-
Notifications
You must be signed in to change notification settings - Fork 109
/
Copy pathssdt_i386.c
6802 lines (6712 loc) · 284 KB
/
ssdt_i386.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// ssdt table for 5.1.2600-sp0-windows-xp i386
SDT_NODE static_ssdt_5_1_2600_sp0_windows_xp_i386[284] = {
/*0x000*/ { "NtAcceptConnectPort" , 6 } ,
/*0x001*/ { "NtAccessCheck" , 8 } ,
/*0x002*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x003*/ { "NtAccessCheckByType" , 11 } ,
/*0x004*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x005*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x006*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x007*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x008*/ { "NtAddAtom" , 3 } ,
/*0x009*/ { "NtAddBootEntry" , 2 } ,
/*0x00A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x00B*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x00C*/ { "NtAlertResumeThread" , 2 } ,
/*0x00D*/ { "NtAlertThread" , 1 } ,
/*0x00E*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x00F*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x010*/ { "NtAllocateUuids" , 4 } ,
/*0x011*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x012*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x013*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x014*/ { "NtCallbackReturn" , 3 } ,
/*0x015*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x016*/ { "NtCancelIoFile" , 2 } ,
/*0x017*/ { "NtCancelTimer" , 2 } ,
/*0x018*/ { "NtClearEvent" , 1 } ,
/*0x019*/ { "NtClose" , 1 } ,
/*0x01A*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x01B*/ { "NtCompactKeys" , 2 } ,
/*0x01C*/ { "NtCompareTokens" , 3 } ,
/*0x01D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x01E*/ { "NtCompressKey" , 1 } ,
/*0x01F*/ { "NtConnectPort" , 8 } ,
/*0x020*/ { "NtContinue" , 2 } ,
/*0x021*/ { "NtCreateDebugObject" , 4 } ,
/*0x022*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x023*/ { "NtCreateEvent" , 5 } ,
/*0x024*/ { "NtCreateEventPair" , 3 } ,
/*0x025*/ { "NtCreateFile" , 11 } ,
/*0x026*/ { "NtCreateIoCompletion" , 4 } ,
/*0x027*/ { "NtCreateJobObject" , 3 } ,
/*0x028*/ { "NtCreateJobSet" , 3 } ,
/*0x029*/ { "NtCreateKey" , 7 } ,
/*0x02A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x02B*/ { "NtCreateMutant" , 4 } ,
/*0x02C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x02D*/ { "NtCreatePagingFile" , 4 } ,
/*0x02E*/ { "NtCreatePort" , 5 } ,
/*0x02F*/ { "NtCreateProcess" , 8 } ,
/*0x030*/ { "NtCreateProcessEx" , 9 } ,
/*0x031*/ { "NtCreateProfile" , 9 } ,
/*0x032*/ { "NtCreateSection" , 7 } ,
/*0x033*/ { "NtCreateSemaphore" , 5 } ,
/*0x034*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x035*/ { "NtCreateThread" , 8 } ,
/*0x036*/ { "NtCreateTimer" , 4 } ,
/*0x037*/ { "NtCreateToken" , 13 } ,
/*0x038*/ { "NtCreateWaitablePort" , 5 } ,
/*0x039*/ { "NtDebugActiveProcess" , 2 } ,
/*0x03A*/ { "NtDebugContinue" , 3 } ,
/*0x03B*/ { "NtDelayExecution" , 2 } ,
/*0x03C*/ { "NtDeleteAtom" , 1 } ,
/*0x03D*/ { "NtDeleteBootEntry" , 1 } ,
/*0x03E*/ { "NtDeleteFile" , 1 } ,
/*0x03F*/ { "NtDeleteKey" , 1 } ,
/*0x040*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x041*/ { "NtDeleteValueKey" , 2 } ,
/*0x042*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x043*/ { "NtDisplayString" , 1 } ,
/*0x044*/ { "NtDuplicateObject" , 7 } ,
/*0x045*/ { "NtDuplicateToken" , 6 } ,
/*0x046*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x047*/ { "NtEnumerateKey" , 6 } ,
/*0x048*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x049*/ { "NtEnumerateValueKey" , 6 } ,
/*0x04A*/ { "NtExtendSection" , 2 } ,
/*0x04B*/ { "NtFilterToken" , 6 } ,
/*0x04C*/ { "NtFindAtom" , 3 } ,
/*0x04D*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04E*/ { "NtFlushInstructionCache" , 3 } ,
/*0x04F*/ { "NtFlushKey" , 1 } ,
/*0x050*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x051*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x052*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x053*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x054*/ { "NtFsControlFile" , 10 } ,
/*0x055*/ { "NtGetContextThread" , 2 } ,
/*0x056*/ { "NtGetDevicePowerState" , 2 } ,
/*0x057*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x058*/ { "NtGetWriteWatch" , 7 } ,
/*0x059*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x05A*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x05B*/ { "NtImpersonateThread" , 3 } ,
/*0x05C*/ { "NtInitializeRegistry" , 1 } ,
/*0x05D*/ { "NtInitiatePowerAction" , 4 } ,
/*0x05E*/ { "NtIsProcessInJob" , 2 } ,
/*0x05F*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x060*/ { "NtListenPort" , 2 } ,
/*0x061*/ { "NtLoadDriver" , 1 } ,
/*0x062*/ { "NtLoadKey" , 2 } ,
/*0x063*/ { "NtLoadKey2" , 3 } ,
/*0x064*/ { "NtLockFile" , 10 } ,
/*0x065*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x066*/ { "NtLockRegistryKey" , 1 } ,
/*0x067*/ { "NtLockVirtualMemory" , 4 } ,
/*0x068*/ { "NtMakePermanentObject" , 1 } ,
/*0x069*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x06A*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x06B*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x06C*/ { "NtMapViewOfSection" , 10 } ,
/*0x06D*/ { "NtModifyBootEntry" , 1 } ,
/*0x06E*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x06F*/ { "NtNotifyChangeKey" , 10 } ,
/*0x070*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x071*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x072*/ { "NtOpenEvent" , 3 } ,
/*0x073*/ { "NtOpenEventPair" , 3 } ,
/*0x074*/ { "NtOpenFile" , 6 } ,
/*0x075*/ { "NtOpenIoCompletion" , 3 } ,
/*0x076*/ { "NtOpenJobObject" , 3 } ,
/*0x077*/ { "NtOpenKey" , 3 } ,
/*0x078*/ { "NtOpenMutant" , 3 } ,
/*0x079*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x07A*/ { "NtOpenProcess" , 4 } ,
/*0x07B*/ { "NtOpenProcessToken" , 3 } ,
/*0x07C*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x07D*/ { "NtOpenSection" , 3 } ,
/*0x07E*/ { "NtOpenSemaphore" , 3 } ,
/*0x07F*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x080*/ { "NtOpenThread" , 4 } ,
/*0x081*/ { "NtOpenThreadToken" , 4 } ,
/*0x082*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x083*/ { "NtOpenTimer" , 3 } ,
/*0x084*/ { "NtPlugPlayControl" , 3 } ,
/*0x085*/ { "NtPowerInformation" , 5 } ,
/*0x086*/ { "NtPrivilegeCheck" , 3 } ,
/*0x087*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x088*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x089*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x08A*/ { "NtPulseEvent" , 2 } ,
/*0x08B*/ { "NtQueryAttributesFile" , 2 } ,
/*0x08C*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x08D*/ { "NtQueryBootOptions" , 2 } ,
/*0x08E*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x08F*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x090*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x091*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x092*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x093*/ { "NtQueryEaFile" , 9 } ,
/*0x094*/ { "NtQueryEvent" , 5 } ,
/*0x095*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x096*/ { "NtQueryInformationAtom" , 5 } ,
/*0x097*/ { "NtQueryInformationFile" , 5 } ,
/*0x098*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x099*/ { "NtQueryInformationPort" , 5 } ,
/*0x09A*/ { "NtQueryInformationProcess" , 5 } ,
/*0x09B*/ { "NtQueryInformationThread" , 5 } ,
/*0x09C*/ { "NtQueryInformationToken" , 5 } ,
/*0x09D*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x09E*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x09F*/ { "NtQueryIoCompletion" , 5 } ,
/*0x0A0*/ { "NtQueryKey" , 5 } ,
/*0x0A1*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x0A2*/ { "NtQueryMutant" , 5 } ,
/*0x0A3*/ { "NtQueryObject" , 5 } ,
/*0x0A4*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x0A5*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x0A6*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x0A7*/ { "NtQuerySection" , 5 } ,
/*0x0A8*/ { "NtQuerySecurityObject" , 5 } ,
/*0x0A9*/ { "NtQuerySemaphore" , 5 } ,
/*0x0AA*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x0AB*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x0AC*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x0AD*/ { "NtQuerySystemInformation" , 4 } ,
/*0x0AE*/ { "NtQuerySystemTime" , 1 } ,
/*0x0AF*/ { "NtQueryTimer" , 5 } ,
/*0x0B0*/ { "NtQueryTimerResolution" , 3 } ,
/*0x0B1*/ { "NtQueryValueKey" , 6 } ,
/*0x0B2*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x0B3*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x0B4*/ { "NtQueueApcThread" , 5 } ,
/*0x0B5*/ { "NtRaiseException" , 3 } ,
/*0x0B6*/ { "NtRaiseHardError" , 6 } ,
/*0x0B7*/ { "NtReadFile" , 9 } ,
/*0x0B8*/ { "NtReadFileScatter" , 9 } ,
/*0x0B9*/ { "NtReadRequestData" , 6 } ,
/*0x0BA*/ { "NtReadVirtualMemory" , 5 } ,
/*0x0BB*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x0BC*/ { "NtReleaseMutant" , 2 } ,
/*0x0BD*/ { "NtReleaseSemaphore" , 3 } ,
/*0x0BE*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x0BF*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x0C0*/ { "NtRenameKey" , 2 } ,
/*0x0C1*/ { "NtReplaceKey" , 3 } ,
/*0x0C2*/ { "NtReplyPort" , 2 } ,
/*0x0C3*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x0C4*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x0C5*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x0C6*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x0C7*/ { "NtRequestPort" , 2 } ,
/*0x0C8*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x0C9*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x0CA*/ { "NtResetEvent" , 2 } ,
/*0x0CB*/ { "NtResetWriteWatch" , 3 } ,
/*0x0CC*/ { "NtRestoreKey" , 3 } ,
/*0x0CD*/ { "NtResumeProcess" , 1 } ,
/*0x0CE*/ { "NtResumeThread" , 2 } ,
/*0x0CF*/ { "NtSaveKey" , 2 } ,
/*0x0D0*/ { "NtSaveKeyEx" , 3 } ,
/*0x0D1*/ { "NtSaveMergedKeys" , 3 } ,
/*0x0D2*/ { "NtSecureConnectPort" , 9 } ,
/*0x0D3*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x0D4*/ { "NtSetBootOptions" , 2 } ,
/*0x0D5*/ { "NtSetContextThread" , 2 } ,
/*0x0D6*/ { "NtSetDebugFilterState" , 3 } ,
/*0x0D7*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x0D8*/ { "NtSetDefaultLocale" , 2 } ,
/*0x0D9*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x0DA*/ { "NtSetEaFile" , 4 } ,
/*0x0DB*/ { "NtSetEvent" , 2 } ,
/*0x0DC*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x0DD*/ { "NtSetHighEventPair" , 1 } ,
/*0x0DE*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x0DF*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x0E0*/ { "NtSetInformationFile" , 5 } ,
/*0x0E1*/ { "NtSetInformationJobObject" , 4 } ,
/*0x0E2*/ { "NtSetInformationKey" , 4 } ,
/*0x0E3*/ { "NtSetInformationObject" , 4 } ,
/*0x0E4*/ { "NtSetInformationProcess" , 4 } ,
/*0x0E5*/ { "NtSetInformationThread" , 4 } ,
/*0x0E6*/ { "NtSetInformationToken" , 4 } ,
/*0x0E7*/ { "NtSetIntervalProfile" , 2 } ,
/*0x0E8*/ { "NtSetIoCompletion" , 5 } ,
/*0x0E9*/ { "NtSetLdtEntries" , 6 } ,
/*0x0EA*/ { "NtSetLowEventPair" , 1 } ,
/*0x0EB*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x0EC*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x0ED*/ { "NtSetSecurityObject" , 3 } ,
/*0x0EE*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x0EF*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x0F0*/ { "NtSetSystemInformation" , 3 } ,
/*0x0F1*/ { "NtSetSystemPowerState" , 3 } ,
/*0x0F2*/ { "NtSetSystemTime" , 2 } ,
/*0x0F3*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x0F4*/ { "NtSetTimer" , 7 } ,
/*0x0F5*/ { "NtSetTimerResolution" , 3 } ,
/*0x0F6*/ { "NtSetUuidSeed" , 1 } ,
/*0x0F7*/ { "NtSetValueKey" , 6 } ,
/*0x0F8*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x0F9*/ { "NtShutdownSystem" , 1 } ,
/*0x0FA*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x0FB*/ { "NtStartProfile" , 1 } ,
/*0x0FC*/ { "NtStopProfile" , 1 } ,
/*0x0FD*/ { "NtSuspendProcess" , 1 } ,
/*0x0FE*/ { "NtSuspendThread" , 2 } ,
/*0x0FF*/ { "NtSystemDebugControl" , 6 } ,
/*0x100*/ { "NtTerminateJobObject" , 2 } ,
/*0x101*/ { "NtTerminateProcess" , 2 } ,
/*0x102*/ { "NtTerminateThread" , 2 } ,
/*0x103*/ { "NtTestAlert" , 0 } ,
/*0x104*/ { "NtTraceEvent" , 4 } ,
/*0x105*/ { "NtTranslateFilePath" , 4 } ,
/*0x106*/ { "NtUnloadDriver" , 1 } ,
/*0x107*/ { "NtUnloadKey" , 1 } ,
/*0x108*/ { "NtUnloadKeyEx" , 2 } ,
/*0x109*/ { "NtUnlockFile" , 5 } ,
/*0x10A*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x10B*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x10C*/ { "NtVdmControl" , 2 } ,
/*0x10D*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x10E*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x10F*/ { "NtWaitForSingleObject" , 3 } ,
/*0x110*/ { "NtWaitHighEventPair" , 1 } ,
/*0x111*/ { "NtWaitLowEventPair" , 1 } ,
/*0x112*/ { "NtWriteFile" , 9 } ,
/*0x113*/ { "NtWriteFileGather" , 9 } ,
/*0x114*/ { "NtWriteRequestData" , 6 } ,
/*0x115*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x116*/ { "NtYieldExecution" , 0 } ,
/*0x117*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x118*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x119*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x11A*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x11B*/ { "NtQueryPortInformationProcess" , 0 }
};
// ssdt table for 5.1.2600-sp1-windows-xp i386
SDT_NODE static_ssdt_5_1_2600_sp1_windows_xp_i386[284] = {
/*0x000*/ { "NtAcceptConnectPort" , 6 } ,
/*0x001*/ { "NtAccessCheck" , 8 } ,
/*0x002*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x003*/ { "NtAccessCheckByType" , 11 } ,
/*0x004*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x005*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x006*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x007*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x008*/ { "NtAddAtom" , 3 } ,
/*0x009*/ { "NtAddBootEntry" , 2 } ,
/*0x00A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x00B*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x00C*/ { "NtAlertResumeThread" , 2 } ,
/*0x00D*/ { "NtAlertThread" , 1 } ,
/*0x00E*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x00F*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x010*/ { "NtAllocateUuids" , 4 } ,
/*0x011*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x012*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x013*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x014*/ { "NtCallbackReturn" , 3 } ,
/*0x015*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x016*/ { "NtCancelIoFile" , 2 } ,
/*0x017*/ { "NtCancelTimer" , 2 } ,
/*0x018*/ { "NtClearEvent" , 1 } ,
/*0x019*/ { "NtClose" , 1 } ,
/*0x01A*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x01B*/ { "NtCompactKeys" , 2 } ,
/*0x01C*/ { "NtCompareTokens" , 3 } ,
/*0x01D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x01E*/ { "NtCompressKey" , 1 } ,
/*0x01F*/ { "NtConnectPort" , 8 } ,
/*0x020*/ { "NtContinue" , 2 } ,
/*0x021*/ { "NtCreateDebugObject" , 4 } ,
/*0x022*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x023*/ { "NtCreateEvent" , 5 } ,
/*0x024*/ { "NtCreateEventPair" , 3 } ,
/*0x025*/ { "NtCreateFile" , 11 } ,
/*0x026*/ { "NtCreateIoCompletion" , 4 } ,
/*0x027*/ { "NtCreateJobObject" , 3 } ,
/*0x028*/ { "NtCreateJobSet" , 3 } ,
/*0x029*/ { "NtCreateKey" , 7 } ,
/*0x02A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x02B*/ { "NtCreateMutant" , 4 } ,
/*0x02C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x02D*/ { "NtCreatePagingFile" , 4 } ,
/*0x02E*/ { "NtCreatePort" , 5 } ,
/*0x02F*/ { "NtCreateProcess" , 8 } ,
/*0x030*/ { "NtCreateProcessEx" , 9 } ,
/*0x031*/ { "NtCreateProfile" , 9 } ,
/*0x032*/ { "NtCreateSection" , 7 } ,
/*0x033*/ { "NtCreateSemaphore" , 5 } ,
/*0x034*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x035*/ { "NtCreateThread" , 8 } ,
/*0x036*/ { "NtCreateTimer" , 4 } ,
/*0x037*/ { "NtCreateToken" , 13 } ,
/*0x038*/ { "NtCreateWaitablePort" , 5 } ,
/*0x039*/ { "NtDebugActiveProcess" , 2 } ,
/*0x03A*/ { "NtDebugContinue" , 3 } ,
/*0x03B*/ { "NtDelayExecution" , 2 } ,
/*0x03C*/ { "NtDeleteAtom" , 1 } ,
/*0x03D*/ { "NtDeleteBootEntry" , 1 } ,
/*0x03E*/ { "NtDeleteFile" , 1 } ,
/*0x03F*/ { "NtDeleteKey" , 1 } ,
/*0x040*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x041*/ { "NtDeleteValueKey" , 2 } ,
/*0x042*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x043*/ { "NtDisplayString" , 1 } ,
/*0x044*/ { "NtDuplicateObject" , 7 } ,
/*0x045*/ { "NtDuplicateToken" , 6 } ,
/*0x046*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x047*/ { "NtEnumerateKey" , 6 } ,
/*0x048*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x049*/ { "NtEnumerateValueKey" , 6 } ,
/*0x04A*/ { "NtExtendSection" , 2 } ,
/*0x04B*/ { "NtFilterToken" , 6 } ,
/*0x04C*/ { "NtFindAtom" , 3 } ,
/*0x04D*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04E*/ { "NtFlushInstructionCache" , 3 } ,
/*0x04F*/ { "NtFlushKey" , 1 } ,
/*0x050*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x051*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x052*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x053*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x054*/ { "NtFsControlFile" , 10 } ,
/*0x055*/ { "NtGetContextThread" , 2 } ,
/*0x056*/ { "NtGetDevicePowerState" , 2 } ,
/*0x057*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x058*/ { "NtGetWriteWatch" , 7 } ,
/*0x059*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x05A*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x05B*/ { "NtImpersonateThread" , 3 } ,
/*0x05C*/ { "NtInitializeRegistry" , 1 } ,
/*0x05D*/ { "NtInitiatePowerAction" , 4 } ,
/*0x05E*/ { "NtIsProcessInJob" , 2 } ,
/*0x05F*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x060*/ { "NtListenPort" , 2 } ,
/*0x061*/ { "NtLoadDriver" , 1 } ,
/*0x062*/ { "NtLoadKey" , 2 } ,
/*0x063*/ { "NtLoadKey2" , 3 } ,
/*0x064*/ { "NtLockFile" , 10 } ,
/*0x065*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x066*/ { "NtLockRegistryKey" , 1 } ,
/*0x067*/ { "NtLockVirtualMemory" , 4 } ,
/*0x068*/ { "NtMakePermanentObject" , 1 } ,
/*0x069*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x06A*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x06B*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x06C*/ { "NtMapViewOfSection" , 10 } ,
/*0x06D*/ { "NtModifyBootEntry" , 1 } ,
/*0x06E*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x06F*/ { "NtNotifyChangeKey" , 10 } ,
/*0x070*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x071*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x072*/ { "NtOpenEvent" , 3 } ,
/*0x073*/ { "NtOpenEventPair" , 3 } ,
/*0x074*/ { "NtOpenFile" , 6 } ,
/*0x075*/ { "NtOpenIoCompletion" , 3 } ,
/*0x076*/ { "NtOpenJobObject" , 3 } ,
/*0x077*/ { "NtOpenKey" , 3 } ,
/*0x078*/ { "NtOpenMutant" , 3 } ,
/*0x079*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x07A*/ { "NtOpenProcess" , 4 } ,
/*0x07B*/ { "NtOpenProcessToken" , 3 } ,
/*0x07C*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x07D*/ { "NtOpenSection" , 3 } ,
/*0x07E*/ { "NtOpenSemaphore" , 3 } ,
/*0x07F*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x080*/ { "NtOpenThread" , 4 } ,
/*0x081*/ { "NtOpenThreadToken" , 4 } ,
/*0x082*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x083*/ { "NtOpenTimer" , 3 } ,
/*0x084*/ { "NtPlugPlayControl" , 3 } ,
/*0x085*/ { "NtPowerInformation" , 5 } ,
/*0x086*/ { "NtPrivilegeCheck" , 3 } ,
/*0x087*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x088*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x089*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x08A*/ { "NtPulseEvent" , 2 } ,
/*0x08B*/ { "NtQueryAttributesFile" , 2 } ,
/*0x08C*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x08D*/ { "NtQueryBootOptions" , 2 } ,
/*0x08E*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x08F*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x090*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x091*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x092*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x093*/ { "NtQueryEaFile" , 9 } ,
/*0x094*/ { "NtQueryEvent" , 5 } ,
/*0x095*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x096*/ { "NtQueryInformationAtom" , 5 } ,
/*0x097*/ { "NtQueryInformationFile" , 5 } ,
/*0x098*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x099*/ { "NtQueryInformationPort" , 5 } ,
/*0x09A*/ { "NtQueryInformationProcess" , 5 } ,
/*0x09B*/ { "NtQueryInformationThread" , 5 } ,
/*0x09C*/ { "NtQueryInformationToken" , 5 } ,
/*0x09D*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x09E*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x09F*/ { "NtQueryIoCompletion" , 5 } ,
/*0x0A0*/ { "NtQueryKey" , 5 } ,
/*0x0A1*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x0A2*/ { "NtQueryMutant" , 5 } ,
/*0x0A3*/ { "NtQueryObject" , 5 } ,
/*0x0A4*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x0A5*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x0A6*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x0A7*/ { "NtQuerySection" , 5 } ,
/*0x0A8*/ { "NtQuerySecurityObject" , 5 } ,
/*0x0A9*/ { "NtQuerySemaphore" , 5 } ,
/*0x0AA*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x0AB*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x0AC*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x0AD*/ { "NtQuerySystemInformation" , 4 } ,
/*0x0AE*/ { "NtQuerySystemTime" , 1 } ,
/*0x0AF*/ { "NtQueryTimer" , 5 } ,
/*0x0B0*/ { "NtQueryTimerResolution" , 3 } ,
/*0x0B1*/ { "NtQueryValueKey" , 6 } ,
/*0x0B2*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x0B3*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x0B4*/ { "NtQueueApcThread" , 5 } ,
/*0x0B5*/ { "NtRaiseException" , 3 } ,
/*0x0B6*/ { "NtRaiseHardError" , 6 } ,
/*0x0B7*/ { "NtReadFile" , 9 } ,
/*0x0B8*/ { "NtReadFileScatter" , 9 } ,
/*0x0B9*/ { "NtReadRequestData" , 6 } ,
/*0x0BA*/ { "NtReadVirtualMemory" , 5 } ,
/*0x0BB*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x0BC*/ { "NtReleaseMutant" , 2 } ,
/*0x0BD*/ { "NtReleaseSemaphore" , 3 } ,
/*0x0BE*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x0BF*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x0C0*/ { "NtRenameKey" , 2 } ,
/*0x0C1*/ { "NtReplaceKey" , 3 } ,
/*0x0C2*/ { "NtReplyPort" , 2 } ,
/*0x0C3*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x0C4*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x0C5*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x0C6*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x0C7*/ { "NtRequestPort" , 2 } ,
/*0x0C8*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x0C9*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x0CA*/ { "NtResetEvent" , 2 } ,
/*0x0CB*/ { "NtResetWriteWatch" , 3 } ,
/*0x0CC*/ { "NtRestoreKey" , 3 } ,
/*0x0CD*/ { "NtResumeProcess" , 1 } ,
/*0x0CE*/ { "NtResumeThread" , 2 } ,
/*0x0CF*/ { "NtSaveKey" , 2 } ,
/*0x0D0*/ { "NtSaveKeyEx" , 3 } ,
/*0x0D1*/ { "NtSaveMergedKeys" , 3 } ,
/*0x0D2*/ { "NtSecureConnectPort" , 9 } ,
/*0x0D3*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x0D4*/ { "NtSetBootOptions" , 2 } ,
/*0x0D5*/ { "NtSetContextThread" , 2 } ,
/*0x0D6*/ { "NtSetDebugFilterState" , 3 } ,
/*0x0D7*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x0D8*/ { "NtSetDefaultLocale" , 2 } ,
/*0x0D9*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x0DA*/ { "NtSetEaFile" , 4 } ,
/*0x0DB*/ { "NtSetEvent" , 2 } ,
/*0x0DC*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x0DD*/ { "NtSetHighEventPair" , 1 } ,
/*0x0DE*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x0DF*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x0E0*/ { "NtSetInformationFile" , 5 } ,
/*0x0E1*/ { "NtSetInformationJobObject" , 4 } ,
/*0x0E2*/ { "NtSetInformationKey" , 4 } ,
/*0x0E3*/ { "NtSetInformationObject" , 4 } ,
/*0x0E4*/ { "NtSetInformationProcess" , 4 } ,
/*0x0E5*/ { "NtSetInformationThread" , 4 } ,
/*0x0E6*/ { "NtSetInformationToken" , 4 } ,
/*0x0E7*/ { "NtSetIntervalProfile" , 2 } ,
/*0x0E8*/ { "NtSetIoCompletion" , 5 } ,
/*0x0E9*/ { "NtSetLdtEntries" , 6 } ,
/*0x0EA*/ { "NtSetLowEventPair" , 1 } ,
/*0x0EB*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x0EC*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x0ED*/ { "NtSetSecurityObject" , 3 } ,
/*0x0EE*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x0EF*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x0F0*/ { "NtSetSystemInformation" , 3 } ,
/*0x0F1*/ { "NtSetSystemPowerState" , 3 } ,
/*0x0F2*/ { "NtSetSystemTime" , 2 } ,
/*0x0F3*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x0F4*/ { "NtSetTimer" , 7 } ,
/*0x0F5*/ { "NtSetTimerResolution" , 3 } ,
/*0x0F6*/ { "NtSetUuidSeed" , 1 } ,
/*0x0F7*/ { "NtSetValueKey" , 6 } ,
/*0x0F8*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x0F9*/ { "NtShutdownSystem" , 1 } ,
/*0x0FA*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x0FB*/ { "NtStartProfile" , 1 } ,
/*0x0FC*/ { "NtStopProfile" , 1 } ,
/*0x0FD*/ { "NtSuspendProcess" , 1 } ,
/*0x0FE*/ { "NtSuspendThread" , 2 } ,
/*0x0FF*/ { "NtSystemDebugControl" , 6 } ,
/*0x100*/ { "NtTerminateJobObject" , 2 } ,
/*0x101*/ { "NtTerminateProcess" , 2 } ,
/*0x102*/ { "NtTerminateThread" , 2 } ,
/*0x103*/ { "NtTestAlert" , 0 } ,
/*0x104*/ { "NtTraceEvent" , 4 } ,
/*0x105*/ { "NtTranslateFilePath" , 4 } ,
/*0x106*/ { "NtUnloadDriver" , 1 } ,
/*0x107*/ { "NtUnloadKey" , 1 } ,
/*0x108*/ { "NtUnloadKeyEx" , 2 } ,
/*0x109*/ { "NtUnlockFile" , 5 } ,
/*0x10A*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x10B*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x10C*/ { "NtVdmControl" , 2 } ,
/*0x10D*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x10E*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x10F*/ { "NtWaitForSingleObject" , 3 } ,
/*0x110*/ { "NtWaitHighEventPair" , 1 } ,
/*0x111*/ { "NtWaitLowEventPair" , 1 } ,
/*0x112*/ { "NtWriteFile" , 9 } ,
/*0x113*/ { "NtWriteFileGather" , 9 } ,
/*0x114*/ { "NtWriteRequestData" , 6 } ,
/*0x115*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x116*/ { "NtYieldExecution" , 0 } ,
/*0x117*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x118*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x119*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x11A*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x11B*/ { "NtQueryPortInformationProcess" , 0 }
};
// ssdt table for 5.1.2600-sp2-windows-xp i386
SDT_NODE static_ssdt_5_1_2600_sp2_windows_xp_i386[284] = {
/*0x000*/ { "NtAcceptConnectPort" , 6 } ,
/*0x001*/ { "NtAccessCheck" , 8 } ,
/*0x002*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x003*/ { "NtAccessCheckByType" , 11 } ,
/*0x004*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x005*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x006*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x007*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x008*/ { "NtAddAtom" , 3 } ,
/*0x009*/ { "NtAddBootEntry" , 2 } ,
/*0x00A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x00B*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x00C*/ { "NtAlertResumeThread" , 2 } ,
/*0x00D*/ { "NtAlertThread" , 1 } ,
/*0x00E*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x00F*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x010*/ { "NtAllocateUuids" , 4 } ,
/*0x011*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x012*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x013*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x014*/ { "NtCallbackReturn" , 3 } ,
/*0x015*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x016*/ { "NtCancelIoFile" , 2 } ,
/*0x017*/ { "NtCancelTimer" , 2 } ,
/*0x018*/ { "NtClearEvent" , 1 } ,
/*0x019*/ { "NtClose" , 1 } ,
/*0x01A*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x01B*/ { "NtCompactKeys" , 2 } ,
/*0x01C*/ { "NtCompareTokens" , 3 } ,
/*0x01D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x01E*/ { "NtCompressKey" , 1 } ,
/*0x01F*/ { "NtConnectPort" , 8 } ,
/*0x020*/ { "NtContinue" , 2 } ,
/*0x021*/ { "NtCreateDebugObject" , 4 } ,
/*0x022*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x023*/ { "NtCreateEvent" , 5 } ,
/*0x024*/ { "NtCreateEventPair" , 3 } ,
/*0x025*/ { "NtCreateFile" , 11 } ,
/*0x026*/ { "NtCreateIoCompletion" , 4 } ,
/*0x027*/ { "NtCreateJobObject" , 3 } ,
/*0x028*/ { "NtCreateJobSet" , 3 } ,
/*0x029*/ { "NtCreateKey" , 7 } ,
/*0x02A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x02B*/ { "NtCreateMutant" , 4 } ,
/*0x02C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x02D*/ { "NtCreatePagingFile" , 4 } ,
/*0x02E*/ { "NtCreatePort" , 5 } ,
/*0x02F*/ { "NtCreateProcess" , 8 } ,
/*0x030*/ { "NtCreateProcessEx" , 9 } ,
/*0x031*/ { "NtCreateProfile" , 9 } ,
/*0x032*/ { "NtCreateSection" , 7 } ,
/*0x033*/ { "NtCreateSemaphore" , 5 } ,
/*0x034*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x035*/ { "NtCreateThread" , 8 } ,
/*0x036*/ { "NtCreateTimer" , 4 } ,
/*0x037*/ { "NtCreateToken" , 13 } ,
/*0x038*/ { "NtCreateWaitablePort" , 5 } ,
/*0x039*/ { "NtDebugActiveProcess" , 2 } ,
/*0x03A*/ { "NtDebugContinue" , 3 } ,
/*0x03B*/ { "NtDelayExecution" , 2 } ,
/*0x03C*/ { "NtDeleteAtom" , 1 } ,
/*0x03D*/ { "NtDeleteBootEntry" , 1 } ,
/*0x03E*/ { "NtDeleteFile" , 1 } ,
/*0x03F*/ { "NtDeleteKey" , 1 } ,
/*0x040*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x041*/ { "NtDeleteValueKey" , 2 } ,
/*0x042*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x043*/ { "NtDisplayString" , 1 } ,
/*0x044*/ { "NtDuplicateObject" , 7 } ,
/*0x045*/ { "NtDuplicateToken" , 6 } ,
/*0x046*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x047*/ { "NtEnumerateKey" , 6 } ,
/*0x048*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x049*/ { "NtEnumerateValueKey" , 6 } ,
/*0x04A*/ { "NtExtendSection" , 2 } ,
/*0x04B*/ { "NtFilterToken" , 6 } ,
/*0x04C*/ { "NtFindAtom" , 3 } ,
/*0x04D*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04E*/ { "NtFlushInstructionCache" , 3 } ,
/*0x04F*/ { "NtFlushKey" , 1 } ,
/*0x050*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x051*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x052*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x053*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x054*/ { "NtFsControlFile" , 10 } ,
/*0x055*/ { "NtGetContextThread" , 2 } ,
/*0x056*/ { "NtGetDevicePowerState" , 2 } ,
/*0x057*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x058*/ { "NtGetWriteWatch" , 7 } ,
/*0x059*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x05A*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x05B*/ { "NtImpersonateThread" , 3 } ,
/*0x05C*/ { "NtInitializeRegistry" , 1 } ,
/*0x05D*/ { "NtInitiatePowerAction" , 4 } ,
/*0x05E*/ { "NtIsProcessInJob" , 2 } ,
/*0x05F*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x060*/ { "NtListenPort" , 2 } ,
/*0x061*/ { "NtLoadDriver" , 1 } ,
/*0x062*/ { "NtLoadKey" , 2 } ,
/*0x063*/ { "NtLoadKey2" , 3 } ,
/*0x064*/ { "NtLockFile" , 10 } ,
/*0x065*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x066*/ { "NtLockRegistryKey" , 1 } ,
/*0x067*/ { "NtLockVirtualMemory" , 4 } ,
/*0x068*/ { "NtMakePermanentObject" , 1 } ,
/*0x069*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x06A*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x06B*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x06C*/ { "NtMapViewOfSection" , 10 } ,
/*0x06D*/ { "NtModifyBootEntry" , 1 } ,
/*0x06E*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x06F*/ { "NtNotifyChangeKey" , 10 } ,
/*0x070*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x071*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x072*/ { "NtOpenEvent" , 3 } ,
/*0x073*/ { "NtOpenEventPair" , 3 } ,
/*0x074*/ { "NtOpenFile" , 6 } ,
/*0x075*/ { "NtOpenIoCompletion" , 3 } ,
/*0x076*/ { "NtOpenJobObject" , 3 } ,
/*0x077*/ { "NtOpenKey" , 3 } ,
/*0x078*/ { "NtOpenMutant" , 3 } ,
/*0x079*/ { "NtOpenObjectAuditAlarm" , 12 } ,
/*0x07A*/ { "NtOpenProcess" , 4 } ,
/*0x07B*/ { "NtOpenProcessToken" , 3 } ,
/*0x07C*/ { "NtOpenProcessTokenEx" , 4 } ,
/*0x07D*/ { "NtOpenSection" , 3 } ,
/*0x07E*/ { "NtOpenSemaphore" , 3 } ,
/*0x07F*/ { "NtOpenSymbolicLinkObject" , 3 } ,
/*0x080*/ { "NtOpenThread" , 4 } ,
/*0x081*/ { "NtOpenThreadToken" , 4 } ,
/*0x082*/ { "NtOpenThreadTokenEx" , 5 } ,
/*0x083*/ { "NtOpenTimer" , 3 } ,
/*0x084*/ { "NtPlugPlayControl" , 3 } ,
/*0x085*/ { "NtPowerInformation" , 5 } ,
/*0x086*/ { "NtPrivilegeCheck" , 3 } ,
/*0x087*/ { "NtPrivilegeObjectAuditAlarm" , 6 } ,
/*0x088*/ { "NtPrivilegedServiceAuditAlarm" , 5 } ,
/*0x089*/ { "NtProtectVirtualMemory" , 5 } ,
/*0x08A*/ { "NtPulseEvent" , 2 } ,
/*0x08B*/ { "NtQueryAttributesFile" , 2 } ,
/*0x08C*/ { "NtQueryBootEntryOrder" , 2 } ,
/*0x08D*/ { "NtQueryBootOptions" , 2 } ,
/*0x08E*/ { "NtQueryDebugFilterState" , 2 } ,
/*0x08F*/ { "NtQueryDefaultLocale" , 2 } ,
/*0x090*/ { "NtQueryDefaultUILanguage" , 1 } ,
/*0x091*/ { "NtQueryDirectoryFile" , 11 } ,
/*0x092*/ { "NtQueryDirectoryObject" , 7 } ,
/*0x093*/ { "NtQueryEaFile" , 9 } ,
/*0x094*/ { "NtQueryEvent" , 5 } ,
/*0x095*/ { "NtQueryFullAttributesFile" , 2 } ,
/*0x096*/ { "NtQueryInformationAtom" , 5 } ,
/*0x097*/ { "NtQueryInformationFile" , 5 } ,
/*0x098*/ { "NtQueryInformationJobObject" , 5 } ,
/*0x099*/ { "NtQueryInformationPort" , 5 } ,
/*0x09A*/ { "NtQueryInformationProcess" , 5 } ,
/*0x09B*/ { "NtQueryInformationThread" , 5 } ,
/*0x09C*/ { "NtQueryInformationToken" , 5 } ,
/*0x09D*/ { "NtQueryInstallUILanguage" , 1 } ,
/*0x09E*/ { "NtQueryIntervalProfile" , 2 } ,
/*0x09F*/ { "NtQueryIoCompletion" , 5 } ,
/*0x0A0*/ { "NtQueryKey" , 5 } ,
/*0x0A1*/ { "NtQueryMultipleValueKey" , 6 } ,
/*0x0A2*/ { "NtQueryMutant" , 5 } ,
/*0x0A3*/ { "NtQueryObject" , 5 } ,
/*0x0A4*/ { "NtQueryOpenSubKeys" , 2 } ,
/*0x0A5*/ { "NtQueryPerformanceCounter" , 2 } ,
/*0x0A6*/ { "NtQueryQuotaInformationFile" , 9 } ,
/*0x0A7*/ { "NtQuerySection" , 5 } ,
/*0x0A8*/ { "NtQuerySecurityObject" , 5 } ,
/*0x0A9*/ { "NtQuerySemaphore" , 5 } ,
/*0x0AA*/ { "NtQuerySymbolicLinkObject" , 3 } ,
/*0x0AB*/ { "NtQuerySystemEnvironmentValue" , 4 } ,
/*0x0AC*/ { "NtQuerySystemEnvironmentValueEx" , 5 } ,
/*0x0AD*/ { "NtQuerySystemInformation" , 4 } ,
/*0x0AE*/ { "NtQuerySystemTime" , 1 } ,
/*0x0AF*/ { "NtQueryTimer" , 5 } ,
/*0x0B0*/ { "NtQueryTimerResolution" , 3 } ,
/*0x0B1*/ { "NtQueryValueKey" , 6 } ,
/*0x0B2*/ { "NtQueryVirtualMemory" , 6 } ,
/*0x0B3*/ { "NtQueryVolumeInformationFile" , 5 } ,
/*0x0B4*/ { "NtQueueApcThread" , 5 } ,
/*0x0B5*/ { "NtRaiseException" , 3 } ,
/*0x0B6*/ { "NtRaiseHardError" , 6 } ,
/*0x0B7*/ { "NtReadFile" , 9 } ,
/*0x0B8*/ { "NtReadFileScatter" , 9 } ,
/*0x0B9*/ { "NtReadRequestData" , 6 } ,
/*0x0BA*/ { "NtReadVirtualMemory" , 5 } ,
/*0x0BB*/ { "NtRegisterThreadTerminatePort" , 1 } ,
/*0x0BC*/ { "NtReleaseMutant" , 2 } ,
/*0x0BD*/ { "NtReleaseSemaphore" , 3 } ,
/*0x0BE*/ { "NtRemoveIoCompletion" , 5 } ,
/*0x0BF*/ { "NtRemoveProcessDebug" , 2 } ,
/*0x0C0*/ { "NtRenameKey" , 2 } ,
/*0x0C1*/ { "NtReplaceKey" , 3 } ,
/*0x0C2*/ { "NtReplyPort" , 2 } ,
/*0x0C3*/ { "NtReplyWaitReceivePort" , 4 } ,
/*0x0C4*/ { "NtReplyWaitReceivePortEx" , 5 } ,
/*0x0C5*/ { "NtReplyWaitReplyPort" , 2 } ,
/*0x0C6*/ { "NtRequestDeviceWakeup" , 1 } ,
/*0x0C7*/ { "NtRequestPort" , 2 } ,
/*0x0C8*/ { "NtRequestWaitReplyPort" , 3 } ,
/*0x0C9*/ { "NtRequestWakeupLatency" , 1 } ,
/*0x0CA*/ { "NtResetEvent" , 2 } ,
/*0x0CB*/ { "NtResetWriteWatch" , 3 } ,
/*0x0CC*/ { "NtRestoreKey" , 3 } ,
/*0x0CD*/ { "NtResumeProcess" , 1 } ,
/*0x0CE*/ { "NtResumeThread" , 2 } ,
/*0x0CF*/ { "NtSaveKey" , 2 } ,
/*0x0D0*/ { "NtSaveKeyEx" , 3 } ,
/*0x0D1*/ { "NtSaveMergedKeys" , 3 } ,
/*0x0D2*/ { "NtSecureConnectPort" , 9 } ,
/*0x0D3*/ { "NtSetBootEntryOrder" , 2 } ,
/*0x0D4*/ { "NtSetBootOptions" , 2 } ,
/*0x0D5*/ { "NtSetContextThread" , 2 } ,
/*0x0D6*/ { "NtSetDebugFilterState" , 3 } ,
/*0x0D7*/ { "NtSetDefaultHardErrorPort" , 1 } ,
/*0x0D8*/ { "NtSetDefaultLocale" , 2 } ,
/*0x0D9*/ { "NtSetDefaultUILanguage" , 1 } ,
/*0x0DA*/ { "NtSetEaFile" , 4 } ,
/*0x0DB*/ { "NtSetEvent" , 2 } ,
/*0x0DC*/ { "NtSetEventBoostPriority" , 1 } ,
/*0x0DD*/ { "NtSetHighEventPair" , 1 } ,
/*0x0DE*/ { "NtSetHighWaitLowEventPair" , 1 } ,
/*0x0DF*/ { "NtSetInformationDebugObject" , 5 } ,
/*0x0E0*/ { "NtSetInformationFile" , 5 } ,
/*0x0E1*/ { "NtSetInformationJobObject" , 4 } ,
/*0x0E2*/ { "NtSetInformationKey" , 4 } ,
/*0x0E3*/ { "NtSetInformationObject" , 4 } ,
/*0x0E4*/ { "NtSetInformationProcess" , 4 } ,
/*0x0E5*/ { "NtSetInformationThread" , 4 } ,
/*0x0E6*/ { "NtSetInformationToken" , 4 } ,
/*0x0E7*/ { "NtSetIntervalProfile" , 2 } ,
/*0x0E8*/ { "NtSetIoCompletion" , 5 } ,
/*0x0E9*/ { "NtSetLdtEntries" , 6 } ,
/*0x0EA*/ { "NtSetLowEventPair" , 1 } ,
/*0x0EB*/ { "NtSetLowWaitHighEventPair" , 1 } ,
/*0x0EC*/ { "NtSetQuotaInformationFile" , 4 } ,
/*0x0ED*/ { "NtSetSecurityObject" , 3 } ,
/*0x0EE*/ { "NtSetSystemEnvironmentValue" , 2 } ,
/*0x0EF*/ { "NtSetSystemEnvironmentValueEx" , 5 } ,
/*0x0F0*/ { "NtSetSystemInformation" , 3 } ,
/*0x0F1*/ { "NtSetSystemPowerState" , 3 } ,
/*0x0F2*/ { "NtSetSystemTime" , 2 } ,
/*0x0F3*/ { "NtSetThreadExecutionState" , 2 } ,
/*0x0F4*/ { "NtSetTimer" , 7 } ,
/*0x0F5*/ { "NtSetTimerResolution" , 3 } ,
/*0x0F6*/ { "NtSetUuidSeed" , 1 } ,
/*0x0F7*/ { "NtSetValueKey" , 6 } ,
/*0x0F8*/ { "NtSetVolumeInformationFile" , 5 } ,
/*0x0F9*/ { "NtShutdownSystem" , 1 } ,
/*0x0FA*/ { "NtSignalAndWaitForSingleObject" , 4 } ,
/*0x0FB*/ { "NtStartProfile" , 1 } ,
/*0x0FC*/ { "NtStopProfile" , 1 } ,
/*0x0FD*/ { "NtSuspendProcess" , 1 } ,
/*0x0FE*/ { "NtSuspendThread" , 2 } ,
/*0x0FF*/ { "NtSystemDebugControl" , 6 } ,
/*0x100*/ { "NtTerminateJobObject" , 2 } ,
/*0x101*/ { "NtTerminateProcess" , 2 } ,
/*0x102*/ { "NtTerminateThread" , 2 } ,
/*0x103*/ { "NtTestAlert" , 0 } ,
/*0x104*/ { "NtTraceEvent" , 4 } ,
/*0x105*/ { "NtTranslateFilePath" , 4 } ,
/*0x106*/ { "NtUnloadDriver" , 1 } ,
/*0x107*/ { "NtUnloadKey" , 1 } ,
/*0x108*/ { "NtUnloadKeyEx" , 2 } ,
/*0x109*/ { "NtUnlockFile" , 5 } ,
/*0x10A*/ { "NtUnlockVirtualMemory" , 4 } ,
/*0x10B*/ { "NtUnmapViewOfSection" , 2 } ,
/*0x10C*/ { "NtVdmControl" , 2 } ,
/*0x10D*/ { "NtWaitForDebugEvent" , 4 } ,
/*0x10E*/ { "NtWaitForMultipleObjects" , 5 } ,
/*0x10F*/ { "NtWaitForSingleObject" , 3 } ,
/*0x110*/ { "NtWaitHighEventPair" , 1 } ,
/*0x111*/ { "NtWaitLowEventPair" , 1 } ,
/*0x112*/ { "NtWriteFile" , 9 } ,
/*0x113*/ { "NtWriteFileGather" , 9 } ,
/*0x114*/ { "NtWriteRequestData" , 6 } ,
/*0x115*/ { "NtWriteVirtualMemory" , 5 } ,
/*0x116*/ { "NtYieldExecution" , 0 } ,
/*0x117*/ { "NtCreateKeyedEvent" , 4 } ,
/*0x118*/ { "NtOpenKeyedEvent" , 3 } ,
/*0x119*/ { "NtReleaseKeyedEvent" , 4 } ,
/*0x11A*/ { "NtWaitForKeyedEvent" , 4 } ,
/*0x11B*/ { "NtQueryPortInformationProcess" , 0 }
};
// ssdt table for 5.1.2600-sp3-windows-xp i386
SDT_NODE static_ssdt_5_1_2600_sp3_windows_xp_i386[284] = {
/*0x000*/ { "NtAcceptConnectPort" , 6 } ,
/*0x001*/ { "NtAccessCheck" , 8 } ,
/*0x002*/ { "NtAccessCheckAndAuditAlarm" , 11 } ,
/*0x003*/ { "NtAccessCheckByType" , 11 } ,
/*0x004*/ { "NtAccessCheckByTypeAndAuditAlarm" , 16 } ,
/*0x005*/ { "NtAccessCheckByTypeResultList" , 11 } ,
/*0x006*/ { "NtAccessCheckByTypeResultListAndAuditAlarm" , 16 } ,
/*0x007*/ { "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" , 17 } ,
/*0x008*/ { "NtAddAtom" , 3 } ,
/*0x009*/ { "NtAddBootEntry" , 2 } ,
/*0x00A*/ { "NtAdjustGroupsToken" , 6 } ,
/*0x00B*/ { "NtAdjustPrivilegesToken" , 6 } ,
/*0x00C*/ { "NtAlertResumeThread" , 2 } ,
/*0x00D*/ { "NtAlertThread" , 1 } ,
/*0x00E*/ { "NtAllocateLocallyUniqueId" , 1 } ,
/*0x00F*/ { "NtAllocateUserPhysicalPages" , 3 } ,
/*0x010*/ { "NtAllocateUuids" , 4 } ,
/*0x011*/ { "NtAllocateVirtualMemory" , 6 } ,
/*0x012*/ { "NtAreMappedFilesTheSame" , 2 } ,
/*0x013*/ { "NtAssignProcessToJobObject" , 2 } ,
/*0x014*/ { "NtCallbackReturn" , 3 } ,
/*0x015*/ { "NtCancelDeviceWakeupRequest" , 1 } ,
/*0x016*/ { "NtCancelIoFile" , 2 } ,
/*0x017*/ { "NtCancelTimer" , 2 } ,
/*0x018*/ { "NtClearEvent" , 1 } ,
/*0x019*/ { "NtClose" , 1 } ,
/*0x01A*/ { "NtCloseObjectAuditAlarm" , 3 } ,
/*0x01B*/ { "NtCompactKeys" , 2 } ,
/*0x01C*/ { "NtCompareTokens" , 3 } ,
/*0x01D*/ { "NtCompleteConnectPort" , 1 } ,
/*0x01E*/ { "NtCompressKey" , 1 } ,
/*0x01F*/ { "NtConnectPort" , 8 } ,
/*0x020*/ { "NtContinue" , 2 } ,
/*0x021*/ { "NtCreateDebugObject" , 4 } ,
/*0x022*/ { "NtCreateDirectoryObject" , 3 } ,
/*0x023*/ { "NtCreateEvent" , 5 } ,
/*0x024*/ { "NtCreateEventPair" , 3 } ,
/*0x025*/ { "NtCreateFile" , 11 } ,
/*0x026*/ { "NtCreateIoCompletion" , 4 } ,
/*0x027*/ { "NtCreateJobObject" , 3 } ,
/*0x028*/ { "NtCreateJobSet" , 3 } ,
/*0x029*/ { "NtCreateKey" , 7 } ,
/*0x02A*/ { "NtCreateMailslotFile" , 8 } ,
/*0x02B*/ { "NtCreateMutant" , 4 } ,
/*0x02C*/ { "NtCreateNamedPipeFile" , 14 } ,
/*0x02D*/ { "NtCreatePagingFile" , 4 } ,
/*0x02E*/ { "NtCreatePort" , 5 } ,
/*0x02F*/ { "NtCreateProcess" , 8 } ,
/*0x030*/ { "NtCreateProcessEx" , 9 } ,
/*0x031*/ { "NtCreateProfile" , 9 } ,
/*0x032*/ { "NtCreateSection" , 7 } ,
/*0x033*/ { "NtCreateSemaphore" , 5 } ,
/*0x034*/ { "NtCreateSymbolicLinkObject" , 4 } ,
/*0x035*/ { "NtCreateThread" , 8 } ,
/*0x036*/ { "NtCreateTimer" , 4 } ,
/*0x037*/ { "NtCreateToken" , 13 } ,
/*0x038*/ { "NtCreateWaitablePort" , 5 } ,
/*0x039*/ { "NtDebugActiveProcess" , 2 } ,
/*0x03A*/ { "NtDebugContinue" , 3 } ,
/*0x03B*/ { "NtDelayExecution" , 2 } ,
/*0x03C*/ { "NtDeleteAtom" , 1 } ,
/*0x03D*/ { "NtDeleteBootEntry" , 1 } ,
/*0x03E*/ { "NtDeleteFile" , 1 } ,
/*0x03F*/ { "NtDeleteKey" , 1 } ,
/*0x040*/ { "NtDeleteObjectAuditAlarm" , 3 } ,
/*0x041*/ { "NtDeleteValueKey" , 2 } ,
/*0x042*/ { "NtDeviceIoControlFile" , 10 } ,
/*0x043*/ { "NtDisplayString" , 1 } ,
/*0x044*/ { "NtDuplicateObject" , 7 } ,
/*0x045*/ { "NtDuplicateToken" , 6 } ,
/*0x046*/ { "NtEnumerateBootEntries" , 2 } ,
/*0x047*/ { "NtEnumerateKey" , 6 } ,
/*0x048*/ { "NtEnumerateSystemEnvironmentValuesEx" , 3 } ,
/*0x049*/ { "NtEnumerateValueKey" , 6 } ,
/*0x04A*/ { "NtExtendSection" , 2 } ,
/*0x04B*/ { "NtFilterToken" , 6 } ,
/*0x04C*/ { "NtFindAtom" , 3 } ,
/*0x04D*/ { "NtFlushBuffersFile" , 2 } ,
/*0x04E*/ { "NtFlushInstructionCache" , 3 } ,
/*0x04F*/ { "NtFlushKey" , 1 } ,
/*0x050*/ { "NtFlushVirtualMemory" , 4 } ,
/*0x051*/ { "NtFlushWriteBuffer" , 0 } ,
/*0x052*/ { "NtFreeUserPhysicalPages" , 3 } ,
/*0x053*/ { "NtFreeVirtualMemory" , 4 } ,
/*0x054*/ { "NtFsControlFile" , 10 } ,
/*0x055*/ { "NtGetContextThread" , 2 } ,
/*0x056*/ { "NtGetDevicePowerState" , 2 } ,
/*0x057*/ { "NtGetPlugPlayEvent" , 4 } ,
/*0x058*/ { "NtGetWriteWatch" , 7 } ,
/*0x059*/ { "NtImpersonateAnonymousToken" , 1 } ,
/*0x05A*/ { "NtImpersonateClientOfPort" , 2 } ,
/*0x05B*/ { "NtImpersonateThread" , 3 } ,
/*0x05C*/ { "NtInitializeRegistry" , 1 } ,
/*0x05D*/ { "NtInitiatePowerAction" , 4 } ,
/*0x05E*/ { "NtIsProcessInJob" , 2 } ,
/*0x05F*/ { "NtIsSystemResumeAutomatic" , 0 } ,
/*0x060*/ { "NtListenPort" , 2 } ,
/*0x061*/ { "NtLoadDriver" , 1 } ,
/*0x062*/ { "NtLoadKey" , 2 } ,
/*0x063*/ { "NtLoadKey2" , 3 } ,
/*0x064*/ { "NtLockFile" , 10 } ,
/*0x065*/ { "NtLockProductActivationKeys" , 2 } ,
/*0x066*/ { "NtLockRegistryKey" , 1 } ,
/*0x067*/ { "NtLockVirtualMemory" , 4 } ,
/*0x068*/ { "NtMakePermanentObject" , 1 } ,
/*0x069*/ { "NtMakeTemporaryObject" , 1 } ,
/*0x06A*/ { "NtMapUserPhysicalPages" , 3 } ,
/*0x06B*/ { "NtMapUserPhysicalPagesScatter" , 3 } ,
/*0x06C*/ { "NtMapViewOfSection" , 10 } ,
/*0x06D*/ { "NtModifyBootEntry" , 1 } ,
/*0x06E*/ { "NtNotifyChangeDirectoryFile" , 9 } ,
/*0x06F*/ { "NtNotifyChangeKey" , 10 } ,
/*0x070*/ { "NtNotifyChangeMultipleKeys" , 12 } ,
/*0x071*/ { "NtOpenDirectoryObject" , 3 } ,
/*0x072*/ { "NtOpenEvent" , 3 } ,
/*0x073*/ { "NtOpenEventPair" , 3 } ,
/*0x074*/ { "NtOpenFile" , 6 } ,
/*0x075*/ { "NtOpenIoCompletion" , 3 } ,
/*0x076*/ { "NtOpenJobObject" , 3 } ,
/*0x077*/ { "NtOpenKey" , 3 } ,
/*0x078*/ { "NtOpenMutant" , 3 } ,
/*0x079*/ { "NtOpenObjectAuditAlarm" , 12 } ,