├── Compiled ├── Composition │ ├── ARM64 │ │ ├── ntos │ │ │ ├── 22631.txt │ │ │ └── 26100.txt │ │ └── win32k │ │ │ ├── 22631.txt │ │ │ └── 26100.txt │ ├── X86_64 │ │ ├── NT10 │ │ │ ├── ium │ │ │ │ ├── 19045.txt │ │ │ │ ├── 25276.txt │ │ │ │ └── 27823.txt │ │ │ ├── ntos │ │ │ │ ├── 10061.txt │ │ │ │ ├── 10240.txt │ │ │ │ ├── 10586.txt │ │ │ │ ├── 14393.txt │ │ │ │ ├── 15063.txt │ │ │ │ ├── 16299.txt │ │ │ │ ├── 17134.txt │ │ │ │ ├── 17763.txt │ │ │ │ ├── 18362.txt │ │ │ │ ├── 18363.txt │ │ │ │ ├── 19041.txt │ │ │ │ ├── 19044.txt │ │ │ │ ├── 20348.txt │ │ │ │ ├── 22000.txt │ │ │ │ ├── 22621.txt │ │ │ │ ├── 22631.txt │ │ │ │ ├── 26120.txt │ │ │ │ ├── 27686.txt │ │ │ │ ├── 27695.txt │ │ │ │ ├── 27723.txt │ │ │ │ ├── 27729.txt │ │ │ │ ├── 27783.txt │ │ │ │ ├── 27823.txt │ │ │ │ └── 27842.txt │ │ │ ├── readme1st.txt │ │ │ └── win32k │ │ │ │ ├── 10240.txt │ │ │ │ ├── 10586.txt │ │ │ │ ├── 14393.txt │ │ │ │ ├── 15063.txt │ │ │ │ ├── 16299.txt │ │ │ │ ├── 17134.txt │ │ │ │ ├── 17763.txt │ │ │ │ ├── 18362.txt │ │ │ │ ├── 18363.txt │ │ │ │ ├── 19041.txt │ │ │ │ ├── 19044.txt │ │ │ │ ├── 20348.txt │ │ │ │ ├── 22000.txt │ │ │ │ ├── 22621.txt │ │ │ │ ├── 22631.txt │ │ │ │ ├── 26120.txt │ │ │ │ ├── 27686.txt │ │ │ │ ├── 27695.txt │ │ │ │ ├── 27723.txt │ │ │ │ ├── 27729.txt │ │ │ │ ├── 27783.txt │ │ │ │ ├── 27823.txt │ │ │ │ └── 27842.txt │ │ └── NT6 │ │ │ ├── ntos │ │ │ ├── 3790.txt │ │ │ ├── 6000.txt │ │ │ ├── 6002.txt │ │ │ ├── 7601.txt │ │ │ ├── 9200.txt │ │ │ └── 9600.txt │ │ │ ├── readme1st.txt │ │ │ ├── syscalls.md │ │ │ ├── w32ksyscalls.md │ │ │ └── win32k │ │ │ ├── 6000.txt │ │ │ ├── 7601.txt │ │ │ ├── 9200.txt │ │ │ └── 9600.txt │ ├── sstc.exe │ └── sstc.exe.config ├── generate.cmd ├── scg32.exe └── scg64.exe ├── LICENSE.md ├── README.md └── Source ├── scg ├── main.c ├── minirtl │ ├── _strcmpi.c │ ├── cmdline.c │ ├── cmdline.h │ ├── minirtl.h │ └── rtltypes.h ├── res.rc ├── resource.h ├── scg.sln ├── scg.vcxproj ├── scg.vcxproj.filters ├── scg.vcxproj.user └── zydis │ ├── Zydis.c │ └── Zydis.h └── sstComposer ├── App.config ├── Program.cs ├── Properties └── AssemblyInfo.cs ├── sstc.csproj ├── sstc.csproj.user └── sstc.sln /Compiled/Composition/X86_64/NT10/ium/19045.txt: -------------------------------------------------------------------------------- 1 | IumAssignMemoryToSocDomain 134217728 2 | IumAwaitSmc 134217729 3 | IumCreateSecureDevice 134217730 4 | IumCreateSecureSection 134217731 5 | IumCreateSecureSectionSpecifyPages 134217732 6 | IumCrypto 134217733 7 | IumDmaMapMemory 134217734 8 | IumEmitSmc 134217735 9 | IumFlushSecureSectionBuffers 134217736 10 | IumGetDmaEnabler 134217737 11 | IumGetExposedSecureSection 134217738 12 | IumGetIdk 134217739 13 | IumMapSecureIo 134217740 14 | IumOpenCurrentExtension 134217741 15 | IumOpenSecureSection 134217742 16 | IumPostMailbox 134217743 17 | IumProtectSecureIo 134217744 18 | IumQuerySecureDeviceInformation 134217745 19 | IumSecureStorageGet 134217746 20 | IumSecureStoragePut 134217747 21 | IumSetDmaTargetProperties 134217748 22 | IumSetPolicyExtension 134217749 23 | IumUnmapSecureIo 134217750 24 | IumUpdateSecureDeviceState 134217751 25 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ium/25276.txt: -------------------------------------------------------------------------------- 1 | IumAssignMemoryToSocDomain 134217728 2 | IumAwaitSmc 134217729 3 | IumCreateSecureDevice 134217730 4 | IumCreateSecureSection 134217731 5 | IumCreateSecureSectionSpecifyPages 134217732 6 | IumCrypto 134217733 7 | IumDmaMapMemory 134217734 8 | IumEmitSmc 134217735 9 | IumFlushSecureSectionBuffers 134217736 10 | IumGetDmaEnabler 134217737 11 | IumGetExposedSecureSection 134217738 12 | IumGetIdk 134217739 13 | IumMapSecureIo 134217740 14 | IumOpenCurrentExtension 134217741 15 | IumOpenSecureSection 134217742 16 | IumPostMailbox 134217743 17 | IumProtectSecureIo 134217744 18 | IumQuerySecureDeviceInformation 134217745 19 | IumSecureStorageGet 134217746 20 | IumSecureStoragePut 134217747 21 | IumSetDmaTargetProperties 134217748 22 | IumSetPolicyExtension 134217749 23 | IumUnmapSecureIo 134217750 24 | IumUpdateSecureDeviceState 134217751 25 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ium/27823.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/ium/27823.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/10061.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAddAtom 71 10 | NtAddAtomEx 103 11 | NtAddBootEntry 104 12 | NtAddDriverEntry 105 13 | NtAdjustGroupsToken 106 14 | NtAdjustPrivilegesToken 65 15 | NtAdjustTokenClaimsAndDeviceGroups 107 16 | NtAlertResumeThread 108 17 | NtAlertThread 109 18 | NtAlertThreadByThreadId 110 19 | NtAllocateLocallyUniqueId 111 20 | NtAllocateReserveObject 112 21 | NtAllocateUserPhysicalPages 113 22 | NtAllocateUuids 114 23 | NtAllocateVirtualMemory 24 24 | NtAlpcAcceptConnectPort 115 25 | NtAlpcCancelMessage 116 26 | NtAlpcConnectPort 117 27 | NtAlpcConnectPortEx 118 28 | NtAlpcCreatePort 119 29 | NtAlpcCreatePortSection 120 30 | NtAlpcCreateResourceReserve 121 31 | NtAlpcCreateSectionView 122 32 | NtAlpcCreateSecurityContext 123 33 | NtAlpcDeletePortSection 124 34 | NtAlpcDeleteResourceReserve 125 35 | NtAlpcDeleteSectionView 126 36 | NtAlpcDeleteSecurityContext 127 37 | NtAlpcDisconnectPort 128 38 | NtAlpcImpersonateClientContainerOfPort 129 39 | NtAlpcImpersonateClientOfPort 130 40 | NtAlpcOpenSenderProcess 131 41 | NtAlpcOpenSenderThread 132 42 | NtAlpcQueryInformation 133 43 | NtAlpcQueryInformationMessage 134 44 | NtAlpcRevokeSecurityContext 135 45 | NtAlpcSendWaitReceivePort 136 46 | NtAlpcSetInformation 137 47 | NtApphelpCacheControl 76 48 | NtAreMappedFilesTheSame 138 49 | NtAssignProcessToJobObject 139 50 | NtAssignProcessToSiloObject 140 51 | NtAssociateWaitCompletionPacket 141 52 | NtCallbackReturn 5 53 | NtCancelIoFile 93 54 | NtCancelIoFileEx 142 55 | NtCancelSynchronousIoFile 143 56 | NtCancelTimer 97 57 | NtCancelTimer2 144 58 | NtCancelWaitCompletionPacket 145 59 | NtClearEvent 62 60 | NtClose 15 61 | NtCloseObjectAuditAlarm 59 62 | NtCommitComplete 146 63 | NtCommitEnlistment 147 64 | NtCommitTransaction 148 65 | NtCompactKeys 149 66 | NtCompareObjects 150 67 | NtCompareTokens 151 68 | NtCompleteConnectPort 152 69 | NtCompressKey 153 70 | NtConnectPort 154 71 | NtContinue 67 72 | NtCreateDebugObject 155 73 | NtCreateDirectoryObject 156 74 | NtCreateDirectoryObjectEx 157 75 | NtCreateEnlistment 158 76 | NtCreateEvent 72 77 | NtCreateEventPair 159 78 | NtCreateFile 85 79 | NtCreateIRTimer 160 80 | NtCreateIoCompletion 161 81 | NtCreateJobObject 162 82 | NtCreateJobSet 163 83 | NtCreateKey 29 84 | NtCreateKeyTransacted 164 85 | NtCreateKeyedEvent 165 86 | NtCreateLowBoxToken 166 87 | NtCreateMailslotFile 167 88 | NtCreateMutant 168 89 | NtCreateNamedPipeFile 169 90 | NtCreatePagingFile 170 91 | NtCreatePartition 171 92 | NtCreatePort 172 93 | NtCreatePrivateNamespace 173 94 | NtCreateProcess 174 95 | NtCreateProcessEx 77 96 | NtCreateProfile 175 97 | NtCreateProfileEx 176 98 | NtCreateResourceManager 177 99 | NtCreateSection 74 100 | NtCreateSemaphore 178 101 | NtCreateSiloObject 179 102 | NtCreateSymbolicLinkObject 180 103 | NtCreateThread 78 104 | NtCreateThreadEx 181 105 | NtCreateTimer 182 106 | NtCreateTimer2 183 107 | NtCreateToken 184 108 | NtCreateTokenEx 185 109 | NtCreateTransaction 186 110 | NtCreateTransactionManager 187 111 | NtCreateUserProcess 188 112 | NtCreateWaitCompletionPacket 189 113 | NtCreateWaitablePort 190 114 | NtCreateWnfStateName 191 115 | NtCreateWorkerFactory 192 116 | NtDebugActiveProcess 193 117 | NtDebugContinue 194 118 | NtDelayExecution 52 119 | NtDeleteAtom 195 120 | NtDeleteBootEntry 196 121 | NtDeleteDriverEntry 197 122 | NtDeleteFile 198 123 | NtDeleteKey 199 124 | NtDeleteObjectAuditAlarm 200 125 | NtDeletePrivateNamespace 201 126 | NtDeleteValueKey 202 127 | NtDeleteWnfStateData 203 128 | NtDeleteWnfStateName 204 129 | NtDeviceIoControlFile 7 130 | NtDisableLastKnownGood 205 131 | NtDisplayString 206 132 | NtDrawText 207 133 | NtDuplicateObject 60 134 | NtDuplicateToken 66 135 | NtEnableLastKnownGood 208 136 | NtEnumerateBootEntries 209 137 | NtEnumerateDriverEntries 210 138 | NtEnumerateKey 50 139 | NtEnumerateSystemEnvironmentValuesEx 211 140 | NtEnumerateTransactionObject 212 141 | NtEnumerateValueKey 19 142 | NtExtendSection 213 143 | NtFilterBootOption 214 144 | NtFilterToken 215 145 | NtFilterTokenEx 216 146 | NtFindAtom 20 147 | NtFlushBuffersFile 75 148 | NtFlushBuffersFileEx 217 149 | NtFlushInstallUILanguage 218 150 | NtFlushInstructionCache 219 151 | NtFlushKey 220 152 | NtFlushProcessWriteBuffers 221 153 | NtFlushVirtualMemory 222 154 | NtFlushWriteBuffer 223 155 | NtFreeUserPhysicalPages 224 156 | NtFreeVirtualMemory 30 157 | NtFreezeRegistry 225 158 | NtFreezeTransactions 226 159 | NtFsControlFile 57 160 | NtGetCachedSigningLevel 227 161 | NtGetCompleteWnfStateSubscription 228 162 | NtGetContextThread 229 163 | NtGetCurrentProcessorNumber 230 164 | NtGetCurrentProcessorNumberEx 231 165 | NtGetDevicePowerState 232 166 | NtGetMUIRegistryInfo 233 167 | NtGetNextProcess 234 168 | NtGetNextThread 235 169 | NtGetNlsSectionPtr 236 170 | NtGetNotificationResourceManager 237 171 | NtGetWriteWatch 238 172 | NtImpersonateAnonymousToken 239 173 | NtImpersonateClientOfPort 31 174 | NtImpersonateThread 240 175 | NtInitializeNlsFiles 241 176 | NtInitializeRegistry 242 177 | NtInitiatePowerAction 243 178 | NtIsProcessInJob 79 179 | NtIsSystemResumeAutomatic 244 180 | NtIsUILanguageComitted 245 181 | NtListenPort 246 182 | NtLoadDriver 247 183 | NtLoadKey 248 184 | NtLoadKey2 249 185 | NtLoadKeyEx 250 186 | NtLockFile 251 187 | NtLockProductActivationKeys 252 188 | NtLockRegistryKey 253 189 | NtLockVirtualMemory 254 190 | NtMakePermanentObject 255 191 | NtMakeTemporaryObject 256 192 | NtManagePartition 257 193 | NtMapCMFModule 258 194 | NtMapUserPhysicalPages 259 195 | NtMapUserPhysicalPagesScatter 3 196 | NtMapViewOfSection 40 197 | NtModifyBootEntry 260 198 | NtModifyDriverEntry 261 199 | NtNotifyChangeDirectoryFile 262 200 | NtNotifyChangeKey 263 201 | NtNotifyChangeMultipleKeys 264 202 | NtNotifyChangeSession 265 203 | NtOpenDirectoryObject 88 204 | NtOpenEnlistment 266 205 | NtOpenEvent 64 206 | NtOpenEventPair 267 207 | NtOpenFile 51 208 | NtOpenIoCompletion 268 209 | NtOpenJobObject 269 210 | NtOpenKey 18 211 | NtOpenKeyEx 270 212 | NtOpenKeyTransacted 271 213 | NtOpenKeyTransactedEx 272 214 | NtOpenKeyedEvent 273 215 | NtOpenMutant 274 216 | NtOpenObjectAuditAlarm 275 217 | NtOpenPartition 276 218 | NtOpenPrivateNamespace 277 219 | NtOpenProcess 38 220 | NtOpenProcessToken 278 221 | NtOpenProcessTokenEx 48 222 | NtOpenResourceManager 279 223 | NtOpenSection 55 224 | NtOpenSemaphore 280 225 | NtOpenSession 281 226 | NtOpenSiloObject 282 227 | NtOpenSymbolicLinkObject 283 228 | NtOpenThread 284 229 | NtOpenThreadToken 36 230 | NtOpenThreadTokenEx 47 231 | NtOpenTimer 285 232 | NtOpenTransaction 286 233 | NtOpenTransactionManager 287 234 | NtPlugPlayControl 288 235 | NtPowerInformation 95 236 | NtPrePrepareComplete 289 237 | NtPrePrepareEnlistment 290 238 | NtPrepareComplete 291 239 | NtPrepareEnlistment 292 240 | NtPrivilegeCheck 293 241 | NtPrivilegeObjectAuditAlarm 294 242 | NtPrivilegedServiceAuditAlarm 295 243 | NtPropagationComplete 296 244 | NtPropagationFailed 297 245 | NtProtectVirtualMemory 80 246 | NtPulseEvent 298 247 | NtQueryAttributesFile 61 248 | NtQueryBootEntryOrder 299 249 | NtQueryBootOptions 300 250 | NtQueryDebugFilterState 301 251 | NtQueryDefaultLocale 21 252 | NtQueryDefaultUILanguage 68 253 | NtQueryDirectoryFile 53 254 | NtQueryDirectoryObject 302 255 | NtQueryDriverEntryOrder 303 256 | NtQueryEaFile 304 257 | NtQueryEvent 86 258 | NtQueryFullAttributesFile 305 259 | NtQueryInformationAtom 306 260 | NtQueryInformationEnlistment 307 261 | NtQueryInformationFile 17 262 | NtQueryInformationJobObject 308 263 | NtQueryInformationPort 309 264 | NtQueryInformationProcess 25 265 | NtQueryInformationResourceManager 310 266 | NtQueryInformationSiloObject 311 267 | NtQueryInformationThread 37 268 | NtQueryInformationToken 33 269 | NtQueryInformationTransaction 312 270 | NtQueryInformationTransactionManager 313 271 | NtQueryInformationWorkerFactory 314 272 | NtQueryInstallUILanguage 315 273 | NtQueryIntervalProfile 316 274 | NtQueryIoCompletion 317 275 | NtQueryKey 22 276 | NtQueryLicenseValue 318 277 | NtQueryMultipleValueKey 319 278 | NtQueryMutant 320 279 | NtQueryObject 16 280 | NtQueryOpenSubKeys 321 281 | NtQueryOpenSubKeysEx 322 282 | NtQueryPerformanceCounter 49 283 | NtQueryPortInformationProcess 323 284 | NtQueryQuotaInformationFile 324 285 | NtQuerySection 81 286 | NtQuerySecurityAttributesToken 325 287 | NtQuerySecurityObject 326 288 | NtQuerySemaphore 327 289 | NtQuerySymbolicLinkObject 328 290 | NtQuerySystemEnvironmentValue 329 291 | NtQuerySystemEnvironmentValueEx 330 292 | NtQuerySystemInformation 54 293 | NtQuerySystemInformationEx 331 294 | NtQueryTimer 56 295 | NtQueryTimerResolution 332 296 | NtQueryValueKey 23 297 | NtQueryVirtualMemory 35 298 | NtQueryVolumeInformationFile 73 299 | NtQueryWnfStateData 333 300 | NtQueryWnfStateNameInformation 334 301 | NtQueueApcThread 69 302 | NtQueueApcThreadEx 335 303 | NtRaiseException 336 304 | NtRaiseHardError 337 305 | NtReadFile 6 306 | NtReadFileScatter 46 307 | NtReadOnlyEnlistment 338 308 | NtReadRequestData 84 309 | NtReadVirtualMemory 63 310 | NtRecoverEnlistment 339 311 | NtRecoverResourceManager 340 312 | NtRecoverTransactionManager 341 313 | NtRegisterProtocolAddressInformation 342 314 | NtRegisterThreadTerminatePort 343 315 | NtReleaseKeyedEvent 344 316 | NtReleaseMutant 32 317 | NtReleaseSemaphore 10 318 | NtReleaseWorkerFactoryWorker 345 319 | NtRemoveIoCompletion 9 320 | NtRemoveIoCompletionEx 346 321 | NtRemoveProcessDebug 347 322 | NtRenameKey 348 323 | NtRenameTransactionManager 349 324 | NtReplaceKey 350 325 | NtReplacePartitionUnit 351 326 | NtReplyPort 12 327 | NtReplyWaitReceivePort 11 328 | NtReplyWaitReceivePortEx 43 329 | NtReplyWaitReplyPort 352 330 | NtRequestPort 353 331 | NtRequestWaitReplyPort 34 332 | NtResetEvent 354 333 | NtResetWriteWatch 355 334 | NtRestoreKey 356 335 | NtResumeProcess 357 336 | NtResumeThread 82 337 | NtRevertContainerImpersonation 358 338 | NtRollbackComplete 359 339 | NtRollbackEnlistment 360 340 | NtRollbackTransaction 361 341 | NtRollforwardTransactionManager 362 342 | NtSaveKey 363 343 | NtSaveKeyEx 364 344 | NtSaveMergedKeys 365 345 | NtSecureConnectPort 366 346 | NtSerializeBoot 367 347 | NtSetBootEntryOrder 368 348 | NtSetBootOptions 369 349 | NtSetCachedSigningLevel 370 350 | NtSetContextThread 371 351 | NtSetDebugFilterState 372 352 | NtSetDefaultHardErrorPort 373 353 | NtSetDefaultLocale 374 354 | NtSetDefaultUILanguage 375 355 | NtSetDriverEntryOrder 376 356 | NtSetEaFile 377 357 | NtSetEvent 14 358 | NtSetEventBoostPriority 45 359 | NtSetHighEventPair 378 360 | NtSetHighWaitLowEventPair 379 361 | NtSetIRTimer 380 362 | NtSetInformationDebugObject 381 363 | NtSetInformationEnlistment 382 364 | NtSetInformationFile 39 365 | NtSetInformationJobObject 383 366 | NtSetInformationKey 384 367 | NtSetInformationObject 92 368 | NtSetInformationProcess 28 369 | NtSetInformationResourceManager 385 370 | NtSetInformationSiloObject 386 371 | NtSetInformationThread 13 372 | NtSetInformationToken 387 373 | NtSetInformationTransaction 388 374 | NtSetInformationTransactionManager 389 375 | NtSetInformationVirtualMemory 390 376 | NtSetInformationWorkerFactory 391 377 | NtSetIntervalProfile 392 378 | NtSetIoCompletion 393 379 | NtSetIoCompletionEx 394 380 | NtSetLdtEntries 395 381 | NtSetLowEventPair 396 382 | NtSetLowWaitHighEventPair 397 383 | NtSetQuotaInformationFile 398 384 | NtSetSecurityObject 399 385 | NtSetSystemEnvironmentValue 400 386 | NtSetSystemEnvironmentValueEx 401 387 | NtSetSystemInformation 402 388 | NtSetSystemPowerState 403 389 | NtSetSystemTime 404 390 | NtSetThreadExecutionState 405 391 | NtSetTimer 98 392 | NtSetTimer2 406 393 | NtSetTimerEx 407 394 | NtSetTimerResolution 408 395 | NtSetUuidSeed 409 396 | NtSetValueKey 96 397 | NtSetVolumeInformationFile 410 398 | NtSetWnfProcessNotificationEvent 411 399 | NtShutdownSystem 412 400 | NtShutdownWorkerFactory 413 401 | NtSignalAndWaitForSingleObject 414 402 | NtSinglePhaseReject 415 403 | NtStartProfile 416 404 | NtStopProfile 417 405 | NtSubscribeWnfStateChange 418 406 | NtSuspendProcess 419 407 | NtSuspendThread 420 408 | NtSystemDebugControl 421 409 | NtTerminateJobObject 422 410 | NtTerminateProcess 44 411 | NtTerminateSiloObject 423 412 | NtTerminateThread 83 413 | NtTestAlert 424 414 | NtThawRegistry 425 415 | NtThawTransactions 426 416 | NtTraceControl 427 417 | NtTraceEvent 94 418 | NtTranslateFilePath 428 419 | NtUmsThreadYield 429 420 | NtUnloadDriver 430 421 | NtUnloadKey 431 422 | NtUnloadKey2 432 423 | NtUnloadKeyEx 433 424 | NtUnlockFile 434 425 | NtUnlockVirtualMemory 435 426 | NtUnmapViewOfSection 42 427 | NtUnmapViewOfSectionEx 436 428 | NtUnsubscribeWnfStateChange 437 429 | NtUpdateWnfStateData 438 430 | NtVdmControl 439 431 | NtWaitForAlertByThreadId 440 432 | NtWaitForDebugEvent 441 433 | NtWaitForKeyedEvent 442 434 | NtWaitForMultipleObjects 91 435 | NtWaitForMultipleObjects32 26 436 | NtWaitForSingleObject 4 437 | NtWaitForWorkViaWorkerFactory 443 438 | NtWaitHighEventPair 444 439 | NtWaitLowEventPair 445 440 | NtWorkerFactoryWorkerReady 1 441 | NtWriteFile 8 442 | NtWriteFileGather 27 443 | NtWriteRequestData 87 444 | NtWriteVirtualMemory 58 445 | NtYieldExecution 70 446 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/10240.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAddAtom 71 10 | NtAddAtomEx 103 11 | NtAddBootEntry 104 12 | NtAddDriverEntry 105 13 | NtAdjustGroupsToken 106 14 | NtAdjustPrivilegesToken 65 15 | NtAdjustTokenClaimsAndDeviceGroups 107 16 | NtAlertResumeThread 108 17 | NtAlertThread 109 18 | NtAlertThreadByThreadId 110 19 | NtAllocateLocallyUniqueId 111 20 | NtAllocateReserveObject 112 21 | NtAllocateUserPhysicalPages 113 22 | NtAllocateUuids 114 23 | NtAllocateVirtualMemory 24 24 | NtAlpcAcceptConnectPort 115 25 | NtAlpcCancelMessage 116 26 | NtAlpcConnectPort 117 27 | NtAlpcConnectPortEx 118 28 | NtAlpcCreatePort 119 29 | NtAlpcCreatePortSection 120 30 | NtAlpcCreateResourceReserve 121 31 | NtAlpcCreateSectionView 122 32 | NtAlpcCreateSecurityContext 123 33 | NtAlpcDeletePortSection 124 34 | NtAlpcDeleteResourceReserve 125 35 | NtAlpcDeleteSectionView 126 36 | NtAlpcDeleteSecurityContext 127 37 | NtAlpcDisconnectPort 128 38 | NtAlpcImpersonateClientContainerOfPort 129 39 | NtAlpcImpersonateClientOfPort 130 40 | NtAlpcOpenSenderProcess 131 41 | NtAlpcOpenSenderThread 132 42 | NtAlpcQueryInformation 133 43 | NtAlpcQueryInformationMessage 134 44 | NtAlpcRevokeSecurityContext 135 45 | NtAlpcSendWaitReceivePort 136 46 | NtAlpcSetInformation 137 47 | NtApphelpCacheControl 76 48 | NtAreMappedFilesTheSame 138 49 | NtAssignProcessToJobObject 139 50 | NtAssociateWaitCompletionPacket 140 51 | NtCallbackReturn 5 52 | NtCancelIoFile 93 53 | NtCancelIoFileEx 141 54 | NtCancelSynchronousIoFile 142 55 | NtCancelTimer 97 56 | NtCancelTimer2 143 57 | NtCancelWaitCompletionPacket 144 58 | NtClearEvent 62 59 | NtClose 15 60 | NtCloseObjectAuditAlarm 59 61 | NtCommitComplete 145 62 | NtCommitEnlistment 146 63 | NtCommitTransaction 147 64 | NtCompactKeys 148 65 | NtCompareObjects 149 66 | NtCompareTokens 150 67 | NtCompleteConnectPort 151 68 | NtCompressKey 152 69 | NtConnectPort 153 70 | NtContinue 67 71 | NtCreateDebugObject 154 72 | NtCreateDirectoryObject 155 73 | NtCreateDirectoryObjectEx 156 74 | NtCreateEnlistment 157 75 | NtCreateEvent 72 76 | NtCreateEventPair 158 77 | NtCreateFile 85 78 | NtCreateIoCompletion 160 79 | NtCreateIRTimer 159 80 | NtCreateJobObject 161 81 | NtCreateJobSet 162 82 | NtCreateKey 29 83 | NtCreateKeyedEvent 164 84 | NtCreateKeyTransacted 163 85 | NtCreateLowBoxToken 165 86 | NtCreateMailslotFile 166 87 | NtCreateMutant 167 88 | NtCreateNamedPipeFile 168 89 | NtCreatePagingFile 169 90 | NtCreatePartition 170 91 | NtCreatePort 171 92 | NtCreatePrivateNamespace 172 93 | NtCreateProcess 173 94 | NtCreateProcessEx 77 95 | NtCreateProfile 174 96 | NtCreateProfileEx 175 97 | NtCreateResourceManager 176 98 | NtCreateSection 74 99 | NtCreateSemaphore 177 100 | NtCreateSymbolicLinkObject 178 101 | NtCreateThread 78 102 | NtCreateThreadEx 179 103 | NtCreateTimer 180 104 | NtCreateTimer2 181 105 | NtCreateToken 182 106 | NtCreateTokenEx 183 107 | NtCreateTransaction 184 108 | NtCreateTransactionManager 185 109 | NtCreateUserProcess 186 110 | NtCreateWaitablePort 188 111 | NtCreateWaitCompletionPacket 187 112 | NtCreateWnfStateName 189 113 | NtCreateWorkerFactory 190 114 | NtDebugActiveProcess 191 115 | NtDebugContinue 192 116 | NtDelayExecution 52 117 | NtDeleteAtom 193 118 | NtDeleteBootEntry 194 119 | NtDeleteDriverEntry 195 120 | NtDeleteFile 196 121 | NtDeleteKey 197 122 | NtDeleteObjectAuditAlarm 198 123 | NtDeletePrivateNamespace 199 124 | NtDeleteValueKey 200 125 | NtDeleteWnfStateData 201 126 | NtDeleteWnfStateName 202 127 | NtDeviceIoControlFile 7 128 | NtDisableLastKnownGood 203 129 | NtDisplayString 204 130 | NtDrawText 205 131 | NtDuplicateObject 60 132 | NtDuplicateToken 66 133 | NtEnableLastKnownGood 206 134 | NtEnumerateBootEntries 207 135 | NtEnumerateDriverEntries 208 136 | NtEnumerateKey 50 137 | NtEnumerateSystemEnvironmentValuesEx 209 138 | NtEnumerateTransactionObject 210 139 | NtEnumerateValueKey 19 140 | NtExtendSection 211 141 | NtFilterBootOption 212 142 | NtFilterToken 213 143 | NtFilterTokenEx 214 144 | NtFindAtom 20 145 | NtFlushBuffersFile 75 146 | NtFlushBuffersFileEx 215 147 | NtFlushInstallUILanguage 216 148 | NtFlushInstructionCache 217 149 | NtFlushKey 218 150 | NtFlushProcessWriteBuffers 219 151 | NtFlushVirtualMemory 220 152 | NtFlushWriteBuffer 221 153 | NtFreeUserPhysicalPages 222 154 | NtFreeVirtualMemory 30 155 | NtFreezeRegistry 223 156 | NtFreezeTransactions 224 157 | NtFsControlFile 57 158 | NtGetCachedSigningLevel 225 159 | NtGetCompleteWnfStateSubscription 226 160 | NtGetContextThread 227 161 | NtGetCurrentProcessorNumber 228 162 | NtGetCurrentProcessorNumberEx 229 163 | NtGetDevicePowerState 230 164 | NtGetMUIRegistryInfo 231 165 | NtGetNextProcess 232 166 | NtGetNextThread 233 167 | NtGetNlsSectionPtr 234 168 | NtGetNotificationResourceManager 235 169 | NtGetWriteWatch 236 170 | NtImpersonateAnonymousToken 237 171 | NtImpersonateClientOfPort 31 172 | NtImpersonateThread 238 173 | NtInitializeNlsFiles 239 174 | NtInitializeRegistry 240 175 | NtInitiatePowerAction 241 176 | NtIsProcessInJob 79 177 | NtIsSystemResumeAutomatic 242 178 | NtIsUILanguageComitted 243 179 | NtListenPort 244 180 | NtLoadDriver 245 181 | NtLoadKey 246 182 | NtLoadKey2 247 183 | NtLoadKeyEx 248 184 | NtLockFile 249 185 | NtLockProductActivationKeys 250 186 | NtLockRegistryKey 251 187 | NtLockVirtualMemory 252 188 | NtMakePermanentObject 253 189 | NtMakeTemporaryObject 254 190 | NtManagePartition 255 191 | NtMapCMFModule 256 192 | NtMapUserPhysicalPages 257 193 | NtMapUserPhysicalPagesScatter 3 194 | NtMapViewOfSection 40 195 | NtModifyBootEntry 258 196 | NtModifyDriverEntry 259 197 | NtNotifyChangeDirectoryFile 260 198 | NtNotifyChangeKey 261 199 | NtNotifyChangeMultipleKeys 262 200 | NtNotifyChangeSession 263 201 | NtOpenDirectoryObject 88 202 | NtOpenEnlistment 264 203 | NtOpenEvent 64 204 | NtOpenEventPair 265 205 | NtOpenFile 51 206 | NtOpenIoCompletion 266 207 | NtOpenJobObject 267 208 | NtOpenKey 18 209 | NtOpenKeyedEvent 271 210 | NtOpenKeyEx 268 211 | NtOpenKeyTransacted 269 212 | NtOpenKeyTransactedEx 270 213 | NtOpenMutant 272 214 | NtOpenObjectAuditAlarm 273 215 | NtOpenPartition 274 216 | NtOpenPrivateNamespace 275 217 | NtOpenProcess 38 218 | NtOpenProcessToken 276 219 | NtOpenProcessTokenEx 48 220 | NtOpenResourceManager 277 221 | NtOpenSection 55 222 | NtOpenSemaphore 278 223 | NtOpenSession 279 224 | NtOpenSymbolicLinkObject 280 225 | NtOpenThread 281 226 | NtOpenThreadToken 36 227 | NtOpenThreadTokenEx 47 228 | NtOpenTimer 282 229 | NtOpenTransaction 283 230 | NtOpenTransactionManager 284 231 | NtPlugPlayControl 285 232 | NtPowerInformation 95 233 | NtPrepareComplete 288 234 | NtPrepareEnlistment 289 235 | NtPrePrepareComplete 286 236 | NtPrePrepareEnlistment 287 237 | NtPrivilegeCheck 290 238 | NtPrivilegedServiceAuditAlarm 292 239 | NtPrivilegeObjectAuditAlarm 291 240 | NtPropagationComplete 293 241 | NtPropagationFailed 294 242 | NtProtectVirtualMemory 80 243 | NtPulseEvent 295 244 | NtQueryAttributesFile 61 245 | NtQueryBootEntryOrder 296 246 | NtQueryBootOptions 297 247 | NtQueryDebugFilterState 298 248 | NtQueryDefaultLocale 21 249 | NtQueryDefaultUILanguage 68 250 | NtQueryDirectoryFile 53 251 | NtQueryDirectoryObject 299 252 | NtQueryDriverEntryOrder 300 253 | NtQueryEaFile 301 254 | NtQueryEvent 86 255 | NtQueryFullAttributesFile 302 256 | NtQueryInformationAtom 303 257 | NtQueryInformationEnlistment 304 258 | NtQueryInformationFile 17 259 | NtQueryInformationJobObject 305 260 | NtQueryInformationPort 306 261 | NtQueryInformationProcess 25 262 | NtQueryInformationResourceManager 307 263 | NtQueryInformationThread 37 264 | NtQueryInformationToken 33 265 | NtQueryInformationTransaction 308 266 | NtQueryInformationTransactionManager 309 267 | NtQueryInformationWorkerFactory 310 268 | NtQueryInstallUILanguage 311 269 | NtQueryIntervalProfile 312 270 | NtQueryIoCompletion 313 271 | NtQueryKey 22 272 | NtQueryLicenseValue 314 273 | NtQueryMultipleValueKey 315 274 | NtQueryMutant 316 275 | NtQueryObject 16 276 | NtQueryOpenSubKeys 317 277 | NtQueryOpenSubKeysEx 318 278 | NtQueryPerformanceCounter 49 279 | NtQueryPortInformationProcess 319 280 | NtQueryQuotaInformationFile 320 281 | NtQuerySection 81 282 | NtQuerySecurityAttributesToken 321 283 | NtQuerySecurityObject 322 284 | NtQuerySemaphore 323 285 | NtQuerySymbolicLinkObject 324 286 | NtQuerySystemEnvironmentValue 325 287 | NtQuerySystemEnvironmentValueEx 326 288 | NtQuerySystemInformation 54 289 | NtQuerySystemInformationEx 327 290 | NtQueryTimer 56 291 | NtQueryTimerResolution 328 292 | NtQueryValueKey 23 293 | NtQueryVirtualMemory 35 294 | NtQueryVolumeInformationFile 73 295 | NtQueryWnfStateData 329 296 | NtQueryWnfStateNameInformation 330 297 | NtQueueApcThread 69 298 | NtQueueApcThreadEx 331 299 | NtRaiseException 332 300 | NtRaiseHardError 333 301 | NtReadFile 6 302 | NtReadFileScatter 46 303 | NtReadOnlyEnlistment 334 304 | NtReadRequestData 84 305 | NtReadVirtualMemory 63 306 | NtRecoverEnlistment 335 307 | NtRecoverResourceManager 336 308 | NtRecoverTransactionManager 337 309 | NtRegisterProtocolAddressInformation 338 310 | NtRegisterThreadTerminatePort 339 311 | NtReleaseKeyedEvent 340 312 | NtReleaseMutant 32 313 | NtReleaseSemaphore 10 314 | NtReleaseWorkerFactoryWorker 341 315 | NtRemoveIoCompletion 9 316 | NtRemoveIoCompletionEx 342 317 | NtRemoveProcessDebug 343 318 | NtRenameKey 344 319 | NtRenameTransactionManager 345 320 | NtReplaceKey 346 321 | NtReplacePartitionUnit 347 322 | NtReplyPort 12 323 | NtReplyWaitReceivePort 11 324 | NtReplyWaitReceivePortEx 43 325 | NtReplyWaitReplyPort 348 326 | NtRequestPort 349 327 | NtRequestWaitReplyPort 34 328 | NtResetEvent 350 329 | NtResetWriteWatch 351 330 | NtRestoreKey 352 331 | NtResumeProcess 353 332 | NtResumeThread 82 333 | NtRevertContainerImpersonation 354 334 | NtRollbackComplete 355 335 | NtRollbackEnlistment 356 336 | NtRollbackTransaction 357 337 | NtRollforwardTransactionManager 358 338 | NtSaveKey 359 339 | NtSaveKeyEx 360 340 | NtSaveMergedKeys 361 341 | NtSecureConnectPort 362 342 | NtSerializeBoot 363 343 | NtSetBootEntryOrder 364 344 | NtSetBootOptions 365 345 | NtSetCachedSigningLevel 366 346 | NtSetContextThread 367 347 | NtSetDebugFilterState 368 348 | NtSetDefaultHardErrorPort 369 349 | NtSetDefaultLocale 370 350 | NtSetDefaultUILanguage 371 351 | NtSetDriverEntryOrder 372 352 | NtSetEaFile 373 353 | NtSetEvent 14 354 | NtSetEventBoostPriority 45 355 | NtSetHighEventPair 374 356 | NtSetHighWaitLowEventPair 375 357 | NtSetInformationDebugObject 377 358 | NtSetInformationEnlistment 378 359 | NtSetInformationFile 39 360 | NtSetInformationJobObject 379 361 | NtSetInformationKey 380 362 | NtSetInformationObject 92 363 | NtSetInformationProcess 28 364 | NtSetInformationResourceManager 381 365 | NtSetInformationSymbolicLink 382 366 | NtSetInformationThread 13 367 | NtSetInformationToken 383 368 | NtSetInformationTransaction 384 369 | NtSetInformationTransactionManager 385 370 | NtSetInformationVirtualMemory 386 371 | NtSetInformationWorkerFactory 387 372 | NtSetIntervalProfile 388 373 | NtSetIoCompletion 389 374 | NtSetIoCompletionEx 390 375 | NtSetIRTimer 376 376 | NtSetLdtEntries 391 377 | NtSetLowEventPair 392 378 | NtSetLowWaitHighEventPair 393 379 | NtSetQuotaInformationFile 394 380 | NtSetSecurityObject 395 381 | NtSetSystemEnvironmentValue 396 382 | NtSetSystemEnvironmentValueEx 397 383 | NtSetSystemInformation 398 384 | NtSetSystemPowerState 399 385 | NtSetSystemTime 400 386 | NtSetThreadExecutionState 401 387 | NtSetTimer 98 388 | NtSetTimer2 402 389 | NtSetTimerEx 403 390 | NtSetTimerResolution 404 391 | NtSetUuidSeed 405 392 | NtSetValueKey 96 393 | NtSetVolumeInformationFile 406 394 | NtSetWnfProcessNotificationEvent 407 395 | NtShutdownSystem 408 396 | NtShutdownWorkerFactory 409 397 | NtSignalAndWaitForSingleObject 410 398 | NtSinglePhaseReject 411 399 | NtStartProfile 412 400 | NtStopProfile 413 401 | NtSubscribeWnfStateChange 414 402 | NtSuspendProcess 415 403 | NtSuspendThread 416 404 | NtSystemDebugControl 417 405 | NtTerminateJobObject 418 406 | NtTerminateProcess 44 407 | NtTerminateThread 83 408 | NtTestAlert 419 409 | NtThawRegistry 420 410 | NtThawTransactions 421 411 | NtTraceControl 422 412 | NtTraceEvent 94 413 | NtTranslateFilePath 423 414 | NtUmsThreadYield 424 415 | NtUnloadDriver 425 416 | NtUnloadKey 426 417 | NtUnloadKey2 427 418 | NtUnloadKeyEx 428 419 | NtUnlockFile 429 420 | NtUnlockVirtualMemory 430 421 | NtUnmapViewOfSection 42 422 | NtUnmapViewOfSectionEx 431 423 | NtUnsubscribeWnfStateChange 432 424 | NtUpdateWnfStateData 433 425 | NtVdmControl 434 426 | NtWaitForAlertByThreadId 435 427 | NtWaitForDebugEvent 436 428 | NtWaitForKeyedEvent 437 429 | NtWaitForMultipleObjects 91 430 | NtWaitForMultipleObjects32 26 431 | NtWaitForSingleObject 4 432 | NtWaitForWorkViaWorkerFactory 438 433 | NtWaitHighEventPair 439 434 | NtWaitLowEventPair 440 435 | NtWorkerFactoryWorkerReady 1 436 | NtWriteFile 8 437 | NtWriteFileGather 27 438 | NtWriteRequestData 87 439 | NtWriteVirtualMemory 58 440 | NtYieldExecution 70 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/10586.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAddAtom 71 10 | NtAddAtomEx 103 11 | NtAddBootEntry 104 12 | NtAddDriverEntry 105 13 | NtAdjustGroupsToken 106 14 | NtAdjustPrivilegesToken 65 15 | NtAdjustTokenClaimsAndDeviceGroups 107 16 | NtAlertResumeThread 108 17 | NtAlertThread 109 18 | NtAlertThreadByThreadId 110 19 | NtAllocateLocallyUniqueId 111 20 | NtAllocateReserveObject 112 21 | NtAllocateUserPhysicalPages 113 22 | NtAllocateUuids 114 23 | NtAllocateVirtualMemory 24 24 | NtAlpcAcceptConnectPort 115 25 | NtAlpcCancelMessage 116 26 | NtAlpcConnectPort 117 27 | NtAlpcConnectPortEx 118 28 | NtAlpcCreatePort 119 29 | NtAlpcCreatePortSection 120 30 | NtAlpcCreateResourceReserve 121 31 | NtAlpcCreateSectionView 122 32 | NtAlpcCreateSecurityContext 123 33 | NtAlpcDeletePortSection 124 34 | NtAlpcDeleteResourceReserve 125 35 | NtAlpcDeleteSectionView 126 36 | NtAlpcDeleteSecurityContext 127 37 | NtAlpcDisconnectPort 128 38 | NtAlpcImpersonateClientContainerOfPort 129 39 | NtAlpcImpersonateClientOfPort 130 40 | NtAlpcOpenSenderProcess 131 41 | NtAlpcOpenSenderThread 132 42 | NtAlpcQueryInformation 133 43 | NtAlpcQueryInformationMessage 134 44 | NtAlpcRevokeSecurityContext 135 45 | NtAlpcSendWaitReceivePort 136 46 | NtAlpcSetInformation 137 47 | NtApphelpCacheControl 76 48 | NtAreMappedFilesTheSame 138 49 | NtAssignProcessToJobObject 139 50 | NtAssociateWaitCompletionPacket 140 51 | NtCallbackReturn 5 52 | NtCancelIoFile 93 53 | NtCancelIoFileEx 141 54 | NtCancelSynchronousIoFile 142 55 | NtCancelTimer 97 56 | NtCancelTimer2 143 57 | NtCancelWaitCompletionPacket 144 58 | NtClearEvent 62 59 | NtClose 15 60 | NtCloseObjectAuditAlarm 59 61 | NtCommitComplete 145 62 | NtCommitEnlistment 146 63 | NtCommitTransaction 147 64 | NtCompactKeys 148 65 | NtCompareObjects 149 66 | NtCompareTokens 150 67 | NtCompleteConnectPort 151 68 | NtCompressKey 152 69 | NtConnectPort 153 70 | NtContinue 67 71 | NtCreateDebugObject 154 72 | NtCreateDirectoryObject 155 73 | NtCreateDirectoryObjectEx 156 74 | NtCreateEnclave 157 75 | NtCreateEnlistment 158 76 | NtCreateEvent 72 77 | NtCreateEventPair 159 78 | NtCreateFile 85 79 | NtCreateIoCompletion 161 80 | NtCreateIRTimer 160 81 | NtCreateJobObject 162 82 | NtCreateJobSet 163 83 | NtCreateKey 29 84 | NtCreateKeyedEvent 165 85 | NtCreateKeyTransacted 164 86 | NtCreateLowBoxToken 166 87 | NtCreateMailslotFile 167 88 | NtCreateMutant 168 89 | NtCreateNamedPipeFile 169 90 | NtCreatePagingFile 170 91 | NtCreatePartition 171 92 | NtCreatePort 172 93 | NtCreatePrivateNamespace 173 94 | NtCreateProcess 174 95 | NtCreateProcessEx 77 96 | NtCreateProfile 175 97 | NtCreateProfileEx 176 98 | NtCreateResourceManager 177 99 | NtCreateSection 74 100 | NtCreateSemaphore 178 101 | NtCreateSymbolicLinkObject 179 102 | NtCreateThread 78 103 | NtCreateThreadEx 180 104 | NtCreateTimer 181 105 | NtCreateTimer2 182 106 | NtCreateToken 183 107 | NtCreateTokenEx 184 108 | NtCreateTransaction 185 109 | NtCreateTransactionManager 186 110 | NtCreateUserProcess 187 111 | NtCreateWaitablePort 189 112 | NtCreateWaitCompletionPacket 188 113 | NtCreateWnfStateName 190 114 | NtCreateWorkerFactory 191 115 | NtDebugActiveProcess 192 116 | NtDebugContinue 193 117 | NtDelayExecution 52 118 | NtDeleteAtom 194 119 | NtDeleteBootEntry 195 120 | NtDeleteDriverEntry 196 121 | NtDeleteFile 197 122 | NtDeleteKey 198 123 | NtDeleteObjectAuditAlarm 199 124 | NtDeletePrivateNamespace 200 125 | NtDeleteValueKey 201 126 | NtDeleteWnfStateData 202 127 | NtDeleteWnfStateName 203 128 | NtDeviceIoControlFile 7 129 | NtDisableLastKnownGood 204 130 | NtDisplayString 205 131 | NtDrawText 206 132 | NtDuplicateObject 60 133 | NtDuplicateToken 66 134 | NtEnableLastKnownGood 207 135 | NtEnumerateBootEntries 208 136 | NtEnumerateDriverEntries 209 137 | NtEnumerateKey 50 138 | NtEnumerateSystemEnvironmentValuesEx 210 139 | NtEnumerateTransactionObject 211 140 | NtEnumerateValueKey 19 141 | NtExtendSection 212 142 | NtFilterBootOption 213 143 | NtFilterToken 214 144 | NtFilterTokenEx 215 145 | NtFindAtom 20 146 | NtFlushBuffersFile 75 147 | NtFlushBuffersFileEx 216 148 | NtFlushInstallUILanguage 217 149 | NtFlushInstructionCache 218 150 | NtFlushKey 219 151 | NtFlushProcessWriteBuffers 220 152 | NtFlushVirtualMemory 221 153 | NtFlushWriteBuffer 222 154 | NtFreeUserPhysicalPages 223 155 | NtFreeVirtualMemory 30 156 | NtFreezeRegistry 224 157 | NtFreezeTransactions 225 158 | NtFsControlFile 57 159 | NtGetCachedSigningLevel 226 160 | NtGetCompleteWnfStateSubscription 227 161 | NtGetContextThread 228 162 | NtGetCurrentProcessorNumber 229 163 | NtGetCurrentProcessorNumberEx 230 164 | NtGetDevicePowerState 231 165 | NtGetMUIRegistryInfo 232 166 | NtGetNextProcess 233 167 | NtGetNextThread 234 168 | NtGetNlsSectionPtr 235 169 | NtGetNotificationResourceManager 236 170 | NtGetWriteWatch 237 171 | NtImpersonateAnonymousToken 238 172 | NtImpersonateClientOfPort 31 173 | NtImpersonateThread 239 174 | NtInitializeEnclave 240 175 | NtInitializeNlsFiles 241 176 | NtInitializeRegistry 242 177 | NtInitiatePowerAction 243 178 | NtIsProcessInJob 79 179 | NtIsSystemResumeAutomatic 244 180 | NtIsUILanguageComitted 245 181 | NtListenPort 246 182 | NtLoadDriver 247 183 | NtLoadEnclaveData 248 184 | NtLoadKey 249 185 | NtLoadKey2 250 186 | NtLoadKeyEx 251 187 | NtLockFile 252 188 | NtLockProductActivationKeys 253 189 | NtLockRegistryKey 254 190 | NtLockVirtualMemory 255 191 | NtMakePermanentObject 256 192 | NtMakeTemporaryObject 257 193 | NtManagePartition 258 194 | NtMapCMFModule 259 195 | NtMapUserPhysicalPages 260 196 | NtMapUserPhysicalPagesScatter 3 197 | NtMapViewOfSection 40 198 | NtModifyBootEntry 261 199 | NtModifyDriverEntry 262 200 | NtNotifyChangeDirectoryFile 263 201 | NtNotifyChangeKey 264 202 | NtNotifyChangeMultipleKeys 265 203 | NtNotifyChangeSession 266 204 | NtOpenDirectoryObject 88 205 | NtOpenEnlistment 267 206 | NtOpenEvent 64 207 | NtOpenEventPair 268 208 | NtOpenFile 51 209 | NtOpenIoCompletion 269 210 | NtOpenJobObject 270 211 | NtOpenKey 18 212 | NtOpenKeyedEvent 274 213 | NtOpenKeyEx 271 214 | NtOpenKeyTransacted 272 215 | NtOpenKeyTransactedEx 273 216 | NtOpenMutant 275 217 | NtOpenObjectAuditAlarm 276 218 | NtOpenPartition 277 219 | NtOpenPrivateNamespace 278 220 | NtOpenProcess 38 221 | NtOpenProcessToken 279 222 | NtOpenProcessTokenEx 48 223 | NtOpenResourceManager 280 224 | NtOpenSection 55 225 | NtOpenSemaphore 281 226 | NtOpenSession 282 227 | NtOpenSymbolicLinkObject 283 228 | NtOpenThread 284 229 | NtOpenThreadToken 36 230 | NtOpenThreadTokenEx 47 231 | NtOpenTimer 285 232 | NtOpenTransaction 286 233 | NtOpenTransactionManager 287 234 | NtPlugPlayControl 288 235 | NtPowerInformation 95 236 | NtPrepareComplete 291 237 | NtPrepareEnlistment 292 238 | NtPrePrepareComplete 289 239 | NtPrePrepareEnlistment 290 240 | NtPrivilegeCheck 293 241 | NtPrivilegedServiceAuditAlarm 295 242 | NtPrivilegeObjectAuditAlarm 294 243 | NtPropagationComplete 296 244 | NtPropagationFailed 297 245 | NtProtectVirtualMemory 80 246 | NtPulseEvent 298 247 | NtQueryAttributesFile 61 248 | NtQueryBootEntryOrder 299 249 | NtQueryBootOptions 300 250 | NtQueryDebugFilterState 301 251 | NtQueryDefaultLocale 21 252 | NtQueryDefaultUILanguage 68 253 | NtQueryDirectoryFile 53 254 | NtQueryDirectoryObject 302 255 | NtQueryDriverEntryOrder 303 256 | NtQueryEaFile 304 257 | NtQueryEvent 86 258 | NtQueryFullAttributesFile 305 259 | NtQueryInformationAtom 306 260 | NtQueryInformationEnlistment 307 261 | NtQueryInformationFile 17 262 | NtQueryInformationJobObject 308 263 | NtQueryInformationPort 309 264 | NtQueryInformationProcess 25 265 | NtQueryInformationResourceManager 310 266 | NtQueryInformationThread 37 267 | NtQueryInformationToken 33 268 | NtQueryInformationTransaction 311 269 | NtQueryInformationTransactionManager 312 270 | NtQueryInformationWorkerFactory 313 271 | NtQueryInstallUILanguage 314 272 | NtQueryIntervalProfile 315 273 | NtQueryIoCompletion 316 274 | NtQueryKey 22 275 | NtQueryLicenseValue 317 276 | NtQueryMultipleValueKey 318 277 | NtQueryMutant 319 278 | NtQueryObject 16 279 | NtQueryOpenSubKeys 320 280 | NtQueryOpenSubKeysEx 321 281 | NtQueryPerformanceCounter 49 282 | NtQueryPortInformationProcess 322 283 | NtQueryQuotaInformationFile 323 284 | NtQuerySection 81 285 | NtQuerySecurityAttributesToken 324 286 | NtQuerySecurityObject 325 287 | NtQuerySemaphore 326 288 | NtQuerySymbolicLinkObject 327 289 | NtQuerySystemEnvironmentValue 328 290 | NtQuerySystemEnvironmentValueEx 329 291 | NtQuerySystemInformation 54 292 | NtQuerySystemInformationEx 330 293 | NtQueryTimer 56 294 | NtQueryTimerResolution 331 295 | NtQueryValueKey 23 296 | NtQueryVirtualMemory 35 297 | NtQueryVolumeInformationFile 73 298 | NtQueryWnfStateData 332 299 | NtQueryWnfStateNameInformation 333 300 | NtQueueApcThread 69 301 | NtQueueApcThreadEx 334 302 | NtRaiseException 335 303 | NtRaiseHardError 336 304 | NtReadFile 6 305 | NtReadFileScatter 46 306 | NtReadOnlyEnlistment 337 307 | NtReadRequestData 84 308 | NtReadVirtualMemory 63 309 | NtRecoverEnlistment 338 310 | NtRecoverResourceManager 339 311 | NtRecoverTransactionManager 340 312 | NtRegisterProtocolAddressInformation 341 313 | NtRegisterThreadTerminatePort 342 314 | NtReleaseKeyedEvent 343 315 | NtReleaseMutant 32 316 | NtReleaseSemaphore 10 317 | NtReleaseWorkerFactoryWorker 344 318 | NtRemoveIoCompletion 9 319 | NtRemoveIoCompletionEx 345 320 | NtRemoveProcessDebug 346 321 | NtRenameKey 347 322 | NtRenameTransactionManager 348 323 | NtReplaceKey 349 324 | NtReplacePartitionUnit 350 325 | NtReplyPort 12 326 | NtReplyWaitReceivePort 11 327 | NtReplyWaitReceivePortEx 43 328 | NtReplyWaitReplyPort 351 329 | NtRequestPort 352 330 | NtRequestWaitReplyPort 34 331 | NtResetEvent 353 332 | NtResetWriteWatch 354 333 | NtRestoreKey 355 334 | NtResumeProcess 356 335 | NtResumeThread 82 336 | NtRevertContainerImpersonation 357 337 | NtRollbackComplete 358 338 | NtRollbackEnlistment 359 339 | NtRollbackTransaction 360 340 | NtRollforwardTransactionManager 361 341 | NtSaveKey 362 342 | NtSaveKeyEx 363 343 | NtSaveMergedKeys 364 344 | NtSecureConnectPort 365 345 | NtSerializeBoot 366 346 | NtSetBootEntryOrder 367 347 | NtSetBootOptions 368 348 | NtSetCachedSigningLevel 369 349 | NtSetContextThread 370 350 | NtSetDebugFilterState 371 351 | NtSetDefaultHardErrorPort 372 352 | NtSetDefaultLocale 373 353 | NtSetDefaultUILanguage 374 354 | NtSetDriverEntryOrder 375 355 | NtSetEaFile 376 356 | NtSetEvent 14 357 | NtSetEventBoostPriority 45 358 | NtSetHighEventPair 377 359 | NtSetHighWaitLowEventPair 378 360 | NtSetInformationDebugObject 380 361 | NtSetInformationEnlistment 381 362 | NtSetInformationFile 39 363 | NtSetInformationJobObject 382 364 | NtSetInformationKey 383 365 | NtSetInformationObject 92 366 | NtSetInformationProcess 28 367 | NtSetInformationResourceManager 384 368 | NtSetInformationSymbolicLink 385 369 | NtSetInformationThread 13 370 | NtSetInformationToken 386 371 | NtSetInformationTransaction 387 372 | NtSetInformationTransactionManager 388 373 | NtSetInformationVirtualMemory 389 374 | NtSetInformationWorkerFactory 390 375 | NtSetIntervalProfile 391 376 | NtSetIoCompletion 392 377 | NtSetIoCompletionEx 393 378 | NtSetIRTimer 379 379 | NtSetLdtEntries 394 380 | NtSetLowEventPair 395 381 | NtSetLowWaitHighEventPair 396 382 | NtSetQuotaInformationFile 397 383 | NtSetSecurityObject 398 384 | NtSetSystemEnvironmentValue 399 385 | NtSetSystemEnvironmentValueEx 400 386 | NtSetSystemInformation 401 387 | NtSetSystemPowerState 402 388 | NtSetSystemTime 403 389 | NtSetThreadExecutionState 404 390 | NtSetTimer 98 391 | NtSetTimer2 405 392 | NtSetTimerEx 406 393 | NtSetTimerResolution 407 394 | NtSetUuidSeed 408 395 | NtSetValueKey 96 396 | NtSetVolumeInformationFile 409 397 | NtSetWnfProcessNotificationEvent 410 398 | NtShutdownSystem 411 399 | NtShutdownWorkerFactory 412 400 | NtSignalAndWaitForSingleObject 413 401 | NtSinglePhaseReject 414 402 | NtStartProfile 415 403 | NtStopProfile 416 404 | NtSubscribeWnfStateChange 417 405 | NtSuspendProcess 418 406 | NtSuspendThread 419 407 | NtSystemDebugControl 420 408 | NtTerminateJobObject 421 409 | NtTerminateProcess 44 410 | NtTerminateThread 83 411 | NtTestAlert 422 412 | NtThawRegistry 423 413 | NtThawTransactions 424 414 | NtTraceControl 425 415 | NtTraceEvent 94 416 | NtTranslateFilePath 426 417 | NtUmsThreadYield 427 418 | NtUnloadDriver 428 419 | NtUnloadKey 429 420 | NtUnloadKey2 430 421 | NtUnloadKeyEx 431 422 | NtUnlockFile 432 423 | NtUnlockVirtualMemory 433 424 | NtUnmapViewOfSection 42 425 | NtUnmapViewOfSectionEx 434 426 | NtUnsubscribeWnfStateChange 435 427 | NtUpdateWnfStateData 436 428 | NtVdmControl 437 429 | NtWaitForAlertByThreadId 438 430 | NtWaitForDebugEvent 439 431 | NtWaitForKeyedEvent 440 432 | NtWaitForMultipleObjects 91 433 | NtWaitForMultipleObjects32 26 434 | NtWaitForSingleObject 4 435 | NtWaitForWorkViaWorkerFactory 441 436 | NtWaitHighEventPair 442 437 | NtWaitLowEventPair 443 438 | NtWorkerFactoryWorkerReady 1 439 | NtWriteFile 8 440 | NtWriteFileGather 27 441 | NtWriteRequestData 87 442 | NtWriteVirtualMemory 58 443 | NtYieldExecution 70 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/14393.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAddAtom 71 10 | NtAddAtomEx 103 11 | NtAddBootEntry 104 12 | NtAddDriverEntry 105 13 | NtAdjustGroupsToken 106 14 | NtAdjustPrivilegesToken 65 15 | NtAdjustTokenClaimsAndDeviceGroups 107 16 | NtAlertResumeThread 108 17 | NtAlertThread 109 18 | NtAlertThreadByThreadId 110 19 | NtAllocateLocallyUniqueId 111 20 | NtAllocateReserveObject 112 21 | NtAllocateUserPhysicalPages 113 22 | NtAllocateUuids 114 23 | NtAllocateVirtualMemory 24 24 | NtAlpcAcceptConnectPort 115 25 | NtAlpcCancelMessage 116 26 | NtAlpcConnectPort 117 27 | NtAlpcConnectPortEx 118 28 | NtAlpcCreatePort 119 29 | NtAlpcCreatePortSection 120 30 | NtAlpcCreateResourceReserve 121 31 | NtAlpcCreateSectionView 122 32 | NtAlpcCreateSecurityContext 123 33 | NtAlpcDeletePortSection 124 34 | NtAlpcDeleteResourceReserve 125 35 | NtAlpcDeleteSectionView 126 36 | NtAlpcDeleteSecurityContext 127 37 | NtAlpcDisconnectPort 128 38 | NtAlpcImpersonateClientContainerOfPort 129 39 | NtAlpcImpersonateClientOfPort 130 40 | NtAlpcOpenSenderProcess 131 41 | NtAlpcOpenSenderThread 132 42 | NtAlpcQueryInformation 133 43 | NtAlpcQueryInformationMessage 134 44 | NtAlpcRevokeSecurityContext 135 45 | NtAlpcSendWaitReceivePort 136 46 | NtAlpcSetInformation 137 47 | NtApphelpCacheControl 76 48 | NtAreMappedFilesTheSame 138 49 | NtAssignProcessToJobObject 139 50 | NtAssociateWaitCompletionPacket 140 51 | NtCallbackReturn 5 52 | NtCancelIoFile 93 53 | NtCancelIoFileEx 141 54 | NtCancelSynchronousIoFile 142 55 | NtCancelTimer 97 56 | NtCancelTimer2 143 57 | NtCancelWaitCompletionPacket 144 58 | NtClearEvent 62 59 | NtClose 15 60 | NtCloseObjectAuditAlarm 59 61 | NtCommitComplete 145 62 | NtCommitEnlistment 146 63 | NtCommitRegistryTransaction 147 64 | NtCommitTransaction 148 65 | NtCompactKeys 149 66 | NtCompareObjects 150 67 | NtCompareTokens 151 68 | NtCompleteConnectPort 152 69 | NtCompressKey 153 70 | NtConnectPort 154 71 | NtContinue 67 72 | NtCreateDebugObject 155 73 | NtCreateDirectoryObject 156 74 | NtCreateDirectoryObjectEx 157 75 | NtCreateEnclave 158 76 | NtCreateEnlistment 159 77 | NtCreateEvent 72 78 | NtCreateEventPair 160 79 | NtCreateFile 85 80 | NtCreateIRTimer 161 81 | NtCreateIoCompletion 162 82 | NtCreateJobObject 163 83 | NtCreateJobSet 164 84 | NtCreateKey 29 85 | NtCreateKeyTransacted 165 86 | NtCreateKeyedEvent 166 87 | NtCreateLowBoxToken 167 88 | NtCreateMailslotFile 168 89 | NtCreateMutant 169 90 | NtCreateNamedPipeFile 170 91 | NtCreatePagingFile 171 92 | NtCreatePartition 172 93 | NtCreatePort 173 94 | NtCreatePrivateNamespace 174 95 | NtCreateProcess 175 96 | NtCreateProcessEx 77 97 | NtCreateProfile 176 98 | NtCreateProfileEx 177 99 | NtCreateRegistryTransaction 178 100 | NtCreateResourceManager 179 101 | NtCreateSection 74 102 | NtCreateSemaphore 180 103 | NtCreateSymbolicLinkObject 181 104 | NtCreateThread 78 105 | NtCreateThreadEx 182 106 | NtCreateTimer 183 107 | NtCreateTimer2 184 108 | NtCreateToken 185 109 | NtCreateTokenEx 186 110 | NtCreateTransaction 187 111 | NtCreateTransactionManager 188 112 | NtCreateUserProcess 189 113 | NtCreateWaitCompletionPacket 190 114 | NtCreateWaitablePort 191 115 | NtCreateWnfStateName 192 116 | NtCreateWorkerFactory 193 117 | NtDebugActiveProcess 194 118 | NtDebugContinue 195 119 | NtDelayExecution 52 120 | NtDeleteAtom 196 121 | NtDeleteBootEntry 197 122 | NtDeleteDriverEntry 198 123 | NtDeleteFile 199 124 | NtDeleteKey 200 125 | NtDeleteObjectAuditAlarm 201 126 | NtDeletePrivateNamespace 202 127 | NtDeleteValueKey 203 128 | NtDeleteWnfStateData 204 129 | NtDeleteWnfStateName 205 130 | NtDeviceIoControlFile 7 131 | NtDisableLastKnownGood 206 132 | NtDisplayString 207 133 | NtDrawText 208 134 | NtDuplicateObject 60 135 | NtDuplicateToken 66 136 | NtEnableLastKnownGood 209 137 | NtEnumerateBootEntries 210 138 | NtEnumerateDriverEntries 211 139 | NtEnumerateKey 50 140 | NtEnumerateSystemEnvironmentValuesEx 212 141 | NtEnumerateTransactionObject 213 142 | NtEnumerateValueKey 19 143 | NtExtendSection 214 144 | NtFilterBootOption 215 145 | NtFilterToken 216 146 | NtFilterTokenEx 217 147 | NtFindAtom 20 148 | NtFlushBuffersFile 75 149 | NtFlushBuffersFileEx 218 150 | NtFlushInstallUILanguage 219 151 | NtFlushInstructionCache 220 152 | NtFlushKey 221 153 | NtFlushProcessWriteBuffers 222 154 | NtFlushVirtualMemory 223 155 | NtFlushWriteBuffer 224 156 | NtFreeUserPhysicalPages 225 157 | NtFreeVirtualMemory 30 158 | NtFreezeRegistry 226 159 | NtFreezeTransactions 227 160 | NtFsControlFile 57 161 | NtGetCachedSigningLevel 228 162 | NtGetCompleteWnfStateSubscription 229 163 | NtGetContextThread 230 164 | NtGetCurrentProcessorNumber 231 165 | NtGetCurrentProcessorNumberEx 232 166 | NtGetDevicePowerState 233 167 | NtGetMUIRegistryInfo 234 168 | NtGetNextProcess 235 169 | NtGetNextThread 236 170 | NtGetNlsSectionPtr 237 171 | NtGetNotificationResourceManager 238 172 | NtGetWriteWatch 239 173 | NtImpersonateAnonymousToken 240 174 | NtImpersonateClientOfPort 31 175 | NtImpersonateThread 241 176 | NtInitializeEnclave 242 177 | NtInitializeNlsFiles 243 178 | NtInitializeRegistry 244 179 | NtInitiatePowerAction 245 180 | NtIsProcessInJob 79 181 | NtIsSystemResumeAutomatic 246 182 | NtIsUILanguageComitted 247 183 | NtListenPort 248 184 | NtLoadDriver 249 185 | NtLoadEnclaveData 250 186 | NtLoadKey 251 187 | NtLoadKey2 252 188 | NtLoadKey3 450 189 | NtLoadKeyEx 253 190 | NtLockFile 254 191 | NtLockProductActivationKeys 255 192 | NtLockRegistryKey 256 193 | NtLockVirtualMemory 257 194 | NtMakePermanentObject 258 195 | NtMakeTemporaryObject 259 196 | NtManagePartition 260 197 | NtMapCMFModule 261 198 | NtMapUserPhysicalPages 262 199 | NtMapUserPhysicalPagesScatter 3 200 | NtMapViewOfSection 40 201 | NtModifyBootEntry 263 202 | NtModifyDriverEntry 264 203 | NtNotifyChangeDirectoryFile 265 204 | NtNotifyChangeKey 266 205 | NtNotifyChangeMultipleKeys 267 206 | NtNotifyChangeSession 268 207 | NtOpenDirectoryObject 88 208 | NtOpenEnlistment 269 209 | NtOpenEvent 64 210 | NtOpenEventPair 270 211 | NtOpenFile 51 212 | NtOpenIoCompletion 271 213 | NtOpenJobObject 272 214 | NtOpenKey 18 215 | NtOpenKeyEx 273 216 | NtOpenKeyTransacted 274 217 | NtOpenKeyTransactedEx 275 218 | NtOpenKeyedEvent 276 219 | NtOpenMutant 277 220 | NtOpenObjectAuditAlarm 278 221 | NtOpenPartition 279 222 | NtOpenPrivateNamespace 280 223 | NtOpenProcess 38 224 | NtOpenProcessToken 281 225 | NtOpenProcessTokenEx 48 226 | NtOpenRegistryTransaction 282 227 | NtOpenResourceManager 283 228 | NtOpenSection 55 229 | NtOpenSemaphore 284 230 | NtOpenSession 285 231 | NtOpenSymbolicLinkObject 286 232 | NtOpenThread 287 233 | NtOpenThreadToken 36 234 | NtOpenThreadTokenEx 47 235 | NtOpenTimer 288 236 | NtOpenTransaction 289 237 | NtOpenTransactionManager 290 238 | NtPlugPlayControl 291 239 | NtPowerInformation 95 240 | NtPrePrepareComplete 292 241 | NtPrePrepareEnlistment 293 242 | NtPrepareComplete 294 243 | NtPrepareEnlistment 295 244 | NtPrivilegeCheck 296 245 | NtPrivilegeObjectAuditAlarm 297 246 | NtPrivilegedServiceAuditAlarm 298 247 | NtPropagationComplete 299 248 | NtPropagationFailed 300 249 | NtProtectVirtualMemory 80 250 | NtPulseEvent 301 251 | NtQueryAttributesFile 61 252 | NtQueryBootEntryOrder 302 253 | NtQueryBootOptions 303 254 | NtQueryDebugFilterState 304 255 | NtQueryDefaultLocale 21 256 | NtQueryDefaultUILanguage 68 257 | NtQueryDirectoryFile 53 258 | NtQueryDirectoryObject 305 259 | NtQueryDriverEntryOrder 306 260 | NtQueryEaFile 307 261 | NtQueryEvent 86 262 | NtQueryFullAttributesFile 308 263 | NtQueryInformationAtom 309 264 | NtQueryInformationEnlistment 310 265 | NtQueryInformationFile 17 266 | NtQueryInformationJobObject 311 267 | NtQueryInformationPort 312 268 | NtQueryInformationProcess 25 269 | NtQueryInformationResourceManager 313 270 | NtQueryInformationThread 37 271 | NtQueryInformationToken 33 272 | NtQueryInformationTransaction 314 273 | NtQueryInformationTransactionManager 315 274 | NtQueryInformationWorkerFactory 316 275 | NtQueryInstallUILanguage 317 276 | NtQueryIntervalProfile 318 277 | NtQueryIoCompletion 319 278 | NtQueryKey 22 279 | NtQueryLicenseValue 320 280 | NtQueryMultipleValueKey 321 281 | NtQueryMutant 322 282 | NtQueryObject 16 283 | NtQueryOpenSubKeys 323 284 | NtQueryOpenSubKeysEx 324 285 | NtQueryPerformanceCounter 49 286 | NtQueryPortInformationProcess 325 287 | NtQueryQuotaInformationFile 326 288 | NtQuerySection 81 289 | NtQuerySecurityAttributesToken 327 290 | NtQuerySecurityObject 328 291 | NtQuerySecurityPolicy 329 292 | NtQuerySemaphore 330 293 | NtQuerySymbolicLinkObject 331 294 | NtQuerySystemEnvironmentValue 332 295 | NtQuerySystemEnvironmentValueEx 333 296 | NtQuerySystemInformation 54 297 | NtQuerySystemInformationEx 334 298 | NtQueryTimer 56 299 | NtQueryTimerResolution 335 300 | NtQueryValueKey 23 301 | NtQueryVirtualMemory 35 302 | NtQueryVolumeInformationFile 73 303 | NtQueryWnfStateData 336 304 | NtQueryWnfStateNameInformation 337 305 | NtQueueApcThread 69 306 | NtQueueApcThreadEx 338 307 | NtRaiseException 339 308 | NtRaiseHardError 340 309 | NtReadFile 6 310 | NtReadFileScatter 46 311 | NtReadOnlyEnlistment 341 312 | NtReadRequestData 84 313 | NtReadVirtualMemory 63 314 | NtRecoverEnlistment 342 315 | NtRecoverResourceManager 343 316 | NtRecoverTransactionManager 344 317 | NtRegisterProtocolAddressInformation 345 318 | NtRegisterThreadTerminatePort 346 319 | NtReleaseKeyedEvent 347 320 | NtReleaseMutant 32 321 | NtReleaseSemaphore 10 322 | NtReleaseWorkerFactoryWorker 348 323 | NtRemoveIoCompletion 9 324 | NtRemoveIoCompletionEx 349 325 | NtRemoveProcessDebug 350 326 | NtRenameKey 351 327 | NtRenameTransactionManager 352 328 | NtReplaceKey 353 329 | NtReplacePartitionUnit 354 330 | NtReplyPort 12 331 | NtReplyWaitReceivePort 11 332 | NtReplyWaitReceivePortEx 43 333 | NtReplyWaitReplyPort 355 334 | NtRequestPort 356 335 | NtRequestWaitReplyPort 34 336 | NtResetEvent 357 337 | NtResetWriteWatch 358 338 | NtRestoreKey 359 339 | NtResumeProcess 360 340 | NtResumeThread 82 341 | NtRevertContainerImpersonation 361 342 | NtRollbackComplete 362 343 | NtRollbackEnlistment 363 344 | NtRollbackRegistryTransaction 364 345 | NtRollbackTransaction 365 346 | NtRollforwardTransactionManager 366 347 | NtSaveKey 367 348 | NtSaveKeyEx 368 349 | NtSaveMergedKeys 369 350 | NtSecureConnectPort 370 351 | NtSerializeBoot 371 352 | NtSetBootEntryOrder 372 353 | NtSetBootOptions 373 354 | NtSetCachedSigningLevel 374 355 | NtSetCachedSigningLevel2 375 356 | NtSetContextThread 376 357 | NtSetDebugFilterState 377 358 | NtSetDefaultHardErrorPort 378 359 | NtSetDefaultLocale 379 360 | NtSetDefaultUILanguage 380 361 | NtSetDriverEntryOrder 381 362 | NtSetEaFile 382 363 | NtSetEvent 14 364 | NtSetEventBoostPriority 45 365 | NtSetHighEventPair 383 366 | NtSetHighWaitLowEventPair 384 367 | NtSetIRTimer 385 368 | NtSetInformationDebugObject 386 369 | NtSetInformationEnlistment 387 370 | NtSetInformationFile 39 371 | NtSetInformationJobObject 388 372 | NtSetInformationKey 389 373 | NtSetInformationObject 92 374 | NtSetInformationProcess 28 375 | NtSetInformationResourceManager 390 376 | NtSetInformationSymbolicLink 391 377 | NtSetInformationThread 13 378 | NtSetInformationToken 392 379 | NtSetInformationTransaction 393 380 | NtSetInformationTransactionManager 394 381 | NtSetInformationVirtualMemory 395 382 | NtSetInformationWorkerFactory 396 383 | NtSetIntervalProfile 397 384 | NtSetIoCompletion 398 385 | NtSetIoCompletionEx 399 386 | NtSetLdtEntries 400 387 | NtSetLowEventPair 401 388 | NtSetLowWaitHighEventPair 402 389 | NtSetQuotaInformationFile 403 390 | NtSetSecurityObject 404 391 | NtSetSystemEnvironmentValue 405 392 | NtSetSystemEnvironmentValueEx 406 393 | NtSetSystemInformation 407 394 | NtSetSystemPowerState 408 395 | NtSetSystemTime 409 396 | NtSetThreadExecutionState 410 397 | NtSetTimer 98 398 | NtSetTimer2 411 399 | NtSetTimerEx 412 400 | NtSetTimerResolution 413 401 | NtSetUuidSeed 414 402 | NtSetValueKey 96 403 | NtSetVolumeInformationFile 415 404 | NtSetWnfProcessNotificationEvent 416 405 | NtShutdownSystem 417 406 | NtShutdownWorkerFactory 418 407 | NtSignalAndWaitForSingleObject 419 408 | NtSinglePhaseReject 420 409 | NtStartProfile 421 410 | NtStopProfile 422 411 | NtSubscribeWnfStateChange 423 412 | NtSuspendProcess 424 413 | NtSuspendThread 425 414 | NtSystemDebugControl 426 415 | NtTerminateJobObject 427 416 | NtTerminateProcess 44 417 | NtTerminateThread 83 418 | NtTestAlert 428 419 | NtThawRegistry 429 420 | NtThawTransactions 430 421 | NtTraceControl 431 422 | NtTraceEvent 94 423 | NtTranslateFilePath 432 424 | NtUmsThreadYield 433 425 | NtUnloadDriver 434 426 | NtUnloadKey 435 427 | NtUnloadKey2 436 428 | NtUnloadKeyEx 437 429 | NtUnlockFile 438 430 | NtUnlockVirtualMemory 439 431 | NtUnmapViewOfSection 42 432 | NtUnmapViewOfSectionEx 440 433 | NtUnsubscribeWnfStateChange 441 434 | NtUpdateWnfStateData 442 435 | NtVdmControl 443 436 | NtWaitForAlertByThreadId 444 437 | NtWaitForDebugEvent 445 438 | NtWaitForKeyedEvent 446 439 | NtWaitForMultipleObjects 91 440 | NtWaitForMultipleObjects32 26 441 | NtWaitForSingleObject 4 442 | NtWaitForWorkViaWorkerFactory 447 443 | NtWaitHighEventPair 448 444 | NtWaitLowEventPair 449 445 | NtWorkerFactoryWorkerReady 1 446 | NtWriteFile 8 447 | NtWriteFileGather 27 448 | NtWriteRequestData 87 449 | NtWriteVirtualMemory 58 450 | NtYieldExecution 70 451 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/15063.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAcquireProcessActivityReference 103 10 | NtAddAtom 71 11 | NtAddAtomEx 104 12 | NtAddBootEntry 105 13 | NtAddDriverEntry 106 14 | NtAdjustGroupsToken 107 15 | NtAdjustPrivilegesToken 65 16 | NtAdjustTokenClaimsAndDeviceGroups 108 17 | NtAlertResumeThread 109 18 | NtAlertThread 110 19 | NtAlertThreadByThreadId 111 20 | NtAllocateLocallyUniqueId 112 21 | NtAllocateReserveObject 113 22 | NtAllocateUserPhysicalPages 114 23 | NtAllocateUuids 115 24 | NtAllocateVirtualMemory 24 25 | NtAlpcAcceptConnectPort 116 26 | NtAlpcCancelMessage 117 27 | NtAlpcConnectPort 118 28 | NtAlpcConnectPortEx 119 29 | NtAlpcCreatePort 120 30 | NtAlpcCreatePortSection 121 31 | NtAlpcCreateResourceReserve 122 32 | NtAlpcCreateSectionView 123 33 | NtAlpcCreateSecurityContext 124 34 | NtAlpcDeletePortSection 125 35 | NtAlpcDeleteResourceReserve 126 36 | NtAlpcDeleteSectionView 127 37 | NtAlpcDeleteSecurityContext 128 38 | NtAlpcDisconnectPort 129 39 | NtAlpcImpersonateClientContainerOfPort 130 40 | NtAlpcImpersonateClientOfPort 131 41 | NtAlpcOpenSenderProcess 132 42 | NtAlpcOpenSenderThread 133 43 | NtAlpcQueryInformation 134 44 | NtAlpcQueryInformationMessage 135 45 | NtAlpcRevokeSecurityContext 136 46 | NtAlpcSendWaitReceivePort 137 47 | NtAlpcSetInformation 138 48 | NtApphelpCacheControl 76 49 | NtAreMappedFilesTheSame 139 50 | NtAssignProcessToJobObject 140 51 | NtAssociateWaitCompletionPacket 141 52 | NtCallbackReturn 5 53 | NtCancelIoFile 93 54 | NtCancelIoFileEx 142 55 | NtCancelSynchronousIoFile 143 56 | NtCancelTimer 97 57 | NtCancelTimer2 144 58 | NtCancelWaitCompletionPacket 145 59 | NtClearEvent 62 60 | NtClose 15 61 | NtCloseObjectAuditAlarm 59 62 | NtCommitComplete 146 63 | NtCommitEnlistment 147 64 | NtCommitRegistryTransaction 148 65 | NtCommitTransaction 149 66 | NtCompactKeys 150 67 | NtCompareObjects 151 68 | NtCompareSigningLevels 152 69 | NtCompareTokens 153 70 | NtCompleteConnectPort 154 71 | NtCompressKey 155 72 | NtConnectPort 156 73 | NtContinue 67 74 | NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 157 75 | NtCreateDebugObject 158 76 | NtCreateDirectoryObject 159 77 | NtCreateDirectoryObjectEx 160 78 | NtCreateEnclave 161 79 | NtCreateEnlistment 162 80 | NtCreateEvent 72 81 | NtCreateEventPair 163 82 | NtCreateFile 85 83 | NtCreateIRTimer 164 84 | NtCreateIoCompletion 165 85 | NtCreateJobObject 166 86 | NtCreateJobSet 167 87 | NtCreateKey 29 88 | NtCreateKeyTransacted 168 89 | NtCreateKeyedEvent 169 90 | NtCreateLowBoxToken 170 91 | NtCreateMailslotFile 171 92 | NtCreateMutant 172 93 | NtCreateNamedPipeFile 173 94 | NtCreatePagingFile 174 95 | NtCreatePartition 175 96 | NtCreatePort 176 97 | NtCreatePrivateNamespace 177 98 | NtCreateProcess 178 99 | NtCreateProcessEx 77 100 | NtCreateProfile 179 101 | NtCreateProfileEx 180 102 | NtCreateRegistryTransaction 181 103 | NtCreateResourceManager 182 104 | NtCreateSection 74 105 | NtCreateSemaphore 183 106 | NtCreateSymbolicLinkObject 184 107 | NtCreateThread 78 108 | NtCreateThreadEx 185 109 | NtCreateTimer 186 110 | NtCreateTimer2 187 111 | NtCreateToken 188 112 | NtCreateTokenEx 189 113 | NtCreateTransaction 190 114 | NtCreateTransactionManager 191 115 | NtCreateUserProcess 192 116 | NtCreateWaitCompletionPacket 193 117 | NtCreateWaitablePort 194 118 | NtCreateWnfStateName 195 119 | NtCreateWorkerFactory 196 120 | NtDebugActiveProcess 197 121 | NtDebugContinue 198 122 | NtDelayExecution 52 123 | NtDeleteAtom 199 124 | NtDeleteBootEntry 200 125 | NtDeleteDriverEntry 201 126 | NtDeleteFile 202 127 | NtDeleteKey 203 128 | NtDeleteObjectAuditAlarm 204 129 | NtDeletePrivateNamespace 205 130 | NtDeleteValueKey 206 131 | NtDeleteWnfStateData 207 132 | NtDeleteWnfStateName 208 133 | NtDeviceIoControlFile 7 134 | NtDisableLastKnownGood 209 135 | NtDisplayString 210 136 | NtDrawText 211 137 | NtDuplicateObject 60 138 | NtDuplicateToken 66 139 | NtEnableLastKnownGood 212 140 | NtEnumerateBootEntries 213 141 | NtEnumerateDriverEntries 214 142 | NtEnumerateKey 50 143 | NtEnumerateSystemEnvironmentValuesEx 215 144 | NtEnumerateTransactionObject 216 145 | NtEnumerateValueKey 19 146 | NtExtendSection 217 147 | NtFilterBootOption 218 148 | NtFilterToken 219 149 | NtFilterTokenEx 220 150 | NtFindAtom 20 151 | NtFlushBuffersFile 75 152 | NtFlushBuffersFileEx 221 153 | NtFlushInstallUILanguage 222 154 | NtFlushInstructionCache 223 155 | NtFlushKey 224 156 | NtFlushProcessWriteBuffers 225 157 | NtFlushVirtualMemory 226 158 | NtFlushWriteBuffer 227 159 | NtFreeUserPhysicalPages 228 160 | NtFreeVirtualMemory 30 161 | NtFreezeRegistry 229 162 | NtFreezeTransactions 230 163 | NtFsControlFile 57 164 | NtGetCachedSigningLevel 231 165 | NtGetCompleteWnfStateSubscription 232 166 | NtGetContextThread 233 167 | NtGetCurrentProcessorNumber 234 168 | NtGetCurrentProcessorNumberEx 235 169 | NtGetDevicePowerState 236 170 | NtGetMUIRegistryInfo 237 171 | NtGetNextProcess 238 172 | NtGetNextThread 239 173 | NtGetNlsSectionPtr 240 174 | NtGetNotificationResourceManager 241 175 | NtGetWriteWatch 242 176 | NtImpersonateAnonymousToken 243 177 | NtImpersonateClientOfPort 31 178 | NtImpersonateThread 244 179 | NtInitializeEnclave 245 180 | NtInitializeNlsFiles 246 181 | NtInitializeRegistry 247 182 | NtInitiatePowerAction 248 183 | NtIsProcessInJob 79 184 | NtIsSystemResumeAutomatic 249 185 | NtIsUILanguageComitted 250 186 | NtListenPort 251 187 | NtLoadDriver 252 188 | NtLoadEnclaveData 253 189 | NtLoadHotPatch 254 190 | NtLoadKey 255 191 | NtLoadKey2 256 192 | NtLoadKeyEx 257 193 | NtLockFile 258 194 | NtLockProductActivationKeys 259 195 | NtLockRegistryKey 260 196 | NtLockVirtualMemory 261 197 | NtMakePermanentObject 262 198 | NtMakeTemporaryObject 263 199 | NtManagePartition 264 200 | NtMapCMFModule 265 201 | NtMapUserPhysicalPages 266 202 | NtMapUserPhysicalPagesScatter 3 203 | NtMapViewOfSection 40 204 | NtModifyBootEntry 267 205 | NtModifyDriverEntry 268 206 | NtNotifyChangeDirectoryFile 269 207 | NtNotifyChangeKey 270 208 | NtNotifyChangeMultipleKeys 271 209 | NtNotifyChangeSession 272 210 | NtOpenDirectoryObject 88 211 | NtOpenEnlistment 273 212 | NtOpenEvent 64 213 | NtOpenEventPair 274 214 | NtOpenFile 51 215 | NtOpenIoCompletion 275 216 | NtOpenJobObject 276 217 | NtOpenKey 18 218 | NtOpenKeyEx 277 219 | NtOpenKeyTransacted 278 220 | NtOpenKeyTransactedEx 279 221 | NtOpenKeyedEvent 280 222 | NtOpenMutant 281 223 | NtOpenObjectAuditAlarm 282 224 | NtOpenPartition 283 225 | NtOpenPrivateNamespace 284 226 | NtOpenProcess 38 227 | NtOpenProcessToken 285 228 | NtOpenProcessTokenEx 48 229 | NtOpenRegistryTransaction 286 230 | NtOpenResourceManager 287 231 | NtOpenSection 55 232 | NtOpenSemaphore 288 233 | NtOpenSession 289 234 | NtOpenSymbolicLinkObject 290 235 | NtOpenThread 291 236 | NtOpenThreadToken 36 237 | NtOpenThreadTokenEx 47 238 | NtOpenTimer 292 239 | NtOpenTransaction 293 240 | NtOpenTransactionManager 294 241 | NtPlugPlayControl 295 242 | NtPowerInformation 95 243 | NtPrePrepareComplete 296 244 | NtPrePrepareEnlistment 297 245 | NtPrepareComplete 298 246 | NtPrepareEnlistment 299 247 | NtPrivilegeCheck 300 248 | NtPrivilegeObjectAuditAlarm 301 249 | NtPrivilegedServiceAuditAlarm 302 250 | NtPropagationComplete 303 251 | NtPropagationFailed 304 252 | NtProtectVirtualMemory 80 253 | NtPulseEvent 305 254 | NtQueryAttributesFile 61 255 | NtQueryAuxiliaryCounterFrequency 306 256 | NtQueryBootEntryOrder 307 257 | NtQueryBootOptions 308 258 | NtQueryDebugFilterState 309 259 | NtQueryDefaultLocale 21 260 | NtQueryDefaultUILanguage 68 261 | NtQueryDirectoryFile 53 262 | NtQueryDirectoryObject 310 263 | NtQueryDriverEntryOrder 311 264 | NtQueryEaFile 312 265 | NtQueryEvent 86 266 | NtQueryFullAttributesFile 313 267 | NtQueryInformationAtom 314 268 | NtQueryInformationByName 315 269 | NtQueryInformationEnlistment 316 270 | NtQueryInformationFile 17 271 | NtQueryInformationJobObject 317 272 | NtQueryInformationPort 318 273 | NtQueryInformationProcess 25 274 | NtQueryInformationResourceManager 319 275 | NtQueryInformationThread 37 276 | NtQueryInformationToken 33 277 | NtQueryInformationTransaction 320 278 | NtQueryInformationTransactionManager 321 279 | NtQueryInformationWorkerFactory 322 280 | NtQueryInstallUILanguage 323 281 | NtQueryIntervalProfile 324 282 | NtQueryIoCompletion 325 283 | NtQueryKey 22 284 | NtQueryLicenseValue 326 285 | NtQueryMultipleValueKey 327 286 | NtQueryMutant 328 287 | NtQueryObject 16 288 | NtQueryOpenSubKeys 329 289 | NtQueryOpenSubKeysEx 330 290 | NtQueryPerformanceCounter 49 291 | NtQueryPortInformationProcess 331 292 | NtQueryQuotaInformationFile 332 293 | NtQuerySection 81 294 | NtQuerySecurityAttributesToken 333 295 | NtQuerySecurityObject 334 296 | NtQuerySecurityPolicy 335 297 | NtQuerySemaphore 336 298 | NtQuerySymbolicLinkObject 337 299 | NtQuerySystemEnvironmentValue 338 300 | NtQuerySystemEnvironmentValueEx 339 301 | NtQuerySystemInformation 54 302 | NtQuerySystemInformationEx 340 303 | NtQueryTimer 56 304 | NtQueryTimerResolution 341 305 | NtQueryValueKey 23 306 | NtQueryVirtualMemory 35 307 | NtQueryVolumeInformationFile 73 308 | NtQueryWnfStateData 342 309 | NtQueryWnfStateNameInformation 343 310 | NtQueueApcThread 69 311 | NtQueueApcThreadEx 344 312 | NtRaiseException 345 313 | NtRaiseHardError 346 314 | NtReadFile 6 315 | NtReadFileScatter 46 316 | NtReadOnlyEnlistment 347 317 | NtReadRequestData 84 318 | NtReadVirtualMemory 63 319 | NtRecoverEnlistment 348 320 | NtRecoverResourceManager 349 321 | NtRecoverTransactionManager 350 322 | NtRegisterProtocolAddressInformation 351 323 | NtRegisterThreadTerminatePort 352 324 | NtReleaseKeyedEvent 353 325 | NtReleaseMutant 32 326 | NtReleaseSemaphore 10 327 | NtReleaseWorkerFactoryWorker 354 328 | NtRemoveIoCompletion 9 329 | NtRemoveIoCompletionEx 355 330 | NtRemoveProcessDebug 356 331 | NtRenameKey 357 332 | NtRenameTransactionManager 358 333 | NtReplaceKey 359 334 | NtReplacePartitionUnit 360 335 | NtReplyPort 12 336 | NtReplyWaitReceivePort 11 337 | NtReplyWaitReceivePortEx 43 338 | NtReplyWaitReplyPort 361 339 | NtRequestPort 362 340 | NtRequestWaitReplyPort 34 341 | NtResetEvent 363 342 | NtResetWriteWatch 364 343 | NtRestoreKey 365 344 | NtResumeProcess 366 345 | NtResumeThread 82 346 | NtRevertContainerImpersonation 367 347 | NtRollbackComplete 368 348 | NtRollbackEnlistment 369 349 | NtRollbackRegistryTransaction 370 350 | NtRollbackTransaction 371 351 | NtRollforwardTransactionManager 372 352 | NtSaveKey 373 353 | NtSaveKeyEx 374 354 | NtSaveMergedKeys 375 355 | NtSecureConnectPort 376 356 | NtSerializeBoot 377 357 | NtSetBootEntryOrder 378 358 | NtSetBootOptions 379 359 | NtSetCachedSigningLevel 380 360 | NtSetCachedSigningLevel2 381 361 | NtSetContextThread 382 362 | NtSetDebugFilterState 383 363 | NtSetDefaultHardErrorPort 384 364 | NtSetDefaultLocale 385 365 | NtSetDefaultUILanguage 386 366 | NtSetDriverEntryOrder 387 367 | NtSetEaFile 388 368 | NtSetEvent 14 369 | NtSetEventBoostPriority 45 370 | NtSetHighEventPair 389 371 | NtSetHighWaitLowEventPair 390 372 | NtSetIRTimer 391 373 | NtSetInformationDebugObject 392 374 | NtSetInformationEnlistment 393 375 | NtSetInformationFile 39 376 | NtSetInformationJobObject 394 377 | NtSetInformationKey 395 378 | NtSetInformationObject 92 379 | NtSetInformationProcess 28 380 | NtSetInformationResourceManager 396 381 | NtSetInformationSymbolicLink 397 382 | NtSetInformationThread 13 383 | NtSetInformationToken 398 384 | NtSetInformationTransaction 399 385 | NtSetInformationTransactionManager 400 386 | NtSetInformationVirtualMemory 401 387 | NtSetInformationWorkerFactory 402 388 | NtSetIntervalProfile 403 389 | NtSetIoCompletion 404 390 | NtSetIoCompletionEx 405 391 | NtSetLdtEntries 406 392 | NtSetLowEventPair 407 393 | NtSetLowWaitHighEventPair 408 394 | NtSetQuotaInformationFile 409 395 | NtSetSecurityObject 410 396 | NtSetSystemEnvironmentValue 411 397 | NtSetSystemEnvironmentValueEx 412 398 | NtSetSystemInformation 413 399 | NtSetSystemPowerState 414 400 | NtSetSystemTime 415 401 | NtSetThreadExecutionState 416 402 | NtSetTimer 98 403 | NtSetTimer2 417 404 | NtSetTimerEx 418 405 | NtSetTimerResolution 419 406 | NtSetUuidSeed 420 407 | NtSetValueKey 96 408 | NtSetVolumeInformationFile 421 409 | NtSetWnfProcessNotificationEvent 422 410 | NtShutdownSystem 423 411 | NtShutdownWorkerFactory 424 412 | NtSignalAndWaitForSingleObject 425 413 | NtSinglePhaseReject 426 414 | NtStartProfile 427 415 | NtStopProfile 428 416 | NtSubscribeWnfStateChange 429 417 | NtSuspendProcess 430 418 | NtSuspendThread 431 419 | NtSystemDebugControl 432 420 | NtTerminateJobObject 433 421 | NtTerminateProcess 44 422 | NtTerminateThread 83 423 | NtTestAlert 434 424 | NtThawRegistry 435 425 | NtThawTransactions 436 426 | NtTraceControl 437 427 | NtTraceEvent 94 428 | NtTranslateFilePath 438 429 | NtUmsThreadYield 439 430 | NtUnloadDriver 440 431 | NtUnloadKey 441 432 | NtUnloadKey2 442 433 | NtUnloadKeyEx 443 434 | NtUnlockFile 444 435 | NtUnlockVirtualMemory 445 436 | NtUnmapViewOfSection 42 437 | NtUnmapViewOfSectionEx 446 438 | NtUnsubscribeWnfStateChange 447 439 | NtUpdateWnfStateData 448 440 | NtVdmControl 449 441 | NtWaitForAlertByThreadId 450 442 | NtWaitForDebugEvent 451 443 | NtWaitForKeyedEvent 452 444 | NtWaitForMultipleObjects 91 445 | NtWaitForMultipleObjects32 26 446 | NtWaitForSingleObject 4 447 | NtWaitForWorkViaWorkerFactory 453 448 | NtWaitHighEventPair 454 449 | NtWaitLowEventPair 455 450 | NtWorkerFactoryWorkerReady 1 451 | NtWriteFile 8 452 | NtWriteFileGather 27 453 | NtWriteRequestData 87 454 | NtWriteVirtualMemory 58 455 | NtYieldExecution 70 456 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/16299.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAcquireProcessActivityReference 103 10 | NtAddAtom 71 11 | NtAddAtomEx 104 12 | NtAddBootEntry 105 13 | NtAddDriverEntry 106 14 | NtAdjustGroupsToken 107 15 | NtAdjustPrivilegesToken 65 16 | NtAdjustTokenClaimsAndDeviceGroups 108 17 | NtAlertResumeThread 109 18 | NtAlertThread 110 19 | NtAlertThreadByThreadId 111 20 | NtAllocateLocallyUniqueId 112 21 | NtAllocateReserveObject 113 22 | NtAllocateUserPhysicalPages 114 23 | NtAllocateUuids 115 24 | NtAllocateVirtualMemory 24 25 | NtAlpcAcceptConnectPort 116 26 | NtAlpcCancelMessage 117 27 | NtAlpcConnectPort 118 28 | NtAlpcConnectPortEx 119 29 | NtAlpcCreatePort 120 30 | NtAlpcCreatePortSection 121 31 | NtAlpcCreateResourceReserve 122 32 | NtAlpcCreateSectionView 123 33 | NtAlpcCreateSecurityContext 124 34 | NtAlpcDeletePortSection 125 35 | NtAlpcDeleteResourceReserve 126 36 | NtAlpcDeleteSectionView 127 37 | NtAlpcDeleteSecurityContext 128 38 | NtAlpcDisconnectPort 129 39 | NtAlpcImpersonateClientContainerOfPort 130 40 | NtAlpcImpersonateClientOfPort 131 41 | NtAlpcOpenSenderProcess 132 42 | NtAlpcOpenSenderThread 133 43 | NtAlpcQueryInformation 134 44 | NtAlpcQueryInformationMessage 135 45 | NtAlpcRevokeSecurityContext 136 46 | NtAlpcSendWaitReceivePort 137 47 | NtAlpcSetInformation 138 48 | NtApphelpCacheControl 76 49 | NtAreMappedFilesTheSame 139 50 | NtAssignProcessToJobObject 140 51 | NtAssociateWaitCompletionPacket 141 52 | NtCallEnclave 142 53 | NtCallbackReturn 5 54 | NtCancelIoFile 93 55 | NtCancelIoFileEx 143 56 | NtCancelSynchronousIoFile 144 57 | NtCancelTimer 97 58 | NtCancelTimer2 145 59 | NtCancelWaitCompletionPacket 146 60 | NtClearEvent 62 61 | NtClose 15 62 | NtCloseObjectAuditAlarm 59 63 | NtCommitComplete 147 64 | NtCommitEnlistment 148 65 | NtCommitRegistryTransaction 149 66 | NtCommitTransaction 150 67 | NtCompactKeys 151 68 | NtCompareObjects 152 69 | NtCompareSigningLevels 153 70 | NtCompareTokens 154 71 | NtCompleteConnectPort 155 72 | NtCompressKey 156 73 | NtConnectPort 157 74 | NtContinue 67 75 | NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 158 76 | NtCreateDebugObject 159 77 | NtCreateDirectoryObject 160 78 | NtCreateDirectoryObjectEx 161 79 | NtCreateEnclave 162 80 | NtCreateEnlistment 163 81 | NtCreateEvent 72 82 | NtCreateEventPair 164 83 | NtCreateFile 85 84 | NtCreateIRTimer 165 85 | NtCreateIoCompletion 166 86 | NtCreateJobObject 167 87 | NtCreateJobSet 168 88 | NtCreateKey 29 89 | NtCreateKeyTransacted 169 90 | NtCreateKeyedEvent 170 91 | NtCreateLowBoxToken 171 92 | NtCreateMailslotFile 172 93 | NtCreateMutant 173 94 | NtCreateNamedPipeFile 174 95 | NtCreatePagingFile 175 96 | NtCreatePartition 176 97 | NtCreatePort 177 98 | NtCreatePrivateNamespace 178 99 | NtCreateProcess 179 100 | NtCreateProcessEx 77 101 | NtCreateProfile 180 102 | NtCreateProfileEx 181 103 | NtCreateRegistryTransaction 182 104 | NtCreateResourceManager 183 105 | NtCreateSection 74 106 | NtCreateSemaphore 184 107 | NtCreateSymbolicLinkObject 185 108 | NtCreateThread 78 109 | NtCreateThreadEx 186 110 | NtCreateTimer 187 111 | NtCreateTimer2 188 112 | NtCreateToken 189 113 | NtCreateTokenEx 190 114 | NtCreateTransaction 191 115 | NtCreateTransactionManager 192 116 | NtCreateUserProcess 193 117 | NtCreateWaitCompletionPacket 194 118 | NtCreateWaitablePort 195 119 | NtCreateWnfStateName 196 120 | NtCreateWorkerFactory 197 121 | NtDebugActiveProcess 198 122 | NtDebugContinue 199 123 | NtDelayExecution 52 124 | NtDeleteAtom 200 125 | NtDeleteBootEntry 201 126 | NtDeleteDriverEntry 202 127 | NtDeleteFile 203 128 | NtDeleteKey 204 129 | NtDeleteObjectAuditAlarm 205 130 | NtDeletePrivateNamespace 206 131 | NtDeleteValueKey 207 132 | NtDeleteWnfStateData 208 133 | NtDeleteWnfStateName 209 134 | NtDeviceIoControlFile 7 135 | NtDisableLastKnownGood 210 136 | NtDisplayString 211 137 | NtDrawText 212 138 | NtDuplicateObject 60 139 | NtDuplicateToken 66 140 | NtEnableLastKnownGood 213 141 | NtEnumerateBootEntries 214 142 | NtEnumerateDriverEntries 215 143 | NtEnumerateKey 50 144 | NtEnumerateSystemEnvironmentValuesEx 216 145 | NtEnumerateTransactionObject 217 146 | NtEnumerateValueKey 19 147 | NtExtendSection 218 148 | NtFilterBootOption 219 149 | NtFilterToken 220 150 | NtFilterTokenEx 221 151 | NtFindAtom 20 152 | NtFlushBuffersFile 75 153 | NtFlushBuffersFileEx 222 154 | NtFlushInstallUILanguage 223 155 | NtFlushInstructionCache 224 156 | NtFlushKey 225 157 | NtFlushProcessWriteBuffers 226 158 | NtFlushVirtualMemory 227 159 | NtFlushWriteBuffer 228 160 | NtFreeUserPhysicalPages 229 161 | NtFreeVirtualMemory 30 162 | NtFreezeRegistry 230 163 | NtFreezeTransactions 231 164 | NtFsControlFile 57 165 | NtGetCachedSigningLevel 232 166 | NtGetCompleteWnfStateSubscription 233 167 | NtGetContextThread 234 168 | NtGetCurrentProcessorNumber 235 169 | NtGetCurrentProcessorNumberEx 236 170 | NtGetDevicePowerState 237 171 | NtGetMUIRegistryInfo 238 172 | NtGetNextProcess 239 173 | NtGetNextThread 240 174 | NtGetNlsSectionPtr 241 175 | NtGetNotificationResourceManager 242 176 | NtGetWriteWatch 243 177 | NtImpersonateAnonymousToken 244 178 | NtImpersonateClientOfPort 31 179 | NtImpersonateThread 245 180 | NtInitializeEnclave 246 181 | NtInitializeNlsFiles 247 182 | NtInitializeRegistry 248 183 | NtInitiatePowerAction 249 184 | NtIsProcessInJob 79 185 | NtIsSystemResumeAutomatic 250 186 | NtIsUILanguageComitted 251 187 | NtListenPort 252 188 | NtLoadDriver 253 189 | NtLoadEnclaveData 254 190 | NtLoadHotPatch 255 191 | NtLoadKey 256 192 | NtLoadKey2 257 193 | NtLoadKeyEx 258 194 | NtLockFile 259 195 | NtLockProductActivationKeys 260 196 | NtLockRegistryKey 261 197 | NtLockVirtualMemory 262 198 | NtMakePermanentObject 263 199 | NtMakeTemporaryObject 264 200 | NtManagePartition 265 201 | NtMapCMFModule 266 202 | NtMapUserPhysicalPages 267 203 | NtMapUserPhysicalPagesScatter 3 204 | NtMapViewOfSection 40 205 | NtModifyBootEntry 268 206 | NtModifyDriverEntry 269 207 | NtNotifyChangeDirectoryFile 270 208 | NtNotifyChangeDirectoryFileEx 271 209 | NtNotifyChangeKey 272 210 | NtNotifyChangeMultipleKeys 273 211 | NtNotifyChangeSession 274 212 | NtOpenDirectoryObject 88 213 | NtOpenEnlistment 275 214 | NtOpenEvent 64 215 | NtOpenEventPair 276 216 | NtOpenFile 51 217 | NtOpenIoCompletion 277 218 | NtOpenJobObject 278 219 | NtOpenKey 18 220 | NtOpenKeyEx 279 221 | NtOpenKeyTransacted 280 222 | NtOpenKeyTransactedEx 281 223 | NtOpenKeyedEvent 282 224 | NtOpenMutant 283 225 | NtOpenObjectAuditAlarm 284 226 | NtOpenPartition 285 227 | NtOpenPrivateNamespace 286 228 | NtOpenProcess 38 229 | NtOpenProcessToken 287 230 | NtOpenProcessTokenEx 48 231 | NtOpenRegistryTransaction 288 232 | NtOpenResourceManager 289 233 | NtOpenSection 55 234 | NtOpenSemaphore 290 235 | NtOpenSession 291 236 | NtOpenSymbolicLinkObject 292 237 | NtOpenThread 293 238 | NtOpenThreadToken 36 239 | NtOpenThreadTokenEx 47 240 | NtOpenTimer 294 241 | NtOpenTransaction 295 242 | NtOpenTransactionManager 296 243 | NtPlugPlayControl 297 244 | NtPowerInformation 95 245 | NtPrePrepareComplete 298 246 | NtPrePrepareEnlistment 299 247 | NtPrepareComplete 300 248 | NtPrepareEnlistment 301 249 | NtPrivilegeCheck 302 250 | NtPrivilegeObjectAuditAlarm 303 251 | NtPrivilegedServiceAuditAlarm 304 252 | NtPropagationComplete 305 253 | NtPropagationFailed 306 254 | NtProtectVirtualMemory 80 255 | NtPulseEvent 307 256 | NtQueryAttributesFile 61 257 | NtQueryAuxiliaryCounterFrequency 308 258 | NtQueryBootEntryOrder 309 259 | NtQueryBootOptions 310 260 | NtQueryDebugFilterState 311 261 | NtQueryDefaultLocale 21 262 | NtQueryDefaultUILanguage 68 263 | NtQueryDirectoryFile 53 264 | NtQueryDirectoryFileEx 312 265 | NtQueryDirectoryObject 313 266 | NtQueryDriverEntryOrder 314 267 | NtQueryEaFile 315 268 | NtQueryEvent 86 269 | NtQueryFullAttributesFile 316 270 | NtQueryInformationAtom 317 271 | NtQueryInformationByName 318 272 | NtQueryInformationEnlistment 319 273 | NtQueryInformationFile 17 274 | NtQueryInformationJobObject 320 275 | NtQueryInformationPort 321 276 | NtQueryInformationProcess 25 277 | NtQueryInformationResourceManager 322 278 | NtQueryInformationThread 37 279 | NtQueryInformationToken 33 280 | NtQueryInformationTransaction 323 281 | NtQueryInformationTransactionManager 324 282 | NtQueryInformationWorkerFactory 325 283 | NtQueryInstallUILanguage 326 284 | NtQueryIntervalProfile 327 285 | NtQueryIoCompletion 328 286 | NtQueryKey 22 287 | NtQueryLicenseValue 329 288 | NtQueryMultipleValueKey 330 289 | NtQueryMutant 331 290 | NtQueryObject 16 291 | NtQueryOpenSubKeys 332 292 | NtQueryOpenSubKeysEx 333 293 | NtQueryPerformanceCounter 49 294 | NtQueryPortInformationProcess 334 295 | NtQueryQuotaInformationFile 335 296 | NtQuerySection 81 297 | NtQuerySecurityAttributesToken 336 298 | NtQuerySecurityObject 337 299 | NtQuerySecurityPolicy 338 300 | NtQuerySemaphore 339 301 | NtQuerySymbolicLinkObject 340 302 | NtQuerySystemEnvironmentValue 341 303 | NtQuerySystemEnvironmentValueEx 342 304 | NtQuerySystemInformation 54 305 | NtQuerySystemInformationEx 343 306 | NtQueryTimer 56 307 | NtQueryTimerResolution 344 308 | NtQueryValueKey 23 309 | NtQueryVirtualMemory 35 310 | NtQueryVolumeInformationFile 73 311 | NtQueryWnfStateData 345 312 | NtQueryWnfStateNameInformation 346 313 | NtQueueApcThread 69 314 | NtQueueApcThreadEx 347 315 | NtRaiseException 348 316 | NtRaiseHardError 349 317 | NtReadFile 6 318 | NtReadFileScatter 46 319 | NtReadOnlyEnlistment 350 320 | NtReadRequestData 84 321 | NtReadVirtualMemory 63 322 | NtRecoverEnlistment 351 323 | NtRecoverResourceManager 352 324 | NtRecoverTransactionManager 353 325 | NtRegisterProtocolAddressInformation 354 326 | NtRegisterThreadTerminatePort 355 327 | NtReleaseKeyedEvent 356 328 | NtReleaseMutant 32 329 | NtReleaseSemaphore 10 330 | NtReleaseWorkerFactoryWorker 357 331 | NtRemoveIoCompletion 9 332 | NtRemoveIoCompletionEx 358 333 | NtRemoveProcessDebug 359 334 | NtRenameKey 360 335 | NtRenameTransactionManager 361 336 | NtReplaceKey 362 337 | NtReplacePartitionUnit 363 338 | NtReplyPort 12 339 | NtReplyWaitReceivePort 11 340 | NtReplyWaitReceivePortEx 43 341 | NtReplyWaitReplyPort 364 342 | NtRequestPort 365 343 | NtRequestWaitReplyPort 34 344 | NtResetEvent 366 345 | NtResetWriteWatch 367 346 | NtRestoreKey 368 347 | NtResumeProcess 369 348 | NtResumeThread 82 349 | NtRevertContainerImpersonation 370 350 | NtRollbackComplete 371 351 | NtRollbackEnlistment 372 352 | NtRollbackRegistryTransaction 373 353 | NtRollbackTransaction 374 354 | NtRollforwardTransactionManager 375 355 | NtSaveKey 376 356 | NtSaveKeyEx 377 357 | NtSaveMergedKeys 378 358 | NtSecureConnectPort 379 359 | NtSerializeBoot 380 360 | NtSetBootEntryOrder 381 361 | NtSetBootOptions 382 362 | NtSetCachedSigningLevel 383 363 | NtSetCachedSigningLevel2 384 364 | NtSetContextThread 385 365 | NtSetDebugFilterState 386 366 | NtSetDefaultHardErrorPort 387 367 | NtSetDefaultLocale 388 368 | NtSetDefaultUILanguage 389 369 | NtSetDriverEntryOrder 390 370 | NtSetEaFile 391 371 | NtSetEvent 14 372 | NtSetEventBoostPriority 45 373 | NtSetHighEventPair 392 374 | NtSetHighWaitLowEventPair 393 375 | NtSetIRTimer 394 376 | NtSetInformationDebugObject 395 377 | NtSetInformationEnlistment 396 378 | NtSetInformationFile 39 379 | NtSetInformationJobObject 397 380 | NtSetInformationKey 398 381 | NtSetInformationObject 92 382 | NtSetInformationProcess 28 383 | NtSetInformationResourceManager 399 384 | NtSetInformationSymbolicLink 400 385 | NtSetInformationThread 13 386 | NtSetInformationToken 401 387 | NtSetInformationTransaction 402 388 | NtSetInformationTransactionManager 403 389 | NtSetInformationVirtualMemory 404 390 | NtSetInformationWorkerFactory 405 391 | NtSetIntervalProfile 406 392 | NtSetIoCompletion 407 393 | NtSetIoCompletionEx 408 394 | NtSetLdtEntries 409 395 | NtSetLowEventPair 410 396 | NtSetLowWaitHighEventPair 411 397 | NtSetQuotaInformationFile 412 398 | NtSetSecurityObject 413 399 | NtSetSystemEnvironmentValue 414 400 | NtSetSystemEnvironmentValueEx 415 401 | NtSetSystemInformation 416 402 | NtSetSystemPowerState 417 403 | NtSetSystemTime 418 404 | NtSetThreadExecutionState 419 405 | NtSetTimer 98 406 | NtSetTimer2 420 407 | NtSetTimerEx 421 408 | NtSetTimerResolution 422 409 | NtSetUuidSeed 423 410 | NtSetValueKey 96 411 | NtSetVolumeInformationFile 424 412 | NtSetWnfProcessNotificationEvent 425 413 | NtShutdownSystem 426 414 | NtShutdownWorkerFactory 427 415 | NtSignalAndWaitForSingleObject 428 416 | NtSinglePhaseReject 429 417 | NtStartProfile 430 418 | NtStopProfile 431 419 | NtSubscribeWnfStateChange 432 420 | NtSuspendProcess 433 421 | NtSuspendThread 434 422 | NtSystemDebugControl 435 423 | NtTerminateEnclave 436 424 | NtTerminateJobObject 437 425 | NtTerminateProcess 44 426 | NtTerminateThread 83 427 | NtTestAlert 438 428 | NtThawRegistry 439 429 | NtThawTransactions 440 430 | NtTraceControl 441 431 | NtTraceEvent 94 432 | NtTranslateFilePath 442 433 | NtUmsThreadYield 443 434 | NtUnloadDriver 444 435 | NtUnloadKey 445 436 | NtUnloadKey2 446 437 | NtUnloadKeyEx 447 438 | NtUnlockFile 448 439 | NtUnlockVirtualMemory 449 440 | NtUnmapViewOfSection 42 441 | NtUnmapViewOfSectionEx 450 442 | NtUnsubscribeWnfStateChange 451 443 | NtUpdateWnfStateData 452 444 | NtVdmControl 453 445 | NtWaitForAlertByThreadId 454 446 | NtWaitForDebugEvent 455 447 | NtWaitForKeyedEvent 456 448 | NtWaitForMultipleObjects 91 449 | NtWaitForMultipleObjects32 26 450 | NtWaitForSingleObject 4 451 | NtWaitForWorkViaWorkerFactory 457 452 | NtWaitHighEventPair 458 453 | NtWaitLowEventPair 459 454 | NtWorkerFactoryWorkerReady 1 455 | NtWriteFile 8 456 | NtWriteFileGather 27 457 | NtWriteRequestData 87 458 | NtWriteVirtualMemory 58 459 | NtYieldExecution 70 460 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/ntos/17134.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 2 2 | NtAccessCheck 0 3 | NtAccessCheckAndAuditAlarm 41 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 89 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAcquireProcessActivityReference 103 10 | NtAddAtom 71 11 | NtAddAtomEx 104 12 | NtAddBootEntry 105 13 | NtAddDriverEntry 106 14 | NtAdjustGroupsToken 107 15 | NtAdjustPrivilegesToken 65 16 | NtAdjustTokenClaimsAndDeviceGroups 108 17 | NtAlertResumeThread 109 18 | NtAlertThread 110 19 | NtAlertThreadByThreadId 111 20 | NtAllocateLocallyUniqueId 112 21 | NtAllocateReserveObject 113 22 | NtAllocateUserPhysicalPages 114 23 | NtAllocateUuids 115 24 | NtAllocateVirtualMemory 24 25 | NtAllocateVirtualMemoryEx 116 26 | NtAlpcAcceptConnectPort 117 27 | NtAlpcCancelMessage 118 28 | NtAlpcConnectPort 119 29 | NtAlpcConnectPortEx 120 30 | NtAlpcCreatePort 121 31 | NtAlpcCreatePortSection 122 32 | NtAlpcCreateResourceReserve 123 33 | NtAlpcCreateSectionView 124 34 | NtAlpcCreateSecurityContext 125 35 | NtAlpcDeletePortSection 126 36 | NtAlpcDeleteResourceReserve 127 37 | NtAlpcDeleteSectionView 128 38 | NtAlpcDeleteSecurityContext 129 39 | NtAlpcDisconnectPort 130 40 | NtAlpcImpersonateClientContainerOfPort 131 41 | NtAlpcImpersonateClientOfPort 132 42 | NtAlpcOpenSenderProcess 133 43 | NtAlpcOpenSenderThread 134 44 | NtAlpcQueryInformation 135 45 | NtAlpcQueryInformationMessage 136 46 | NtAlpcRevokeSecurityContext 137 47 | NtAlpcSendWaitReceivePort 138 48 | NtAlpcSetInformation 139 49 | NtApphelpCacheControl 76 50 | NtAreMappedFilesTheSame 140 51 | NtAssignProcessToJobObject 141 52 | NtAssociateWaitCompletionPacket 142 53 | NtCallEnclave 143 54 | NtCallbackReturn 5 55 | NtCancelIoFile 93 56 | NtCancelIoFileEx 144 57 | NtCancelSynchronousIoFile 145 58 | NtCancelTimer 97 59 | NtCancelTimer2 146 60 | NtCancelWaitCompletionPacket 147 61 | NtClearEvent 62 62 | NtClose 15 63 | NtCloseObjectAuditAlarm 59 64 | NtCommitComplete 148 65 | NtCommitEnlistment 149 66 | NtCommitRegistryTransaction 150 67 | NtCommitTransaction 151 68 | NtCompactKeys 152 69 | NtCompareObjects 153 70 | NtCompareSigningLevels 154 71 | NtCompareTokens 155 72 | NtCompleteConnectPort 156 73 | NtCompressKey 157 74 | NtConnectPort 158 75 | NtContinue 67 76 | NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 159 77 | NtCreateDebugObject 160 78 | NtCreateDirectoryObject 161 79 | NtCreateDirectoryObjectEx 162 80 | NtCreateEnclave 163 81 | NtCreateEnlistment 164 82 | NtCreateEvent 72 83 | NtCreateEventPair 165 84 | NtCreateFile 85 85 | NtCreateIRTimer 166 86 | NtCreateIoCompletion 167 87 | NtCreateJobObject 168 88 | NtCreateJobSet 169 89 | NtCreateKey 29 90 | NtCreateKeyTransacted 170 91 | NtCreateKeyedEvent 171 92 | NtCreateLowBoxToken 172 93 | NtCreateMailslotFile 173 94 | NtCreateMutant 174 95 | NtCreateNamedPipeFile 175 96 | NtCreatePagingFile 176 97 | NtCreatePartition 177 98 | NtCreatePort 178 99 | NtCreatePrivateNamespace 179 100 | NtCreateProcess 180 101 | NtCreateProcessEx 77 102 | NtCreateProfile 181 103 | NtCreateProfileEx 182 104 | NtCreateRegistryTransaction 183 105 | NtCreateResourceManager 184 106 | NtCreateSection 74 107 | NtCreateSemaphore 185 108 | NtCreateSymbolicLinkObject 186 109 | NtCreateThread 78 110 | NtCreateThreadEx 187 111 | NtCreateTimer 188 112 | NtCreateTimer2 189 113 | NtCreateToken 190 114 | NtCreateTokenEx 191 115 | NtCreateTransaction 192 116 | NtCreateTransactionManager 193 117 | NtCreateUserProcess 194 118 | NtCreateWaitCompletionPacket 195 119 | NtCreateWaitablePort 196 120 | NtCreateWnfStateName 197 121 | NtCreateWorkerFactory 198 122 | NtDebugActiveProcess 199 123 | NtDebugContinue 200 124 | NtDelayExecution 52 125 | NtDeleteAtom 201 126 | NtDeleteBootEntry 202 127 | NtDeleteDriverEntry 203 128 | NtDeleteFile 204 129 | NtDeleteKey 205 130 | NtDeleteObjectAuditAlarm 206 131 | NtDeletePrivateNamespace 207 132 | NtDeleteValueKey 208 133 | NtDeleteWnfStateData 209 134 | NtDeleteWnfStateName 210 135 | NtDeviceIoControlFile 7 136 | NtDisableLastKnownGood 211 137 | NtDisplayString 212 138 | NtDrawText 213 139 | NtDuplicateObject 60 140 | NtDuplicateToken 66 141 | NtEnableLastKnownGood 214 142 | NtEnumerateBootEntries 215 143 | NtEnumerateDriverEntries 216 144 | NtEnumerateKey 50 145 | NtEnumerateSystemEnvironmentValuesEx 217 146 | NtEnumerateTransactionObject 218 147 | NtEnumerateValueKey 19 148 | NtExtendSection 219 149 | NtFilterBootOption 220 150 | NtFilterToken 221 151 | NtFilterTokenEx 222 152 | NtFindAtom 20 153 | NtFlushBuffersFile 75 154 | NtFlushBuffersFileEx 223 155 | NtFlushInstallUILanguage 224 156 | NtFlushInstructionCache 225 157 | NtFlushKey 226 158 | NtFlushProcessWriteBuffers 227 159 | NtFlushVirtualMemory 228 160 | NtFlushWriteBuffer 229 161 | NtFreeUserPhysicalPages 230 162 | NtFreeVirtualMemory 30 163 | NtFreezeRegistry 231 164 | NtFreezeTransactions 232 165 | NtFsControlFile 57 166 | NtGetCachedSigningLevel 233 167 | NtGetCompleteWnfStateSubscription 234 168 | NtGetContextThread 235 169 | NtGetCurrentProcessorNumber 236 170 | NtGetCurrentProcessorNumberEx 237 171 | NtGetDevicePowerState 238 172 | NtGetMUIRegistryInfo 239 173 | NtGetNextProcess 240 174 | NtGetNextThread 241 175 | NtGetNlsSectionPtr 242 176 | NtGetNotificationResourceManager 243 177 | NtGetWriteWatch 244 178 | NtImpersonateAnonymousToken 245 179 | NtImpersonateClientOfPort 31 180 | NtImpersonateThread 246 181 | NtInitializeEnclave 247 182 | NtInitializeNlsFiles 248 183 | NtInitializeRegistry 249 184 | NtInitiatePowerAction 250 185 | NtIsProcessInJob 79 186 | NtIsSystemResumeAutomatic 251 187 | NtIsUILanguageComitted 252 188 | NtListenPort 253 189 | NtLoadDriver 254 190 | NtLoadEnclaveData 255 191 | NtLoadHotPatch 256 192 | NtLoadKey 257 193 | NtLoadKey2 258 194 | NtLoadKeyEx 259 195 | NtLockFile 260 196 | NtLockProductActivationKeys 261 197 | NtLockRegistryKey 262 198 | NtLockVirtualMemory 263 199 | NtMakePermanentObject 264 200 | NtMakeTemporaryObject 265 201 | NtManagePartition 266 202 | NtMapCMFModule 267 203 | NtMapUserPhysicalPages 268 204 | NtMapUserPhysicalPagesScatter 3 205 | NtMapViewOfSection 40 206 | NtMapViewOfSectionEx 269 207 | NtModifyBootEntry 270 208 | NtModifyDriverEntry 271 209 | NtNotifyChangeDirectoryFile 272 210 | NtNotifyChangeDirectoryFileEx 273 211 | NtNotifyChangeKey 274 212 | NtNotifyChangeMultipleKeys 275 213 | NtNotifyChangeSession 276 214 | NtOpenDirectoryObject 88 215 | NtOpenEnlistment 277 216 | NtOpenEvent 64 217 | NtOpenEventPair 278 218 | NtOpenFile 51 219 | NtOpenIoCompletion 279 220 | NtOpenJobObject 280 221 | NtOpenKey 18 222 | NtOpenKeyEx 281 223 | NtOpenKeyTransacted 282 224 | NtOpenKeyTransactedEx 283 225 | NtOpenKeyedEvent 284 226 | NtOpenMutant 285 227 | NtOpenObjectAuditAlarm 286 228 | NtOpenPartition 287 229 | NtOpenPrivateNamespace 288 230 | NtOpenProcess 38 231 | NtOpenProcessToken 289 232 | NtOpenProcessTokenEx 48 233 | NtOpenRegistryTransaction 290 234 | NtOpenResourceManager 291 235 | NtOpenSection 55 236 | NtOpenSemaphore 292 237 | NtOpenSession 293 238 | NtOpenSymbolicLinkObject 294 239 | NtOpenThread 295 240 | NtOpenThreadToken 36 241 | NtOpenThreadTokenEx 47 242 | NtOpenTimer 296 243 | NtOpenTransaction 297 244 | NtOpenTransactionManager 298 245 | NtPlugPlayControl 299 246 | NtPowerInformation 95 247 | NtPrePrepareComplete 300 248 | NtPrePrepareEnlistment 301 249 | NtPrepareComplete 302 250 | NtPrepareEnlistment 303 251 | NtPrivilegeCheck 304 252 | NtPrivilegeObjectAuditAlarm 305 253 | NtPrivilegedServiceAuditAlarm 306 254 | NtPropagationComplete 307 255 | NtPropagationFailed 308 256 | NtProtectVirtualMemory 80 257 | NtPulseEvent 309 258 | NtQueryAttributesFile 61 259 | NtQueryAuxiliaryCounterFrequency 310 260 | NtQueryBootEntryOrder 311 261 | NtQueryBootOptions 312 262 | NtQueryDebugFilterState 313 263 | NtQueryDefaultLocale 21 264 | NtQueryDefaultUILanguage 68 265 | NtQueryDirectoryFile 53 266 | NtQueryDirectoryFileEx 314 267 | NtQueryDirectoryObject 315 268 | NtQueryDriverEntryOrder 316 269 | NtQueryEaFile 317 270 | NtQueryEvent 86 271 | NtQueryFullAttributesFile 318 272 | NtQueryInformationAtom 319 273 | NtQueryInformationByName 320 274 | NtQueryInformationEnlistment 321 275 | NtQueryInformationFile 17 276 | NtQueryInformationJobObject 322 277 | NtQueryInformationPort 323 278 | NtQueryInformationProcess 25 279 | NtQueryInformationResourceManager 324 280 | NtQueryInformationThread 37 281 | NtQueryInformationToken 33 282 | NtQueryInformationTransaction 325 283 | NtQueryInformationTransactionManager 326 284 | NtQueryInformationWorkerFactory 327 285 | NtQueryInstallUILanguage 328 286 | NtQueryIntervalProfile 329 287 | NtQueryIoCompletion 330 288 | NtQueryKey 22 289 | NtQueryLicenseValue 331 290 | NtQueryMultipleValueKey 332 291 | NtQueryMutant 333 292 | NtQueryObject 16 293 | NtQueryOpenSubKeys 334 294 | NtQueryOpenSubKeysEx 335 295 | NtQueryPerformanceCounter 49 296 | NtQueryPortInformationProcess 336 297 | NtQueryQuotaInformationFile 337 298 | NtQuerySection 81 299 | NtQuerySecurityAttributesToken 338 300 | NtQuerySecurityObject 339 301 | NtQuerySecurityPolicy 340 302 | NtQuerySemaphore 341 303 | NtQuerySymbolicLinkObject 342 304 | NtQuerySystemEnvironmentValue 343 305 | NtQuerySystemEnvironmentValueEx 344 306 | NtQuerySystemInformation 54 307 | NtQuerySystemInformationEx 345 308 | NtQueryTimer 56 309 | NtQueryTimerResolution 346 310 | NtQueryValueKey 23 311 | NtQueryVirtualMemory 35 312 | NtQueryVolumeInformationFile 73 313 | NtQueryWnfStateData 347 314 | NtQueryWnfStateNameInformation 348 315 | NtQueueApcThread 69 316 | NtQueueApcThreadEx 349 317 | NtRaiseException 350 318 | NtRaiseHardError 351 319 | NtReadFile 6 320 | NtReadFileScatter 46 321 | NtReadOnlyEnlistment 352 322 | NtReadRequestData 84 323 | NtReadVirtualMemory 63 324 | NtRecoverEnlistment 353 325 | NtRecoverResourceManager 354 326 | NtRecoverTransactionManager 355 327 | NtRegisterProtocolAddressInformation 356 328 | NtRegisterThreadTerminatePort 357 329 | NtReleaseKeyedEvent 358 330 | NtReleaseMutant 32 331 | NtReleaseSemaphore 10 332 | NtReleaseWorkerFactoryWorker 359 333 | NtRemoveIoCompletion 9 334 | NtRemoveIoCompletionEx 360 335 | NtRemoveProcessDebug 361 336 | NtRenameKey 362 337 | NtRenameTransactionManager 363 338 | NtReplaceKey 364 339 | NtReplacePartitionUnit 365 340 | NtReplyPort 12 341 | NtReplyWaitReceivePort 11 342 | NtReplyWaitReceivePortEx 43 343 | NtReplyWaitReplyPort 366 344 | NtRequestPort 367 345 | NtRequestWaitReplyPort 34 346 | NtResetEvent 368 347 | NtResetWriteWatch 369 348 | NtRestoreKey 370 349 | NtResumeProcess 371 350 | NtResumeThread 82 351 | NtRevertContainerImpersonation 372 352 | NtRollbackComplete 373 353 | NtRollbackEnlistment 374 354 | NtRollbackRegistryTransaction 375 355 | NtRollbackTransaction 376 356 | NtRollforwardTransactionManager 377 357 | NtSaveKey 378 358 | NtSaveKeyEx 379 359 | NtSaveMergedKeys 380 360 | NtSecureConnectPort 381 361 | NtSerializeBoot 382 362 | NtSetBootEntryOrder 383 363 | NtSetBootOptions 384 364 | NtSetCachedSigningLevel 385 365 | NtSetCachedSigningLevel2 386 366 | NtSetContextThread 387 367 | NtSetDebugFilterState 388 368 | NtSetDefaultHardErrorPort 389 369 | NtSetDefaultLocale 390 370 | NtSetDefaultUILanguage 391 371 | NtSetDriverEntryOrder 392 372 | NtSetEaFile 393 373 | NtSetEvent 14 374 | NtSetEventBoostPriority 45 375 | NtSetHighEventPair 394 376 | NtSetHighWaitLowEventPair 395 377 | NtSetIRTimer 396 378 | NtSetInformationDebugObject 397 379 | NtSetInformationEnlistment 398 380 | NtSetInformationFile 39 381 | NtSetInformationJobObject 399 382 | NtSetInformationKey 400 383 | NtSetInformationObject 92 384 | NtSetInformationProcess 28 385 | NtSetInformationResourceManager 401 386 | NtSetInformationSymbolicLink 402 387 | NtSetInformationThread 13 388 | NtSetInformationToken 403 389 | NtSetInformationTransaction 404 390 | NtSetInformationTransactionManager 405 391 | NtSetInformationVirtualMemory 406 392 | NtSetInformationWorkerFactory 407 393 | NtSetIntervalProfile 408 394 | NtSetIoCompletion 409 395 | NtSetIoCompletionEx 410 396 | NtSetLdtEntries 411 397 | NtSetLowEventPair 412 398 | NtSetLowWaitHighEventPair 413 399 | NtSetQuotaInformationFile 414 400 | NtSetSecurityObject 415 401 | NtSetSystemEnvironmentValue 416 402 | NtSetSystemEnvironmentValueEx 417 403 | NtSetSystemInformation 418 404 | NtSetSystemPowerState 419 405 | NtSetSystemTime 420 406 | NtSetThreadExecutionState 421 407 | NtSetTimer 98 408 | NtSetTimer2 422 409 | NtSetTimerEx 423 410 | NtSetTimerResolution 424 411 | NtSetUuidSeed 425 412 | NtSetValueKey 96 413 | NtSetVolumeInformationFile 426 414 | NtSetWnfProcessNotificationEvent 427 415 | NtShutdownSystem 428 416 | NtShutdownWorkerFactory 429 417 | NtSignalAndWaitForSingleObject 430 418 | NtSinglePhaseReject 431 419 | NtStartProfile 432 420 | NtStopProfile 433 421 | NtSubscribeWnfStateChange 434 422 | NtSuspendProcess 435 423 | NtSuspendThread 436 424 | NtSystemDebugControl 437 425 | NtTerminateEnclave 438 426 | NtTerminateJobObject 439 427 | NtTerminateProcess 44 428 | NtTerminateThread 83 429 | NtTestAlert 440 430 | NtThawRegistry 441 431 | NtThawTransactions 442 432 | NtTraceControl 443 433 | NtTraceEvent 94 434 | NtTranslateFilePath 444 435 | NtUmsThreadYield 445 436 | NtUnloadDriver 446 437 | NtUnloadKey 447 438 | NtUnloadKey2 448 439 | NtUnloadKeyEx 449 440 | NtUnlockFile 450 441 | NtUnlockVirtualMemory 451 442 | NtUnmapViewOfSection 42 443 | NtUnmapViewOfSectionEx 452 444 | NtUnsubscribeWnfStateChange 453 445 | NtUpdateWnfStateData 454 446 | NtVdmControl 455 447 | NtWaitForAlertByThreadId 456 448 | NtWaitForDebugEvent 457 449 | NtWaitForKeyedEvent 458 450 | NtWaitForMultipleObjects 91 451 | NtWaitForMultipleObjects32 26 452 | NtWaitForSingleObject 4 453 | NtWaitForWorkViaWorkerFactory 459 454 | NtWaitHighEventPair 460 455 | NtWaitLowEventPair 461 456 | NtWorkerFactoryWorkerReady 1 457 | NtWriteFile 8 458 | NtWriteFileGather 27 459 | NtWriteRequestData 87 460 | NtWriteVirtualMemory 58 461 | NtYieldExecution 70 462 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/readme1st.txt: -------------------------------------------------------------------------------- 1 | syscalls composition generated with 2 | 3 | for markdown 4 | sstc -d NT10 5 | sstc -w -d NT10 6 | 7 | for html 8 | sstc -h -d NT10 9 | sstc -h -w -d NT10 10 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/win32k/10240.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/win32k/10240.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/win32k/10586.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/win32k/10586.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/win32k/15063.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/win32k/15063.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/win32k/16299.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/win32k/16299.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/win32k/17134.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/win32k/17134.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT10/win32k/18362.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT10/win32k/18362.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/ntos/3790.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 96 2 | NtAccessCheck 97 3 | NtAccessCheckAndAuditAlarm 38 4 | NtAccessCheckByType 98 5 | NtAccessCheckByTypeAndAuditAlarm 86 6 | NtAccessCheckByTypeResultList 99 7 | NtAccessCheckByTypeResultListAndAuditAlarm 100 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 101 9 | NtAddAtom 68 10 | NtAddBootEntry 102 11 | NtAddDriverEntry 103 12 | NtAdjustGroupsToken 104 13 | NtAdjustPrivilegesToken 62 14 | NtAlertResumeThread 105 15 | NtAlertThread 106 16 | NtAllocateLocallyUniqueId 107 17 | NtAllocateUserPhysicalPages 108 18 | NtAllocateUuids 109 19 | NtAllocateVirtualMemory 21 20 | NtApphelpCacheControl 73 21 | NtAreMappedFilesTheSame 110 22 | NtAssignProcessToJobObject 111 23 | NtCallbackReturn 2 24 | NtCancelDeviceWakeupRequest 112 25 | NtCancelIoFile 90 26 | NtCancelTimer 94 27 | NtClearEvent 59 28 | NtClose 12 29 | NtCloseObjectAuditAlarm 56 30 | NtCompactKeys 113 31 | NtCompareTokens 114 32 | NtCompleteConnectPort 115 33 | NtCompressKey 116 34 | NtConnectPort 117 35 | NtContinue 64 36 | NtCreateDebugObject 118 37 | NtCreateDirectoryObject 119 38 | NtCreateEvent 69 39 | NtCreateEventPair 120 40 | NtCreateFile 82 41 | NtCreateIoCompletion 121 42 | NtCreateJobObject 122 43 | NtCreateJobSet 123 44 | NtCreateKey 26 45 | NtCreateKeyedEvent 124 46 | NtCreateMailslotFile 125 47 | NtCreateMutant 126 48 | NtCreateNamedPipeFile 127 49 | NtCreatePagingFile 128 50 | NtCreatePort 129 51 | NtCreateProcess 130 52 | NtCreateProcessEx 74 53 | NtCreateProfile 131 54 | NtCreateSection 71 55 | NtCreateSemaphore 132 56 | NtCreateSymbolicLinkObject 133 57 | NtCreateThread 75 58 | NtCreateTimer 134 59 | NtCreateToken 135 60 | NtCreateWaitablePort 136 61 | NtDebugActiveProcess 137 62 | NtDebugContinue 138 63 | NtDelayExecution 49 64 | NtDeleteAtom 139 65 | NtDeleteBootEntry 140 66 | NtDeleteDriverEntry 141 67 | NtDeleteFile 142 68 | NtDeleteKey 143 69 | NtDeleteObjectAuditAlarm 144 70 | NtDeleteValueKey 145 71 | NtDeviceIoControlFile 4 72 | NtDisplayString 146 73 | NtDuplicateObject 57 74 | NtDuplicateToken 63 75 | NtEnumerateBootEntries 147 76 | NtEnumerateDriverEntries 148 77 | NtEnumerateKey 47 78 | NtEnumerateSystemEnvironmentValuesEx 149 79 | NtEnumerateValueKey 16 80 | NtExtendSection 150 81 | NtFilterToken 151 82 | NtFindAtom 17 83 | NtFlushBuffersFile 72 84 | NtFlushInstructionCache 152 85 | NtFlushKey 153 86 | NtFlushVirtualMemory 154 87 | NtFlushWriteBuffer 155 88 | NtFreeUserPhysicalPages 156 89 | NtFreeVirtualMemory 27 90 | NtFsControlFile 54 91 | NtGetContextThread 157 92 | NtGetCurrentProcessorNumber 158 93 | NtGetDevicePowerState 159 94 | NtGetPlugPlayEvent 160 95 | NtGetWriteWatch 161 96 | NtImpersonateAnonymousToken 162 97 | NtImpersonateClientOfPort 28 98 | NtImpersonateThread 163 99 | NtInitializeRegistry 164 100 | NtInitiatePowerAction 165 101 | NtIsProcessInJob 76 102 | NtIsSystemResumeAutomatic 166 103 | NtListenPort 167 104 | NtLoadDriver 168 105 | NtLoadKey 169 106 | NtLoadKey2 170 107 | NtLoadKeyEx 171 108 | NtLockFile 172 109 | NtLockProductActivationKeys 173 110 | NtLockRegistryKey 174 111 | NtLockVirtualMemory 175 112 | NtMakePermanentObject 176 113 | NtMakeTemporaryObject 177 114 | NtMapUserPhysicalPages 178 115 | NtMapUserPhysicalPagesScatter 0 116 | NtMapViewOfSection 37 117 | NtModifyBootEntry 179 118 | NtModifyDriverEntry 180 119 | NtNotifyChangeDirectoryFile 181 120 | NtNotifyChangeKey 182 121 | NtNotifyChangeMultipleKeys 183 122 | NtOpenDirectoryObject 85 123 | NtOpenEvent 61 124 | NtOpenEventPair 184 125 | NtOpenFile 48 126 | NtOpenIoCompletion 185 127 | NtOpenJobObject 186 128 | NtOpenKey 15 129 | NtOpenKeyedEvent 187 130 | NtOpenMutant 188 131 | NtOpenObjectAuditAlarm 189 132 | NtOpenProcess 35 133 | NtOpenProcessToken 190 134 | NtOpenProcessTokenEx 45 135 | NtOpenSection 52 136 | NtOpenSemaphore 191 137 | NtOpenSymbolicLinkObject 192 138 | NtOpenThread 193 139 | NtOpenThreadToken 33 140 | NtOpenThreadTokenEx 44 141 | NtOpenTimer 194 142 | NtPlugPlayControl 195 143 | NtPowerInformation 92 144 | NtPrivilegeCheck 196 145 | NtPrivilegedServiceAuditAlarm 198 146 | NtPrivilegeObjectAuditAlarm 197 147 | NtProtectVirtualMemory 77 148 | NtPulseEvent 199 149 | NtQueryAttributesFile 58 150 | NtQueryBootEntryOrder 200 151 | NtQueryBootOptions 201 152 | NtQueryDebugFilterState 202 153 | NtQueryDefaultLocale 18 154 | NtQueryDefaultUILanguage 65 155 | NtQueryDirectoryFile 50 156 | NtQueryDirectoryObject 203 157 | NtQueryDriverEntryOrder 204 158 | NtQueryEaFile 205 159 | NtQueryEvent 83 160 | NtQueryFullAttributesFile 206 161 | NtQueryInformationAtom 207 162 | NtQueryInformationFile 14 163 | NtQueryInformationJobObject 208 164 | NtQueryInformationPort 209 165 | NtQueryInformationProcess 22 166 | NtQueryInformationThread 34 167 | NtQueryInformationToken 30 168 | NtQueryInstallUILanguage 210 169 | NtQueryIntervalProfile 211 170 | NtQueryIoCompletion 212 171 | NtQueryKey 19 172 | NtQueryMultipleValueKey 213 173 | NtQueryMutant 214 174 | NtQueryObject 13 175 | NtQueryOpenSubKeys 215 176 | NtQueryOpenSubKeysEx 216 177 | NtQueryPerformanceCounter 46 178 | NtQueryPortInformationProcess 217 179 | NtQueryQuotaInformationFile 218 180 | NtQuerySection 78 181 | NtQuerySecurityObject 219 182 | NtQuerySemaphore 220 183 | NtQuerySymbolicLinkObject 221 184 | NtQuerySystemEnvironmentValue 222 185 | NtQuerySystemEnvironmentValueEx 223 186 | NtQuerySystemInformation 51 187 | NtQueryTimer 53 188 | NtQueryTimerResolution 224 189 | NtQueryValueKey 20 190 | NtQueryVirtualMemory 32 191 | NtQueryVolumeInformationFile 70 192 | NtQueueApcThread 66 193 | NtRaiseException 225 194 | NtRaiseHardError 226 195 | NtReadFile 3 196 | NtReadFileScatter 43 197 | NtReadRequestData 81 198 | NtReadVirtualMemory 60 199 | NtRegisterThreadTerminatePort 227 200 | NtReleaseKeyedEvent 228 201 | NtReleaseMutant 29 202 | NtReleaseSemaphore 7 203 | NtRemoveIoCompletion 6 204 | NtRemoveProcessDebug 229 205 | NtRenameKey 230 206 | NtReplaceKey 231 207 | NtReplyPort 9 208 | NtReplyWaitReceivePort 8 209 | NtReplyWaitReceivePortEx 40 210 | NtReplyWaitReplyPort 232 211 | NtRequestDeviceWakeup 233 212 | NtRequestPort 234 213 | NtRequestWaitReplyPort 31 214 | NtRequestWakeupLatency 235 215 | NtResetEvent 236 216 | NtResetWriteWatch 237 217 | NtRestoreKey 238 218 | NtResumeProcess 239 219 | NtResumeThread 79 220 | NtSaveKey 240 221 | NtSaveKeyEx 241 222 | NtSaveMergedKeys 242 223 | NtSecureConnectPort 243 224 | NtSetBootEntryOrder 244 225 | NtSetBootOptions 245 226 | NtSetContextThread 246 227 | NtSetDebugFilterState 247 228 | NtSetDefaultHardErrorPort 248 229 | NtSetDefaultLocale 249 230 | NtSetDefaultUILanguage 250 231 | NtSetDriverEntryOrder 251 232 | NtSetEaFile 252 233 | NtSetEvent 11 234 | NtSetEventBoostPriority 42 235 | NtSetHighEventPair 253 236 | NtSetHighWaitLowEventPair 254 237 | NtSetInformationDebugObject 255 238 | NtSetInformationFile 36 239 | NtSetInformationJobObject 256 240 | NtSetInformationKey 257 241 | NtSetInformationObject 89 242 | NtSetInformationProcess 25 243 | NtSetInformationThread 10 244 | NtSetInformationToken 258 245 | NtSetIntervalProfile 259 246 | NtSetIoCompletion 260 247 | NtSetLdtEntries 261 248 | NtSetLowEventPair 262 249 | NtSetLowWaitHighEventPair 263 250 | NtSetQuotaInformationFile 264 251 | NtSetSecurityObject 265 252 | NtSetSystemEnvironmentValue 266 253 | NtSetSystemEnvironmentValueEx 267 254 | NtSetSystemInformation 268 255 | NtSetSystemPowerState 269 256 | NtSetSystemTime 270 257 | NtSetThreadExecutionState 271 258 | NtSetTimer 95 259 | NtSetTimerResolution 272 260 | NtSetUuidSeed 273 261 | NtSetValueKey 93 262 | NtSetVolumeInformationFile 274 263 | NtShutdownSystem 275 264 | NtSignalAndWaitForSingleObject 276 265 | NtStartProfile 277 266 | NtStopProfile 278 267 | NtSuspendProcess 279 268 | NtSuspendThread 280 269 | NtSystemDebugControl 281 270 | NtTerminateJobObject 282 271 | NtTerminateProcess 41 272 | NtTerminateThread 80 273 | NtTestAlert 283 274 | NtTraceEvent 91 275 | NtTranslateFilePath 284 276 | NtUnloadDriver 285 277 | NtUnloadKey 286 278 | NtUnloadKey2 287 279 | NtUnloadKeyEx 288 280 | NtUnlockFile 289 281 | NtUnlockVirtualMemory 290 282 | NtUnmapViewOfSection 39 283 | NtVdmControl 291 284 | NtWaitForDebugEvent 292 285 | NtWaitForKeyedEvent 293 286 | NtWaitForMultipleObjects 88 287 | NtWaitForMultipleObjects32 23 288 | NtWaitForSingleObject 1 289 | NtWaitHighEventPair 294 290 | NtWaitLowEventPair 295 291 | NtWriteFile 5 292 | NtWriteFileGather 24 293 | NtWriteRequestData 84 294 | NtWriteVirtualMemory 55 295 | NtYieldExecution 67 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/ntos/6000.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 96 2 | NtAccessCheck 97 3 | NtAccessCheckAndAuditAlarm 38 4 | NtAccessCheckByType 98 5 | NtAccessCheckByTypeAndAuditAlarm 86 6 | NtAccessCheckByTypeResultList 99 7 | NtAccessCheckByTypeResultListAndAuditAlarm 100 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 101 9 | NtAcquireCMFViewOwnership 102 10 | NtAddAtom 68 11 | NtAddBootEntry 103 12 | NtAddDriverEntry 104 13 | NtAdjustGroupsToken 105 14 | NtAdjustPrivilegesToken 62 15 | NtAlertResumeThread 106 16 | NtAlertThread 107 17 | NtAllocateLocallyUniqueId 108 18 | NtAllocateUserPhysicalPages 109 19 | NtAllocateUuids 110 20 | NtAllocateVirtualMemory 21 21 | NtAlpcAcceptConnectPort 111 22 | NtAlpcCancelMessage 112 23 | NtAlpcConnectPort 113 24 | NtAlpcCreatePort 114 25 | NtAlpcCreatePortSection 115 26 | NtAlpcCreateResourceReserve 116 27 | NtAlpcCreateSectionView 117 28 | NtAlpcCreateSecurityContext 118 29 | NtAlpcDeletePortSection 119 30 | NtAlpcDeleteResourceReserve 120 31 | NtAlpcDeleteSectionView 121 32 | NtAlpcDeleteSecurityContext 122 33 | NtAlpcDisconnectPort 123 34 | NtAlpcImpersonateClientOfPort 124 35 | NtAlpcOpenSenderProcess 125 36 | NtAlpcOpenSenderThread 126 37 | NtAlpcQueryInformation 127 38 | NtAlpcQueryInformationMessage 128 39 | NtAlpcRevokeSecurityContext 129 40 | NtAlpcSendWaitReceivePort 130 41 | NtAlpcSetInformation 131 42 | NtApphelpCacheControl 73 43 | NtAreMappedFilesTheSame 132 44 | NtAssignProcessToJobObject 133 45 | NtCallbackReturn 2 46 | NtCancelDeviceWakeupRequest 134 47 | NtCancelIoFile 90 48 | NtCancelIoFileEx 135 49 | NtCancelSynchronousIoFile 136 50 | NtCancelTimer 94 51 | NtClearAllSavepointsTransaction 137 52 | NtClearEvent 59 53 | NtClearSavepointTransaction 138 54 | NtClose 12 55 | NtCloseObjectAuditAlarm 56 56 | NtCommitComplete 139 57 | NtCommitEnlistment 140 58 | NtCommitTransaction 141 59 | NtCompactKeys 142 60 | NtCompareTokens 143 61 | NtCompleteConnectPort 144 62 | NtCompressKey 145 63 | NtConnectPort 146 64 | NtContinue 64 65 | NtCreateDebugObject 147 66 | NtCreateDirectoryObject 148 67 | NtCreateEnlistment 149 68 | NtCreateEvent 69 69 | NtCreateEventPair 150 70 | NtCreateFile 82 71 | NtCreateIoCompletion 151 72 | NtCreateJobObject 152 73 | NtCreateJobSet 153 74 | NtCreateKey 26 75 | NtCreateKeyedEvent 155 76 | NtCreateKeyTransacted 154 77 | NtCreateMailslotFile 156 78 | NtCreateMutant 157 79 | NtCreateNamedPipeFile 158 80 | NtCreatePagingFile 159 81 | NtCreatePort 160 82 | NtCreatePrivateNamespace 161 83 | NtCreateProcess 162 84 | NtCreateProcessEx 74 85 | NtCreateProfile 163 86 | NtCreateResourceManager 164 87 | NtCreateSection 71 88 | NtCreateSemaphore 165 89 | NtCreateSymbolicLinkObject 166 90 | NtCreateThread 75 91 | NtCreateThreadEx 167 92 | NtCreateTimer 168 93 | NtCreateToken 169 94 | NtCreateTransaction 170 95 | NtCreateTransactionManager 171 96 | NtCreateUserProcess 172 97 | NtCreateWaitablePort 173 98 | NtCreateWorkerFactory 174 99 | NtDebugActiveProcess 175 100 | NtDebugContinue 176 101 | NtDelayExecution 49 102 | NtDeleteAtom 177 103 | NtDeleteBootEntry 178 104 | NtDeleteDriverEntry 179 105 | NtDeleteFile 180 106 | NtDeleteKey 181 107 | NtDeleteObjectAuditAlarm 182 108 | NtDeletePrivateNamespace 183 109 | NtDeleteValueKey 184 110 | NtDeviceIoControlFile 4 111 | NtDisplayString 185 112 | NtDuplicateObject 57 113 | NtDuplicateToken 63 114 | NtEnumerateBootEntries 186 115 | NtEnumerateDriverEntries 187 116 | NtEnumerateKey 47 117 | NtEnumerateSystemEnvironmentValuesEx 188 118 | NtEnumerateTransactionObject 189 119 | NtEnumerateValueKey 16 120 | NtExtendSection 190 121 | NtFilterToken 191 122 | NtFindAtom 17 123 | NtFlushBuffersFile 72 124 | NtFlushInstallUILanguage 192 125 | NtFlushInstructionCache 193 126 | NtFlushKey 194 127 | NtFlushProcessWriteBuffers 195 128 | NtFlushVirtualMemory 196 129 | NtFlushWriteBuffer 197 130 | NtFreeUserPhysicalPages 198 131 | NtFreeVirtualMemory 27 132 | NtFreezeRegistry 199 133 | NtFreezeTransactions 200 134 | NtFsControlFile 54 135 | NtGetContextThread 201 136 | NtGetCurrentProcessorNumber 202 137 | NtGetDevicePowerState 203 138 | NtGetMUIRegistryInfo 204 139 | NtGetNextProcess 205 140 | NtGetNextThread 206 141 | NtGetNlsSectionPtr 207 142 | NtGetNotificationResourceManager 208 143 | NtGetPlugPlayEvent 209 144 | NtGetWriteWatch 210 145 | NtImpersonateAnonymousToken 211 146 | NtImpersonateClientOfPort 28 147 | NtImpersonateThread 212 148 | NtInitializeNlsFiles 213 149 | NtInitializeRegistry 214 150 | NtInitiatePowerAction 215 151 | NtIsProcessInJob 76 152 | NtIsSystemResumeAutomatic 216 153 | NtIsUILanguageComitted 217 154 | NtListenPort 219 155 | NtListTransactions 218 156 | NtLoadDriver 220 157 | NtLoadKey 221 158 | NtLoadKey2 222 159 | NtLoadKeyEx 223 160 | NtLockFile 224 161 | NtLockProductActivationKeys 225 162 | NtLockRegistryKey 226 163 | NtLockVirtualMemory 227 164 | NtMakePermanentObject 228 165 | NtMakeTemporaryObject 229 166 | NtMapCMFModule 230 167 | NtMapUserPhysicalPages 231 168 | NtMapUserPhysicalPagesScatter 0 169 | NtMapViewOfSection 37 170 | NtMarshallTransaction 232 171 | NtModifyBootEntry 233 172 | NtModifyDriverEntry 234 173 | NtNotifyChangeDirectoryFile 235 174 | NtNotifyChangeKey 236 175 | NtNotifyChangeMultipleKeys 237 176 | NtOpenDirectoryObject 85 177 | NtOpenEnlistment 238 178 | NtOpenEvent 61 179 | NtOpenEventPair 239 180 | NtOpenFile 48 181 | NtOpenIoCompletion 240 182 | NtOpenJobObject 241 183 | NtOpenKey 15 184 | NtOpenKeyedEvent 243 185 | NtOpenKeyTransacted 242 186 | NtOpenMutant 244 187 | NtOpenObjectAuditAlarm 245 188 | NtOpenPrivateNamespace 246 189 | NtOpenProcess 35 190 | NtOpenProcessToken 247 191 | NtOpenProcessTokenEx 45 192 | NtOpenResourceManager 248 193 | NtOpenSection 52 194 | NtOpenSemaphore 249 195 | NtOpenSession 250 196 | NtOpenSymbolicLinkObject 251 197 | NtOpenThread 252 198 | NtOpenThreadToken 33 199 | NtOpenThreadTokenEx 44 200 | NtOpenTimer 253 201 | NtOpenTransaction 254 202 | NtOpenTransactionManager 255 203 | NtPlugPlayControl 256 204 | NtPowerInformation 92 205 | NtPrepareComplete 259 206 | NtPrepareEnlistment 260 207 | NtPrePrepareComplete 257 208 | NtPrePrepareEnlistment 258 209 | NtPrivilegeCheck 261 210 | NtPrivilegedServiceAuditAlarm 263 211 | NtPrivilegeObjectAuditAlarm 262 212 | NtPropagationComplete 264 213 | NtPropagationFailed 265 214 | NtProtectVirtualMemory 77 215 | NtPullTransaction 266 216 | NtPulseEvent 267 217 | NtQueryAttributesFile 58 218 | NtQueryBootEntryOrder 268 219 | NtQueryBootOptions 269 220 | NtQueryDebugFilterState 270 221 | NtQueryDefaultLocale 18 222 | NtQueryDefaultUILanguage 65 223 | NtQueryDirectoryFile 50 224 | NtQueryDirectoryObject 271 225 | NtQueryDriverEntryOrder 272 226 | NtQueryEaFile 273 227 | NtQueryEvent 83 228 | NtQueryFullAttributesFile 274 229 | NtQueryInformationAtom 275 230 | NtQueryInformationEnlistment 276 231 | NtQueryInformationFile 14 232 | NtQueryInformationJobObject 277 233 | NtQueryInformationPort 278 234 | NtQueryInformationProcess 22 235 | NtQueryInformationResourceManager 279 236 | NtQueryInformationThread 34 237 | NtQueryInformationToken 30 238 | NtQueryInformationTransaction 280 239 | NtQueryInformationTransactionManager 281 240 | NtQueryInformationWorkerFactory 282 241 | NtQueryInstallUILanguage 283 242 | NtQueryIntervalProfile 284 243 | NtQueryIoCompletion 285 244 | NtQueryKey 19 245 | NtQueryLicenseValue 286 246 | NtQueryMultipleValueKey 287 247 | NtQueryMutant 288 248 | NtQueryObject 13 249 | NtQueryOpenSubKeys 289 250 | NtQueryOpenSubKeysEx 290 251 | NtQueryPerformanceCounter 46 252 | NtQueryPortInformationProcess 291 253 | NtQueryQuotaInformationFile 292 254 | NtQuerySection 78 255 | NtQuerySecurityObject 293 256 | NtQuerySemaphore 294 257 | NtQuerySymbolicLinkObject 295 258 | NtQuerySystemEnvironmentValue 296 259 | NtQuerySystemEnvironmentValueEx 297 260 | NtQuerySystemInformation 51 261 | NtQueryTimer 53 262 | NtQueryTimerResolution 298 263 | NtQueryValueKey 20 264 | NtQueryVirtualMemory 32 265 | NtQueryVolumeInformationFile 70 266 | NtQueueApcThread 66 267 | NtRaiseException 299 268 | NtRaiseHardError 300 269 | NtReadFile 3 270 | NtReadFileScatter 43 271 | NtReadOnlyEnlistment 301 272 | NtReadRequestData 81 273 | NtReadVirtualMemory 60 274 | NtRecoverEnlistment 302 275 | NtRecoverResourceManager 303 276 | NtRecoverTransactionManager 304 277 | NtRegisterProtocolAddressInformation 305 278 | NtRegisterThreadTerminatePort 306 279 | NtReleaseCMFViewOwnership 307 280 | NtReleaseKeyedEvent 308 281 | NtReleaseMutant 29 282 | NtReleaseSemaphore 7 283 | NtReleaseWorkerFactoryWorker 309 284 | NtRemoveIoCompletion 6 285 | NtRemoveIoCompletionEx 310 286 | NtRemoveProcessDebug 311 287 | NtRenameKey 312 288 | NtReplaceKey 313 289 | NtReplyPort 9 290 | NtReplyWaitReceivePort 8 291 | NtReplyWaitReceivePortEx 40 292 | NtReplyWaitReplyPort 314 293 | NtRequestDeviceWakeup 315 294 | NtRequestPort 316 295 | NtRequestWaitReplyPort 31 296 | NtRequestWakeupLatency 317 297 | NtResetEvent 318 298 | NtResetWriteWatch 319 299 | NtRestoreKey 320 300 | NtResumeProcess 321 301 | NtResumeThread 79 302 | NtRollbackComplete 322 303 | NtRollbackEnlistment 323 304 | NtRollbackSavepointTransaction 324 305 | NtRollbackTransaction 325 306 | NtRollforwardTransactionManager 326 307 | NtSaveKey 327 308 | NtSaveKeyEx 328 309 | NtSaveMergedKeys 329 310 | NtSavepointComplete 330 311 | NtSavepointTransaction 331 312 | NtSecureConnectPort 332 313 | NtSetBootEntryOrder 333 314 | NtSetBootOptions 334 315 | NtSetContextThread 335 316 | NtSetDebugFilterState 336 317 | NtSetDefaultHardErrorPort 337 318 | NtSetDefaultLocale 338 319 | NtSetDefaultUILanguage 339 320 | NtSetDriverEntryOrder 340 321 | NtSetEaFile 341 322 | NtSetEvent 11 323 | NtSetEventBoostPriority 42 324 | NtSetHighEventPair 342 325 | NtSetHighWaitLowEventPair 343 326 | NtSetInformationDebugObject 344 327 | NtSetInformationEnlistment 345 328 | NtSetInformationFile 36 329 | NtSetInformationJobObject 346 330 | NtSetInformationKey 347 331 | NtSetInformationObject 89 332 | NtSetInformationProcess 25 333 | NtSetInformationResourceManager 348 334 | NtSetInformationThread 10 335 | NtSetInformationToken 349 336 | NtSetInformationTransaction 350 337 | NtSetInformationTransactionManager 351 338 | NtSetInformationWorkerFactory 352 339 | NtSetIntervalProfile 353 340 | NtSetIoCompletion 354 341 | NtSetLdtEntries 355 342 | NtSetLowEventPair 356 343 | NtSetLowWaitHighEventPair 357 344 | NtSetQuotaInformationFile 358 345 | NtSetSecurityObject 359 346 | NtSetSystemEnvironmentValue 360 347 | NtSetSystemEnvironmentValueEx 361 348 | NtSetSystemInformation 362 349 | NtSetSystemPowerState 363 350 | NtSetSystemTime 364 351 | NtSetThreadExecutionState 365 352 | NtSetTimer 95 353 | NtSetTimerResolution 366 354 | NtSetUuidSeed 367 355 | NtSetValueKey 93 356 | NtSetVolumeInformationFile 368 357 | NtShutdownSystem 369 358 | NtShutdownWorkerFactory 370 359 | NtSignalAndWaitForSingleObject 371 360 | NtSinglePhaseReject 372 361 | NtStartProfile 373 362 | NtStartTm 374 363 | NtStopProfile 375 364 | NtSuspendProcess 376 365 | NtSuspendThread 377 366 | NtSystemDebugControl 378 367 | NtTerminateJobObject 379 368 | NtTerminateProcess 41 369 | NtTerminateThread 80 370 | NtTestAlert 380 371 | NtThawRegistry 381 372 | NtThawTransactions 382 373 | NtTraceControl 383 374 | NtTraceEvent 91 375 | NtTranslateFilePath 384 376 | NtUnloadDriver 385 377 | NtUnloadKey 386 378 | NtUnloadKey2 387 379 | NtUnloadKeyEx 388 380 | NtUnlockFile 389 381 | NtUnlockVirtualMemory 390 382 | NtUnmapViewOfSection 39 383 | NtVdmControl 391 384 | NtWaitForDebugEvent 392 385 | NtWaitForKeyedEvent 393 386 | NtWaitForMultipleObjects 88 387 | NtWaitForMultipleObjects32 23 388 | NtWaitForSingleObject 1 389 | NtWaitForWorkViaWorkerFactory 394 390 | NtWaitHighEventPair 395 391 | NtWaitLowEventPair 396 392 | NtWorkerFactoryWorkerReady 397 393 | NtWriteFile 5 394 | NtWriteFileGather 24 395 | NtWriteRequestData 84 396 | NtWriteVirtualMemory 55 397 | NtYieldExecution 67 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/ntos/6002.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 96 2 | NtAccessCheck 97 3 | NtAccessCheckAndAuditAlarm 38 4 | NtAccessCheckByType 98 5 | NtAccessCheckByTypeAndAuditAlarm 86 6 | NtAccessCheckByTypeResultList 99 7 | NtAccessCheckByTypeResultListAndAuditAlarm 100 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 101 9 | NtAcquireCMFViewOwnership 102 10 | NtAddAtom 68 11 | NtAddBootEntry 103 12 | NtAddDriverEntry 104 13 | NtAdjustGroupsToken 105 14 | NtAdjustPrivilegesToken 62 15 | NtAlertResumeThread 106 16 | NtAlertThread 107 17 | NtAllocateLocallyUniqueId 108 18 | NtAllocateUserPhysicalPages 109 19 | NtAllocateUuids 110 20 | NtAllocateVirtualMemory 21 21 | NtAlpcAcceptConnectPort 111 22 | NtAlpcCancelMessage 112 23 | NtAlpcConnectPort 113 24 | NtAlpcCreatePort 114 25 | NtAlpcCreatePortSection 115 26 | NtAlpcCreateResourceReserve 116 27 | NtAlpcCreateSectionView 117 28 | NtAlpcCreateSecurityContext 118 29 | NtAlpcDeletePortSection 119 30 | NtAlpcDeleteResourceReserve 120 31 | NtAlpcDeleteSectionView 121 32 | NtAlpcDeleteSecurityContext 122 33 | NtAlpcDisconnectPort 123 34 | NtAlpcImpersonateClientOfPort 124 35 | NtAlpcOpenSenderProcess 125 36 | NtAlpcOpenSenderThread 126 37 | NtAlpcQueryInformation 127 38 | NtAlpcQueryInformationMessage 128 39 | NtAlpcRevokeSecurityContext 129 40 | NtAlpcSendWaitReceivePort 130 41 | NtAlpcSetInformation 131 42 | NtApphelpCacheControl 73 43 | NtAreMappedFilesTheSame 132 44 | NtAssignProcessToJobObject 133 45 | NtCallbackReturn 2 46 | NtCancelDeviceWakeupRequest 134 47 | NtCancelIoFile 90 48 | NtCancelIoFileEx 135 49 | NtCancelSynchronousIoFile 136 50 | NtCancelTimer 94 51 | NtClearEvent 59 52 | NtClose 12 53 | NtCloseObjectAuditAlarm 56 54 | NtCommitComplete 137 55 | NtCommitEnlistment 138 56 | NtCommitTransaction 139 57 | NtCompactKeys 140 58 | NtCompareTokens 141 59 | NtCompleteConnectPort 142 60 | NtCompressKey 143 61 | NtConnectPort 144 62 | NtContinue 64 63 | NtCreateDebugObject 145 64 | NtCreateDirectoryObject 146 65 | NtCreateEnlistment 147 66 | NtCreateEvent 69 67 | NtCreateEventPair 148 68 | NtCreateFile 82 69 | NtCreateIoCompletion 149 70 | NtCreateJobObject 150 71 | NtCreateJobSet 151 72 | NtCreateKey 26 73 | NtCreateKeyedEvent 153 74 | NtCreateKeyTransacted 152 75 | NtCreateMailslotFile 154 76 | NtCreateMutant 155 77 | NtCreateNamedPipeFile 156 78 | NtCreatePagingFile 157 79 | NtCreatePort 158 80 | NtCreatePrivateNamespace 159 81 | NtCreateProcess 160 82 | NtCreateProcessEx 74 83 | NtCreateProfile 161 84 | NtCreateResourceManager 162 85 | NtCreateSection 71 86 | NtCreateSemaphore 163 87 | NtCreateSymbolicLinkObject 164 88 | NtCreateThread 75 89 | NtCreateThreadEx 165 90 | NtCreateTimer 166 91 | NtCreateToken 167 92 | NtCreateTransaction 168 93 | NtCreateTransactionManager 169 94 | NtCreateUserProcess 170 95 | NtCreateWaitablePort 171 96 | NtCreateWorkerFactory 172 97 | NtDebugActiveProcess 173 98 | NtDebugContinue 174 99 | NtDelayExecution 49 100 | NtDeleteAtom 175 101 | NtDeleteBootEntry 176 102 | NtDeleteDriverEntry 177 103 | NtDeleteFile 178 104 | NtDeleteKey 179 105 | NtDeleteObjectAuditAlarm 180 106 | NtDeletePrivateNamespace 181 107 | NtDeleteValueKey 182 108 | NtDeviceIoControlFile 4 109 | NtDisplayString 183 110 | NtDuplicateObject 57 111 | NtDuplicateToken 63 112 | NtEnumerateBootEntries 184 113 | NtEnumerateDriverEntries 185 114 | NtEnumerateKey 47 115 | NtEnumerateSystemEnvironmentValuesEx 186 116 | NtEnumerateTransactionObject 187 117 | NtEnumerateValueKey 16 118 | NtExtendSection 188 119 | NtFilterToken 189 120 | NtFindAtom 17 121 | NtFlushBuffersFile 72 122 | NtFlushInstallUILanguage 190 123 | NtFlushInstructionCache 191 124 | NtFlushKey 192 125 | NtFlushProcessWriteBuffers 193 126 | NtFlushVirtualMemory 194 127 | NtFlushWriteBuffer 195 128 | NtFreeUserPhysicalPages 196 129 | NtFreeVirtualMemory 27 130 | NtFreezeRegistry 197 131 | NtFreezeTransactions 198 132 | NtFsControlFile 54 133 | NtGetContextThread 199 134 | NtGetCurrentProcessorNumber 200 135 | NtGetDevicePowerState 201 136 | NtGetMUIRegistryInfo 202 137 | NtGetNextProcess 203 138 | NtGetNextThread 204 139 | NtGetNlsSectionPtr 205 140 | NtGetNotificationResourceManager 206 141 | NtGetPlugPlayEvent 207 142 | NtGetWriteWatch 208 143 | NtImpersonateAnonymousToken 209 144 | NtImpersonateClientOfPort 28 145 | NtImpersonateThread 210 146 | NtInitializeNlsFiles 211 147 | NtInitializeRegistry 212 148 | NtInitiatePowerAction 213 149 | NtIsProcessInJob 76 150 | NtIsSystemResumeAutomatic 214 151 | NtIsUILanguageComitted 215 152 | NtListenPort 216 153 | NtLoadDriver 217 154 | NtLoadKey 218 155 | NtLoadKey2 219 156 | NtLoadKeyEx 220 157 | NtLockFile 221 158 | NtLockProductActivationKeys 222 159 | NtLockRegistryKey 223 160 | NtLockVirtualMemory 224 161 | NtMakePermanentObject 225 162 | NtMakeTemporaryObject 226 163 | NtMapCMFModule 227 164 | NtMapUserPhysicalPages 228 165 | NtMapUserPhysicalPagesScatter 0 166 | NtMapViewOfSection 37 167 | NtModifyBootEntry 229 168 | NtModifyDriverEntry 230 169 | NtNotifyChangeDirectoryFile 231 170 | NtNotifyChangeKey 232 171 | NtNotifyChangeMultipleKeys 233 172 | NtOpenDirectoryObject 85 173 | NtOpenEnlistment 234 174 | NtOpenEvent 61 175 | NtOpenEventPair 235 176 | NtOpenFile 48 177 | NtOpenIoCompletion 236 178 | NtOpenJobObject 237 179 | NtOpenKey 15 180 | NtOpenKeyedEvent 239 181 | NtOpenKeyTransacted 238 182 | NtOpenMutant 240 183 | NtOpenObjectAuditAlarm 241 184 | NtOpenPrivateNamespace 242 185 | NtOpenProcess 35 186 | NtOpenProcessToken 243 187 | NtOpenProcessTokenEx 45 188 | NtOpenResourceManager 244 189 | NtOpenSection 52 190 | NtOpenSemaphore 245 191 | NtOpenSession 246 192 | NtOpenSymbolicLinkObject 247 193 | NtOpenThread 248 194 | NtOpenThreadToken 33 195 | NtOpenThreadTokenEx 44 196 | NtOpenTimer 249 197 | NtOpenTransaction 250 198 | NtOpenTransactionManager 251 199 | NtPlugPlayControl 252 200 | NtPowerInformation 92 201 | NtPrepareComplete 255 202 | NtPrepareEnlistment 256 203 | NtPrePrepareComplete 253 204 | NtPrePrepareEnlistment 254 205 | NtPrivilegeCheck 257 206 | NtPrivilegedServiceAuditAlarm 259 207 | NtPrivilegeObjectAuditAlarm 258 208 | NtPropagationComplete 260 209 | NtPropagationFailed 261 210 | NtProtectVirtualMemory 77 211 | NtPulseEvent 262 212 | NtQueryAttributesFile 58 213 | NtQueryBootEntryOrder 263 214 | NtQueryBootOptions 264 215 | NtQueryDebugFilterState 265 216 | NtQueryDefaultLocale 18 217 | NtQueryDefaultUILanguage 65 218 | NtQueryDirectoryFile 50 219 | NtQueryDirectoryObject 266 220 | NtQueryDriverEntryOrder 267 221 | NtQueryEaFile 268 222 | NtQueryEvent 83 223 | NtQueryFullAttributesFile 269 224 | NtQueryInformationAtom 270 225 | NtQueryInformationEnlistment 271 226 | NtQueryInformationFile 14 227 | NtQueryInformationJobObject 272 228 | NtQueryInformationPort 273 229 | NtQueryInformationProcess 22 230 | NtQueryInformationResourceManager 274 231 | NtQueryInformationThread 34 232 | NtQueryInformationToken 30 233 | NtQueryInformationTransaction 275 234 | NtQueryInformationTransactionManager 276 235 | NtQueryInformationWorkerFactory 277 236 | NtQueryInstallUILanguage 278 237 | NtQueryIntervalProfile 279 238 | NtQueryIoCompletion 280 239 | NtQueryKey 19 240 | NtQueryLicenseValue 281 241 | NtQueryMultipleValueKey 282 242 | NtQueryMutant 283 243 | NtQueryObject 13 244 | NtQueryOpenSubKeys 284 245 | NtQueryOpenSubKeysEx 285 246 | NtQueryPerformanceCounter 46 247 | NtQueryPortInformationProcess 286 248 | NtQueryQuotaInformationFile 287 249 | NtQuerySection 78 250 | NtQuerySecurityObject 288 251 | NtQuerySemaphore 289 252 | NtQuerySymbolicLinkObject 290 253 | NtQuerySystemEnvironmentValue 291 254 | NtQuerySystemEnvironmentValueEx 292 255 | NtQuerySystemInformation 51 256 | NtQueryTimer 53 257 | NtQueryTimerResolution 293 258 | NtQueryValueKey 20 259 | NtQueryVirtualMemory 32 260 | NtQueryVolumeInformationFile 70 261 | NtQueueApcThread 66 262 | NtRaiseException 294 263 | NtRaiseHardError 295 264 | NtReadFile 3 265 | NtReadFileScatter 43 266 | NtReadOnlyEnlistment 296 267 | NtReadRequestData 81 268 | NtReadVirtualMemory 60 269 | NtRecoverEnlistment 297 270 | NtRecoverResourceManager 298 271 | NtRecoverTransactionManager 299 272 | NtRegisterProtocolAddressInformation 300 273 | NtRegisterThreadTerminatePort 301 274 | NtReleaseCMFViewOwnership 302 275 | NtReleaseKeyedEvent 303 276 | NtReleaseMutant 29 277 | NtReleaseSemaphore 7 278 | NtReleaseWorkerFactoryWorker 304 279 | NtRemoveIoCompletion 6 280 | NtRemoveIoCompletionEx 305 281 | NtRemoveProcessDebug 306 282 | NtRenameKey 307 283 | NtRenameTransactionManager 308 284 | NtReplaceKey 309 285 | NtReplacePartitionUnit 310 286 | NtReplyPort 9 287 | NtReplyWaitReceivePort 8 288 | NtReplyWaitReceivePortEx 40 289 | NtReplyWaitReplyPort 311 290 | NtRequestDeviceWakeup 312 291 | NtRequestPort 313 292 | NtRequestWaitReplyPort 31 293 | NtRequestWakeupLatency 314 294 | NtResetEvent 315 295 | NtResetWriteWatch 316 296 | NtRestoreKey 317 297 | NtResumeProcess 318 298 | NtResumeThread 79 299 | NtRollbackComplete 319 300 | NtRollbackEnlistment 320 301 | NtRollbackTransaction 321 302 | NtRollforwardTransactionManager 322 303 | NtSaveKey 323 304 | NtSaveKeyEx 324 305 | NtSaveMergedKeys 325 306 | NtSecureConnectPort 326 307 | NtSetBootEntryOrder 327 308 | NtSetBootOptions 328 309 | NtSetContextThread 329 310 | NtSetDebugFilterState 330 311 | NtSetDefaultHardErrorPort 331 312 | NtSetDefaultLocale 332 313 | NtSetDefaultUILanguage 333 314 | NtSetDriverEntryOrder 334 315 | NtSetEaFile 335 316 | NtSetEvent 11 317 | NtSetEventBoostPriority 42 318 | NtSetHighEventPair 336 319 | NtSetHighWaitLowEventPair 337 320 | NtSetInformationDebugObject 338 321 | NtSetInformationEnlistment 339 322 | NtSetInformationFile 36 323 | NtSetInformationJobObject 340 324 | NtSetInformationKey 341 325 | NtSetInformationObject 89 326 | NtSetInformationProcess 25 327 | NtSetInformationResourceManager 342 328 | NtSetInformationThread 10 329 | NtSetInformationToken 343 330 | NtSetInformationTransaction 344 331 | NtSetInformationTransactionManager 345 332 | NtSetInformationWorkerFactory 346 333 | NtSetIntervalProfile 347 334 | NtSetIoCompletion 348 335 | NtSetLdtEntries 349 336 | NtSetLowEventPair 350 337 | NtSetLowWaitHighEventPair 351 338 | NtSetQuotaInformationFile 352 339 | NtSetSecurityObject 353 340 | NtSetSystemEnvironmentValue 354 341 | NtSetSystemEnvironmentValueEx 355 342 | NtSetSystemInformation 356 343 | NtSetSystemPowerState 357 344 | NtSetSystemTime 358 345 | NtSetThreadExecutionState 359 346 | NtSetTimer 95 347 | NtSetTimerResolution 360 348 | NtSetUuidSeed 361 349 | NtSetValueKey 93 350 | NtSetVolumeInformationFile 362 351 | NtShutdownSystem 363 352 | NtShutdownWorkerFactory 364 353 | NtSignalAndWaitForSingleObject 365 354 | NtSinglePhaseReject 366 355 | NtStartProfile 367 356 | NtStopProfile 368 357 | NtSuspendProcess 369 358 | NtSuspendThread 370 359 | NtSystemDebugControl 371 360 | NtTerminateJobObject 372 361 | NtTerminateProcess 41 362 | NtTerminateThread 80 363 | NtTestAlert 373 364 | NtThawRegistry 374 365 | NtThawTransactions 375 366 | NtTraceControl 376 367 | NtTraceEvent 91 368 | NtTranslateFilePath 377 369 | NtUnloadDriver 378 370 | NtUnloadKey 379 371 | NtUnloadKey2 380 372 | NtUnloadKeyEx 381 373 | NtUnlockFile 382 374 | NtUnlockVirtualMemory 383 375 | NtUnmapViewOfSection 39 376 | NtVdmControl 384 377 | NtWaitForDebugEvent 385 378 | NtWaitForKeyedEvent 386 379 | NtWaitForMultipleObjects 88 380 | NtWaitForMultipleObjects32 23 381 | NtWaitForSingleObject 1 382 | NtWaitForWorkViaWorkerFactory 387 383 | NtWaitHighEventPair 388 384 | NtWaitLowEventPair 389 385 | NtWorkerFactoryWorkerReady 390 386 | NtWriteFile 5 387 | NtWriteFileGather 24 388 | NtWriteRequestData 84 389 | NtWriteVirtualMemory 55 390 | NtYieldExecution 67 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/ntos/7601.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 96 2 | NtAccessCheck 97 3 | NtAccessCheckAndAuditAlarm 38 4 | NtAccessCheckByType 98 5 | NtAccessCheckByTypeAndAuditAlarm 86 6 | NtAccessCheckByTypeResultList 99 7 | NtAccessCheckByTypeResultListAndAuditAlarm 100 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 101 9 | NtAddAtom 68 10 | NtAddBootEntry 102 11 | NtAddDriverEntry 103 12 | NtAdjustGroupsToken 104 13 | NtAdjustPrivilegesToken 62 14 | NtAlertResumeThread 105 15 | NtAlertThread 106 16 | NtAllocateLocallyUniqueId 107 17 | NtAllocateReserveObject 108 18 | NtAllocateUserPhysicalPages 109 19 | NtAllocateUuids 110 20 | NtAllocateVirtualMemory 21 21 | NtAlpcAcceptConnectPort 111 22 | NtAlpcCancelMessage 112 23 | NtAlpcConnectPort 113 24 | NtAlpcCreatePort 114 25 | NtAlpcCreatePortSection 115 26 | NtAlpcCreateResourceReserve 116 27 | NtAlpcCreateSectionView 117 28 | NtAlpcCreateSecurityContext 118 29 | NtAlpcDeletePortSection 119 30 | NtAlpcDeleteResourceReserve 120 31 | NtAlpcDeleteSectionView 121 32 | NtAlpcDeleteSecurityContext 122 33 | NtAlpcDisconnectPort 123 34 | NtAlpcImpersonateClientOfPort 124 35 | NtAlpcOpenSenderProcess 125 36 | NtAlpcOpenSenderThread 126 37 | NtAlpcQueryInformation 127 38 | NtAlpcQueryInformationMessage 128 39 | NtAlpcRevokeSecurityContext 129 40 | NtAlpcSendWaitReceivePort 130 41 | NtAlpcSetInformation 131 42 | NtApphelpCacheControl 73 43 | NtAreMappedFilesTheSame 132 44 | NtAssignProcessToJobObject 133 45 | NtCallbackReturn 2 46 | NtCancelIoFile 90 47 | NtCancelIoFileEx 134 48 | NtCancelSynchronousIoFile 135 49 | NtCancelTimer 94 50 | NtClearEvent 59 51 | NtClose 12 52 | NtCloseObjectAuditAlarm 56 53 | NtCommitComplete 136 54 | NtCommitEnlistment 137 55 | NtCommitTransaction 138 56 | NtCompactKeys 139 57 | NtCompareTokens 140 58 | NtCompleteConnectPort 141 59 | NtCompressKey 142 60 | NtConnectPort 143 61 | NtContinue 64 62 | NtCreateDebugObject 144 63 | NtCreateDirectoryObject 145 64 | NtCreateEnlistment 146 65 | NtCreateEvent 69 66 | NtCreateEventPair 147 67 | NtCreateFile 82 68 | NtCreateIoCompletion 148 69 | NtCreateJobObject 149 70 | NtCreateJobSet 150 71 | NtCreateKey 26 72 | NtCreateKeyTransacted 151 73 | NtCreateKeyedEvent 152 74 | NtCreateMailslotFile 153 75 | NtCreateMutant 154 76 | NtCreateNamedPipeFile 155 77 | NtCreatePagingFile 156 78 | NtCreatePort 157 79 | NtCreatePrivateNamespace 158 80 | NtCreateProcess 159 81 | NtCreateProcessEx 74 82 | NtCreateProfile 160 83 | NtCreateProfileEx 161 84 | NtCreateResourceManager 162 85 | NtCreateSection 71 86 | NtCreateSemaphore 163 87 | NtCreateSymbolicLinkObject 164 88 | NtCreateThread 75 89 | NtCreateThreadEx 165 90 | NtCreateTimer 166 91 | NtCreateToken 167 92 | NtCreateTransaction 168 93 | NtCreateTransactionManager 169 94 | NtCreateUserProcess 170 95 | NtCreateWaitablePort 171 96 | NtCreateWorkerFactory 172 97 | NtDebugActiveProcess 173 98 | NtDebugContinue 174 99 | NtDelayExecution 49 100 | NtDeleteAtom 175 101 | NtDeleteBootEntry 176 102 | NtDeleteDriverEntry 177 103 | NtDeleteFile 178 104 | NtDeleteKey 179 105 | NtDeleteObjectAuditAlarm 180 106 | NtDeletePrivateNamespace 181 107 | NtDeleteValueKey 182 108 | NtDeviceIoControlFile 4 109 | NtDisableLastKnownGood 183 110 | NtDisplayString 184 111 | NtDrawText 185 112 | NtDuplicateObject 57 113 | NtDuplicateToken 63 114 | NtEnableLastKnownGood 186 115 | NtEnumerateBootEntries 187 116 | NtEnumerateDriverEntries 188 117 | NtEnumerateKey 47 118 | NtEnumerateSystemEnvironmentValuesEx 189 119 | NtEnumerateTransactionObject 190 120 | NtEnumerateValueKey 16 121 | NtExtendSection 191 122 | NtFilterToken 192 123 | NtFindAtom 17 124 | NtFlushBuffersFile 72 125 | NtFlushInstallUILanguage 193 126 | NtFlushInstructionCache 194 127 | NtFlushKey 195 128 | NtFlushProcessWriteBuffers 196 129 | NtFlushVirtualMemory 197 130 | NtFlushWriteBuffer 198 131 | NtFreeUserPhysicalPages 199 132 | NtFreeVirtualMemory 27 133 | NtFreezeRegistry 200 134 | NtFreezeTransactions 201 135 | NtFsControlFile 54 136 | NtGetContextThread 202 137 | NtGetCurrentProcessorNumber 203 138 | NtGetDevicePowerState 204 139 | NtGetMUIRegistryInfo 205 140 | NtGetNextProcess 206 141 | NtGetNextThread 207 142 | NtGetNlsSectionPtr 208 143 | NtGetNotificationResourceManager 209 144 | NtGetPlugPlayEvent 210 145 | NtGetWriteWatch 211 146 | NtImpersonateAnonymousToken 212 147 | NtImpersonateClientOfPort 28 148 | NtImpersonateThread 213 149 | NtInitializeNlsFiles 214 150 | NtInitializeRegistry 215 151 | NtInitiatePowerAction 216 152 | NtIsProcessInJob 76 153 | NtIsSystemResumeAutomatic 217 154 | NtIsUILanguageComitted 218 155 | NtListenPort 219 156 | NtLoadDriver 220 157 | NtLoadKey 221 158 | NtLoadKey2 222 159 | NtLoadKeyEx 223 160 | NtLockFile 224 161 | NtLockProductActivationKeys 225 162 | NtLockRegistryKey 226 163 | NtLockVirtualMemory 227 164 | NtMakePermanentObject 228 165 | NtMakeTemporaryObject 229 166 | NtMapCMFModule 230 167 | NtMapUserPhysicalPages 231 168 | NtMapUserPhysicalPagesScatter 0 169 | NtMapViewOfSection 37 170 | NtModifyBootEntry 232 171 | NtModifyDriverEntry 233 172 | NtNotifyChangeDirectoryFile 234 173 | NtNotifyChangeKey 235 174 | NtNotifyChangeMultipleKeys 236 175 | NtNotifyChangeSession 237 176 | NtOpenDirectoryObject 85 177 | NtOpenEnlistment 238 178 | NtOpenEvent 61 179 | NtOpenEventPair 239 180 | NtOpenFile 48 181 | NtOpenIoCompletion 240 182 | NtOpenJobObject 241 183 | NtOpenKey 15 184 | NtOpenKeyEx 242 185 | NtOpenKeyTransacted 243 186 | NtOpenKeyTransactedEx 244 187 | NtOpenKeyedEvent 245 188 | NtOpenMutant 246 189 | NtOpenObjectAuditAlarm 247 190 | NtOpenPrivateNamespace 248 191 | NtOpenProcess 35 192 | NtOpenProcessToken 249 193 | NtOpenProcessTokenEx 45 194 | NtOpenResourceManager 250 195 | NtOpenSection 52 196 | NtOpenSemaphore 251 197 | NtOpenSession 252 198 | NtOpenSymbolicLinkObject 253 199 | NtOpenThread 254 200 | NtOpenThreadToken 33 201 | NtOpenThreadTokenEx 44 202 | NtOpenTimer 255 203 | NtOpenTransaction 256 204 | NtOpenTransactionManager 257 205 | NtPlugPlayControl 258 206 | NtPowerInformation 92 207 | NtPrePrepareComplete 259 208 | NtPrePrepareEnlistment 260 209 | NtPrepareComplete 261 210 | NtPrepareEnlistment 262 211 | NtPrivilegeCheck 263 212 | NtPrivilegeObjectAuditAlarm 264 213 | NtPrivilegedServiceAuditAlarm 265 214 | NtPropagationComplete 266 215 | NtPropagationFailed 267 216 | NtProtectVirtualMemory 77 217 | NtPulseEvent 268 218 | NtQueryAttributesFile 58 219 | NtQueryBootEntryOrder 269 220 | NtQueryBootOptions 270 221 | NtQueryDebugFilterState 271 222 | NtQueryDefaultLocale 18 223 | NtQueryDefaultUILanguage 65 224 | NtQueryDirectoryFile 50 225 | NtQueryDirectoryObject 272 226 | NtQueryDriverEntryOrder 273 227 | NtQueryEaFile 274 228 | NtQueryEvent 83 229 | NtQueryFullAttributesFile 275 230 | NtQueryInformationAtom 276 231 | NtQueryInformationEnlistment 277 232 | NtQueryInformationFile 14 233 | NtQueryInformationJobObject 278 234 | NtQueryInformationPort 279 235 | NtQueryInformationProcess 22 236 | NtQueryInformationResourceManager 280 237 | NtQueryInformationThread 34 238 | NtQueryInformationToken 30 239 | NtQueryInformationTransaction 281 240 | NtQueryInformationTransactionManager 282 241 | NtQueryInformationWorkerFactory 283 242 | NtQueryInstallUILanguage 284 243 | NtQueryIntervalProfile 285 244 | NtQueryIoCompletion 286 245 | NtQueryKey 19 246 | NtQueryLicenseValue 287 247 | NtQueryMultipleValueKey 288 248 | NtQueryMutant 289 249 | NtQueryObject 13 250 | NtQueryOpenSubKeys 290 251 | NtQueryOpenSubKeysEx 291 252 | NtQueryPerformanceCounter 46 253 | NtQueryPortInformationProcess 292 254 | NtQueryQuotaInformationFile 293 255 | NtQuerySection 78 256 | NtQuerySecurityAttributesToken 294 257 | NtQuerySecurityObject 295 258 | NtQuerySemaphore 296 259 | NtQuerySymbolicLinkObject 297 260 | NtQuerySystemEnvironmentValue 298 261 | NtQuerySystemEnvironmentValueEx 299 262 | NtQuerySystemInformation 51 263 | NtQuerySystemInformationEx 300 264 | NtQueryTimer 53 265 | NtQueryTimerResolution 301 266 | NtQueryValueKey 20 267 | NtQueryVirtualMemory 32 268 | NtQueryVolumeInformationFile 70 269 | NtQueueApcThread 66 270 | NtQueueApcThreadEx 302 271 | NtRaiseException 303 272 | NtRaiseHardError 304 273 | NtReadFile 3 274 | NtReadFileScatter 43 275 | NtReadOnlyEnlistment 305 276 | NtReadRequestData 81 277 | NtReadVirtualMemory 60 278 | NtRecoverEnlistment 306 279 | NtRecoverResourceManager 307 280 | NtRecoverTransactionManager 308 281 | NtRegisterProtocolAddressInformation 309 282 | NtRegisterThreadTerminatePort 310 283 | NtReleaseKeyedEvent 311 284 | NtReleaseMutant 29 285 | NtReleaseSemaphore 7 286 | NtReleaseWorkerFactoryWorker 312 287 | NtRemoveIoCompletion 6 288 | NtRemoveIoCompletionEx 313 289 | NtRemoveProcessDebug 314 290 | NtRenameKey 315 291 | NtRenameTransactionManager 316 292 | NtReplaceKey 317 293 | NtReplacePartitionUnit 318 294 | NtReplyPort 9 295 | NtReplyWaitReceivePort 8 296 | NtReplyWaitReceivePortEx 40 297 | NtReplyWaitReplyPort 319 298 | NtRequestPort 320 299 | NtRequestWaitReplyPort 31 300 | NtResetEvent 321 301 | NtResetWriteWatch 322 302 | NtRestoreKey 323 303 | NtResumeProcess 324 304 | NtResumeThread 79 305 | NtRollbackComplete 325 306 | NtRollbackEnlistment 326 307 | NtRollbackTransaction 327 308 | NtRollforwardTransactionManager 328 309 | NtSaveKey 329 310 | NtSaveKeyEx 330 311 | NtSaveMergedKeys 331 312 | NtSecureConnectPort 332 313 | NtSerializeBoot 333 314 | NtSetBootEntryOrder 334 315 | NtSetBootOptions 335 316 | NtSetContextThread 336 317 | NtSetDebugFilterState 337 318 | NtSetDefaultHardErrorPort 338 319 | NtSetDefaultLocale 339 320 | NtSetDefaultUILanguage 340 321 | NtSetDriverEntryOrder 341 322 | NtSetEaFile 342 323 | NtSetEvent 11 324 | NtSetEventBoostPriority 42 325 | NtSetHighEventPair 343 326 | NtSetHighWaitLowEventPair 344 327 | NtSetInformationDebugObject 345 328 | NtSetInformationEnlistment 346 329 | NtSetInformationFile 36 330 | NtSetInformationJobObject 347 331 | NtSetInformationKey 348 332 | NtSetInformationObject 89 333 | NtSetInformationProcess 25 334 | NtSetInformationResourceManager 349 335 | NtSetInformationThread 10 336 | NtSetInformationToken 350 337 | NtSetInformationTransaction 351 338 | NtSetInformationTransactionManager 352 339 | NtSetInformationWorkerFactory 353 340 | NtSetIntervalProfile 354 341 | NtSetIoCompletion 355 342 | NtSetIoCompletionEx 356 343 | NtSetLdtEntries 357 344 | NtSetLowEventPair 358 345 | NtSetLowWaitHighEventPair 359 346 | NtSetQuotaInformationFile 360 347 | NtSetSecurityObject 361 348 | NtSetSystemEnvironmentValue 362 349 | NtSetSystemEnvironmentValueEx 363 350 | NtSetSystemInformation 364 351 | NtSetSystemPowerState 365 352 | NtSetSystemTime 366 353 | NtSetThreadExecutionState 367 354 | NtSetTimer 95 355 | NtSetTimerEx 368 356 | NtSetTimerResolution 369 357 | NtSetUuidSeed 370 358 | NtSetValueKey 93 359 | NtSetVolumeInformationFile 371 360 | NtShutdownSystem 372 361 | NtShutdownWorkerFactory 373 362 | NtSignalAndWaitForSingleObject 374 363 | NtSinglePhaseReject 375 364 | NtStartProfile 376 365 | NtStopProfile 377 366 | NtSuspendProcess 378 367 | NtSuspendThread 379 368 | NtSystemDebugControl 380 369 | NtTerminateJobObject 381 370 | NtTerminateProcess 41 371 | NtTerminateThread 80 372 | NtTestAlert 382 373 | NtThawRegistry 383 374 | NtThawTransactions 384 375 | NtTraceControl 385 376 | NtTraceEvent 91 377 | NtTranslateFilePath 386 378 | NtUmsThreadYield 387 379 | NtUnloadDriver 388 380 | NtUnloadKey 389 381 | NtUnloadKey2 390 382 | NtUnloadKeyEx 391 383 | NtUnlockFile 392 384 | NtUnlockVirtualMemory 393 385 | NtUnmapViewOfSection 39 386 | NtVdmControl 394 387 | NtWaitForDebugEvent 395 388 | NtWaitForKeyedEvent 396 389 | NtWaitForMultipleObjects 88 390 | NtWaitForMultipleObjects32 23 391 | NtWaitForSingleObject 1 392 | NtWaitForWorkViaWorkerFactory 397 393 | NtWaitHighEventPair 398 394 | NtWaitLowEventPair 399 395 | NtWorkerFactoryWorkerReady 400 396 | NtWriteFile 5 397 | NtWriteFileGather 24 398 | NtWriteRequestData 84 399 | NtWriteVirtualMemory 55 400 | NtYieldExecution 67 401 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/ntos/9200.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 97 2 | NtAccessCheck 98 3 | NtAccessCheckAndAuditAlarm 39 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 87 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAddAtom 69 10 | NtAddAtomEx 103 11 | NtAddBootEntry 104 12 | NtAddDriverEntry 105 13 | NtAdjustGroupsToken 106 14 | NtAdjustPrivilegesToken 63 15 | NtAdjustTokenClaimsAndDeviceGroups 107 16 | NtAlertResumeThread 108 17 | NtAlertThread 109 18 | NtAlertThreadByThreadId 110 19 | NtAllocateLocallyUniqueId 111 20 | NtAllocateReserveObject 112 21 | NtAllocateUserPhysicalPages 113 22 | NtAllocateUuids 114 23 | NtAllocateVirtualMemory 22 24 | NtAlpcAcceptConnectPort 115 25 | NtAlpcCancelMessage 116 26 | NtAlpcConnectPort 117 27 | NtAlpcConnectPortEx 118 28 | NtAlpcCreatePort 119 29 | NtAlpcCreatePortSection 120 30 | NtAlpcCreateResourceReserve 121 31 | NtAlpcCreateSectionView 122 32 | NtAlpcCreateSecurityContext 123 33 | NtAlpcDeletePortSection 124 34 | NtAlpcDeleteResourceReserve 125 35 | NtAlpcDeleteSectionView 126 36 | NtAlpcDeleteSecurityContext 127 37 | NtAlpcDisconnectPort 128 38 | NtAlpcImpersonateClientOfPort 129 39 | NtAlpcOpenSenderProcess 130 40 | NtAlpcOpenSenderThread 131 41 | NtAlpcQueryInformation 132 42 | NtAlpcQueryInformationMessage 133 43 | NtAlpcRevokeSecurityContext 134 44 | NtAlpcSendWaitReceivePort 135 45 | NtAlpcSetInformation 136 46 | NtApphelpCacheControl 74 47 | NtAreMappedFilesTheSame 137 48 | NtAssignProcessToJobObject 138 49 | NtAssociateWaitCompletionPacket 139 50 | NtCallbackReturn 3 51 | NtCancelIoFile 91 52 | NtCancelIoFileEx 140 53 | NtCancelSynchronousIoFile 141 54 | NtCancelTimer 95 55 | NtCancelWaitCompletionPacket 142 56 | NtClearEvent 60 57 | NtClose 13 58 | NtCloseObjectAuditAlarm 57 59 | NtCommitComplete 143 60 | NtCommitEnlistment 144 61 | NtCommitTransaction 145 62 | NtCompactKeys 146 63 | NtCompareTokens 147 64 | NtCompleteConnectPort 148 65 | NtCompressKey 149 66 | NtConnectPort 150 67 | NtContinue 65 68 | NtCreateDebugObject 151 69 | NtCreateDirectoryObject 152 70 | NtCreateDirectoryObjectEx 153 71 | NtCreateEnlistment 154 72 | NtCreateEvent 70 73 | NtCreateEventPair 155 74 | NtCreateFile 83 75 | NtCreateIoCompletion 157 76 | NtCreateIRTimer 156 77 | NtCreateJobObject 158 78 | NtCreateJobSet 159 79 | NtCreateKey 27 80 | NtCreateKeyedEvent 161 81 | NtCreateKeyTransacted 160 82 | NtCreateLowBoxToken 162 83 | NtCreateMailslotFile 163 84 | NtCreateMutant 164 85 | NtCreateNamedPipeFile 165 86 | NtCreatePagingFile 166 87 | NtCreatePort 167 88 | NtCreatePrivateNamespace 168 89 | NtCreateProcess 169 90 | NtCreateProcessEx 75 91 | NtCreateProfile 170 92 | NtCreateProfileEx 171 93 | NtCreateResourceManager 172 94 | NtCreateSection 72 95 | NtCreateSemaphore 173 96 | NtCreateSymbolicLinkObject 174 97 | NtCreateThread 76 98 | NtCreateThreadEx 175 99 | NtCreateTimer 176 100 | NtCreateToken 177 101 | NtCreateTokenEx 178 102 | NtCreateTransaction 179 103 | NtCreateTransactionManager 180 104 | NtCreateUserProcess 181 105 | NtCreateWaitablePort 183 106 | NtCreateWaitCompletionPacket 182 107 | NtCreateWnfStateName 184 108 | NtCreateWorkerFactory 185 109 | NtDebugActiveProcess 186 110 | NtDebugContinue 187 111 | NtDelayExecution 50 112 | NtDeleteAtom 188 113 | NtDeleteBootEntry 189 114 | NtDeleteDriverEntry 190 115 | NtDeleteFile 191 116 | NtDeleteKey 192 117 | NtDeleteObjectAuditAlarm 193 118 | NtDeletePrivateNamespace 194 119 | NtDeleteValueKey 195 120 | NtDeleteWnfStateData 196 121 | NtDeleteWnfStateName 197 122 | NtDeviceIoControlFile 5 123 | NtDisableLastKnownGood 198 124 | NtDisplayString 199 125 | NtDrawText 200 126 | NtDuplicateObject 58 127 | NtDuplicateToken 64 128 | NtEnableLastKnownGood 201 129 | NtEnumerateBootEntries 202 130 | NtEnumerateDriverEntries 203 131 | NtEnumerateKey 48 132 | NtEnumerateSystemEnvironmentValuesEx 204 133 | NtEnumerateTransactionObject 205 134 | NtEnumerateValueKey 17 135 | NtExtendSection 206 136 | NtFilterBootOption 207 137 | NtFilterToken 208 138 | NtFilterTokenEx 209 139 | NtFindAtom 18 140 | NtFlushBuffersFile 73 141 | NtFlushBuffersFileEx 210 142 | NtFlushInstallUILanguage 211 143 | NtFlushInstructionCache 212 144 | NtFlushKey 213 145 | NtFlushProcessWriteBuffers 214 146 | NtFlushVirtualMemory 215 147 | NtFlushWriteBuffer 216 148 | NtFreeUserPhysicalPages 217 149 | NtFreeVirtualMemory 28 150 | NtFreezeRegistry 218 151 | NtFreezeTransactions 219 152 | NtFsControlFile 55 153 | NtGetCachedSigningLevel 220 154 | NtGetContextThread 221 155 | NtGetCurrentProcessorNumber 222 156 | NtGetDevicePowerState 223 157 | NtGetMUIRegistryInfo 224 158 | NtGetNextProcess 225 159 | NtGetNextThread 226 160 | NtGetNlsSectionPtr 227 161 | NtGetNotificationResourceManager 228 162 | NtGetWriteWatch 229 163 | NtImpersonateAnonymousToken 230 164 | NtImpersonateClientOfPort 29 165 | NtImpersonateThread 231 166 | NtInitializeNlsFiles 232 167 | NtInitializeRegistry 233 168 | NtInitiatePowerAction 234 169 | NtIsProcessInJob 77 170 | NtIsSystemResumeAutomatic 235 171 | NtIsUILanguageComitted 236 172 | NtListenPort 237 173 | NtLoadDriver 238 174 | NtLoadKey 239 175 | NtLoadKey2 240 176 | NtLoadKeyEx 241 177 | NtLockFile 242 178 | NtLockProductActivationKeys 243 179 | NtLockRegistryKey 244 180 | NtLockVirtualMemory 245 181 | NtMakePermanentObject 246 182 | NtMakeTemporaryObject 247 183 | NtMapCMFModule 248 184 | NtMapUserPhysicalPages 249 185 | NtMapUserPhysicalPagesScatter 1 186 | NtMapViewOfSection 38 187 | NtModifyBootEntry 250 188 | NtModifyDriverEntry 251 189 | NtNotifyChangeDirectoryFile 252 190 | NtNotifyChangeKey 253 191 | NtNotifyChangeMultipleKeys 254 192 | NtNotifyChangeSession 255 193 | NtOpenDirectoryObject 86 194 | NtOpenEnlistment 256 195 | NtOpenEvent 62 196 | NtOpenEventPair 257 197 | NtOpenFile 49 198 | NtOpenIoCompletion 258 199 | NtOpenJobObject 259 200 | NtOpenKey 16 201 | NtOpenKeyedEvent 263 202 | NtOpenKeyEx 260 203 | NtOpenKeyTransacted 261 204 | NtOpenKeyTransactedEx 262 205 | NtOpenMutant 264 206 | NtOpenObjectAuditAlarm 265 207 | NtOpenPrivateNamespace 266 208 | NtOpenProcess 36 209 | NtOpenProcessToken 267 210 | NtOpenProcessTokenEx 46 211 | NtOpenResourceManager 268 212 | NtOpenSection 53 213 | NtOpenSemaphore 269 214 | NtOpenSession 270 215 | NtOpenSymbolicLinkObject 271 216 | NtOpenThread 272 217 | NtOpenThreadToken 34 218 | NtOpenThreadTokenEx 45 219 | NtOpenTimer 273 220 | NtOpenTransaction 274 221 | NtOpenTransactionManager 275 222 | NtPlugPlayControl 276 223 | NtPowerInformation 93 224 | NtPrepareComplete 279 225 | NtPrepareEnlistment 280 226 | NtPrePrepareComplete 277 227 | NtPrePrepareEnlistment 278 228 | NtPrivilegeCheck 281 229 | NtPrivilegedServiceAuditAlarm 283 230 | NtPrivilegeObjectAuditAlarm 282 231 | NtPropagationComplete 284 232 | NtPropagationFailed 285 233 | NtProtectVirtualMemory 78 234 | NtPulseEvent 286 235 | NtQueryAttributesFile 59 236 | NtQueryBootEntryOrder 287 237 | NtQueryBootOptions 288 238 | NtQueryDebugFilterState 289 239 | NtQueryDefaultLocale 19 240 | NtQueryDefaultUILanguage 66 241 | NtQueryDirectoryFile 51 242 | NtQueryDirectoryObject 290 243 | NtQueryDriverEntryOrder 291 244 | NtQueryEaFile 292 245 | NtQueryEvent 84 246 | NtQueryFullAttributesFile 293 247 | NtQueryInformationAtom 294 248 | NtQueryInformationEnlistment 295 249 | NtQueryInformationFile 15 250 | NtQueryInformationJobObject 296 251 | NtQueryInformationPort 297 252 | NtQueryInformationProcess 23 253 | NtQueryInformationResourceManager 298 254 | NtQueryInformationThread 35 255 | NtQueryInformationToken 31 256 | NtQueryInformationTransaction 299 257 | NtQueryInformationTransactionManager 300 258 | NtQueryInformationWorkerFactory 301 259 | NtQueryInstallUILanguage 302 260 | NtQueryIntervalProfile 303 261 | NtQueryIoCompletion 304 262 | NtQueryKey 20 263 | NtQueryLicenseValue 305 264 | NtQueryMultipleValueKey 306 265 | NtQueryMutant 307 266 | NtQueryObject 14 267 | NtQueryOpenSubKeys 308 268 | NtQueryOpenSubKeysEx 309 269 | NtQueryPerformanceCounter 47 270 | NtQueryPortInformationProcess 310 271 | NtQueryQuotaInformationFile 311 272 | NtQuerySection 79 273 | NtQuerySecurityAttributesToken 312 274 | NtQuerySecurityObject 313 275 | NtQuerySemaphore 314 276 | NtQuerySymbolicLinkObject 315 277 | NtQuerySystemEnvironmentValue 316 278 | NtQuerySystemEnvironmentValueEx 317 279 | NtQuerySystemInformation 52 280 | NtQuerySystemInformationEx 318 281 | NtQueryTimer 54 282 | NtQueryTimerResolution 319 283 | NtQueryValueKey 21 284 | NtQueryVirtualMemory 33 285 | NtQueryVolumeInformationFile 71 286 | NtQueryWnfStateData 320 287 | NtQueryWnfStateNameInformation 321 288 | NtQueueApcThread 67 289 | NtQueueApcThreadEx 322 290 | NtRaiseException 323 291 | NtRaiseHardError 324 292 | NtReadFile 4 293 | NtReadFileScatter 44 294 | NtReadOnlyEnlistment 325 295 | NtReadRequestData 82 296 | NtReadVirtualMemory 61 297 | NtRecoverEnlistment 326 298 | NtRecoverResourceManager 327 299 | NtRecoverTransactionManager 328 300 | NtRegisterProtocolAddressInformation 329 301 | NtRegisterThreadTerminatePort 330 302 | NtReleaseKeyedEvent 331 303 | NtReleaseMutant 30 304 | NtReleaseSemaphore 8 305 | NtReleaseWorkerFactoryWorker 332 306 | NtRemoveIoCompletion 7 307 | NtRemoveIoCompletionEx 333 308 | NtRemoveProcessDebug 334 309 | NtRenameKey 335 310 | NtRenameTransactionManager 336 311 | NtReplaceKey 337 312 | NtReplacePartitionUnit 338 313 | NtReplyPort 10 314 | NtReplyWaitReceivePort 9 315 | NtReplyWaitReceivePortEx 41 316 | NtReplyWaitReplyPort 339 317 | NtRequestPort 340 318 | NtRequestWaitReplyPort 32 319 | NtResetEvent 341 320 | NtResetWriteWatch 342 321 | NtRestoreKey 343 322 | NtResumeProcess 344 323 | NtResumeThread 80 324 | NtRollbackComplete 345 325 | NtRollbackEnlistment 346 326 | NtRollbackTransaction 347 327 | NtRollforwardTransactionManager 348 328 | NtSaveKey 349 329 | NtSaveKeyEx 350 330 | NtSaveMergedKeys 351 331 | NtSecureConnectPort 352 332 | NtSerializeBoot 353 333 | NtSetBootEntryOrder 354 334 | NtSetBootOptions 355 335 | NtSetCachedSigningLevel 356 336 | NtSetContextThread 357 337 | NtSetDebugFilterState 358 338 | NtSetDefaultHardErrorPort 359 339 | NtSetDefaultLocale 360 340 | NtSetDefaultUILanguage 361 341 | NtSetDriverEntryOrder 362 342 | NtSetEaFile 363 343 | NtSetEvent 12 344 | NtSetEventBoostPriority 43 345 | NtSetHighEventPair 364 346 | NtSetHighWaitLowEventPair 365 347 | NtSetInformationDebugObject 367 348 | NtSetInformationEnlistment 368 349 | NtSetInformationFile 37 350 | NtSetInformationJobObject 369 351 | NtSetInformationKey 370 352 | NtSetInformationObject 90 353 | NtSetInformationProcess 26 354 | NtSetInformationResourceManager 371 355 | NtSetInformationThread 11 356 | NtSetInformationToken 372 357 | NtSetInformationTransaction 373 358 | NtSetInformationTransactionManager 374 359 | NtSetInformationVirtualMemory 375 360 | NtSetInformationWorkerFactory 376 361 | NtSetIntervalProfile 377 362 | NtSetIoCompletion 378 363 | NtSetIoCompletionEx 379 364 | NtSetIRTimer 366 365 | NtSetLdtEntries 380 366 | NtSetLowEventPair 381 367 | NtSetLowWaitHighEventPair 382 368 | NtSetQuotaInformationFile 383 369 | NtSetSecurityObject 384 370 | NtSetSystemEnvironmentValue 385 371 | NtSetSystemEnvironmentValueEx 386 372 | NtSetSystemInformation 387 373 | NtSetSystemPowerState 388 374 | NtSetSystemTime 389 375 | NtSetThreadExecutionState 390 376 | NtSetTimer 96 377 | NtSetTimerEx 391 378 | NtSetTimerResolution 392 379 | NtSetUuidSeed 393 380 | NtSetValueKey 94 381 | NtSetVolumeInformationFile 394 382 | NtShutdownSystem 395 383 | NtShutdownWorkerFactory 396 384 | NtSignalAndWaitForSingleObject 397 385 | NtSinglePhaseReject 398 386 | NtStartProfile 399 387 | NtStopProfile 400 388 | NtSubscribeWnfStateChange 401 389 | NtSuspendProcess 402 390 | NtSuspendThread 403 391 | NtSystemDebugControl 404 392 | NtTerminateJobObject 405 393 | NtTerminateProcess 42 394 | NtTerminateThread 81 395 | NtTestAlert 406 396 | NtThawRegistry 407 397 | NtThawTransactions 408 398 | NtTraceControl 409 399 | NtTraceEvent 92 400 | NtTranslateFilePath 410 401 | NtUmsThreadYield 411 402 | NtUnloadDriver 412 403 | NtUnloadKey 413 404 | NtUnloadKey2 414 405 | NtUnloadKeyEx 415 406 | NtUnlockFile 416 407 | NtUnlockVirtualMemory 417 408 | NtUnmapViewOfSection 40 409 | NtUnmapViewOfSectionEx 418 410 | NtUnsubscribeWnfStateChange 419 411 | NtUpdateWnfStateData 420 412 | NtVdmControl 421 413 | NtWaitForAlertByThreadId 422 414 | NtWaitForDebugEvent 423 415 | NtWaitForKeyedEvent 424 416 | NtWaitForMultipleObjects 89 417 | NtWaitForMultipleObjects32 24 418 | NtWaitForSingleObject 2 419 | NtWaitForWnfNotifications 425 420 | NtWaitForWorkViaWorkerFactory 426 421 | NtWaitHighEventPair 427 422 | NtWaitLowEventPair 428 423 | NtWorkerFactoryWorkerReady 0 424 | NtWriteFile 6 425 | NtWriteFileGather 25 426 | NtWriteRequestData 85 427 | NtWriteVirtualMemory 56 428 | NtYieldExecution 68 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/ntos/9600.txt: -------------------------------------------------------------------------------- 1 | NtAcceptConnectPort 1 2 | NtAccessCheck 98 3 | NtAccessCheckAndAuditAlarm 40 4 | NtAccessCheckByType 99 5 | NtAccessCheckByTypeAndAuditAlarm 88 6 | NtAccessCheckByTypeResultList 100 7 | NtAccessCheckByTypeResultListAndAuditAlarm 101 8 | NtAccessCheckByTypeResultListAndAuditAlarmByHandle 102 9 | NtAddAtom 70 10 | NtAddAtomEx 103 11 | NtAddBootEntry 104 12 | NtAddDriverEntry 105 13 | NtAdjustGroupsToken 106 14 | NtAdjustPrivilegesToken 64 15 | NtAdjustTokenClaimsAndDeviceGroups 107 16 | NtAlertResumeThread 108 17 | NtAlertThread 109 18 | NtAlertThreadByThreadId 110 19 | NtAllocateLocallyUniqueId 111 20 | NtAllocateReserveObject 112 21 | NtAllocateUserPhysicalPages 113 22 | NtAllocateUuids 114 23 | NtAllocateVirtualMemory 23 24 | NtAlpcAcceptConnectPort 115 25 | NtAlpcCancelMessage 116 26 | NtAlpcConnectPort 117 27 | NtAlpcConnectPortEx 118 28 | NtAlpcCreatePort 119 29 | NtAlpcCreatePortSection 120 30 | NtAlpcCreateResourceReserve 121 31 | NtAlpcCreateSectionView 122 32 | NtAlpcCreateSecurityContext 123 33 | NtAlpcDeletePortSection 124 34 | NtAlpcDeleteResourceReserve 125 35 | NtAlpcDeleteSectionView 126 36 | NtAlpcDeleteSecurityContext 127 37 | NtAlpcDisconnectPort 128 38 | NtAlpcImpersonateClientOfPort 129 39 | NtAlpcOpenSenderProcess 130 40 | NtAlpcOpenSenderThread 131 41 | NtAlpcQueryInformation 132 42 | NtAlpcQueryInformationMessage 133 43 | NtAlpcRevokeSecurityContext 134 44 | NtAlpcSendWaitReceivePort 135 45 | NtAlpcSetInformation 136 46 | NtApphelpCacheControl 75 47 | NtAreMappedFilesTheSame 137 48 | NtAssignProcessToJobObject 138 49 | NtAssociateWaitCompletionPacket 139 50 | NtCallbackReturn 4 51 | NtCancelIoFile 92 52 | NtCancelIoFileEx 140 53 | NtCancelSynchronousIoFile 141 54 | NtCancelTimer 96 55 | NtCancelTimer2 142 56 | NtCancelWaitCompletionPacket 143 57 | NtClearEvent 61 58 | NtClose 14 59 | NtCloseObjectAuditAlarm 58 60 | NtCommitComplete 144 61 | NtCommitEnlistment 145 62 | NtCommitTransaction 146 63 | NtCompactKeys 147 64 | NtCompareTokens 148 65 | NtCompleteConnectPort 149 66 | NtCompressKey 150 67 | NtConnectPort 151 68 | NtContinue 66 69 | NtCreateDebugObject 152 70 | NtCreateDirectoryObject 153 71 | NtCreateDirectoryObjectEx 154 72 | NtCreateEnlistment 155 73 | NtCreateEvent 71 74 | NtCreateEventPair 156 75 | NtCreateFile 84 76 | NtCreateIoCompletion 158 77 | NtCreateIRTimer 157 78 | NtCreateJobObject 159 79 | NtCreateJobSet 160 80 | NtCreateKey 28 81 | NtCreateKeyedEvent 162 82 | NtCreateKeyTransacted 161 83 | NtCreateLowBoxToken 163 84 | NtCreateMailslotFile 164 85 | NtCreateMutant 165 86 | NtCreateNamedPipeFile 166 87 | NtCreatePagingFile 167 88 | NtCreatePort 168 89 | NtCreatePrivateNamespace 169 90 | NtCreateProcess 170 91 | NtCreateProcessEx 76 92 | NtCreateProfile 171 93 | NtCreateProfileEx 172 94 | NtCreateResourceManager 173 95 | NtCreateSection 73 96 | NtCreateSemaphore 174 97 | NtCreateSymbolicLinkObject 175 98 | NtCreateThread 77 99 | NtCreateThreadEx 176 100 | NtCreateTimer 177 101 | NtCreateTimer2 178 102 | NtCreateToken 179 103 | NtCreateTokenEx 180 104 | NtCreateTransaction 181 105 | NtCreateTransactionManager 182 106 | NtCreateUserProcess 183 107 | NtCreateWaitablePort 185 108 | NtCreateWaitCompletionPacket 184 109 | NtCreateWnfStateName 186 110 | NtCreateWorkerFactory 187 111 | NtDebugActiveProcess 188 112 | NtDebugContinue 189 113 | NtDelayExecution 51 114 | NtDeleteAtom 190 115 | NtDeleteBootEntry 191 116 | NtDeleteDriverEntry 192 117 | NtDeleteFile 193 118 | NtDeleteKey 194 119 | NtDeleteObjectAuditAlarm 195 120 | NtDeletePrivateNamespace 196 121 | NtDeleteValueKey 197 122 | NtDeleteWnfStateData 198 123 | NtDeleteWnfStateName 199 124 | NtDeviceIoControlFile 6 125 | NtDisableLastKnownGood 200 126 | NtDisplayString 201 127 | NtDrawText 202 128 | NtDuplicateObject 59 129 | NtDuplicateToken 65 130 | NtEnableLastKnownGood 203 131 | NtEnumerateBootEntries 204 132 | NtEnumerateDriverEntries 205 133 | NtEnumerateKey 49 134 | NtEnumerateSystemEnvironmentValuesEx 206 135 | NtEnumerateTransactionObject 207 136 | NtEnumerateValueKey 18 137 | NtExtendSection 208 138 | NtFilterBootOption 209 139 | NtFilterToken 210 140 | NtFilterTokenEx 211 141 | NtFindAtom 19 142 | NtFlushBuffersFile 74 143 | NtFlushBuffersFileEx 212 144 | NtFlushInstallUILanguage 213 145 | NtFlushInstructionCache 214 146 | NtFlushKey 215 147 | NtFlushProcessWriteBuffers 216 148 | NtFlushVirtualMemory 217 149 | NtFlushWriteBuffer 218 150 | NtFreeUserPhysicalPages 219 151 | NtFreeVirtualMemory 29 152 | NtFreezeRegistry 220 153 | NtFreezeTransactions 221 154 | NtFsControlFile 56 155 | NtGetCachedSigningLevel 222 156 | NtGetCompleteWnfStateSubscription 223 157 | NtGetContextThread 224 158 | NtGetCurrentProcessorNumber 225 159 | NtGetDevicePowerState 226 160 | NtGetMUIRegistryInfo 227 161 | NtGetNextProcess 228 162 | NtGetNextThread 229 163 | NtGetNlsSectionPtr 230 164 | NtGetNotificationResourceManager 231 165 | NtGetWriteWatch 232 166 | NtImpersonateAnonymousToken 233 167 | NtImpersonateClientOfPort 30 168 | NtImpersonateThread 234 169 | NtInitializeNlsFiles 235 170 | NtInitializeRegistry 236 171 | NtInitiatePowerAction 237 172 | NtIsProcessInJob 78 173 | NtIsSystemResumeAutomatic 238 174 | NtIsUILanguageComitted 239 175 | NtListenPort 240 176 | NtLoadDriver 241 177 | NtLoadKey 242 178 | NtLoadKey2 243 179 | NtLoadKeyEx 244 180 | NtLockFile 245 181 | NtLockProductActivationKeys 246 182 | NtLockRegistryKey 247 183 | NtLockVirtualMemory 248 184 | NtMakePermanentObject 249 185 | NtMakeTemporaryObject 250 186 | NtMapCMFModule 251 187 | NtMapUserPhysicalPages 252 188 | NtMapUserPhysicalPagesScatter 2 189 | NtMapViewOfSection 39 190 | NtModifyBootEntry 253 191 | NtModifyDriverEntry 254 192 | NtNotifyChangeDirectoryFile 255 193 | NtNotifyChangeKey 256 194 | NtNotifyChangeMultipleKeys 257 195 | NtNotifyChangeSession 258 196 | NtOpenDirectoryObject 87 197 | NtOpenEnlistment 259 198 | NtOpenEvent 63 199 | NtOpenEventPair 260 200 | NtOpenFile 50 201 | NtOpenIoCompletion 261 202 | NtOpenJobObject 262 203 | NtOpenKey 17 204 | NtOpenKeyedEvent 266 205 | NtOpenKeyEx 263 206 | NtOpenKeyTransacted 264 207 | NtOpenKeyTransactedEx 265 208 | NtOpenMutant 267 209 | NtOpenObjectAuditAlarm 268 210 | NtOpenPrivateNamespace 269 211 | NtOpenProcess 37 212 | NtOpenProcessToken 270 213 | NtOpenProcessTokenEx 47 214 | NtOpenResourceManager 271 215 | NtOpenSection 54 216 | NtOpenSemaphore 272 217 | NtOpenSession 273 218 | NtOpenSymbolicLinkObject 274 219 | NtOpenThread 275 220 | NtOpenThreadToken 35 221 | NtOpenThreadTokenEx 46 222 | NtOpenTimer 276 223 | NtOpenTransaction 277 224 | NtOpenTransactionManager 278 225 | NtPlugPlayControl 279 226 | NtPowerInformation 94 227 | NtPrepareComplete 282 228 | NtPrepareEnlistment 283 229 | NtPrePrepareComplete 280 230 | NtPrePrepareEnlistment 281 231 | NtPrivilegeCheck 284 232 | NtPrivilegedServiceAuditAlarm 286 233 | NtPrivilegeObjectAuditAlarm 285 234 | NtPropagationComplete 287 235 | NtPropagationFailed 288 236 | NtProtectVirtualMemory 79 237 | NtPulseEvent 289 238 | NtQueryAttributesFile 60 239 | NtQueryBootEntryOrder 290 240 | NtQueryBootOptions 291 241 | NtQueryDebugFilterState 292 242 | NtQueryDefaultLocale 20 243 | NtQueryDefaultUILanguage 67 244 | NtQueryDirectoryFile 52 245 | NtQueryDirectoryObject 293 246 | NtQueryDriverEntryOrder 294 247 | NtQueryEaFile 295 248 | NtQueryEvent 85 249 | NtQueryFullAttributesFile 296 250 | NtQueryInformationAtom 297 251 | NtQueryInformationEnlistment 298 252 | NtQueryInformationFile 16 253 | NtQueryInformationJobObject 299 254 | NtQueryInformationPort 300 255 | NtQueryInformationProcess 24 256 | NtQueryInformationResourceManager 301 257 | NtQueryInformationThread 36 258 | NtQueryInformationToken 32 259 | NtQueryInformationTransaction 302 260 | NtQueryInformationTransactionManager 303 261 | NtQueryInformationWorkerFactory 304 262 | NtQueryInstallUILanguage 305 263 | NtQueryIntervalProfile 306 264 | NtQueryIoCompletion 307 265 | NtQueryKey 21 266 | NtQueryLicenseValue 308 267 | NtQueryMultipleValueKey 309 268 | NtQueryMutant 310 269 | NtQueryObject 15 270 | NtQueryOpenSubKeys 311 271 | NtQueryOpenSubKeysEx 312 272 | NtQueryPerformanceCounter 48 273 | NtQueryPortInformationProcess 313 274 | NtQueryQuotaInformationFile 314 275 | NtQuerySection 80 276 | NtQuerySecurityAttributesToken 315 277 | NtQuerySecurityObject 316 278 | NtQuerySemaphore 317 279 | NtQuerySymbolicLinkObject 318 280 | NtQuerySystemEnvironmentValue 319 281 | NtQuerySystemEnvironmentValueEx 320 282 | NtQuerySystemInformation 53 283 | NtQuerySystemInformationEx 321 284 | NtQueryTimer 55 285 | NtQueryTimerResolution 322 286 | NtQueryValueKey 22 287 | NtQueryVirtualMemory 34 288 | NtQueryVolumeInformationFile 72 289 | NtQueryWnfStateData 323 290 | NtQueryWnfStateNameInformation 324 291 | NtQueueApcThread 68 292 | NtQueueApcThreadEx 325 293 | NtRaiseException 326 294 | NtRaiseHardError 327 295 | NtReadFile 5 296 | NtReadFileScatter 45 297 | NtReadOnlyEnlistment 328 298 | NtReadRequestData 83 299 | NtReadVirtualMemory 62 300 | NtRecoverEnlistment 329 301 | NtRecoverResourceManager 330 302 | NtRecoverTransactionManager 331 303 | NtRegisterProtocolAddressInformation 332 304 | NtRegisterThreadTerminatePort 333 305 | NtReleaseKeyedEvent 334 306 | NtReleaseMutant 31 307 | NtReleaseSemaphore 9 308 | NtReleaseWorkerFactoryWorker 335 309 | NtRemoveIoCompletion 8 310 | NtRemoveIoCompletionEx 336 311 | NtRemoveProcessDebug 337 312 | NtRenameKey 338 313 | NtRenameTransactionManager 339 314 | NtReplaceKey 340 315 | NtReplacePartitionUnit 341 316 | NtReplyPort 11 317 | NtReplyWaitReceivePort 10 318 | NtReplyWaitReceivePortEx 42 319 | NtReplyWaitReplyPort 342 320 | NtRequestPort 343 321 | NtRequestWaitReplyPort 33 322 | NtResetEvent 344 323 | NtResetWriteWatch 345 324 | NtRestoreKey 346 325 | NtResumeProcess 347 326 | NtResumeThread 81 327 | NtRollbackComplete 348 328 | NtRollbackEnlistment 349 329 | NtRollbackTransaction 350 330 | NtRollforwardTransactionManager 351 331 | NtSaveKey 352 332 | NtSaveKeyEx 353 333 | NtSaveMergedKeys 354 334 | NtSecureConnectPort 355 335 | NtSerializeBoot 356 336 | NtSetBootEntryOrder 357 337 | NtSetBootOptions 358 338 | NtSetCachedSigningLevel 359 339 | NtSetContextThread 360 340 | NtSetDebugFilterState 361 341 | NtSetDefaultHardErrorPort 362 342 | NtSetDefaultLocale 363 343 | NtSetDefaultUILanguage 364 344 | NtSetDriverEntryOrder 365 345 | NtSetEaFile 366 346 | NtSetEvent 13 347 | NtSetEventBoostPriority 44 348 | NtSetHighEventPair 367 349 | NtSetHighWaitLowEventPair 368 350 | NtSetInformationDebugObject 370 351 | NtSetInformationEnlistment 371 352 | NtSetInformationFile 38 353 | NtSetInformationJobObject 372 354 | NtSetInformationKey 373 355 | NtSetInformationObject 91 356 | NtSetInformationProcess 27 357 | NtSetInformationResourceManager 374 358 | NtSetInformationThread 12 359 | NtSetInformationToken 375 360 | NtSetInformationTransaction 376 361 | NtSetInformationTransactionManager 377 362 | NtSetInformationVirtualMemory 378 363 | NtSetInformationWorkerFactory 379 364 | NtSetIntervalProfile 380 365 | NtSetIoCompletion 381 366 | NtSetIoCompletionEx 382 367 | NtSetIRTimer 369 368 | NtSetLdtEntries 383 369 | NtSetLowEventPair 384 370 | NtSetLowWaitHighEventPair 385 371 | NtSetQuotaInformationFile 386 372 | NtSetSecurityObject 387 373 | NtSetSystemEnvironmentValue 388 374 | NtSetSystemEnvironmentValueEx 389 375 | NtSetSystemInformation 390 376 | NtSetSystemPowerState 391 377 | NtSetSystemTime 392 378 | NtSetThreadExecutionState 393 379 | NtSetTimer 97 380 | NtSetTimer2 394 381 | NtSetTimerEx 395 382 | NtSetTimerResolution 396 383 | NtSetUuidSeed 397 384 | NtSetValueKey 95 385 | NtSetVolumeInformationFile 398 386 | NtSetWnfProcessNotificationEvent 399 387 | NtShutdownSystem 400 388 | NtShutdownWorkerFactory 401 389 | NtSignalAndWaitForSingleObject 402 390 | NtSinglePhaseReject 403 391 | NtStartProfile 404 392 | NtStopProfile 405 393 | NtSubscribeWnfStateChange 406 394 | NtSuspendProcess 407 395 | NtSuspendThread 408 396 | NtSystemDebugControl 409 397 | NtTerminateJobObject 410 398 | NtTerminateProcess 43 399 | NtTerminateThread 82 400 | NtTestAlert 411 401 | NtThawRegistry 412 402 | NtThawTransactions 413 403 | NtTraceControl 414 404 | NtTraceEvent 93 405 | NtTranslateFilePath 415 406 | NtUmsThreadYield 416 407 | NtUnloadDriver 417 408 | NtUnloadKey 418 409 | NtUnloadKey2 419 410 | NtUnloadKeyEx 420 411 | NtUnlockFile 421 412 | NtUnlockVirtualMemory 422 413 | NtUnmapViewOfSection 41 414 | NtUnmapViewOfSectionEx 423 415 | NtUnsubscribeWnfStateChange 424 416 | NtUpdateWnfStateData 425 417 | NtVdmControl 426 418 | NtWaitForAlertByThreadId 427 419 | NtWaitForDebugEvent 428 420 | NtWaitForKeyedEvent 429 421 | NtWaitForMultipleObjects 90 422 | NtWaitForMultipleObjects32 25 423 | NtWaitForSingleObject 3 424 | NtWaitForWorkViaWorkerFactory 430 425 | NtWaitHighEventPair 431 426 | NtWaitLowEventPair 432 427 | NtWorkerFactoryWorkerReady 0 428 | NtWriteFile 7 429 | NtWriteFileGather 26 430 | NtWriteRequestData 86 431 | NtWriteVirtualMemory 57 432 | NtYieldExecution 69 -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/readme1st.txt: -------------------------------------------------------------------------------- 1 | syscalls composition generated with 2 | 3 | for markdown 4 | sstc -d NT6 5 | sstc -w -d NT6 6 | 7 | for html 8 | sstc -h -d NT6 9 | sstc -h -w -d NT6 10 | -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/win32k/6000.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT6/win32k/6000.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/win32k/7601.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT6/win32k/7601.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/win32k/9200.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT6/win32k/9200.txt -------------------------------------------------------------------------------- /Compiled/Composition/X86_64/NT6/win32k/9600.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/X86_64/NT6/win32k/9600.txt -------------------------------------------------------------------------------- /Compiled/Composition/sstc.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/Composition/sstc.exe -------------------------------------------------------------------------------- /Compiled/Composition/sstc.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /Compiled/generate.cmd: -------------------------------------------------------------------------------- 1 | rem example command script 2 | set arg1=%1 3 | C:\SyscallTables\Compiled\scg64 Z:\WindowsNT\%arg1%\ntdll.dll >C:\SyscallTables\Compiled\Composition\X86_64\NT10\ntos\%arg1%.txt 4 | C:\SyscallTables\Compiled\scg64 Z:\WindowsNT\%arg1%\win32u.dll >C:\SyscallTables\Compiled\Composition\X86_64\NT10\win32k\%arg1%.txt 5 | pushd C:\SyscallTables\Compiled\Composition\X86_64\ 6 | C:\SyscallTables\Compiled\Composition\sstc.exe -h -d NT10 7 | C:\SyscallTables\Compiled\Composition\sstc.exe -h -w -d NT10 8 | popd 9 | pause -------------------------------------------------------------------------------- /Compiled/scg32.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/scg32.exe -------------------------------------------------------------------------------- /Compiled/scg64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Compiled/scg64.exe -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | Copyright (c) 2016 - 2025, SyscallTables Project, hfiref0x 2 | 3 | Redistribution and use in source and binary forms, with or without 4 | modification, are permitted provided that the following conditions are met: 5 | 6 | * Redistributions of source code must retain the above copyright notice, this 7 | list of conditions and the following disclaimer. 8 | 9 | * Redistributions in binary form must reproduce the above copyright notice, 10 | this list of conditions and the following disclaimer in the documentation 11 | and/or other materials provided with the distribution. 12 | 13 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 14 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 16 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 17 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 19 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 20 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 21 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 22 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 23 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | # Syscall tables 3 | ## Combined Windows syscall tables 4 | 5 | # X86-64 6 | 7 | ## Ntoskrnl service tables 8 | 9 | + Windows 2003 SP2 build 3790 also Windows XP 64; 10 | + Windows Vista RTM build 6000; 11 | + Windows Vista SP2 build 6002; * Note that it is identical for 6001 build 12 | + Windows 7 SP1 build 7601; * Note that it is identical for 7600 build 13 | + Windows 8 RTM build 9200; 14 | + Windows 8.1 build 9600; 15 | + Windows 10 TP build 10061; 16 | + Windows 10 TH1 build 10240; 17 | + Windows 10 TH2 build 10586; 18 | + Windows 10 RS1 build 14393; 19 | + Windows 10 RS2 build 15063; 20 | + Windows 10 RS3 build 16299; 21 | + Windows 10 RS4 build 17134; 22 | + Windows 10 RS5 build 17763; 23 | + Windows 10 19H1 build 18362; 24 | + Windows 10 19H2 build 18363; 25 | + Windows 10 20H1 build 19041; * Note that 19042, 19043, 19044, 19045 are the same as 19041 26 | + Windows Server 2022 build 20348; 27 | + Windows 11 21H2 build 22000; 28 | + Windows 11 22H2 build 22621; 29 | + Windows 11 23H2 build 22631; 30 | + Windows 11 24H2 build 26120; 31 | + Windows 11 25H2 build 27686; 32 | + Windows 11 25H2 build 27695; 33 | + Windows 11 25H2 build 27723; 34 | + Windows 11 25H2 build 27729; 35 | + Windows 11 25H2 build 27783; 36 | + Windows 11 25H2 build 27823; 37 | + Windows 11 25H2 build 27842. 38 | 39 | ** located in Compiled\Composition\X86_64\ntos 40 | 41 | NT6 (Windows Vista/7/8/8.1) + bonus NT5.2 (Windows XP x64) 42 | 43 | **View online** https://hfiref0x.github.io/X86_64/NT6_syscalls.html 44 | 45 | NT10 (Windows 10/11) 46 | 47 | **View online** https://hfiref0x.github.io/X86_64/NT10_syscalls.html 48 | 49 | ## Win32k service tables 50 | 51 | + Windows Vista RTM build 6000; 52 | + Windows 7 SP1 build 7601; 53 | + Windows 8 RTM build 9200; 54 | + Windows 8.1 build 9600; 55 | + Windows 10 TH1 build 10240; 56 | + Windows 10 TH2 build 10586; 57 | + Windows 10 RS1 build 14393; 58 | + Windows 10 RS2 build 15063; 59 | + Windows 10 RS3 build 16299; 60 | + Windows 10 RS4 build 17134; 61 | + Windows 10 RS5 build 17763; 62 | + Windows 10 19H1 build 18362; 63 | + Windows 10 19H2 build 18363; 64 | + Windows 10 20H1 build 19041; * Note that 19042, 19043, 19044, 19045 are the same as 19041 65 | + Windows Server 2022 build 20348; 66 | + Windows 11 21H2 build 22000; 67 | + Windows 11 22H2 build 22621; 68 | + Windows 11 23H2 build 22631; 69 | + Windows 11 24H2 build 26120; 70 | + Windows 11 25H2 build 27686; 71 | + Windows 11 25H2 build 27695; 72 | + Windows 11 25H2 build 27723; 73 | + Windows 11 25H2 build 27729; 74 | + Windows 11 25H2 build 27783; 75 | + Windows 11 25H2 build 27823; 76 | + Windows 11 25H2 build 27842. 77 | 78 | ** located in Compiled\Composition\X86_64\win32k 79 | 80 | NT6 (Windows Vista/7/8/8.1) 81 | 82 | **View online** https://hfiref0x.github.io/X86_64/NT6_w32ksyscalls.html 83 | 84 | NT10 (Windows 10/11) 85 | 86 | **View online** https://hfiref0x.github.io/X86_64/NT10_w32ksyscalls.html 87 | 88 | ## IUM service tables 89 | 90 | + Windows 10 20H1 build 19041; * Note that 19042, 19043, 19044, 19045 are the same as 19041 91 | + Windows 11 DEV build 25276; 92 | + Windows 11 25H2 27823. 93 | 94 | ** located in Compiled\Composition\X86_64\ium 95 | 96 | NT10 (Windows 10/11) 97 | **View online** https://hfiref0x.github.io/X86_64/NT10_iumsyscalls.html 98 | 99 | # ARM64 100 | 101 | ## Ntoskrnl service tables 102 | 103 | + Windows 11 23H2 build 22631; 104 | + Windows 11 24H2 build 26100. 105 | 106 | ** located in Compiled\Composition\ARM64\ntos 107 | 108 | NT10 (Windows 10/11) 109 | 110 | **View online** https://hfiref0x.github.io/ARM64/syscalls.html 111 | 112 | ## Win32k service tables 113 | 114 | + Windows 11 23H2 build 22631; 115 | + Windows 11 24H2 build 26100. 116 | 117 | ** located in Compiled\Composition\ARM64\win32k 118 | 119 | NT10 (Windows 10/11) 120 | 121 | **View online** https://hfiref0x.github.io/ARM64/w32ksyscalls.html 122 | 123 | # Usage 124 | 125 | 1) Dump syscall table list (using scg for ntoskrnl or wscg64 for win32k), see run examples for more info. 126 | 2) [Tables] <- put syscall list text file named as build number inside directory (ntos subdirectory for ntoskrnl.exe tables, win32k subdirectory for win32k.sys tables); 127 | 128 | 3) sstc.exe <- run composer with key -h to generate html output file, else output file will be saved in markdown table format. Specify -w as second param if you want to generate win32k combined syscall table. By default sstc will read files from "Tables" (without quotes) directory and compose output table. Specify -d "DirectoryName" (without quotes) if you want to generate table from different directory, in any case sstc will expect ntos and/or win32k subfolders are present inside target directory. 129 | 130 | Run Examples: 131 | * scg64.exe c:\wfiles\ntdll\ntdll_7600.dll > table7600.txt 132 | * scg64.exe c:\wfiles\win32u\win32u_11.dll > win32u_11.txt 133 | * sstc -w 134 | * sstc -h 135 | * sstc -h -d OnlyW10 136 | * sstc -h -w 137 | 138 | # 3rd party code usage 139 | Uses Zydis x86/x86-64 disassembler and code generation library (https://github.com/zyantific/zydis) 140 | 141 | # Build 142 | 143 | Composer source code written in C#. In order to build from source you need Microsoft Visual Studio version 2022 and higher and .NET Framework version 4.5 and higher. Both scg and wscg source code written in C. In order to build from source you need Microsoft Visual Studio version 2022 with SDK 19041 or higher installed. 144 | 145 | # Authors 146 | 147 | + scg (c) 2018 - 2025 SyscallTables Project 148 | + sstComposer (c) 2016 - 2025 SyscallTables Project 149 | 150 | Original scg (c) 2011 gr8 151 | -------------------------------------------------------------------------------- /Source/scg/main.c: -------------------------------------------------------------------------------- 1 | /******************************************************************************* 2 | * 3 | * (C) COPYRIGHT AUTHORS, 2018 - 2024 4 | * 5 | * TITLE: MAIN.C 6 | * 7 | * VERSION: 1.30 8 | * 9 | * DATE: 18 Aug 2024 10 | * 11 | * Ntdll/Win32u/Iumdll Syscall dumper 12 | * Based on gr8 scg project 13 | * 14 | * THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF 15 | * ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED 16 | * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A 17 | * PARTICULAR PURPOSE. 18 | * 19 | *******************************************************************************/ 20 | 21 | #if !defined UNICODE 22 | #error ANSI build is not supported 23 | #endif 24 | 25 | #if defined (_MSC_VER) 26 | #if (_MSC_VER >= 1900) 27 | #ifdef _DEBUG 28 | #pragma comment(lib, "vcruntimed.lib") 29 | #pragma comment(lib, "ucrtd.lib") 30 | #else 31 | #pragma comment(lib, "libucrt.lib") 32 | #pragma comment(lib, "libvcruntime.lib") 33 | #endif 34 | #endif 35 | #endif 36 | 37 | #include 38 | #include 39 | #include 40 | #include "minirtl\cmdline.h" 41 | #include "minirtl\minirtl.h" 42 | 43 | #include 44 | 45 | #pragma comment(lib, "version.lib") 46 | 47 | typedef enum tagScgDllType { 48 | ScgNtDll = 0, 49 | ScgWin32u, 50 | ScgIumDll, 51 | ScgUnknown 52 | } ScgDllType; 53 | 54 | typedef struct _LANGANDCODEPAGE { 55 | WORD wLanguage; 56 | WORD wCodePage; 57 | } LANGANDCODEPAGE, * LPTRANSLATE; 58 | 59 | #ifndef RtlOffsetToPointer 60 | #define RtlOffsetToPointer(Base, Offset) ((PCHAR)( ((PCHAR)(Base)) + ((ULONG_PTR)(Offset)))) 61 | #endif 62 | 63 | /* 64 | * MapInputFile 65 | * 66 | * Purpose: 67 | * 68 | * Create mapped section from input file. 69 | * 70 | */ 71 | PVOID MapInputFile( 72 | _In_ LPCWSTR lpFileName 73 | ) 74 | { 75 | HANDLE hFile, hMapping; 76 | PVOID pvImageBase = NULL; 77 | 78 | hFile = CreateFile(lpFileName, 79 | GENERIC_READ, 80 | FILE_SHARE_READ | 81 | FILE_SHARE_WRITE | 82 | FILE_SHARE_DELETE, 83 | NULL, 84 | OPEN_EXISTING, 85 | 0, 86 | NULL); 87 | 88 | if (hFile != INVALID_HANDLE_VALUE) { 89 | 90 | hMapping = CreateFileMapping(hFile, 91 | NULL, 92 | PAGE_READONLY | SEC_IMAGE, 93 | 0, 94 | 0, 95 | NULL); 96 | 97 | if (hMapping != NULL) { 98 | 99 | pvImageBase = MapViewOfFile(hMapping, 100 | FILE_MAP_READ, 0, 0, 0); 101 | 102 | CloseHandle(hMapping); 103 | } 104 | CloseHandle(hFile); 105 | } 106 | return pvImageBase; 107 | } 108 | 109 | /* 110 | * GetDllType 111 | * 112 | * Purpose: 113 | * 114 | * Parse dll version and check it against known values to determine dll type. 115 | * 116 | */ 117 | ScgDllType GetDllType( 118 | _In_ LPCWSTR lpFileName) 119 | { 120 | DWORD dwSize; 121 | DWORD dwHandle; 122 | PVOID vinfo = NULL; 123 | LPTRANSLATE lpTranslate = NULL; 124 | LPWSTR lpOriginalFileName; 125 | WCHAR szKey[100 + 1]; 126 | 127 | ScgDllType dllType = ScgUnknown; 128 | 129 | dwSize = GetFileVersionInfoSize(lpFileName, &dwHandle); 130 | if (dwSize) { 131 | vinfo = LocalAlloc(LMEM_ZEROINIT, (SIZE_T)dwSize); 132 | if (vinfo) { 133 | if (GetFileVersionInfo(lpFileName, 0, dwSize, vinfo)) { 134 | 135 | dwSize = 0; 136 | if (VerQueryValue(vinfo, 137 | L"\\VarFileInfo\\Translation", 138 | (LPVOID*)&lpTranslate, 139 | (PUINT)&dwSize)) 140 | { 141 | RtlFillMemory(&szKey, sizeof(szKey), 0); 142 | 143 | StringCchPrintf(szKey, 144 | RTL_NUMBER_OF(szKey), 145 | TEXT("\\StringFileInfo\\%04x%04x\\InternalName"), 146 | lpTranslate[0].wLanguage, 147 | lpTranslate[0].wCodePage); 148 | 149 | if (VerQueryValue(vinfo, szKey, (LPVOID*)&lpOriginalFileName, (PUINT)&dwSize)) { 150 | 151 | if (_strcmpi(lpOriginalFileName, L"IumDll.dll") == 0) { 152 | dllType = ScgIumDll; 153 | } 154 | else if (_strcmpi(lpOriginalFileName, L"Ntdll.dll") == 0) { 155 | dllType = ScgNtDll; 156 | } 157 | else if (_strcmpi(lpOriginalFileName, L"win32u") == 0) 158 | { 159 | dllType = ScgWin32u; 160 | } 161 | 162 | } 163 | } 164 | } 165 | LocalFree(vinfo); 166 | } 167 | } 168 | 169 | return dllType; 170 | } 171 | 172 | VOID ProcessExportEntry( 173 | _In_ PCHAR FunctionCode, 174 | _In_ PCHAR FunctionName, 175 | _In_ ScgDllType DllType, 176 | _In_ WORD MachineType 177 | ) 178 | { 179 | size_t cchFuncName = 0; 180 | DWORD sid; 181 | PBYTE ptrCode; 182 | ULONG i, max, value; 183 | 184 | USHORT targetUShort; 185 | ZydisDisassembledInstruction instruction; 186 | ZyanU64 runtime_address; 187 | ZyanUSize offset; 188 | ZydisMachineMode machineMode; 189 | CHAR nameBuffer[MAX_PATH]; 190 | 191 | switch (DllType) { 192 | case ScgIumDll: 193 | targetUShort = 'uI'; 194 | break; 195 | case ScgWin32u: 196 | targetUShort = 'tN'; 197 | break; 198 | default: 199 | targetUShort = 'wZ'; 200 | break; 201 | } 202 | 203 | if (*(USHORT*)FunctionName != targetUShort) { 204 | return; 205 | } 206 | 207 | if (S_OK != StringCchLengthA(FunctionName, MAX_PATH, &cchFuncName)) 208 | { 209 | printf_s("scg: Unexpected function name length %zu\r\n", cchFuncName); 210 | } 211 | 212 | if (S_OK != StringCchCopyNA(nameBuffer, MAX_PATH, FunctionName, cchFuncName)) 213 | { 214 | printf_s("scg: Unexpected error with function name\r\n"); 215 | } 216 | 217 | sid = (DWORD)-1; 218 | ptrCode = (PBYTE)FunctionCode; 219 | i = 0; 220 | 221 | switch (MachineType) 222 | { 223 | case IMAGE_FILE_MACHINE_I386: 224 | max = 16; 225 | machineMode = ZYDIS_MACHINE_MODE_LEGACY_32; 226 | break; 227 | case IMAGE_FILE_MACHINE_AMD64: 228 | default: 229 | max = 32; 230 | machineMode = ZYDIS_MACHINE_MODE_LONG_64; 231 | break; 232 | } 233 | 234 | if (MachineType == IMAGE_FILE_MACHINE_AMD64 || 235 | MachineType == IMAGE_FILE_MACHINE_I386) 236 | { 237 | offset = 0; 238 | runtime_address = (ZyanU64)ptrCode; 239 | 240 | RtlSecureZeroMemory(&instruction, sizeof(instruction)); 241 | 242 | while (ZYAN_SUCCESS(ZydisDisassembleIntel( 243 | machineMode, 244 | runtime_address, 245 | ptrCode + offset, 246 | max - offset, 247 | &instruction))) 248 | { 249 | // 250 | // mov reg, SyscallId 251 | // 252 | if (instruction.info.length == 5 && 253 | instruction.info.mnemonic == ZYDIS_MNEMONIC_MOV && 254 | instruction.info.operand_count == 2 && 255 | instruction.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && 256 | instruction.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE) 257 | { 258 | sid = (DWORD)instruction.operands[1].imm.value.u; 259 | break; 260 | } 261 | offset += instruction.info.length; 262 | runtime_address += instruction.info.length; 263 | } 264 | } 265 | else if (MachineType == IMAGE_FILE_MACHINE_ARM64) { 266 | // 267 | // SVC SyscallId 268 | // 269 | value = *(DWORD*)ptrCode; 270 | sid = (value >> 5) & 0xffff; 271 | } 272 | 273 | if (sid != (DWORD)-1) { 274 | if (DllType == ScgNtDll) { 275 | // 276 | // Hack for consistency. 277 | // 278 | nameBuffer[0] = 'N'; 279 | nameBuffer[1] = 't'; 280 | } 281 | printf_s("%s\t%lu\n", nameBuffer, sid); 282 | } 283 | #ifdef _DEBUG 284 | else { 285 | printf_s("scg: syscall index for %s not found\r\n", nameBuffer); 286 | } 287 | #endif 288 | } 289 | 290 | /* 291 | * ParseInputFile 292 | * 293 | * Purpose: 294 | * 295 | * Generate syscall list from given dll. 296 | * 297 | */ 298 | VOID ParseInputFile( 299 | _In_ LPCWSTR lpFileName) 300 | { 301 | PIMAGE_FILE_HEADER FileHeader; 302 | 303 | union { 304 | PIMAGE_OPTIONAL_HEADER32 oh32; 305 | PIMAGE_OPTIONAL_HEADER64 oh64; 306 | } oh; 307 | PIMAGE_EXPORT_DIRECTORY ExportDirectory = NULL; 308 | 309 | PULONG NameTableBase; 310 | PULONG FunctionsTableBase; 311 | PUSHORT NameOrdinalTableBase; 312 | 313 | PCHAR pvImageBase; 314 | ULONG entryIndex; 315 | 316 | ScgDllType dllType = GetDllType(lpFileName); 317 | 318 | if (dllType == ScgUnknown) { 319 | printf_s("scg: unknown or corrupted dll, must be ntdll/win32u/iumdll\r\n"); 320 | return; 321 | } 322 | 323 | pvImageBase = MapInputFile(lpFileName); 324 | if (pvImageBase == NULL) { 325 | printf_s("scg: cannot load input file, GetLastError %lu\r\n", GetLastError()); 326 | return; 327 | } 328 | 329 | __try { 330 | 331 | FileHeader = (PIMAGE_FILE_HEADER)RtlOffsetToPointer(pvImageBase, 332 | ((PIMAGE_DOS_HEADER)pvImageBase)->e_lfanew + sizeof(DWORD)); 333 | 334 | switch (FileHeader->Machine) { 335 | 336 | case IMAGE_FILE_MACHINE_I386: 337 | 338 | oh.oh32 = (PIMAGE_OPTIONAL_HEADER32)RtlOffsetToPointer(FileHeader, 339 | sizeof(IMAGE_FILE_HEADER)); 340 | 341 | ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlOffsetToPointer(pvImageBase, 342 | oh.oh32->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); 343 | 344 | break; 345 | 346 | case IMAGE_FILE_MACHINE_ARM64: 347 | case IMAGE_FILE_MACHINE_AMD64: 348 | 349 | oh.oh64 = (PIMAGE_OPTIONAL_HEADER64)RtlOffsetToPointer(FileHeader, 350 | sizeof(IMAGE_FILE_HEADER)); 351 | 352 | ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlOffsetToPointer(pvImageBase, 353 | oh.oh64->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); 354 | 355 | break; 356 | 357 | default: 358 | printf_s("scg: unexpected image machine type %lx\r\n", FileHeader->Machine); 359 | break; 360 | } 361 | 362 | if (ExportDirectory) { 363 | 364 | NameTableBase = (PULONG)RtlOffsetToPointer(pvImageBase, (ULONG)ExportDirectory->AddressOfNames); 365 | NameOrdinalTableBase = (PUSHORT)RtlOffsetToPointer(pvImageBase, ExportDirectory->AddressOfNameOrdinals); 366 | FunctionsTableBase = (PULONG)RtlOffsetToPointer(pvImageBase, ExportDirectory->AddressOfFunctions); 367 | 368 | for (entryIndex = 0; entryIndex < ExportDirectory->NumberOfNames; entryIndex++) { 369 | 370 | ProcessExportEntry( 371 | RtlOffsetToPointer(pvImageBase, FunctionsTableBase[NameOrdinalTableBase[entryIndex]]), 372 | RtlOffsetToPointer(pvImageBase, NameTableBase[entryIndex]), 373 | dllType, 374 | FileHeader->Machine); 375 | 376 | } 377 | } 378 | } 379 | __finally { 380 | UnmapViewOfFile(pvImageBase); 381 | if (AbnormalTermination()) { 382 | printf_s("Unexpected exception occurred\r\n"); 383 | } 384 | } 385 | } 386 | 387 | /* 388 | * main 389 | * 390 | * Purpose: 391 | * 392 | * Program entry point. 393 | * 394 | */ 395 | int main() 396 | { 397 | ULONG paramLength = 0; 398 | WCHAR szInputFile[MAX_PATH + 1]; 399 | PVOID pvEnable = (PVOID)1; 400 | 401 | HeapSetInformation(GetProcessHeap(), HeapEnableTerminationOnCorruption, &pvEnable, sizeof(pvEnable)); 402 | 403 | RtlSecureZeroMemory(szInputFile, sizeof(szInputFile)); 404 | GetCommandLineParam(GetCommandLine(), 1, szInputFile, MAX_PATH, ¶mLength); 405 | if (paramLength > 0) { 406 | ParseInputFile((LPCWSTR)szInputFile); 407 | } 408 | else { 409 | printf_s("Syscall Generator (NTOS/WIN32K/IUM)\r\nSupports ntdll/win32u/iumdll dlls as targets\r\nUsage: scg filename\r\n"); 410 | } 411 | 412 | return 0; 413 | } 414 | -------------------------------------------------------------------------------- /Source/scg/minirtl/_strcmpi.c: -------------------------------------------------------------------------------- 1 | #include "rtltypes.h" 2 | 3 | int _strcmpi_a(const char *s1, const char *s2) 4 | { 5 | char c1, c2; 6 | 7 | if ( s1==s2 ) 8 | return 0; 9 | 10 | if ( s1==0 ) 11 | return -1; 12 | 13 | if ( s2==0 ) 14 | return 1; 15 | 16 | do { 17 | c1 = locase_a(*s1); 18 | c2 = locase_a(*s2); 19 | s1++; 20 | s2++; 21 | } while ( (c1 != 0) && (c1 == c2) ); 22 | 23 | return (int)(c1 - c2); 24 | } 25 | 26 | int _strcmpi_w(const wchar_t *s1, const wchar_t *s2) 27 | { 28 | wchar_t c1, c2; 29 | 30 | if ( s1==s2 ) 31 | return 0; 32 | 33 | if ( s1==0 ) 34 | return -1; 35 | 36 | if ( s2==0 ) 37 | return 1; 38 | 39 | do { 40 | c1 = locase_w(*s1); 41 | c2 = locase_w(*s2); 42 | s1++; 43 | s2++; 44 | } while ( (c1 != 0) && (c1 == c2) ); 45 | 46 | return (int)(c1 - c2); 47 | } 48 | -------------------------------------------------------------------------------- /Source/scg/minirtl/cmdline.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | BOOL GetCommandLineParamW( 4 | IN LPCWSTR CmdLine, 5 | IN ULONG ParamIndex, 6 | OUT LPWSTR Buffer, 7 | IN ULONG BufferSize, 8 | OUT PULONG ParamLen 9 | ) 10 | { 11 | ULONG c, plen = 0; 12 | TCHAR divider; 13 | 14 | if (ParamLen != NULL) 15 | *ParamLen = 0; 16 | 17 | if (CmdLine == NULL) { 18 | if ((Buffer != NULL) && (BufferSize > 0)) 19 | *Buffer = 0; 20 | return FALSE; 21 | } 22 | 23 | for (c = 0; c <= ParamIndex; c++) { 24 | plen = 0; 25 | 26 | while (*CmdLine == ' ') 27 | CmdLine++; 28 | 29 | switch (*CmdLine) { 30 | case 0: 31 | goto zero_term_exit; 32 | 33 | case '"': 34 | CmdLine++; 35 | divider = '"'; 36 | break; 37 | 38 | default: 39 | divider = ' '; 40 | } 41 | 42 | while ((*CmdLine != '"') && (*CmdLine != divider) && (*CmdLine != 0)) { 43 | plen++; 44 | if (c == ParamIndex) 45 | if ((plen < BufferSize) && (Buffer != NULL)) { 46 | *Buffer = *CmdLine; 47 | Buffer++; 48 | } 49 | CmdLine++; 50 | } 51 | 52 | if (*CmdLine != 0) 53 | CmdLine++; 54 | } 55 | 56 | zero_term_exit: 57 | 58 | if ((Buffer != NULL) && (BufferSize > 0)) 59 | *Buffer = 0; 60 | 61 | if (ParamLen != NULL) 62 | *ParamLen = plen; 63 | 64 | if (plen < BufferSize) 65 | return TRUE; 66 | else 67 | return FALSE; 68 | } 69 | 70 | BOOL GetCommandLineParamA( 71 | IN LPCSTR CmdLine, 72 | IN ULONG ParamIndex, 73 | OUT LPSTR Buffer, 74 | IN ULONG BufferSize, 75 | OUT PULONG ParamLen 76 | ) 77 | { 78 | ULONG c, plen = 0; 79 | TCHAR divider; 80 | 81 | if (CmdLine == NULL) 82 | return FALSE; 83 | 84 | if (ParamLen != NULL) 85 | *ParamLen = 0; 86 | 87 | for (c = 0; c <= ParamIndex; c++) { 88 | plen = 0; 89 | 90 | while (*CmdLine == ' ') 91 | CmdLine++; 92 | 93 | switch (*CmdLine) { 94 | case 0: 95 | goto zero_term_exit; 96 | 97 | case '"': 98 | CmdLine++; 99 | divider = '"'; 100 | break; 101 | 102 | default: 103 | divider = ' '; 104 | } 105 | 106 | while ((*CmdLine != '"') && (*CmdLine != divider) && (*CmdLine != 0)) { 107 | plen++; 108 | if (c == ParamIndex) 109 | if ((plen < BufferSize) && (Buffer != NULL)) { 110 | *Buffer = *CmdLine; 111 | Buffer++; 112 | } 113 | CmdLine++; 114 | } 115 | 116 | if (*CmdLine != 0) 117 | CmdLine++; 118 | } 119 | 120 | zero_term_exit: 121 | 122 | if ((Buffer != NULL) && (BufferSize > 0)) 123 | *Buffer = 0; 124 | 125 | if (ParamLen != NULL) 126 | *ParamLen = plen; 127 | 128 | if (plen < BufferSize) 129 | return TRUE; 130 | else 131 | return FALSE; 132 | } 133 | 134 | char *ExtractFilePathA(const char *FileName, char *FilePath) 135 | { 136 | char *p = (char *)FileName, *p0 = (char *)FileName; 137 | 138 | if ((FileName == 0) || (FilePath == 0)) 139 | return 0; 140 | 141 | while (*FileName != 0) { 142 | if (*FileName == '\\') 143 | p = (char *)FileName + 1; 144 | FileName++; 145 | } 146 | 147 | while (p0 < p) { 148 | *FilePath = *p0; 149 | FilePath++; 150 | p0++; 151 | } 152 | 153 | *FilePath = 0; 154 | 155 | return FilePath; 156 | } 157 | 158 | wchar_t *ExtractFilePathW(const wchar_t *FileName, wchar_t *FilePath) 159 | { 160 | wchar_t *p = (wchar_t *)FileName, *p0 = (wchar_t *)FileName; 161 | 162 | if ((FileName == 0) || (FilePath == 0)) 163 | return 0; 164 | 165 | while (*FileName != 0) { 166 | if (*FileName == '\\') 167 | p = (wchar_t *)FileName + 1; 168 | FileName++; 169 | } 170 | 171 | while (p0 < p) { 172 | *FilePath = *p0; 173 | FilePath++; 174 | p0++; 175 | } 176 | 177 | *FilePath = 0; 178 | 179 | return FilePath; 180 | } 181 | -------------------------------------------------------------------------------- /Source/scg/minirtl/cmdline.h: -------------------------------------------------------------------------------- 1 | #ifndef _CMDLINEH_ 2 | #define _CMDLINEH_ 3 | 4 | BOOL GetCommandLineParamW( 5 | IN LPCWSTR CmdLine, 6 | IN ULONG ParamIndex, 7 | OUT LPWSTR Buffer, 8 | IN ULONG BufferSize, 9 | OUT PULONG ParamLen 10 | ); 11 | 12 | BOOL GetCommandLineParamA( 13 | IN LPCSTR CmdLine, 14 | IN ULONG ParamIndex, 15 | OUT LPSTR Buffer, 16 | IN ULONG BufferSize, 17 | OUT PULONG ParamLen 18 | ); 19 | 20 | char *ExtractFilePathA(const char *FileName, char *FilePath); 21 | wchar_t *ExtractFilePathW(const wchar_t *FileName, wchar_t *FilePath); 22 | 23 | #ifdef UNICODE 24 | 25 | #define ExtractFilePath ExtractFilePathW 26 | #define GetCommandLineParam GetCommandLineParamW 27 | 28 | #else // ANSI 29 | 30 | #define ExtractFilePath ExtractFilePathA 31 | #define GetCommandLineParam GetCommandLineParamA 32 | 33 | #endif 34 | 35 | #endif /* _CMDLINEH_ */ 36 | -------------------------------------------------------------------------------- /Source/scg/minirtl/minirtl.h: -------------------------------------------------------------------------------- 1 | /* 2 | Module name: 3 | minirtl.h 4 | 5 | Description: 6 | header for string handling and conversion routines 7 | 8 | Date: 9 | 1 Mar 2015 10 | */ 11 | 12 | #ifndef _MINIRTL_ 13 | #define _MINIRTL_ 14 | 15 | // string copy/concat/length 16 | 17 | char *_strend_a(const char *s); 18 | wchar_t *_strend_w(const wchar_t *s); 19 | 20 | char *_strcpy_a(char *dest, const char *src); 21 | wchar_t *_strcpy_w(wchar_t *dest, const wchar_t *src); 22 | 23 | char *_strcat_a(char *dest, const char *src); 24 | wchar_t *_strcat_w(wchar_t *dest, const wchar_t *src); 25 | 26 | char *_strncpy_a(char *dest, size_t ccdest, const char *src, size_t ccsrc); 27 | wchar_t *_strncpy_w(wchar_t *dest, size_t ccdest, const wchar_t *src, size_t ccsrc); 28 | 29 | size_t _strlen_a(const char *s); 30 | size_t _strlen_w(const wchar_t *s); 31 | 32 | // comparing 33 | 34 | int _strcmp_a(const char *s1, const char *s2); 35 | int _strcmp_w(const wchar_t *s1, const wchar_t *s2); 36 | 37 | int _strncmp_a(const char *s1, const char *s2, size_t cchars); 38 | int _strncmp_w(const wchar_t *s1, const wchar_t *s2, size_t cchars); 39 | 40 | int _strcmpi_a(const char *s1, const char *s2); 41 | int _strcmpi_w(const wchar_t *s1, const wchar_t *s2); 42 | 43 | int _strncmpi_a(const char *s1, const char *s2, size_t cchars); 44 | int _strncmpi_w(const wchar_t *s1, const wchar_t *s2, size_t cchars); 45 | 46 | char *_strstr_a(const char *s, const char *sub_s); 47 | wchar_t *_strstr_w(const wchar_t *s, const wchar_t *sub_s); 48 | 49 | char *_strstri_a(const char *s, const char *sub_s); 50 | wchar_t *_strstri_w(const wchar_t *s, const wchar_t *sub_s); 51 | 52 | // conversion of integer types to string, returning string length 53 | 54 | size_t ultostr_a(unsigned long x, char *s); 55 | size_t ultostr_w(unsigned long x, wchar_t *s); 56 | 57 | size_t ultohex_a(unsigned long x, char *s); 58 | size_t ultohex_w(unsigned long x, wchar_t *s); 59 | 60 | size_t itostr_a(int x, char *s); 61 | size_t itostr_w(int x, wchar_t *s); 62 | 63 | size_t i64tostr_a(signed long long x, char *s); 64 | size_t i64tostr_w(signed long long x, wchar_t *s); 65 | 66 | size_t u64tostr_a(unsigned long long x, char *s); 67 | size_t u64tostr_w(unsigned long long x, wchar_t *s); 68 | 69 | size_t u64tohex_a(unsigned long long x, char *s); 70 | size_t u64tohex_w(unsigned long long x, wchar_t *s); 71 | 72 | // string to integers conversion 73 | 74 | unsigned long strtoul_a(char *s); 75 | unsigned long strtoul_w(wchar_t *s); 76 | 77 | unsigned long long strtou64_a(char *s); 78 | unsigned long long strtou64_w(wchar_t *s); 79 | 80 | unsigned long hextoul_a(char *s); 81 | unsigned long hextoul_w(wchar_t *s); 82 | 83 | int strtoi_a(char *s); 84 | int strtoi_w(wchar_t *s); 85 | 86 | signed long long strtoi64_a(char *s); 87 | signed long long strtoi64_w(wchar_t *s); 88 | 89 | unsigned long long hextou64_a(char *s); 90 | unsigned long long hextou64_w(wchar_t *s); 91 | 92 | /* =================================== */ 93 | 94 | #ifdef UNICODE 95 | 96 | #define _strend _strend_w 97 | #define _strcpy _strcpy_w 98 | #define _strcat _strcat_w 99 | #define _strlen _strlen_w 100 | #define _strncpy _strncpy_w 101 | 102 | #define _strcmp _strcmp_w 103 | #define _strncmp _strncmp_w 104 | #define _strcmpi _strcmpi_w 105 | #define _strncmpi _strncmpi_w 106 | #define _strstr _strstr_w 107 | #define _strstri _strstri_w 108 | 109 | #define ultostr ultostr_w 110 | #define ultohex ultohex_w 111 | #define itostr itostr_w 112 | #define i64tostr i64tostr_w 113 | #define u64tostr u64tostr_w 114 | #define u64tohex u64tohex_w 115 | 116 | #define strtoul strtoul_w 117 | #define hextoul hextoul_w 118 | #define strtoi strtoi_w 119 | #define strtoi64 strtoi64_w 120 | #define strtou64 strtou64_w 121 | #define hextou64 hextou64_w 122 | 123 | #else // ANSI 124 | 125 | #define _strend _strend_a 126 | #define _strcpy _strcpy_a 127 | #define _strcat _strcat_a 128 | #define _strlen _strlen_a 129 | #define _strncpy _strncpy_a 130 | #define _strcmp _strcmp_a 131 | 132 | #define _strcmp _strcmp_a 133 | #define _strncmp _strncmp_a 134 | #define _strcmpi _strcmpi_a 135 | #define _strncmpi _strncmpi_a 136 | #define _strstr _strstr_a 137 | #define _strstri _strstri_a 138 | 139 | #define ultostr ultostr_a 140 | #define ultohex ultohex_a 141 | #define itostr itostr_a 142 | #define i64tostr i64tostr_a 143 | #define u64tostr u64tostr_a 144 | #define u64tohex u64tohex_a 145 | 146 | #define strtoul strtoul_a 147 | #define hextoul hextoul_a 148 | #define strtoi strtoi_a 149 | #define strtoi64 strtoi64_a 150 | #define strtou64 strtou64_a 151 | #define hextou64 hextou64_a 152 | 153 | #endif 154 | 155 | #endif /* _MINIRTL_ */ 156 | -------------------------------------------------------------------------------- /Source/scg/minirtl/rtltypes.h: -------------------------------------------------------------------------------- 1 | #ifndef _WCHAR_T_DEFINED 2 | typedef unsigned short wchar_t; 3 | #define _WCHAR_T_DEFINED 4 | #endif /* _WCHAR_T_DEFINED */ 5 | 6 | #ifndef _SIZE_T_DEFINED 7 | #ifdef _WIN64 8 | typedef unsigned __int64 size_t; 9 | #else /* _WIN64 */ 10 | typedef __w64 unsigned int size_t; 11 | #endif /* _WIN64 */ 12 | #define _SIZE_T_DEFINED 13 | #endif /* _SIZE_T_DEFINED */ 14 | 15 | __forceinline char locase_a(char c) 16 | { 17 | if ((c >= 'A') && (c <= 'Z')) 18 | return c + 0x20; 19 | else 20 | return c; 21 | } 22 | 23 | __forceinline wchar_t locase_w(wchar_t c) 24 | { 25 | if ((c >= 'A') && (c <= 'Z')) 26 | return c + 0x20; 27 | else 28 | return c; 29 | } 30 | 31 | __forceinline char byteabs(char x) { 32 | if (x < 0) 33 | return -x; 34 | return x; 35 | } 36 | 37 | __forceinline int _isdigit_a(char x) { 38 | return ((x >= '0') && (x <= '9')); 39 | } 40 | 41 | __forceinline int _isdigit_w(wchar_t x) { 42 | return ((x >= L'0') && (x <= L'9')); 43 | } 44 | -------------------------------------------------------------------------------- /Source/scg/res.rc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hfiref0x/SyscallTables/9a48582309b5fe795f489b36a5d1df38a3bddcde/Source/scg/res.rc -------------------------------------------------------------------------------- /Source/scg/resource.h: -------------------------------------------------------------------------------- 1 | //{{NO_DEPENDENCIES}} 2 | // Microsoft Visual C++ generated include file. 3 | // Used by res.rc 4 | 5 | // Next default values for new objects 6 | // 7 | #ifdef APSTUDIO_INVOKED 8 | #ifndef APSTUDIO_READONLY_SYMBOLS 9 | #define _APS_NEXT_RESOURCE_VALUE 101 10 | #define _APS_NEXT_COMMAND_VALUE 40001 11 | #define _APS_NEXT_CONTROL_VALUE 1001 12 | #define _APS_NEXT_SYMED_VALUE 101 13 | #endif 14 | #endif 15 | -------------------------------------------------------------------------------- /Source/scg/scg.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 14 4 | VisualStudioVersion = 14.0.25420.1 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "scg", "scg.vcxproj", "{FA7F7578-AF89-4131-880B-E3B9AE4B3D73}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Debug|x64.ActiveCfg = Debug|x64 17 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Debug|x64.Build.0 = Debug|x64 18 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Debug|x86.ActiveCfg = Debug|Win32 19 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Debug|x86.Build.0 = Debug|Win32 20 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Release|x64.ActiveCfg = Release|x64 21 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Release|x64.Build.0 = Release|x64 22 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Release|x86.ActiveCfg = Release|Win32 23 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | EndGlobal 29 | -------------------------------------------------------------------------------- /Source/scg/scg.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {FA7F7578-AF89-4131-880B-E3B9AE4B3D73} 23 | Win32Proj 24 | scg 25 | 10.0 26 | 27 | 28 | 29 | Application 30 | true 31 | v143 32 | Unicode 33 | 34 | 35 | Application 36 | false 37 | v143 38 | true 39 | Unicode 40 | 41 | 42 | Application 43 | true 44 | v143 45 | Unicode 46 | 47 | 48 | Application 49 | false 50 | v143 51 | true 52 | Unicode 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | true 74 | .\output\$(Platform)\$(Configuration)\ 75 | .\output\$(Platform)\$(Configuration)\ 76 | $(ProjectName)32 77 | 78 | 79 | true 80 | .\output\$(Platform)\$(Configuration)\ 81 | .\output\$(Platform)\$(Configuration)\ 82 | $(ProjectName)64 83 | 84 | 85 | false 86 | .\output\$(Platform)\$(Configuration)\ 87 | .\output\$(Platform)\$(Configuration)\ 88 | $(ProjectName)32 89 | AllRules.ruleset 90 | false 91 | 92 | 93 | false 94 | .\output\$(Platform)\$(Configuration)\ 95 | .\output\$(Platform)\$(Configuration)\ 96 | $(ProjectName)64 97 | AllRules.ruleset 98 | false 99 | 100 | 101 | 102 | 103 | 104 | Level4 105 | Disabled 106 | WIN32;_DEBUG;_WINDOWS;ZYDIS_STATIC_BUILD;ZYAN_NO_LIBC;%(PreprocessorDefinitions) 107 | true 108 | CompileAsC 109 | zydis;%(AdditionalIncludeDirectories) 110 | 111 | 112 | Console 113 | true 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | Level4 123 | Disabled 124 | _DEBUG;_WINDOWS;ZYDIS_STATIC_BUILD;ZYAN_NO_LIBC;%(PreprocessorDefinitions) 125 | true 126 | CompileAsC 127 | zydis;%(AdditionalIncludeDirectories) 128 | 129 | 130 | Console 131 | true 132 | 133 | 134 | 135 | 136 | 137 | 138 | Level4 139 | 140 | 141 | MinSpace 142 | true 143 | true 144 | WIN32;NDEBUG;_WINDOWS;ZYDIS_STATIC_BUILD;ZYAN_NO_LIBC;%(PreprocessorDefinitions) 145 | true 146 | MultiThreaded 147 | Guard 148 | true 149 | true 150 | CompileAsC 151 | false 152 | Size 153 | zydis;%(AdditionalIncludeDirectories) 154 | 155 | 156 | Console 157 | true 158 | true 159 | false 160 | 161 | 162 | true 163 | /NOCOFFGRPINFO %(AdditionalOptions) 164 | 165 | 166 | 167 | 168 | Level4 169 | 170 | 171 | MinSpace 172 | true 173 | true 174 | NDEBUG;_WINDOWS;ZYDIS_STATIC_BUILD;ZYAN_NO_LIBC;%(PreprocessorDefinitions) 175 | true 176 | MultiThreaded 177 | Guard 178 | true 179 | true 180 | CompileAsC 181 | false 182 | Size 183 | zydis;%(AdditionalIncludeDirectories) 184 | 185 | 186 | Console 187 | true 188 | true 189 | false 190 | 191 | 192 | true 193 | /NOCOFFGRPINFO %(AdditionalOptions) 194 | 195 | 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | -------------------------------------------------------------------------------- /Source/scg/scg.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {bf9f4a5f-db9e-4753-a972-e4e2af5fc431} 18 | 19 | 20 | 21 | 22 | Source Files 23 | 24 | 25 | Source Files 26 | 27 | 28 | zydis 29 | 30 | 31 | Source Files 32 | 33 | 34 | 35 | 36 | Header Files 37 | 38 | 39 | Header Files 40 | 41 | 42 | Header Files 43 | 44 | 45 | Header Files 46 | 47 | 48 | zydis 49 | 50 | 51 | 52 | 53 | Resource Files 54 | 55 | 56 | -------------------------------------------------------------------------------- /Source/scg/scg.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | c:\temp\win32u.dll >win32u.txt 5 | WindowsLocalDebugger 6 | 7 | 8 | c:\temp\win32u.dll >win32u.txt 9 | WindowsLocalDebugger 10 | 11 | 12 | c:\temp\win32u.dll >win32u.txt 13 | WindowsLocalDebugger 14 | 15 | 16 | c:\temp\win32u.dll >win32u.txt 17 | WindowsLocalDebugger 18 | 19 | -------------------------------------------------------------------------------- /Source/sstComposer/App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /Source/sstComposer/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("sstc")] 9 | [assembly: AssemblyDescription("Service table composer application")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("UG North")] 12 | [assembly: AssemblyProduct("sstc")] 13 | [assembly: AssemblyCopyright("Copyright © 2016 - 2023")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("674a6b7b-90e0-49e8-a090-2b7ee58a5478")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.3.23.01")] 37 | -------------------------------------------------------------------------------- /Source/sstComposer/sstc.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {674A6B7B-90E0-49E8-A090-2B7EE58A5478} 8 | Exe 9 | Properties 10 | sstc 11 | sstc 12 | v4.8 13 | 512 14 | true 15 | false 16 | 17 | publish\ 18 | true 19 | Disk 20 | false 21 | Foreground 22 | 7 23 | Days 24 | false 25 | false 26 | true 27 | 0 28 | 1.31.2301.%2a 29 | false 30 | true 31 | 32 | 33 | AnyCPU 34 | true 35 | full 36 | false 37 | bin\Debug\ 38 | DEBUG;TRACE 39 | prompt 40 | 4 41 | false 42 | SecurityRules.ruleset 43 | false 44 | 45 | 46 | AnyCPU 47 | none 48 | true 49 | bin\Release\ 50 | TRACE 51 | prompt 52 | 4 53 | false 54 | false 55 | MinimumRecommendedRules.ruleset 56 | false 57 | 58 | 59 | false 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | False 81 | Microsoft .NET Framework 4.5.2 %28x86 and x64%29 82 | true 83 | 84 | 85 | False 86 | .NET Framework 3.5 SP1 87 | false 88 | 89 | 90 | 91 | 98 | -------------------------------------------------------------------------------- /Source/sstComposer/sstc.csproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | publish\ 5 | 6 | 7 | 8 | 9 | 10 | en-US 11 | false 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /Source/sstComposer/sstc.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 14 4 | VisualStudioVersion = 14.0.24720.0 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "sstc", "sstc.csproj", "{674A6B7B-90E0-49E8-A090-2B7EE58A5478}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {674A6B7B-90E0-49E8-A090-2B7EE58A5478}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {674A6B7B-90E0-49E8-A090-2B7EE58A5478}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {674A6B7B-90E0-49E8-A090-2B7EE58A5478}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {674A6B7B-90E0-49E8-A090-2B7EE58A5478}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | EndGlobal 23 | --------------------------------------------------------------------------------