073 0x0073 0x008D 0x008D 0x008D 0x008D 0x008D 0x00 A2 0x00A2 0x00 A2 0x00A2 0x00A9 0x00A9 0x00E9 0x00F7 NtQuery Object 0x0074 0x0074 0x0074 0x0074 0x008E 0x008E 0x008E 0x008E 0x008E 0x00 A3 0x00A3 0x00 A3 0x00A3 OxOOAA OxOOAA OxOOEA OxOOF8 NtQueryOleDirectoryFile 0x0075 0x0075 0x0075 0x0075 NtQueryOpenSubKeys 0x008F 0x008F 0x008F 0x008F 0x008F 0x00A4 0x00A4 0x00A4 0x00A4 OxOOAB OxOOAB OxOOEB 0x00F9 NtQueryOpenSubKeysEx OxOOAC OxOOAC OxOOEC OxOOFA NtQueryPerformanceCounter 0x0076 0x0076 0x0076 0x0076 0x0090 0x0090 0x0090 0x0090 0x0090 0x00 A5 0x00A5 0x00 A5 0x00A5 OxOOAD OxOOAD OxOOED OxOOFB NtQueryPortlnformationProcess 0x01IB 0x01IB 0x01IB 0x0IIB 0x0125 0x0125 0x016D OxOOFC NtQueryQuotalnformationFile 0x0091 0x0091 0x0091 0x0091 0x0091 0x00A6 0x00A6 0x00A6 0x00A6 OxOOAE OxOOAE OxOOEE OxOOFD NtQuerySection 0x0077 0x0077 0x0077 0x0077 0x0092 0x0092 0x0092 0x0092 0x0092 0x00A7 0x00A7 0x00A7 0x00A7 OxOOAF OxOOAF OxOOEF OxOOFE NtQuerySecurityAttributesToken OxOOFF NtQuerySecurityObject 0x0078 0x0078 0x0078 0x0078 0x0093 0x0093 0x0093 0x0093 0x0093 0x00A8 0x00A8 0x00A8 0x00A8 OxOOBO OxOOBO OxOOFO 0x0100 NtQuerySemaphore 0x0079 0x0079 0x0079 0x0079 0x0094 0x0094 0x0094 0x0094 0x0094 0x00 A9 0x00A9 0x00 A9 0x00A9 OxOOBl OxOOBl OxOOFl 0x0101 NtQuerySymbolicLinkObject 0x007A 0x007A 0x007A 0x007A 0x0095 0x0095 0x0095 0x0095 0x0095 0x00 AA OxOOAA OxOOAA OxOOAA 0x00B2 0x00B2 0x00F2 0x0102 NtQuerySystemEnvironment Value 0x007B 0x007B 0x007B 0x007B 0x0096 0x0096 0x0096 0x0096 0x0096 0x00 AB OxOOAB OxOOAB OxOOAB 0x00B3 0x00B3 0x00F3 0x0103 NtQuerySystemEnvironmentValueEx OxOOAC OxOOAC OxOOAC OxOOAC 0x00B4 0x00B4 OxOOF4 0x0104 NtQuerySystemlnformation 0x007C 0x007C 0x007C 0x007C 0x0097 0x0097 0x0097 0x0097 0x0097 0x00 AD OxOOAD OxOOAD OxOOAD 0x00B5 0x00B5 0x00F5 0x0105 NtQuerySystemlnformationEx 0x0106 NtQuerySystemTime 0x007D 0x007D 0x007D 0x007D 0x0098 0x0098 0x0098 0x0098 0x0098 0x00 AE OxOOAE OxOOAE OxOOAE 0x00B6 0x00B6 0x00F6 0x0107 NtQuery Timer 0x007E 0x007E 0x007E 0x007E 0x0099 0x0099 0x0099 0x0099 0x0099 0x00 AF OxOOAF OxOOAF OxOOAF 0x00B7 0x00B7 0x00F7 0x0108 NtQuery TimerResolution 0x007F 0x007F 0x007F 0x007F 0x009A 0x009A 0x009A 0x009A 0x009A OxOOBO OxOOBO OxOOBO OxOOBO 0x00B8 0x00B8 OxOOF8 0x0109 NtQuery ValueKey 0x0080 0x0080 0x0080 0x0080 0x009B 0x009B 0x009B 0x009B 0x009B OxOOBl OxOOBl OxOOBl OxOOBl 0x00B9 0x00B9 0x00F9 0x010A NtQuery VirtualMemory 0x0081 0x0081 0x0081 0x0081 0x009C 0x009C 0x009C 0x009C 0x009C 0x00B2 0x00B2 0x00B2 0x00B2 OxOOBA OxOOBA OxOOFA 0x010B NtQuery VolumelnformationFile 0x0082 0x0082 0x0082 0x0082 0x009D 0x009D 0x009D 0x009D 0x009D 0x00B3 0x00B3 0x00B3 0x00B3 OxOOBB OxOOBB OxOOFB 0x0IOC NtQuery WinStationlnformation 0x00D5 NtQueueApcThread 0x0083 0x0083 0x0083 0x0083 0x009E 0x009E 0x009E 0x009E 0x009E 0x00B4 0x00B4 0x00B4 0x00B4 OxOOBC OxOOBC OxOOFC 0x010D NtQueueApcThreadEx 0x010E NtRaiseException 0x0084 0x0084 0x0084 0x0084 0x009F 0x009F 0x009F 0x009F 0x009F 0x00B5 0x00B5 0x00B5 0x00B5 OxOOBD OxOOBD OxOOFD 0x010F NtRaiseHardError 0x0085 0x0085 0x0085 0x0085 OxOOAO OxOOAO OxOOAO OxOOAO OxOOAO 0x00B6 0x00B6 0x00B6 0x00B6 OxOOBE OxOOBE OxOOFE 0x0110 NtReadFile 0x0086 0x0086 0x0086 0x0086 OxOOAl OxOOAl OxOOAl OxOOAl OxOOAl 0x00B7 0x00B7 0x00B7 0x00B7 OxOOBF OxOOBF OxOOFF 0x0111 NtReadFileScatter 0x0087 0x0087 0x0087 0x0087 0x00 A2 0x00A2 0x00A2 0x00A2 0x00A2 0x00B8 0x00B8 0x00B8 0x00B8 OxOOCO OxOOCO 0x0100 0x0112 NtReadOnlyEnlistment 0x0056 0x0113 NtReadReque stData 0x0088 0x0088 0x0088 0x0088 0x00 A3 0x00A3 0x00A3 0x00A3 0x00A3 0x00B9 0x00B9 0x00B9 0x00B9 OxOOCl OxOOCl 0x0101 0x0114 NtReadVirtualMemory 0x0089 0x0089 0x0089 0x0089 0x00A4 0x00A4 0x00A4 0x00A4 0x00A4 OxOOBA OxOOBA OxOOBA OxOOBA 0x00C2 0x00C2 0x0102 0x0115 NtRecoverEnlistment 0x0066 0x0116 NtRecoverResourceManager 0x0067 0x0117 NtRecoverTransactionManager 0x0068 0x0118 http://miscellaneouz.googlecodexom/svn/tmnkywinsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 8 of 11 0x0175 0x0119 NtRegisterThreadTerminatePort 0x008A 0x008A 0x008A 0x008A 0x00 A5 0x00A5 0x00A5 0x00A5 0x00A5 OxOOBB OxOOBB OxOOBB OxOOBB 0x00C3 0x00C3 0x0103 0x011A NtReleaseKeyedEvent 0x0119 0x0119 0x0119 0x0119 0x0123 0x0123 0x016B 0x0IIB NtReleaseMutant 0x008B 0x008B 0x008B 0x008B 0x00A6 0x00A6 0x00A6 0x00A6 0x00A6 OxOOBC OxOOBC OxOOBC OxOOBC OxOOC4 OxOOC4 0x0104 0x0 HC NtReleaseSemaphore 0x008C 0x008C 0x008C 0x008C 0x00A7 0x00A7 0x00A7 0x00A7 0x00A7 OxOOBD OxOOBD OxOOBD OxOOBD 0x00C5 0x00C5 0x0105 0x01ID NtReleaseWorkerFactory Worker 0x017B 0x0 HE NtRemoveloCompletion 0x008D 0x008D 0x008D 0x008D 0x00A8 0x00A8 0x00A8 0x00A8 0x00A8 OxOOBE OxOOBE OxOOBE OxOOBE 0x00C6 0x00C6 0x0106 0x01IF NtRemoveloCompletionEx 0x0174 0x0120 NtRemoveProcessDebug OxOOBF OxOOBF OxOOBF OxOOBF 0x00C7 0x00C7 0x0107 0x0121 NtRenameKey OxOOCO OxOOCO OxOOCO OxOOCO OxOOC8 OxOOC8 0x0108 0x0122 NtRenameTransactionManager 0x0064 0x0123 NtReplaceKey 0x008E 0x008E 0x008E 0x008E 0x00 A9 0x00A9 0x00A9 0x00A9 0x00A9 OxOOCl OxOOCl OxOOCl OxOOCl 0x00C9 0x00C9 0x0109 0x0124 NtReplacePartitionUnit 0x0125 NtReplyPort 0x008F 0x008F 0x008F 0x008F 0x00 AA OxOOAA OxOOAA OxOOAA OxOOAA 0x00C2 0x00C2 0x00C2 0x00C2 OxOOCA OxOOCA 0x010A 0x0126 NtReplyWaitReceivePort 0x0090 0x0090 0x0090 0x0090 0x00 AB OxOOAB OxOOAB OxOOAB OxOOAB 0x00C3 0x00C3 0x00C3 0x00C3 OxOOCB OxOOCB 0x010B 0x0127 NtReplyWaitReceivePortEx OxOOAC OxOOAC OxOOAC OxOOAC OxOOAC 0x00C4 0x00C4 OxOOC4 OxOOC4 OxOOCC OxOOCC 0x0IOC 0x0128 NtReplyWaitReplyPort 0x0091 0x0091 0x0091 0x0091 0x00 AD OxOOAD OxOOAD OxOOAD OxOOAD 0x00C5 0x00C5 0x00C5 0x00C5 OxOOCD OxOOCD 0x010D 0x0129 NtReplyWaitSendChannel OxOODO OxOOCF OxOOCF OxOOCF 0x00F4 0x00F4 0x00F4 0x00F4 0x00F4 NtRequestDeviceWakeup 0x00 AE OxOOAE OxOOAE OxOOAE OxOOAE 0x00C6 0x00C6 0x00C6 0x00C6 OxOOCE OxOOCE 0x010E NtRequestPort 0x0092 0x0092 0x0092 0x0092 0x00 AF OxOOAF OxOOAF OxOOAF OxOOAF 0x00C7 0x00C7 0x00C7 0x00C7 OxOOCF OxOOCF 0x010F 0x012A NtRequestWaitReplyPort 0x0093 0x0093 0x0093 0x0093 OxOOBO OxOOBO OxOOBO OxOOBO OxOOBO 0x00C8 0x00C8 OxOOC8 OxOOC8 OxOODO OxOODO 0x0110 0x012B NtRequestWakeupLatency OxOOBl OxOOBl OxOOBl OxOOBl OxOOBl 0x00C9 0x00C9 0x00C9 0x00C9 OxOODl OxOODl 0x0111 NtResetEvent 0x0094 0x0094 0x0094 0x0094 0x00B2 0x00B2 0x00B2 0x00B2 0x00B2 OxOOCA OxOOCA OxOOCA OxOOCA 0x00D2 0x00D2 0x0112 0x012C NtResetWriteWatch 0x00B3 0x00B3 0x00B3 0x00B3 0x00B3 OxOOCB OxOOCB OxOOCB OxOOCB 0x00D3 0x00D3 0x0113 0x012D NtRestoreKey 0x0095 0x0095 0x0095 0x0095 0x00B4 0x00B4 0x00B4 0x00B4 0x00B4 OxOOCC OxOOCC OxOOCC OxOOCC OxOOD4 OxOOD4 0x0114 0x012E NtResumeProcess OxOOCD OxOOCD OxOOCD OxOOCD 0x00D5 0x00D5 0x0115 0x012F NtResumeThread 0x0096 0x0096 0x0096 0x0096 0x00B5 0x00B5 0x00B5 0x00B5 0x00B5 OxOOCE OxOOCE OxOOCE OxOOCE 0x00D6 0x00D6 0x0116 0x0130 NtRollbackComplete 0x0057 0x0131 NtRollbackEnlistment 0x0058 0x0132 NtRollbackSavepointTransaction 0x011C NtRollbackTransaction 0x005A 0x0133 NtRollforwardTransactionManager 0x0065 0x0134 NtSaveKey 0x0097 0x0097 0x0097 0x0097 0x00B6 0x00B6 0x00B6 0x00B6 0x00B6 OxOOCF OxOOCF OxOOCF OxOOCF 0x00D7 0x00D7 0x0117 0x0135 NtSaveKeyEx OxOODO OxOODO OxOODO OxOODO OxOOD8 OxOOD8 0x0118 0x0136 NtSaveMergedKeys 0x00B7 0x00B7 0x00B7 0x00B7 0x00B7 OxOODl OxOODl OxOODl OxOODl 0x00D9 0x00D9 0x0119 0x0137 NtSavepointComplete 0x0 HE NtSavepoint Transaction 0x01ID NtSecureConnectPort 0x00B8 0x00B8 0x00B8 0x00B8 0x00B8 0x00D2 0x00D2 0x00D2 0x00D2 OxOODA OxOODA 0x01IF 0x0138 NtSendWaitReplyChannel OxOODl OxOODO OxOODO OxOODO 0x00F5 0x00F5 0x00F5 0x00F5 0x00F5 NtSerializeBoot 0x0139 NtSetBootEntry Order 0x00D3 0x00D3 0x00D3 OxOODB OxOODB 0x0120 0x013A NtSetBootOptions 0x00D4 OxOOD4 OxOOD4 OxOODC OxOODC 0x0121 0x013B NtSetContextChannel 0x00D2 OxOODl OxOODl OxOODl 0x00F6 0x00F6 0x00F6 0x00F6 0x00F6 http://miscellaneouz.googlecode.com/svn/trunk/winsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 9 of 11 0x0099 0x0099 0x0099 0x0099 OxOOBA OxOOBA OxOOBA OxOOBA OxOOBA 0x00D5 0x00D5 0x00D5 0x00D5 OxOODD OxOODD 0x0122 0x013C NtSetDebugFilterState 0x00D6 0x00D6 0x00D6 0x00D6 OxOODE OxOODE 0x0123 0x013D NtSetDefaultHardErrorPort 0x009A 0x009A 0x009A 0x009A OxOOBB OxOOBB OxOOBB OxOOBB OxOOBB 0x00D7 0x00D7 0x00D7 0x00D7 OxOODF OxOODF 0x0124 0x013E NtSetDefaultLocale 0x009B 0x009B 0x009B 0x009B OxOOBC OxOOBC OxOOBC OxOOBC OxOOBC OxOOD8 OxOOD8 OxOOD8 OxOOD8 OxOOEO OxOOEO 0x0125 0x013F NtSetDefaultUILanguage OxOOBD OxOOBD OxOOBD OxOOBD OxOOBD 0x00D9 0x00D9 0x00D9 0x00D9 OxOOEl OxOOEl 0x0126 0x0140 NtSetDriverEntry Order 0x00E2 0x00E2 0x0127 0x0141 NtSetEaFile 0x009C 0x009C 0x009C 0x009C OxOOBE OxOOBE OxOOBE OxOOBE OxOOBE OxOODA OxOODA OxOODA OxOODA 0x00E3 0x00E3 0x0128 0x0142 NtSetEvent 0x009D 0x009D 0x009D 0x009D OxOOBF OxOOBF OxOOBF OxOOBF OxOOBF OxOODB OxOODB OxOODB OxOODB OxOOE4 OxOOE4 0x0129 0x0143 NtSetEventBoostPriority OxOODC OxOODC OxOODC OxOODC 0x00E5 0x00E5 0x012A 0x0144 NtSetHighEventPair 0x009E 0x009E 0x009E 0x009E OxOOCO OxOOCO OxOOCO OxOOCO OxOOCO OxOODD OxOODD OxOODD OxOODD 0x00E6 0x00E6 0x012B 0x0145 NtSetHighWaitLowEventPair 0x009F 0x009F 0x009F 0x009F OxOOCl OxOOCl OxOOCl OxOOCl OxOOCl OxOODE OxOODE OxOODE OxOODE 0x00E7 0x00E7 0x012C 0x0146 NtSetHighWaitLowThread OxOOAO OxOOAO OxOOAO OxOOAO NtSetlnformationDebugObject OxOODF OxOODF OxOODF OxOODF OxOOE8 OxOOE8 0x012D 0x0147 NtSetlnformationEnlistment 0x006F 0x0148 NtSetlnformationFile 0x00 Al OxOOAl OxOOAl OxOOAl 0x00C2 0x00C2 0x00C2 0x00C2 0x00C2 OxOOEO OxOOEO OxOOEO OxOOEO 0x00E9 0x00E9 0x012E 0x0149 NtSetlnformationJobObject 0x00C3 0x00C3 0x00C3 0x00C3 0x00C3 OxOOEl OxOOEl OxOOEl OxOOEl OxOOEA OxOOEA 0x012F 0x014A NtSetlnformationKey 0x00A2 0x00A2 0x00A2 0x00A2 0x00C4 0x00C4 0x00C4 OxOOC4 OxOOC4 0x00E2 0x00E2 0x00E2 0x00E2 OxOOEB OxOOEB 0x0130 0x014B NtSetlnformationObject 0x00A3 0x00A3 0x00A3 0x00A3 0x00C5 0x00C5 0x00C5 0x00C5 0x00C5 0x00E3 0x00E3 0x00E3 0x00E3 OxOOEC OxOOEC 0x0131 0x014C NtSetlnformationProcess 0x00A4 0x00A4 0x00A4 0x00A4 0x00C6 0x00C6 0x00C6 0x00C6 0x00C6 OxOOE4 OxOOE4 OxOOE4 OxOOE4 OxOOED OxOOED 0x0132 0x014D NtSetlnformationResourceManager 0x0061 0x014E NtSetlnformationThread 0x00A5 0x00A5 0x00A5 0x00A5 0x00C7 0x00C7 0x00C7 0x00C7 0x00C7 0x00E5 0x00E5 0x00E5 0x00E5 OxOOEE OxOOEE 0x0133 0x014F NtSetlnformationToken 0x00A6 0x00A6 0x00A6 0x00A6 0x00C8 0x00C8 0x00C8 OxOOC8 OxOOC8 0x00E6 0x00E6 0x00E6 0x00E6 OxOOEF OxOOEF 0x0134 0x0150 NtSetlnformationTransaction 0x005F 0x0151 NtSetlnformationTransactionManager 0x0060 0x0152 NtSetlnformationWorkerFactory 0x017D 0x0153 NtSetlntervalProfile 0x00A7 0x00A7 0x00A7 0x00A7 0x00C9 0x00C9 0x00C9 0x00C9 0x00C9 0x00E7 0x00E7 0x00E7 0x00E7 OxOOFO OxOOFO 0x0135 0x0154 NtSetloCompletion 0x0098 0x0098 0x0098 0x0098 0x00B9 0x00B9 0x00B9 0x00B9 0x00B9 OxOOE8 OxOOE8 OxOOE8 OxOOE8 OxOOFl OxOOFl 0x0136 0x0155 NtSetloCompletionEx 0x0156 NtSetLdtEntries 0x00A8 0x00A8 0x00A8 0x00A8 OxOOCA OxOOCA OxOOCA OxOOCA OxOOCA 0x00E9 0x00E9 0x00E9 0x00E9 0x00F2 0x00F2 0x0137 0x0157 NtSetLowEventPair 0x00A9 0x00A9 0x00A9 0x00A9 OxOOCB OxOOCB OxOOCB OxOOCB OxOOCB OxOOEA OxOOEA OxOOEA OxOOEA 0x00F3 0x00F3 0x0138 0x0158 NtSetLowWaitHighEventPair OxOOAA OxOOAA OxOOAA OxOOAA OxOOCC OxOOCC OxOOCC OxOOCC OxOOCC OxOOEB OxOOEB OxOOEB OxOOEB OxOOF4 OxOOF4 0x0139 0x0159 NtSetLowWaitHighThread OxOOAB OxOOAB OxOOAB OxOOAB NtSetQuotalnformationFile OxOOCD OxOOCD OxOOCD OxOOCD OxOOCD OxOOEC OxOOEC OxOOEC OxOOEC 0x00F5 0x00F5 0x013A 0x015A NtSetSecurityObject OxOOAC OxOOAC OxOOAC OxOOAC OxOOCE OxOOCE OxOOCE OxOOCE OxOOCE OxOOED OxOOED OxOOED OxOOED 0x00F6 0x00F6 0x013B 0x015B NtSetSystemEnvironment Value OxOOAD OxOOAD OxOOAD OxOOAD OxOOCF OxOOCF OxOOCF OxOOCF OxOOCF OxOOEE OxOOEE OxOOEE OxOOEE 0x00F7 0x00F7 0x013C 0x015C NtSetSystemEnvironmentValueEx OxOOEF OxOOEF OxOOEF OxOOF8 OxOOF8 0x013D 0x015D NtSetSystemlnformation OxOOAE OxOOAE OxOOAE OxOOAE OxOODO OxOODO OxOODO OxOODO OxOODO OxOOFO OxOOFO OxOOFO OxOOFO 0x00F9 0x00F9 0x013E 0x015E NtSetSystemPowerState OxOOAF OxOOAF OxOOAF OxOOAF OxOODl OxOODl OxOODl OxOODl OxOODl OxOOFl OxOOFl OxOOFl OxOOFl OxOOFA OxOOFA 0x013F 0x015F NtSetSystemTime OxOOBO OxOOBO OxOOBO OxOOBO 0x00D2 0x00D2 0x00D2 0x00D2 0x00D2 0x00F2 0x00F2 0x00F2 0x00F2 OxOOFB OxOOFB 0x0140 0x0160 NtSetThreadExecutionState 0x00D3 0x00D3 0x00D3 0x00D3 0x00D3 0x00F3 0x00F3 0x00F3 0x00F3 OxOOFC OxOOFC 0x0141 0x0161 NtSetTimer OxOOBl OxOOBl OxOOBl OxOOBl 0x00D4 0x00D4 OxOOD4 OxOOD4 OxOOD4 OxOOF4 OxOOF4 OxOOF4 OxOOF4 OxOOFD OxOOFD 0x0142 0x0162 NtSetTimerEx 0x0163 NtSetTimerResolution 0x00B2 0x00B2 0x00B2 0x00B2 0x00D5 0x00D5 0x00D5 0x00D5 0x00D5 0x00F5 0x00F5 0x00F5 0x00F5 OxOOFE OxOOFE 0x0143 0x0164 http://miscellaneouz.googlecode.com/svn/trunk/winsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 10 of 11 0x00D6 0x00D6 0x00D6 0x00D6 0x00D6 0x00F6 0x00F6 0x00F6 0x00F6 OxOOFF OxOOFF 0x0144 0x0165 NtSetValueKey 0x00B3 0x00B3 0x00B3 0x00B3 0x00D7 0x00D7 0x00D7 0x00D7 0x00D7 0x00F7 0x00F7 0x00F7 0x00F7 0x0100 0x0100 0x0145 0x0166 NtSetVolumelnformationFile 0x00B4 0x00B4 0x00B4 0x00B4 0x00D8 OxOOD8 OxOOD8 OxOOD8 OxOOD8 OxOOF8 OxOOF8 OxOOF8 OxOOF8 0x0101 0x0101 0x0146 0x0167 NtSetWinStationlnformation 0x00D6 NtShutdownSystem 0x00B5 0x00B5 0x00B5 0x00B5 0x00D9 0x00D9 0x00D9 0x00D9 0x00D9 0x00F9 0x00F9 0x00F9 0x00F9 0x0102 0x0102 0x0147 0x0168 NtShutdownWorkerFactory 0x0180 0x0169 NtSignalAndWaitForSingleObject 0x00B6 0x00B6 0x00B6 0x00B6 OxOODA OxOODA OxOODA OxOODA OxOODA OxOOFA OxOOFA OxOOFA OxOOFA 0x0103 0x0103 0x0148 0x016A NtSinglePhaseReject 0x005E 0x016B NtStartProfile 0x00B7 0x00B7 0x00B7 0x00B7 OxOODB OxOODB OxOODB OxOODB OxOODB OxOOFB OxOOFB OxOOFB OxOOFB 0x0104 0x0104 0x0149 0x016C NtStartTm 0x0071 NtStopProfile 0x00B8 0x00B8 0x00B8 0x00B8 OxOODC OxOODC OxOODC OxOODC OxOODC OxOOFC OxOOFC OxOOFC OxOOFC 0x0105 0x0105 0x014A 0x016D NtSuspendProcess OxOOFD OxOOFD OxOOFD OxOOFD 0x0106 0x0106 0x014B 0x016E NtSuspendThread 0x00B9 0x00B9 0x00B9 0x00B9 OxOODD OxOODD OxOODD OxOODD OxOODD OxOOFE OxOOFE OxOOFE OxOOFE 0x0107 0x0107 0x014C 0x016F NtSystemDebugControl OxOOBA OxOOBA OxOOBA OxOOBA OxOODE OxOODE OxOODE OxOODE OxOODE OxOOFF OxOOFF OxOOFF OxOOFF 0x0108 0x0108 0x014D 0x0170 NtTerminateJobObject OxOODF OxOODF OxOODF OxOODF OxOODF 0x0100 0x0100 0x0100 0x0100 0x0109 0x0109 0x014E 0x0171 NtTerminateProcess OxOOBB OxOOBB OxOOBB OxOOBB OxOOEO OxOOEO OxOOEO OxOOEO OxOOEO 0x0101 0x0101 0x0101 0x0101 OxOlOA OxOlOA 0x014F 0x0172 NtTerminate Thread OxOOBC OxOOBC OxOOBC OxOOBC OxOOEl OxOOEl OxOOEl OxOOEl OxOOEl 0x0102 0x0102 0x0102 0x0102 OxOlOB OxOlOB 0x0150 0x0173 NtTestAlert OxOOBD OxOOBD OxOOBD OxOOBD 0x00E2 0x00E2 0x00E2 0x00E2 0x00E2 0x0103 0x0103 0x0103 0x0103 OxOlOC OxOlOC 0x0151 0x0174 NtThawRegistry 0x0152 0x0175 NtThawTransactions 0x0153 0x0176 NtTraceControl 0x0155 0x0177 NtTraceEvent 0x0104 0x0104 0x0104 0x0104 OxOlOD OxOlOD 0x0154 0x0178 NtTranslateFilePath 0x0105 0x0105 0x0105 0x0105 OxOlOE OxOlOE 0x0156 0x0179 NtUmsThreadYield 0x017A NtUnloadDriver OxOOBE OxOOBE OxOOBE OxOOBE 0x00E3 0x00E3 0x00E3 0x00E3 0x00E3 0x0106 0x0106 0x0106 0x0106 OxOlOF OxOlOF 0x0157 0x017B NtUnloadKey OxOOBF OxOOBF OxOOBF OxOOBF OxOOE4 OxOOE4 OxOOE4 OxOOE4 OxOOE4 0x0107 0x0107 0x0107 0x0107 0x0110 0x0110 0x0158 0x017C NtUnloadKey2 0x0111 0x0111 0x0159 0x017D NtUnloadKeyEx 0x0108 0x0108 0x0108 0x0108 0x0112 0x0112 0x015A 0x017E NtUnlockFile OxOOCO OxOOCO OxOOCO OxOOCO 0x00E5 0x00E5 0x00E5 0x00E5 0x00E5 0x0109 0x0109 0x0109 0x0109 0x0113 0x0113 0x015B 0x017F NtUnlockVirtualMemory OxOOCl OxOOCl OxOOCl OxOOCl 0x00E6 0x00E6 0x00E6 0x00E6 0x00E6 0x01 OA OxOlOA 0x01 OA 0x010A 0x0114 0x0114 0x015C 0x0180 NtUnmapViewOfSection 0x00C2 0x00C2 0x00C2 0x00C2 0x00E7 0x00E7 0x00E7 0x00E7 0x00E7 0x01OB OxOlOB 0x01OB 0x010B 0x0115 0x0115 0x015D 0x0181 NtVdmControl 0x00C3 0x00C3 0x00C3 0x00C3 OxOOE8 OxOOE8 OxOOE8 OxOOE8 OxOOE8 0x0IOC OxOlOC 0x0IOC 0x0IOC 0x0116 0x0116 0x015E 0x0182 NtW32Call OxOOCC NtWaitForDebugEvent 0x01 OD OxOlOD 0x01 OD 0x010D 0x0117 0x0117 0x015F 0x0183 NtWaitForKeyedEvent 0x011A 0x011A 0x011A 0x011A 0x0124 0x0124 0x016C 0x0184 NtWaitForMultipleObjects 0x00C4 0x00C4 0x00C4 0x00C4 0x00E9 0x00E9 0x00E9 0x00E9 0x00E9 0x010E OxOlOE 0x010E 0x010E 0x0118 0x0118 0x0160 0x0185 NtWaitForMultipleObjects32 0x0127 0x016F 0x0186 NtWaitForSingleObject 0x00C5 0x00C5 0x00C5 0x00C5 OxOOEA OxOOEA OxOOEA OxOOEA OxOOEA 0x01OF OxOlOF 0x01OF 0x010F 0x0119 0x0119 0x0161 0x0187 NtWaitForWorkViaWorkerFactory 0x017C 0x0188 NtWaitHignEventPair 0x00C6 0x00C6 0x00C6 0x00C6 OxOOEB OxOOEB OxOOEB OxOOEB OxOOEB 0x0110 0x0110 0x0110 0x0110 0x011A 0x011A 0x0162 0x0189 NtWaitLowEventPair 0x00C7 0x00C7 0x00C7 0x00C7 OxOOEC OxOOEC OxOOEC OxOOEC OxOOEC 0x0111 0x0111 0x0111 0x0111 0x01IB 0x01IB 0x0163 0x018A NtWorkerFactoryWorkerReady 0x017F 0x018B NtWriteErrorLogEntry 0x00D7 http://miscellaneouz.googlecode.com/svn/trunk/winsyscalls/winsyscall.html 9.2.2010 Windows System Calls Page 11 of 11 0x00C8 0x00C8 0x00C8 OxOOC8 OxOOED OxOOED OxOOED OxOOED OxOOED 0x0112 0x0112 0x0112 0x0112 0x011C 0x011C 0x0164 0x018C NtWriteFileGather 0x00C9 0x00C9 0x00C9 0x00C9 OxOOEE OxOOEE OxOOEE OxOOEE OxOOEE 0x0113 0x0113 0x0113 0x0113 0x01 ID 0x01ID 0x0165 0x018D NtWriteRequestData OxOOCA OxOOCA OxOOCA OxOOCA OxOOEF OxOOEF OxOOEF OxOOEF OxOOEF 0x0114 0x0114 0x0114 0x0114 0x01IE 0x01IE 0x0166 0x018E NtWriteVirtualMemory OxOOCB OxOOCB OxOOCB OxOOCB OxOOFO OxOOFO OxOOFO OxOOFO OxOOFO 0x0115 0x0115 0x0115 0x0115 0x01IF 0x01IF 0x0167 0x018F NtYieldExecution 0x00D3 0x00D2 0x00D2 0x00D2 0x00F7 0x00F7 0x00F7 0x00F7 0x00F7 0x0116 0x0116 0x0116 0x0116 0x0120 0x0120 0x0168 0x0190 http://miscellaneouz.googlecodexom/svn/tmnk/winsyscalls/winsyscall.html 9.2.2010