├── H_APIs.h ├── README.md ├── gen_H_APIs.py ├── ntgdi_reactos.h ├── ntuser_reactos.h ├── ntuser_w2k.h ├── output_win7_sp1 ├── gdi32_x86.txt ├── ntdll_x64.txt ├── ntdll_x86.txt ├── user32_x64.txt └── user32_x86.txt └── syscalls.py /H_APIs.h: -------------------------------------------------------------------------------- 1 | BOOL NtUserSetKeyboardState(PBYTE);//1 2 | DWORD NtGdiDvpColorControl(HANDLE,OUT PDD_VPORTCOLORDATA);//2 3 | NTSTATUS NtUserCreateLocalMemHandle(HANDLE,OUT PBYTE,UINT,OUT PUINT);//4 4 | NTSTATUS NtGdiSetUMPDSandboxState(BOOL);//1 5 | BOOL NtGdiSetColorAdjustment(HDC,PCOLORADJUSTMENT);//2 6 | BOOL NtGdiForceUFIMapping(HDC,PUNIVERSAL_FONT_ID);//2 7 | HWND NtUserGetForegroundWindow(VOID);//0 8 | BOOL NtGdiDwmCreatedBitmapRemotingOutput(VOID);//0 9 | DWORD NtGdiDdCanCreateSurface(HANDLE,OUT PDD_CANCREATESURFACEDATA);//2 10 | BOOL NtGdiEngPlgBlt(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,COLORADJUSTMENT*,PPOINTL,POINTFIX*,LPRECTL,PPOINTL,ULONG);//11 11 | BOOL NtGdiRemoveFontResourceW(PWCHAR,ULONG,ULONG,ULONG,DWORD,DESIGNVECTOR*);//6 12 | BOOL NtGdiIcmBrushInfo(HDC,HBRUSH,PBITMAPINFO,PVOID,OUT PULONG,OUT PDWORD,OUT PBOOL,ULONG);//8 13 | BOOL NtUserQuerySendMessage(OUT LPMSG);//1 14 | DWORD NtGdiSetBoundsRect(HDC,LPRECT,DWORD);//3 15 | BOOL NtUserDestroyCursor(HCURSOR,DWORD);//2 16 | BOOL NtUserRealWaitMessageEx(DWORD,UINT);//2 17 | UINT NtUserHardErrorControl(HARDERRORCONTROL,HANDLE,OUT PDESKRESTOREDATA);//3 18 | BOOL NtGdiGetBitmapDimension(HBITMAP,OUT LPSIZE);//2 19 | BOOL NtGdiEndGdiRendering(HBITMAP,BOOL,OUT PBOOL,PVOID);//4 20 | DWORD NtGdiDdUnlock(HANDLE,OUT PDD_UNLOCKDATA);//2 21 | LONG NtGdiHT_Get8BPPMaskPalette(OUT LPPALETTEENTRY,BOOL,BYTE,USHORT,USHORT,USHORT);//6 22 | BOOL NtGdiEngAlphaBlend(SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,LPRECTL,BLENDOBJ*);//7 23 | INT NtGdiGetTextFaceW(HDC,INT,PWSTR,BOOL);//4 24 | BOOL NtGdiAddRemoteMMInstanceToDC(HDC,DOWNLOADDESIGNVECTOR*,ULONG);//3 25 | BOOL NtGdiCheckBitmapBits(HDC,HANDLE,PVOID,ULONG,DWORD,DWORD,DWORD,PBYTE);//8 26 | BOOL NtUserCloseWindowStation(HWINSTA);//1 27 | DWORD NtGdiGetCharacterPlacementW(HDC,PWSTR,INT,INT,OUT LPGCP_RESULTSW,DWORD);//6 28 | BOOL NtUserWaitForMsgAndEvent(HANDLE);//1 29 | BOOL NtUserCheckWindowThreadDesktop(HWND,DWORD,ULONG);//3 30 | HBITMAP NtGdiCreateSessionMappedDIBSection(HDC,HANDLE,DWORD,LPBITMAPINFO,DWORD,UINT,FLONG,ULONG_PTR);//8 31 | HANDLE NtGdiGetStockObject(INT);//1 32 | UINT NtUserGetDoubleClickTime(VOID);//0 33 | BOOL NtGdiStrokePath(HDC);//1 34 | BOOL NtUserSystemParametersInfo(UINT,DWORD,OUT PVOID,UINT);//4 35 | DWORD NtGdiDdBlt(HANDLE,HANDLE,OUT PDD_BLTDATA);//3 36 | BOOL NtGdiSwapBuffers(HDC);//1 37 | LONG NtUserSetWindowLong(HWND,INT,LONG,BOOL);//4 38 | BOOL NtGdiChangeGhostFont(KERNEL_PVOID*,BOOL);//2 39 | VOID NtUserModifyUserStartupInfoFlags(DWORD,DWORD);//2 40 | BOOL NtUserFillWindow(HWND,HWND,HDC,HBRUSH);//4 41 | BOOL NtGdiGetUFIPathname(PUNIVERSAL_FONT_ID,PULONG,PWSTR,OUT PULONG,FLONG,OUT PBOOL,OUT PULONG,OUT PVOID,OUT PBOOL,OUT PULONG);//10 42 | BOOL NtUserUnregisterUserApiHook(VOID);//0 43 | HWND NtUserWindowFromPoint(LONG,LONG);//2 44 | NTSTATUS NtUserBuildHwndList(HDESK,HWND,BOOL,DWORD,UINT,OUT HWND*,OUT PUINT);//7 45 | UINT NtGdiSetSystemPaletteUse(HDC,UINT);//2 46 | BOOL NtUserSetLogonNotifyWindow(HWND);//1 47 | BOOL NtUserUnlockWindowStation(HWINSTA);//1 48 | INT NtGdiExcludeClipRect(HDC,INT,INT,INT,INT);//5 49 | HANDLE NtGdiDvpCreateVideoPort(HANDLE,OUT PDD_CREATEVPORTDATA);//2 50 | BOOL NtUserUpdatePerUserSystemParameters(HANDLE,BOOL);//2 51 | BOOL NtUserSetClipboardData(UINT,HANDLE,PSETCLIPBDATA);//3 52 | BOOL NtUserMNDragOver(LPPOINT,OUT PMNDRAGOVERINFO);//2 53 | DHPDEV NtGdiGetDhpdev(HDEV);//1 54 | DWORD_PTR NtUserCallTwoParam(DWORD_PTR,DWORD_PTR,DWORD);//3 55 | HBITMAP NtGdiCreateBitmapFromDxSurface(HDC,UINT,UINT,DWORD,HANDLE);//5 56 | BOOL NtUserScrollWindowEx(HWND,INT,INT,LPRECT,LPRECT,HRGN,OUT LPRECT,UINT);//8 57 | BOOL NtGdiGetEmbUFI(HDC,OUT PUNIVERSAL_FONT_ID,OUT DESIGNVECTOR*,OUT PULONG,OUT PULONG,OUT FLONG*,OUT KERNEL_PVOID*);//7 58 | WORD NtUserSetClassWord(HWND,INT,WORD);//3 59 | NTSTATUS NtGdiDdUnattachSurface(HANDLE,HANDLE);//2 60 | BOOL NtUserDrawCaptionTemp(HWND,HDC,LPCRECT,HFONT,HICON,PUNICODE_STRING,UINT);//7 61 | BOOL NtGdiExtFloodFill(HDC,INT,INT,COLORREF,UINT);//5 62 | BOOL NtUserThunkedMenuItemInfo(HMENU,UINT,BOOL,BOOL,LPMENUITEMINFOW,PUNICODE_STRING);//6 63 | UINT NtUserSendInput(UINT,INPUT*,INT);//3 64 | BOOL NtGdiTransparentBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,INT,INT,COLORREF);//11 65 | HDC NtUserBeginPaint(HWND,OUT LPPAINTSTRUCT);//2 66 | HPEN NtGdiSelectPen(HDC,HPEN);//2 67 | HANDLE NtGdiDdGetDxHandle(HANDLE,HANDLE,BOOL);//3 68 | HPEN NtGdiCreatePen(INT,INT,COLORREF,HBRUSH);//4 69 | HWND NtUserGetOpenClipboardWindow(VOID);//0 70 | BOOL NtUserSetInternalWindowPos(HWND,UINT,LPRECT,LPPOINT);//4 71 | BOOL NtGdiInvertRgn(HDC,HRGN);//2 72 | INT NtGdiGetAppClipBox(HDC,OUT LPRECT);//2 73 | BOOL NtGdiGetCharWidthW(HDC,UINT,UINT,PWCHAR,FLONG,PVOID);//6 74 | BOOL NtGdiDdQueryDirectDrawObject(HANDLE,OUT PDD_HALINFO,PDWORD,OUT LPD3DNTHAL_CALLBACKS,OUT LPD3DNTHAL_GLOBALDRIVERDATA,OUT PDD_D3DBUFCALLBACKS,OUT LPDDSURFACEDESC,OUT PDWORD,OUT VIDEOMEMORY*,OUT PDWORD,OUT PDWORD);//11 75 | LONG NtGdiGetDeviceWidth(HDC);//1 76 | BOOL NtGdiSetDeviceGammaRamp(HDC,PVOID);//2 77 | DWORD NtGdiDdGetMoCompFormats(HANDLE,OUT PDD_GETMOCOMPFORMATSDATA);//2 78 | BOOL NtUserUnloadKeyboardLayout(HKL);//1 79 | BOOL NtGdiSetMagicColors(HDC,PALETTEENTRY,ULONG);//3 80 | DWORD NtGdiDdSetExclusiveMode(HANDLE,OUT PDD_SETEXCLUSIVEMODEDATA);//2 81 | HBRUSH NtGdiCreateSolidBrush(COLORREF,HBRUSH);//2 82 | HPEN NtGdiExtCreatePen(ULONG,ULONG,ULONG,ULONG,ULONG_PTR,ULONG_PTR,ULONG,PULONG,ULONG,BOOL,HBRUSH);//11 83 | BOOL NtUserSetCursorContents(HCURSOR,HCURSOR);//2 84 | HDC NtGdiOpenDCW(PUNICODE_STRING,DEVMODEW*,PUNICODE_STRING,ULONG,BOOL,HANDLE,PVOID);//7 85 | BOOL NtGdiMoveTo(HDC,INT,INT,OUT LPPOINT);//4 86 | BOOL NtGdiPATHOBJ_bEnumClipLines(PATHOBJ*,ULONG,CLIPLINE*);//3 87 | BOOL NtGdiDwmGetHighColorMode(OUT DXGI_FORMAT*);//1 88 | BOOL NtGdiStrokeAndFillPath(HDC);//1 89 | DWORD_PTR NtUserCallNoParam(DWORD);//1 90 | BOOL NtGdiGetAndSetDCDword(HDC,UINT,DWORD,OUT PDWORD);//4 91 | INT NtGdiGetRandomRgn(HDC,HRGN,INT);//3 92 | INT NtGdiSetMetaRgn(HDC);//1 93 | HBRUSH NtUserGetControlColor(HWND,HWND,HDC,UINT);//4 94 | INT NtGdiGetRgnBox(HRGN,OUT LPRECT);//2 95 | DWORD NtGdiDdGetBltStatus(HANDLE,OUT PDD_GETBLTSTATUSDATA);//2 96 | HBRUSH NtGdiCreateDIBBrush(PVOID,FLONG,UINT,BOOL,BOOL,PVOID);//6 97 | UINT NtUserGetInternalWindowPos(HWND,OUT LPRECT,OUT LPPOINT);//3 98 | INT NtUserCopyAcceleratorTable(HACCEL,OUT LPACCEL,INT);//3 99 | HBITMAP NtGdiCreateDIBitmapInternal(HDC,INT,INT,DWORD,PBYTE,LPBITMAPINFO,DWORD,UINT,UINT,FLONG,HANDLE);//11 100 | BOOL NtGdiEudcLoadUnloadLink(PCWSTR,UINT,PCWSTR,UINT,INT,INT,BOOL);//7 101 | ULONG_PTR NtUserGetThreadState(USERTHREADSTATECLASS);//1 102 | BOOL NtGdiMaskBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,HBITMAP,INT,INT,DWORD,DWORD);//13 103 | BOOL NtGdiEqualRgn(HRGN,HRGN);//2 104 | DWORD NtGdiDdGetMoCompBuffInfo(HANDLE,OUT PDD_GETMOCOMPCOMPBUFFDATA);//2 105 | BOOL NtUserGetMenuBarInfo(HWND,long,long,OUT PMENUBARINFO);//4 106 | BOOL NtGdiMakeObjectXferable(HANDLE,DWORD);//2 107 | BOOL NtGdiEndPath(HDC);//1 108 | NTSTATUS NtUserRemoteRedrawScreen(VOID);//0 109 | LONG NtUserChangeDisplaySettings(PUNICODE_STRING,LPDEVMODEW,DWORD,PVOID);//4 110 | INT NtGdiExtGetObjectW(HANDLE,INT,PVOID);//3 111 | BOOL NtUserSendMessageCallback(HWND,UINT,WPARAM,LPARAM,SENDASYNCPROC,ULONG_PTR);//6 112 | HMONITOR NtUserMonitorFromPoint(POINT,DWORD);//2 113 | BOOL NtGdiSetRectRgn(HRGN,INT,INT,INT,INT);//5 114 | HWND NtUserSetActiveWindow(HWND);//1 115 | HANDLE NtGdiDwmCaptureScreen(LPRECT,DXGI_FORMAT);//2 116 | BOOL NtGdiSetColorSpace(HDC,HCOLORSPACE);//2 117 | BOOL NtUserGetIconSize(HICON,UINT,OUT PINT,OUT PINT);//4 118 | BOOL NtUserShowScrollBar(HWND,INT,BOOL);//3 119 | BOOL NtGdiUpdateTransform(HDC);//1 120 | BOOL NtGdiResetDC(HDC,LPDEVMODEW,OUT PBOOL,DRIVER_INFO_2W*,PVOID);//5 121 | BOOL NtUserGetCursorInfo(OUT LPCURSORINFO);//1 122 | DWORD NtGdiDdGetMoCompGuids(HANDLE,OUT PDD_GETMOCOMPGUIDSDATA);//2 123 | NTSTATUS NtUserSetInformationThread(HANDLE,USERTHREADINFOCLASS,PVOID,ULONG);//4 124 | HDESK NtUserResolveDesktop(HANDLE,PUNICODE_STRING,BOOL,OUT HWINSTA*);//4 125 | SHORT NtUserGetAsyncKeyState(INT);//1 126 | DWORD NtUserCallHwnd(HWND,DWORD);//2 127 | HBITMAP NtGdiSelectBitmap(HDC,HBITMAP);//2 128 | DWORD NtGdiGetBoundsRect(HDC,OUT LPRECT,DWORD);//3 129 | NTSTATUS NtGdiFlush(VOID);//0 130 | BOOL NtGdiSetBrushOrg(HDC,INT,INT,OUT LPPOINT);//4 131 | DWORD NtGdiD3dValidateTextureStageState(OUT LPD3DNTHAL_VALIDATETEXTURESTAGESTATEDATA);//1 132 | HBITMAP NtGdiCreateDIBSection(HDC,HANDLE,DWORD,LPBITMAPINFO,DWORD,UINT,FLONG,ULONG_PTR,OUT PVOID*);//9 133 | DWORD NtGdiDdSetOverlayPosition(HANDLE,HANDLE,OUT PDD_SETOVERLAYPOSITIONDATA);//3 134 | PVOID NtGdiBRUSHOBJ_pvGetRbrush(BRUSHOBJ*);//1 135 | BOOL NtUserSetMenuDefaultItem(HMENU,UINT,UINT);//3 136 | BOOL NtGdiFillPath(HDC);//1 137 | BOOL NtGdiPtVisible(HDC,INT,INT);//3 138 | HDC NtGdiGetDCforBitmap(HBITMAP);//1 139 | DWORD NtGdiDdLockD3D(HANDLE,OUT PDD_LOCKDATA);//2 140 | BOOL NtGdiGetRealizationInfo(HDC,OUT PFONT_REALIZATION_INFO);//2 141 | BOOL NtUserSendNotifyMessage(HWND,UINT,WPARAM,LPARAM);//4 142 | BOOL NtGdiUpdateColors(HDC);//1 143 | DWORD NtGdiDvpGetVideoPortConnectInfo(HANDLE,OUT PDD_GETVPORTCONNECTDATA);//2 144 | BOOL NtGdiGradientFill(HDC,PTRIVERTEX,ULONG,PVOID,ULONG,ULONG);//6 145 | BOOL NtGdiDeleteClientObj(HANDLE);//1 146 | HWND NtUserCallHwndOpt(HWND,DWORD);//2 147 | BOOL NtUserRedrawWindow(HWND,LPRECT,HRGN,UINT);//4 148 | DWORD NtGdiDdGetFlipStatus(HANDLE,OUT PDD_GETFLIPSTATUSDATA);//2 149 | LONG NtUserSetClassLong(HWND,INT,LONG,BOOL);//4 150 | DWORD NtUserUpdateInstance(HANDLE,OUT PDWORD,DWORD);//3 151 | BOOL NtGdiAddRemoteFontToDC(HDC,PVOID,ULONG,PUNIVERSAL_FONT_ID);//4 152 | NTSTATUS NtUserBuildPropList(HWND,UINT,OUT PPROPSET,OUT PUINT);//4 153 | DWORD NtUserCheckMenuItem(HMENU,UINT,UINT);//3 154 | BOOL NtGdiD3dContextCreate(HANDLE,HANDLE,HANDLE,OUT D3DNTHAL_CONTEXTCREATEI*);//4 155 | BOOL NtGdiCancelDC(HDC);//1 156 | BOOL NtGdiHLSurfGetInformation(HLSURF,HLSURF_INFORMATION_CLASS,PVOID,OUT PULONG);//4 157 | HMONITOR NtUserMonitorFromRect(LPCRECT,DWORD);//2 158 | BOOL NtUserValidateTimerCallback(LPARAM);//1 159 | ULONG NtGdiXLATEOBJ_cGetPalette(XLATEOBJ*,ULONG,ULONG,PULONG);//4 160 | DWORD NtGdiDdGetInternalMoCompInfo(HANDLE,OUT PDD_GETINTERNALMOCOMPDATA);//2 161 | NTSTATUS NtUserEnumDisplayDevices(PUNICODE_STRING,DWORD,OUT LPDISPLAY_DEVICEW,DWORD);//4 162 | BOOL NtUserCheckDesktopByThreadId(DWORD);//1 163 | BOOL NtGdiBitBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,DWORD,DWORD,FLONG);//11 164 | BOOL NtUserSetWindowPos(HWND,HWND,INT,INT,INT,INT,UINT);//7 165 | INT NtGdiExtEscape(HDC,PWCHAR,INT,INT,INT,PSTR,INT,PSTR);//8 166 | BOOL NtGdiDdAttachSurface(HANDLE,HANDLE);//2 167 | BOOL NtUserSetConsoleReserveKeys(HWND,DWORD);//2 168 | BOOL NtUserUnhookWinEvent(HWINEVENTHOOK);//1 169 | HWND NtUserSetParent(HWND,HWND);//2 170 | NTSTATUS NtGdiPATHOBJ_vEnumStartClipLines(PATHOBJ*,CLIPOBJ*,SURFOBJ*,LINEATTRS*);//4 171 | BOOL NtUserSBGetParms(HWND,INT,PSBDATA,OUT LPSCROLLINFO);//4 172 | BOOL NtUserInvalidateRect(HWND,LPRECT,BOOL);//3 173 | DWORD NtGdiDdBeginMoCompFrame(HANDLE,OUT PDD_BEGINMOCOMPFRAMEDATA);//2 174 | BOOL NtUserSetMenu(HWND,HMENU,BOOL);//3 175 | LRESULT NtUserMessageCall(HWND,UINT,WPARAM,LPARAM,ULONG_PTR,DWORD,BOOL);//7 176 | DWORD NtGdiGetCharSet(HDC);//1 177 | HRGN NtGdiPathToRegion(HDC);//1 178 | BOOL NtGdiDeleteObjectApp(HANDLE);//1 179 | BOOL NtGdiSetSizeDevice(HDC,INT,INT);//3 180 | BOOL NtUserGetComboBoxInfo(HWND,OUT LPCOMBOBOXINFO);//2 181 | INT NtGdiExtSelectClipRgn(HDC,HRGN,INT);//3 182 | INT NtUserGetPriorityClipboardFormat(OUT PUINT,INT);//2 183 | BOOL NtGdiGetColorAdjustment(HDC,OUT PCOLORADJUSTMENT);//2 184 | BOOL NtGdiFillRgn(HDC,HRGN,HBRUSH);//3 185 | DWORD NtGdiDvpGetVideoPortInputFormats(HANDLE,OUT PDD_GETVPORTINPUTFORMATDATA);//2 186 | ULONG NtGdiSetFontEnumeration(ULONG);//1 187 | BOOL NtUserCloseDesktop(HDESK);//1 188 | HPALETTE NtGdiCreateHalftonePalette(HDC);//1 189 | PFD_GLYPHATTR NtGdiFONTOBJ_pQueryGlyphAttrs(FONTOBJ*,ULONG);//2 190 | BOOL NtUserChangeClipboardChain(HWND,HWND);//2 191 | BOOL NtGdiEngStretchBltROP(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,COLORADJUSTMENT*,PPOINTL,LPRECTL,LPRECTL,PPOINTL,ULONG,BRUSHOBJ*,ROP4);//13 192 | BOOL NtGdiComputeXformCoefficients(HDC);//1 193 | HANDLE NtGdiCreateColorTransform(HDC,LPLOGCOLORSPACEW,PVOID,ULONG,PVOID,ULONG,PVOID,ULONG);//8 194 | HANDLE NtGdiCreateColorSpace(PLOGCOLORSPACEEXW);//1 195 | HANDLE NtGdiCreateServerMetaFile(DWORD,ULONG,PBYTE,DWORD,DWORD,DWORD);//6 196 | DWORD NtGdiDdGetScanLine(HANDLE,OUT PDD_GETSCANLINEDATA);//2 197 | HWND NtUserRealChildWindowFromPoint(HWND,LONG,LONG);//3 198 | HBITMAP NtGdiCreateBitmap(INT,INT,UINT,UINT,PBYTE);//5 199 | COLORREF NtGdiSetPixel(HDC,INT,INT,COLORREF);//4 200 | NTSTATUS NtGdiFullscreenControl(FULLSCREENCONTROL,PVOID,DWORD,OUT PVOID,OUT PULONG);//5 201 | BOOL NtUserDdeSetQualityOfService(HWND,SECURITY_QUALITY_OF_SERVICE*,OUT PSECURITY_QUALITY_OF_SERVICE);//3 202 | BOOL NtGdiEngBitBlt(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,PPOINTL,PPOINTL,BRUSHOBJ*,PPOINTL,ROP4);//11 203 | BOOL NtUserValidateRect(HWND,LPRECT);//2 204 | BOOL NtGdiInit(VOID);//0 205 | BOOL NtGdiGetFontResourceInfoInternalW(PWSTR,ULONG,ULONG,UINT,OUT PDWORD,PVOID,DWORD);//7 206 | BOOL NtUserSetWindowPlacement(HWND,LPWINDOWPLACEMENT);//2 207 | BOOL NtUserWin32PoolAllocationStats(PDWORD,SIZE_T,OUT SIZE_T*,OUT SIZE_T*,OUT PDWORD,OUT PDWORD);//6 208 | BOOL NtGdiDwmSetHighColorMode(DXGI_FORMAT);//1 209 | BOOL NtGdiGetTextExtent(HDC,PWSTR,INT,OUT LPSIZE,UINT);//5 210 | INT NtGdiQueryFonts(PUNIVERSAL_FONT_ID,ULONG,OUT PLARGE_INTEGER);//3 211 | BOOL NtGdiRemoveMergeFont(HDC,UNIVERSAL_FONT_ID*);//2 212 | BOOL NtGdiAngleArc(HDC,INT,INT,DWORD,DWORD,DWORD);//6 213 | INT NtGdiStretchDIBitsInternal(HDC,INT,INT,INT,INT,INT,INT,INT,INT,PBYTE,LPBITMAPINFO,DWORD,DWORD,UINT,UINT,HANDLE);//16 214 | BOOL NtGdiPATHOBJ_bEnum(PATHOBJ*,OUT PATHDATA*);//2 215 | NTSTATUS NtUserCtxDisplayIOCtl(ULONG,PUCHAR,ULONG);//3 216 | HBITMAP NtGdiSetBitmapAttributes(HBITMAP,DWORD);//2 217 | HWINSTA NtUserCreateWindowStation(POBJECT_ATTRIBUTES,ACCESS_MASK,HANDLE,DWORD,PUNICODE_STRING,UINT);//6 218 | FD_GLYPHSET* NtGdiFONTOBJ_pfdg(FONTOBJ*);//1 219 | HPALETTE NtUserSelectPalette(HDC,HPALETTE,BOOL);//3 220 | BOOL NtGdiDeleteColorSpace(HANDLE);//1 221 | DWORD NtGdiDvpGetVideoPortLine(HANDLE,OUT PDD_GETVPORTLINEDATA);//2 222 | BOOL NtGdiRectInRegion(HRGN,OUT LPRECT);//2 223 | BOOL NtUserUnregisterClass(PUNICODE_STRING,HINSTANCE,OUT PCLSMENUNAME);//3 224 | BOOL NtGdiDoBanding(HDC,BOOL,OUT PPOINTL,OUT LPSIZE);//4 225 | ULONG_PTR NtGdiEnumFontOpen(HDC,ULONG,FLONG,ULONG,PWSTR,ULONG,OUT PULONG);//7 226 | BOOL NtUserTrackMouseEvent(OUT LPTRACKMOUSEEVENT);//1 227 | NTSTATUS NtGdiPATHOBJ_vEnumStart(PATHOBJ*);//1 228 | HBITMAP NtGdiEngCreateBitmap(SIZEL,LONG,ULONG,FLONG,PVOID);//5 229 | DWORD NtGdiGetFontUnicodeRanges(HDC,OUT LPGLYPHSET);//2 230 | BOOL NtUserGetCaretPos(OUT LPPOINT);//1 231 | SHORT NtUserGetKeyState(INT);//1 232 | HANDLE NtGdiDdCreateMoComp(HANDLE,OUT PDD_CREATEMOCOMPDATA);//2 233 | DWORD NtGdiDdGetAvailDriverMemory(HANDLE,OUT PDD_GETAVAILDRIVERMEMORYDATA);//2 234 | UINT_PTR NtUserSetTimer(HWND,UINT_PTR,UINT,TIMERPROC);//4 235 | BOOL NtUserValidateHandleSecure(HANDLE);//1 236 | HANDLE NtGdiAddFontMemResourceEx(PVOID,DWORD,DESIGNVECTOR*,ULONG,OUT PDWORD);//5 237 | VOID RtlInitLargeAnsiString(OUT PLARGE_ANSI_STRING,PCSZ,INT);//3 238 | DWORD NtGdiDvpWaitForVideoPortSync(HANDLE,OUT PDD_WAITFORVPORTSYNCDATA);//2 239 | BOOL NtGdiWidenPath(HDC);//1 240 | BOOL NtUserSwitchDesktop(HDESK);//1 241 | INT NtUserEnumDisplayMonitors(HDC,LPCRECT,OUT HMONITOR*,OUT LPRECT,DWORD);//5 242 | BOOL NtGdiUnrealizeObject(HANDLE);//1 243 | UINT NtUserMapVirtualKeyEx(UINT,UINT,ULONG_PTR,BOOL);//4 244 | BOOL NtGdiEngDeletePalette(HPALETTE);//1 245 | DWORD NtGdiDdGetDriverState(OUT PDD_GETDRIVERSTATEDATA);//1 246 | HCURSOR NtUserGetCursorFrameInfo(HCURSOR,INT,OUT PDWORD,OUT PINT);//4 247 | DWORD NtUserGetMenuIndex(HMENU,HMENU);//2 248 | BOOL NtGdiSetIcmMode(HDC,ULONG,ULONG);//3 249 | HBRUSH NtGdiSelectBrush(HDC,HBRUSH);//2 250 | BOOL NtGdiGetTransform(HDC,DWORD,OUT LPXFORM);//3 251 | BOOL NtGdiSTROBJ_bEnumPositionsOnly(STROBJ*,OUT PULONG,PGLYPHPOS*);//3 252 | BOOL NtGdiRemoveFontMemResourceEx(HANDLE);//1 253 | BOOL NtGdiDdReleaseDC(HANDLE);//1 254 | BOOL NtGdiSetVirtualResolution(HDC,INT,INT,INT,INT);//5 255 | LONG NtGdiGetBitmapBits(HBITMAP,ULONG,PBYTE);//3 256 | BOOL NtUserRegisterTasklist(HWND);//1 257 | DWORD NtGdiDvpFlipVideoPort(HANDLE,HANDLE,HANDLE,OUT PDD_FLIPVPORTDATA);//4 258 | INT NtUserTranslateAccelerator(HWND,HACCEL,LPMSG);//3 259 | DWORD NtGdiDvpGetVideoPortField(HANDLE,OUT PDD_GETVPORTFIELDDATA);//2 260 | LONG NtGdiDoPalette(HGDIOBJ,WORD,WORD,PVOID,DWORD,BOOL);//6 261 | BOOL NtGdiStartPage(HDC);//1 262 | BOOL NtUserHideCaret(HWND);//1 263 | INT NtGdiGetDIBitsInternal(HDC,HBITMAP,UINT,UINT,PBYTE,OUT LPBITMAPINFO,UINT,UINT,UINT);//9 264 | BOOL NtUserGetWindowPlacement(HWND,OUT PWINDOWPLACEMENT);//2 265 | HHOOK NtUserSetWindowsHookEx(HANDLE,PUNICODE_STRING,DWORD,INT,PROC,DWORD);//6 266 | BOOL NtUserGetKeyboardLayoutName(OUT PUNICODE_STRING);//1 267 | BOOL NtUserUnregisterHotKey(HWND,INT);//2 268 | BOOL NtUserThunkedMenuInfo(HMENU,LPCMENUINFO);//2 269 | INT NtUserGetMouseMovePointsEx(UINT,MOUSEMOVEPOINT*,OUT MOUSEMOVEPOINT*,UINT,DWORD);//5 270 | BOOL NtUserWaitMessage(VOID);//0 271 | BOOL NtGdiEnumFontChunk(HDC,ULONG_PTR,ULONG,OUT PULONG,OUT PENUMFONTDATAW);//5 272 | BOOL NtGdiPtInRegion(HRGN,INT,INT);//3 273 | DWORD NtGdiDdAlphaBlt(HANDLE,HANDLE,OUT PDD_BLTDATA);//3 274 | BOOL NtGdiBeginPath(HDC);//1 275 | HANDLE NtUserDeferWindowPos(HDWP,HWND,HWND,INT,INT,INT,INT,UINT);//8 276 | DWORD NtUserGetKeyboardType(DWORD);//1 277 | BOOL NtGdiScaleViewportExtEx(HDC,INT,INT,INT,INT,OUT LPSIZE);//6 278 | HKL NtUserLoadKeyboardLayoutEx(HANDLE,DWORD,PUNICODE_STRING,HKL,PUNICODE_STRING,DWORD,UINT);//7 279 | DWORD NtGdiDvpGetVideoSignalStatus(HANDLE,OUT PDD_GETVPORTSIGNALDATA);//2 280 | BOOL NtUserDefSetText(HWND,PLARGE_STRING);//2 281 | INT NtGdiOffsetClipRgn(HDC,INT,INT);//3 282 | PATHOBJ* NtGdiCLIPOBJ_ppoGetPath(CLIPOBJ*);//1 283 | BOOL NtGdiEndPage(HDC);//1 284 | NTSTATUS NtUserRemoteStopScreenUpdates(VOID);//0 285 | BOOL NtUserCallMsgFilter(OUT LPMSG,INT);//2 286 | BOOL NtGdiAbortPath(HDC);//1 287 | DWORD NtGdiD3dDrawPrimitives2(HANDLE,HANDLE,OUT LPD3DNTHAL_DRAWPRIMITIVES2DATA,OUT FLATPTR*,OUT PDWORD,OUT FLATPTR*,OUT PDWORD);//7 288 | BOOL NtGdiEngMarkBandingSurface(HSURF);//1 289 | BOOL NtGdiAnyLinkedFonts(VOID);//0 290 | BOOL NtGdiSetTextJustification(HDC,INT,INT);//3 291 | DWORD NtGdiDdUnlockD3D(HANDLE,OUT PDD_UNLOCKDATA);//2 292 | BOOL NtGdiEngTextOut(SURFOBJ*,STROBJ*,FONTOBJ*,CLIPOBJ*,LPRECTL,LPRECTL,BRUSHOBJ*,BRUSHOBJ*,PPOINTL,MIX);//10 293 | BOOL NtUserQueryUserCounters(DWORD,PVOID,DWORD,OUT PVOID,DWORD);//5 294 | BOOL NtGdiSfmRegisterLogicalSurfaceForSignaling(HLSURF,BOOL);//2 295 | BOOL NtGdiEngCheckAbort(SURFOBJ*);//1 296 | DWORD NtGdiDvpUpdateVideoPort(HANDLE,HANDLE*,HANDLE*,OUT PDD_UPDATEVPORTDATA);//4 297 | HBITMAP NtGdiCreateBitmapFromDxSurface2(HDC,UINT,UINT,DWORD,DWORD,BOOL,HANDLE);//7 298 | ULONG NtGdiMakeFontDir(FLONG,PBYTE,UINT,PWSTR,UINT);//5 299 | BOOL NtGdiCombineTransform(OUT LPXFORM,LPXFORM,LPXFORM);//3 300 | BOOL NtGdiTransformPoints(HDC,LPPOINT,LPPOINT,INT,INT);//5 301 | DWORD NtUserDdeInitialize(OUT PHANDLE,OUT HWND*,OUT PDWORD,DWORD,PVOID);//5 302 | BOOL NtGdiExtTextOutW(HDC,INT,INT,UINT,LPRECT,PWSTR,INT,PINT,DWORD);//9 303 | HRGN NtGdiCreateEllipticRgn(INT,INT,INT,INT);//4 304 | HDC NtUserGetWindowDC(HWND);//1 305 | DWORD NtGdiDdEndMoCompFrame(HANDLE,OUT PDD_ENDMOCOMPFRAMEDATA);//2 306 | FD_GLYPHSET* NtGdiEngComputeGlyphSet(INT,INT,INT);//3 307 | BOOL NtUserGetScrollBarInfo(HWND,LONG,OUT LPSCROLLBARINFO);//3 308 | DWORD NtGdiGetFontFileData(UINT,UINT,PULONGLONG,PVOID,SIZE_T);//5 309 | HBITMAP NtGdiGetObjectBitmapHandle(HBRUSH,OUT PUINT);//2 310 | BOOL NtUserDrawIconEx(HDC,INT,INT,HICON,INT,INT,UINT,HBRUSH,UINT,BOOL,OUT DRAWICONEXDATA*);//11 311 | DWORD NtGdiGetGlyphIndicesW(HDC,PCWSTR,INT,PWORD,DWORD);//5 312 | BOOL NtUserYieldTask(VOID);//0 313 | BOOL NtUserLockWorkStation(VOID);//0 314 | BOOL NtGdiRoundRect(HDC,INT,INT,INT,INT,INT,INT);//7 315 | BOOL NtUserImpersonateDdeClientWindow(HWND,HWND);//2 316 | INT NtGdiGetDeviceCaps(HDC,INT);//2 317 | INT NtUserDrawMenuBarTemp(HWND,HDC,LPCRECT,HMENU,HFONT);//5 318 | UINT NtGdiGetNearestPaletteIndex(HPALETTE,COLORREF);//2 319 | INT NtGdiDrawEscape(HDC,INT,INT,PSTR);//4 320 | NTSTATUS NtUserTestForInteractiveUser(PLUID);//1 321 | BOOL NtUserBlockInput(BOOL);//1 322 | BOOL NtUserSetProp(HWND,DWORD,HANDLE);//3 323 | BOOL NtUserSetMenuFlagRtoL(HMENU);//1 324 | BOOL NtGdiSetFontXform(HDC,DWORD,DWORD);//3 325 | BOOL NtGdiEngStretchBlt(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,COLORADJUSTMENT*,PPOINTL,LPRECTL,LPRECTL,PPOINTL,ULONG);//11 326 | ULONG NtGdiXFORMOBJ_iGetXform(XFORMOBJ*,OUT XFORML*);//2 327 | DWORD NtUserGetRawInputDeviceList(PRAWINPUTDEVICELIST,PUINT,UINT);//3 328 | HANDLE NtGdiBRUSHOBJ_hGetColorTransform(BRUSHOBJ*);//1 329 | BOOL NtUserMoveWindow(HWND,INT,INT,INT,INT,BOOL);//6 330 | BOOL NtUserUnhookWindowsHookEx(HHOOK);//1 331 | DWORD NtUserGetRawInputData(HRAWINPUT,UINT,PVOID,PUINT,UINT);//5 332 | BOOL NtUserOpenClipboard(HWND,OUT PBOOL);//2 333 | BOOL NtGdiGetDCDword(HDC,UINT,OUT PDWORD);//3 334 | HKL NtUserGetKeyboardLayout(DWORD);//1 335 | BOOL NtGdiEnumFontClose(ULONG_PTR);//1 336 | BOOL NtUserPaintDesktop(HDC);//1 337 | DWORD NtGdiDvpGetVideoPortBandwidth(HANDLE,OUT PDD_GETVPORTBANDWIDTHDATA);//2 338 | BOOL NtUserShowWindowAsync(HWND,INT);//2 339 | NTSTATUS NtUserProcessConnect(HANDLE,OUT PVOID,ULONG);//3 340 | BOOL NtUserSetSysColors(INT,PINT,LPCOLORREF,UINT);//4 341 | BOOL NtGdiPlgBlt(HDC,LPPOINT,HDC,INT,INT,INT,INT,HBITMAP,INT,INT,DWORD);//11 342 | BOOL NtGdiFontIsLinked(HDC);//1 343 | BOOL NtUserUserHandleGrantAccess(HANDLE,HANDLE,BOOL);//3 344 | HBRUSH NtGdiCreatePatternBrushInternal(HBITMAP,BOOL,BOOL);//3 345 | HFONT NtGdiSelectFont(HDC,HFONT);//2 346 | HRGN NtGdiCreateRectRgn(INT,INT,INT,INT);//4 347 | DWORD NtGdiDvpGetVideoPortFlipStatus(HANDLE,OUT PDD_GETVPORTFLIPSTATUSDATA);//2 348 | BOOL NtUserSetThreadDesktop(HDESK);//1 349 | VOID NtUserNotifyWinEvent(DWORD,HWND,LONG,LONG);//4 350 | UINT NtUserLockWindowStation(HWINSTA);//1 351 | BOOL NtUserRemoveMenu(HMENU,UINT,UINT);//3 352 | INT NtGdiAddFontResourceW(PWCHAR,ULONG,ULONG,FLONG,DWORD,DESIGNVECTOR*);//6 353 | DWORD NtUserGetRawInputBuffer(PRAWINPUT,PUINT,UINT);//3 354 | BOOL NtUserDestroyMenu(HMENU);//1 355 | HHOOK NtUserSetWindowsHookAW(INT,HOOKPROC,DWORD);//3 356 | INT NtGdiSaveDC(HDC);//1 357 | BOOL NtGdiGetTextExtentExW(HDC,PWSTR,ULONG,ULONG,OUT PULONG,PULONG,OUT LPSIZE,FLONG);//8 358 | BOOL NtUserMNDragLeave(VOID);//0 359 | BOOL NtGdiGetETM(HDC,OUT EXTTEXTMETRIC*);//2 360 | HANDLE NtGdiCreateClientObj(ULONG);//1 361 | BOOL NtUserGetObjectInformation(HANDLE,INT,OUT PVOID,DWORD,OUT PDWORD);//5 362 | BOOL NtUserCreateCaret(HWND,HBITMAP,INT,INT);//4 363 | BOOL NtGdiGetMiterLimit(HDC,OUT PDWORD);//2 364 | BOOL NtGdiSTROBJ_bEnum(STROBJ*,OUT PULONG,PGLYPHPOS*);//3 365 | BOOL NtGdiDeleteColorTransform(HDC,HANDLE);//2 366 | HWND NtUserGetClipboardOwner(VOID);//0 367 | BOOL NtGdiPatBlt(HDC,INT,INT,INT,INT,DWORD);//6 368 | HBITMAP NtGdiEngCreateDeviceBitmap(DHSURF,SIZEL,ULONG);//3 369 | BOOL NtGdiSetPixelFormat(HDC,INT);//2 370 | DWORD NtGdiGetFontFileInfo(UINT,UINT,PFONT_FILE_INFO,SIZE_T,OUT PSIZE_T);//5 371 | BOOL NtUserPrintWindow(HWND,HDC,UINT);//3 372 | ULONG NtGdiEnumObjects(HDC,INT,ULONG,PVOID);//4 373 | BOOL NtUserGetUpdateRect(HWND,LPRECT,BOOL);//3 374 | BOOL NtUserShowCaret(HWND);//1 375 | PVOID NtGdiFONTOBJ_pvTrueTypeFontFile(FONTOBJ*,OUT PULONG);//2 376 | BOOL NtGdiGetRasterizerCaps(LPRASTERIZER_STATUS,ULONG);//2 377 | DWORD NtGdiDdDestroyD3DBuffer(HANDLE);//1 378 | INT NtGdiSetDIBitsToDeviceInternal(HDC,INT,INT,DWORD,DWORD,INT,INT,DWORD,DWORD,PBYTE,LPBITMAPINFO,DWORD,UINT,UINT,BOOL,HANDLE);//16 379 | HANDLE NtUserRemoveProp(HWND,DWORD);//2 380 | BOOL NtGdiGetCharABCWidthsW(HDC,UINT,ULONG,PWCHAR,FLONG,PVOID);//6 381 | LRESULT NtUserCallNextHookEx(INT,WPARAM,LPARAM,BOOL);//4 382 | BOOL NtUserDeleteMenu(HMENU,UINT,UINT);//3 383 | DWORD NtGdiDdCreateSurface(HANDLE,HANDLE*,OUT DDSURFACEDESC*,OUT DD_SURFACE_GLOBAL*,OUT DD_SURFACE_LOCAL*,OUT DD_SURFACE_MORE*,OUT DD_CREATESURFACEDATA*,OUT HANDLE*);//8 384 | UINT NtUserRegisterWindowMessage(PUNICODE_STRING);//1 385 | DWORD NtUserSetImeInfoEx(PIMEINFOEX);//1 386 | BOOL NtGdiXFORMOBJ_bApplyXform(XFORMOBJ*,ULONG,ULONG,PPOINTL,PPOINTL);//5 387 | BOOL NtGdiDdResetVisrgn(HANDLE,HWND);//2 388 | BOOL NtUserInvalidateRgn(HWND,HRGN,BOOL);//3 389 | LONG_PTR NtUserSetClassLongPtr(HWND,INT,LONG_PTR,BOOL);//4 390 | ULONG NtGdiXLATEOBJ_iXlate(XLATEOBJ*,ULONG);//2 391 | BOOL NtGdiGetMonitorID(HDC,DWORD,PWSTR);//3 392 | ULONG NtGdiBRUSHOBJ_ulGetBrushColor(BRUSHOBJ*);//1 393 | HMENU NtUserGetSystemMenu(HWND,BOOL);//2 394 | SURFOBJ* NtGdiEngLockSurface(HSURF);//1 395 | BOOL NtGdiPolyPatBlt(HDC,DWORD,PPOLYPATBLT,DWORD,DWORD);//5 396 | UINT NtGdiGetStringBitmapW(HDC,PWSTR,UINT,PBYTE,UINT);//5 397 | BOOL NtUserSetObjectInformation(HANDLE,INT,LPCVOID,DWORD);//4 398 | BOOL NtUserHiliteMenuItem(HWND,HMENU,UINT,UINT);//4 399 | DWORD NtUserDbgWin32HeapStat(PDBGHEAPSTAT,DWORD);//2 400 | BOOL NtUserDdeGetQualityOfService(HWND,HWND,OUT PSECURITY_QUALITY_OF_SERVICE);//3 401 | BOOL NtGdiSetMiterLimit(HDC,DWORD,OUT PDWORD);//3 402 | DWORD NtGdiDdCreateSurfaceEx(HANDLE,HANDLE,DWORD);//3 403 | HDC NtGdiCreateMetafileDC(HDC);//1 404 | NTSTATUS NtGdiEngUnlockSurface(SURFOBJ*);//1 405 | BOOL NtGdiSetPUMPDOBJ(HUMPD,BOOL,OUT HUMPD*,OUT PBOOL);//4 406 | BOOL NtGdiGetWidthTable(HDC,ULONG,PWCHAR,ULONG,PUSHORT,OUT WIDTHDATA*,OUT FLONG*);//7 407 | BOOL NtUserDestroyWindow(HWND);//1 408 | NTSTATUS NtUserBuildNameList(HWINSTA,UINT,OUT PNAMELIST,OUT PUINT);//4 409 | BOOL NtGdiFrameRgn(HDC,HRGN,HBRUSH,INT,INT);//5 410 | BOOL NtUserGetClassInfo(HINSTANCE,PUNICODE_STRING,OUT LPWNDCLASSEXW,OUT PWSTR*,BOOL);//5 411 | INT NtUserToUnicodeEx(UINT,UINT,PBYTE,OUT PWSTR,INT,UINT,HKL);//7 412 | UINT NtUserSetWindowStationUser(HWINSTA,PLUID,PSID,DWORD);//4 413 | DWORD NtGdiDdFlip(HANDLE,HANDLE,HANDLE,HANDLE,OUT PDD_FLIPDATA);//5 414 | BOOL NtGdiMakeObjectUnXferable(HANDLE);//1 415 | NTSTATUS NtGdiSTROBJ_vEnumStart(OUT STROBJ*);//1 416 | DWORD NtGdiDxgGenericThunk(ULONG_PTR,ULONG_PTR,OUT SIZE_T*,OUT PVOID,OUT SIZE_T*,OUT PVOID);//6 417 | DWORD NtUserDragObject(HWND,HWND,UINT,ULONG_PTR,HCURSOR);//5 418 | NTSTATUS NtUserQueryInformationThread(HANDLE,USERTHREADINFOCLASS,OUT PVOID,ULONG);//4 419 | BOOL NtGdiEngTransparentBlt(SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,LPRECTL,ULONG,ULONG);//8 420 | BOOL NtUserGetIconInfo(HICON,OUT PICONINFO,OUT PUNICODE_STRING,OUT PUNICODE_STRING,OUT PDWORD,BOOL);//6 421 | DWORD NtGdiDdUpdateOverlay(HANDLE,HANDLE,OUT PDD_UPDATEOVERLAYDATA);//3 422 | BOOL NtUserSetSystemMenu(HWND,HMENU);//2 423 | BOOL NtGdiConsoleTextOut(HDC,POLYTEXTW*,UINT,LPRECTL);//4 424 | ULONG NtGdiGetPerBandInfo(HDC,OUT PERBANDINFO*);//2 425 | BOOL NtUserGetGUIThreadInfo(DWORD,OUT LPGUITHREADINFO);//2 426 | HDC NtGdiCreateCompatibleDC(HDC);//1 427 | HFONT NtGdiHfontCreate(ENUMLOGFONTEXDVW*,ULONG,LFTYPE,FLONG,PVOID);//5 428 | ULONG NtGdiGetKerningPairs(HDC,ULONG,KERNINGPAIR*);//3 429 | BOOL NtGdiGetUFI(HDC,OUT PUNIVERSAL_FONT_ID,OUT DESIGNVECTOR*,OUT PULONG,OUT PULONG,OUT FLONG*);//6 430 | DWORD NtUserEvent(PEVENT_PACKET);//1 431 | BOOL NtGdiSTROBJ_bGetAdvanceWidths(STROBJ*,ULONG,ULONG,POINTQF*);//4 432 | INT NtGdiDescribePixelFormat(HDC,INT,UINT,PPIXELFORMATDESCRIPTOR);//4 433 | DWORD NtGdiDvpDestroyVideoPort(HANDLE,OUT PDD_DESTROYVPORTDATA);//2 434 | BOOL NtUserDrawAnimatedRects(HWND,INT,LPRECT,LPRECT);//4 435 | HWND NtUserSetClipboardViewer(HWND);//1 436 | BOOL NtGdiEnumFonts(HDC,ULONG,FLONG,ULONG,PCWSTR,ULONG,OUT PULONG,PVOID);//8 437 | BOOL NtGdiEllipse(HDC,INT,INT,INT,INT);//5 438 | LONG NtGdiSetBitmapBits(HBITMAP,ULONG,PBYTE);//3 439 | DWORD NtUserGetClipboardSequenceNumber(VOID);//0 440 | BOOL NtGdiEngGradientFill(SURFOBJ*,CLIPOBJ*,XLATEOBJ*,TRIVERTEX*,ULONG,PVOID,ULONG,LPRECTL,PPOINTL,ULONG);//10 441 | HDESK NtUserOpenDesktop(POBJECT_ATTRIBUTES,DWORD,ACCESS_MASK);//3 442 | BOOL NtUserScrollDC(HDC,INT,INT,LPRECT,LPRECT,HRGN,OUT LPRECT);//7 443 | NTSTATUS NtUserRemoteRedrawRectangle(WORD,WORD,WORD,WORD);//4 444 | ULONG NtGdiFONTOBJ_cGetGlyphs(FONTOBJ*,ULONG,ULONG,HGLYPH*,PVOID*);//5 445 | ULONG_PTR NtGdiPolyPolyDraw(HDC,LPPOINT,PULONG,ULONG,INT);//5 446 | BOOL NtUserGetLayeredWindowAttributes(HWND,LPCOLORREF,PBYTE,PDWORD);//4 447 | BOOL NtGdiUnmapMemFont(PVOID);//1 448 | BOOL NtGdiUMPDEngFreeUserMem(KERNEL_PVOID*);//1 449 | ULONG_PTR NtGdiGetColorSpaceforBitmap(HBITMAP);//1 450 | PVOID NtGdiBRUSHOBJ_pvAllocRbrush(BRUSHOBJ*,ULONG);//2 451 | NTSTATUS NtUserInitialize(DWORD,HANDLE,HANDLE);//3 452 | DWORD NtGdiDdWaitForVerticalBlank(HANDLE,OUT PDD_WAITFORVERTICALBLANKDATA);//2 453 | BOOL NtUserGetMenuItemRect(HWND,HMENU,UINT,OUT LPRECT);//4 454 | BOOL NtUserSetProcessWindowStation(HWINSTA);//1 455 | DWORD NtGdiDdCreateD3DBuffer(HANDLE,OUT HANDLE*,OUT DDSURFACEDESC*,OUT DD_SURFACE_GLOBAL*,OUT DD_SURFACE_LOCAL*,OUT DD_SURFACE_MORE*,OUT DD_CREATESURFACEDATA*,OUT HANDLE*);//8 456 | INT NtUserGetUpdateRgn(HWND,HRGN,BOOL);//3 457 | HWINSTA NtUserGetProcessWindowStation(VOID);//0 458 | BOOL NtGdiLineTo(HDC,INT,INT);//3 459 | BOOL NtGdiRestoreDC(HDC,INT);//2 460 | BOOL NtGdiRectVisible(HDC,LPRECT);//2 461 | INT NtUserSetWindowRgn(HWND,HRGN,BOOL);//3 462 | ULONG NtGdiColorCorrectPalette(HDC,HPALETTE,ULONG,ULONG,PALETTEENTRY*,ULONG);//6 463 | HCURSOR NtUserFindExistingCursorIcon(PUNICODE_STRING,PUNICODE_STRING,PCURSORFIND);//3 464 | BOOL NtUserRegisterRawInputDevices(PCRAWINPUTDEVICE,UINT,UINT);//3 465 | BOOL NtGdiGetCharWidthInfo(HDC,OUT PCHWIDTHINFO);//2 466 | BOOL NtGdiBRUSHOBJ_DeleteRbrush(BRUSHOBJ*,BRUSHOBJ*);//2 467 | HBITMAP NtGdiClearBitmapAttributes(HBITMAP,DWORD);//2 468 | BOOL NtUserSetCursorIconData(HCURSOR,PUNICODE_STRING,PUNICODE_STRING,PCURSORDATA);//4 469 | BOOL NtGdiScaleWindowExtEx(HDC,INT,INT,INT,INT,OUT LPSIZE);//6 470 | HANDLE NtGdiDdCreateSurfaceObject(HANDLE,HANDLE,PDD_SURFACE_LOCAL,PDD_SURFACE_MORE,PDD_SURFACE_GLOBAL,BOOL);//6 471 | CLIPOBJ* NtGdiEngCreateClip(VOID);//0 472 | BOOL NtGdiRectangle(HDC,INT,INT,INT,INT);//5 473 | NTSTATUS NtGdiDdDestroyFullscreenSprite(HDC,HANDLE);//2 474 | HANDLE NtUserConvertMemHandle(PBYTE,UINT);//2 475 | BOOL NtGdiEnableEudc(BOOL);//1 476 | BOOL NtUserDragDetect(HWND,POINT);//2 477 | BOOL NtUserPeekMessage(OUT LPMSG,HWND,UINT,UINT,UINT);//5 478 | INT NtGdiOffsetRgn(HRGN,INT,INT);//3 479 | BOOL NtUserSetShellWindowEx(HWND,HWND);//2 480 | BOOL NtGdiArcInternal(ARCTYPE,HDC,INT,INT,INT,INT,INT,INT,INT,INT);//10 481 | VOID NtUserSetDbgTag(INT,DWORD);//2 482 | DWORD NtUserCallHwndParam(HWND,DWORD,DWORD);//3 483 | HDC NtUserGetDC(HWND);//1 484 | BOOL NtUserEndMenu(VOID);//0 485 | HBRUSH NtGdiClearBrushAttributes(HBRUSH,DWORD);//2 486 | HCURSOR NtUserSetCursor(HCURSOR);//1 487 | ULONG NtGdiGetEmbedFonts(VOID);//0 488 | NTSTATUS NtUserInitTask(UINT,DWORD,PUNICODE_STRING,PUNICODE_STRING,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD);//11 489 | INT NtUserInternalGetWindowText(HWND,OUT PWSTR,INT);//3 490 | NTSTATUS NtGdiDdCreateFullscreenSprite(HDC,COLORREF,OUT HANDLE*,OUT HDC*);//4 491 | BOOL NtGdiTileBitBlt(HDC,LPRECTL,HDC,LPRECTL,PPOINTL,DWORD,DWORD);//7 492 | BOOL NtGdiEngAssociateSurface(HSURF,HDEV,FLONG);//3 493 | HRGN NtGdiExtCreateRegion(LPXFORM,DWORD,LPRGNDATA);//3 494 | VOID NtUserDbgWin32HeapFail(DWORD,BOOL);//2 495 | BOOL NtGdiEngLineTo(SURFOBJ*,CLIPOBJ*,BRUSHOBJ*,LONG,LONG,LONG,LONG,LPRECTL,MIX);//9 496 | INT NtGdiCombineRgn(HRGN,HRGN,HRGN,INT);//4 497 | BOOL NtUserSetWindowFNID(HWND,WORD);//2 498 | INT NtGdiStartDoc(HDC,DOCINFOW*,OUT PBOOL,INT);//4 499 | DWORD NtGdiDdCanCreateD3DBuffer(HANDLE,OUT PDD_CANCREATESURFACEDATA);//2 500 | BOOL NtGdiMakeInfoDC(HDC,BOOL);//2 501 | BOOL NtUserIsClipboardFormatAvailable(UINT);//1 502 | BOOL NtGdiPolyTextOutW(HDC,POLYTEXTW*,UINT,DWORD);//4 503 | HWND NtUserGetAncestor(HWND,UINT);//2 504 | ULONG_PTR NtUserGetCPD(HWND,DWORD,ULONG_PTR);//3 505 | HWINSTA NtUserOpenWindowStation(POBJECT_ATTRIBUTES,ACCESS_MASK);//2 506 | BOOL NtGdiResizePalette(HPALETTE,UINT);//2 507 | HDESK NtUserCreateDesktop(POBJECT_ATTRIBUTES,PUNICODE_STRING,LPDEVMODEW,DWORD,ACCESS_MASK);//5 508 | PCLS NtUserGetWOWClass(HINSTANCE,PUNICODE_STRING);//2 509 | BOOL NtGdiSelectClipPath(HDC,INT);//2 510 | HANDLE NtGdiGetDCObject(HDC,INT);//2 511 | DWORD NtGdiSTROBJ_dwGetCodePage(STROBJ*);//1 512 | BOOL NtGdiPolyDraw(HDC,LPPOINT,PBYTE,ULONG);//4 513 | DWORD NtUserGetListBoxInfo(HWND);//1 514 | BOOL NtUserNotifyProcessCreate(DWORD,DWORD,ULONG_PTR,DWORD);//4 515 | HWINEVENTHOOK NtUserSetWinEventHook(DWORD,DWORD,HMODULE,PUNICODE_STRING,WINEVENTPROC,DWORD,DWORD,DWORD);//8 516 | BOOL NtGdiAddEmbFontToDC(HDC,PVOID*);//2 517 | HWND NtUserChildWindowFromPointEx(HWND,POINT,UINT);//3 518 | BOOL NtUserBitBltSysBmp(HDC,INT,INT,INT,INT,INT,INT,DWORD);//8 519 | DWORD NtGdiGetPixel(HDC,INT,INT);//3 520 | DWORD NtGdiDdGetDriverInfo(HANDLE,OUT PDD_GETDRIVERINFODATA);//2 521 | BOOL NtUserGetKeyboardState(OUT PBYTE);//1 522 | XFORMOBJ* NtGdiFONTOBJ_pxoGetXform(FONTOBJ*);//1 523 | HBITMAP NtGdiCreateCompatibleBitmap(HDC,INT,INT);//3 524 | BOOL NtUserFlashWindowEx(PFLASHWINFO);//1 525 | ULONG NtGdiGetOutlineTextMetricsInternalW(HDC,ULONG,OUTLINETEXTMETRICW*,OUT TMDIFF*);//4 526 | BOOL NtGdiUnloadPrinterDriver(PWSTR,ULONG);//2 527 | BOOL NtGdiDrawStream(HDC,ULONG,PVOID);//3 528 | BOOL NtGdiSetLinkedUFIs(HDC,PUNIVERSAL_FONT_ID,ULONG);//3 529 | BOOL NtUserKillTimer(HWND,UINT_PTR);//2 530 | ULONG NtGdiFONTOBJ_cGetAllGlyphHandles(FONTOBJ*,OUT HGLYPH*);//2 531 | BOOL NtUserGetMonitorInfo(HMONITOR,OUT LPMONITORINFO);//2 532 | BOOL NtGdiBeginGdiRendering(HBITMAP,BOOL,PVOID);//3 533 | BOOL NtUserGetAltTabInfo(HWND,INT,OUT PALTTABINFO,OUT PWSTR,UINT,BOOL);//6 534 | HANDLE NtGdiXLATEOBJ_hGetColorTransform(XLATEOBJ*);//1 535 | DWORD NtGdiD3dContextDestroy(LPD3DNTHAL_CONTEXTDESTROYDATA);//1 536 | BOOL NtGdiCLIPOBJ_bEnum(CLIPOBJ*,ULONG,PULONG);//3 537 | BOOL NtGdiInitSpool(VOID);//0 538 | NTSTATUS NtUserResolveDesktopForWOW(OUT PUNICODE_STRING);//1 539 | VOID NtUserSetThreadState(DWORD,DWORD);//2 540 | BOOL NtGdiEndDoc(HDC);//1 541 | BOOL NtGdiDdReenableDirectDrawObject(HANDLE,OUT PBOOL);//2 542 | BOOL NtUserSetMenuContextHelpId(HMENU,DWORD);//2 543 | INT NtGdiGetTextCharsetInfo(HDC,OUT LPFONTSIGNATURE,DWORD);//3 544 | HANDLE NtGdiDdCreateDirectDrawObject(HDC);//1 545 | INT NtGdiGetLinkedUFIs(HDC,PUNIVERSAL_FONT_ID,INT);//3 546 | NTSTATUS NtUserConsoleControl(CONSOLECONTROL,PVOID,DWORD);//3 547 | NTSTATUS NtGdiGetStats(HANDLE,INT,INT,PVOID,UINT);//5 548 | BOOL NtUserSetLayeredWindowAttributes(HWND,COLORREF,BYTE,DWORD);//4 549 | HPALETTE NtGdiEngCreatePalette(ULONG,ULONG,PULONG,FLONG,FLONG,FLONG);//6 550 | BOOL NtGdiGetTextMetricsW(HDC,TMW_INTERNAL*,ULONG);//3 551 | HWND NtUserSetCapture(HWND);//1 552 | BOOL NtUserEmptyClipboard(VOID);//0 553 | HWND NtUserFindWindowEx(HWND,HWND,PUNICODE_STRING,PUNICODE_STRING,DWORD);//5 554 | DWORD NtUserGetRegisteredRawInputDevices(PRAWINPUTDEVICE,PUINT,UINT);//3 555 | HANDLE NtUserQueryWindow(HWND,WINDOWINFOCLASS);//2 556 | VOID RtlInitLargeUnicodeString(OUT PLARGE_UNICODE_STRING,PCWSTR,INT);//3 557 | UINT_PTR NtUserSetSystemTimer(HWND,UINT_PTR,DWORD,WNDPROC);//4 558 | BOOL NtUserGetClipCursor(OUT LPRECT);//1 559 | DWORD NtGdiDdRenderMoComp(HANDLE,OUT PDD_RENDERMOCOMPDATA);//2 560 | INT NtGdiGetPath(HDC,LPPOINT,PBYTE,INT);//4 561 | WORD NtUserSetWindowWord(HWND,INT,WORD);//3 562 | NTSTATUS NtGdiPATHOBJ_vGetBounds(PATHOBJ*,OUT PRECTFX);//2 563 | BOOL NtGdiEngFillPath(SURFOBJ*,PATHOBJ*,CLIPOBJ*,BRUSHOBJ*,PPOINTL,MIX,FLONG);//7 564 | ULONG NtGdiQueryFontAssocInfo(HDC);//1 565 | DWORD NtGdiD3dContextDestroyAll(OUT LPD3DNTHAL_CONTEXTDESTROYALLDATA);//1 566 | BOOL NtGdiEngStrokeAndFillPath(SURFOBJ*,PATHOBJ*,CLIPOBJ*,XFORMOBJ*,BRUSHOBJ*,LINEATTRS*,BRUSHOBJ*,PPOINTL,MIX,FLONG);//10 567 | LONG NtGdiHT_Get8BPPFormatPalette(OUT LPPALETTEENTRY,USHORT,USHORT,USHORT);//4 568 | DWORD NtGdiDvpAcquireNotification(HANDLE,OUT HANDLE*,LPDDVIDEOPORTNOTIFY);//3 569 | BOOL NtUserRegisterHotKey(HWND,INT,UINT,UINT);//4 570 | HWND NtUserMinMaximize(HWND,UINT,BOOL);//3 571 | RTL_ATOM NtUserRegisterClassExWOW(LPWNDCLASSEXW,PUNICODE_STRING,PUNICODE_STRING,PCLSMENUNAME,DWORD,DWORD,PDWORD);//7 572 | BOOL NtUserClipCursor(LPRECT);//1 573 | NTSTATUS NtUserInitializeClientPfnArrays(PFNCLIENT*,PFNCLIENT*,PFNCLIENTWORKER*,HANDLE);//4 574 | BOOL NtUserEnableMenuItem(HMENU,UINT,UINT);//3 575 | HBRUSH NtGdiSetBrushAttributes(HBRUSH,DWORD);//2 576 | BOOL NtGdiDdDeleteSurfaceObject(HANDLE);//1 577 | BOOL NtUserAttachThreadInput(DWORD,DWORD,BOOL);//3 578 | BOOL NtUserEndDeferWindowPosEx(HDWP,BOOL);//2 579 | BOOL NtGdiFlattenPath(HDC);//1 580 | NTSTATUS NtUserEnumDisplaySettings(PUNICODE_STRING,DWORD,OUT LPDEVMODEW,DWORD);//4 581 | DWORD NtGdiDdColorControl(HANDLE,OUT PDD_COLORCONTROLDATA);//2 582 | BOOL NtUserRealInternalGetMessage(LPMSG,HWND,UINT,UINT,UINT,BOOL);//6 583 | BOOL NtUserGetTitleBarInfo(HWND,OUT LPTITLEBARINFO);//2 584 | INT NtUserGetClipboardFormatName(UINT,OUT PWSTR,UINT);//3 585 | BOOL NtUserCloseClipboard(VOID);//0 586 | HDESK NtUserGetThreadDesktop(DWORD,HDESK);//2 587 | NTSTATUS NtGdiFONTOBJ_vGetInfo(FONTOBJ*,ULONG,FONTINFO*);//3 588 | HRGN NtGdiCreateRoundRectRgn(INT,INT,INT,INT,INT,INT);//6 589 | HWND NtUserGetClipboardViewer(VOID);//0 590 | BOOL NtGdiEngDeleteSurface(HSURF);//1 591 | BOOL NtUserPostMessage(HWND,UINT,WPARAM,LPARAM);//4 592 | INT NtUserSetScrollInfo(HWND,INT,LPCSCROLLINFO,BOOL);//4 593 | ULONG NtGdiCLIPOBJ_cEnumStart(CLIPOBJ*,BOOL,ULONG,ULONG,ULONG);//5 594 | BOOL NtGdiDdSetGammaRamp(HANDLE,HDC,PVOID);//3 595 | ULONG NtGdiGetServerMetaFileBits(HANDLE,ULONG,PBYTE,OUT PDWORD,OUT PDWORD,OUT PDWORD,OUT PDWORD);//7 596 | UINT NtGdiGetSystemPaletteUse(HDC);//1 597 | BOOL NtGdiGetDeviceGammaRamp(HDC,PVOID);//2 598 | DWORD NtGdiDdChangeSurfacePointer(HANDLE,PVOID);//2 599 | DWORD NtGdiDdAddAttachedSurface(HANDLE,HANDLE,OUT PDD_ADDATTACHEDSURFACEDATA);//3 600 | BOOL NtGdiAlphaBlend(HDC,LONG,LONG,LONG,LONG,HDC,LONG,LONG,LONG,LONG,BLENDFUNCTION,HANDLE);//12 601 | ULONG NtGdiGetFontData(HDC,DWORD,DWORD,PVOID,ULONG);//5 602 | NTSTATUS NtUserRemoteConnect(PDOCONNECTDATA,ULONG,PWCHAR);//3 603 | NTSTATUS NtUserSoundSentry(VOID);//0 604 | BOOL NtUserGetMessage(OUT LPMSG,HWND,UINT,UINT);//4 605 | BOOL NtGdiMonoBitmap(HBITMAP);//1 606 | HDC NtUserGetDCEx(HWND,HRGN,DWORD);//3 607 | LONG_PTR NtUserSetWindowLongPtr(HWND,INT,LONG_PTR,BOOL);//4 608 | DWORD NtUserGetRawInputDeviceInfo(HANDLE,UINT,PVOID,PUINT);//4 609 | DWORD NtUserCallHwndParamLock(HWND,DWORD,DWORD);//3 610 | BOOL NtGdiModifyWorldTransform(HDC,LPXFORM,DWORD);//3 611 | ULONG NtGdiGetEudcTimeStampEx(PWSTR,ULONG,BOOL);//3 612 | DWORD NtGdiDdDestroySurface(HANDLE,BOOL);//2 613 | HDC NtGdiDdGetDC(HANDLE,PALETTEENTRY*);//2 614 | DWORD NtGdiGetGlyphIndicesWInternal(HDC,PWSTR,INT,PWORD,DWORD,BOOL);//6 615 | HSURF NtGdiEngCreateDeviceSurface(DHSURF,SIZEL,ULONG);//3 616 | INT NtUserCountClipboardFormats(VOID);//0 617 | BOOL NtUserLockWindowUpdate(HWND);//1 618 | HMONITOR NtUserMonitorFromWindow(HWND,DWORD);//2 619 | BOOL NtGdiHLSurfSetInformation(HLSURF,HLSURF_INFORMATION_CLASS,PVOID,ULONG);//4 620 | BOOL NtUserCallHwndLock(HWND,DWORD);//2 621 | VOID NtUserAlterWindowStyle(HWND,DWORD,DWORD);//3 622 | DWORD NtUserGetGuiResources(HANDLE,DWORD);//2 623 | ULONG NtGdiGetRegionData(HRGN,ULONG,LPRGNDATA);//3 624 | NTSTATUS NtUserSetInformationProcess(HANDLE,USERPROCESSINFOCLASS,PVOID,ULONG);//4 625 | BOOL NtGdiEngStrokePath(SURFOBJ*,PATHOBJ*,CLIPOBJ*,XFORMOBJ*,BRUSHOBJ*,PPOINTL,LINEATTRS*,MIX);//8 626 | DWORD NtGdiDdSetColorKey(HANDLE,OUT PDD_SETCOLORKEYDATA);//2 627 | HWND NtUserCreateWindowEx(DWORD,PLARGE_STRING,PLARGE_STRING,PLARGE_STRING,DWORD,INT,INT,INT,INT,HWND,HMENU,HINSTANCE,PVOID,DWORD,PVOID);//15 628 | BOOL NtUserSetScrollBarInfo(HWND,LONG,SETSCROLLBARINFO*);//3 629 | BOOL NtGdiCloseFigure(HDC);//1 630 | BOOL NtGdiEngPaint(SURFOBJ*,CLIPOBJ*,BRUSHOBJ*,PPOINTL,MIX);//5 631 | INT NtUserGetKeyNameText(LONG,OUT PWSTR,UINT);//3 632 | INT NtGdiSetupPublicCFONT(HDC,HFONT,ULONG);//3 633 | BOOL NtGdiGetDeviceCapsAll(HDC,OUT PDEVCAPS);//2 634 | DWORD NtGdiSetLayout(HDC,LONG,DWORD);//3 635 | BOOL NtUserDestroyAcceleratorTable(HACCEL);//1 636 | NTSTATUS NtGdiGetCurrentDpiInfo(HMONITOR,OUT PVOID);//2 637 | HANDLE NtUserGetClipboardData(UINT,OUT PGETCLIPBDATA);//2 638 | HBRUSH NtUserGetControlBrush(HWND,HDC,UINT);//3 639 | BOOL RtlLargeStringToUnicodeString(PUNICODE_STRING,PLARGE_STRING);//2 640 | DWORD NtUserWaitForInputIdle(ULONG_PTR,DWORD,BOOL);//3 641 | UINT NtUserGetCaretBlinkTime(VOID);//0 642 | BOOL NtGdiAbortDoc(HDC);//1 643 | SHORT NtUserVkKeyScanEx(WCHAR,ULONG_PTR,BOOL);//3 644 | BOOL NtGdiSetBitmapDimension(HBITMAP,INT,INT,LPSIZE);//4 645 | BOOL NtUserTrackPopupMenuEx(HMENU,UINT,INT,INT,HWND,TPMPARAMS*);//6 646 | BOOL NtUserEndPaint(HWND,LPPAINTSTRUCT);//2 647 | HDESK NtUserOpenInputDesktop(DWORD,BOOL,DWORD);//3 648 | DWORD NtGdiDvpGetVideoPortOutputFormats(HANDLE,OUT PDD_GETVPORTOUTPUTFORMATDATA);//2 649 | BOOL NtUserPostThreadMessage(DWORD,UINT,WPARAM,LPARAM);//4 650 | HBRUSH NtGdiCreateHatchBrushInternal(ULONG,COLORREF,BOOL);//3 651 | DWORD NtGdiDdQueryMoCompStatus(HANDLE,OUT PDD_QUERYMOCOMPSTATUSDATA);//2 652 | UINT NtUserGetKeyboardLayoutList(UINT,OUT LPHKL);//2 653 | NTSTATUS NtGdiDdNotifyFullscreenSpriteUpdate(HDC,HANDLE);//2 654 | INT NtUserMenuItemFromPoint(HWND,HMENU,DWORD,DWORD);//4 655 | NTSTATUS NtGdiEngDeletePath(PATHOBJ*);//1 656 | BOOL NtGdiEngEraseSurface(SURFOBJ*,LPRECTL,ULONG);//3 657 | NTSTATUS NtGdiEngDeleteClip(CLIPOBJ*);//1 658 | IFIMETRICS* NtGdiFONTOBJ_pifi(FONTOBJ*);//1 659 | BOOL NtGdiEngCopyBits(SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,PPOINTL);//6 660 | ULONG NtGdiGetGlyphOutline(HDC,WCHAR,UINT,OUT LPGLYPHMETRICS,ULONG,PVOID,LPMAT2,BOOL);//8 661 | HACCEL NtUserCreateAcceleratorTable(LPACCEL,INT);//2 662 | COLORREF NtGdiGetNearestColor(HDC,COLORREF);//2 663 | LRESULT NtUserDispatchMessage(LPMSG);//1 664 | BOOL NtGdiGetDCPoint(HDC,UINT,OUT PPOINTL);//3 665 | BOOL NtUserShowWindow(HWND,INT);//2 666 | DWORD_PTR NtUserCallOneParam(DWORD_PTR,DWORD);//2 667 | BOOL NtUserEnableScrollBar(HWND,UINT,UINT);//3 668 | DWORD NtGdiDdLock(HANDLE,OUT PDD_LOCKDATA,HDC);//3 669 | INT NtGdiIntersectClipRect(HDC,INT,INT,INT,INT);//5 670 | BOOL NtGdiDdDeleteDirectDrawObject(HANDLE);//1 671 | HWND NtUserSetFocus(HWND);//1 672 | BOOL NtUserDrawCaption(HWND,HDC,LPRECT,UINT);//4 673 | INT NtGdiGetSpoolMessage(DWORD,DWORD,DWORD,DWORD);//4 674 | ULONG NtUserGetAtomName(ATOM,OUT PUNICODE_STRING);//2 675 | HKL NtUserActivateKeyboardLayout(HKL,UINT);//2 676 | BOOL NtGdiMirrorWindowOrg(HDC);//1 677 | DWORD NtGdiDdFlipToGDISurface(HANDLE,OUT PDD_FLIPTOGDISURFACEDATA);//2 678 | LONG NtGdiConvertMetafileRect(HDC,OUT PRECTL);//2 679 | DWORD NtGdiDvpCanCreateVideoPort(HANDLE,OUT PDD_CANCREATEVPORTDATA);//2 680 | VOID NtUserSetRipFlags(DWORD,DWORD);//2 681 | BOOL NtGdiStretchBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,INT,INT,DWORD,DWORD);//12 682 | INT NtUserGetClassName(HWND,BOOL,OUT PUNICODE_STRING);//3 683 | BOOL NtUserUpdateLayeredWindow(HWND,HDC,LPPOINT,LPSIZE,HDC,LPPOINT,COLORREF,PBLENDFUNCTION,DWORD,LPRECT);//10 684 | BOOL NtUserSetSystemCursor(HCURSOR,DWORD);//2 685 | BOOL NtUserTranslateMessage(LPMSG,UINT);//2 686 | DWORD NtGdiDdDestroyMoComp(HANDLE,OUT PDD_DESTROYMOCOMPDATA);//2 687 | DWORD NtGdiDvpReleaseNotification(HANDLE,HANDLE);//2 688 | INT NtUserExcludeUpdateRgn(HDC,HWND);//2 689 | HPALETTE NtGdiCreatePaletteInternal(LPLOGPALETTE,UINT);//2 690 | ULONG NtGdiDdQueryVisRgnUniqueness(VOID);//0 691 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Tool of fetch windows syscalls 2 | 3 | author : [@55-AA](https://twitter.com/5_5_A_A), Sept 23, 2016 4 | 5 | ##Introduction 6 | 7 | This IdaPython script fetchs syscall's ID and function name from those Windows dlls with IDA Pro, such as ntdll.dll, user32.dll. 8 | 9 | It requires IDA 6.8 and later. For getting function prototypes, A Pdb file is required when the dll is first opened to analyze. 10 | 11 | If not a H\_APIs.h, You need generate it from ntgdi_reactos.h, ntuser_reactos.h and ntuser_w2k.h, then use 'Alt+F7' to open this script to run. The H\_APIs.h supply the prototype, when IDA cannot get it. 12 | 13 | The last, you can obtain a output file at the script path. 14 | 15 | A example of function fetched from IDA is following: 16 | 17 | .text:77D74BF9 _NtUserGetPriorityClipboardFormat@8 proc near 18 | .text:77D74BF9 mov eax, 11BDh 19 | .text:77D74BFE mov edx, 7FFE0300h 20 | .text:77D74C03 call dword ptr [edx] 21 | .text:77D74C05 retn 8 22 | .text:77D74C05 _NtUserGetPriorityClipboardFormat@8 endp 23 | 24 | The example of output is following: 25 | 26 | ...... 27 | /*0x116e,03*/BOOL NtUserDeleteMenu(HMENU,UINT,UINT); 28 | /*0x1211,03*/BOOL NtUserRemoveMenu(HMENU,UINT,UINT); 29 | /*0x122d,03*/BOOL NtUserSetMenuDefaultItem(HMENU,UINT,UINT); 30 | /*0x1172,01*/BOOL NtUserDestroyMenu(HMENU); 31 | /*0x11ef,06*/BOOL NtUserMoveWindow(HWND,INT,INT,INT,INT,BOOL); 32 | /*0x1158,01*/BOOL NtUserCheckDesktopByThreadId(DWORD); 33 | ...... 34 | 35 | The columns meanning above: 36 | 37 | ID, Paramster count, Function prototype 38 | 39 | ##Todo 40 | I cannot get prototype and parameter count on x64 PE, so I need a new way. In fact, there are many function, their prototype are identical with x86 ones. 41 | 42 | 43 | ##References 44 | 45 | + [idapython_docs](https://www.hex-rays.com/products/ida/support/idapython_docs/) 46 | + idaapi.py -------------------------------------------------------------------------------- /gen_H_APIs.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | import re 4 | 5 | g_func_dict = {} 6 | g_Unknown = 0 7 | g_Count = 0 8 | g_Duplicate = 0 9 | 10 | g_param_format = { 11 | "char" : "CHAR", 12 | "int" : "INT", 13 | "void" : "VOID", 14 | "_DWORD" : "DWORD", 15 | 16 | "LPSTR" : "PSTR", 17 | "LPCSTR" : "PCSTR", 18 | "LPWSTR" : "PWSTR", 19 | "LPCWSTR" : "PCWSTR", 20 | 21 | "LPVOID" : "PVOID", 22 | "LPCHAR" : "PCHAR", 23 | "LPUCHAR" : "PUCHAR", 24 | "LPBYTE" : "PBYTE", 25 | "LPWCHAR" : "PWCHAR", 26 | "LPSHORT" : "PSHORT", 27 | "LPUSHORT" : "PUSHORT", 28 | "LPDWORD" : "PDWORD", 29 | "LPWORD" : "PWORD", 30 | "LPINT" : "PINT", 31 | "LPUINT" : "PUINT", 32 | "LPLONG" : "PLONG", 33 | "LPULONG" : "PULONG", 34 | "LPBOOL" : "PBOOL", 35 | 36 | "PMSG" : "LPMSG", 37 | "PSIZE" : "LPSIZE", 38 | "PPOINT" : "LPPOINT", 39 | "PRECT" : "LPRECT", 40 | "PCURSORINFO" : "LPCURSORINFO", 41 | "PTITLEBARINFO" : "LPTITLEBARINFO", 42 | "PGUITHREADINFO" : "LPGUITHREADINFO", 43 | "PSCROLLBARINFO" : "LPSCROLLBARINFO", 44 | "PCOMBOBOXINFO" : "LPCOMBOBOXINFO", 45 | } 46 | 47 | g_param_format2 = { 48 | "VOID*" : "PVOID", 49 | "CHAR*" : "PCHAR", 50 | "UCHAR*" : "PUCHAR", 51 | "BYTE*" : "PBYTE", 52 | "WCHAR*" : "PWCHAR", 53 | "SHORT*" : "PSHORT", 54 | "USHORT*" : "PUSHORT", 55 | "DWORD*" : "PDWORD", 56 | "WORD*" : "PWORD", 57 | "INT*" : "PINT", 58 | "UINT*" : "PUINT", 59 | "LONG*" : "PLONG", 60 | "ULONG*" : "PULONG", 61 | "BOOL*" : "PBOOL", 62 | #structure 63 | "SIZE*" : "LPSIZE", 64 | "MSG*" : "LPMSG", 65 | "POINT*" : "LPPOINT", 66 | "POINTL*" : "PPOINTL", 67 | "HKL*" : "LPHKL", 68 | "RECT*" : "LPRECT", 69 | "PRECT" : "LPRECT", 70 | "RECTL*" : "LPRECTL", 71 | "COLORREF*" : "LPCOLORREF", 72 | "WNDCLASSEXW*" : "LPWNDCLASSEXW", 73 | "PAINTSTRUCT*" : "LPPAINTSTRUCT", 74 | "WINDOWPLACEMENT*" : "LPWINDOWPLACEMENT", 75 | "BLENDFUNCTION*" : "PBLENDFUNCTION", # 76 | } 77 | 78 | def format_type(T): 79 | A = T.split('*') 80 | param = A[0] 81 | if param in g_param_format.keys(): 82 | param = g_param_format[param] 83 | 84 | if len(A) > 1: 85 | param += '*' 86 | if param in g_param_format2.keys(): 87 | param = g_param_format2[param] 88 | 89 | return param 90 | 91 | def save_func(func_line): 92 | global g_Unknown 93 | global g_Count 94 | global g_Duplicate 95 | 96 | g_Count += 1 97 | (NTAPI, func_ret, func_line) = func_line.split(' ', 2) 98 | assert(NTAPI == "NTAPI") 99 | func_ret = format_type(func_ret) 100 | (func_name, func_line) = func_line.split('(', 1) 101 | func_name = func_name.strip() 102 | A = func_line.split(')')[0] 103 | B = A.split(',') 104 | 105 | func_param = '' 106 | paramN = 0 107 | for i in B: 108 | C = i.split() 109 | is_OUT = 0 110 | IN_key_skip = ["IN", "CONST", "const", "_In_", "_In_opt_", 'OPTIONAL'] 111 | OUT_key_skip = ["OUT", "_Out_opt_", "_Inout_opt_", "_Inout_", "_Out_", '_Outptr_'] 112 | 113 | for j in IN_key_skip: 114 | if j in C: 115 | C.remove(j) 116 | for j in OUT_key_skip: 117 | if j in C: 118 | C.remove(j) 119 | is_OUT = 1 120 | 121 | if not len(C): 122 | print "ERROR: No parameters" 123 | 124 | argument = '' 125 | if len(C) > 1: 126 | argument = C[1] 127 | if argument[:9] == "dwUnknown" or argument[:7] == "Unknown": 128 | g_Unknown += 1 129 | # print "ERROR: Unknown parameters" 130 | return 131 | 132 | param = C[0] 133 | if param: 134 | if argument[:1] == '*': 135 | param = param + '*' 136 | param = format_type(param) 137 | 138 | if is_OUT: 139 | param = "OUT " + param 140 | func_param += ',' + param 141 | paramN += 1 142 | 143 | func_param = func_param[1:] 144 | if "VOID" == func_param or "" == func_param : 145 | func_param = "VOID" 146 | paramN = 0 147 | 148 | if func_name not in g_func_dict.keys(): 149 | g_func_dict[func_name] = [func_ret, paramN, func_param] 150 | else: 151 | g_Duplicate += 1 152 | if paramN == g_func_dict[func_name][1]: 153 | g_func_dict[func_name] = [func_ret, paramN, func_param] 154 | 155 | 156 | def process_lines(lines): 157 | ''' 158 | input e.g.1 159 | BOOL 160 | NTAPI 161 | NtUserDrawAnimatedRects( 162 | HWND hwnd, 163 | INT idAni, 164 | RECT *lprcFrom, 165 | RECT *lprcTo); 166 | 167 | input e.g.2 168 | W32KAPI 169 | HWINSTA 170 | NtUserOpenWindowStation( 171 | IN POBJECT_ATTRIBUTES pObja, 172 | IN ACCESS_MASK amRequest); 173 | ''' 174 | linesN = len(lines) 175 | i = 0 176 | while i < linesN : 177 | ntapi_lines = lines[i].split() 178 | i += 1 179 | func_line = '' 180 | if "NTAPI" in ntapi_lines: 181 | ntapi_idx = ntapi_lines.index("NTAPI") 182 | if ntapi_idx == 0: 183 | ntapi_lines.insert(1, lines[i - 2]) 184 | for j in ntapi_lines: 185 | func_line += j + ' ' 186 | else: 187 | continue 188 | 189 | elif "W32KAPI" in ntapi_lines: 190 | ntapi_idx = ntapi_lines.index("W32KAPI") 191 | if ntapi_idx == 0: 192 | ntapi_lines[ntapi_idx] = "NTAPI" 193 | for j in ntapi_lines: 194 | func_line += j + ' ' 195 | else: 196 | continue 197 | else: 198 | 199 | continue 200 | 201 | # search ')' 202 | j = i + 20 203 | if j > linesN: 204 | j = linesN 205 | while i < j : 206 | func_line += lines[i] + ' ' 207 | if lines[i].find(')') >= 0 : 208 | # save_func(func_line) 209 | try: 210 | save_func(func_line) 211 | except: 212 | print "ERROR: [EXCEPT]", func_line 213 | i += 1 214 | break 215 | i += 1 216 | 217 | def load_user32_file(h_file): 218 | f = open(h_file, "r") 219 | lines = [] 220 | R_APIENTRY = re.compile(r'(.*)(APIENTRY)(.*)') 221 | R_all = re.compile(r'(.*)(/\*.*\*/)(.*)') 222 | R_left = re.compile(r'(.*)(/\*.*)') 223 | R_right = re.compile(r'(.*\*/)(.*)') 224 | search_end = 0 225 | for line in f: 226 | line = line.strip() 227 | line = R_APIENTRY.sub(r'\1NTAPI\3', line) #"APIENTRY" -> "NTAPI" 228 | line = R_all.sub(r'\1\3', line) #"111/*222*/333" -> "111333" 229 | line = line.split("//", 1)[0] #"111//22222222" -> "111" 230 | 231 | R = R_left.match(line) #"111/*222" -> "111" 232 | if R: 233 | search_end = 1 234 | line = R.group(1) 235 | else: 236 | if search_end: 237 | R = R_right.match(line) #"111*/222" -> "222" 238 | if R: 239 | search_end = 0 240 | line = R.group(2) 241 | else: 242 | line = "" #"/*111*/" -> "" 243 | if line: 244 | lines.append(line) 245 | 246 | f.close() 247 | return lines 248 | 249 | 250 | def load_gdi32_file(h_file): 251 | ''' 252 | input e.g. 253 | W32KAPI 254 | HBRUSH 255 | APIENTRY 256 | NtGdiCreateSolidBrush( 257 | _In_ COLORREF cr, 258 | _In_opt_ HBRUSH hbr); 259 | ''' 260 | f = open(h_file, "r") 261 | lines = [] 262 | R_all = re.compile(r'(.*)(/\*.*\*/)(.*)') 263 | R_left = re.compile(r'(.*)(/\*.*)') 264 | R_right = re.compile(r'(.*\*/)(.*)') 265 | 266 | R_except = [ 267 | re.compile(r'(.*)(_When_\(.*\)\))(.*)'), 268 | re.compile(r'(.*)(_Out_writes_.*\) )(.*)'), 269 | re.compile(r'(.*)(_In_reads_.*\) )(.*)'), 270 | re.compile(r'(.*)(_Inout_updates_.*\) )(.*)'), 271 | re.compile(r'(.*)(_At_\(.*\) )(.*)'), 272 | re.compile(r'(.*)(_Deref_out_range_\(.*\) )(.*)'), 273 | re.compile(r'(.*)(_In_range_\(.*\) )(.*)'), 274 | re.compile(r'(.*)(_Outptr_result_buffer_\(.*\) )(.*)'), 275 | re.compile(r'(.*)(_Post_count_\(.*\) )(.*)'), 276 | re.compile(r'(.*)(_Post_bytecount_\(.*\) )(.*)'), 277 | ] 278 | 279 | search_end = 0 280 | for line in f: 281 | line = line.strip() 282 | if "APIENTRY" == line: 283 | continue 284 | 285 | for REXP in R_except: 286 | line = REXP.sub(r'\1\3', line) 287 | 288 | line = R_all.sub(r'\1\3', line) #"111/*222*/333" -> "111333" 289 | line = line.split("//", 1)[0] #"111//22222222" -> "111" 290 | 291 | R = R_left.match(line) #"111/*222" -> "111" 292 | if R: 293 | search_end = 1 294 | line = R.group(1) 295 | else: 296 | if search_end: 297 | R = R_right.match(line) #"111*/222" -> "222" 298 | if R: 299 | search_end = 0 300 | line = R.group(2) 301 | else: 302 | line = "" #"/*111*/" -> "" 303 | if line: 304 | lines.append(line) 305 | 306 | f.close() 307 | return lines 308 | 309 | 310 | process_lines(load_gdi32_file("ntgdi_reactos.h")) 311 | process_lines(load_user32_file("ntuser_reactos.h")) 312 | process_lines(load_user32_file("ntuser_w2k.h")) 313 | 314 | f = open("H_APIs.h", "w") 315 | for k,v in g_func_dict.iteritems(): 316 | f.write("%s %s(%s);//%d\n" % (v[0], k, v[2], v[1])) 317 | f.close() 318 | 319 | out_str = "Found APIs: %d\n(Valid)%d + (Unknown)%d = (Procss)%d\nDuplicate APIs: %d" % \ 320 | (g_Count, len(g_func_dict), g_Unknown, len(g_func_dict) + g_Unknown, g_Duplicate) 321 | print(out_str) 322 | 323 | -------------------------------------------------------------------------------- /output_win7_sp1/gdi32_x86.txt: -------------------------------------------------------------------------------- 1 | /*0x1099,00*/DWORD NtGdiFlush(VOID); 2 | /*0x12dc,03*/_UNKNOWN NtGdiSfmGetNotificationTokens(_UNKNOWN,_UNKNOWN,_UNKNOWN); 3 | /*0x12fe,01*/_UNKNOWN NtGdiDdDDIGetPresentHistory(_UNKNOWN); 4 | /*0x1306,01*/_UNKNOWN NtGdiDdDDIGetDeviceState(_UNKNOWN); 5 | /*0x12f6,01*/_UNKNOWN NtGdiDdDDIRender(_UNKNOWN); 6 | /*0x1320,01*/_UNKNOWN NtGdiDdDDICheckVidPnExclusiveOwnership(_UNKNOWN); 7 | /*0x1304,01*/_UNKNOWN NtGdiDdDDIWaitForVerticalBlankEvent(_UNKNOWN); 8 | /*0x1314,01*/_UNKNOWN NtGdiDdDDICheckMonitorPowerState(_UNKNOWN); 9 | /*0x12f5,01*/_UNKNOWN NtGdiDdDDIPresent(_UNKNOWN); 10 | /*0x10fa,04*/BOOL NtGdiPolyTextOutW(HDC,POLYTEXTW*,UINT,DWORD); 11 | /*0x10f5,05*/BOOL NtGdiPolyPatBlt(HDC,DWORD,PPOLYPATBLT,DWORD,DWORD); 12 | /*0x10f4,06*/BOOL NtGdiPatBlt(HDC,INT,INT,INT,INT,DWORD); 13 | /*0x1015,04*/INT NtGdiCombineRgn(HRGN,HRGN,HRGN,INT); 14 | /*0x110b,02*/HBITMAP NtGdiSelectBitmap(HDC,HBITMAP); 15 | /*0x1020,01*/HDC NtGdiCreateCompatibleDC(HDC); 16 | /*0x101a,05*/HBITMAP NtGdiCreateBitmap(INT,INT,UINT,UINT,PBYTE); 17 | /*0x102f,02*/HBRUSH NtGdiCreateSolidBrush(COLORREF,HBRUSH); 18 | /*0x10fe,01*/ULONG NtGdiQueryFontAssocInfo(HDC); 19 | /*0x10d1,01*/HANDLE NtGdiGetStockObject(INT); 20 | /*0x107d,01*/BOOL NtGdiDeleteObjectApp(HANDLE); 21 | /*0x10b0,02*/INT NtGdiGetDeviceCaps(HDC,INT); 22 | /*0x100e,11*/BOOL NtGdiBitBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,DWORD,DWORD,FLONG); 23 | /*0x12db,03*/BOOL NtGdiDrawStream(HDC,ULONG,PVOID); 24 | /*0x101f,03*/HBITMAP NtGdiCreateCompatibleBitmap(HDC,INT,INT); 25 | /*0x1093,03*/INT NtGdiExtGetObjectW(HANDLE,INT,PVOID); 26 | /*0x10ae,02*/HANDLE NtGdiGetDCObject(HDC,INT); 27 | /*0x10f2,03*/INT NtGdiOffsetRgn(HRGN,INT,INT); 28 | /*0x10cd,02*/INT NtGdiGetRgnBox(HRGN,OUT LPRECT); 29 | /*0x10e8,05*/INT NtGdiIntersectClipRect(HDC,INT,INT,INT,INT); 30 | /*0x10ac,03*/BOOL NtGdiGetDCDword(HDC,UINT,OUT PDWORD); 31 | /*0x10c9,03*/INT NtGdiGetRandomRgn(HDC,HRGN,INT); 32 | /*0x1094,03*/INT NtGdiExtSelectClipRgn(HDC,HRGN,INT); 33 | /*0x10a6,01*/DWORD NtGdiGetCharSet(HDC); 34 | /*0x1095,09*/BOOL NtGdiExtTextOutW(HDC,INT,INT,UINT,LPRECT,PWSTR,INT,PINT,DWORD); 35 | /*0x110e,02*/HFONT NtGdiSelectFont(HDC,HFONT); 36 | /*0x1007,12*/BOOL NtGdiAlphaBlend(HDC,LONG,LONG,LONG,LONG,HDC,LONG,LONG,LONG,LONG,BLENDFUNCTION,HANDLE); 37 | /*0x109e,02*/INT NtGdiGetAppClipBox(HDC,OUT LPRECT); 38 | /*0x1023,09*/HBITMAP NtGdiCreateDIBSection(HDC,HANDLE,DWORD,LPBITMAPINFO,DWORD,UINT,FLONG,ULONG_PTR,OUT PVOID*); 39 | /*0x1101,02*/BOOL NtGdiRectVisible(HDC,LPRECT); 40 | /*0x10cc,03*/ULONG NtGdiGetRegionData(HRGN,ULONG,LPRGNDATA); 41 | /*0x12dd,04*/BOOL NtGdiHLSurfGetInformation(HLSURF,HLSURF_INFORMATION_CLASS,PVOID,OUT PULONG); 42 | /*0x12e2,01*/_UNKNOWN NtGdiDdDDIDestroyAllocation(_UNKNOWN); 43 | /*0x12de,04*/BOOL NtGdiHLSurfSetInformation(HLSURF,HLSURF_INFORMATION_CLASS,PVOID,ULONG); 44 | /*0x108e,05*/INT NtGdiExcludeClipRect(HDC,INT,INT,INT,INT); 45 | /*0x102d,06*/HRGN NtGdiCreateRoundRectRgn(INT,INT,INT,INT,INT,INT); 46 | /*0x12df,01*/_UNKNOWN NtGdiDdDDICreateAllocation(_UNKNOWN); 47 | /*0x12e0,01*/_UNKNOWN NtGdiDdDDIQueryResourceInfo(_UNKNOWN); 48 | /*0x12e1,01*/_UNKNOWN NtGdiDdDDIOpenResource(_UNKNOWN); 49 | /*0x1133,05*/BOOL NtGdiTransformPoints(HDC,LPPOINT,LPPOINT,INT,INT); 50 | /*0x1111,03*/LONG NtGdiSetBitmapBits(HBITMAP,ULONG,PBYTE); 51 | /*0x1123,03*/DWORD NtGdiSetLayout(HDC,LONG,DWORD); 52 | /*0x10e6,00*/DWORD NtGdiInit(VOID); 53 | /*0x1082,06*/LONG NtGdiDoPalette(HGDIOBJ,WORD,WORD,PVOID,DWORD,BOOL); 54 | /*0x102c,04*/HRGN NtGdiCreateRectRgn(INT,INT,INT,INT); 55 | /*0x1217,03*/HPALETTE NtUserSelectPalette(HDC,HPALETTE,BOOL); 56 | /*0x10b3,09*/INT NtGdiGetDIBitsInternal(HDC,HBITMAP,UINT,UINT,PBYTE,OUT LPBITMAPINFO,UINT,UINT,UINT); 57 | /*0x1022,11*/HBITMAP NtGdiCreateDIBitmapInternal(HDC,INT,INT,DWORD,PBYTE,LPBITMAPINFO,DWORD,UINT,UINT,FLONG,HANDLE); 58 | /*0x112f,16*/INT NtGdiStretchDIBitsInternal(HDC,INT,INT,INT,INT,INT,INT,INT,INT,PBYTE,LPBITMAPINFO,DWORD,DWORD,UINT,UINT,HANDLE); 59 | /*0x1106,02*/BOOL NtGdiRestoreDC(HDC,INT); 60 | /*0x1108,01*/INT NtGdiSaveDC(HDC); 61 | /*0x1119,16*/INT NtGdiSetDIBitsToDeviceInternal(HDC,INT,INT,DWORD,DWORD,INT,INT,DWORD,DWORD,PBYTE,LPBITMAPINFO,DWORD,UINT,UINT,BOOL,HANDLE); 62 | /*0x10ad,01*/HDC NtGdiGetDCforBitmap(HBITMAP); 63 | /*0x10e4,05*/HFONT NtGdiHfontCreate(ENUMLOGFONTEXDVW*,ULONG,LFTYPE,FLONG,PVOID); 64 | /*0x102a,03*/HBRUSH NtGdiCreatePatternBrushInternal(HBITMAP,BOOL,BOOL); 65 | /*0x10d9,03*/BOOL NtGdiGetTextMetricsW(HDC,TMW_INTERNAL*,ULONG); 66 | /*0x10cb,02*/BOOL NtGdiGetRealizationInfo(HDC,OUT PFONT_REALIZATION_INFO); 67 | /*0x10d5,03*/INT NtGdiGetTextCharsetInfo(HDC,LPFONTSIGNATURE,DWORD); 68 | /*0x1029,02*/HPALETTE NtGdiCreatePaletteInternal(LPLOGPALETTE,UINT); 69 | /*0x10c2,02*/COLORREF NtGdiGetNearestColor(HDC,COLORREF); 70 | /*0x111a,01*/ULONG NtGdiSetFontEnumeration(ULONG); 71 | /*0x10d8,04*/INT NtGdiGetTextFaceW(HDC,INT,PWSTR,BOOL); 72 | /*0x10ba,05*/DWORD NtGdiGetGlyphIndicesW(HDC,PCWSTR,INT,PWORD,DWORD); 73 | /*0x10e2,07*/BOOL NtGdiGetWidthTable(HDC,ULONG,PWCHAR,ULONG,PUSHORT,OUT WIDTHDATA*,OUT FLONG*); 74 | /*0x10c6,04*/ULONG NtGdiGetOutlineTextMetricsInternalW(HDC,ULONG,OUTLINETEXTMETRICW*,OUT TMDIFF*); 75 | /*0x10b6,05*/ULONG NtGdiGetFontData(HDC,DWORD,DWORD,PVOID,ULONG); 76 | /*0x10a4,06*/BOOL NtGdiGetCharABCWidthsW(HDC,UINT,ULONG,PWCHAR,FLONG,PVOID); 77 | /*0x100a,01*/BOOL NtGdiFontIsLinked(HDC); 78 | /*0x1009,00*/DWORD NtGdiAnyLinkedFonts(VOID); 79 | /*0x10d7,08*/BOOL NtGdiGetTextExtentExW(HDC,PWSTR,ULONG,ULONG,OUT PULONG,PULONG,OUT LPSIZE,FLONG); 80 | /*0x10a8,02*/BOOL NtGdiGetCharWidthInfo(HDC,OUT PCHWIDTHINFO); 81 | /*0x1113,03*/DWORD NtGdiSetBoundsRect(HDC,LPRECT,DWORD); 82 | /*0x10a1,03*/DWORD NtGdiGetBoundsRect(HDC,OUT LPRECT,DWORD); 83 | /*0x1090,03*/HRGN NtGdiExtCreateRegion(LPXFORM,DWORD,LPRGNDATA); 84 | /*0x109f,03*/LONG NtGdiGetBitmapBits(HBITMAP,ULONG,PBYTE); 85 | /*0x1025,01*/HPALETTE NtGdiCreateHalftonePalette(HDC); 86 | /*0x10c8,03*/DWORD NtGdiGetPixel(HDC,INT,INT); 87 | /*0x10ed,13*/BOOL NtGdiMaskBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,HBITMAP,INT,INT,DWORD,DWORD); 88 | /*0x10ee,03*/BOOL NtGdiModifyWorldTransform(HDC,LPXFORM,DWORD); 89 | /*0x10da,03*/BOOL NtGdiGetTransform(HDC,DWORD,OUT LPXFORM); 90 | /*0x10f3,08*/_UNKNOWN NtGdiOpenDCW(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 91 | /*0x12f0,01*/_UNKNOWN NtGdiDdDDILock(_UNKNOWN); 92 | /*0x12f1,01*/_UNKNOWN NtGdiDdDDIUnlock(_UNKNOWN); 93 | /*0x12fb,01*/_UNKNOWN NtGdiDdDDIEscape(_UNKNOWN); 94 | /*0x12ef,01*/_UNKNOWN NtGdiDdDDIQueryAdapterInfo(_UNKNOWN); 95 | /*0x12f8,01*/_UNKNOWN NtGdiDdDDIOpenAdapterFromHdc(_UNKNOWN); 96 | /*0x12f9,01*/_UNKNOWN NtGdiDdDDICloseAdapter(_UNKNOWN); 97 | /*0x12e7,01*/_UNKNOWN NtGdiDdDDICreateContext(_UNKNOWN); 98 | /*0x12e5,01*/_UNKNOWN NtGdiDdDDICreateDevice(_UNKNOWN); 99 | /*0x108a,08*/BOOL NtGdiEnumFonts(HDC,ULONG,FLONG,ULONG,PCWSTR,ULONG,OUT PULONG,PVOID); 100 | /*0x12fd,01*/_UNKNOWN NtGdiDdDDISetVidPnSourceOwner(_UNKNOWN); 101 | /*0x12f3,01*/_UNKNOWN NtGdiDdDDISetDisplayMode(_UNKNOWN); 102 | /*0x12ff,02*/_UNKNOWN NtGdiDdDDIGetPresentQueueEvent(_UNKNOWN,_UNKNOWN); 103 | /*0x12f7,01*/_UNKNOWN NtGdiDdDDIOpenAdapterFromDeviceName(_UNKNOWN); 104 | /*0x130b,02*/_UNKNOWN NtGdiDdDDISetProcessSchedulingPriorityClass(_UNKNOWN,_UNKNOWN); 105 | /*0x1002,06*/INT NtGdiAddFontResourceW(PWCHAR,ULONG,ULONG,FLONG,DWORD,DESIGNVECTOR*); 106 | /*0x1085,01*/BOOL NtGdiEnableEudc(BOOL); 107 | /*0x1110,02*/HBITMAP NtGdiSetBitmapAttributes(HBITMAP,DWORD); 108 | /*0x1100,02*/BOOL NtGdiRectInRegion(HRGN,OUT LPRECT); 109 | /*0x10f9,05*/ULONG_PTR NtGdiPolyPolyDraw(HDC,LPPOINT,PULONG,ULONG,INT); 110 | /*0x10ff,05*/BOOL NtGdiRectangle(HDC,INT,INT,INT,INT); 111 | /*0x10fb,03*/BOOL NtGdiPtInRegion(HRGN,INT,INT); 112 | /*0x12f2,01*/_UNKNOWN NtGdiDdDDIGetDisplayModeList(_UNKNOWN); 113 | /*0x12e8,01*/_UNKNOWN NtGdiDdDDIDestroyContext(_UNKNOWN); 114 | /*0x12e6,01*/_UNKNOWN NtGdiDdDDIDestroyDevice(_UNKNOWN); 115 | /*0x130e,01*/_UNKNOWN NtGdiDdDDIGetScanLine(_UNKNOWN); 116 | /*0x1315,00*/DWORD NtGdiDdDDICheckExclusiveOwnership(VOID); 117 | /*0x107f,01*/_UNKNOWN NtGdiDestroyOPMProtectedOutput(_UNKNOWN); 118 | /*0x12eb,01*/_UNKNOWN NtGdiDdDDIDestroySynchronizationObject(_UNKNOWN); 119 | /*0x12e4,01*/_UNKNOWN NtGdiDdDDIQueryAllocationResidency(_UNKNOWN); 120 | /*0x1309,01*/_UNKNOWN NtGdiDdDDISetContextSchedulingPriority(_UNKNOWN); 121 | /*0x12e3,01*/_UNKNOWN NtGdiDdDDISetAllocationPriority(_UNKNOWN); 122 | /*0x12fa,01*/_UNKNOWN NtGdiDdDDIGetSharedPrimaryHandle(_UNKNOWN); 123 | /*0x112e,12*/BOOL NtGdiStretchBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,INT,INT,DWORD,DWORD); 124 | /*0x102b,04*/HPEN NtGdiCreatePen(INT,INT,COLORREF,HBRUSH); 125 | /*0x10ea,03*/BOOL NtGdiLineTo(HDC,INT,INT); 126 | /*0x1017,01*/BOOL NtGdiComputeXformCoefficients(HDC); 127 | /*0x10e3,06*/BOOL NtGdiGradientFill(HDC,PTRIVERTEX,ULONG,PVOID,ULONG,ULONG); 128 | /*0x1134,11*/BOOL NtGdiTransparentBlt(HDC,INT,INT,INT,INT,HDC,INT,INT,INT,INT,COLORREF); 129 | /*0x108c,02*/BOOL NtGdiEqualRgn(HRGN,HRGN); 130 | /*0x10af,03*/BOOL NtGdiGetDCPoint(HDC,UINT,OUT PPOINTL); 131 | /*0x10a7,06*/BOOL NtGdiGetCharWidthW(HDC,UINT,UINT,PWCHAR,FLONG,PVOID); 132 | /*0x10e1,02*/DWORD NtGdiGetFontUnicodeRanges(HDC,LPGLYPHSET); 133 | /*0x1021,06*/HBRUSH NtGdiCreateDIBBrush(PVOID,FLONG,UINT,BOOL,BOOL,PVOID); 134 | /*0x1097,03*/BOOL NtGdiFillRgn(HDC,HRGN,HBRUSH); 135 | /*0x1115,04*/BOOL NtGdiSetBrushOrg(HDC,INT,INT,OUT LPPOINT); 136 | /*0x10b2,02*/BOOL NtGdiGetDeviceCapsAll(HDC,OUT PDEVCAPS); 137 | /*0x109d,04*/BOOL NtGdiGetAndSetDCDword(HDC,UINT,DWORD,OUT PDWORD); 138 | /*0x111c,03*/BOOL NtGdiSetIcmMode(HDC,ULONG,ULONG); 139 | /*0x12d8,04*/BOOL NtGdiSetPUMPDOBJ(HUMPD,BOOL,OUT HUMPD*,OUT PBOOL); 140 | /*0x129f,01*/BOOL NtGdiEngDeletePalette(HPALETTE); 141 | /*0x129c,06*/HPALETTE NtGdiEngCreatePalette(ULONG,ULONG,PULONG,FLONG,FLONG,FLONG); 142 | /*0x1091,08*/INT NtGdiExtEscape(HDC,PWCHAR,INT,INT,INT,PSTR,INT,PSTR); 143 | /*0x107a,01*/BOOL NtGdiDeleteClientObj(HANDLE); 144 | /*0x101c,01*/HANDLE NtGdiCreateClientObj(ULONG); 145 | /*0x10c3,02*/UINT NtGdiGetNearestPaletteIndex(HPALETTE,COLORREF); 146 | /*0x10d4,01*/UINT NtGdiGetSystemPaletteUse(HDC); 147 | /*0x103e,01*/HANDLE NtGdiDdCreateDirectDrawObject(HDC); 148 | /*0x10e9,02*/BOOL NtGdiInvertRgn(HDC,HRGN); 149 | /*0x10ef,01*/BOOL NtGdiMonoBitmap(HBITMAP); 150 | /*0x10c1,03*/BOOL NtGdiGetMonitorID(HDC,DWORD,PWSTR); 151 | /*0x10c0,02*/BOOL NtGdiGetMiterLimit(HDC,OUT PDWORD); 152 | /*0x10c4,02*/HBITMAP NtGdiGetObjectBitmapHandle(HBRUSH,OUT PUINT); 153 | /*0x10b8,05*/DWORD NtGdiGetFontFileInfo(UINT,UINT,PFONT_FILE_INFO,SIZE_T,OUT PSIZE_T); 154 | /*0x1016,03*/BOOL NtGdiCombineTransform(OUT LPXFORM,LPXFORM,LPXFORM); 155 | /*0x112a,05*/BOOL NtGdiSetVirtualResolution(HDC,INT,INT,INT,INT); 156 | /*0x1027,01*/HDC NtGdiCreateMetafileDC(HDC); 157 | /*0x112b,03*/BOOL NtGdiSetSizeDevice(HDC,INT,INT); 158 | /*0x111f,01*/INT NtGdiSetMetaRgn(HDC); 159 | /*0x1120,03*/BOOL NtGdiSetMiterLimit(HDC,DWORD,OUT PDWORD); 160 | /*0x111b,03*/BOOL NtGdiSetFontXform(HDC,DWORD,DWORD); 161 | /*0x1092,05*/BOOL NtGdiExtFloodFill(HDC,INT,INT,COLORREF,UINT); 162 | /*0x10be,03*/ULONG NtGdiGetKerningPairs(HDC,ULONG,KERNINGPAIR*); 163 | /*0x1107,07*/BOOL NtGdiRoundRect(HDC,INT,INT,INT,INT,INT,INT); 164 | /*0x1104,05*/BOOL NtGdiResetDC(HDC,LPDEVMODEW,OUT PBOOL,DRIVER_INFO_2W*,PVOID); 165 | /*0x10f7,11*/BOOL NtGdiPlgBlt(HDC,LPPOINT,HDC,INT,INT,INT,INT,HBITMAP,INT,INT,DWORD); 166 | /*0x130f,01*/_UNKNOWN NtGdiDdDDISetQueuedLimit(_UNKNOWN); 167 | /*0x131e,01*/_UNKNOWN NtGdiDdDDIConfigureSharedResource(_UNKNOWN); 168 | /*0x1321,01*/_UNKNOWN NtGdiDdDDICheckSharedResourceAccess(_UNKNOWN); 169 | /*0x1124,02*/_UNKNOWN NtGdiSetOPMSigningKeyAndSequenceNumbers(_UNKNOWN,_UNKNOWN); 170 | /*0x1028,05*/_UNKNOWN NtGdiCreateOPMProtectedOutputs(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 171 | /*0x10a2,04*/_UNKNOWN NtGdiGetCertificate(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 172 | /*0x10a3,03*/_UNKNOWN NtGdiGetCertificateSize(_UNKNOWN,_UNKNOWN,_UNKNOWN); 173 | /*0x10c5,02*/_UNKNOWN NtGdiGetOPMRandomNumber(_UNKNOWN,_UNKNOWN); 174 | /*0x10d3,02*/_UNKNOWN NtGdiGetSuggestedOPMProtectedOutputArraySize(_UNKNOWN,_UNKNOWN); 175 | /*0x10bd,03*/_UNKNOWN NtGdiGetOPMInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN); 176 | /*0x12ed,01*/_UNKNOWN NtGdiDdDDISignalSynchronizationObject(_UNKNOWN); 177 | /*0x12ec,01*/_UNKNOWN NtGdiDdDDIWaitForSynchronizationObject(_UNKNOWN); 178 | /*0x12e9,01*/_UNKNOWN NtGdiDdDDICreateSynchronizationObject(_UNKNOWN); 179 | /*0x1307,01*/_UNKNOWN NtGdiDdDDICreateDCFromMemory(_UNKNOWN); 180 | /*0x1308,01*/_UNKNOWN NtGdiDdDDIDestroyDCFromMemory(_UNKNOWN); 181 | /*0x1125,04*/COLORREF NtGdiSetPixel(HDC,INT,INT,COLORREF); 182 | /*0x108f,11*/HPEN NtGdiExtCreatePen(ULONG,ULONG,ULONG,ULONG,ULONG_PTR,ULONG_PTR,ULONG,PULONG,ULONG,BOOL,HBRUSH); 183 | /*0x1000,01*/BOOL NtGdiAbortDoc(HDC); 184 | /*0x1001,01*/BOOL NtGdiAbortPath(HDC); 185 | /*0x1003,04*/BOOL NtGdiAddRemoteFontToDC(HDC,PVOID,ULONG,PUNIVERSAL_FONT_ID); 186 | /*0x1004,05*/HANDLE NtGdiAddFontMemResourceEx(PVOID,DWORD,DESIGNVECTOR*,ULONG,OUT PDWORD); 187 | /*0x1005,02*/BOOL NtGdiRemoveMergeFont(HDC,UNIVERSAL_FONT_ID*); 188 | /*0x1006,03*/BOOL NtGdiAddRemoteMMInstanceToDC(HDC,DOWNLOADDESIGNVECTOR*,ULONG); 189 | /*0x1008,06*/BOOL NtGdiAngleArc(HDC,INT,INT,DWORD,DWORD,DWORD); 190 | /*0x100b,10*/BOOL NtGdiArcInternal(ARCTYPE,HDC,INT,INT,INT,INT,INT,INT,INT,INT); 191 | /*0x100c,02*/_UNKNOWN NtGdiBeginGdiRendering(_UNKNOWN,_UNKNOWN); 192 | /*0x100d,01*/BOOL NtGdiBeginPath(HDC); 193 | /*0x100f,01*/BOOL NtGdiCancelDC(HDC); 194 | /*0x1010,08*/BOOL NtGdiCheckBitmapBits(HDC,HANDLE,PVOID,ULONG,DWORD,DWORD,DWORD,PBYTE); 195 | /*0x1011,01*/BOOL NtGdiCloseFigure(HDC); 196 | /*0x1012,02*/HBITMAP NtGdiClearBitmapAttributes(HBITMAP,DWORD); 197 | /*0x1013,02*/HBRUSH NtGdiClearBrushAttributes(HBRUSH,DWORD); 198 | /*0x1014,06*/ULONG NtGdiColorCorrectPalette(HDC,HPALETTE,ULONG,ULONG,PALETTEENTRY*,ULONG); 199 | /*0x1018,04*/_UNKNOWN NtGdiConfigureOPMProtectedOutput(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 200 | /*0x1019,02*/LONG NtGdiConvertMetafileRect(HDC,OUT PRECTL); 201 | /*0x101b,05*/HBITMAP NtGdiCreateBitmapFromDxSurface(HDC,UINT,UINT,DWORD,HANDLE); 202 | /*0x101d,01*/HANDLE NtGdiCreateColorSpace(PLOGCOLORSPACEEXW); 203 | /*0x101e,08*/HANDLE NtGdiCreateColorTransform(HDC,LPLOGCOLORSPACEW,PVOID,ULONG,PVOID,ULONG,PVOID,ULONG); 204 | /*0x1024,04*/HRGN NtGdiCreateEllipticRgn(INT,INT,INT,INT); 205 | /*0x1026,03*/HBRUSH NtGdiCreateHatchBrushInternal(ULONG,COLORREF,BOOL); 206 | /*0x102e,06*/HANDLE NtGdiCreateServerMetaFile(DWORD,ULONG,PBYTE,DWORD,DWORD,DWORD); 207 | /*0x1030,04*/BOOL NtGdiD3dContextCreate(HANDLE,HANDLE,HANDLE,OUT D3DNTHAL_CONTEXTCREATEI*); 208 | /*0x1031,01*/DWORD NtGdiD3dContextDestroy(LPD3DNTHAL_CONTEXTDESTROYDATA); 209 | /*0x1032,01*/DWORD NtGdiD3dContextDestroyAll(OUT LPD3DNTHAL_CONTEXTDESTROYALLDATA); 210 | /*0x1033,01*/DWORD NtGdiD3dValidateTextureStageState(OUT LPD3DNTHAL_VALIDATETEXTURESTAGESTATEDATA); 211 | /*0x1034,07*/DWORD NtGdiD3dDrawPrimitives2(HANDLE,HANDLE,OUT LPD3DNTHAL_DRAWPRIMITIVES2DATA,OUT FLATPTR*,OUT PDWORD,OUT FLATPTR*,OUT PDWORD); 212 | /*0x1035,01*/DWORD NtGdiDdGetDriverState(OUT PDD_GETDRIVERSTATEDATA); 213 | /*0x1036,03*/DWORD NtGdiDdAddAttachedSurface(HANDLE,HANDLE,OUT PDD_ADDATTACHEDSURFACEDATA); 214 | /*0x1037,03*/DWORD NtGdiDdAlphaBlt(HANDLE,HANDLE,OUT PDD_BLTDATA); 215 | /*0x1038,02*/BOOL NtGdiDdAttachSurface(HANDLE,HANDLE); 216 | /*0x1039,02*/DWORD NtGdiDdBeginMoCompFrame(HANDLE,OUT PDD_BEGINMOCOMPFRAMEDATA); 217 | /*0x103a,03*/DWORD NtGdiDdBlt(HANDLE,HANDLE,OUT PDD_BLTDATA); 218 | /*0x103b,02*/DWORD NtGdiDdCanCreateSurface(HANDLE,OUT PDD_CANCREATESURFACEDATA); 219 | /*0x103c,02*/DWORD NtGdiDdCanCreateD3DBuffer(HANDLE,OUT PDD_CANCREATESURFACEDATA); 220 | /*0x103d,02*/DWORD NtGdiDdColorControl(HANDLE,OUT PDD_COLORCONTROLDATA); 221 | /*0x103f,08*/DWORD NtGdiDdCreateSurface(HANDLE,HANDLE*,OUT DDSURFACEDESC*,OUT DD_SURFACE_GLOBAL*,OUT DD_SURFACE_LOCAL*,OUT DD_SURFACE_MORE*,OUT DD_CREATESURFACEDATA*,OUT HANDLE*); 222 | /*0x1040,08*/DWORD NtGdiDdCreateD3DBuffer(HANDLE,OUT HANDLE*,OUT DDSURFACEDESC*,OUT DD_SURFACE_GLOBAL*,OUT DD_SURFACE_LOCAL*,OUT DD_SURFACE_MORE*,OUT DD_CREATESURFACEDATA*,OUT HANDLE*); 223 | /*0x1041,02*/HANDLE NtGdiDdCreateMoComp(HANDLE,OUT PDD_CREATEMOCOMPDATA); 224 | /*0x1042,06*/HANDLE NtGdiDdCreateSurfaceObject(HANDLE,HANDLE,PDD_SURFACE_LOCAL,PDD_SURFACE_MORE,PDD_SURFACE_GLOBAL,BOOL); 225 | /*0x1043,01*/BOOL NtGdiDdDeleteDirectDrawObject(HANDLE); 226 | /*0x1044,01*/BOOL NtGdiDdDeleteSurfaceObject(HANDLE); 227 | /*0x1045,02*/DWORD NtGdiDdDestroyMoComp(HANDLE,OUT PDD_DESTROYMOCOMPDATA); 228 | /*0x1046,02*/DWORD NtGdiDdDestroySurface(HANDLE,BOOL); 229 | /*0x1047,01*/DWORD NtGdiDdDestroyD3DBuffer(HANDLE); 230 | /*0x1048,02*/DWORD NtGdiDdEndMoCompFrame(HANDLE,OUT PDD_ENDMOCOMPFRAMEDATA); 231 | /*0x1049,05*/DWORD NtGdiDdFlip(HANDLE,HANDLE,HANDLE,HANDLE,OUT PDD_FLIPDATA); 232 | /*0x104a,02*/DWORD NtGdiDdFlipToGDISurface(HANDLE,OUT PDD_FLIPTOGDISURFACEDATA); 233 | /*0x104b,02*/DWORD NtGdiDdGetAvailDriverMemory(HANDLE,OUT PDD_GETAVAILDRIVERMEMORYDATA); 234 | /*0x104c,02*/DWORD NtGdiDdGetBltStatus(HANDLE,OUT PDD_GETBLTSTATUSDATA); 235 | /*0x104d,02*/HDC NtGdiDdGetDC(HANDLE,PALETTEENTRY*); 236 | /*0x104e,02*/DWORD NtGdiDdGetDriverInfo(HANDLE,OUT PDD_GETDRIVERINFODATA); 237 | /*0x104f,03*/HANDLE NtGdiDdGetDxHandle(HANDLE,HANDLE,BOOL); 238 | /*0x1050,02*/DWORD NtGdiDdGetFlipStatus(HANDLE,OUT PDD_GETFLIPSTATUSDATA); 239 | /*0x1051,02*/DWORD NtGdiDdGetInternalMoCompInfo(HANDLE,OUT PDD_GETINTERNALMOCOMPDATA); 240 | /*0x1052,02*/DWORD NtGdiDdGetMoCompBuffInfo(HANDLE,OUT PDD_GETMOCOMPCOMPBUFFDATA); 241 | /*0x1053,02*/DWORD NtGdiDdGetMoCompGuids(HANDLE,OUT PDD_GETMOCOMPGUIDSDATA); 242 | /*0x1054,02*/DWORD NtGdiDdGetMoCompFormats(HANDLE,OUT PDD_GETMOCOMPFORMATSDATA); 243 | /*0x1055,02*/DWORD NtGdiDdGetScanLine(HANDLE,OUT PDD_GETSCANLINEDATA); 244 | /*0x1056,03*/DWORD NtGdiDdLock(HANDLE,OUT PDD_LOCKDATA,HDC); 245 | /*0x1057,02*/DWORD NtGdiDdLockD3D(HANDLE,OUT PDD_LOCKDATA); 246 | /*0x1058,11*/BOOL NtGdiDdQueryDirectDrawObject(HANDLE,OUT PDD_HALINFO,PDWORD,OUT LPD3DNTHAL_CALLBACKS,OUT LPD3DNTHAL_GLOBALDRIVERDATA,OUT PDD_D3DBUFCALLBACKS,OUT LPDDSURFACEDESC,OUT PDWORD,OUT VIDEOMEMORY*,OUT PDWORD,OUT PDWORD); 247 | /*0x1059,02*/DWORD NtGdiDdQueryMoCompStatus(HANDLE,OUT PDD_QUERYMOCOMPSTATUSDATA); 248 | /*0x105a,02*/BOOL NtGdiDdReenableDirectDrawObject(HANDLE,OUT PBOOL); 249 | /*0x105b,01*/BOOL NtGdiDdReleaseDC(HANDLE); 250 | /*0x105c,02*/DWORD NtGdiDdRenderMoComp(HANDLE,OUT PDD_RENDERMOCOMPDATA); 251 | /*0x105d,02*/BOOL NtGdiDdResetVisrgn(HANDLE,HWND); 252 | /*0x105e,02*/DWORD NtGdiDdSetColorKey(HANDLE,OUT PDD_SETCOLORKEYDATA); 253 | /*0x105f,02*/DWORD NtGdiDdSetExclusiveMode(HANDLE,OUT PDD_SETEXCLUSIVEMODEDATA); 254 | /*0x1060,03*/BOOL NtGdiDdSetGammaRamp(HANDLE,HDC,PVOID); 255 | /*0x1061,03*/DWORD NtGdiDdCreateSurfaceEx(HANDLE,HANDLE,DWORD); 256 | /*0x1062,03*/DWORD NtGdiDdSetOverlayPosition(HANDLE,HANDLE,OUT PDD_SETOVERLAYPOSITIONDATA); 257 | /*0x1063,02*/NTSTATUS NtGdiDdUnattachSurface(HANDLE,HANDLE); 258 | /*0x1064,02*/DWORD NtGdiDdUnlock(HANDLE,OUT PDD_UNLOCKDATA); 259 | /*0x1065,02*/DWORD NtGdiDdUnlockD3D(HANDLE,OUT PDD_UNLOCKDATA); 260 | /*0x1066,03*/DWORD NtGdiDdUpdateOverlay(HANDLE,HANDLE,OUT PDD_UPDATEOVERLAYDATA); 261 | /*0x1067,02*/DWORD NtGdiDdWaitForVerticalBlank(HANDLE,OUT PDD_WAITFORVERTICALBLANKDATA); 262 | /*0x1068,02*/DWORD NtGdiDvpCanCreateVideoPort(HANDLE,OUT PDD_CANCREATEVPORTDATA); 263 | /*0x1069,02*/DWORD NtGdiDvpColorControl(HANDLE,OUT PDD_VPORTCOLORDATA); 264 | /*0x106a,02*/HANDLE NtGdiDvpCreateVideoPort(HANDLE,OUT PDD_CREATEVPORTDATA); 265 | /*0x106b,02*/DWORD NtGdiDvpDestroyVideoPort(HANDLE,OUT PDD_DESTROYVPORTDATA); 266 | /*0x106c,04*/DWORD NtGdiDvpFlipVideoPort(HANDLE,HANDLE,HANDLE,OUT PDD_FLIPVPORTDATA); 267 | /*0x106d,02*/DWORD NtGdiDvpGetVideoPortBandwidth(HANDLE,OUT PDD_GETVPORTBANDWIDTHDATA); 268 | /*0x106e,02*/DWORD NtGdiDvpGetVideoPortField(HANDLE,OUT PDD_GETVPORTFIELDDATA); 269 | /*0x106f,02*/DWORD NtGdiDvpGetVideoPortFlipStatus(HANDLE,OUT PDD_GETVPORTFLIPSTATUSDATA); 270 | /*0x1070,02*/DWORD NtGdiDvpGetVideoPortInputFormats(HANDLE,OUT PDD_GETVPORTINPUTFORMATDATA); 271 | /*0x1071,02*/DWORD NtGdiDvpGetVideoPortLine(HANDLE,OUT PDD_GETVPORTLINEDATA); 272 | /*0x1072,02*/DWORD NtGdiDvpGetVideoPortOutputFormats(HANDLE,OUT PDD_GETVPORTOUTPUTFORMATDATA); 273 | /*0x1073,02*/DWORD NtGdiDvpGetVideoPortConnectInfo(HANDLE,OUT PDD_GETVPORTCONNECTDATA); 274 | /*0x1074,02*/DWORD NtGdiDvpGetVideoSignalStatus(HANDLE,OUT PDD_GETVPORTSIGNALDATA); 275 | /*0x1075,04*/DWORD NtGdiDvpUpdateVideoPort(HANDLE,HANDLE*,HANDLE*,OUT PDD_UPDATEVPORTDATA); 276 | /*0x1076,02*/DWORD NtGdiDvpWaitForVideoPortSync(HANDLE,OUT PDD_WAITFORVPORTSYNCDATA); 277 | /*0x1077,03*/DWORD NtGdiDvpAcquireNotification(HANDLE,OUT HANDLE*,LPDDVIDEOPORTNOTIFY); 278 | /*0x1078,02*/DWORD NtGdiDvpReleaseNotification(HANDLE,HANDLE); 279 | /*0x1079,06*/DWORD NtGdiDxgGenericThunk(ULONG_PTR,ULONG_PTR,OUT SIZE_T*,OUT PVOID,OUT SIZE_T*,OUT PVOID); 280 | /*0x107b,01*/BOOL NtGdiDeleteColorSpace(HANDLE); 281 | /*0x107c,02*/BOOL NtGdiDeleteColorTransform(HDC,HANDLE); 282 | /*0x107e,04*/INT NtGdiDescribePixelFormat(HDC,INT,UINT,PPIXELFORMATDESCRIPTOR); 283 | /*0x1080,02*/ULONG NtGdiGetPerBandInfo(HDC,OUT PERBANDINFO*); 284 | /*0x1081,04*/BOOL NtGdiDoBanding(HDC,BOOL,OUT PPOINTL,OUT LPSIZE); 285 | /*0x1083,04*/INT NtGdiDrawEscape(HDC,INT,INT,PSTR); 286 | /*0x1084,05*/BOOL NtGdiEllipse(HDC,INT,INT,INT,INT); 287 | /*0x1086,01*/BOOL NtGdiEndDoc(HDC); 288 | /*0x1087,03*/_UNKNOWN NtGdiEndGdiRendering(_UNKNOWN,_UNKNOWN,_UNKNOWN); 289 | /*0x1088,01*/BOOL NtGdiEndPage(HDC); 290 | /*0x1089,01*/BOOL NtGdiEndPath(HDC); 291 | /*0x108b,04*/ULONG NtGdiEnumObjects(HDC,INT,ULONG,PVOID); 292 | /*0x108d,07*/BOOL NtGdiEudcLoadUnloadLink(PCWSTR,UINT,PCWSTR,UINT,INT,INT,BOOL); 293 | /*0x1096,01*/BOOL NtGdiFillPath(HDC); 294 | /*0x1098,01*/BOOL NtGdiFlattenPath(HDC); 295 | /*0x109a,02*/BOOL NtGdiForceUFIMapping(HDC,PUNIVERSAL_FONT_ID); 296 | /*0x109b,05*/BOOL NtGdiFrameRgn(HDC,HRGN,HBRUSH,INT,INT); 297 | /*0x109c,05*/NTSTATUS NtGdiFullscreenControl(FULLSCREENCONTROL,PVOID,DWORD,OUT PVOID,OUT PULONG); 298 | /*0x10a0,02*/BOOL NtGdiGetBitmapDimension(HBITMAP,OUT LPSIZE); 299 | /*0x10a5,06*/DWORD NtGdiGetCharacterPlacementW(HDC,PWSTR,INT,INT,OUT LPGCP_RESULTSW,DWORD); 300 | /*0x10a9,02*/BOOL NtGdiGetColorAdjustment(HDC,OUT PCOLORADJUSTMENT); 301 | /*0x10ab,03*/_UNKNOWN NtGdiGetCOPPCompatibleOPMInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN); 302 | /*0x10b1,02*/BOOL NtGdiGetDeviceGammaRamp(HDC,PVOID); 303 | /*0x10b4,02*/BOOL NtGdiGetETM(HDC,OUT EXTTEXTMETRIC*); 304 | /*0x10b5,03*/ULONG NtGdiGetEudcTimeStampEx(PWSTR,ULONG,BOOL); 305 | /*0x10b7,05*/DWORD NtGdiGetFontFileData(UINT,UINT,PULONGLONG,PVOID,SIZE_T); 306 | /*0x10b9,07*/BOOL NtGdiGetFontResourceInfoInternalW(PWSTR,ULONG,ULONG,UINT,OUT PDWORD,PVOID,DWORD); 307 | /*0x10bb,06*/DWORD NtGdiGetGlyphIndicesWInternal(HDC,PWSTR,INT,PWORD,DWORD,BOOL); 308 | /*0x10bc,08*/ULONG NtGdiGetGlyphOutline(HDC,WCHAR,UINT,OUT LPGLYPHMETRICS,ULONG,PVOID,LPMAT2,BOOL); 309 | /*0x10bf,03*/INT NtGdiGetLinkedUFIs(HDC,PUNIVERSAL_FONT_ID,INT); 310 | /*0x10c7,04*/INT NtGdiGetPath(HDC,LPPOINT,PBYTE,INT); 311 | /*0x10ca,02*/BOOL NtGdiGetRasterizerCaps(LPRASTERIZER_STATUS,ULONG); 312 | /*0x10ce,07*/ULONG NtGdiGetServerMetaFileBits(HANDLE,ULONG,PBYTE,OUT PDWORD,OUT PDWORD,OUT PDWORD,OUT PDWORD); 313 | /*0x10cf,04*/INT NtGdiGetSpoolMessage(DWORD,DWORD,DWORD,DWORD); 314 | /*0x10d2,05*/UINT NtGdiGetStringBitmapW(HDC,PWSTR,UINT,PBYTE,UINT); 315 | /*0x10d6,05*/BOOL NtGdiGetTextExtent(HDC,PWSTR,INT,OUT LPSIZE,UINT); 316 | /*0x10db,06*/BOOL NtGdiGetUFI(HDC,OUT PUNIVERSAL_FONT_ID,OUT DESIGNVECTOR*,OUT PULONG,OUT PULONG,OUT FLONG*); 317 | /*0x10dc,07*/BOOL NtGdiGetEmbUFI(HDC,OUT PUNIVERSAL_FONT_ID,OUT DESIGNVECTOR*,OUT PULONG,OUT PULONG,OUT FLONG*,OUT KERNEL_PVOID*); 318 | /*0x10dd,10*/BOOL NtGdiGetUFIPathname(PUNIVERSAL_FONT_ID,PULONG,PWSTR,OUT PULONG,FLONG,OUT PBOOL,OUT PULONG,OUT PVOID,OUT PBOOL,OUT PULONG); 319 | /*0x10de,00*/DWORD NtGdiGetEmbedFonts(VOID); 320 | /*0x10df,02*/BOOL NtGdiChangeGhostFont(KERNEL_PVOID*,BOOL); 321 | /*0x10e0,02*/BOOL NtGdiAddEmbFontToDC(HDC,PVOID*); 322 | /*0x10e5,08*/BOOL NtGdiIcmBrushInfo(HDC,HBRUSH,PBITMAPINFO,PVOID,OUT PULONG,OUT PDWORD,OUT PBOOL,ULONG); 323 | /*0x10e7,00*/DWORD NtGdiInitSpool(VOID); 324 | /*0x10eb,05*/ULONG NtGdiMakeFontDir(FLONG,PBYTE,UINT,PWSTR,UINT); 325 | /*0x10ec,02*/BOOL NtGdiMakeInfoDC(HDC,BOOL); 326 | /*0x10f1,03*/INT NtGdiOffsetClipRgn(HDC,INT,INT); 327 | /*0x10f6,01*/HRGN NtGdiPathToRegion(HDC); 328 | /*0x10f8,04*/BOOL NtGdiPolyDraw(HDC,LPPOINT,PBYTE,ULONG); 329 | /*0x10fc,03*/BOOL NtGdiPtVisible(HDC,INT,INT); 330 | /*0x10fd,03*/INT NtGdiQueryFonts(PUNIVERSAL_FONT_ID,ULONG,OUT PLARGE_INTEGER); 331 | /*0x1102,06*/BOOL NtGdiRemoveFontResourceW(PWCHAR,ULONG,ULONG,ULONG,DWORD,DESIGNVECTOR*); 332 | /*0x1103,01*/BOOL NtGdiRemoveFontMemResourceEx(HANDLE); 333 | /*0x1105,02*/BOOL NtGdiResizePalette(HPALETTE,UINT); 334 | /*0x1109,06*/BOOL NtGdiScaleViewportExtEx(HDC,INT,INT,INT,INT,OUT LPSIZE); 335 | /*0x110a,06*/BOOL NtGdiScaleWindowExtEx(HDC,INT,INT,INT,INT,OUT LPSIZE); 336 | /*0x110d,02*/BOOL NtGdiSelectClipPath(HDC,INT); 337 | /*0x110f,02*/HPEN NtGdiSelectPen(HDC,HPEN); 338 | /*0x1112,04*/BOOL NtGdiSetBitmapDimension(HBITMAP,INT,INT,LPSIZE); 339 | /*0x1114,02*/HBRUSH NtGdiSetBrushAttributes(HBRUSH,DWORD); 340 | /*0x1116,02*/BOOL NtGdiSetColorAdjustment(HDC,PCOLORADJUSTMENT); 341 | /*0x1117,02*/BOOL NtGdiSetColorSpace(HDC,HCOLORSPACE); 342 | /*0x1118,02*/BOOL NtGdiSetDeviceGammaRamp(HDC,PVOID); 343 | /*0x111d,03*/BOOL NtGdiSetLinkedUFIs(HDC,PUNIVERSAL_FONT_ID,ULONG); 344 | /*0x111e,03*/BOOL NtGdiSetMagicColors(HDC,PALETTEENTRY,ULONG); 345 | /*0x1121,01*/LONG NtGdiGetDeviceWidth(HDC); 346 | /*0x1122,01*/BOOL NtGdiMirrorWindowOrg(HDC); 347 | /*0x1126,02*/BOOL NtGdiSetPixelFormat(HDC,INT); 348 | /*0x1127,05*/BOOL NtGdiSetRectRgn(HRGN,INT,INT,INT,INT); 349 | /*0x1128,02*/UINT NtGdiSetSystemPaletteUse(HDC,UINT); 350 | /*0x112c,04*/INT NtGdiStartDoc(HDC,DOCINFOW*,OUT PBOOL,INT); 351 | /*0x112d,01*/BOOL NtGdiStartPage(HDC); 352 | /*0x1130,01*/BOOL NtGdiStrokeAndFillPath(HDC); 353 | /*0x1131,01*/BOOL NtGdiStrokePath(HDC); 354 | /*0x1132,01*/BOOL NtGdiSwapBuffers(HDC); 355 | /*0x1135,02*/BOOL NtGdiUnloadPrinterDriver(PWSTR,ULONG); 356 | /*0x1137,01*/BOOL NtGdiUnrealizeObject(HANDLE); 357 | /*0x1138,01*/BOOL NtGdiUpdateColors(HDC); 358 | /*0x1139,01*/BOOL NtGdiWidenPath(HDC); 359 | /*0x1298,03*/BOOL NtGdiEngAssociateSurface(HSURF,HDEV,FLONG); 360 | /*0x1299,06*/_UNKNOWN NtGdiEngCreateBitmap(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 361 | /*0x129a,04*/_UNKNOWN NtGdiEngCreateDeviceSurface(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 362 | /*0x129b,04*/_UNKNOWN NtGdiEngCreateDeviceBitmap(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 363 | /*0x129d,03*/FD_GLYPHSET* NtGdiEngComputeGlyphSet(INT,INT,INT); 364 | /*0x129e,06*/BOOL NtGdiEngCopyBits(SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,PPOINTL); 365 | /*0x12a0,01*/BOOL NtGdiEngDeleteSurface(HSURF); 366 | /*0x12a1,03*/BOOL NtGdiEngEraseSurface(SURFOBJ*,LPRECTL,ULONG); 367 | /*0x12a2,01*/NTSTATUS NtGdiEngUnlockSurface(SURFOBJ*); 368 | /*0x12a3,01*/SURFOBJ* NtGdiEngLockSurface(HSURF); 369 | /*0x12a4,11*/BOOL NtGdiEngBitBlt(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,PPOINTL,PPOINTL,BRUSHOBJ*,PPOINTL,ROP4); 370 | /*0x12a5,11*/BOOL NtGdiEngStretchBlt(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,COLORADJUSTMENT*,PPOINTL,LPRECTL,LPRECTL,PPOINTL,ULONG); 371 | /*0x12a6,11*/BOOL NtGdiEngPlgBlt(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,COLORADJUSTMENT*,PPOINTL,POINTFIX*,LPRECTL,PPOINTL,ULONG); 372 | /*0x12a7,01*/BOOL NtGdiEngMarkBandingSurface(HSURF); 373 | /*0x12a8,08*/BOOL NtGdiEngStrokePath(SURFOBJ*,PATHOBJ*,CLIPOBJ*,XFORMOBJ*,BRUSHOBJ*,PPOINTL,LINEATTRS*,MIX); 374 | /*0x12a9,07*/BOOL NtGdiEngFillPath(SURFOBJ*,PATHOBJ*,CLIPOBJ*,BRUSHOBJ*,PPOINTL,MIX,FLONG); 375 | /*0x12aa,10*/BOOL NtGdiEngStrokeAndFillPath(SURFOBJ*,PATHOBJ*,CLIPOBJ*,XFORMOBJ*,BRUSHOBJ*,LINEATTRS*,BRUSHOBJ*,PPOINTL,MIX,FLONG); 376 | /*0x12ab,05*/BOOL NtGdiEngPaint(SURFOBJ*,CLIPOBJ*,BRUSHOBJ*,PPOINTL,MIX); 377 | /*0x12ac,09*/BOOL NtGdiEngLineTo(SURFOBJ*,CLIPOBJ*,BRUSHOBJ*,LONG,LONG,LONG,LONG,LPRECTL,MIX); 378 | /*0x12ad,07*/BOOL NtGdiEngAlphaBlend(SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,LPRECTL,BLENDOBJ*); 379 | /*0x12ae,10*/BOOL NtGdiEngGradientFill(SURFOBJ*,CLIPOBJ*,XLATEOBJ*,TRIVERTEX*,ULONG,PVOID,ULONG,LPRECTL,PPOINTL,ULONG); 380 | /*0x12af,08*/BOOL NtGdiEngTransparentBlt(SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,LPRECTL,LPRECTL,ULONG,ULONG); 381 | /*0x12b0,10*/BOOL NtGdiEngTextOut(SURFOBJ*,STROBJ*,FONTOBJ*,CLIPOBJ*,LPRECTL,LPRECTL,BRUSHOBJ*,BRUSHOBJ*,PPOINTL,MIX); 382 | /*0x12b1,13*/BOOL NtGdiEngStretchBltROP(SURFOBJ*,SURFOBJ*,SURFOBJ*,CLIPOBJ*,XLATEOBJ*,COLORADJUSTMENT*,PPOINTL,LPRECTL,LPRECTL,PPOINTL,ULONG,BRUSHOBJ*,ROP4); 383 | /*0x12b2,04*/ULONG NtGdiXLATEOBJ_cGetPalette(XLATEOBJ*,ULONG,ULONG,PULONG); 384 | /*0x12b3,02*/ULONG NtGdiXLATEOBJ_iXlate(XLATEOBJ*,ULONG); 385 | /*0x12b4,01*/HANDLE NtGdiXLATEOBJ_hGetColorTransform(XLATEOBJ*); 386 | /*0x12b5,03*/BOOL NtGdiCLIPOBJ_bEnum(CLIPOBJ*,ULONG,PULONG); 387 | /*0x12b6,05*/ULONG NtGdiCLIPOBJ_cEnumStart(CLIPOBJ*,BOOL,ULONG,ULONG,ULONG); 388 | /*0x12b7,01*/PATHOBJ* NtGdiCLIPOBJ_ppoGetPath(CLIPOBJ*); 389 | /*0x12b8,01*/NTSTATUS NtGdiEngDeletePath(PATHOBJ*); 390 | /*0x12b9,00*/DWORD NtGdiEngCreateClip(VOID); 391 | /*0x12ba,01*/NTSTATUS NtGdiEngDeleteClip(CLIPOBJ*); 392 | /*0x12bb,01*/ULONG NtGdiBRUSHOBJ_ulGetBrushColor(BRUSHOBJ*); 393 | /*0x12bc,02*/PVOID NtGdiBRUSHOBJ_pvAllocRbrush(BRUSHOBJ*,ULONG); 394 | /*0x12bd,01*/PVOID NtGdiBRUSHOBJ_pvGetRbrush(BRUSHOBJ*); 395 | /*0x12be,01*/HANDLE NtGdiBRUSHOBJ_hGetColorTransform(BRUSHOBJ*); 396 | /*0x12bf,05*/BOOL NtGdiXFORMOBJ_bApplyXform(XFORMOBJ*,ULONG,ULONG,PPOINTL,PPOINTL); 397 | /*0x12c0,02*/ULONG NtGdiXFORMOBJ_iGetXform(XFORMOBJ*,OUT XFORML*); 398 | /*0x12c1,03*/NTSTATUS NtGdiFONTOBJ_vGetInfo(FONTOBJ*,ULONG,FONTINFO*); 399 | /*0x12c2,01*/XFORMOBJ* NtGdiFONTOBJ_pxoGetXform(FONTOBJ*); 400 | /*0x12c3,05*/ULONG NtGdiFONTOBJ_cGetGlyphs(FONTOBJ*,ULONG,ULONG,HGLYPH*,PVOID*); 401 | /*0x12c4,01*/IFIMETRICS* NtGdiFONTOBJ_pifi(FONTOBJ*); 402 | /*0x12c5,01*/FD_GLYPHSET* NtGdiFONTOBJ_pfdg(FONTOBJ*); 403 | /*0x12c6,02*/PFD_GLYPHATTR NtGdiFONTOBJ_pQueryGlyphAttrs(FONTOBJ*,ULONG); 404 | /*0x12c7,02*/PVOID NtGdiFONTOBJ_pvTrueTypeFontFile(FONTOBJ*,OUT PULONG); 405 | /*0x12c8,02*/ULONG NtGdiFONTOBJ_cGetAllGlyphHandles(FONTOBJ*,OUT HGLYPH*); 406 | /*0x12c9,03*/BOOL NtGdiSTROBJ_bEnum(STROBJ*,OUT PULONG,PGLYPHPOS*); 407 | /*0x12ca,03*/BOOL NtGdiSTROBJ_bEnumPositionsOnly(STROBJ*,OUT PULONG,PGLYPHPOS*); 408 | /*0x12cb,04*/BOOL NtGdiSTROBJ_bGetAdvanceWidths(STROBJ*,ULONG,ULONG,POINTQF*); 409 | /*0x12cc,01*/NTSTATUS NtGdiSTROBJ_vEnumStart(OUT STROBJ*); 410 | /*0x12cd,01*/DWORD NtGdiSTROBJ_dwGetCodePage(STROBJ*); 411 | /*0x12ce,02*/NTSTATUS NtGdiPATHOBJ_vGetBounds(PATHOBJ*,OUT PRECTFX); 412 | /*0x12cf,02*/BOOL NtGdiPATHOBJ_bEnum(PATHOBJ*,OUT PATHDATA*); 413 | /*0x12d0,01*/NTSTATUS NtGdiPATHOBJ_vEnumStart(PATHOBJ*); 414 | /*0x12d1,04*/NTSTATUS NtGdiPATHOBJ_vEnumStartClipLines(PATHOBJ*,CLIPOBJ*,SURFOBJ*,LINEATTRS*); 415 | /*0x12d2,03*/BOOL NtGdiPATHOBJ_bEnumClipLines(PATHOBJ*,ULONG,CLIPLINE*); 416 | /*0x12d3,01*/DHPDEV NtGdiGetDhpdev(HDEV); 417 | /*0x12d4,01*/BOOL NtGdiEngCheckAbort(SURFOBJ*); 418 | /*0x12d5,04*/LONG NtGdiHT_Get8BPPFormatPalette(OUT LPPALETTEENTRY,USHORT,USHORT,USHORT); 419 | /*0x12d6,06*/LONG NtGdiHT_Get8BPPMaskPalette(OUT LPPALETTEENTRY,BOOL,BYTE,USHORT,USHORT,USHORT); 420 | /*0x12d7,01*/BOOL NtGdiUpdateTransform(HDC); 421 | /*0x12d9,02*/BOOL NtGdiBRUSHOBJ_DeleteRbrush(BRUSHOBJ*,BRUSHOBJ*); 422 | /*0x12da,01*/BOOL NtGdiUMPDEngFreeUserMem(KERNEL_PVOID*); 423 | /*0x12ea,01*/_UNKNOWN NtGdiDdDDIOpenSynchronizationObject(_UNKNOWN); 424 | /*0x12ee,01*/_UNKNOWN NtGdiDdDDIGetRuntimeData(_UNKNOWN); 425 | /*0x12f4,01*/_UNKNOWN NtGdiDdDDIGetMultisampleMethodList(_UNKNOWN); 426 | /*0x12fc,01*/_UNKNOWN NtGdiDdDDIQueryStatistics(_UNKNOWN); 427 | /*0x1300,01*/_UNKNOWN NtGdiDdDDICreateOverlay(_UNKNOWN); 428 | /*0x1301,01*/_UNKNOWN NtGdiDdDDIUpdateOverlay(_UNKNOWN); 429 | /*0x1302,01*/_UNKNOWN NtGdiDdDDIFlipOverlay(_UNKNOWN); 430 | /*0x1303,01*/_UNKNOWN NtGdiDdDDIDestroyOverlay(_UNKNOWN); 431 | /*0x1305,01*/_UNKNOWN NtGdiDdDDISetGammaRamp(_UNKNOWN); 432 | /*0x130a,01*/_UNKNOWN NtGdiDdDDIGetContextSchedulingPriority(_UNKNOWN); 433 | /*0x130c,02*/_UNKNOWN NtGdiDdDDIGetProcessSchedulingPriorityClass(_UNKNOWN,_UNKNOWN); 434 | /*0x130d,01*/_UNKNOWN NtGdiDdDDIReleaseProcessVidPnSourceOwners(_UNKNOWN); 435 | /*0x1310,01*/_UNKNOWN NtGdiDdDDIPollDisplayChildren(_UNKNOWN); 436 | /*0x1311,01*/_UNKNOWN NtGdiDdDDIInvalidateActiveVidPn(_UNKNOWN); 437 | /*0x1312,01*/_UNKNOWN NtGdiDdDDICheckOcclusion(_UNKNOWN); 438 | /*0x1313,01*/_UNKNOWN NtGdiDdDDIWaitForIdle(_UNKNOWN); 439 | /*0x1316,01*/_UNKNOWN NtGdiDdDDISetDisplayPrivateDriverFormat(_UNKNOWN); 440 | /*0x1317,01*/_UNKNOWN NtGdiDdDDISharedPrimaryLockNotification(_UNKNOWN); 441 | /*0x1318,01*/_UNKNOWN NtGdiDdDDISharedPrimaryUnLockNotification(_UNKNOWN); 442 | /*0x1319,01*/_UNKNOWN NtGdiDdDDICreateKeyedMutex(_UNKNOWN); 443 | /*0x131a,01*/_UNKNOWN NtGdiDdDDIOpenKeyedMutex(_UNKNOWN); 444 | /*0x131b,01*/_UNKNOWN NtGdiDdDDIDestroyKeyedMutex(_UNKNOWN); 445 | /*0x131c,01*/_UNKNOWN NtGdiDdDDIAcquireKeyedMutex(_UNKNOWN); 446 | /*0x131d,01*/_UNKNOWN NtGdiDdDDIReleaseKeyedMutex(_UNKNOWN); 447 | /*0x131f,01*/_UNKNOWN NtGdiDdDDIGetOverlayState(_UNKNOWN); 448 | /*0x1324,02*/_UNKNOWN NtGdiGetNumberOfPhysicalMonitors(_UNKNOWN,_UNKNOWN); 449 | /*0x1325,04*/_UNKNOWN NtGdiGetPhysicalMonitors(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 450 | /*0x1326,03*/_UNKNOWN NtGdiGetPhysicalMonitorDescription(_UNKNOWN,_UNKNOWN,_UNKNOWN); 451 | /*0x1327,01*/_UNKNOWN NtGdiDestroyPhysicalMonitor(_UNKNOWN); 452 | /*0x1328,05*/_UNKNOWN NtGdiDDCCIGetVCPFeature(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 453 | /*0x1329,03*/_UNKNOWN NtGdiDDCCISetVCPFeature(_UNKNOWN,_UNKNOWN,_UNKNOWN); 454 | /*0x132a,01*/_UNKNOWN NtGdiDDCCISaveCurrentSettings(_UNKNOWN); 455 | /*0x132b,02*/_UNKNOWN NtGdiDDCCIGetCapabilitiesStringLength(_UNKNOWN,_UNKNOWN); 456 | /*0x132c,03*/_UNKNOWN NtGdiDDCCIGetCapabilitiesString(_UNKNOWN,_UNKNOWN,_UNKNOWN); 457 | /*0x132d,02*/_UNKNOWN NtGdiDDCCIGetTimingReport(_UNKNOWN,_UNKNOWN); 458 | /*0x132e,04*/NTSTATUS NtGdiDdCreateFullscreenSprite(HDC,COLORREF,OUT HANDLE*,OUT HDC*); 459 | /*0x132f,02*/NTSTATUS NtGdiDdNotifyFullscreenSpriteUpdate(HDC,HANDLE); 460 | /*0x1330,02*/NTSTATUS NtGdiDdDestroyFullscreenSprite(HDC,HANDLE); 461 | /*0x1331,00*/DWORD NtGdiDdQueryVisRgnUniqueness(VOID); 462 | -------------------------------------------------------------------------------- /output_win7_sp1/ntdll_x64.txt: -------------------------------------------------------------------------------- 1 | 0x0000, ZwMapUserPhysicalPagesScatter 2 | 0x0001, NtWaitForSingleObject 3 | 0x0002, ZwCallbackReturn 4 | 0x0003, NtReadFile 5 | 0x0004, NtDeviceIoControlFile 6 | 0x0005, NtWriteFile 7 | 0x0006, ZwRemoveIoCompletion 8 | 0x0007, ZwReleaseSemaphore 9 | 0x0008, ZwReplyWaitReceivePort 10 | 0x0009, NtReplyPort 11 | 0x000a, NtSetInformationThread 12 | 0x000b, ZwSetEvent 13 | 0x000c, NtClose 14 | 0x000d, ZwQueryObject 15 | 0x000e, NtQueryInformationFile 16 | 0x000f, NtOpenKey 17 | 0x0010, ZwEnumerateValueKey 18 | 0x0011, ZwFindAtom 19 | 0x0012, NtQueryDefaultLocale 20 | 0x0013, ZwQueryKey 21 | 0x0014, NtQueryValueKey 22 | 0x0015, ZwAllocateVirtualMemory 23 | 0x0016, NtQueryInformationProcess 24 | 0x0017, ZwWaitForMultipleObjects32 25 | 0x0018, ZwWriteFileGather 26 | 0x0019, NtSetInformationProcess 27 | 0x001a, ZwCreateKey 28 | 0x001b, ZwFreeVirtualMemory 29 | 0x001c, ZwImpersonateClientOfPort 30 | 0x001d, ZwReleaseMutant 31 | 0x001e, NtQueryInformationToken 32 | 0x001f, ZwRequestWaitReplyPort 33 | 0x0020, ZwQueryVirtualMemory 34 | 0x0021, NtOpenThreadToken 35 | 0x0022, ZwQueryInformationThread 36 | 0x0023, NtOpenProcess 37 | 0x0024, ZwSetInformationFile 38 | 0x0025, ZwMapViewOfSection 39 | 0x0026, ZwAccessCheckAndAuditAlarm 40 | 0x0027, NtUnmapViewOfSection 41 | 0x0028, ZwReplyWaitReceivePortEx 42 | 0x0029, ZwTerminateProcess 43 | 0x002a, ZwSetEventBoostPriority 44 | 0x002b, ZwReadFileScatter 45 | 0x002c, NtOpenThreadTokenEx 46 | 0x002d, NtOpenProcessTokenEx 47 | 0x002e, NtQueryPerformanceCounter 48 | 0x002f, NtEnumerateKey 49 | 0x0030, NtOpenFile 50 | 0x0031, ZwDelayExecution 51 | 0x0032, NtQueryDirectoryFile 52 | 0x0033, NtQuerySystemInformation 53 | 0x0034, NtOpenSection 54 | 0x0035, ZwQueryTimer 55 | 0x0036, ZwFsControlFile 56 | 0x0037, NtWriteVirtualMemory 57 | 0x0038, ZwCloseObjectAuditAlarm 58 | 0x0039, ZwDuplicateObject 59 | 0x003a, ZwQueryAttributesFile 60 | 0x003b, NtClearEvent 61 | 0x003c, ZwReadVirtualMemory 62 | 0x003d, NtOpenEvent 63 | 0x003e, NtAdjustPrivilegesToken 64 | 0x003f, NtDuplicateToken 65 | 0x0040, ZwContinue 66 | 0x0041, ZwQueryDefaultUILanguage 67 | 0x0042, NtQueueApcThread 68 | 0x0043, ZwYieldExecution 69 | 0x0044, ZwAddAtom 70 | 0x0045, ZwCreateEvent 71 | 0x0046, ZwQueryVolumeInformationFile 72 | 0x0047, NtCreateSection 73 | 0x0048, ZwFlushBuffersFile 74 | 0x0049, NtApphelpCacheControl 75 | 0x004a, ZwCreateProcessEx 76 | 0x004b, NtCreateThread 77 | 0x004c, NtIsProcessInJob 78 | 0x004d, ZwProtectVirtualMemory 79 | 0x004e, NtQuerySection 80 | 0x004f, ZwResumeThread 81 | 0x0050, NtTerminateThread 82 | 0x0051, NtReadRequestData 83 | 0x0052, ZwCreateFile 84 | 0x0053, NtQueryEvent 85 | 0x0054, ZwWriteRequestData 86 | 0x0055, ZwOpenDirectoryObject 87 | 0x0056, ZwAccessCheckByTypeAndAuditAlarm 88 | 0x0058, NtWaitForMultipleObjects 89 | 0x0059, NtSetInformationObject 90 | 0x005a, ZwCancelIoFile 91 | 0x005b, NtTraceEvent 92 | 0x005c, NtPowerInformation 93 | 0x005d, ZwSetValueKey 94 | 0x005e, NtCancelTimer 95 | 0x005f, ZwSetTimer 96 | 0x0060, NtAcceptConnectPort 97 | 0x0061, ZwAccessCheck 98 | 0x0062, ZwAccessCheckByType 99 | 0x0063, ZwAccessCheckByTypeResultList 100 | 0x0064, ZwAccessCheckByTypeResultListAndAuditAlarm 101 | 0x0065, ZwAccessCheckByTypeResultListAndAuditAlarmByHandle 102 | 0x0066, ZwAddBootEntry 103 | 0x0067, NtAddDriverEntry 104 | 0x0068, NtAdjustGroupsToken 105 | 0x0069, ZwAlertResumeThread 106 | 0x006a, NtAlertThread 107 | 0x006b, ZwAllocateLocallyUniqueId 108 | 0x006c, NtAllocateReserveObject 109 | 0x006d, ZwAllocateUserPhysicalPages 110 | 0x006e, ZwAllocateUuids 111 | 0x006f, ZwAlpcAcceptConnectPort 112 | 0x0070, NtAlpcCancelMessage 113 | 0x0071, NtAlpcConnectPort 114 | 0x0072, NtAlpcCreatePort 115 | 0x0073, ZwAlpcCreatePortSection 116 | 0x0074, ZwAlpcCreateResourceReserve 117 | 0x0075, NtAlpcCreateSectionView 118 | 0x0076, NtAlpcCreateSecurityContext 119 | 0x0077, NtAlpcDeletePortSection 120 | 0x0078, NtAlpcDeleteResourceReserve 121 | 0x0079, ZwAlpcDeleteSectionView 122 | 0x007a, ZwAlpcDeleteSecurityContext 123 | 0x007b, NtAlpcDisconnectPort 124 | 0x007c, NtAlpcImpersonateClientOfPort 125 | 0x007d, NtAlpcOpenSenderProcess 126 | 0x007e, NtAlpcOpenSenderThread 127 | 0x007f, ZwAlpcQueryInformation 128 | 0x0080, ZwAlpcQueryInformationMessage 129 | 0x0081, NtAlpcRevokeSecurityContext 130 | 0x0082, ZwAlpcSendWaitReceivePort 131 | 0x0083, NtAlpcSetInformation 132 | 0x0084, ZwAreMappedFilesTheSame 133 | 0x0085, NtAssignProcessToJobObject 134 | 0x0086, ZwCancelIoFileEx 135 | 0x0087, ZwCancelSynchronousIoFile 136 | 0x0088, NtCommitComplete 137 | 0x0089, ZwCommitEnlistment 138 | 0x008a, ZwCommitTransaction 139 | 0x008b, NtCompactKeys 140 | 0x008c, ZwCompareTokens 141 | 0x008d, NtCompleteConnectPort 142 | 0x008e, NtCompressKey 143 | 0x008f, ZwConnectPort 144 | 0x0090, NtCreateDebugObject 145 | 0x0091, NtCreateDirectoryObject 146 | 0x0092, NtCreateEnlistment 147 | 0x0093, ZwCreateEventPair 148 | 0x0094, NtCreateIoCompletion 149 | 0x0095, ZwCreateJobObject 150 | 0x0096, ZwCreateJobSet 151 | 0x0097, ZwCreateKeyTransacted 152 | 0x0098, ZwCreateKeyedEvent 153 | 0x0099, ZwCreateMailslotFile 154 | 0x009a, NtCreateMutant 155 | 0x009b, NtCreateNamedPipeFile 156 | 0x009c, NtCreatePagingFile 157 | 0x009d, ZwCreatePort 158 | 0x009e, ZwCreatePrivateNamespace 159 | 0x009f, NtCreateProcess 160 | 0x00a0, ZwCreateProfile 161 | 0x00a1, ZwCreateProfileEx 162 | 0x00a2, NtCreateResourceManager 163 | 0x00a3, NtCreateSemaphore 164 | 0x00a4, ZwCreateSymbolicLinkObject 165 | 0x00a5, NtCreateThreadEx 166 | 0x00a6, ZwCreateTimer 167 | 0x00a7, NtCreateToken 168 | 0x00a8, NtCreateTransaction 169 | 0x00a9, ZwCreateTransactionManager 170 | 0x00aa, NtCreateUserProcess 171 | 0x00ab, NtCreateWaitablePort 172 | 0x00ac, NtCreateWorkerFactory 173 | 0x00ad, NtDebugActiveProcess 174 | 0x00ae, NtDebugContinue 175 | 0x00af, NtDeleteAtom 176 | 0x00b0, NtDeleteBootEntry 177 | 0x00b1, ZwDeleteDriverEntry 178 | 0x00b2, NtDeleteFile 179 | 0x00b3, NtDeleteKey 180 | 0x00b4, ZwDeleteObjectAuditAlarm 181 | 0x00b5, NtDeletePrivateNamespace 182 | 0x00b6, ZwDeleteValueKey 183 | 0x00b7, NtDisableLastKnownGood 184 | 0x00b8, ZwDisplayString 185 | 0x00b9, NtDrawText 186 | 0x00ba, NtEnableLastKnownGood 187 | 0x00bb, NtEnumerateBootEntries 188 | 0x00bc, ZwEnumerateDriverEntries 189 | 0x00bd, NtEnumerateSystemEnvironmentValuesEx 190 | 0x00be, NtEnumerateTransactionObject 191 | 0x00bf, NtExtendSection 192 | 0x00c0, ZwFilterToken 193 | 0x00c1, NtFlushInstallUILanguage 194 | 0x00c2, NtFlushInstructionCache 195 | 0x00c3, ZwFlushKey 196 | 0x00c4, ZwFlushProcessWriteBuffers 197 | 0x00c5, ZwFlushVirtualMemory 198 | 0x00c6, NtFlushWriteBuffer 199 | 0x00c7, ZwFreeUserPhysicalPages 200 | 0x00c8, NtFreezeRegistry 201 | 0x00c9, ZwFreezeTransactions 202 | 0x00ca, ZwGetContextThread 203 | 0x00cb, ZwGetCurrentProcessorNumber 204 | 0x00cc, ZwGetDevicePowerState 205 | 0x00cd, ZwGetMUIRegistryInfo 206 | 0x00ce, NtGetNextProcess 207 | 0x00cf, ZwGetNextThread 208 | 0x00d0, ZwGetNlsSectionPtr 209 | 0x00d1, NtGetNotificationResourceManager 210 | 0x00d2, NtGetPlugPlayEvent 211 | 0x00d3, ZwGetWriteWatch 212 | 0x00d4, ZwImpersonateAnonymousToken 213 | 0x00d5, ZwImpersonateThread 214 | 0x00d6, NtInitializeNlsFiles 215 | 0x00d7, NtInitializeRegistry 216 | 0x00d8, NtInitiatePowerAction 217 | 0x00d9, ZwIsSystemResumeAutomatic 218 | 0x00da, NtIsUILanguageComitted 219 | 0x00db, NtListenPort 220 | 0x00dc, ZwLoadDriver 221 | 0x00dd, NtLoadKey 222 | 0x00de, ZwLoadKey2 223 | 0x00df, NtLoadKeyEx 224 | 0x00e0, ZwLockFile 225 | 0x00e1, NtLockProductActivationKeys 226 | 0x00e2, ZwLockRegistryKey 227 | 0x00e3, NtLockVirtualMemory 228 | 0x00e4, NtMakePermanentObject 229 | 0x00e5, NtMakeTemporaryObject 230 | 0x00e6, NtMapCMFModule 231 | 0x00e7, NtMapUserPhysicalPages 232 | 0x00e8, NtModifyBootEntry 233 | 0x00e9, ZwModifyDriverEntry 234 | 0x00ea, NtNotifyChangeDirectoryFile 235 | 0x00eb, ZwNotifyChangeKey 236 | 0x00ec, NtNotifyChangeMultipleKeys 237 | 0x00ed, NtNotifyChangeSession 238 | 0x00ee, NtOpenEnlistment 239 | 0x00ef, ZwOpenEventPair 240 | 0x00f0, NtOpenIoCompletion 241 | 0x00f1, NtOpenJobObject 242 | 0x00f2, NtOpenKeyEx 243 | 0x00f3, ZwOpenKeyTransacted 244 | 0x00f4, ZwOpenKeyTransactedEx 245 | 0x00f5, NtOpenKeyedEvent 246 | 0x00f6, NtOpenMutant 247 | 0x00f7, ZwOpenObjectAuditAlarm 248 | 0x00f8, NtOpenPrivateNamespace 249 | 0x00f9, NtOpenProcessToken 250 | 0x00fa, NtOpenResourceManager 251 | 0x00fb, ZwOpenSemaphore 252 | 0x00fc, ZwOpenSession 253 | 0x00fd, ZwOpenSymbolicLinkObject 254 | 0x00fe, ZwOpenThread 255 | 0x00ff, ZwOpenTimer 256 | 0x0100, ZwOpenTransaction 257 | 0x0101, NtOpenTransactionManager 258 | 0x0102, ZwPlugPlayControl 259 | 0x0103, ZwPrePrepareComplete 260 | 0x0104, NtPrePrepareEnlistment 261 | 0x0105, ZwPrepareComplete 262 | 0x0106, ZwPrepareEnlistment 263 | 0x0107, ZwPrivilegeCheck 264 | 0x0108, NtPrivilegeObjectAuditAlarm 265 | 0x0109, ZwPrivilegedServiceAuditAlarm 266 | 0x010a, NtPropagationComplete 267 | 0x010b, NtPropagationFailed 268 | 0x010c, ZwPulseEvent 269 | 0x010d, ZwQueryBootEntryOrder 270 | 0x010e, NtQueryBootOptions 271 | 0x010f, ZwQueryDebugFilterState 272 | 0x0110, ZwQueryDirectoryObject 273 | 0x0111, NtQueryDriverEntryOrder 274 | 0x0112, ZwQueryEaFile 275 | 0x0113, NtQueryFullAttributesFile 276 | 0x0114, NtQueryInformationAtom 277 | 0x0115, NtQueryInformationEnlistment 278 | 0x0116, NtQueryInformationJobObject 279 | 0x0117, NtQueryInformationPort 280 | 0x0118, NtQueryInformationResourceManager 281 | 0x0119, ZwQueryInformationTransaction 282 | 0x011a, NtQueryInformationTransactionManager 283 | 0x011b, ZwQueryInformationWorkerFactory 284 | 0x011c, NtQueryInstallUILanguage 285 | 0x011d, NtQueryIntervalProfile 286 | 0x011e, NtQueryIoCompletion 287 | 0x011f, ZwQueryLicenseValue 288 | 0x0120, ZwQueryMultipleValueKey 289 | 0x0121, ZwQueryMutant 290 | 0x0122, NtQueryOpenSubKeys 291 | 0x0123, NtQueryOpenSubKeysEx 292 | 0x0124, NtQueryPortInformationProcess 293 | 0x0125, NtQueryQuotaInformationFile 294 | 0x0126, ZwQuerySecurityAttributesToken 295 | 0x0127, NtQuerySecurityObject 296 | 0x0128, ZwQuerySemaphore 297 | 0x0129, NtQuerySymbolicLinkObject 298 | 0x012a, NtQuerySystemEnvironmentValue 299 | 0x012b, NtQuerySystemEnvironmentValueEx 300 | 0x012c, NtQuerySystemInformationEx 301 | 0x012d, ZwQueryTimerResolution 302 | 0x012e, NtQueueApcThreadEx 303 | 0x012f, ZwRaiseException 304 | 0x0130, NtRaiseHardError 305 | 0x0131, ZwReadOnlyEnlistment 306 | 0x0132, ZwRecoverEnlistment 307 | 0x0133, ZwRecoverResourceManager 308 | 0x0134, NtRecoverTransactionManager 309 | 0x0135, NtRegisterProtocolAddressInformation 310 | 0x0136, NtRegisterThreadTerminatePort 311 | 0x0137, NtReleaseKeyedEvent 312 | 0x0138, NtReleaseWorkerFactoryWorker 313 | 0x0139, ZwRemoveIoCompletionEx 314 | 0x013a, ZwRemoveProcessDebug 315 | 0x013b, NtRenameKey 316 | 0x013c, NtRenameTransactionManager 317 | 0x013d, NtReplaceKey 318 | 0x013e, NtReplacePartitionUnit 319 | 0x013f, NtReplyWaitReplyPort 320 | 0x0140, NtRequestPort 321 | 0x0141, ZwResetEvent 322 | 0x0142, ZwResetWriteWatch 323 | 0x0143, NtRestoreKey 324 | 0x0144, ZwResumeProcess 325 | 0x0145, ZwRollbackComplete 326 | 0x0146, NtRollbackEnlistment 327 | 0x0147, ZwRollbackTransaction 328 | 0x0148, NtRollforwardTransactionManager 329 | 0x0149, NtSaveKey 330 | 0x014a, NtSaveKeyEx 331 | 0x014b, ZwSaveMergedKeys 332 | 0x014c, NtSecureConnectPort 333 | 0x014d, ZwSerializeBoot 334 | 0x014e, ZwSetBootEntryOrder 335 | 0x014f, NtSetBootOptions 336 | 0x0150, NtSetContextThread 337 | 0x0151, ZwSetDebugFilterState 338 | 0x0152, NtSetDefaultHardErrorPort 339 | 0x0153, NtSetDefaultLocale 340 | 0x0154, ZwSetDefaultUILanguage 341 | 0x0155, NtSetDriverEntryOrder 342 | 0x0156, ZwSetEaFile 343 | 0x0157, NtSetHighEventPair 344 | 0x0158, ZwSetHighWaitLowEventPair 345 | 0x0159, NtSetInformationDebugObject 346 | 0x015a, NtSetInformationEnlistment 347 | 0x015b, ZwSetInformationJobObject 348 | 0x015c, ZwSetInformationKey 349 | 0x015d, NtSetInformationResourceManager 350 | 0x015e, NtSetInformationToken 351 | 0x015f, NtSetInformationTransaction 352 | 0x0160, ZwSetInformationTransactionManager 353 | 0x0161, NtSetInformationWorkerFactory 354 | 0x0162, NtSetIntervalProfile 355 | 0x0163, ZwSetIoCompletion 356 | 0x0164, ZwSetIoCompletionEx 357 | 0x0165, ZwSetLdtEntries 358 | 0x0166, ZwSetLowEventPair 359 | 0x0167, ZwSetLowWaitHighEventPair 360 | 0x0168, ZwSetQuotaInformationFile 361 | 0x0169, NtSetSecurityObject 362 | 0x016a, ZwSetSystemEnvironmentValue 363 | 0x016b, ZwSetSystemEnvironmentValueEx 364 | 0x016c, ZwSetSystemInformation 365 | 0x016d, ZwSetSystemPowerState 366 | 0x016e, ZwSetSystemTime 367 | 0x016f, NtSetThreadExecutionState 368 | 0x0170, ZwSetTimerEx 369 | 0x0171, NtSetTimerResolution 370 | 0x0172, NtSetUuidSeed 371 | 0x0173, ZwSetVolumeInformationFile 372 | 0x0174, ZwShutdownSystem 373 | 0x0175, ZwShutdownWorkerFactory 374 | 0x0176, ZwSignalAndWaitForSingleObject 375 | 0x0177, ZwSinglePhaseReject 376 | 0x0178, ZwStartProfile 377 | 0x0179, ZwStopProfile 378 | 0x017a, ZwSuspendProcess 379 | 0x017b, NtSuspendThread 380 | 0x017c, ZwSystemDebugControl 381 | 0x017d, NtTerminateJobObject 382 | 0x017e, ZwTestAlert 383 | 0x017f, ZwThawRegistry 384 | 0x0180, ZwThawTransactions 385 | 0x0181, NtTraceControl 386 | 0x0182, NtTranslateFilePath 387 | 0x0183, ZwUmsThreadYield 388 | 0x0184, ZwUnloadDriver 389 | 0x0185, NtUnloadKey 390 | 0x0186, NtUnloadKey2 391 | 0x0187, ZwUnloadKeyEx 392 | 0x0188, ZwUnlockFile 393 | 0x0189, ZwUnlockVirtualMemory 394 | 0x018a, ZwVdmControl 395 | 0x018b, ZwWaitForDebugEvent 396 | 0x018c, NtWaitForKeyedEvent 397 | 0x018d, ZwWaitForWorkViaWorkerFactory 398 | 0x018e, ZwWaitHighEventPair 399 | 0x018f, NtWaitLowEventPair 400 | 0x0190, NtWorkerFactoryWorkerReady 401 | -------------------------------------------------------------------------------- /output_win7_sp1/ntdll_x86.txt: -------------------------------------------------------------------------------- 1 | /*0x0000,06*/NTSTATUS NtAcceptConnectPort(PHANDLE,ULONG,PPORT_MESSAGE,BOOLEAN,PPORT_SECTION_WRITE,PPORT_SECTION_READ); 2 | /*0x0001,08*/NTSTATUS NtAccessCheck(PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PACCESS_MASK,PBOOLEAN); 3 | /*0x0002,11*/NTSTATUS ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,PVOID,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN); 4 | /*0x0003,11*/NTSTATUS NtAccessCheckByType(PSECURITY_DESCRIPTOR,PSID,HANDLE,ULONG,POBJECT_TYPE_LIST,ULONG,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PACCESS_MASK,PULONG); 5 | /*0x0004,16*/NTSTATUS NtAccessCheckByTypeAndAuditAlarm(PUNICODE_STRING,PVOID,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,PSID,ACCESS_MASK,AUDIT_EVENT_TYPE,ULONG,POBJECT_TYPE_LIST,ULONG,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PULONG,PBOOLEAN); 6 | /*0x0005,11*/NTSTATUS NtAccessCheckByTypeResultList(PSECURITY_DESCRIPTOR,PSID,HANDLE,ACCESS_MASK,POBJECT_TYPE_LIST,ULONG,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PACCESS_MASK,PULONG); 7 | /*0x0006,16*/NTSTATUS NtAccessCheckByTypeResultListAndAuditAlarm(PUNICODE_STRING,PVOID,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,PSID,ACCESS_MASK,AUDIT_EVENT_TYPE,ULONG,POBJECT_TYPE_LIST,ULONG,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PULONG,PULONG); 8 | /*0x0007,17*/NTSTATUS ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(PUNICODE_STRING,PVOID,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,PSID,ACCESS_MASK,AUDIT_EVENT_TYPE,ULONG,POBJECT_TYPE_LIST,ULONG,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PULONG,PULONG); 9 | /*0x0008,03*/NTSTATUS NtAddAtom(PWSTR,ULONG,PUSHORT); 10 | /*0x0009,02*/_UNKNOWN ZwAddBootEntry(_UNKNOWN,_UNKNOWN); 11 | /*0x000a,02*/_UNKNOWN NtAddDriverEntry(_UNKNOWN,_UNKNOWN); 12 | /*0x000b,06*/NTSTATUS ZwAdjustGroupsToken(HANDLE,BOOLEAN,PTOKEN_GROUPS,ULONG,PTOKEN_GROUPS,PULONG); 13 | /*0x000c,06*/NTSTATUS ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,ULONG,PTOKEN_PRIVILEGES,PULONG); 14 | /*0x000d,02*/NTSTATUS NtAlertResumeThread(HANDLE,PULONG); 15 | /*0x000e,01*/NTSTATUS NtAlertThread(HANDLE); 16 | /*0x000f,01*/NTSTATUS ZwAllocateLocallyUniqueId(PLUID); 17 | /*0x0010,03*/_UNKNOWN NtAllocateReserveObject(_UNKNOWN,_UNKNOWN,_UNKNOWN); 18 | /*0x0011,03*/NTSTATUS NtAllocateUserPhysicalPages(HANDLE,PULONG,PULONG); 19 | /*0x0012,04*/NTSTATUS NtAllocateUuids(PLARGE_INTEGER,PULONG,PULONG,PUCHAR); 20 | /*0x0013,06*/NTSTATUS NtAllocateVirtualMemory(HANDLE,PVOID*,ULONG,PULONG,ULONG,ULONG); 21 | /*0x0014,09*/_UNKNOWN NtAlpcAcceptConnectPort(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 22 | /*0x0015,03*/_UNKNOWN ZwAlpcCancelMessage(_UNKNOWN,_UNKNOWN,_UNKNOWN); 23 | /*0x0016,11*/_UNKNOWN ZwAlpcConnectPort(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 24 | /*0x0017,03*/_UNKNOWN ZwAlpcCreatePort(_UNKNOWN,_UNKNOWN,_UNKNOWN); 25 | /*0x0018,06*/_UNKNOWN NtAlpcCreatePortSection(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 26 | /*0x0019,04*/_UNKNOWN ZwAlpcCreateResourceReserve(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 27 | /*0x001a,03*/_UNKNOWN ZwAlpcCreateSectionView(_UNKNOWN,_UNKNOWN,_UNKNOWN); 28 | /*0x001b,03*/_UNKNOWN ZwAlpcCreateSecurityContext(_UNKNOWN,_UNKNOWN,_UNKNOWN); 29 | /*0x001c,03*/_UNKNOWN ZwAlpcDeletePortSection(_UNKNOWN,_UNKNOWN,_UNKNOWN); 30 | /*0x001d,03*/_UNKNOWN NtAlpcDeleteResourceReserve(_UNKNOWN,_UNKNOWN,_UNKNOWN); 31 | /*0x001e,03*/_UNKNOWN NtAlpcDeleteSectionView(_UNKNOWN,_UNKNOWN,_UNKNOWN); 32 | /*0x001f,03*/_UNKNOWN NtAlpcDeleteSecurityContext(_UNKNOWN,_UNKNOWN,_UNKNOWN); 33 | /*0x0020,02*/_UNKNOWN NtAlpcDisconnectPort(_UNKNOWN,_UNKNOWN); 34 | /*0x0021,03*/_UNKNOWN ZwAlpcImpersonateClientOfPort(_UNKNOWN,_UNKNOWN,_UNKNOWN); 35 | /*0x0022,06*/_UNKNOWN ZwAlpcOpenSenderProcess(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 36 | /*0x0023,06*/_UNKNOWN ZwAlpcOpenSenderThread(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 37 | /*0x0024,05*/_UNKNOWN ZwAlpcQueryInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 38 | /*0x0025,06*/_UNKNOWN ZwAlpcQueryInformationMessage(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 39 | /*0x0026,03*/_UNKNOWN NtAlpcRevokeSecurityContext(_UNKNOWN,_UNKNOWN,_UNKNOWN); 40 | /*0x0027,08*/_UNKNOWN NtAlpcSendWaitReceivePort(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 41 | /*0x0028,04*/_UNKNOWN NtAlpcSetInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 42 | /*0x0029,02*/_UNKNOWN NtApphelpCacheControl(_UNKNOWN,_UNKNOWN); 43 | /*0x002a,02*/NTSTATUS ZwAreMappedFilesTheSame(PVOID,PVOID); 44 | /*0x002b,02*/NTSTATUS ZwAssignProcessToJobObject(HANDLE,HANDLE); 45 | /*0x002c,03*/NTSTATUS ZwCallbackReturn(PVOID,ULONG,NTSTATUS); 46 | /*0x002d,02*/NTSTATUS ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK); 47 | /*0x002e,03*/_UNKNOWN NtCancelIoFileEx(_UNKNOWN,_UNKNOWN,_UNKNOWN); 48 | /*0x002f,03*/_UNKNOWN NtCancelSynchronousIoFile(_UNKNOWN,_UNKNOWN,_UNKNOWN); 49 | /*0x0030,02*/NTSTATUS ZwCancelTimer(HANDLE,PBOOLEAN); 50 | /*0x0031,01*/NTSTATUS NtClearEvent(HANDLE); 51 | /*0x0032,01*/NTSTATUS NtClose(HANDLE); 52 | /*0x0033,03*/NTSTATUS ZwCloseObjectAuditAlarm(PUNICODE_STRING,PVOID,BOOLEAN); 53 | /*0x0034,02*/_UNKNOWN ZwCommitComplete(_UNKNOWN,_UNKNOWN); 54 | /*0x0035,02*/_UNKNOWN NtCommitEnlistment(_UNKNOWN,_UNKNOWN); 55 | /*0x0036,02*/_UNKNOWN NtCommitTransaction(_UNKNOWN,_UNKNOWN); 56 | /*0x0037,02*/_UNKNOWN NtCompactKeys(_UNKNOWN,_UNKNOWN); 57 | /*0x0038,03*/_UNKNOWN ZwCompareTokens(_UNKNOWN,_UNKNOWN,_UNKNOWN); 58 | /*0x0039,01*/NTSTATUS NtCompleteConnectPort(HANDLE); 59 | /*0x003a,01*/_UNKNOWN ZwCompressKey(_UNKNOWN); 60 | /*0x003b,08*/NTSTATUS NtConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PPORT_SECTION_WRITE,PPORT_SECTION_READ,PULONG,PVOID,PULONG); 61 | /*0x003c,02*/NTSTATUS ZwContinue(PCONTEXT,BOOLEAN); 62 | /*0x003d,04*/_UNKNOWN ZwCreateDebugObject(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 63 | /*0x003e,03*/NTSTATUS ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 64 | /*0x003f,08*/_UNKNOWN ZwCreateEnlistment(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 65 | /*0x0040,05*/NTSTATUS NtCreateEvent(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,EVENT_TYPE,BOOLEAN); 66 | /*0x0041,03*/NTSTATUS NtCreateEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 67 | /*0x0042,11*/NTSTATUS NtCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG); 68 | /*0x0043,04*/NTSTATUS NtCreateIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG); 69 | /*0x0044,03*/NTSTATUS ZwCreateJobObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 70 | /*0x0045,03*/_UNKNOWN NtCreateJobSet(_UNKNOWN,_UNKNOWN,_UNKNOWN); 71 | /*0x0046,07*/NTSTATUS ZwCreateKey(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG,PUNICODE_STRING,ULONG,PULONG); 72 | /*0x0047,04*/_UNKNOWN ZwCreateKeyedEvent(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 73 | /*0x0048,08*/_UNKNOWN NtCreateKeyTransacted(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 74 | /*0x0049,08*/NTSTATUS ZwCreateMailslotFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,PLARGE_INTEGER); 75 | /*0x004a,04*/NTSTATUS ZwCreateMutant(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,BOOLEAN); 76 | /*0x004b,14*/NTSTATUS ZwCreateNamedPipeFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,BOOLEAN,BOOLEAN,BOOLEAN,ULONG,ULONG,ULONG,PLARGE_INTEGER); 77 | /*0x004c,04*/NTSTATUS NtCreatePagingFile(PUNICODE_STRING,PULARGE_INTEGER,PULARGE_INTEGER,ULONG); 78 | /*0x004d,05*/NTSTATUS ZwCreatePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,ULONG); 79 | /*0x004e,04*/_UNKNOWN NtCreatePrivateNamespace(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 80 | /*0x004f,08*/NTSTATUS ZwCreateProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,BOOLEAN,HANDLE,HANDLE,HANDLE); 81 | /*0x0050,09*/_UNKNOWN ZwCreateProcessEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 82 | /*0x0051,09*/NTSTATUS ZwCreateProfile(PHANDLE,HANDLE,PVOID,ULONG,ULONG,PULONG,ULONG,KPROFILE_SOURCE,ULONG); 83 | /*0x0052,10*/_UNKNOWN NtCreateProfileEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 84 | /*0x0053,07*/_UNKNOWN ZwCreateResourceManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 85 | /*0x0054,07*/NTSTATUS NtCreateSection(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PLARGE_INTEGER,ULONG,ULONG,HANDLE); 86 | /*0x0055,05*/NTSTATUS NtCreateSemaphore(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,LONG,LONG); 87 | /*0x0056,04*/NTSTATUS ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING); 88 | /*0x0057,08*/NTSTATUS NtCreateThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PCONTEXT,PUSER_STACK,BOOLEAN); 89 | /*0x0058,11*/_UNKNOWN NtCreateThreadEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 90 | /*0x0059,04*/NTSTATUS ZwCreateTimer(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,TIMER_TYPE); 91 | /*0x005a,13*/NTSTATUS NtCreateToken(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,TOKEN_TYPE,PLUID,PLARGE_INTEGER,PTOKEN_USER,PTOKEN_GROUPS,PTOKEN_PRIVILEGES,PTOKEN_OWNER,PTOKEN_PRIMARY_GROUP,PTOKEN_DEFAULT_DACL,PTOKEN_SOURCE); 92 | /*0x005b,10*/_UNKNOWN NtCreateTransaction(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 93 | /*0x005c,06*/_UNKNOWN ZwCreateTransactionManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 94 | /*0x005d,11*/_UNKNOWN NtCreateUserProcess(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 95 | /*0x005e,05*/NTSTATUS ZwCreateWaitablePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,ULONG); 96 | /*0x005f,10*/_UNKNOWN NtCreateWorkerFactory(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 97 | /*0x0060,02*/_UNKNOWN NtDebugActiveProcess(_UNKNOWN,_UNKNOWN); 98 | /*0x0061,03*/_UNKNOWN ZwDebugContinue(_UNKNOWN,_UNKNOWN,_UNKNOWN); 99 | /*0x0062,02*/NTSTATUS ZwDelayExecution(BOOLEAN,PLARGE_INTEGER); 100 | /*0x0063,01*/NTSTATUS ZwDeleteAtom(USHORT); 101 | /*0x0064,01*/_UNKNOWN NtDeleteBootEntry(_UNKNOWN); 102 | /*0x0065,01*/_UNKNOWN ZwDeleteDriverEntry(_UNKNOWN); 103 | /*0x0066,01*/NTSTATUS NtDeleteFile(POBJECT_ATTRIBUTES); 104 | /*0x0067,01*/NTSTATUS ZwDeleteKey(HANDLE); 105 | /*0x0068,03*/NTSTATUS NtDeleteObjectAuditAlarm(PUNICODE_STRING,PVOID,BOOLEAN); 106 | /*0x0069,01*/_UNKNOWN NtDeletePrivateNamespace(_UNKNOWN); 107 | /*0x006a,02*/NTSTATUS NtDeleteValueKey(HANDLE,PUNICODE_STRING); 108 | /*0x006b,10*/NTSTATUS ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG); 109 | /*0x006c,00*/DWORD NtDisableLastKnownGood(VOID); 110 | /*0x006d,01*/NTSTATUS NtDisplayString(PUNICODE_STRING); 111 | /*0x006e,01*/_UNKNOWN ZwDrawText(_UNKNOWN); 112 | /*0x006f,07*/NTSTATUS ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG); 113 | /*0x0070,06*/NTSTATUS NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,BOOLEAN,TOKEN_TYPE,PHANDLE); 114 | /*0x0071,00*/DWORD NtEnableLastKnownGood(VOID); 115 | /*0x0072,02*/_UNKNOWN ZwEnumerateBootEntries(_UNKNOWN,_UNKNOWN); 116 | /*0x0073,02*/_UNKNOWN NtEnumerateDriverEntries(_UNKNOWN,_UNKNOWN); 117 | /*0x0074,06*/NTSTATUS ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,PVOID,ULONG,PULONG); 118 | /*0x0075,03*/_UNKNOWN ZwEnumerateSystemEnvironmentValuesEx(_UNKNOWN,_UNKNOWN,_UNKNOWN); 119 | /*0x0076,05*/_UNKNOWN ZwEnumerateTransactionObject(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 120 | /*0x0077,06*/NTSTATUS NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG); 121 | /*0x0078,02*/NTSTATUS ZwExtendSection(HANDLE,PLARGE_INTEGER); 122 | /*0x0079,06*/NTSTATUS NtFilterToken(HANDLE,ULONG,PTOKEN_GROUPS,PTOKEN_PRIVILEGES,PTOKEN_GROUPS,PHANDLE); 123 | /*0x007a,03*/NTSTATUS NtFindAtom(PWSTR,ULONG,PUSHORT); 124 | /*0x007b,02*/NTSTATUS ZwFlushBuffersFile(HANDLE,PIO_STATUS_BLOCK); 125 | /*0x007c,02*/_UNKNOWN ZwFlushInstallUILanguage(_UNKNOWN,_UNKNOWN); 126 | /*0x007d,03*/NTSTATUS ZwFlushInstructionCache(HANDLE,PVOID,ULONG); 127 | /*0x007e,01*/NTSTATUS NtFlushKey(HANDLE); 128 | /*0x007f,00*/DWORD ZwFlushProcessWriteBuffers(VOID); 129 | /*0x0080,04*/NTSTATUS ZwFlushVirtualMemory(HANDLE,PVOID*,PULONG,PIO_STATUS_BLOCK); 130 | /*0x0081,01*/NTSTATUS NtFlushWriteBuffer(VOID); 131 | /*0x0082,03*/NTSTATUS NtFreeUserPhysicalPages(HANDLE,PULONG,PULONG); 132 | /*0x0083,04*/NTSTATUS NtFreeVirtualMemory(HANDLE,PVOID*,PULONG,ULONG); 133 | /*0x0084,01*/_UNKNOWN NtFreezeRegistry(_UNKNOWN); 134 | /*0x0085,02*/_UNKNOWN ZwFreezeTransactions(_UNKNOWN,_UNKNOWN); 135 | /*0x0086,10*/NTSTATUS NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG); 136 | /*0x0087,02*/NTSTATUS NtGetContextThread(HANDLE,PCONTEXT); 137 | /*0x0088,00*/DWORD NtGetCurrentProcessorNumber(VOID); 138 | /*0x0089,02*/NTSTATUS NtGetDevicePowerState(HANDLE,PDEVICE_POWER_STATE); 139 | /*0x008a,03*/_UNKNOWN NtGetMUIRegistryInfo(_UNKNOWN,_UNKNOWN,_UNKNOWN); 140 | /*0x008b,05*/_UNKNOWN ZwGetNextProcess(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 141 | /*0x008c,06*/_UNKNOWN ZwGetNextThread(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 142 | /*0x008d,05*/_UNKNOWN NtGetNlsSectionPtr(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 143 | /*0x008e,07*/_UNKNOWN ZwGetNotificationResourceManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 144 | /*0x008f,04*/NTSTATUS ZwGetPlugPlayEvent(ULONG,ULONG,PVOID,ULONG); 145 | /*0x0090,07*/NTSTATUS NtGetWriteWatch(HANDLE,ULONG,PVOID,ULONG,PULONG,PULONG,PULONG); 146 | /*0x0091,01*/NTSTATUS NtImpersonateAnonymousToken(HANDLE); 147 | /*0x0092,02*/NTSTATUS ZwImpersonateClientOfPort(HANDLE,PPORT_MESSAGE); 148 | /*0x0093,03*/NTSTATUS ZwImpersonateThread(HANDLE,HANDLE,PSECURITY_QUALITY_OF_SERVICE); 149 | /*0x0094,03*/_UNKNOWN NtInitializeNlsFiles(_UNKNOWN,_UNKNOWN,_UNKNOWN); 150 | /*0x0095,01*/_UNKNOWN ZwInitializeRegistry(_UNKNOWN); 151 | /*0x0096,04*/NTSTATUS NtInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN); 152 | /*0x0097,02*/_UNKNOWN ZwIsProcessInJob(_UNKNOWN,_UNKNOWN); 153 | /*0x0098,01*/BOOLEAN NtIsSystemResumeAutomatic(VOID); 154 | /*0x0099,00*/DWORD ZwIsUILanguageComitted(VOID); 155 | /*0x009a,02*/NTSTATUS ZwListenPort(HANDLE,PPORT_MESSAGE); 156 | /*0x009b,01*/NTSTATUS NtLoadDriver(PUNICODE_STRING); 157 | /*0x009c,02*/NTSTATUS NtLoadKey(POBJECT_ATTRIBUTES,POBJECT_ATTRIBUTES); 158 | /*0x009d,03*/NTSTATUS NtLoadKey2(POBJECT_ATTRIBUTES,POBJECT_ATTRIBUTES,ULONG); 159 | /*0x009e,08*/_UNKNOWN NtLoadKeyEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 160 | /*0x009f,10*/NTSTATUS NtLockFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PULARGE_INTEGER,PULARGE_INTEGER,ULONG,BOOLEAN,BOOLEAN); 161 | /*0x00a0,02*/_UNKNOWN ZwLockProductActivationKeys(_UNKNOWN,_UNKNOWN); 162 | /*0x00a1,01*/_UNKNOWN NtLockRegistryKey(_UNKNOWN); 163 | /*0x00a2,04*/NTSTATUS ZwLockVirtualMemory(HANDLE,PVOID*,PULONG,ULONG); 164 | /*0x00a3,01*/_UNKNOWN ZwMakePermanentObject(_UNKNOWN); 165 | /*0x00a4,01*/NTSTATUS NtMakeTemporaryObject(HANDLE); 166 | /*0x00a5,06*/_UNKNOWN ZwMapCMFModule(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 167 | /*0x00a6,03*/NTSTATUS NtMapUserPhysicalPages(PVOID,PULONG,PULONG); 168 | /*0x00a7,03*/NTSTATUS ZwMapUserPhysicalPagesScatter(PVOID*,PULONG,PULONG); 169 | /*0x00a8,10*/NTSTATUS ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,PLARGE_INTEGER,PSIZE_T,SECTION_INHERIT,ULONG,ULONG); 170 | /*0x00a9,01*/_UNKNOWN NtModifyBootEntry(_UNKNOWN); 171 | /*0x00aa,01*/_UNKNOWN ZwModifyDriverEntry(_UNKNOWN); 172 | /*0x00ab,09*/NTSTATUS NtNotifyChangeDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PFILE_NOTIFY_INFORMATION,ULONG,ULONG,BOOLEAN); 173 | /*0x00ac,10*/NTSTATUS NtNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN); 174 | /*0x00ad,12*/NTSTATUS NtNotifyChangeMultipleKeys(HANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN); 175 | /*0x00ae,08*/_UNKNOWN NtNotifyChangeSession(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 176 | /*0x00af,03*/NTSTATUS ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 177 | /*0x00b0,05*/_UNKNOWN ZwOpenEnlistment(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 178 | /*0x00b1,03*/NTSTATUS NtOpenEvent(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 179 | /*0x00b2,03*/NTSTATUS NtOpenEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 180 | /*0x00b3,06*/NTSTATUS NtOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG); 181 | /*0x00b4,03*/NTSTATUS ZwOpenIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 182 | /*0x00b5,03*/NTSTATUS ZwOpenJobObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 183 | /*0x00b6,03*/NTSTATUS ZwOpenKey(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 184 | /*0x00b7,04*/_UNKNOWN ZwOpenKeyEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 185 | /*0x00b8,03*/_UNKNOWN NtOpenKeyedEvent(_UNKNOWN,_UNKNOWN,_UNKNOWN); 186 | /*0x00b9,04*/_UNKNOWN NtOpenKeyTransacted(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 187 | /*0x00ba,05*/_UNKNOWN NtOpenKeyTransactedEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 188 | /*0x00bb,03*/NTSTATUS NtOpenMutant(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 189 | /*0x00bc,12*/NTSTATUS ZwOpenObjectAuditAlarm(PUNICODE_STRING,PVOID*,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,ACCESS_MASK,PPRIVILEGE_SET,BOOLEAN,BOOLEAN,PBOOLEAN); 190 | /*0x00bd,04*/_UNKNOWN NtOpenPrivateNamespace(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 191 | /*0x00be,04*/NTSTATUS ZwOpenProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PCLIENT_ID); 192 | /*0x00bf,03*/NTSTATUS ZwOpenProcessToken(HANDLE,ACCESS_MASK,PHANDLE); 193 | /*0x00c0,04*/_UNKNOWN ZwOpenProcessTokenEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 194 | /*0x00c1,05*/_UNKNOWN ZwOpenResourceManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 195 | /*0x00c2,03*/NTSTATUS NtOpenSection(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 196 | /*0x00c3,03*/NTSTATUS NtOpenSemaphore(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 197 | /*0x00c4,03*/_UNKNOWN NtOpenSession(_UNKNOWN,_UNKNOWN,_UNKNOWN); 198 | /*0x00c5,03*/NTSTATUS NtOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 199 | /*0x00c6,04*/NTSTATUS ZwOpenThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PCLIENT_ID); 200 | /*0x00c7,04*/NTSTATUS NtOpenThreadToken(HANDLE,ACCESS_MASK,BOOLEAN,PHANDLE); 201 | /*0x00c8,05*/_UNKNOWN NtOpenThreadTokenEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 202 | /*0x00c9,03*/NTSTATUS ZwOpenTimer(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES); 203 | /*0x00ca,05*/_UNKNOWN ZwOpenTransaction(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 204 | /*0x00cb,06*/_UNKNOWN ZwOpenTransactionManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 205 | /*0x00cc,03*/_UNKNOWN NtPlugPlayControl(_UNKNOWN,_UNKNOWN,_UNKNOWN); 206 | /*0x00cd,05*/NTSTATUS ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG); 207 | /*0x00ce,02*/_UNKNOWN NtPrepareComplete(_UNKNOWN,_UNKNOWN); 208 | /*0x00cf,02*/_UNKNOWN ZwPrepareEnlistment(_UNKNOWN,_UNKNOWN); 209 | /*0x00d0,02*/_UNKNOWN ZwPrePrepareComplete(_UNKNOWN,_UNKNOWN); 210 | /*0x00d1,02*/_UNKNOWN NtPrePrepareEnlistment(_UNKNOWN,_UNKNOWN); 211 | /*0x00d2,03*/NTSTATUS ZwPrivilegeCheck(HANDLE,PPRIVILEGE_SET,PBOOLEAN); 212 | /*0x00d3,05*/NTSTATUS NtPrivilegedServiceAuditAlarm(PUNICODE_STRING,PUNICODE_STRING,HANDLE,PPRIVILEGE_SET,BOOLEAN); 213 | /*0x00d4,06*/NTSTATUS ZwPrivilegeObjectAuditAlarm(PUNICODE_STRING,PVOID,HANDLE,ACCESS_MASK,PPRIVILEGE_SET,BOOLEAN); 214 | /*0x00d5,04*/_UNKNOWN NtPropagationComplete(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 215 | /*0x00d6,03*/_UNKNOWN ZwPropagationFailed(_UNKNOWN,_UNKNOWN,_UNKNOWN); 216 | /*0x00d7,05*/NTSTATUS ZwProtectVirtualMemory(HANDLE,PVOID*,PULONG,ULONG,PULONG); 217 | /*0x00d8,02*/NTSTATUS ZwPulseEvent(HANDLE,PULONG); 218 | /*0x00d9,02*/NTSTATUS ZwQueryAttributesFile(POBJECT_ATTRIBUTES,PFILE_BASIC_INFORMATION); 219 | /*0x00da,02*/_UNKNOWN ZwQueryBootEntryOrder(_UNKNOWN,_UNKNOWN); 220 | /*0x00db,02*/_UNKNOWN ZwQueryBootOptions(_UNKNOWN,_UNKNOWN); 221 | /*0x00dc,02*/_UNKNOWN NtQueryDebugFilterState(_UNKNOWN,_UNKNOWN); 222 | /*0x00dd,02*/NTSTATUS NtQueryDefaultLocale(BOOLEAN,PLCID); 223 | /*0x00de,01*/NTSTATUS ZwQueryDefaultUILanguage(PLANGID); 224 | /*0x00df,11*/NTSTATUS ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN); 225 | /*0x00e0,07*/NTSTATUS ZwQueryDirectoryObject(HANDLE,PVOID,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG); 226 | /*0x00e1,02*/_UNKNOWN NtQueryDriverEntryOrder(_UNKNOWN,_UNKNOWN); 227 | /*0x00e2,09*/NTSTATUS ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PFILE_FULL_EA_INFORMATION,ULONG,BOOLEAN,PFILE_GET_EA_INFORMATION,ULONG,PULONG,BOOLEAN); 228 | /*0x00e3,05*/NTSTATUS NtQueryEvent(HANDLE,EVENT_INFORMATION_CLASS,PVOID,ULONG,PULONG); 229 | /*0x00e4,02*/NTSTATUS ZwQueryFullAttributesFile(POBJECT_ATTRIBUTES,PFILE_NETWORK_OPEN_INFORMATION); 230 | /*0x00e5,05*/NTSTATUS NtQueryInformationAtom(USHORT,ATOM_INFORMATION_CLASS,PVOID,ULONG,PULONG); 231 | /*0x00e6,05*/_UNKNOWN ZwQueryInformationEnlistment(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 232 | /*0x00e7,05*/NTSTATUS ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS); 233 | /*0x00e8,05*/NTSTATUS ZwQueryInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG,PULONG); 234 | /*0x00e9,05*/NTSTATUS ZwQueryInformationPort(HANDLE,PORT_INFORMATION_CLASS,PVOID,ULONG,PULONG); 235 | /*0x00ea,05*/NTSTATUS ZwQueryInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG); 236 | /*0x00eb,05*/_UNKNOWN ZwQueryInformationResourceManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 237 | /*0x00ec,05*/NTSTATUS NtQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG); 238 | /*0x00ed,05*/NTSTATUS ZwQueryInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG,PULONG); 239 | /*0x00ee,05*/_UNKNOWN ZwQueryInformationTransaction(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 240 | /*0x00ef,05*/_UNKNOWN NtQueryInformationTransactionManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 241 | /*0x00f0,05*/_UNKNOWN ZwQueryInformationWorkerFactory(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 242 | /*0x00f1,01*/NTSTATUS NtQueryInstallUILanguage(PLANGID); 243 | /*0x00f2,02*/NTSTATUS NtQueryIntervalProfile(KPROFILE_SOURCE,PULONG); 244 | /*0x00f3,05*/NTSTATUS NtQueryIoCompletion(HANDLE,IO_COMPLETION_INFORMATION_CLASS,PVOID,ULONG,PULONG); 245 | /*0x00f4,05*/NTSTATUS ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,PVOID,ULONG,PULONG); 246 | /*0x00f5,05*/_UNKNOWN NtQueryLicenseValue(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 247 | /*0x00f6,06*/NTSTATUS NtQueryMultipleValueKey(HANDLE,PKEY_VALUE_ENTRY,ULONG,PVOID,PULONG,PULONG); 248 | /*0x00f7,05*/NTSTATUS NtQueryMutant(HANDLE,MUTANT_INFORMATION_CLASS,PVOID,ULONG,PULONG); 249 | /*0x00f8,05*/NTSTATUS NtQueryObject(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG); 250 | /*0x00f9,02*/_UNKNOWN NtQueryOpenSubKeys(_UNKNOWN,_UNKNOWN); 251 | /*0x00fa,04*/_UNKNOWN NtQueryOpenSubKeysEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 252 | /*0x00fb,02*/NTSTATUS NtQueryPerformanceCounter(PLARGE_INTEGER,PLARGE_INTEGER); 253 | /*0x00fc,00*/DWORD ZwQueryPortInformationProcess(VOID); 254 | /*0x00fd,09*/NTSTATUS ZwQueryQuotaInformationFile(HANDLE,PIO_STATUS_BLOCK,PFILE_USER_QUOTA_INFORMATION,ULONG,BOOLEAN,PFILE_QUOTA_LIST_INFORMATION,ULONG,PSID,BOOLEAN); 255 | /*0x00fe,05*/NTSTATUS ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG); 256 | /*0x00ff,06*/_UNKNOWN ZwQuerySecurityAttributesToken(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 257 | /*0x0100,05*/NTSTATUS NtQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG); 258 | /*0x0101,05*/NTSTATUS ZwQuerySemaphore(HANDLE,SEMAPHORE_INFORMATION_CLASS,PVOID,ULONG,PULONG); 259 | /*0x0102,03*/NTSTATUS ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG); 260 | /*0x0103,04*/NTSTATUS ZwQuerySystemEnvironmentValue(PUNICODE_STRING,PVOID,ULONG,PULONG); 261 | /*0x0104,05*/_UNKNOWN ZwQuerySystemEnvironmentValueEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 262 | /*0x0105,04*/NTSTATUS NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG); 263 | /*0x0106,06*/_UNKNOWN ZwQuerySystemInformationEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 264 | /*0x0107,01*/NTSTATUS NtQuerySystemTime(PLARGE_INTEGER); 265 | /*0x0108,05*/NTSTATUS ZwQueryTimer(HANDLE,TIMER_INFORMATION_CLASS,PVOID,ULONG,PULONG); 266 | /*0x0109,03*/NTSTATUS NtQueryTimerResolution(PULONG,PULONG,PULONG); 267 | /*0x010a,06*/NTSTATUS ZwQueryValueKey(HANDLE,PUNICODE_STRING,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG); 268 | /*0x010b,06*/NTSTATUS NtQueryVirtualMemory(HANDLE,PVOID,MEMORY_INFORMATION_CLASS,PVOID,ULONG,PULONG); 269 | /*0x010c,05*/NTSTATUS NtQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS); 270 | /*0x010d,05*/NTSTATUS NtQueueApcThread(HANDLE,PKNORMAL_ROUTINE,PVOID,PVOID,PVOID); 271 | /*0x010e,06*/_UNKNOWN NtQueueApcThreadEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 272 | /*0x010f,03*/NTSTATUS ZwRaiseException(PEXCEPTION_RECORD,PCONTEXT,BOOLEAN); 273 | /*0x0110,06*/NTSTATUS ZwRaiseHardError(NTSTATUS,ULONG,ULONG,PULONG,ULONG,PULONG); 274 | /*0x0111,09*/NTSTATUS NtReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG); 275 | /*0x0112,09*/NTSTATUS NtReadFileScatter(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PFILE_SEGMENT_ELEMENT,ULONG,PLARGE_INTEGER,PULONG); 276 | /*0x0113,02*/_UNKNOWN ZwReadOnlyEnlistment(_UNKNOWN,_UNKNOWN); 277 | /*0x0114,06*/NTSTATUS ZwReadRequestData(HANDLE,PPORT_MESSAGE,ULONG,PVOID,ULONG,PULONG); 278 | /*0x0115,05*/NTSTATUS NtReadVirtualMemory(HANDLE,PVOID,PVOID,ULONG,PULONG); 279 | /*0x0116,02*/_UNKNOWN NtRecoverEnlistment(_UNKNOWN,_UNKNOWN); 280 | /*0x0117,01*/_UNKNOWN NtRecoverResourceManager(_UNKNOWN); 281 | /*0x0118,01*/_UNKNOWN ZwRecoverTransactionManager(_UNKNOWN); 282 | /*0x0119,05*/_UNKNOWN ZwRegisterProtocolAddressInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 283 | /*0x011a,01*/NTSTATUS ZwRegisterThreadTerminatePort(HANDLE); 284 | /*0x011b,04*/_UNKNOWN NtReleaseKeyedEvent(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 285 | /*0x011c,02*/NTSTATUS ZwReleaseMutant(HANDLE,PULONG); 286 | /*0x011d,03*/NTSTATUS NtReleaseSemaphore(HANDLE,LONG,PLONG); 287 | /*0x011e,01*/_UNKNOWN ZwReleaseWorkerFactoryWorker(_UNKNOWN); 288 | /*0x011f,05*/NTSTATUS ZwRemoveIoCompletion(HANDLE,PULONG,PULONG,PIO_STATUS_BLOCK,PLARGE_INTEGER); 289 | /*0x0120,06*/_UNKNOWN ZwRemoveIoCompletionEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 290 | /*0x0121,02*/_UNKNOWN ZwRemoveProcessDebug(_UNKNOWN,_UNKNOWN); 291 | /*0x0122,02*/_UNKNOWN ZwRenameKey(_UNKNOWN,_UNKNOWN); 292 | /*0x0123,02*/_UNKNOWN NtRenameTransactionManager(_UNKNOWN,_UNKNOWN); 293 | /*0x0124,03*/NTSTATUS ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES); 294 | /*0x0125,03*/_UNKNOWN NtReplacePartitionUnit(_UNKNOWN,_UNKNOWN,_UNKNOWN); 295 | /*0x0126,02*/NTSTATUS ZwReplyPort(HANDLE,PPORT_MESSAGE); 296 | /*0x0127,04*/NTSTATUS NtReplyWaitReceivePort(HANDLE,PULONG,PPORT_MESSAGE,PPORT_MESSAGE); 297 | /*0x0128,05*/NTSTATUS NtReplyWaitReceivePortEx(HANDLE,PULONG,PPORT_MESSAGE,PPORT_MESSAGE,PLARGE_INTEGER); 298 | /*0x0129,02*/NTSTATUS NtReplyWaitReplyPort(HANDLE,PPORT_MESSAGE); 299 | /*0x012a,02*/NTSTATUS ZwRequestPort(HANDLE,PPORT_MESSAGE); 300 | /*0x012b,03*/NTSTATUS NtRequestWaitReplyPort(HANDLE,PPORT_MESSAGE,PPORT_MESSAGE); 301 | /*0x012c,02*/NTSTATUS NtResetEvent(HANDLE,PULONG); 302 | /*0x012d,03*/NTSTATUS ZwResetWriteWatch(HANDLE,PVOID,ULONG); 303 | /*0x012e,03*/NTSTATUS NtRestoreKey(HANDLE,HANDLE,ULONG); 304 | /*0x012f,01*/_UNKNOWN ZwResumeProcess(_UNKNOWN); 305 | /*0x0130,02*/NTSTATUS ZwResumeThread(HANDLE,PULONG); 306 | /*0x0131,02*/_UNKNOWN ZwRollbackComplete(_UNKNOWN,_UNKNOWN); 307 | /*0x0132,02*/_UNKNOWN NtRollbackEnlistment(_UNKNOWN,_UNKNOWN); 308 | /*0x0133,02*/_UNKNOWN NtRollbackTransaction(_UNKNOWN,_UNKNOWN); 309 | /*0x0134,02*/_UNKNOWN NtRollforwardTransactionManager(_UNKNOWN,_UNKNOWN); 310 | /*0x0135,02*/NTSTATUS NtSaveKey(HANDLE,HANDLE); 311 | /*0x0136,03*/_UNKNOWN NtSaveKeyEx(_UNKNOWN,_UNKNOWN,_UNKNOWN); 312 | /*0x0137,03*/NTSTATUS NtSaveMergedKeys(HANDLE,HANDLE,HANDLE); 313 | /*0x0138,09*/NTSTATUS NtSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PPORT_SECTION_WRITE,PSID,PPORT_SECTION_READ,PULONG,PVOID,PULONG); 314 | /*0x0139,00*/DWORD NtSerializeBoot(VOID); 315 | /*0x013a,02*/_UNKNOWN ZwSetBootEntryOrder(_UNKNOWN,_UNKNOWN); 316 | /*0x013b,02*/_UNKNOWN ZwSetBootOptions(_UNKNOWN,_UNKNOWN); 317 | /*0x013c,02*/NTSTATUS ZwSetContextThread(HANDLE,PCONTEXT); 318 | /*0x013d,03*/_UNKNOWN NtSetDebugFilterState(_UNKNOWN,_UNKNOWN,_UNKNOWN); 319 | /*0x013e,01*/NTSTATUS NtSetDefaultHardErrorPort(HANDLE); 320 | /*0x013f,02*/NTSTATUS NtSetDefaultLocale(BOOLEAN,LCID); 321 | /*0x0140,01*/NTSTATUS ZwSetDefaultUILanguage(LANGID); 322 | /*0x0141,02*/_UNKNOWN NtSetDriverEntryOrder(_UNKNOWN,_UNKNOWN); 323 | /*0x0142,04*/NTSTATUS ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PFILE_FULL_EA_INFORMATION,ULONG); 324 | /*0x0143,02*/NTSTATUS NtSetEvent(HANDLE,PULONG); 325 | /*0x0144,01*/_UNKNOWN NtSetEventBoostPriority(_UNKNOWN); 326 | /*0x0145,01*/NTSTATUS NtSetHighEventPair(HANDLE); 327 | /*0x0146,01*/NTSTATUS NtSetHighWaitLowEventPair(HANDLE); 328 | /*0x0147,05*/_UNKNOWN ZwSetInformationDebugObject(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 329 | /*0x0148,04*/_UNKNOWN NtSetInformationEnlistment(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 330 | /*0x0149,05*/NTSTATUS ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS); 331 | /*0x014a,04*/NTSTATUS ZwSetInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG); 332 | /*0x014b,04*/NTSTATUS ZwSetInformationKey(HANDLE,KEY_SET_INFORMATION_CLASS,PVOID,ULONG); 333 | /*0x014c,04*/NTSTATUS ZwSetInformationObject(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG); 334 | /*0x014d,04*/NTSTATUS ZwSetInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG); 335 | /*0x014e,04*/_UNKNOWN ZwSetInformationResourceManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 336 | /*0x014f,04*/NTSTATUS ZwSetInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG); 337 | /*0x0150,04*/NTSTATUS ZwSetInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG); 338 | /*0x0151,04*/_UNKNOWN ZwSetInformationTransaction(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 339 | /*0x0152,04*/_UNKNOWN ZwSetInformationTransactionManager(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 340 | /*0x0153,04*/_UNKNOWN ZwSetInformationWorkerFactory(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 341 | /*0x0154,02*/NTSTATUS NtSetIntervalProfile(ULONG,KPROFILE_SOURCE); 342 | /*0x0155,05*/NTSTATUS NtSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG); 343 | /*0x0156,06*/_UNKNOWN NtSetIoCompletionEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 344 | /*0x0157,04*/NTSTATUS ZwSetLdtEntries(ULONG,LDT_ENTRY,ULONG,LDT_ENTRY); 345 | /*0x0158,01*/NTSTATUS ZwSetLowEventPair(HANDLE); 346 | /*0x0159,01*/NTSTATUS ZwSetLowWaitHighEventPair(HANDLE); 347 | /*0x015a,04*/NTSTATUS ZwSetQuotaInformationFile(HANDLE,PIO_STATUS_BLOCK,PFILE_USER_QUOTA_INFORMATION,ULONG); 348 | /*0x015b,03*/NTSTATUS NtSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR); 349 | /*0x015c,02*/NTSTATUS ZwSetSystemEnvironmentValue(PUNICODE_STRING,PUNICODE_STRING); 350 | /*0x015d,05*/_UNKNOWN ZwSetSystemEnvironmentValueEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 351 | /*0x015e,03*/NTSTATUS ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG); 352 | /*0x015f,03*/NTSTATUS ZwSetSystemPowerState(POWER_ACTION,SYSTEM_POWER_STATE,ULONG); 353 | /*0x0160,02*/NTSTATUS ZwSetSystemTime(PLARGE_INTEGER,PLARGE_INTEGER); 354 | /*0x0161,02*/NTSTATUS ZwSetThreadExecutionState(EXECUTION_STATE,PEXECUTION_STATE); 355 | /*0x0162,07*/NTSTATUS ZwSetTimer(HANDLE,PLARGE_INTEGER,PTIMER_APC_ROUTINE,PVOID,BOOLEAN,LONG,PBOOLEAN); 356 | /*0x0163,04*/_UNKNOWN ZwSetTimerEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 357 | /*0x0164,03*/NTSTATUS NtSetTimerResolution(ULONG,BOOLEAN,PULONG); 358 | /*0x0165,01*/NTSTATUS ZwSetUuidSeed(PUCHAR); 359 | /*0x0166,06*/NTSTATUS ZwSetValueKey(HANDLE,PUNICODE_STRING,ULONG,ULONG,PVOID,ULONG); 360 | /*0x0167,05*/NTSTATUS NtSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS); 361 | /*0x0168,01*/NTSTATUS ZwShutdownSystem(SHUTDOWN_ACTION); 362 | /*0x0169,02*/_UNKNOWN NtShutdownWorkerFactory(_UNKNOWN,_UNKNOWN); 363 | /*0x016a,04*/NTSTATUS ZwSignalAndWaitForSingleObject(HANDLE,HANDLE,BOOLEAN,PLARGE_INTEGER); 364 | /*0x016b,02*/_UNKNOWN ZwSinglePhaseReject(_UNKNOWN,_UNKNOWN); 365 | /*0x016c,01*/NTSTATUS NtStartProfile(HANDLE); 366 | /*0x016d,01*/NTSTATUS ZwStopProfile(HANDLE); 367 | /*0x016e,01*/_UNKNOWN ZwSuspendProcess(_UNKNOWN); 368 | /*0x016f,02*/NTSTATUS ZwSuspendThread(HANDLE,PULONG); 369 | /*0x0170,06*/NTSTATUS NtSystemDebugControl(DEBUG_CONTROL_CODE,PVOID,ULONG,PVOID,ULONG,PULONG); 370 | /*0x0171,02*/NTSTATUS ZwTerminateJobObject(HANDLE,NTSTATUS); 371 | /*0x0172,02*/NTSTATUS ZwTerminateProcess(HANDLE,NTSTATUS); 372 | /*0x0173,02*/NTSTATUS ZwTerminateThread(HANDLE,NTSTATUS); 373 | /*0x0174,01*/NTSTATUS NtTestAlert(VOID); 374 | /*0x0175,00*/DWORD ZwThawRegistry(VOID); 375 | /*0x0176,00*/DWORD NtThawTransactions(VOID); 376 | /*0x0177,06*/_UNKNOWN ZwTraceControl(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 377 | /*0x0178,04*/_UNKNOWN NtTraceEvent(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 378 | /*0x0179,04*/_UNKNOWN NtTranslateFilePath(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 379 | /*0x017a,01*/_UNKNOWN ZwUmsThreadYield(_UNKNOWN); 380 | /*0x017b,01*/NTSTATUS ZwUnloadDriver(PUNICODE_STRING); 381 | /*0x017c,01*/NTSTATUS NtUnloadKey(POBJECT_ATTRIBUTES); 382 | /*0x017d,02*/_UNKNOWN ZwUnloadKey2(_UNKNOWN,_UNKNOWN); 383 | /*0x017e,02*/_UNKNOWN ZwUnloadKeyEx(_UNKNOWN,_UNKNOWN); 384 | /*0x017f,05*/NTSTATUS ZwUnlockFile(HANDLE,PIO_STATUS_BLOCK,PULARGE_INTEGER,PULARGE_INTEGER,ULONG); 385 | /*0x0180,04*/NTSTATUS NtUnlockVirtualMemory(HANDLE,PVOID*,PULONG,ULONG); 386 | /*0x0181,02*/NTSTATUS NtUnmapViewOfSection(HANDLE,PVOID); 387 | /*0x0182,02*/NTSTATUS NtVdmControl(ULONG,PVOID); 388 | /*0x0183,04*/_UNKNOWN NtWaitForDebugEvent(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 389 | /*0x0184,04*/_UNKNOWN NtWaitForKeyedEvent(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 390 | /*0x0185,05*/NTSTATUS NtWaitForMultipleObjects(ULONG,PHANDLE,WAIT_TYPE,BOOLEAN,PLARGE_INTEGER); 391 | /*0x0186,05*/_UNKNOWN NtWaitForMultipleObjects32(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 392 | /*0x0187,03*/NTSTATUS ZwWaitForSingleObject(HANDLE,BOOLEAN,PLARGE_INTEGER); 393 | /*0x0188,02*/_UNKNOWN NtWaitForWorkViaWorkerFactory(_UNKNOWN,_UNKNOWN); 394 | /*0x0189,01*/NTSTATUS ZwWaitHighEventPair(HANDLE); 395 | /*0x018a,01*/NTSTATUS NtWaitLowEventPair(HANDLE); 396 | /*0x018b,01*/_UNKNOWN NtWorkerFactoryWorkerReady(_UNKNOWN); 397 | /*0x018c,09*/NTSTATUS NtWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG); 398 | /*0x018d,09*/NTSTATUS NtWriteFileGather(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PFILE_SEGMENT_ELEMENT,ULONG,PLARGE_INTEGER,PULONG); 399 | /*0x018e,06*/NTSTATUS NtWriteRequestData(HANDLE,PPORT_MESSAGE,ULONG,PVOID,ULONG,PULONG); 400 | /*0x018f,05*/NTSTATUS NtWriteVirtualMemory(HANDLE,PVOID,PVOID,ULONG,PULONG); 401 | /*0x0190,01*/NTSTATUS ZwYieldExecution(VOID); 402 | -------------------------------------------------------------------------------- /output_win7_sp1/user32_x64.txt: -------------------------------------------------------------------------------- 1 | 0x12d4, NtUserInitializeClientPfnArrays 2 | 0x10f6, NtUserProcessConnect 3 | 0x1291, ZwUserCreateWindowStation 4 | 0x132d, NtUserUnregisterUserApiHook 5 | 0x12f8, ZwUserRegisterUserApiHook 6 | 0x12d9, NtUserLoadKeyboardLayoutEx 7 | 0x1306, NtUserSetImeHotKey 8 | 0x1331, ZwUserUpdatePerUserSystemParameters 9 | 0x1319, ZwUserSetWindowStationUser 10 | 0x1297, NtUserDoSoundConnect 11 | 0x12f6, ZwUserRegisterSessionPort 12 | 0x1287, ZwUserCallHwndOpt 13 | 0x110c, ZwUserCallHwnd 14 | 0x1311, NtUserSetShellWindowEx 15 | 0x1301, ZwUserSetChildWindowNoActivate 16 | 0x128f, NtUserCreateDesktopEx 17 | 0x10e1, ZwUserSetInformationThread 18 | 0x110d, ZwUserDdeInitialize 19 | 0x1305, ZwUserSetGestureConfig 20 | 0x12da, ZwUserLockWindowStation 21 | 0x1326, ZwUserSwitchDesktop 22 | 0x132a, ZwUserUnlockWindowStation 23 | 0x1339, NtUserSetClassLongPtr 24 | 0x1320, ZwUserSfmDxReportPendingBindingsToDwm 25 | 0x129f, NtUserDwmStartRedirection 26 | 0x10c0, ZwUserSetClassLong 27 | 0x12ac, ZwUserGetDisplayConfigBufferSizes 28 | 0x12ec, NtUserQueryDisplayConfig 29 | 0x12e9, ZwUserPaintMonitor 30 | 0x1115, NtUserPaintDesktop 31 | 0x12f4, NtUserRegisterRawInputDevices 32 | 0x12e7, NtUserOpenInputDesktop 33 | 0x1059, ZwUserGetKeyboardLayoutList 34 | 0x10e2, ZwUserSetWindowPlacement 35 | 0x111e, ZwUserActivateKeyboardLayout 36 | 0x12a1, NtUserEndMenu 37 | 0x1077, ZwUserSetParent 38 | 0x1105, NtUserUnhookWinEvent 39 | 0x10bc, ZwUserDeleteMenu 40 | 0x10fa, ZwUserRemoveMenu 41 | 0x1102, ZwUserSetMenuDefaultItem 42 | 0x10dd, ZwUserDestroyMenu 43 | 0x10f7, NtUserEnumDisplayDevices 44 | 0x1045, NtUserGetCPD 45 | 0x105e, ZwUserMoveWindow 46 | 0x128b, ZwUserCheckDesktopByThreadId 47 | 0x10f1, ZwUserCreateAcceleratorTable 48 | 0x101f, NtUserHideCaret 49 | 0x1025, NtUserShowCaret 50 | 0x10ca, ZwUserSetWindowRgn 51 | 0x10c8, ZwUserInvalidateRgn 52 | 0x12c9, NtUserGetWindowMinimizeRect 53 | 0x1044, NtUserGetAsyncKeyState 54 | 0x1316, NtUserSetWindowCompositionAttribute 55 | 0x101a, ZwUserSetCursor 56 | 0x1330, NtUserUpdateLayeredWindow 57 | 0x12d7, ZwUserIsTopLevelWindow 58 | 0x12cb, ZwUserGhostWindowFromHungWindow 59 | 0x1054, ZwUserGetUpdateRect 60 | 0x109d, ZwUserDestroyWindow 61 | 0x1027, ZwUserCallHwndParamLock 62 | 0x130a, NtUserSetLayeredWindowAttributes 63 | 0x12f3, ZwUserRegisterHotKey 64 | 0x1026, ZwUserEndDeferWindowPosEx 65 | 0x1053, ZwUserDeferWindowPos 66 | 0x109c, NtUserDestroyCursor 67 | 0x1051, NtUserSetFocus 68 | 0x10ec, NtUserAttachThreadInput 69 | 0x10b6, NtUserGetDoubleClickTime 70 | 0x1070, ZwUserUnhookWindowsHookEx 71 | 0x10bb, NtUserUnregisterClass 72 | 0x10a8, NtUserSetProcessWindowStation 73 | 0x1091, ZwUserSetThreadDesktop 74 | 0x106e, NtUserFindWindowEx 75 | 0x10a6, NtUserCloseDesktop 76 | 0x10a7, NtUserOpenDesktop 77 | 0x10ae, NtUserBuildNameList 78 | 0x1003, ZwUserGetKeyState 79 | 0x102d, ZwUserNotifyWinEvent 80 | 0x102a, ZwUserCallTwoParam 81 | 0x10a4, ZwUserSetCursorIconData 82 | 0x103e, ZwUserFindExistingCursorIcon 83 | 0x1037, NtUserRegisterWindowMessage 84 | 0x1022, ZwUserGetProcessWindowStation 85 | 0x1042, NtUserSystemParametersInfo 86 | 0x108c, NtUserSetWindowsHookEx 87 | 0x106c, NtUserGetObjectInformation 88 | 0x10b0, ZwUserRegisterClassExWOW 89 | 0x1076, ZwUserCreateWindowEx 90 | 0x105f, NtUserPostThreadMessage 91 | 0x10a9, ZwUserGetAtomName 92 | 0x1310, NtUserSetProcessDPIAware 93 | 0x1095, NtUserSetWindowFNID 94 | 0x132e, ZwUserUpdateInputContext 95 | 0x10b9, NtUserGetClassInfoEx 96 | 0x104f, NtUserGetIconInfo 97 | 0x1058, NtUserShowWindow 98 | 0x1088, ZwUserGetIconSize 99 | 0x1098, ZwUserThunkedMenuItemInfo 100 | 0x1061, NtUserGetSystemMenu 101 | 0x10f4, ZwUserGetCaretBlinkTime 102 | 0x105c, NtUserSetWindowLong 103 | 0x1024, NtUserSetWindowPos 104 | 0x107b, NtUserGetClassName 105 | 0x1021, ZwUserCallHwndLock 106 | 0x1308, ZwUserSetImeOwnerWindow 107 | 0x1289, NtUserChangeWindowMessageFilterEx 108 | 0x1013, NtUserRedrawWindow 109 | 0x10ff, ZwUserGetGUIThreadInfo 110 | 0x1104, NtUserSetWinEventHook 111 | 0x10b2, NtUserGetAncestor 112 | 0x1060, NtUserDrawIconEx 113 | 0x12c6, ZwUserGetWindowCompositionAttribute 114 | 0x12c7, ZwUserGetWindowCompositionInfo 115 | 0x12ca, NtUserGetWindowRgnEx 116 | 0x109e, NtUserCallHwndParam 117 | 0x10db, NtUserTrackMouseEvent 118 | 0x1092, NtUserGetDCEx 119 | 0x10e0, ZwUserSetActiveWindow 120 | 0x1114, ZwUserEnumDisplaySettings 121 | 0x103c, ZwUserGetForegroundWindow 122 | 0x104a, ZwUserEnumDisplayMonitors 123 | 0x101c, NtUserBuildHwndList 124 | 0x1000, ZwUserGetThreadState 125 | 0x1007, ZwUserMessageCall 126 | 0x1018, NtUserSetTimer 127 | 0x100a, NtUserGetDC 128 | 0x1004, NtUserInvalidateRect 129 | 0x1019, ZwUserEndPaint 130 | 0x1017, NtUserBeginPaint 131 | 0x1036, NtUserDispatchMessage 132 | 0x104c, ZwUserSetProp 133 | 0x1046, NtUserRemoveProp 134 | 0x133a, ZwUserSetWindowLongPtr 135 | 0x100f, NtUserPostMessage 136 | 0x1030, NtUserSetScrollInfo 137 | 0x1010, NtUserQueryWindow 138 | 0x100e, NtUserGetProp 139 | 0x1064, NtUserGetWindowDC 140 | 0x1063, ZwUserInternalGetWindowText 141 | 0x1097, ZwUserCalcMenuBar 142 | 0x108f, ZwUserGetTitleBarInfo 143 | 0x1093, NtUserGetScrollBarInfo 144 | 0x104e, ZwUserSBGetParms 145 | 0x1001, NtUserPeekMessage 146 | 0x101b, ZwUserKillTimer 147 | 0x10ea, ZwUserRealInternalGetMessage 148 | 0x1016, NtUserValidateTimerCallback 149 | 0x100c, ZwUserWaitMessage 150 | 0x1322, ZwUserSfmDxSetSwapChainStats 151 | 0x1006, ZwUserGetMessage 152 | 0x1002, NtUserCallOneParam 153 | 0x1005, NtUserCallNoParam 154 | 0x1083, NtUserGetThreadDesktop 155 | 0x10df, ZwUserConsoleControl 156 | 0x106b, NtUserScrollDC 157 | 0x12db, ZwUserLockWorkStation 158 | 0x1286, NtUserCalculatePopupWindowPosition 159 | 0x1295, ZwUserDisplayConfigGetDeviceInfo 160 | 0x10f2, NtUserGetCursorFrameInfo 161 | 0x1028, NtUserVkKeyScanEx 162 | 0x1079, NtUserToUnicodeEx 163 | 0x12ba, NtUserGetMenuItemRect 164 | 0x10cb, ZwUserBitBltSysBmp 165 | 0x10d1, ZwUserSetClipboardData 166 | 0x10fd, ZwUserConvertMemHandle 167 | 0x10f8, ZwUserEmptyClipboard 168 | 0x10f9, NtUserGetClipboardData 169 | 0x10eb, ZwUserCreateLocalMemHandle 170 | 0x101e, NtUserCallNextHookEx 171 | 0x128d, NtUserChildWindowFromPointEx 172 | 0x10cd, NtUserValidateRect 173 | 0x131d, NtUserSfmDxOpenSwapChain 174 | 0x131e, ZwUserSfmDxQuerySwapChainBindingStatus 175 | 0x1321, NtUserSfmDxSetSwapChainBindingStatus 176 | 0x131f, NtUserSfmDxReleaseSwapChain 177 | 0x1325, ZwUserSoundSentry 178 | 0x111a, NtUserSetClipboardViewer 179 | 0x1103, ZwUserCheckMenuItem 180 | 0x130b, NtUserSetMenu 181 | 0x107f, NtUserDefSetText 182 | 0x1119, ZwUserChangeClipboardChain 183 | 0x1106, NtUserLockWindowUpdate 184 | 0x10e9, ZwUserGetClipboardFormatName 185 | 0x10d2, NtUserEnableMenuItem 186 | 0x10ee, ZwUserPaintMenuBar 187 | 0x1334, ZwUserValidateHandleSecure 188 | 0x12a0, NtUserDwmStopRedirection 189 | 0x12d6, NtUserInternalGetWindowIcon 190 | 0x1086, ZwUserGetUpdateRgn 191 | 0x12ce, NtUserHungWindowFromGhostWindow 192 | 0x1288, NtUserChangeDisplaySettings 193 | 0x12cf, ZwUserHwndQueryRedirectionInfo 194 | 0x12d0, NtUserHwndSetRedirectionInfo 195 | 0x12e0, ZwUserMagGetContextInformation 196 | 0x12df, ZwUserMagControl 197 | 0x12e1, ZwUserMagSetContextInformation 198 | 0x1335, NtUserWaitForInputIdle 199 | 0x1318, ZwUserSetWindowRgnEx 200 | 0x102c, ZwUserCopyAcceleratorTable 201 | 0x12a7, NtUserGetCaretPos 202 | 0x12aa, NtUserGetComboBoxInfo 203 | 0x1089, NtUserFillWindow 204 | 0x10d9, NtUserSetThreadState 205 | 0x103d, ZwUserShowScrollBar 206 | 0x10be, NtUserScrollWindowEx 207 | 0x10ce, ZwUserCloseClipboard 208 | 0x10cf, ZwUserOpenClipboard 209 | 0x102f, ZwUserIsClipboardFormatAvailable 210 | 0x1056, NtUserGetClipboardSequenceNumber 211 | 0x10c9, ZwUserGetClipboardOwner 212 | 0x1108, NtUserThunkedMenuInfo 213 | 0x110f, ZwUserCountClipboardFormats 214 | 0x1015, NtUserCallMsgFilter 215 | 0x10d8, NtUserGetOpenClipboardWindow 216 | 0x1328, NtUserTrackPopupMenuEx 217 | 0x1032, ZwUserCreateCaret 218 | 0x10fe, ZwUserDestroyAcceleratorTable 219 | 0x10c1, ZwUserGetMenuBarInfo 220 | 0x1049, ZwUserSetCapture 221 | 0x1078, ZwUserGetKeyboardState 222 | 0x1011, ZwUserTranslateAccelerator 223 | 0x105b, ZwUserMapVirtualKeyEx 224 | 0x10ef, NtUserSetKeyboardState 225 | 0x10d5, NtUserGetWindowPlacement 226 | 0x132b, NtUserUnregisterHotKey 227 | 0x100d, NtUserTranslateMessage 228 | 0x1014, ZwUserWindowFromPoint 229 | 0x1337, NtUserWindowFromPhysicalPoint 230 | 0x12dc, NtUserLogicalToPhysicalPoint 231 | 0x12ea, NtUserPhysicalToLogicalPoint 232 | 0x1082, NtUserSendInput 233 | 0x10b5, ZwUserCloseWindowStation 234 | 0x10a0, NtUserOpenWindowStation 235 | 0x1008, NtGdiBitBlt 236 | 0x1009, ZwGdiGetCharSet 237 | 0x100b, ZwGdiSelectBitmap 238 | 0x1012, NtGdiFlush 239 | 0x101d, ZwUserSelectPalette 240 | 0x1020, NtGdiIntersectClipRect 241 | 0x1023, ZwGdiDeleteObjectApp 242 | 0x1029, ZwGdiSetDIBitsToDeviceInternal 243 | 0x102b, NtGdiGetRandomRgn 244 | 0x102e, NtGdiExtSelectClipRgn 245 | 0x1031, NtGdiStretchBlt 246 | 0x1033, NtGdiRectVisible 247 | 0x1034, ZwGdiCombineRgn 248 | 0x1035, NtGdiGetDCObject 249 | 0x1038, ZwGdiExtTextOutW 250 | 0x1039, NtGdiSelectFont 251 | 0x103a, NtGdiRestoreDC 252 | 0x103b, ZwGdiSaveDC 253 | 0x103f, ZwGdiGetDCDword 254 | 0x1040, ZwGdiGetRegionData 255 | 0x1041, NtGdiLineTo 256 | 0x1043, NtGdiGetAppClipBox 257 | 0x1047, ZwGdiDoPalette 258 | 0x1048, NtGdiPolyPolyDraw 259 | 0x104b, NtGdiCreateCompatibleBitmap 260 | 0x104d, NtGdiGetTextCharsetInfo 261 | 0x1050, NtUserExcludeUpdateRgn 262 | 0x1052, ZwGdiExtGetObjectW 263 | 0x1055, ZwGdiCreateCompatibleDC 264 | 0x1057, NtGdiCreatePen 265 | 0x105a, ZwGdiPatBlt 266 | 0x105d, NtGdiHfontCreate 267 | 0x1062, ZwGdiDrawStream 268 | 0x1065, ZwGdiD3dDrawPrimitives2 269 | 0x1066, NtGdiInvertRgn 270 | 0x1067, NtGdiGetRgnBox 271 | 0x1068, ZwGdiGetAndSetDCDword 272 | 0x1069, ZwGdiMaskBlt 273 | 0x106a, ZwGdiGetWidthTable 274 | 0x106d, NtGdiCreateBitmap 275 | 0x106f, ZwGdiPolyPatBlt 276 | 0x1071, ZwGdiGetNearestColor 277 | 0x1072, ZwGdiTransformPoints 278 | 0x1073, NtGdiGetDCPoint 279 | 0x1074, NtGdiCreateDIBBrush 280 | 0x1075, NtGdiGetTextMetricsW 281 | 0x107a, NtUserGetControlBrush 282 | 0x107c, NtGdiAlphaBlend 283 | 0x107d, NtGdiDdBlt 284 | 0x107e, NtGdiOffsetRgn 285 | 0x1080, ZwGdiGetTextFaceW 286 | 0x1081, NtGdiStretchDIBitsInternal 287 | 0x1084, NtGdiCreateRectRgn 288 | 0x1085, NtGdiGetDIBitsInternal 289 | 0x1087, ZwGdiDeleteClientObj 290 | 0x108a, ZwGdiExtCreateRegion 291 | 0x108b, NtGdiComputeXformCoefficients 292 | 0x108d, NtUserNotifyProcessCreate 293 | 0x108e, ZwGdiUnrealizeObject 294 | 0x1090, NtGdiRectangle 295 | 0x1094, NtGdiGetTextExtent 296 | 0x1096, NtGdiSetLayout 297 | 0x1099, ZwGdiExcludeClipRect 298 | 0x109a, NtGdiCreateDIBSection 299 | 0x109b, ZwGdiGetDCforBitmap 300 | 0x109f, NtGdiCreateDIBitmapInternal 301 | 0x10a1, ZwGdiDdDeleteSurfaceObject 302 | 0x10a2, NtGdiDdCanCreateSurface 303 | 0x10a3, ZwGdiDdCreateSurface 304 | 0x10a5, ZwGdiDdDestroySurface 305 | 0x10aa, NtGdiDdResetVisrgn 306 | 0x10ab, NtGdiExtCreatePen 307 | 0x10ac, NtGdiCreatePaletteInternal 308 | 0x10ad, NtGdiSetBrushOrg 309 | 0x10af, ZwGdiSetPixel 310 | 0x10b1, NtGdiCreatePatternBrushInternal 311 | 0x10b3, NtGdiGetOutlineTextMetricsInternalW 312 | 0x10b4, NtGdiSetBitmapBits 313 | 0x10b7, ZwUserEnableScrollBar 314 | 0x10b8, ZwGdiCreateSolidBrush 315 | 0x10ba, ZwGdiCreateClientObj 316 | 0x10bd, NtGdiRectInRegion 317 | 0x10bf, ZwGdiGetPixel 318 | 0x10c2, ZwGdiDdCreateSurfaceEx 319 | 0x10c3, NtGdiDdCreateSurfaceObject 320 | 0x10c4, NtGdiGetNearestPaletteIndex 321 | 0x10c5, NtGdiDdLockD3D 322 | 0x10c6, ZwGdiDdUnlockD3D 323 | 0x10c7, NtGdiGetCharWidthW 324 | 0x10cc, NtGdiGetCharWidthInfo 325 | 0x10d0, NtGdiGetStockObject 326 | 0x10d3, NtUserAlterWindowStyle 327 | 0x10d4, NtGdiFillRgn 328 | 0x10d6, ZwGdiModifyWorldTransform 329 | 0x10d7, NtGdiGetFontData 330 | 0x10da, NtGdiOpenDCW 331 | 0x10dc, NtGdiGetTransform 332 | 0x10de, NtGdiGetBitmapBits 333 | 0x10e3, ZwUserGetControlColor 334 | 0x10e4, NtGdiSetMetaRgn 335 | 0x10e5, ZwGdiSetMiterLimit 336 | 0x10e6, NtGdiSetVirtualResolution 337 | 0x10e7, ZwGdiGetRasterizerCaps 338 | 0x10e8, ZwUserSetWindowWord 339 | 0x10ed, NtGdiCreateHalftonePalette 340 | 0x10f0, NtGdiCombineTransform 341 | 0x10f3, ZwUserGetAltTabInfo 342 | 0x10f5, NtGdiQueryFontAssocInfo 343 | 0x10fb, ZwGdiSetBoundsRect 344 | 0x10fc, ZwGdiGetBitmapDimension 345 | 0x1100, NtGdiCloseFigure 346 | 0x1101, ZwUserSetWindowsHookAW 347 | 0x1107, ZwUserSetSystemMenu 348 | 0x1109, ZwGdiBeginPath 349 | 0x110a, NtGdiEndPath 350 | 0x110b, NtGdiFillPath 351 | 0x110e, NtUserModifyUserStartupInfoFlags 352 | 0x1110, ZwGdiAddFontMemResourceEx 353 | 0x1111, NtGdiEqualRgn 354 | 0x1112, NtGdiGetSystemPaletteUse 355 | 0x1113, NtGdiRemoveFontMemResourceEx 356 | 0x1116, ZwGdiExtEscape 357 | 0x1117, ZwGdiSetBitmapDimension 358 | 0x1118, ZwGdiSetFontEnumeration 359 | 0x111b, ZwUserShowWindowAsync 360 | 0x111c, NtGdiCreateColorSpace 361 | 0x111d, NtGdiDeleteColorSpace 362 | 0x111f, ZwGdiAbortDoc 363 | 0x1120, ZwGdiAbortPath 364 | 0x1121, NtGdiAddEmbFontToDC 365 | 0x1122, ZwGdiAddFontResourceW 366 | 0x1123, NtGdiAddRemoteFontToDC 367 | 0x1124, ZwGdiAddRemoteMMInstanceToDC 368 | 0x1125, ZwGdiAngleArc 369 | 0x1126, ZwGdiAnyLinkedFonts 370 | 0x1127, NtGdiArcInternal 371 | 0x1128, NtGdiBRUSHOBJ_DeleteRbrush 372 | 0x1129, NtGdiBRUSHOBJ_hGetColorTransform 373 | 0x112a, ZwGdiBRUSHOBJ_pvAllocRbrush 374 | 0x112b, NtGdiBRUSHOBJ_pvGetRbrush 375 | 0x112c, ZwGdiBRUSHOBJ_ulGetBrushColor 376 | 0x112d, NtGdiBeginGdiRendering 377 | 0x112e, NtGdiCLIPOBJ_bEnum 378 | 0x112f, NtGdiCLIPOBJ_cEnumStart 379 | 0x1130, ZwGdiCLIPOBJ_ppoGetPath 380 | 0x1131, ZwGdiCancelDC 381 | 0x1132, ZwGdiChangeGhostFont 382 | 0x1133, ZwGdiCheckBitmapBits 383 | 0x1134, NtGdiClearBitmapAttributes 384 | 0x1135, ZwGdiClearBrushAttributes 385 | 0x1136, ZwGdiColorCorrectPalette 386 | 0x1137, NtGdiConfigureOPMProtectedOutput 387 | 0x1138, ZwGdiConvertMetafileRect 388 | 0x1139, NtGdiCreateBitmapFromDxSurface 389 | 0x113a, ZwGdiCreateColorTransform 390 | 0x113b, ZwGdiCreateEllipticRgn 391 | 0x113c, ZwGdiCreateHatchBrushInternal 392 | 0x113d, NtGdiCreateMetafileDC 393 | 0x113e, NtGdiCreateOPMProtectedOutputs 394 | 0x113f, ZwGdiCreateRoundRectRgn 395 | 0x1140, ZwGdiCreateServerMetaFile 396 | 0x1141, ZwGdiD3dContextCreate 397 | 0x1142, ZwGdiD3dContextDestroy 398 | 0x1143, ZwGdiD3dContextDestroyAll 399 | 0x1144, NtGdiD3dValidateTextureStageState 400 | 0x1145, NtGdiDDCCIGetCapabilitiesString 401 | 0x1146, ZwGdiDDCCIGetCapabilitiesStringLength 402 | 0x1147, ZwGdiDDCCIGetTimingReport 403 | 0x1148, NtGdiDDCCIGetVCPFeature 404 | 0x1149, ZwGdiDDCCISaveCurrentSettings 405 | 0x114a, ZwGdiDDCCISetVCPFeature 406 | 0x114b, NtGdiDdAddAttachedSurface 407 | 0x114c, ZwGdiDdAlphaBlt 408 | 0x114d, ZwGdiDdAttachSurface 409 | 0x114e, ZwGdiDdBeginMoCompFrame 410 | 0x114f, NtGdiDdCanCreateD3DBuffer 411 | 0x1150, ZwGdiDdColorControl 412 | 0x1151, ZwGdiDdCreateD3DBuffer 413 | 0x1152, ZwGdiDdCreateDirectDrawObject 414 | 0x1153, NtGdiDdCreateFullscreenSprite 415 | 0x1154, ZwGdiDdCreateMoComp 416 | 0x1155, NtGdiDdDDIAcquireKeyedMutex 417 | 0x1156, NtGdiDdDDICheckExclusiveOwnership 418 | 0x1157, ZwGdiDdDDICheckMonitorPowerState 419 | 0x1158, ZwGdiDdDDICheckOcclusion 420 | 0x1159, NtGdiDdDDICheckSharedResourceAccess 421 | 0x115a, NtGdiDdDDICheckVidPnExclusiveOwnership 422 | 0x115b, NtGdiDdDDICloseAdapter 423 | 0x115c, ZwGdiDdDDIConfigureSharedResource 424 | 0x115d, NtGdiDdDDICreateAllocation 425 | 0x115e, NtGdiDdDDICreateContext 426 | 0x115f, ZwGdiDdDDICreateDCFromMemory 427 | 0x1160, NtGdiDdDDICreateDevice 428 | 0x1161, ZwGdiDdDDICreateKeyedMutex 429 | 0x1162, ZwGdiDdDDICreateOverlay 430 | 0x1163, ZwGdiDdDDICreateSynchronizationObject 431 | 0x1164, ZwGdiDdDDIDestroyAllocation 432 | 0x1165, NtGdiDdDDIDestroyContext 433 | 0x1166, NtGdiDdDDIDestroyDCFromMemory 434 | 0x1167, ZwGdiDdDDIDestroyDevice 435 | 0x1168, NtGdiDdDDIDestroyKeyedMutex 436 | 0x1169, ZwGdiDdDDIDestroyOverlay 437 | 0x116a, ZwGdiDdDDIDestroySynchronizationObject 438 | 0x116b, ZwGdiDdDDIEscape 439 | 0x116c, ZwGdiDdDDIFlipOverlay 440 | 0x116d, NtGdiDdDDIGetContextSchedulingPriority 441 | 0x116e, ZwGdiDdDDIGetDeviceState 442 | 0x116f, NtGdiDdDDIGetDisplayModeList 443 | 0x1170, NtGdiDdDDIGetMultisampleMethodList 444 | 0x1171, ZwGdiDdDDIGetOverlayState 445 | 0x1172, NtGdiDdDDIGetPresentHistory 446 | 0x1173, ZwGdiDdDDIGetPresentQueueEvent 447 | 0x1174, NtGdiDdDDIGetProcessSchedulingPriorityClass 448 | 0x1175, ZwGdiDdDDIGetRuntimeData 449 | 0x1176, ZwGdiDdDDIGetScanLine 450 | 0x1177, NtGdiDdDDIGetSharedPrimaryHandle 451 | 0x1178, NtGdiDdDDIInvalidateActiveVidPn 452 | 0x1179, ZwGdiDdDDILock 453 | 0x117a, ZwGdiDdDDIOpenAdapterFromDeviceName 454 | 0x117b, ZwGdiDdDDIOpenAdapterFromHdc 455 | 0x117c, NtGdiDdDDIOpenKeyedMutex 456 | 0x117d, NtGdiDdDDIOpenResource 457 | 0x117e, ZwGdiDdDDIOpenSynchronizationObject 458 | 0x117f, ZwGdiDdDDIPollDisplayChildren 459 | 0x1180, ZwGdiDdDDIPresent 460 | 0x1181, NtGdiDdDDIQueryAdapterInfo 461 | 0x1182, ZwGdiDdDDIQueryAllocationResidency 462 | 0x1183, NtGdiDdDDIQueryResourceInfo 463 | 0x1184, ZwGdiDdDDIQueryStatistics 464 | 0x1185, NtGdiDdDDIReleaseKeyedMutex 465 | 0x1186, NtGdiDdDDIReleaseProcessVidPnSourceOwners 466 | 0x1187, ZwGdiDdDDIRender 467 | 0x1188, ZwGdiDdDDISetAllocationPriority 468 | 0x1189, ZwGdiDdDDISetContextSchedulingPriority 469 | 0x118a, NtGdiDdDDISetDisplayMode 470 | 0x118b, NtGdiDdDDISetDisplayPrivateDriverFormat 471 | 0x118c, NtGdiDdDDISetGammaRamp 472 | 0x118d, ZwGdiDdDDISetProcessSchedulingPriorityClass 473 | 0x118e, ZwGdiDdDDISetQueuedLimit 474 | 0x118f, NtGdiDdDDISetVidPnSourceOwner 475 | 0x1190, ZwGdiDdDDISharedPrimaryLockNotification 476 | 0x1191, ZwGdiDdDDISharedPrimaryUnLockNotification 477 | 0x1192, ZwGdiDdDDISignalSynchronizationObject 478 | 0x1193, ZwGdiDdDDIUnlock 479 | 0x1194, ZwGdiDdDDIUpdateOverlay 480 | 0x1195, ZwGdiDdDDIWaitForIdle 481 | 0x1196, ZwGdiDdDDIWaitForSynchronizationObject 482 | 0x1197, ZwGdiDdDDIWaitForVerticalBlankEvent 483 | 0x1198, NtGdiDdDeleteDirectDrawObject 484 | 0x1199, NtGdiDdDestroyD3DBuffer 485 | 0x119a, NtGdiDdDestroyFullscreenSprite 486 | 0x119b, NtGdiDdDestroyMoComp 487 | 0x119c, NtGdiDdEndMoCompFrame 488 | 0x119d, NtGdiDdFlip 489 | 0x119e, ZwGdiDdFlipToGDISurface 490 | 0x119f, ZwGdiDdGetAvailDriverMemory 491 | 0x11a0, NtGdiDdGetBltStatus 492 | 0x11a1, ZwGdiDdGetDC 493 | 0x11a2, ZwGdiDdGetDriverInfo 494 | 0x11a3, ZwGdiDdGetDriverState 495 | 0x11a4, NtGdiDdGetDxHandle 496 | 0x11a5, ZwGdiDdGetFlipStatus 497 | 0x11a6, ZwGdiDdGetInternalMoCompInfo 498 | 0x11a7, ZwGdiDdGetMoCompBuffInfo 499 | 0x11a8, NtGdiDdGetMoCompFormats 500 | 0x11a9, NtGdiDdGetMoCompGuids 501 | 0x11aa, ZwGdiDdGetScanLine 502 | 0x11ab, NtGdiDdLock 503 | 0x11ac, NtGdiDdNotifyFullscreenSpriteUpdate 504 | 0x11ad, NtGdiDdQueryDirectDrawObject 505 | 0x11ae, ZwGdiDdQueryMoCompStatus 506 | 0x11af, NtGdiDdQueryVisRgnUniqueness 507 | 0x11b0, NtGdiDdReenableDirectDrawObject 508 | 0x11b1, ZwGdiDdReleaseDC 509 | 0x11b2, NtGdiDdRenderMoComp 510 | 0x11b3, NtGdiDdSetColorKey 511 | 0x11b4, ZwGdiDdSetExclusiveMode 512 | 0x11b5, ZwGdiDdSetGammaRamp 513 | 0x11b6, NtGdiDdSetOverlayPosition 514 | 0x11b7, ZwGdiDdUnattachSurface 515 | 0x11b8, NtGdiDdUnlock 516 | 0x11b9, ZwGdiDdUpdateOverlay 517 | 0x11ba, NtGdiDdWaitForVerticalBlank 518 | 0x11bb, ZwGdiDeleteColorTransform 519 | 0x11bc, ZwGdiDescribePixelFormat 520 | 0x11bd, NtGdiDestroyOPMProtectedOutput 521 | 0x11be, NtGdiDestroyPhysicalMonitor 522 | 0x11bf, NtGdiDoBanding 523 | 0x11c0, NtGdiDrawEscape 524 | 0x11c1, ZwGdiDvpAcquireNotification 525 | 0x11c2, ZwGdiDvpCanCreateVideoPort 526 | 0x11c3, ZwGdiDvpColorControl 527 | 0x11c4, ZwGdiDvpCreateVideoPort 528 | 0x11c5, ZwGdiDvpDestroyVideoPort 529 | 0x11c6, ZwGdiDvpFlipVideoPort 530 | 0x11c7, ZwGdiDvpGetVideoPortBandwidth 531 | 0x11c8, NtGdiDvpGetVideoPortConnectInfo 532 | 0x11c9, ZwGdiDvpGetVideoPortField 533 | 0x11ca, NtGdiDvpGetVideoPortFlipStatus 534 | 0x11cb, ZwGdiDvpGetVideoPortInputFormats 535 | 0x11cc, ZwGdiDvpGetVideoPortLine 536 | 0x11cd, ZwGdiDvpGetVideoPortOutputFormats 537 | 0x11ce, ZwGdiDvpGetVideoSignalStatus 538 | 0x11cf, ZwGdiDvpReleaseNotification 539 | 0x11d0, NtGdiDvpUpdateVideoPort 540 | 0x11d1, ZwGdiDvpWaitForVideoPortSync 541 | 0x11d2, NtGdiDxgGenericThunk 542 | 0x11d3, NtGdiEllipse 543 | 0x11d4, ZwGdiEnableEudc 544 | 0x11d5, NtGdiEndDoc 545 | 0x11d6, NtGdiEndGdiRendering 546 | 0x11d7, ZwGdiEndPage 547 | 0x11d8, NtGdiEngAlphaBlend 548 | 0x11d9, NtGdiEngAssociateSurface 549 | 0x11da, NtGdiEngBitBlt 550 | 0x11db, NtGdiEngCheckAbort 551 | 0x11dc, ZwGdiEngComputeGlyphSet 552 | 0x11dd, NtGdiEngCopyBits 553 | 0x11de, ZwGdiEngCreateBitmap 554 | 0x11df, ZwGdiEngCreateClip 555 | 0x11e0, NtGdiEngCreateDeviceBitmap 556 | 0x11e1, NtGdiEngCreateDeviceSurface 557 | 0x11e2, ZwGdiEngCreatePalette 558 | 0x11e3, NtGdiEngDeleteClip 559 | 0x11e4, NtGdiEngDeletePalette 560 | 0x11e5, ZwGdiEngDeletePath 561 | 0x11e6, ZwGdiEngDeleteSurface 562 | 0x11e7, ZwGdiEngEraseSurface 563 | 0x11e8, ZwGdiEngFillPath 564 | 0x11e9, ZwGdiEngGradientFill 565 | 0x11ea, ZwGdiEngLineTo 566 | 0x11eb, ZwGdiEngLockSurface 567 | 0x11ec, ZwGdiEngMarkBandingSurface 568 | 0x11ed, ZwGdiEngPaint 569 | 0x11ee, ZwGdiEngPlgBlt 570 | 0x11ef, ZwGdiEngStretchBlt 571 | 0x11f0, ZwGdiEngStretchBltROP 572 | 0x11f1, NtGdiEngStrokeAndFillPath 573 | 0x11f2, ZwGdiEngStrokePath 574 | 0x11f3, ZwGdiEngTextOut 575 | 0x11f4, NtGdiEngTransparentBlt 576 | 0x11f5, NtGdiEngUnlockSurface 577 | 0x11f6, NtGdiEnumFonts 578 | 0x11f7, NtGdiEnumObjects 579 | 0x11f8, ZwGdiEudcLoadUnloadLink 580 | 0x11f9, NtGdiExtFloodFill 581 | 0x11fa, ZwGdiFONTOBJ_cGetAllGlyphHandles 582 | 0x11fb, ZwGdiFONTOBJ_cGetGlyphs 583 | 0x11fc, NtGdiFONTOBJ_pQueryGlyphAttrs 584 | 0x11fd, ZwGdiFONTOBJ_pfdg 585 | 0x11fe, NtGdiFONTOBJ_pifi 586 | 0x11ff, NtGdiFONTOBJ_pvTrueTypeFontFile 587 | 0x1200, NtGdiFONTOBJ_pxoGetXform 588 | 0x1201, ZwGdiFONTOBJ_vGetInfo 589 | 0x1202, NtGdiFlattenPath 590 | 0x1203, ZwGdiFontIsLinked 591 | 0x1204, NtGdiForceUFIMapping 592 | 0x1205, ZwGdiFrameRgn 593 | 0x1206, ZwGdiFullscreenControl 594 | 0x1207, ZwGdiGetBoundsRect 595 | 0x1208, ZwGdiGetCOPPCompatibleOPMInformation 596 | 0x1209, ZwGdiGetCertificate 597 | 0x120a, ZwGdiGetCertificateSize 598 | 0x120b, ZwGdiGetCharABCWidthsW 599 | 0x120c, ZwGdiGetCharacterPlacementW 600 | 0x120d, NtGdiGetColorAdjustment 601 | 0x120e, NtGdiGetColorSpaceforBitmap 602 | 0x120f, NtGdiGetDeviceCaps 603 | 0x1210, NtGdiGetDeviceCapsAll 604 | 0x1211, NtGdiGetDeviceGammaRamp 605 | 0x1212, NtGdiGetDeviceWidth 606 | 0x1213, NtGdiGetDhpdev 607 | 0x1214, NtGdiGetETM 608 | 0x1215, NtGdiGetEmbUFI 609 | 0x1216, ZwGdiGetEmbedFonts 610 | 0x1217, ZwGdiGetEudcTimeStampEx 611 | 0x1218, NtGdiGetFontFileData 612 | 0x1219, ZwGdiGetFontFileInfo 613 | 0x121a, ZwGdiGetFontResourceInfoInternalW 614 | 0x121b, ZwGdiGetFontUnicodeRanges 615 | 0x121c, ZwGdiGetGlyphIndicesW 616 | 0x121d, NtGdiGetGlyphIndicesWInternal 617 | 0x121e, ZwGdiGetGlyphOutline 618 | 0x121f, ZwGdiGetKerningPairs 619 | 0x1220, NtGdiGetLinkedUFIs 620 | 0x1221, ZwGdiGetMiterLimit 621 | 0x1222, ZwGdiGetMonitorID 622 | 0x1223, NtGdiGetNumberOfPhysicalMonitors 623 | 0x1224, NtGdiGetOPMInformation 624 | 0x1225, ZwGdiGetOPMRandomNumber 625 | 0x1226, ZwGdiGetObjectBitmapHandle 626 | 0x1227, ZwGdiGetPath 627 | 0x1228, NtGdiGetPerBandInfo 628 | 0x1229, NtGdiGetPhysicalMonitorDescription 629 | 0x122a, ZwGdiGetPhysicalMonitors 630 | 0x122b, ZwGdiGetRealizationInfo 631 | 0x122c, NtGdiGetServerMetaFileBits 632 | 0x122d, NtGdiGetSpoolMessage 633 | 0x122e, NtGdiGetStats 634 | 0x122f, NtGdiGetStringBitmapW 635 | 0x1230, ZwGdiGetSuggestedOPMProtectedOutputArraySize 636 | 0x1231, NtGdiGetTextExtentExW 637 | 0x1232, ZwGdiGetUFI 638 | 0x1233, NtGdiGetUFIPathname 639 | 0x1234, ZwGdiGradientFill 640 | 0x1235, NtGdiHLSurfGetInformation 641 | 0x1236, NtGdiHLSurfSetInformation 642 | 0x1237, NtGdiHT_Get8BPPFormatPalette 643 | 0x1238, NtGdiHT_Get8BPPMaskPalette 644 | 0x1239, ZwGdiIcmBrushInfo 645 | 0x123a, ZwGdiInit 646 | 0x123b, NtGdiInitSpool 647 | 0x123c, ZwGdiMakeFontDir 648 | 0x123d, ZwGdiMakeInfoDC 649 | 0x123e, NtGdiMakeObjectUnXferable 650 | 0x123f, ZwGdiMakeObjectXferable 651 | 0x1240, NtGdiMirrorWindowOrg 652 | 0x1241, ZwGdiMonoBitmap 653 | 0x1242, NtGdiMoveTo 654 | 0x1243, NtGdiOffsetClipRgn 655 | 0x1244, ZwGdiPATHOBJ_bEnum 656 | 0x1245, ZwGdiPATHOBJ_bEnumClipLines 657 | 0x1246, ZwGdiPATHOBJ_vEnumStart 658 | 0x1247, NtGdiPATHOBJ_vEnumStartClipLines 659 | 0x1248, ZwGdiPATHOBJ_vGetBounds 660 | 0x1249, NtGdiPathToRegion 661 | 0x124a, NtGdiPlgBlt 662 | 0x124b, NtGdiPolyDraw 663 | 0x124c, ZwGdiPolyTextOutW 664 | 0x124d, ZwGdiPtInRegion 665 | 0x124e, ZwGdiPtVisible 666 | 0x124f, ZwGdiQueryFonts 667 | 0x1250, NtGdiRemoveFontResourceW 668 | 0x1251, ZwGdiRemoveMergeFont 669 | 0x1252, NtGdiResetDC 670 | 0x1253, NtGdiResizePalette 671 | 0x1254, ZwGdiRoundRect 672 | 0x1255, NtGdiSTROBJ_bEnum 673 | 0x1256, NtGdiSTROBJ_bEnumPositionsOnly 674 | 0x1257, ZwGdiSTROBJ_bGetAdvanceWidths 675 | 0x1258, ZwGdiSTROBJ_dwGetCodePage 676 | 0x1259, NtGdiSTROBJ_vEnumStart 677 | 0x125a, NtGdiScaleViewportExtEx 678 | 0x125b, ZwGdiScaleWindowExtEx 679 | 0x125c, NtGdiSelectBrush 680 | 0x125d, NtGdiSelectClipPath 681 | 0x125e, ZwGdiSelectPen 682 | 0x125f, NtGdiSetBitmapAttributes 683 | 0x1260, NtGdiSetBrushAttributes 684 | 0x1261, NtGdiSetColorAdjustment 685 | 0x1262, NtGdiSetColorSpace 686 | 0x1263, NtGdiSetDeviceGammaRamp 687 | 0x1264, ZwGdiSetFontXform 688 | 0x1265, ZwGdiSetIcmMode 689 | 0x1266, NtGdiSetLinkedUFIs 690 | 0x1267, NtGdiSetMagicColors 691 | 0x1268, ZwGdiSetOPMSigningKeyAndSequenceNumbers 692 | 0x1269, NtGdiSetPUMPDOBJ 693 | 0x126a, ZwGdiSetPixelFormat 694 | 0x126b, ZwGdiSetRectRgn 695 | 0x126c, NtGdiSetSizeDevice 696 | 0x126d, NtGdiSetSystemPaletteUse 697 | 0x126e, ZwGdiSetTextJustification 698 | 0x126f, ZwGdiSfmGetNotificationTokens 699 | 0x1270, NtGdiStartDoc 700 | 0x1271, NtGdiStartPage 701 | 0x1272, NtGdiStrokeAndFillPath 702 | 0x1273, ZwGdiStrokePath 703 | 0x1274, NtGdiSwapBuffers 704 | 0x1275, NtGdiTransparentBlt 705 | 0x1276, ZwGdiUMPDEngFreeUserMem 706 | 0x1277, ZwGdiUnloadPrinterDriver 707 | 0x1278, ZwGdiUnmapMemFont 708 | 0x1279, NtGdiUpdateColors 709 | 0x127a, ZwGdiUpdateTransform 710 | 0x127b, NtGdiWidenPath 711 | 0x127c, NtGdiXFORMOBJ_bApplyXform 712 | 0x127d, NtGdiXFORMOBJ_iGetXform 713 | 0x127e, NtGdiXLATEOBJ_cGetPalette 714 | 0x127f, NtGdiXLATEOBJ_hGetColorTransform 715 | 0x1280, NtGdiXLATEOBJ_iXlate 716 | 0x1281, NtUserAddClipboardFormatListener 717 | 0x1282, NtUserAssociateInputContext 718 | 0x1283, NtUserBlockInput 719 | 0x1284, ZwUserBuildHimcList 720 | 0x1285, ZwUserBuildPropList 721 | 0x128a, ZwUserCheckAccessForIntegrityLevel 722 | 0x128c, NtUserCheckWindowThreadDesktop 723 | 0x128e, NtUserClipCursor 724 | 0x1290, ZwUserCreateInputContext 725 | 0x1292, NtUserCtxDisplayIOCtl 726 | 0x1293, ZwUserDestroyInputContext 727 | 0x1294, ZwUserDisableThreadIme 728 | 0x1296, ZwUserDisplayConfigSetDeviceInfo 729 | 0x1298, NtUserDoSoundDisconnect 730 | 0x1299, NtUserDragDetect 731 | 0x129a, ZwUserDragObject 732 | 0x129b, NtUserDrawAnimatedRects 733 | 0x129c, ZwUserDrawCaption 734 | 0x129d, ZwUserDrawCaptionTemp 735 | 0x129e, NtUserDrawMenuBarTemp 736 | 0x12a2, ZwUserEndTouchOperation 737 | 0x12a3, NtUserEvent 738 | 0x12a4, NtUserFlashWindowEx 739 | 0x12a5, ZwUserFrostCrashedWindow 740 | 0x12a6, NtUserGetAppImeLevel 741 | 0x12a8, ZwUserGetClipCursor 742 | 0x12a9, ZwUserGetClipboardViewer 743 | 0x12ab, NtUserGetCursorInfo 744 | 0x12ad, NtUserGetGestureConfig 745 | 0x12ae, ZwUserGetGestureExtArgs 746 | 0x12af, ZwUserGetGestureInfo 747 | 0x12b0, ZwUserGetGuiResources 748 | 0x12b1, ZwUserGetImeHotKey 749 | 0x12b2, NtUserGetImeInfoEx 750 | 0x12b3, ZwUserGetInputLocaleInfo 751 | 0x12b4, NtUserGetInternalWindowPos 752 | 0x12b5, NtUserGetKeyNameText 753 | 0x12b6, ZwUserGetKeyboardLayoutName 754 | 0x12b7, ZwUserGetLayeredWindowAttributes 755 | 0x12b8, NtUserGetListBoxInfo 756 | 0x12b9, ZwUserGetMenuIndex 757 | 0x12bb, NtUserGetMouseMovePointsEx 758 | 0x12bc, ZwUserGetPriorityClipboardFormat 759 | 0x12bd, ZwUserGetRawInputBuffer 760 | 0x12be, NtUserGetRawInputData 761 | 0x12bf, ZwUserGetRawInputDeviceInfo 762 | 0x12c0, ZwUserGetRawInputDeviceList 763 | 0x12c1, ZwUserGetRegisteredRawInputDevices 764 | 0x12c2, NtUserGetTopLevelWindow 765 | 0x12c3, ZwUserGetTouchInputInfo 766 | 0x12c4, ZwUserGetUpdatedClipboardFormats 767 | 0x12c5, ZwUserGetWOWClass 768 | 0x12c8, ZwUserGetWindowDisplayAffinity 769 | 0x12cc, ZwUserHardErrorControl 770 | 0x12cd, ZwUserHiliteMenuItem 771 | 0x12d1, ZwUserImpersonateDdeClientWindow 772 | 0x12d2, ZwUserInitTask 773 | 0x12d3, NtUserInitialize 774 | 0x12d5, ZwUserInjectGesture 775 | 0x12d8, ZwUserIsTouchWindow 776 | 0x12dd, NtUserMNDragLeave 777 | 0x12de, ZwUserMNDragOver 778 | 0x12e2, NtUserManageGestureHandlerWindow 779 | 0x12e3, NtUserMenuItemFromPoint 780 | 0x12e4, ZwUserMinMaximize 781 | 0x12e5, ZwUserModifyWindowTouchCapability 782 | 0x12e6, ZwUserNotifyIMEStatus 783 | 0x12e8, ZwUserOpenThreadDesktop 784 | 0x12eb, ZwUserPrintWindow 785 | 0x12ed, NtUserQueryInformationThread 786 | 0x12ee, ZwUserQueryInputContext 787 | 0x12ef, ZwUserQuerySendMessage 788 | 0x12f0, ZwUserRealChildWindowFromPoint 789 | 0x12f1, NtUserRealWaitMessageEx 790 | 0x12f2, NtUserRegisterErrorReportingDialog 791 | 0x12f7, ZwUserRegisterTasklist 792 | 0x12f9, NtUserRemoteConnect 793 | 0x12fa, ZwUserRemoteRedrawRectangle 794 | 0x12fb, NtUserRemoteRedrawScreen 795 | 0x12fc, NtUserRemoteStopScreenUpdates 796 | 0x12fd, NtUserRemoveClipboardFormatListener 797 | 0x12fe, NtUserResolveDesktopForWOW 798 | 0x12ff, ZwUserSendTouchInput 799 | 0x1300, ZwUserSetAppImeLevel 800 | 0x1302, ZwUserSetClassWord 801 | 0x1303, ZwUserSetCursorContents 802 | 0x1304, ZwUserSetDisplayConfig 803 | 0x1307, ZwUserSetImeInfoEx 804 | 0x1309, ZwUserSetInternalWindowPos 805 | 0x130c, ZwUserSetMenuContextHelpId 806 | 0x130d, NtUserSetMenuFlagRtoL 807 | 0x130e, ZwUserSetMirrorRendering 808 | 0x130f, ZwUserSetObjectInformation 809 | 0x1312, ZwUserSetSysColors 810 | 0x1313, NtUserSetSystemCursor 811 | 0x1314, ZwUserSetSystemTimer 812 | 0x1315, NtUserSetThreadLayoutHandles 813 | 0x1317, NtUserSetWindowDisplayAffinity 814 | 0x131a, NtUserSfmDestroyLogicalSurfaceBinding 815 | 0x131b, ZwUserSfmDxBindSwapChain 816 | 0x131c, ZwUserSfmDxGetSwapChainStats 817 | 0x1323, ZwUserSfmGetLogicalSurfaceBinding 818 | 0x1324, NtUserShowSystemCursor 819 | 0x1327, ZwUserTestForInteractiveUser 820 | 0x1329, NtUserUnloadKeyboardLayout 821 | 0x132c, ZwUserUnregisterSessionPort 822 | 0x132f, ZwUserUpdateInstance 823 | 0x1332, ZwUserUpdateWindowTransform 824 | 0x1333, ZwUserUserHandleGrantAccess 825 | 0x1336, ZwUserWaitForMsgAndEvent 826 | 0x1338, NtUserYieldTask 827 | -------------------------------------------------------------------------------- /output_win7_sp1/user32_x86.txt: -------------------------------------------------------------------------------- 1 | /*0x120d,01*/_UNKNOWN NtUserRegisterServicesProcess(_UNKNOWN); 2 | /*0x116a,08*/_UNKNOWN NtUserCreateWindowStation(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 3 | /*0x11da,04*/NTSTATUS NtUserInitializeClientPfnArrays(PFNCLIENT*,PFNCLIENT*,PFNCLIENTWORKER*,HANDLE); 4 | /*0x11ff,02*/_UNKNOWN NtUserProcessConnect(_UNKNOWN,_UNKNOWN); 5 | /*0x1264,00*/DWORD NtUserUnregisterUserApiHook(VOID); 6 | /*0x120a,04*/_UNKNOWN NtUserRegisterUserApiHook(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 7 | /*0x126b,01*/_UNKNOWN NtUserUpdatePerUserSystemParameters(_UNKNOWN); 8 | /*0x1225,05*/_UNKNOWN NtUserSetImeHotKey(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 9 | /*0x124a,04*/UINT NtUserSetWindowStationUser(HWINSTA,PLUID,PSID,DWORD); 10 | /*0x11e3,08*/_UNKNOWN NtUserLoadKeyboardLayoutEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 11 | /*0x1176,00*/DWORD NtUserDoSoundConnect(VOID); 12 | /*0x127c,02*/_UNKNOWN NtUserRegisterSessionPort(_UNKNOWN,_UNKNOWN); 13 | /*0x1148,02*/HWND NtUserCallHwndOpt(HWND,DWORD); 14 | /*0x1235,02*/BOOL NtUserSetShellWindowEx(HWND,HWND); 15 | /*0x121c,01*/_UNKNOWN NtUserSetChildWindowNoActivate(_UNKNOWN); 16 | /*0x1166,06*/_UNKNOWN NtUserCreateDesktopEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 17 | /*0x1228,04*/NTSTATUS NtUserSetInformationThread(HANDLE,USERTHREADINFOCLASS,PVOID,ULONG); 18 | /*0x1296,05*/_UNKNOWN NtUserSetGestureConfig(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 19 | /*0x11e4,01*/UINT NtUserLockWindowStation(HWINSTA); 20 | /*0x1252,02*/_UNKNOWN NtUserSwitchDesktop(_UNKNOWN,_UNKNOWN); 21 | /*0x1262,01*/BOOL NtUserUnlockWindowStation(HWINSTA); 22 | /*0x1146,02*/DWORD NtUserCallHwnd(HWND,DWORD); 23 | /*0x1287,00*/DWORD NtUserSfmDxReportPendingBindingsToDwm(VOID); 24 | /*0x127f,01*/_UNKNOWN NtUserDwmStartRedirection(_UNKNOWN); 25 | /*0x1152,03*/_UNKNOWN NtUserGetDisplayConfigBufferSizes(_UNKNOWN,_UNKNOWN,_UNKNOWN); 26 | /*0x1154,06*/_UNKNOWN NtUserQueryDisplayConfig(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 27 | /*0x11f9,03*/_UNKNOWN NtUserPaintMonitor(_UNKNOWN,_UNKNOWN,_UNKNOWN); 28 | /*0x11f8,01*/BOOL NtUserPaintDesktop(HDC); 29 | /*0x120c,03*/BOOL NtUserRegisterRawInputDevices(PCRAWINPUTDEVICE,UINT,UINT); 30 | /*0x11f5,03*/HDESK NtUserOpenInputDesktop(DWORD,BOOL,ACCESS_MASK); 31 | /*0x116b,05*/DWORD NtUserDdeInitialize(OUT PHANDLE,OUT HWND*,OUT PDWORD,DWORD,PVOID); 32 | /*0x121d,04*/LONG NtUserSetClassLong(HWND,INT,LONG,BOOL); 33 | /*0x1243,02*/BOOL NtUserSetWindowPlacement(HWND,LPWINDOWPLACEMENT); 34 | /*0x11df,03*/BOOL NtUserInvalidateRgn(HWND,HRGN,BOOL); 35 | /*0x113a,02*/HKL NtUserActivateKeyboardLayout(HKL,UINT); 36 | /*0x1183,00*/BOOL NtUserEndMenu(VOID); 37 | /*0x1230,02*/HWND NtUserSetParent(HWND,HWND); 38 | /*0x116e,03*/BOOL NtUserDeleteMenu(HMENU,UINT,UINT); 39 | /*0x1211,03*/BOOL NtUserRemoveMenu(HMENU,UINT,UINT); 40 | /*0x122d,03*/BOOL NtUserSetMenuDefaultItem(HMENU,UINT,UINT); 41 | /*0x1172,01*/BOOL NtUserDestroyMenu(HMENU); 42 | /*0x11ef,06*/BOOL NtUserMoveWindow(HWND,INT,INT,INT,INT,BOOL); 43 | /*0x1158,01*/BOOL NtUserCheckDesktopByThreadId(DWORD); 44 | /*0x124d,01*/BOOL NtUserShowCaret(HWND); 45 | /*0x11d5,01*/BOOL NtUserHideCaret(HWND); 46 | /*0x11b0,02*/INT NtUserGetKeyboardLayoutList(INT,LPHKL); 47 | /*0x11a1,03*/ULONG_PTR NtUserGetCPD(HWND,DWORD,ULONG_PTR); 48 | /*0x1164,02*/HACCEL NtUserCreateAcceleratorTable(LPACCEL,INT); 49 | /*0x1245,03*/INT NtUserSetWindowRgn(HWND,HRGN,BOOL); 50 | /*0x1281,02*/_UNKNOWN NtUserGetWindowMinimizeRect(_UNKNOWN,_UNKNOWN); 51 | /*0x1192,01*/SHORT NtUserGetAsyncKeyState(INT); 52 | /*0x1268,10*/BOOL NtUserUpdateLayeredWindow(HWND,HDC,LPPOINT,LPSIZE,HDC,LPPOINT,COLORREF,PBLENDFUNCTION,DWORD,LPRECT); 53 | /*0x11e1,01*/_UNKNOWN NtUserIsTopLevelWindow(_UNKNOWN); 54 | /*0x11d3,01*/_UNKNOWN NtUserGhostWindowFromHungWindow(_UNKNOWN); 55 | /*0x11cb,03*/BOOL NtUserGetUpdateRect(HWND,LPRECT,BOOL); 56 | /*0x114a,03*/DWORD NtUserCallHwndParamLock(HWND,DWORD,DWORD); 57 | /*0x1182,02*/BOOL NtUserEndDeferWindowPosEx(HDWP,BOOL); 58 | /*0x116c,08*/HDWP NtUserDeferWindowPos(HDWP,HWND,HWND,INT,INT,INT,INT,UINT); 59 | /*0x126a,04*/BOOL NtUserSetLayeredWindowAttributes(HWND,COLORREF,BYTE,DWORD); 60 | /*0x1170,02*/BOOL NtUserDestroyCursor(HCURSOR,DWORD); 61 | /*0x120b,04*/BOOL NtUserRegisterHotKey(HWND,INT,UINT,UINT); 62 | /*0x123f,02*/_UNKNOWN NtUserSetWindowCompositionAttribute(_UNKNOWN,_UNKNOWN); 63 | /*0x1224,01*/HWND NtUserSetFocus(HWND); 64 | /*0x11a6,00*/UINT NtUserGetDoubleClickTime(VOID); 65 | /*0x125f,01*/BOOL NtUserUnhookWindowsHookEx(HHOOK); 66 | /*0x1173,01*/BOOL NtUserDestroyWindow(HWND); 67 | /*0x1260,01*/BOOL NtUserUnhookWinEvent(HWINEVENTHOOK); 68 | /*0x123a,01*/BOOL NtUserSetThreadDesktop(HDESK); 69 | /*0x1231,01*/BOOL NtUserSetProcessWindowStation(HWINSTA); 70 | /*0x118c,05*/HWND NtUserFindWindowEx(HWND,HWND,PUNICODE_STRING,PUNICODE_STRING,DWORD); 71 | /*0x1263,03*/BOOL NtUserUnregisterClass(PUNICODE_STRING,HINSTANCE,OUT PCLSMENUNAME); 72 | /*0x1185,04*/NTSTATUS NtUserEnumDisplayDevices(PUNICODE_STRING,DWORD,OUT LPDISPLAY_DEVICEW,DWORD); 73 | /*0x115e,01*/BOOL NtUserCloseDesktop(HDESK); 74 | /*0x11f4,03*/HDESK NtUserOpenDesktop(POBJECT_ATTRIBUTES,DWORD,ACCESS_MASK); 75 | /*0x1144,04*/NTSTATUS NtUserBuildNameList(HWINSTA,UINT,OUT PNAMELIST,OUT PUINT); 76 | /*0x115f,01*/BOOL NtUserCloseWindowStation(HWINSTA); 77 | /*0x11f7,02*/HWINSTA NtUserOpenWindowStation(POBJECT_ATTRIBUTES,ACCESS_MASK); 78 | /*0x1223,04*/BOOL NtUserSetCursorIconData(HCURSOR,PUNICODE_STRING,PUNICODE_STRING,PCURSORDATA); 79 | /*0x114f,03*/DWORD_PTR NtUserCallTwoParam(DWORD_PTR,DWORD_PTR,DWORD); 80 | /*0x118b,03*/HCURSOR NtUserFindExistingCursorIcon(PUNICODE_STRING,PUNICODE_STRING,PCURSORFIND); 81 | /*0x120f,01*/UINT NtUserRegisterWindowMessage(PUNICODE_STRING); 82 | /*0x11be,00*/HWINSTA NtUserGetProcessWindowStation(VOID); 83 | /*0x1253,04*/BOOL NtUserSystemParametersInfo(UINT,DWORD,OUT PVOID,UINT); 84 | /*0x1249,06*/HHOOK NtUserSetWindowsHookEx(HANDLE,PUNICODE_STRING,DWORD,INT,PROC,DWORD); 85 | /*0x11bb,05*/BOOL NtUserGetObjectInformation(HANDLE,INT,PVOID,DWORD,PDWORD); 86 | /*0x1208,07*/RTL_ATOM NtUserRegisterClassExWOW(LPWNDCLASSEXW,PUNICODE_STRING,PUNICODE_STRING,PCLSMENUNAME,DWORD,DWORD,PDWORD); 87 | /*0x1169,15*/HWND NtUserCreateWindowEx(DWORD,PLARGE_STRING,PLARGE_STRING,PLARGE_STRING,DWORD,INT,INT,INT,INT,HWND,HMENU,HINSTANCE,PVOID,DWORD,PVOID); 88 | /*0x11fd,04*/BOOL NtUserPostThreadMessage(DWORD,UINT,WPARAM,LPARAM); 89 | /*0x1193,02*/ULONG NtUserGetAtomName(ATOM,OUT PUNICODE_STRING); 90 | /*0x124f,02*/BOOL NtUserShowWindow(HWND,INT); 91 | /*0x11aa,06*/BOOL NtUserGetIconInfo(HICON,OUT PICONINFO,OUT PUNICODE_STRING,OUT PUNICODE_STRING,OUT PDWORD,BOOL); 92 | /*0x11ab,04*/BOOL NtUserGetIconSize(HICON,UINT,OUT PINT,OUT PINT); 93 | /*0x1256,06*/BOOL NtUserThunkedMenuItemInfo(HMENU,UINT,BOOL,BOOL,LPMENUITEMINFOW,PUNICODE_STRING); 94 | /*0x11c5,02*/HMENU NtUserGetSystemMenu(HWND,BOOL); 95 | /*0x1241,02*/BOOL NtUserSetWindowFNID(HWND,WORD); 96 | /*0x1266,03*/_UNKNOWN NtUserUpdateInputContext(_UNKNOWN,_UNKNOWN,_UNKNOWN); 97 | /*0x1196,05*/_UNKNOWN NtUserGetClassInfoEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 98 | /*0x1194,00*/UINT NtUserGetCaretBlinkTime(VOID); 99 | /*0x1187,04*/NTSTATUS NtUserEnumDisplaySettings(PUNICODE_STRING,DWORD,OUT LPDEVMODEW,DWORD); 100 | /*0x1197,03*/INT NtUserGetClassName(HWND,BOOL,OUT PUNICODE_STRING); 101 | /*0x1244,07*/BOOL NtUserSetWindowPos(HWND,HWND,INT,INT,INT,INT,UINT); 102 | /*0x1147,02*/BOOL NtUserCallHwndLock(HWND,DWORD); 103 | /*0x1227,02*/_UNKNOWN NtUserSetImeOwnerWindow(_UNKNOWN,_UNKNOWN); 104 | /*0x11a9,02*/BOOL NtUserGetGUIThreadInfo(DWORD,LPGUITHREADINFO); 105 | /*0x1291,04*/_UNKNOWN NtUserChangeWindowMessageFilterEx(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 106 | /*0x124c,08*/HWINEVENTHOOK NtUserSetWinEventHook(DWORD,DWORD,HMODULE,PUNICODE_STRING,WINEVENTPROC,DWORD,DWORD,DWORD); 107 | /*0x1207,04*/BOOL NtUserRedrawWindow(HWND,LPRECT,HRGN,UINT); 108 | /*0x1190,02*/HWND NtUserGetAncestor(HWND,UINT); 109 | /*0x11ce,02*/_UNKNOWN NtUserGetWindowCompositionAttribute(_UNKNOWN,_UNKNOWN); 110 | /*0x11cd,02*/_UNKNOWN NtUserGetWindowCompositionInfo(_UNKNOWN,_UNKNOWN); 111 | /*0x1246,03*/_UNKNOWN NtUserGetWindowRgnEx(_UNKNOWN,_UNKNOWN,_UNKNOWN); 112 | /*0x117d,11*/BOOL NtUserDrawIconEx(HDC,INT,INT,HICON,INT,INT,UINT,HBRUSH,UINT,BOOL,OUT DRAWICONEXDATA*); 113 | /*0x11b4,01*/SHORT NtUserGetKeyState(INT); 114 | /*0x11a5,03*/HDC NtUserGetDCEx(HWND,HRGN,DWORD); 115 | /*0x1149,03*/DWORD NtUserCallHwndParam(HWND,DWORD,DWORD); 116 | /*0x1221,01*/HCURSOR NtUserSetCursor(HCURSOR); 117 | /*0x1258,01*/BOOL NtUserTrackMouseEvent(LPTRACKMOUSEEVENT); 118 | /*0x11f2,04*/VOID NtUserNotifyWinEvent(DWORD,HWND,LONG,LONG); 119 | /*0x1219,01*/HWND NtUserSetActiveWindow(HWND); 120 | /*0x11a7,00*/HWND NtUserGetForegroundWindow(VOID); 121 | /*0x1186,04*/BOOL NtUserEnumDisplayMonitors(HDC,LPCRECT,MONITORENUMPROC,LPARAM); 122 | /*0x1143,07*/NTSTATUS NtUserBuildHwndList(HDESK,HWND,BOOL,DWORD,UINT,OUT HWND*,OUT PUINT); 123 | /*0x11c7,01*/ULONG_PTR NtUserGetThreadState(USERTHREADSTATECLASS); 124 | /*0x1242,04*/LONG NtUserSetWindowLong(HWND,INT,LONG,BOOL); 125 | /*0x11fc,04*/BOOL NtUserPostMessage(HWND,UINT,WPARAM,LPARAM); 126 | /*0x1234,04*/INT NtUserSetScrollInfo(HWND,INT,LPCSCROLLINFO,BOOL); 127 | /*0x11cf,01*/HDC NtUserGetWindowDC(HWND); 128 | /*0x11dc,03*/INT NtUserInternalGetWindowText(HWND,OUT PWSTR,INT); 129 | /*0x11c8,02*/BOOL NtUserGetTitleBarInfo(HWND,LPTITLEBARINFO); 130 | /*0x125b,05*/_UNKNOWN NtUserCalcMenuBar(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 131 | /*0x11c4,03*/BOOL NtUserGetScrollBarInfo(HWND,LONG,LPSCROLLBARINFO); 132 | /*0x1214,04*/BOOL NtUserSBGetParms(HWND,INT,PSBDATA,OUT LPSCROLLINFO); 133 | /*0x11ea,07*/LRESULT NtUserMessageCall(HWND,UINT,WPARAM,LPARAM,ULONG_PTR,DWORD,BOOL); 134 | /*0x123d,04*/UINT_PTR NtUserSetTimer(HWND,UINT_PTR,UINT,TIMERPROC); 135 | /*0x11a4,01*/HDC NtUserGetDC(HWND); 136 | /*0x11de,03*/BOOL NtUserInvalidateRect(HWND,LPRECT,BOOL); 137 | /*0x1203,02*/HANDLE NtUserQueryWindow(HWND,WINDOWINFOCLASS); 138 | /*0x1232,02*/_UNKNOWN NtUserGetProp(_UNKNOWN,_UNKNOWN); 139 | /*0x1175,01*/LRESULT NtUserDispatchMessage(LPMSG); 140 | /*0x113f,02*/HDC NtUserBeginPaint(HWND,LPPAINTSTRUCT); 141 | /*0x1184,02*/BOOL NtUserEndPaint(HWND,LPPAINTSTRUCT); 142 | /*0x1233,03*/BOOL NtUserSetProp(HWND,DWORD,HANDLE); 143 | /*0x1212,02*/HANDLE NtUserRemoveProp(HWND,DWORD); 144 | /*0x11fa,05*/BOOL NtUserPeekMessage(OUT LPMSG,HWND,UINT,UINT,UINT); 145 | /*0x11e2,02*/BOOL NtUserKillTimer(HWND,UINT_PTR); 146 | /*0x1205,06*/BOOL NtUserRealInternalGetMessage(LPMSG,HWND,UINT,UINT,UINT,BOOL); 147 | /*0x126f,01*/BOOL NtUserValidateTimerCallback(LPARAM); 148 | /*0x1273,00*/BOOL NtUserWaitMessage(VOID); 149 | /*0x11b9,04*/BOOL NtUserGetMessage(OUT LPMSG,HWND,UINT,UINT); 150 | /*0x1289,02*/_UNKNOWN NtUserSfmDxSetSwapChainStats(_UNKNOWN,_UNKNOWN); 151 | /*0x114e,02*/DWORD_PTR NtUserCallOneParam(DWORD_PTR,DWORD); 152 | /*0x114d,01*/DWORD_PTR NtUserCallNoParam(DWORD); 153 | /*0x11c6,01*/HDESK NtUserGetThreadDesktop(DWORD); 154 | /*0x123e,00*/DWORD NtUserSetProcessDPIAware(VOID); 155 | /*0x1160,03*/NTSTATUS NtUserConsoleControl(CONSOLECONTROL,PVOID,DWORD); 156 | /*0x1215,07*/BOOL NtUserScrollDC(HDC,INT,INT,LPRECT,LPRECT,HRGN,OUT LPRECT); 157 | /*0x11e6,00*/BOOL NtUserLockWorkStation(VOID); 158 | /*0x125a,05*/_UNKNOWN NtUserCalculatePopupWindowPosition(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 159 | /*0x1155,01*/_UNKNOWN NtUserDisplayConfigGetDeviceInfo(_UNKNOWN); 160 | /*0x115c,01*/BOOL NtUserClipCursor(LPRECT); 161 | /*0x1257,07*/INT NtUserToUnicodeEx(UINT,UINT,PBYTE,OUT PWSTR,INT,UINT,HKL); 162 | /*0x11b8,04*/BOOL NtUserGetMenuItemRect(HWND,HMENU,UINT,LPRECT); 163 | /*0x121f,03*/BOOL NtUserSetClipboardData(UINT,HANDLE,PSETCLIPBDATA); 164 | /*0x1161,02*/HANDLE NtUserConvertMemHandle(PBYTE,UINT); 165 | /*0x117f,00*/BOOL NtUserEmptyClipboard(VOID); 166 | /*0x1198,02*/HANDLE NtUserGetClipboardData(UINT,OUT PGETCLIPBDATA); 167 | /*0x1168,04*/NTSTATUS NtUserCreateLocalMemHandle(HANDLE,OUT PBYTE,UINT,OUT PUINT); 168 | /*0x1282,03*/_UNKNOWN NtUserSfmDxBindSwapChain(_UNKNOWN,_UNKNOWN,_UNKNOWN); 169 | /*0x1283,04*/_UNKNOWN NtUserSfmDxOpenSwapChain(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 170 | /*0x1286,03*/_UNKNOWN NtUserSfmDxQuerySwapChainBindingStatus(_UNKNOWN,_UNKNOWN,_UNKNOWN); 171 | /*0x1288,02*/_UNKNOWN NtUserSfmDxGetSwapChainStats(_UNKNOWN,_UNKNOWN); 172 | /*0x1285,02*/_UNKNOWN NtUserSfmDxSetSwapChainBindingStatus(_UNKNOWN,_UNKNOWN); 173 | /*0x1284,02*/_UNKNOWN NtUserSfmDxReleaseSwapChain(_UNKNOWN,_UNKNOWN); 174 | /*0x115a,03*/DWORD NtUserCheckMenuItem(HMENU,UINT,UINT); 175 | /*0x11e5,01*/BOOL NtUserLockWindowUpdate(HWND); 176 | /*0x1251,00*/DWORD NtUserSoundSentry(VOID); 177 | /*0x1338,04*/_UNKNOWN NtUserHwndSetRedirectionInfo(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 178 | /*0x126d,01*/BOOL NtUserValidateHandleSecure(HANDLE); 179 | /*0x1280,00*/DWORD NtUserDwmStopRedirection(VOID); 180 | /*0x11dd,02*/_UNKNOWN NtUserInternalGetWindowIcon(_UNKNOWN,_UNKNOWN); 181 | /*0x11d7,01*/_UNKNOWN NtUserHungWindowFromGhostWindow(_UNKNOWN); 182 | /*0x1151,04*/LONG NtUserChangeDisplaySettings(PUNICODE_STRING,LPDEVMODEW,DWORD,PVOID); 183 | /*0x1337,04*/_UNKNOWN NtUserHwndQueryRedirectionInfo(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 184 | /*0x1334,02*/_UNKNOWN NtUserMagControl(_UNKNOWN,_UNKNOWN); 185 | /*0x1335,04*/_UNKNOWN NtUserMagSetContextInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 186 | /*0x1336,04*/_UNKNOWN NtUserMagGetContextInformation(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 187 | /*0x1199,03*/INT NtUserGetClipboardFormatName(UINT,OUT PWSTR,UINT); 188 | /*0x1220,01*/HWND NtUserSetClipboardViewer(HWND); 189 | /*0x119f,03*/HBRUSH NtUserGetControlBrush(HWND,HDC,UINT); 190 | /*0x1189,02*/INT NtUserExcludeUpdateRgn(HDC,HWND); 191 | /*0x1270,03*/SHORT NtUserVkKeyScanEx(WCHAR,ULONG_PTR,BOOL); 192 | /*0x126e,02*/BOOL NtUserValidateRect(HWND,LPRECT); 193 | /*0x1238,02*/BOOL NtUserSetSystemMenu(HWND,HMENU); 194 | /*0x115b,03*/HWND NtUserChildWindowFromPointEx(HWND,POINT,UINT); 195 | /*0x1271,03*/DWORD NtUserWaitForInputIdle(ULONG_PTR,DWORD,BOOL); 196 | /*0x11cc,03*/INT NtUserGetUpdateRgn(HWND,HRGN,BOOL); 197 | /*0x124b,03*/WORD NtUserSetWindowWord(HWND,INT,WORD); 198 | /*0x1180,03*/BOOL NtUserEnableMenuItem(HMENU,UINT,UINT); 199 | /*0x1150,02*/BOOL NtUserChangeClipboardChain(HWND,HWND); 200 | /*0x1140,08*/BOOL NtUserBitBltSysBmp(HDC,INT,INT,INT,INT,INT,INT,DWORD); 201 | /*0x1181,03*/BOOL NtUserEnableScrollBar(HWND,UINT,UINT); 202 | /*0x116d,02*/BOOL NtUserDefSetText(HWND,PLARGE_STRING); 203 | /*0x11a2,04*/HCURSOR NtUserGetCursorFrameInfo(HCURSOR,INT,OUT PDWORD,OUT PINT); 204 | /*0x118d,01*/BOOL NtUserFlashWindowEx(PFLASHWINFO); 205 | /*0x114c,04*/LRESULT NtUserCallNextHookEx(INT,WPARAM,LPARAM,BOOL); 206 | /*0x1247,03*/_UNKNOWN NtUserSetWindowRgnEx(_UNKNOWN,_UNKNOWN,_UNKNOWN); 207 | /*0x1195,01*/BOOL NtUserGetCaretPos(LPPOINT); 208 | /*0x1162,03*/INT NtUserCopyAcceleratorTable(HACCEL,LPACCEL,INT); 209 | /*0x119e,02*/BOOL NtUserGetComboBoxInfo(HWND,LPCOMBOBOXINFO); 210 | /*0x123c,02*/VOID NtUserSetThreadState(DWORD,DWORD); 211 | /*0x124e,03*/BOOL NtUserShowScrollBar(HWND,INT,BOOL); 212 | /*0x1216,08*/BOOL NtUserScrollWindowEx(HWND,INT,INT,LPRECT,LPRECT,HRGN,OUT LPRECT,UINT); 213 | /*0x115d,00*/BOOL NtUserCloseClipboard(VOID); 214 | /*0x11f3,02*/BOOL NtUserOpenClipboard(HWND,OUT PBOOL); 215 | /*0x11e0,01*/BOOL NtUserIsClipboardFormatAvailable(UINT); 216 | /*0x119b,00*/DWORD NtUserGetClipboardSequenceNumber(VOID); 217 | /*0x119a,00*/HWND NtUserGetClipboardOwner(VOID); 218 | /*0x1255,02*/BOOL NtUserThunkedMenuInfo(HMENU,LPCMENUINFO); 219 | /*0x1163,00*/INT NtUserCountClipboardFormats(VOID); 220 | /*0x114b,02*/BOOL NtUserCallMsgFilter(OUT LPMSG,INT); 221 | /*0x11bc,00*/HWND NtUserGetOpenClipboardWindow(VOID); 222 | /*0x1259,06*/BOOL NtUserTrackPopupMenuEx(HMENU,UINT,INT,INT,HWND,LPTPMPARAMS); 223 | /*0x118a,04*/BOOL NtUserFillWindow(HWND,HWND,HDC,HBRUSH); 224 | /*0x1165,04*/BOOL NtUserCreateCaret(HWND,HBITMAP,INT,INT); 225 | /*0x116f,01*/BOOL NtUserDestroyAcceleratorTable(HACCEL); 226 | /*0x121b,01*/HWND NtUserSetCapture(HWND); 227 | /*0x11b2,01*/BOOL NtUserGetKeyboardState(PBYTE); 228 | /*0x122a,01*/BOOL NtUserSetKeyboardState(PBYTE); 229 | /*0x125d,03*/INT NtUserTranslateAccelerator(HWND,HACCEL,LPMSG); 230 | /*0x11d1,02*/BOOL NtUserGetWindowPlacement(HWND,LPWINDOWPLACEMENT); 231 | /*0x125e,02*/BOOL NtUserTranslateMessage(LPMSG,UINT); 232 | /*0x1265,02*/BOOL NtUserUnregisterHotKey(HWND,INT); 233 | /*0x11e8,04*/UINT NtUserMapVirtualKeyEx(UINT,UINT,ULONG_PTR,BOOL); 234 | /*0x1141,01*/BOOL NtUserBlockInput(BOOL); 235 | /*0x122b,03*/BOOL NtUserSetMenu(HWND,HMENU,BOOL); 236 | /*0x113e,03*/BOOL NtUserAttachThreadInput(DWORD,DWORD,BOOL); 237 | /*0x1275,01*/HWND NtUserWindowFromPoint(POINT); 238 | /*0x1274,02*/_UNKNOWN NtUserWindowFromPhysicalPoint(_UNKNOWN,_UNKNOWN); 239 | /*0x11e7,02*/_UNKNOWN NtUserLogicalToPhysicalPoint(_UNKNOWN,_UNKNOWN); 240 | /*0x11fb,02*/_UNKNOWN NtUserPhysicalToLogicalPoint(_UNKNOWN,_UNKNOWN); 241 | /*0x11b6,04*/BOOL NtUserGetMenuBarInfo(HWND,LONG,LONG,PMENUBARINFO); 242 | /*0x1218,03*/UINT NtUserSendInput(UINT,LPINPUT,INT); 243 | /*0x125c,06*/_UNKNOWN NtUserPaintMenuBar(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 244 | /*0x113b,01*/_UNKNOWN NtUserAddClipboardFormatListener(_UNKNOWN); 245 | /*0x113c,03*/VOID NtUserAlterWindowStyle(HWND,DWORD,DWORD); 246 | /*0x1145,04*/NTSTATUS NtUserBuildPropList(HWND,UINT,OUT PPROPSET,OUT PUINT); 247 | /*0x1153,05*/_UNKNOWN NtUserSetDisplayConfig(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 248 | /*0x1156,01*/_UNKNOWN NtUserDisplayConfigSetDeviceInfo(_UNKNOWN); 249 | /*0x1157,03*/_UNKNOWN NtUserCheckAccessForIntegrityLevel(_UNKNOWN,_UNKNOWN,_UNKNOWN); 250 | /*0x1159,02*/_UNKNOWN NtUserCheckWindowThreadDesktop(_UNKNOWN,_UNKNOWN); 251 | /*0x1177,00*/DWORD NtUserDoSoundDisconnect(VOID); 252 | /*0x1178,02*/BOOL NtUserDragDetect(HWND,POINT); 253 | /*0x1179,05*/DWORD NtUserDragObject(HWND,HWND,UINT,ULONG_PTR,HCURSOR); 254 | /*0x117a,04*/BOOL NtUserDrawAnimatedRects(HWND,INT,LPRECT,LPRECT); 255 | /*0x117b,04*/BOOL NtUserDrawCaption(HWND,HDC,LPRECT,UINT); 256 | /*0x117c,07*/BOOL NtUserDrawCaptionTemp(HWND,HDC,LPCRECT,HFONT,HICON,PUNICODE_STRING,UINT); 257 | /*0x117e,05*/INT NtUserDrawMenuBarTemp(HWND,HDC,LPCRECT,HMENU,HFONT); 258 | /*0x1188,01*/DWORD NtUserEvent(PEVENT_PACKET); 259 | /*0x118e,02*/_UNKNOWN NtUserFrostCrashedWindow(_UNKNOWN,_UNKNOWN); 260 | /*0x118f,06*/BOOL NtUserGetAltTabInfo(HWND,INT,OUT PALTTABINFO,OUT PWSTR,UINT,BOOL); 261 | /*0x119c,00*/HWND NtUserGetClipboardViewer(VOID); 262 | /*0x119d,01*/BOOL NtUserGetClipCursor(LPRECT); 263 | /*0x11a0,04*/HBRUSH NtUserGetControlColor(HWND,HWND,HDC,UINT); 264 | /*0x11a3,01*/BOOL NtUserGetCursorInfo(LPCURSORINFO); 265 | /*0x11a8,02*/DWORD NtUserGetGuiResources(HANDLE,DWORD); 266 | /*0x11ac,04*/_UNKNOWN NtUserGetImeHotKey(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 267 | /*0x11ae,02*/_UNKNOWN NtUserGetInputLocaleInfo(_UNKNOWN,_UNKNOWN); 268 | /*0x11af,03*/UINT NtUserGetInternalWindowPos(HWND,OUT LPRECT,OUT LPPOINT); 269 | /*0x11b1,01*/BOOL NtUserGetKeyboardLayoutName(OUT PUNICODE_STRING); 270 | /*0x11b3,03*/INT NtUserGetKeyNameText(LONG,OUT PWSTR,UINT); 271 | /*0x11b5,01*/DWORD NtUserGetListBoxInfo(HWND); 272 | /*0x11b7,02*/DWORD NtUserGetMenuIndex(HMENU,HMENU); 273 | /*0x11ba,05*/INT NtUserGetMouseMovePointsEx(UINT,LPMOUSEMOVEPOINT,LPMOUSEMOVEPOINT,INT,DWORD); 274 | /*0x11bd,02*/INT NtUserGetPriorityClipboardFormat(PUINT,INT); 275 | /*0x11bf,03*/DWORD NtUserGetRawInputBuffer(PRAWINPUT,PUINT,UINT); 276 | /*0x11c0,05*/UINT NtUserGetRawInputData(HRAWINPUT,UINT,PVOID,PUINT,UINT); 277 | /*0x11c1,04*/DWORD NtUserGetRawInputDeviceInfo(HANDLE,UINT,PVOID,PUINT); 278 | /*0x11c2,03*/UINT NtUserGetRawInputDeviceList(PRAWINPUTDEVICELIST,PUINT,UINT); 279 | /*0x11c3,03*/UINT NtUserGetRegisteredRawInputDevices(PRAWINPUTDEVICE,PUINT,UINT); 280 | /*0x11c9,01*/_UNKNOWN NtUserGetTopLevelWindow(_UNKNOWN); 281 | /*0x11ca,03*/_UNKNOWN NtUserGetUpdatedClipboardFormats(_UNKNOWN,_UNKNOWN,_UNKNOWN); 282 | /*0x11d0,02*/_UNKNOWN NtUserGetWindowDisplayAffinity(_UNKNOWN,_UNKNOWN); 283 | /*0x11d2,02*/PCLS NtUserGetWOWClass(HINSTANCE,PUNICODE_STRING); 284 | /*0x11d6,04*/BOOL NtUserHiliteMenuItem(HWND,HMENU,UINT,UINT); 285 | /*0x11d8,02*/BOOL NtUserImpersonateDdeClientWindow(HWND,HWND); 286 | /*0x11db,12*/_UNKNOWN NtUserInitTask(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 287 | /*0x11e9,03*/INT NtUserMenuItemFromPoint(HWND,HMENU,POINT); 288 | /*0x11eb,03*/HWND NtUserMinMaximize(HWND,UINT,BOOL); 289 | /*0x11ec,00*/DWORD NtUserMNDragLeave(VOID); 290 | /*0x11ed,02*/BOOL NtUserMNDragOver(LPPOINT,OUT PMNDRAGOVERINFO); 291 | /*0x11ee,02*/VOID NtUserModifyUserStartupInfoFlags(DWORD,DWORD); 292 | /*0x11f0,03*/_UNKNOWN NtUserNotifyIMEStatus(_UNKNOWN,_UNKNOWN,_UNKNOWN); 293 | /*0x11f6,04*/_UNKNOWN NtUserOpenThreadDesktop(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 294 | /*0x11fe,03*/BOOL NtUserPrintWindow(HWND,HDC,UINT); 295 | /*0x1202,01*/BOOL NtUserQuerySendMessage(OUT LPMSG); 296 | /*0x1204,02*/HWND NtUserRealChildWindowFromPoint(HWND,POINT); 297 | /*0x1206,02*/BOOL NtUserRealWaitMessageEx(DWORD,UINT); 298 | /*0x1209,02*/_UNKNOWN NtUserRegisterErrorReportingDialog(_UNKNOWN,_UNKNOWN); 299 | /*0x120e,01*/BOOL NtUserRegisterTasklist(HWND); 300 | /*0x1210,01*/_UNKNOWN NtUserRemoveClipboardFormatListener(_UNKNOWN); 301 | /*0x1213,01*/NTSTATUS NtUserResolveDesktopForWOW(OUT PUNICODE_STRING); 302 | /*0x121e,03*/WORD NtUserSetClassWord(HWND,INT,WORD); 303 | /*0x1222,02*/BOOL NtUserSetCursorContents(HCURSOR,HCURSOR); 304 | /*0x1229,04*/BOOL NtUserSetInternalWindowPos(HWND,UINT,LPRECT,LPPOINT); 305 | /*0x122c,02*/BOOL NtUserSetMenuContextHelpId(HMENU,DWORD); 306 | /*0x122e,01*/BOOL NtUserSetMenuFlagRtoL(HMENU); 307 | /*0x122f,04*/BOOL NtUserSetObjectInformation(HANDLE,INT,PVOID,DWORD); 308 | /*0x1236,04*/BOOL NtUserSetSysColors(INT,PINT,LPCOLORREF,UINT); 309 | /*0x1237,02*/BOOL NtUserSetSystemCursor(HCURSOR,DWORD); 310 | /*0x1239,03*/_UNKNOWN NtUserSetSystemTimer(_UNKNOWN,_UNKNOWN,_UNKNOWN); 311 | /*0x1240,02*/_UNKNOWN NtUserSetWindowDisplayAffinity(_UNKNOWN,_UNKNOWN); 312 | /*0x1248,03*/HHOOK NtUserSetWindowsHookAW(INT,HOOKPROC,DWORD); 313 | /*0x1250,02*/BOOL NtUserShowWindowAsync(HWND,INT); 314 | /*0x1254,01*/NTSTATUS NtUserTestForInteractiveUser(PLUID); 315 | /*0x1261,01*/BOOL NtUserUnloadKeyboardLayout(HKL); 316 | /*0x1267,03*/DWORD NtUserUpdateInstance(HANDLE,OUT PDWORD,DWORD); 317 | /*0x1269,04*/BOOL NtUserGetLayeredWindowAttributes(HWND,LPCOLORREF,PBYTE,PDWORD); 318 | /*0x126c,03*/BOOL NtUserUserHandleGrantAccess(HANDLE,HANDLE,BOOL); 319 | /*0x1272,01*/BOOL NtUserWaitForMsgAndEvent(HANDLE); 320 | /*0x1276,00*/DWORD NtUserYieldTask(VOID); 321 | /*0x127d,00*/DWORD NtUserUnregisterSessionPort(VOID); 322 | /*0x127e,03*/_UNKNOWN NtUserUpdateWindowTransform(_UNKNOWN,_UNKNOWN,_UNKNOWN); 323 | /*0x128a,04*/_UNKNOWN NtUserSfmGetLogicalSurfaceBinding(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 324 | /*0x128b,01*/_UNKNOWN NtUserSfmDestroyLogicalSurfaceBinding(_UNKNOWN); 325 | /*0x128c,03*/_UNKNOWN NtUserModifyWindowTouchCapability(_UNKNOWN,_UNKNOWN,_UNKNOWN); 326 | /*0x128d,02*/_UNKNOWN NtUserIsTouchWindow(_UNKNOWN,_UNKNOWN); 327 | /*0x128e,04*/_UNKNOWN NtUserSendTouchInput(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 328 | /*0x128f,01*/_UNKNOWN NtUserEndTouchOperation(_UNKNOWN); 329 | /*0x1290,04*/_UNKNOWN NtUserGetTouchInputInfo(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 330 | /*0x1292,05*/_UNKNOWN NtUserInjectGesture(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 331 | /*0x1293,02*/_UNKNOWN NtUserGetGestureInfo(_UNKNOWN,_UNKNOWN); 332 | /*0x1294,03*/_UNKNOWN NtUserGetGestureExtArgs(_UNKNOWN,_UNKNOWN,_UNKNOWN); 333 | /*0x1295,02*/_UNKNOWN NtUserManageGestureHandlerWindow(_UNKNOWN,_UNKNOWN); 334 | /*0x1297,06*/_UNKNOWN NtUserGetGestureConfig(_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN,_UNKNOWN); 335 | /*0x1332,02*/_UNKNOWN NtUserSetMirrorRendering(_UNKNOWN,_UNKNOWN); 336 | /*0x1333,01*/_UNKNOWN NtUserShowSystemCursor(_UNKNOWN); 337 | -------------------------------------------------------------------------------- /syscalls.py: -------------------------------------------------------------------------------- 1 | ''' 2 | This IdaPython script fetchs syscall's ID and function name from 3 | those Windows dlls with IDA Pro, such as ntdll.dll, user32.dll. 4 | 5 | It requires IDA 6.8 and later. For getting function prototypes, 6 | A pdb file is required when the dll is first opened to analyze. 7 | 8 | If not a H_APIs.h, You need generate it from ntgdi_reactos.h, 9 | ntuser_reactos.h and ntuser_w2k.h, then use 'Alt+F7' to open 10 | this script to run. The H_APIs.h supply the prototype, when IDA 11 | cannot get it. 12 | 13 | The last, you can obtain a output file at the script path. 14 | 15 | A example of function fetched from IDA is following: 16 | 17 | .text:77D74BF9 _NtUserGetPriorityClipboardFormat@8 proc near 18 | .text:77D74BF9 mov eax, 11BDh 19 | .text:77D74BFE mov edx, 7FFE0300h 20 | .text:77D74C03 call dword ptr [edx] 21 | .text:77D74C05 retn 8 22 | .text:77D74C05 _NtUserGetPriorityClipboardFormat@8 endp 23 | 24 | The example of output is following: 25 | ...... 26 | /*0x116e,03*/BOOL NtUserDeleteMenu(HMENU,UINT,UINT); 27 | /*0x1211,03*/BOOL NtUserRemoveMenu(HMENU,UINT,UINT); 28 | /*0x122d,03*/BOOL NtUserSetMenuDefaultItem(HMENU,UINT,UINT); 29 | /*0x1172,01*/BOOL NtUserDestroyMenu(HMENU); 30 | /*0x11ef,06*/BOOL NtUserMoveWindow(HWND,INT,INT,INT,INT,BOOL); 31 | /*0x1158,01*/BOOL NtUserCheckDesktopByThreadId(DWORD); 32 | ...... 33 | 34 | The columns meanning above: 35 | ID, Paramster count, Function prototype 36 | 37 | author: 55-AA 38 | 39 | ref: https://www.hex-rays.com/products/ida/support/idapython_docs/ 40 | idaapi.py 41 | ''' 42 | 43 | import os 44 | from idaapi import * 45 | 46 | g_param_format = { 47 | "char" : "CHAR", 48 | "int" : "INT", 49 | "void" : "VOID", 50 | "_DWORD" : "DWORD", 51 | 52 | "LPSTR" : "PSTR", 53 | "LPCSTR" : "PCSTR", 54 | "LPWSTR" : "PWSTR", 55 | "LPCWSTR" : "PCWSTR", 56 | 57 | "LPVOID" : "PVOID", 58 | "LPCHAR" : "PCHAR", 59 | "LPUCHAR" : "PUCHAR", 60 | "LPBYTE" : "PBYTE", 61 | "LPWCHAR" : "PWCHAR", 62 | "LPSHORT" : "PSHORT", 63 | "LPUSHORT" : "PUSHORT", 64 | "LPDWORD" : "PDWORD", 65 | "LPWORD" : "PWORD", 66 | "LPINT" : "PINT", 67 | "LPUINT" : "PUINT", 68 | "LPLONG" : "PLONG", 69 | "LPULONG" : "PULONG", 70 | "LPBOOL" : "PBOOL", 71 | 72 | "PMSG" : "LPMSG", 73 | "PSIZE" : "LPSIZE", 74 | "PPOINT" : "LPPOINT", 75 | "PRECT" : "LPRECT", 76 | "PCURSORINFO" : "LPCURSORINFO", 77 | "PTITLEBARINFO" : "LPTITLEBARINFO", 78 | "PGUITHREADINFO" : "LPGUITHREADINFO", 79 | "PSCROLLBARINFO" : "LPSCROLLBARINFO", 80 | "PCOMBOBOXINFO" : "LPCOMBOBOXINFO", 81 | } 82 | 83 | g_param_format2 = { 84 | "VOID*" : "PVOID", 85 | "CHAR*" : "PCHAR", 86 | "UCHAR*" : "PUCHAR", 87 | "BYTE*" : "PBYTE", 88 | "WCHAR*" : "PWCHAR", 89 | "SHORT*" : "PSHORT", 90 | "USHORT*" : "PUSHORT", 91 | "DWORD*" : "PDWORD", 92 | "WORD*" : "PWORD", 93 | "INT*" : "PINT", 94 | "UINT*" : "PUINT", 95 | "LONG*" : "PLONG", 96 | "ULONG*" : "PULONG", 97 | "BOOL*" : "PBOOL", 98 | #structure 99 | "SIZE*" : "LPSIZE", 100 | "MSG*" : "LPMSG", 101 | "POINT*" : "LPPOINT", 102 | "POINTL*" : "PPOINTL", 103 | "HKL*" : "LPHKL", 104 | "RECT*" : "LPRECT", 105 | "RECTL*" : "LPRECTL", 106 | "COLORREF*" : "LPCOLORREF", 107 | "WNDCLASSEXW*" : "LPWNDCLASSEXW", 108 | "PAINTSTRUCT*" : "LPPAINTSTRUCT", 109 | "WINDOWPLACEMENT*" : "LPWINDOWPLACEMENT", 110 | "BLENDFUNCTION*" : "PBLENDFUNCTION", # 111 | } 112 | 113 | def format_type(T): 114 | A = T.split('*') 115 | param = A[0] 116 | if param in g_param_format.keys(): 117 | param = g_param_format[param] 118 | 119 | if len(A) > 1: 120 | param += '*' 121 | if param in g_param_format2.keys(): 122 | param = g_param_format2[param] 123 | 124 | return param 125 | 126 | def from_IDA_function_type(T): 127 | # BOOL __stdcall(HWND hwnd, LONG idObject, PSCROLLBARINFO psbi) 128 | (Ret, Other) = T.strip().split('(') 129 | Ret = Ret.strip().split(' ')[0].strip() 130 | Ret = format_type(Ret) 131 | Other = Other.strip().split(')')[0].strip() 132 | Args = [] 133 | Argn = 0 134 | IN_key_skip = ["IN", "OUT", "CONST", "const", "OPTIONAL"] 135 | for i in Other.split(','): 136 | words = i.split() 137 | for j in IN_key_skip: 138 | if j in words: 139 | words.remove(j) 140 | 141 | if len(words) > 0: 142 | arg = words[0] 143 | argument = '' 144 | if len(words) > 1: 145 | argument = words[1] 146 | 147 | if '*' in words: 148 | arg += '*' 149 | else: 150 | if len(words) > 1 and '*' == words[1][:1]: 151 | arg += '*' 152 | 153 | Argn += 1 154 | else: 155 | arg = "VOID" 156 | 157 | Args.append(format_type(arg)) 158 | 159 | return(Ret, ','.join(Args), Argn) 160 | 161 | g_func_dict = {} 162 | 163 | def load_h_file(h_file): 164 | f = open(h_file, "r") 165 | for line in f: 166 | (line, paramN) = line.split(');//') 167 | (func_ret, line) = line.split(' ', 1) 168 | (func_name, parameters) = line.split('(') 169 | dictV = [func_ret, int(paramN), parameters] 170 | g_func_dict[func_name] = dictV 171 | continue 172 | 173 | f.close() 174 | 175 | def from_h_function_type(Name, argN): 176 | if Name in g_func_dict.keys(): 177 | Value = g_func_dict[Name] 178 | if Value[1] == argN: 179 | return (Value[0], Value[2], Value[1]) 180 | 181 | Ret = '_UNKNOWN' 182 | Args = ','.join([Ret] * argN) 183 | return (Ret, Args, argN) 184 | 185 | def fetch_x86(seg, fout): 186 | g_TotalFunc = 0 187 | func = get_next_func(seg.startEA) 188 | while func is not None and func.startEA < seg.endEA: 189 | funcEA = func.startEA 190 | INSTS = list(FuncItems(funcEA)) 191 | if len(INSTS) == 4 \ 192 | and "mov" == GetMnem(INSTS[0]) \ 193 | and "mov" == GetMnem(INSTS[1]) \ 194 | and "call" == GetMnem(INSTS[2]) \ 195 | and "retn" == GetMnem(INSTS[3]) : 196 | ID = GetOperandValue(INSTS[0], 1) 197 | 198 | Name = get_func_name(funcEA).split('@')[0] 199 | if '_' == Name[0]: 200 | Name = Name[1:] 201 | 202 | ArgN = get_frame_size(func) / 4 - 1 203 | 204 | Types = idc_get_type(funcEA) 205 | if Types: 206 | (Ret, Args, ArgN) = from_IDA_function_type(Types) 207 | else : 208 | (Ret, Args, ArgN) = from_h_function_type(Name, ArgN) 209 | 210 | print '/*0x%04x,%02d*/%s %s(%s);' % (ID, ArgN, Ret, Name, Args) 211 | fout.write('/*0x%04x,%02d*/%s %s(%s);\n' % (ID, ArgN, Ret, Name, Args)) 212 | 213 | g_TotalFunc += 1 214 | 215 | func = get_next_func(funcEA) 216 | 217 | return g_TotalFunc 218 | 219 | def fetch_x64(seg, fout): 220 | g_TotalFunc = 0 221 | func = get_next_func(seg.startEA) 222 | while func is not None and func.startEA < seg.endEA: 223 | funcEA = func.startEA 224 | 225 | INSTS = list(FuncItems(funcEA)) 226 | if len(INSTS) == 4 \ 227 | and "mov" == GetMnem(INSTS[0]) \ 228 | and "mov" == GetMnem(INSTS[1]) \ 229 | and "syscall" == GetMnem(INSTS[2]) \ 230 | and "retn" == GetMnem(INSTS[3]) : 231 | 232 | ID = GetOperandValue(INSTS[1], 1) 233 | Name = get_func_name(funcEA).split('@')[0] 234 | if '_' == Name[0]: 235 | Name = Name[1:] 236 | 237 | print "0x%04x, %s(0x%x)" % (ID, Name, funcEA) 238 | fout.write("0x%04x, %s\n" % (ID, Name)) 239 | 240 | g_TotalFunc += 1 241 | 242 | func = get_next_func(funcEA) 243 | 244 | return g_TotalFunc 245 | 246 | def main(): 247 | seg = get_segm_by_name(".text") 248 | if not seg: 249 | print "canot find CODE section." 250 | return 251 | 252 | if get_inf_structure().is_64bit(): 253 | arch = "_x64.txt" 254 | else: 255 | arch = "_x86.txt" 256 | 257 | current_path = os.path.join(os.path.dirname(os.path.realpath(__file__))) 258 | load_h_file(os.path.join(current_path, "H_APIs.h")) 259 | 260 | file_out = get_root_filename().split('.')[0] + arch 261 | f = open(os.path.join(current_path, file_out), "w") 262 | 263 | if get_inf_structure().is_64bit(): 264 | g_TotalFunc = fetch_x64(seg, f) 265 | else: 266 | g_TotalFunc = fetch_x86(seg, f) 267 | 268 | f.close() 269 | print "total:%d" % g_TotalFunc 270 | 271 | main() 272 | --------------------------------------------------------------------------------