├── .gitignore ├── LICENSE ├── README.md ├── extract_syscalls.py ├── ntdll_dll_syscalls.json └── win32u_dll_syscalls.json /.gitignore: -------------------------------------------------------------------------------- 1 | # Byte-compiled / optimized / DLL files 2 | __pycache__/ 3 | *.py[cod] 4 | *$py.class 5 | 6 | # C extensions 7 | *.so 8 | 9 | # Distribution / packaging 10 | .Python 11 | env/ 12 | build/ 13 | develop-eggs/ 14 | dist/ 15 | downloads/ 16 | eggs/ 17 | .eggs/ 18 | lib/ 19 | lib64/ 20 | parts/ 21 | sdist/ 22 | var/ 23 | *.egg-info/ 24 | .installed.cfg 25 | *.egg 26 | 27 | # PyInstaller 28 | # Usually these files are written by a python script from a template 29 | # before PyInstaller builds the exe, so as to inject date/other infos into it. 30 | *.manifest 31 | *.spec 32 | 33 | # Installer logs 34 | pip-log.txt 35 | pip-delete-this-directory.txt 36 | 37 | # Unit test / coverage reports 38 | htmlcov/ 39 | .tox/ 40 | .coverage 41 | .coverage.* 42 | .cache 43 | nosetests.xml 44 | coverage.xml 45 | *,cover 46 | .hypothesis/ 47 | 48 | # Translations 49 | *.mo 50 | *.pot 51 | 52 | # Django stuff: 53 | *.log 54 | local_settings.py 55 | 56 | # Flask stuff: 57 | instance/ 58 | .webassets-cache 59 | 60 | # Scrapy stuff: 61 | .scrapy 62 | 63 | # Sphinx documentation 64 | docs/_build/ 65 | 66 | # PyBuilder 67 | target/ 68 | 69 | # IPython Notebook 70 | .ipynb_checkpoints 71 | 72 | # pyenv 73 | .python-version 74 | 75 | # celery beat schedule file 76 | celerybeat-schedule 77 | 78 | # dotenv 79 | .env 80 | 81 | # virtualenv 82 | venv/ 83 | ENV/ 84 | 85 | # Spyder project settings 86 | .spyderproject 87 | 88 | # Rope project settings 89 | .ropeproject 90 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | This is free and unencumbered software released into the public domain. 2 | 3 | Anyone is free to copy, modify, publish, use, compile, sell, or 4 | distribute this software, either in source code form or as a compiled 5 | binary, for any purpose, commercial or non-commercial, and by any 6 | means. 7 | 8 | In jurisdictions that recognize copyright laws, the author or authors 9 | of this software dedicate any and all copyright interest in the 10 | software to the public domain. We make this dedication for the benefit 11 | of the public at large and to the detriment of our heirs and 12 | successors. We intend this dedication to be an overt act of 13 | relinquishment in perpetuity of all present and future rights to this 14 | software under copyright law. 15 | 16 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 17 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 18 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 19 | IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR 20 | OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 21 | ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR 22 | OTHER DEALINGS IN THE SOFTWARE. 23 | 24 | For more information, please refer to 25 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # windows_syscalls_dumper 2 | A dirty IDAPython script to dump windows system call number/name pairs as JSON 3 | -------------------------------------------------------------------------------- /extract_syscalls.py: -------------------------------------------------------------------------------- 1 | import idautils 2 | import idc 3 | import json 4 | import os 5 | 6 | ea = idc.MinEA() 7 | all = {} 8 | while True: 9 | ea = idc.FindText(ea, idc.SEARCH_DOWN, 0, 0, "syscall") 10 | if ea == idaapi.BADADDR: 11 | break 12 | func_name = idc.GetFunctionName(ea) 13 | ins = idc.FindText(ea, idc.SEARCH_UP, 0, 0, "mov") 14 | 15 | syscall_num = idc.GetOpnd(ins, 1) 16 | all[func_name] = syscall_num 17 | ea += len("syscall") 18 | 19 | out_path = os.path.join(os.path.expanduser('~'), 'Desktop') 20 | in_file = idc.GetInputFile().replace('.','_') 21 | out_path += "\\" + in_file + '_syscalls.json' 22 | with open(out_path, 'w+') as fp: 23 | json.dump(all, fp) 24 | 25 | print "Saved %d system calls to %s" % (len(all), out_path) -------------------------------------------------------------------------------- /ntdll_dll_syscalls.json: -------------------------------------------------------------------------------- 1 | {"ZwResumeProcess": "168h", "ZwReleaseSemaphore": "0Ah", "ZwAllocateUserPhysicalPages": "71h", "ZwCancelIoFileEx": "8Dh", "ZwResetEvent": "165h", "ZwCreateProfile": "0B0h", "ZwRequestWaitReplyPort": "22h", "NtQueryDriverEntryOrder": "132h", "NtAlpcOpenSenderThread": "84h", "NtRegisterThreadTerminatePort": "15Ah", "NtWorkerFactoryWorkerReady": "1", "NtDebugActiveProcess": "0C2h", "NtSetInformationProcess": "1Ch", "ZwSaveMergedKeys": "171h", "NtPropagationComplete": "12Bh", "NtAlpcDisconnectPort": "80h", "ZwReadVirtualMemory": "3Fh", "ZwRollbackComplete": "16Ah", "NtWriteFile": "8", "ZwEnumerateDriverEntries": "0D3h", "ZwReadOnlyEnlistment": "155h", "ZwCreateTransactionManager": "0BCh", "ZwFlushKey": "0DDh", "ZwResumeThread": "52h", "ZwQueryAttributesFile": "3Dh", "ZwLockRegistryKey": "100h", "ZwQueryLicenseValue": "140h", "NtSetContextThread": "178h", "NtIsUILanguageComitted": "0F7h", "ZwIsSystemResumeAutomatic": "0F6h", "NtRollbackEnlistment": "16Bh", "NtQueryValueKey": "17h", "NtEnableLastKnownGood": "0D1h", "ZwAccessCheckByType": "63h", "NtDrawText": "0D0h", "NtAlpcDeletePortSection": "7Ch", "ZwStartProfile": "1A5h", "NtReplacePartitionUnit": "162h", "NtAlpcCreateSectionView": "7Ah", "ZwQueryMultipleValueKey": "141h", "NtApphelpCacheControl": "4Ch", "NtReadFile": "6", "ZwCreateRegistryTransaction": "0B2h", "ZwAlpcCreateResourceReserve": "79h", "NtQuerySystemInformation": "36h", "ZwReplyWaitReceivePort": "0Bh", "NtFreezeRegistry": "0E2h", "NtUnmapViewOfSectionEx": "1B8h", "NtLoadKey": "0FBh", "ZwStopProfile": "1A6h", "ZwWaitForWorkViaWorkerFactory": "1BFh", "NtCreateTimer2": "0B8h", "NtAlpcSetInformation": "89h", "ZwQuerySecurityAttributesToken": "147h", "NtCreateThread": "4Eh", "NtSetHighEventPair": "17Fh", "NtCreateUserProcess": "0BDh", "NtLockProductActivationKeys": "0FFh", "ZwQueryVirtualMemory": "23h", "NtSetTimerResolution": "19Dh", "NtCreateWorkerFactory": "0C1h", "NtTerminateThread": "53h", "ZwAccessCheckByTypeResultList": "64h", "ZwModifyDriverEntry": "108h", "ZwCreateKeyTransacted": "0A5h", "NtWaitForMultipleObjects": "5Bh", "NtIsProcessInJob": "4Fh", "NtRestoreKey": "167h", "ZwDelayExecution": "34h", "NtCommitComplete": "91h", "ZwMapUserPhysicalPagesScatter": "3", "ZwAccessCheckByTypeResultListAndAuditAlarm": "65h", "NtSetCachedSigningLevel2": "177h", "ZwAllocateVirtualMemory": "18h", "NtCreateResourceManager": "0B3h", "NtOpenEnlistment": "10Dh", "ZwSignalAndWaitForSingleObject": "1A3h", "NtGetNextProcess": "0EBh", "NtGetNotificationResourceManager": "0EEh", "ZwRemoveProcessDebug": "15Eh", "NtQueryQuotaInformationFile": "146h", "NtLoadEnclaveData": "0FAh", "ZwDeleteValueKey": "0CBh", "NtOpenEvent": "40h", "ZwTerminateProcess": "2Ch", "NtQueryFullAttributesFile": "134h", "ZwDeleteDriverEntry": "0C6h", "NtPropagationFailed": "12Ch", "ZwCreateMailslotFile": "0A8h", "NtSetInformationThread": "0Dh", "NtCancelTimer": "61h", "ZwImpersonateClientOfPort": "1Fh", "ZwFilterToken": "0D8h", "NtUnloadKey2": "1B4h", "ZwQueryDebugFilterState": "130h", "NtGetCompleteWnfStateSubscription": "0E5h", "ZwSetLdtEntries": "190h", "NtCreateWnfStateName": "0C0h", "ZwLoadKey2": "0FCh", "NtUnmapViewOfSection": "2Ah", "NtAlpcImpersonateClientContainerOfPort": "81h", "ZwGetNlsSectionPtr": "0EDh", "NtAcceptConnectPort": "2", "NtQuerySystemEnvironmentValue": "14Ch", "ZwShutdownWorkerFactory": "1A2h", "ZwGetContextThread": "0E6h", "ZwRemoveIoCompletion": "9", "NtAllocateReserveObject": "70h", "ZwOpenSymbolicLinkObject": "11Eh", "NtWaitLowEventPair": "1C1h", "NtOpenKey": "12h", "NtAlpcCreatePort": "77h", "ZwAllocateLocallyUniqueId": "6Fh", "NtAdjustPrivilegesToken": "41h", "NtQueryInformationProcess": "19h", "ZwUmsThreadYield": "1B1h", "ZwRecoverEnlistment": "156h", "NtOpenThreadToken": "24h", "NtQueryInformationEnlistment": "136h", "ZwCreateJobObject": "0A3h", "NtCommitRegistryTransaction": "93h", "NtRenameKey": "15Fh", "NtSubscribeWnfStateChange": "1A7h", "NtClearEvent": "3Eh", "NtMapUserPhysicalPages": "106h", "ZwGetCurrentProcessorNumber": "0E7h", "ZwTestAlert": "1ACh", "ZwAlpcAcceptConnectPort": "73h", "NtPowerInformation": "5Fh", "NtQueryDefaultLocale": "15h", "NtNotifyChangeMultipleKeys": "10Bh", "ZwSetInformationKey": "185h", "NtCreateProcess": "0AFh", "ZwFlushBuffersFileEx": "0DAh", "ZwSetEaFile": "17Eh", "NtSetInformationToken": "188h", "ZwAreMappedFilesTheSame": "8Ah", "ZwSetSystemPowerState": "198h", "ZwCommitTransaction": "94h", "ZwQueryInformationWorkerFactory": "13Ch", "ZwImpersonateThread": "0F1h", "ZwAlpcDeleteSectionView": "7Eh", "NtRollforwardTransactionManager": "16Eh", "NtQueryPerformanceCounter": "31h", "ZwImpersonateAnonymousToken": "0F0h", "NtSetInformationSymbolicLink": "187h", "ZwWaitHighEventPair": "1C0h", "ZwUnlockVirtualMemory": "1B7h", "NtSetBootOptions": "175h", "NtAlpcCreateSecurityContext": "7Bh", "ZwCompareTokens": "97h", "ZwReplyWaitReceivePortEx": "2Bh", "NtRenameTransactionManager": "160h", "NtWriteVirtualMemory": "3Ah", "ZwNotifyChangeKey": "10Ah", "ZwAlpcSendWaitReceivePort": "88h", "ZwPulseEvent": "12Dh", "NtAdjustGroupsToken": "6Ah", "NtQueryInformationJobObject": "137h", "NtSetSecurityObject": "194h", "ZwCreateTimer": "0B7h", "ZwAlpcQueryInformation": "85h", "ZwSetBootEntryOrder": "174h", "NtExtendSection": "0D6h", "ZwQueryTimer": "38h", "ZwSetValueKey": "60h", "ZwFlushVirtualMemory": "0DFh", "NtNotifyChangeDirectoryFile": "109h", "NtQueryIntervalProfile": "13Eh", "NtRaiseHardError": "154h", "ZwQueryBootEntryOrder": "12Eh", "NtReplaceKey": "161h", "NtSetInformationWorkerFactory": "18Ch", "ZwOpenTransaction": "121h", "ZwCommitEnlistment": "92h", "NtOpenKeyedEvent": "114h", "ZwCreateDirectoryObjectEx": "9Dh", "ZwOpenRegistryTransaction": "11Ah", "ZwRollbackTransaction": "16Dh", "NtSetInformationTransaction": "189h", "NtCreateWaitCompletionPacket": "0BEh", "ZwAlpcCreatePortSection": "78h", "ZwPrePrepareComplete": "124h", "ZwFreeVirtualMemory": "1Eh", "NtQuerySecurityPolicy": "149h", "ZwSerializeBoot": "173h", "ZwEnumerateValueKey": "13h", "NtQuerySection": "51h", "ZwFlushBuffersFile": "4Bh", "NtUnloadKey": "1B3h", "ZwPrepareEnlistment": "127h", "NtReplyWaitReplyPort": "163h", "NtQueryIoCompletion": "13Fh", "NtCreateSection": "4Ah", "NtOpenPrivateNamespace": "118h", "NtSetInformationDebugObject": "182h", "ZwCancelSynchronousIoFile": "8Eh", "ZwQueryEaFile": "133h", "ZwCreateEvent": "48h", "NtAddDriverEntry": "69h", "ZwCancelIoFile": "5Dh", "ZwSetQuotaInformationFile": "193h", "ZwCreateFile": "55h", "NtOpenJobObject": "110h", "NtClose": "0Fh", "ZwCreateKeyedEvent": "0A6h", "NtQueryInformationToken": "21h", "NtPrivilegeObjectAuditAlarm": "129h", "NtCreateDebugObject": "9Bh", "ZwSetSystemInformation": "197h", "NtCreateLowBoxToken": "0A7h", "NtSetWnfProcessNotificationEvent": "1A0h", "ZwGetNextThread": "0ECh", "ZwAddAtom": "47h", "ZwRevertContainerImpersonation": "169h", "ZwSetLowEventPair": "191h", "ZwSetTimer": "62h", "NtSetInformationResourceManager": "186h", "ZwCallbackReturn": "5", "ZwSetHighWaitLowEventPair": "180h", "ZwSetDefaultUILanguage": "17Ch", "ZwYieldExecution": "46h", "ZwOpenThread": "11Fh", "NtTranslateFilePath": "1B0h", "ZwPrivilegeCheck": "128h", "ZwAlertResumeThread": "6Ch", "ZwSetVolumeInformationFile": "19Fh", "ZwOpenSemaphore": "11Ch", "NtAlpcRevokeSecurityContext": "87h", "ZwDuplicateObject": "3Ch", "NtMapCMFModule": "105h", "NtSetDefaultHardErrorPort": "17Ah", "NtQuerySymbolicLinkObject": "14Bh", "NtAlpcOpenSenderProcess": "83h", "ZwCancelTimer2": "8Fh", "ZwQueryInformationThread": "25h", "ZwSetIoCompletionEx": "18Fh", "NtMakeTemporaryObject": "103h", "NtCreateTokenEx": "0BAh", "ZwManagePartition": "104h", "ZwProtectVirtualMemory": "50h", "ZwOpenEventPair": "10Eh", "NtEnumerateTransactionObject": "0D5h", "NtOpenPartition": "117h", "ZwCreateSymbolicLinkObject": "0B5h", "ZwSetSystemTime": "199h", "ZwCloseObjectAuditAlarm": "3Bh", "NtSetIntervalProfile": "18Dh", "ZwMapViewOfSection": "28h", "ZwRemoveIoCompletionEx": "15Dh", "NtCompressKey": "99h", "ZwSetEventBoostPriority": "2Dh", "NtQuerySystemEnvironmentValueEx": "14Dh", "NtWaitForSingleObject": "4", "NtQueryInformationPort": "138h", "NtAlpcConnectPortEx": "76h", "ZwQuerySemaphore": "14Ah", "NtModifyBootEntry": "107h", "ZwOpenObjectAuditAlarm": "116h", "NtDuplicateToken": "42h", "ZwUnloadKeyEx": "1B5h", "ZwFilterTokenEx": "0D9h", "ZwRaiseException": "153h", "NtSuspendThread": "1A9h", "NtQueryInformationFile": "11h", "ZwAssociateWaitCompletionPacket": "8Ch", "ZwSetInformationTransactionManager": "18Ah", "NtDeleteWnfStateData": "0CCh", "ZwQueryInformationTransaction": "13Ah", "NtQueryOpenSubKeys": "143h", "NtDisableLastKnownGood": "0CEh", "NtCompleteConnectPort": "98h", "ZwAddAtomEx": "67h", "NtWaitForKeyedEvent": "1BEh", "NtDeviceIoControlFile": "7", "ZwDisplayString": "0CFh", "NtCreateDirectoryObject": "9Ch", "ZwQueryDefaultUILanguage": "44h", "ZwAccessCheckAndAuditAlarm": "29h", "NtTraceControl": "1AFh", "NtDeletePrivateNamespace": "0CAh", "ZwQueryObject": "10h", "NtAssignProcessToJobObject": "8Bh", "ZwAccessCheck": "0", "NtWaitForAlertByThreadId": "1BCh", "ZwGetDevicePowerState": "0E9h", "NtSetThreadExecutionState": "19Ah", "ZwGetMUIRegistryInfo": "0EAh", "NtQueryInformationAtom": "135h", "NtLockVirtualMemory": "101h", "NtAlpcImpersonateClientOfPort": "82h", "NtFlushWriteBuffer": "0E0h", "ZwFreeUserPhysicalPages": "0E1h", "NtReplyPort": "0Ch", "ZwWaitForMultipleObjects32": "1Ah", "NtCreateIoCompletion": "0A2h", "NtQueueApcThread": "45h", "NtTerminateJobObject": "1ABh", "ZwPrivilegedServiceAuditAlarm": "12Ah", "NtFlushInstallUILanguage": "0DBh", "ZwAccessCheckByTypeResultListAndAuditAlarmByHandle": "66h", "NtGetCachedSigningLevel": "0E4h", "NtDeleteFile": "0C7h", "NtQueueApcThreadEx": "152h", "NtDeleteBootEntry": "0C5h", "ZwPrepareComplete": "126h", "NtCreateEnlistment": "9Fh", "NtCreateSemaphore": "0B4h", "NtCreateNamedPipeFile": "0AAh", "NtInitializeRegistry": "0F4h", "ZwReadFileScatter": "2Eh", "NtOpenMutant": "115h", "ZwAdjustTokenClaimsAndDeviceGroups": "6Bh", "ZwInitializeEnclave": "0F2h", "ZwReleaseMutant": "20h", "ZwUnloadDriver": "1B2h", "ZwAddBootEntry": "68h", "NtSetInformationEnlistment": "183h", "ZwCreateKey": "1Dh", "NtQueryInstallUILanguage": "13Dh", "ZwConnectPort": "9Ah", "ZwCreateJobSet": "0A4h", "NtOpenProcessTokenEx": "30h", "NtDeleteAtom": "0C4h", "ZwPlugPlayControl": "123h", "ZwCreateIRTimer": "0A1h", "ZwWriteFileGather": "1Bh", "NtSetUuidSeed": "19Eh", "NtMakePermanentObject": "102h", "NtCreateMutant": "0A9h", "NtGetCurrentProcessorNumberEx": "0E8h", "ZwOpenTimer": "120h", "ZwCreateProfileEx": "0B1h", "NtQuerySecurityObject": "148h", "ZwSetIoCompletion": "18Eh", "NtOpenThreadTokenEx": "2Fh", "NtCreatePagingFile": "0ABh", "NtDebugContinue": "0C3h", "NtCreateWaitablePort": "0BFh", "NtOpenSection": "37h", "ZwUpdateWnfStateData": "1BAh", "ZwQueryDirectoryObject": "131h", "ZwSetSystemEnvironmentValueEx": "196h", "NtRequestPort": "164h", "ZwSetInformationJobObject": "184h", "NtInitiatePowerAction": "0F5h", "NtQueryPortInformationProcess": "145h", "ZwAllocateUuids": "72h", "NtQueryInformationResourceManager": "139h", "NtTraceEvent": "5Eh", "ZwOpenKeyTransacted": "112h", "ZwRecoverResourceManager": "157h", "ZwSetInformationVirtualMemory": "18Bh", "ZwCreateEventPair": "0A0h", "NtOpenTransactionManager": "122h", "ZwDeleteObjectAuditAlarm": "0C9h", "ZwQueryMutant": "142h", "NtQueryOpenSubKeysEx": "144h", "ZwVdmControl": "1BBh", "ZwGetWriteWatch": "0EFh", "ZwFilterBootOption": "0D7h", "ZwShutdownSystem": "1A1h", "NtOpenIoCompletion": "10Fh", "NtQueryBootOptions": "12Fh", "NtFlushInstructionCache": "0DCh", "ZwSetCachedSigningLevel": "176h", "NtSetDriverEntryOrder": "17Dh", "NtSetIRTimer": "181h", "ZwSetSystemEnvironmentValue": "195h", "NtEnumerateSystemEnvironmentValuesEx": "0D4h", "NtAlpcCancelMessage": "74h", "NtCompactKeys": "95h", "ZwQueryTimerResolution": "14Fh", "NtReleaseKeyedEvent": "15Bh", "NtCreateToken": "0B9h", "NtLoadKeyEx": "0FDh", "NtQueryInformationTransactionManager": "13Bh", "NtAlpcConnectPort": "75h", "ZwDeleteWnfStateName": "0CDh", "NtNotifyChangeSession": "10Ch", "ZwOpenKeyTransactedEx": "113h", "ZwLockFile": "0FEh", "ZwWaitForDebugEvent": "1BDh", "ZwSuspendProcess": "1A8h", "ZwCreateProcessEx": "4Dh", "ZwCancelWaitCompletionPacket": "90h", "ZwOpenDirectoryObject": "58h", "ZwSetEvent": "0Eh", "NtListenPort": "0F8h", "ZwCreatePrivateNamespace": "0AEh", "NtSaveKeyEx": "170h", "NtEnumerateKey": "32h", "ZwResetWriteWatch": "166h", "NtQueryEvent": "56h", "NtQueryWnfStateNameInformation": "151h", "NtReleaseWorkerFactoryWorker": "15Ch", "ZwThawRegistry": "1ADh", "ZwUnlockFile": "1B6h", "ZwOpenSession": "11Dh", "ZwFlushProcessWriteBuffers": "0DEh", "ZwQueryKey": "16h", "ZwAlpcDeleteSecurityContext": "7Fh", "NtSetInformationObject": "5Ch", "NtSecureConnectPort": "172h", "NtUnsubscribeWnfStateChange": "1B9h", "NtCreateThreadEx": "0B6h", "NtEnumerateBootEntries": "0D2h", "ZwThawTransactions": "1AEh", "ZwSinglePhaseReject": "1A4h", "NtCreateTransaction": "0BBh", "NtAlpcDeleteResourceReserve": "7Dh", "NtRecoverTransactionManager": "158h", "NtRegisterProtocolAddressInformation": "159h", "NtPrePrepareEnlistment": "125h", "ZwSetInformationFile": "27h", "NtQuerySystemInformationEx": "14Eh", "NtInitializeNlsFiles": "0F3h", "ZwCreatePort": "0ADh", "NtOpenResourceManager": "11Bh", "ZwLoadDriver": "0F9h", "NtOpenProcessToken": "119h", "ZwSetTimerEx": "19Ch", "ZwAlertThreadByThreadId": "6Eh", "ZwQueryWnfStateData": "150h", "ZwRollbackRegistryTransaction": "16Ch", "ZwAccessCheckByTypeAndAuditAlarm": "59h", "NtAlertThread": "6Dh", "ZwSetDebugFilterState": "179h", "ZwQueryVolumeInformationFile": "49h", "NtOpenProcess": "26h", "ZwContinue": "43h", "ZwSystemDebugControl": "1AAh", "NtCompareObjects": "96h", "ZwFsControlFile": "39h", "NtSaveKey": "16Fh", "ZwSetLowWaitHighEventPair": "192h", "ZwCreatePartition": "0ACh", "NtOpenFile": "33h", "ZwCreateEnclave": "9Eh", "NtQueryDirectoryFile": "35h", "NtDeleteKey": "0C8h", "ZwFindAtom": "14h", "ZwWriteRequestData": "57h", "NtReadRequestData": "54h", "ZwAlpcQueryInformationMessage": "86h", "NtSetDefaultLocale": "17Bh", "ZwFreezeTransactions": "0E3h", "NtOpenKeyEx": "111h", "ZwSetTimer2": "19Bh"} -------------------------------------------------------------------------------- /win32u_dll_syscalls.json: -------------------------------------------------------------------------------- 1 | {"NtGdiDdDDISetDisplayPrivateDriverFormat": "1209h", "ZwGdiDvpCanCreateVideoPort": "1255h", "ZwUserCompositionInputSinkLuidFromPoint": "1352h", "NtGdiDoBanding": "1252h", "NtRIMUpdateInputObserverRegistration": "132Dh", "ZwGdiEngPlgBlt": "1282h", "NtGdiSetColorAdjustment": "12FBh", "NtSetCompositionSurfaceHDRMetaData": "1331h", "NtGdiForceUFIMapping": "1298h", "NtUpdateInputSinkTransforms": "133Bh", "ZwUserGetUpdatedClipboardFormats": "13B6h", "ZwGdiAddFontResourceW": "1157h", "ZwUserCloseClipboard": "10D0h", "ZwGdiDdQueryMoCompStatus": "1241h", "ZwGdiSetPixel": "10B1h", "NtGdiDwmCreatedBitmapRemotingOutput": "1265h", "ZwGdiCreateColorTransform": "1170h", "ZwGdiDdDDIReserveGpuVirtualAddress": "1204h", "NtUserDeferWindowPosAndBand": "1358h", "ZwUserCallTwoParam": "102Dh", "NtRIMAddInputObserver": "1329h", "NtGdiDdCanCreateSurface": "10A4h", "ZwUserGetPrecisionTouchPadConfiguration": "13A8h", "NtGdiRemoveFontResourceW": "12EAh", "ZwGdiDdDDIGetDeviceState": "11BFh", "ZwGdiDdDDIMarkDeviceAsError": "11D2h", "ZwGdiDdDDIOpenNtHandleFromName": "11DFh", "ZwGdiDdDDISetFSEBlock": "120Bh", "NtGdiResetDC": "12ECh", "ZwUserOpenClipboard": "10D1h", "NtUserChangeWindowMessageFilterEx": "134Ah", "NtUserInjectMouseInput": "13D2h", "NtUserGetCursorInfo": "1384h", "NtGdiEndGdiRendering": "126Ah", "ZwUserGetUpdateRect": "1056h", "NtGdiDdDDIAcquireKeyedMutex": "118Eh", "NtGdiDdUnlock": "124Bh", "NtGdiHT_Get8BPPMaskPalette": "12D2h", "ZwUserSetWindowRgn": "10CCh", "ZwUserSetMenuDefaultItem": "1103h", "ZwGdiDdDDICreateSynchronizationObject": "11A9h", "ZwGdiEnableEudc": "1268h", "ZwGdiDdDDIOpenSynchronizationObject": "11E6h", "ZwUserMessageCall": "100Ah", "NtUserInvalidateRect": "1007h", "NtGdiGetSpoolMessage": "12C7h", "ZwUserFrostCrashedWindow": "1379h", "NtUserCheckWindowThreadDesktop": "134Eh", "ZwUserGetMenuBarInfo": "10C3h", "ZwUserGetKeyState": "1006h", "ZwGdiDdUnattachSurface": "124Ah", "NtUserAssociateInputContext": "133Fh", "ZwGdiD3dContextDestroy": "117Ah", "NtGdiDdDDISetDisplayMode": "1208h", "NtUserSystemParametersInfo": "1045h", "ZwGdiEngDeletePath": "1279h", "NtGdiDdBlt": "107Fh", "NtGdiSwapBuffers": "130Eh", "NtUserSetWindowLong": "105Eh", "ZwUserAutoRotateScreen": "1341h", "ZwUserSetFeatureReportResponse": "1429h", "NtGdiDdDDINetDispStartMiracastDisplayDevice": "11D6h", "NtUserHwndSetRedirectionInfo": "13C6h", "NtUserFillWindow": "108Bh", "NtGdiGetUFIPathname": "12CDh", "NtDCompositionTelemetryAnimationScenarioUnreference": "114Bh", "ZwUserUnhookWindowsHookEx": "1072h", "NtUserRegisterDManipHook": "1400h", "ZwDCompositionAddCrossDeviceVisualChild": "1126h", "NtUserRegisterShellPTPListener": "140Ah", "ZwUserRemoteRedrawRectangle": "1411h", "ZwUserGetRawInputDeviceInfo": "13AFh", "ZwUserGetDesktopID": "1386h", "ZwUserGetKeyboardLayoutList": "105Bh", "NtUserBuildHwndList": "101Fh", "NtGdiSetSystemPaletteUse": "1307h", "ZwGdiEngGradientFill": "127Dh", "ZwUserCallHwndLock": "1024h", "ZwGdiEngStrokePath": "1286h", "ZwUserGetDisplayConfigBufferSizes": "1389h", "NtUserIsWindowBroadcastingDpiToChildren": "13DEh", "NtGdiDdDDIPresentMultiPlaneOverlay2": "11F0h", "NtGdiDdDDIPresentMultiPlaneOverlay3": "11F1h", "ZwDCompositionCreateChannel": "112Ch", "ZwGdiDdCreateSurfaceEx": "10C4h", "NtGdiCreateBitmapFromDxSurface": "116Eh", "NtUserScrollWindowEx": "10C0h", "NtGdiGetEmbUFI": "12ACh", "NtDCompositionSetDebugCounter": "1146h", "ZwUserSetActiveWindow": "10E1h", "NtUserInitialize": "13CAh", "ZwUserSBGetParms": "1051h", "NtUserRemoveClipboardFormatListener": "1414h", "ZwUserCreateDCompositionHwndTarget": "1353h", "ZwTokenManagerCreateCompositionTokenHandle": "1335h", "NtGdiExtFloodFill": "128Dh", "NtTokenManagerOpenSectionAndEvents": "1338h", "NtGdiEngBitBlt": "126Eh", "ZwGdiGetAndSetDCDword": "106Ah", "NtGdiDdGetDxHandle": "1237h", "ZwGdiMaskBlt": "106Bh", "NtGdiCreatePen": "1059h", "NtUserGetOpenClipboardWindow": "10D9h", "NtGdiInvertRgn": "1068h", "NtGdiGetAppClipBox": "1046h", "NtGdiGetCharWidthW": "10C9h", "NtUserSetCalibrationData": "141Fh", "NtGdiDdQueryDirectDrawObject": "1240h", "NtGdiGetDeviceWidth": "12A9h", "ZwGdiEngStretchBlt": "1283h", "NtGdiDdGetMoCompFormats": "123Bh", "NtUserSetProcessInteractionFlags": "143Ah", "ZwUserGetCurrentInputMessageSource": "1382h", "ZwGdiPolyTextOutW": "12E6h", "ZwUserRegisterSessionPort": "1409h", "NtUserGetWindowFeedbackSetting": "13BCh", "NtGdiDdDDIQueryResourceInfo": "11F8h", "NtGdiSetMagicColors": "1301h", "ZwUserBitBltSysBmp": "10CDh", "ZwUserGetInputLocaleInfo": "1392h", "ZwGdiDvpGetVideoPortInputFormats": "125Eh", "ZwUserRegisterTouchHitTestingWindow": "140Ch", "NtGdiExtCreatePen": "10ADh", "NtUserSetProcessWindowStation": "10AAh", "NtGdiOpenDCW": "10DBh", "NtGdiMoveTo": "12DCh", "NtCreateCompositionSurfaceHandle": "1124h", "ZwGdiCancelDC": "1166h", "NtUserWaitForRedirectionStartComplete": "146Ch", "NtGdiArcInternal": "115Ch", "NtUserCallNoParam": "1008h", "NtGdiDdDDICreateOutputDupl": "11A5h", "ZwGdiSelectBitmap": "100Eh", "NtGdiGetRandomRgn": "102Eh", "ZwUserGetGUIThreadInfo": "1100h", "NtCreateImplicitCompositionInputSink": "1125h", "ZwGdiDeleteObjectApp": "1026h", "ZwUserSetDisplayAutoRotationPreferences": "1425h", "NtGdiDdGetBltStatus": "1233h", "NtDCompositionTelemetryTouchInteractionUpdate": "114Fh", "NtGdiDdDDICreateContext": "119Fh", "ZwGdiUnmapMemFont": "1312h", "NtGdiDdDDISignalSynchronizationObjectFromGpu2": "121Ch", "NtSetCompositionSurfaceDirectFlipState": "1330h", "NtUserGetInternalWindowPos": "1395h", "NtGdiDdDDIFreeGpuVirtualAddress": "11BAh", "NtUserCreateDesktopEx": "1354h", "NtGdiCreateDIBitmapInternal": "10A1h", "ZwGdiDdDDIDestroyOverlay": "11B1h", "NtGdiEqualRgn": "1112h", "ZwGdiExtEscape": "1117h", "ZwDCompositionSubmitDWMBatch": "1147h", "NtUserGetWindowMinimizeRect": "13BDh", "NtGdiDdDDIOpenKeyedMutex": "11DDh", "NtGdiDdDDICheckVidPnExclusiveOwnership": "119Bh", "ZwGdiDvpColorControl": "1256h", "NtGdiEndPath": "110Bh", "NtUserRemoteRedrawScreen": "1412h", "ZwUserEnumDisplayMonitors": "104Dh", "ZwGdiDdDDIUpdateAllocationProperty": "1222h", "ZwCompositionInputThread": "1121h", "ZwUserUnregisterSessionPort": "145Dh", "ZwUserGetMenuIndex": "139Ah", "ZwGdiDdDDIChangeVideoMemoryReservation": "1193h", "NtUserGetAppImeLevel": "137Ah", "ZwUserGetPointerDeviceRects": "13A2h", "NtUserSetThreadInputBlocked": "1441h", "NtGdiDdDDIAcquireKeyedMutex2": "118Fh", "NtUserGetWindowRgnEx": "13BEh", "ZwUserUpdateWindowTransform": "1466h", "NtUserShowWindow": "105Ah", "ZwGdiSetOPMSigningKeyAndSequenceNumbers": "1302h", "NtGdiWidenPath": "1315h", "NtUserSystemParametersInfoForDpi": "1454h", "ZwUserIsClipboardFormatAvailable": "1032h", "ZwGdiDdDDIDestroyDevice": "11AEh", "NtGdiDdDestroyMoComp": "122Eh", "ZwUserCreateLocalMemHandle": "10ECh", "ZwGdiD3dDrawPrimitives2": "1067h", "ZwUserDelegateInput": "135Ah", "NtUserDestroyCursor": "109Eh", "NtUserDwmGetRemoteSessionOcclusionEvent": "136Bh", "NtGdiDdDDISetVidPnSourceOwner": "1214h", "ZwDCompositionReferenceSharedResourceOnDwmChannel": "113Eh", "NtGdiGetServerMetaFileBits": "12C6h", "ZwGdiSTROBJ_bGetAdvanceWidths": "12F1h", "ZwDCompositionDestroyConnection": "1131h", "ZwUserCreateInputContext": "1355h", "NtUserSetThreadLayoutHandles": "1442h", "ZwGdiDdBeginMoCompFrame": "1186h", "NtGdiDdGetMoCompGuids": "123Ch", "NtGdiEngAlphaBlend": "126Ch", "NtUserGetPointerType": "13A7h", "NtDCompositionDestroyChannel": "1130h", "ZwUserShutdownBlockReasonCreate": "144Dh", "ZwUserInternalGetWindowText": "1065h", "NtUserGetAsyncKeyState": "1047h", "ZwUserSetInteractiveCtrlRotationAngle": "142Fh", "ZwUserNavigateFocus": "13EEh", "NtGdiGetDeviceGammaRamp": "12A8h", "NtGdiCreateDIBBrush": "1076h", "NtUserEvent": "1377h", "NtUserSetImeHotKey": "142Bh", "NtGdiDdDDIOutputDuplGetPointerShapeData": "11E9h", "ZwUserUpdateInstance": "1461h", "NtGdiFlush": "1015h", "ZwUserRegisterHotKey": "1403h", "NtGdiSetBrushOrg": "10AFh", "NtGdiD3dValidateTextureStageState": "117Ch", "ZwGdiMakeObjectXferable": "12D9h", "NtUserGetGestureConfig": "138Bh", "NtGdiCreateDIBSection": "109Ch", "NtGdiDdSetOverlayPosition": "1249h", "ZwUserInitializePointerDeviceInjection": "13CDh", "ZwGdiDdDDIOutputDuplGetFrameInfo": "11E7h", "ZwGdiDdDDINetDispGetNextChunkInfo": "11D3h", "ZwSetCompositionSurfaceBufferCompositionModeAndOrientation": "132Fh", "ZwTokenManagerGetAnalogExclusiveSurfaceUpdates": "1336h", "NtGdiBRUSHOBJ_pvGetRbrush": "1160h", "NtGdiDdDDIQueryAdapterInfo": "11F2h", "ZwUserSetSysColors": "143Eh", "NtGdiConfigureOPMProtectedOutput": "116Ch", "ZwGdiDdDDICreateOverlay": "11A6h", "NtUserIsMouseInputEnabled": "13DAh", "ZwUserFindExistingCursorIcon": "1041h", "ZwUserClearForeground": "1350h", "NtGdiDdDDIGetDisplayModeList": "11C0h", "ZwGdiSetPixelFormat": "1304h", "ZwGdiDdDDIQueryProcessOfferInfo": "11F6h", "NtGdiDdLockD3D": "10C7h", "ZwGdiDdDDIUpdateGpuVirtualAddress": "1223h", "ZwUserCheckMenuItem": "1104h", "ZwUserUnlockWindowStation": "145Bh", "NtGdiCreateHalftonePalette": "10EEh", "NtGdiDvpGetVideoPortConnectInfo": "125Bh", "ZwUserRegisterClassExWOW": "10B2h", "NtUserSetFallbackForeground": "1428h", "NtGdiFlattenPath": "1296h", "ZwUserActivateKeyboardLayout": "111Fh", "NtUserRedrawWindow": "1016h", "ZwUserGetControlColor": "10E4h", "NtGdiDdDDIGetContextSchedulingPriority": "11BDh", "NtGdiDdDDICheckExclusiveOwnership": "1194h", "ZwQueryCompositionInputSinkLuid": "1323h", "ZwGdiDdDDINetDispQueryMiracastDisplayDeviceStatus": "11D4h", "ZwUserDelegateCapturePointers": "1359h", "ZwDCompositionReleaseAllResources": "1141h", "ZwUserUpdateWindowTrackingInfo": "1465h", "NtGdiAddRemoteFontToDC": "1158h", "NtUserInjectTouchInput": "13D4h", "NtGdiCreateOPMProtectedOutputs": "1175h", "ZwUserSetImeInfoEx": "142Ch", "NtGdiFillPath": "110Ch", "NtGdiDdDDIQueryFSEBlock": "11F5h", "ZwUserBuildPropList": "1345h", "NtGdiHLSurfGetInformation": "12CFh", "ZwGdiAbortDoc": "1154h", "ZwUserGhostWindowFromHungWindow": "13BFh", "NtGdiDdDDICheckMultiPlaneOverlaySupport3": "1198h", "NtGdiDdDDICheckMultiPlaneOverlaySupport2": "1197h", "NtUserEnumDisplayDevices": "10F8h", "ZwGdiExtTextOutW": "103Bh", "NtUserGetDCEx": "1094h", "NtGdiBitBlt": "100Bh", "ZwUserSetImeOwnerWindow": "142Dh", "NtUserCheckProcessSession": "134Dh", "NtUserSendInteractiveControlHapticsReport": "1419h", "ZwUserSignalRedirectionStartComplete": "1450h", "NtUserSetCoreWindow": "1422h", "ZwUserLockWindowStation": "13E2h", "ZwGdiDvpCreateVideoPort": "1257h", "NtUserGetPointerDeviceCursors": "13A0h", "ZwGdiPtVisible": "12E8h", "NtUserUnhookWinEvent": "1106h", "NtGdiDdDDIOutputDuplPresent": "11EAh", "ZwGdiFrameRgn": "1299h", "ZwGdiEngComputeGlyphSet": "1270h", "ZwGdiDrawStream": "1064h", "ZwUserSetWindowCompositionTransition": "1446h", "ZwUserGetLayeredWindowAttributes": "1398h", "NtUserSetMenu": "1433h", "NtValidateCompositionSurfaceHandle": "146Eh", "ZwUserMagGetContextInformation": "13E9h", "ZwNotifyPresentToCompositionSurface": "131Ch", "ZwGdiDdDeleteSurfaceObject": "10A3h", "NtGdiEngCreateDeviceBitmap": "1274h", "NtGdiDdDDIGetSharedPrimaryHandle": "11CAh", "ZwGdiUnrealizeObject": "1090h", "NtGdiDdDDIMapGpuVirtualAddress": "11D1h", "ZwGdiDdDDIUpdateOverlay": "1224h", "ZwUserSetClassWord": "1421h", "NtUserDwmKernelShutdown": "136Dh", "ZwGdiEngCreatePalette": "1276h", "NtGdiSetSizeDevice": "1306h", "NtUserGetComboBoxInfo": "1381h", "NtGdiExtSelectClipRgn": "1031h", "ZwGdiGetObjectBitmapHandle": "12BEh", "ZwUserWaitMessage": "100Fh", "NtDCompositionTelemetryTouchInteractionEnd": "114Eh", "ZwGdiDdDDIAdjustFullscreenGamma": "1191h", "ZwGdiGetEudcTimeStampEx": "12AFh", "ZwBindCompositionSurface": "1120h", "NtGdiFillRgn": "10D5h", "ZwGdiModifyWorldTransform": "10D7h", "ZwUserBuildHimcList": "1344h", "NtUserCloseDesktop": "10A8h", "ZwGdiDdAttachSurface": "1185h", "ZwUserGetForegroundWindow": "103Fh", "ZwUserGetRawPointerDeviceData": "13B1h", "ZwUserGetKeyboardLayoutName": "1397h", "NtQueryCompositionInputQueueAndTransform": "1321h", "NtGdiFONTOBJ_pQueryGlyphAttrs": "1290h", "ZwGdiEngDeleteSurface": "127Ah", "ZwUserSetWindowArrangement": "1443h", "NtGdiComputeXformCoefficients": "108Dh", "NtUserSetInteractiveControlFocus": "142Eh", "NtGdiCreateColorSpace": "111Dh", "ZwGdiMakeFontDir": "12D6h", "NtUserRegisterTouchPadCapable": "140Dh", "ZwUserSwitchDesktop": "1453h", "ZwGdiDdDDIRender": "1203h", "ZwUserSetGestureConfig": "142Ah", "ZwGdiSetFontEnumeration": "1119h", "ZwUserGetMessage": "1009h", "ZwGdiRoundRect": "12EEh", "ZwGdiDdDDICreateKeyedMutex": "11A3h", "NtGdiCreateBitmap": "106Fh", "ZwGdiDdDDICheckMonitorPowerState": "1195h", "NtUserInjectKeyboardInput": "13D1h", "ZwGdiDdDDIWaitForVerticalBlankEvent": "1229h", "ZwUserConsoleControl": "10E0h", "NtUserSetWindowCompositionAttribute": "1445h", "ZwUserEnableScrollBar": "10B9h", "NtGdiDdDDIDestroyKeyedMutex": "11AFh", "ZwGdiGetRasterizerCaps": "10E8h", "ZwGdiDdDDIUnpinDirectFlipResources": "1221h", "ZwGdiDdGetAvailDriverMemory": "1232h", "ZwGdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName": "11F7h", "ZwUserDiscardPointerFrameMessages": "1360h", "NtUserSetProcessRestrictionExemption": "143Bh", "ZwGdiDdDDIGetSetSwapChainMetadata": "11C9h", "ZwGdiGetOPMRandomNumber": "12BDh", "NtGdiStretchDIBitsInternal": "1083h", "ZwGdiScaleWindowExtEx": "12F5h", "NtGdiGetGlyphIndicesWInternal": "12B5h", "NtUserCtxDisplayIOCtl": "1357h", "ZwQueryCompositionInputSink": "1322h", "NtGdiSetBitmapAttributes": "12F9h", "ZwUserEndDeferWindowPosEx": "1029h", "ZwGdiDvpReleaseNotification": "1262h", "NtGdiDdDDISubmitCommand": "121Dh", "ZwUserMinMaximize": "13ECh", "ZwGdiDDCCIGetCapabilitiesStringLength": "117Eh", "NtGdiDdDDICreateAllocation": "119Eh", "ZwDCompositionRegisterVirtualDesktopVisual": "1140h", "NtGdiDeleteColorSpace": "111Eh", "ZwGdiDdCreateD3DBuffer": "1189h", "NtGdiDdDDISetStereoEnabled": "1211h", "ZwUserGetTouchValidationStatus": "13B5h", "ZwUserSlicerControl": "1451h", "ZwGdiDdDDIReleaseSwapChain": "1202h", "NtGdiRectInRegion": "10BFh", "ZwUserRegisterManipulationThread": "1404h", "NtGdiDdDDIMakeResident": "11D0h", "NtUserUnregisterClass": "10BDh", "ZwDuplicateCompositionInputSink": "1153h", "NtUserTrackMouseEvent": "10DCh", "ZwUserIsChildWindowDpiMessageEnabled": "13D8h", "ZwTokenManagerConfirmOutstandingAnalogToken": "1334h", "NtUserTransformRect": "1458h", "ZwUserEnableMouseInputForCursorSuppression": "1373h", "ZwGdiDdFlipToGDISurface": "1231h", "ZwGdiDdUpdateOverlay": "124Ch", "ZwGdiAnyLinkedFonts": "115Bh", "NtUserSetWindowPos": "1027h", "ZwDCompositionGetFrameSurfaceUpdates": "113Ch", "ZwUserCallHwndParamLock": "102Ah", "NtUserSendInput": "1084h", "NtGdiGetPhysicalMonitorDescription": "12C1h", "ZwGdiSetIcmMode": "12FFh", "NtUserGetDisplayAutoRotationPreferences": "1387h", "NtGdiDdDDINetDispStopSessions": "11D8h", "NtUserUnloadKeyboardLayout": "145Ah", "NtUserSetTimer": "101Bh", "ZwGdiDdDDIInvalidateCache": "11CDh", "ZwUserCheckAccessForIntegrityLevel": "134Bh", "ZwDCompositionGetDeletedResources": "1139h", "NtGdiDdDDICheckMultiPlaneOverlaySupport": "1196h", "ZwUserSetWindowWord": "10E9h", "NtUserEnableNonClientDpiScaling": "1374h", "ZwUserGetRegisteredRawInputDevices": "13B2h", "ZwUserPaintMonitor": "13F2h", "ZwGdiDdDDISetQueuedLimit": "120Fh", "ZwDCompositionConfirmFrame": "1129h", "NtGdiDdDDIQueryVidPnExclusiveOwnership": "11FBh", "NtGdiDdDDIInvalidateActiveVidPn": "11CCh", "NtDCompositionDuplicateSwapchainHandleToDwm": "1134h", "ZwUserPromotePointer": "13F7h", "ZwUserDestroyInputContext": "135Ch", "ZwUserIsTouchWindow": "13DDh", "ZwUserSetCursorContents": "1424h", "ZwUserSetObjectInformation": "1437h", "ZwGdiRemoveMergeFont": "12EBh", "NtGdiEngDeletePalette": "1278h", "ZwDCompositionRetireFrame": "1143h", "NtUserGetCursorFrameInfo": "10F3h", "NtUserRegisterErrorReportingDialog": "1402h", "ZwUserGetGestureExtArgs": "138Ch", "ZwUserEnumDisplaySettings": "1115h", "NtGdiSelectBrush": "12F6h", "NtGdiGetTransform": "10DDh", "NtGdiDdDDIGetDWMVerticalBlankEvent": "11BEh", "NtGdiSTROBJ_bEnumPositionsOnly": "12F0h", "NtGdiRemoveFontMemResourceEx": "1114h", "ZwUserRegisterPointerInputTarget": "1406h", "ZwUserDwmGetRemoteSessionOcclusionState": "136Ch", "ZwGdiEngPaint": "1281h", "NtGdiSetVirtualResolution": "10E7h", "NtGdiGetBitmapBits": "10DFh", "ZwGdiSetRectRgn": "1305h", "ZwGdiPATHOBJ_vEnumStart": "12E0h", "NtUserGetClassInfoEx": "10BBh", "ZwUserSetSystemMenu": "1108h", "NtGdiGetNumberOfPhysicalMonitors": "12BBh", "NtUnBindCompositionSurface": "133Ah", "NtUserAttachThreadInput": "10EDh", "NtGdiStartPage": "130Bh", "ZwGdiDdDDICreatePagingQueue": "11A7h", "ZwGdiDdColorControl": "1188h", "NtUserHideCaret": "1022h", "NtUserSetAutoRotation": "141Dh", "NtGdiGetDIBitsInternal": "1087h", "NtUserAlterWindowStyle": "10D4h", "ZwGdiFONTOBJ_vGetInfo": "1295h", "NtUserSetWindowsHookEx": "108Eh", "ZwUserGetWindowCompositionAttribute": "13B9h", "NtUserGetPhysicalDeviceRect": "139Dh", "NtUserThunkedMenuInfo": "1109h", "ZwUserRegisterUserApiHook": "140Eh", "NtGdiGetTextMetricsW": "1077h", "NtDCompositionSetChannelCommitCompletionEvent": "1145h", "ZwGdiGetDCforBitmap": "109Dh", "ZwGdiDdDDIOpenAdapterFromLuid": "11DCh", "NtUserGetMouseMovePointsEx": "139Ch", "ZwUserIsNonClientDpiScalingEnabled": "13DBh", "ZwGdiGetDCDword": "1042h", "NtUserDrawIconEx": "1062h", "NtGdiXLATEOBJ_cGetPalette": "1318h", "NtUserHungWindowFromGhostWindow": "13C4h", "ZwGdiDdCreateDirectDrawObject": "118Ah", "ZwGdiEngStretchBltROP": "1284h", "ZwGdiDdDDIOpenAdapterFromDeviceName": "11DAh", "NtUserCalculatePopupWindowPosition": "1346h", "ZwUserGetThreadState": "1003h", "ZwUserSetBrokeredForeground": "141Eh", "ZwGdiQueryFonts": "12E9h", "ZwGdiGetFontUnicodeRanges": "12B3h", "ZwUserWindowFromPoint": "1017h", "ZwGdiDdDDICreateDCFromMemory": "11A1h", "ZwGdiDdDDISignalSynchronizationObject": "1219h", "ZwGdiDdDDIGetCachedHybridQueryValue": "11BBh", "NtUserDefSetText": "1081h", "NtDCompositionCreateAndBindSharedSection": "112Bh", "NtUserAddClipboardFormatListener": "133Eh", "ZwGdiCreateHatchBrushInternal": "1172h", "NtUserEnableIAMAccess": "1371h", "ZwUserInternalClipCursor": "13D6h", "NtOpenCompositionSurfaceDirtyRegion": "131Dh", "NtUserCallMsgFilter": "1018h", "NtDesktopCaptureBits": "1152h", "NtUserShowCaret": "1028h", "NtUserSendEventMessage": "1418h", "ZwGdiGetUFI": "12CCh", "NtUserShutdownBlockReasonQuery": "144Eh", "NtGdiGetDhpdev": "12AAh", "NtGdiPlgBlt": "12E4h", "NtGdiEngCheckAbort": "126Fh", "NtUserQueryInformationThread": "13FAh", "NtGdiDdDDISetDodIndirectSwapchain": "120Ah", "NtGdiCombineTransform": "10F1h", "ZwUserGetCursorDims": "1383h", "ZwUserSetCoreWindowPartner": "1423h", "NtUserGetProcessDpiAwarenessContext": "13AAh", "ZwUserRemoveInjectionDevice": "1415h", "NtGdiDdDDINetDispStopMiracastDisplayDevice": "11D7h", "ZwUserGetAltTabInfo": "10F4h", "ZwGdiGetCertificateSize": "129Fh", "ZwUserHandleDelegatedInput": "13C0h", "ZwGdiDdSetExclusiveMode": "1247h", "ZwUserGetAutoRotationState": "137Bh", "ZwGdiDDCCISaveCurrentSettings": "1181h", "NtUserGetWindowDC": "1066h", "ZwGdiDdDDIGetOverlayState": "11C2h", "ZwGdiSetDIBitsToDeviceInternal": "102Ch", "NtUserGetScrollBarInfo": "1095h", "ZwUserGetKeyboardState": "107Ah", "NtGdiGetFontFileData": "12B0h", "NtGdiGetOPMInformation": "12BCh", "ZwGdiAddFontMemResourceEx": "1111h", "ZwUserSetActiveProcessForMonitor": "141Bh", "ZwUserSetProcessDpiAwarenessContext": "1439h", "ZwHWCursorUpdatePointer": "131Bh", "NtUserYieldTask": "1001h", "NtGdiDdDDIOfferAllocations": "11D9h", "NtGdiGetStringBitmapW": "12C9h", "ZwUserGetUpdateRgn": "1088h", "ZwGdiSelectPen": "12F8h", "NtGdiGetDeviceCaps": "12A6h", "NtUserDrawMenuBarTemp": "136Ah", "ZwGdiD3dContextDestroyAll": "117Bh", "NtGdiGetNearestPaletteIndex": "10C6h", "ZwGdiDdDDIPinDirectFlipResources": "11ECh", "NtUserBlockInput": "1342h", "NtUserSetMenuFlagRtoL": "1435h", "ZwGdiSaveDC": "103Eh", "NtGdiDdDDIGetPresentHistory": "11C3h", "ZwGdiGetTextFaceW": "1082h", "ZwUserInitTask": "13C9h", "ZwGdiDdGetInternalMoCompInfo": "1239h", "NtGdiDdDDIDestroyDCFromMemory": "11ADh", "ZwUserGetWindowCompositionInfo": "13BAh", "ZwGdiEngFillPath": "127Ch", "ZwUserIsMouseInPointerEnabled": "13D9h", "ZwUserLogicalToPerMonitorDPIPhysicalPoint": "13E4h", "NtGdiBRUSHOBJ_hGetColorTransform": "115Eh", "ZwGdiSetMiterLimit": "10E6h", "ZwUserDisplayConfigGetDeviceInfo": "1361h", "ZwUserInjectPointerInput": "13D3h", "ZwUserReportInertia": "1416h", "NtUserGetRawInputData": "13AEh", "ZwGdiPolyPatBlt": "1071h", "NtUserGetPointerInputTransform": "13A6h", "NtDCompositionGetFrameLegacyTokens": "113Ah", "NtUserUnregisterHotKey": "145Ch", "NtDCompositionSetChannelCallbackId": "1144h", "ZwGdiUMPDEngFreeUserMem": "1310h", "NtGdiScaleViewportExtEx": "12F4h", "ZwUserGetProcessWindowStation": "1025h", "ZwUserUpdateInputContext": "1460h", "NtUserChangeDisplaySettings": "1349h", "NtUserLoadKeyboardLayoutEx": "13E1h", "NtUserProcessConnect": "10F7h", "NtGdiFONTOBJ_pxoGetXform": "1294h", "ZwGdiDdDDIQueryVideoMemoryInfo": "11FCh", "ZwUserNotifyWinEvent": "1030h", "ZwRIMRemoveInputObserver": "132Ch", "ZwGdiDdGetFlipStatus": "1238h", "ZwGdiGetPath": "12BFh", "ZwUserGetRawInputBuffer": "13ADh", "NtUserSetDisplayMapping": "1427h", "NtGdiCreatePatternBrushInternal": "10B3h", "ZwGdiCreateSolidBrush": "10BAh", "NtGdiSelectFont": "103Ch", "NtGdiCreateRectRgn": "1086h", "ZwUserSetChildWindowNoActivate": "1420h", "NtGdiDvpGetVideoPortFlipStatus": "125Dh", "ZwTokenManagerGetAnalogExclusiveTokenEvent": "1337h", "ZwGdiDescribePixelFormat": "124Fh", "NtOpenCompositionSurfaceSectionInfo": "131Eh", "NtGdiDdDDISetVidPnSourceOwner1": "1215h", "ZwGdiDdDDIEvict": "11B7h", "ZwGdiDdDDIFlipOverlay": "11B8h", "ZwUserGetClipCursor": "137Eh", "ZwGdiGetPublicFontTableChangeCookie": "12C4h", "NtGdiOffsetClipRgn": "12DDh", "NtUserBeginPaint": "101Ah", "ZwUserSetWindowLongPtr": "1471h", "ZwUserGetDpiForMonitor": "138Ah", "NtGdiSetColorSpace": "12FCh", "ZwGdiDdDDIQueryStatistics": "11FAh", "ZwUserGetQueueStatusReadonly": "13ACh", "ZwGdiDdDDIGetResourcePresentPrivateDriverData": "11C6h", "ZwDCompositionEnableMMCSS": "1136h", "ZwGdiTransformPoints": "1074h", "ZwGdiEngTextOut": "1287h", "ZwGdiDeleteClientObj": "1089h", "ZwDCompositionRemoveCrossDeviceVisualChild": "1142h", "NtGdiDdDDIFlushHeapTransitions": "11B9h", "ZwUserDisableThreadIme": "135Fh", "NtUserMNDragLeave": "13E6h", "ZwGdiGetWidthTable": "106Ch", "NtGdiDdDDIDestroyPagingQueue": "11B2h", "NtGdiGetETM": "12ABh", "NtUserShowSystemCursor": "144Ch", "ZwGdiChangeGhostFont": "1167h", "NtUserGetCIMSSM": "137Ch", "ZwGdiGradientFill": "12CEh", "NtUserRemoteStopScreenUpdates": "1413h", "ZwGdiDdDDIOutputDuplReleaseFrame": "11EBh", "ZwUserGetAtomName": "10ABh", "NtUserGetObjectInformation": "106Eh", "ZwUserQueryInputContext": "13FBh", "ZwGdiBRUSHOBJ_pvAllocRbrush": "115Fh", "NtUserGetDoubleClickTime": "10B8h", "NtUserEnableChildWindowDpiMessage": "1370h", "NtGdiSTROBJ_bEnum": "12EFh", "ZwUserMoveWindow": "1060h", "NtGdiDdDDIGetProcessSchedulingPriorityClass": "11C5h", "ZwGdiEngEraseSurface": "127Bh", "ZwUserDdeInitialize": "110Eh", "ZwRIMObserveNextInput": "132Bh", "NtGdiDdDDIReleaseProcessVidPnSourceOwners": "1201h", "ZwGdiDdDDIWaitForIdle": "1225h", "NtGdiEnumObjects": "128Bh", "ZwGdiDdDDICacheHybridQueryValue": "1192h", "ZwUserModifyWindowTouchCapability": "13EDh", "ZwUserSetInternalWindowPos": "1430h", "NtGdiDDCCIGetCapabilitiesString": "117Dh", "NtGdiFONTOBJ_pvTrueTypeFontFile": "1293h", "ZwDCompositionTelemetryTouchInteractionBegin": "114Dh", "NtDCompositionDuplicateHandleToProcess": "1133h", "NtGdiDdDestroyD3DBuffer": "122Ch", "ZwUserGetGestureInfo": "138Dh", "ZwDCompositionBeginFrame": "1127h", "ZwGdiGetCertificateByHandle": "129Eh", "NtUserCallNextHookEx": "1021h", "ZwGdiAngleArc": "115Ah", "ZwUserGetTitleBarInfo": "1091h", "ZwUserSetWindowPlacement": "10E3h", "NtUserRegisterWindowMessage": "103Ah", "NtGdiHT_Get8BPPFormatPalette": "12D1h", "ZwGdiClearBrushAttributes": "116Ah", "NtGdiStrokeAndFillPath": "130Ch", "NtUserGetThreadDesktop": "1085h", "ZwGdiGetRealizationInfo": "12C5h", "NtGdiDdResetVisrgn": "10ACh", "NtDCompositionGetChannels": "1137h", "ZwGdiDdDDIGetPresentQueueEvent": "11C4h", "NtGdiPATHOBJ_vEnumStartClipLines": "12E1h", "NtGdiXFORMOBJ_bApplyXform": "1316h", "NtGdiXLATEOBJ_iXlate": "131Ah", "ZwOpenCompositionSurfaceSwapChainHandleInfo": "131Fh", "ZwGdiExtGetObjectW": "1055h", "ZwGdiDdDDISharedPrimaryLockNotification": "1217h", "ZwGdiDdCreateMoComp": "118Ch", "ZwGdiGetGlyphIndicesW": "12B4h", "NtGdiDdDDISetVidPnSourceHwProtection": "1213h", "NtGdiDvpUpdateVideoPort": "1263h", "ZwGdiDdDDIShareObjects": "1216h", "NtUserGetSystemMenu": "1063h", "ZwGdiPATHOBJ_bEnumClipLines": "12DFh", "ZwGdiDvpGetVideoSignalStatus": "1261h", "ZwGdiEngLineTo": "127Eh", "NtUserGetTopLevelWindow": "13B3h", "NtGdiPathToRegion": "12E3h", "NtGdiSetDeviceGammaRamp": "12FDh", "ZwGdiDdDDIOpenAdapterFromHdc": "11DBh", "ZwGdiSetBitmapDimension": "1118h", "ZwUserSetClassLong": "10C2h", "ZwUserGetTouchInputInfo": "13B4h", "ZwGdiCreateCompatibleDC": "1057h", "ZwGdiBRUSHOBJ_ulGetBrushColor": "1161h", "NtGdiCreateMetafileDC": "1173h", "ZwGdiDdGetMoCompBuffInfo": "123Ah", "ZwUserCanBrokerForceForeground": "1348h", "NtGdiEngUnlockSurface": "1289h", "NtGdiSetPUMPDOBJ": "1303h", "ZwGdiDdDDIGetRuntimeData": "11C7h", "NtUserBuildNameList": "10B0h", "ZwUserDragObject": "1366h", "NtCreateCompositionInputSink": "1123h", "ZwUserUpdatePerUserSystemParameters": "1463h", "NtGdiDdDDIOutputDuplGetMetaData": "11E8h", "ZwUserGetClipboardFormatName": "10EAh", "NtUserGetOwnerTransformedMonitorRect": "1000h", "ZwGdiDoPalette": "104Ah", "NtUserToUnicodeEx": "107Bh", "NtGdiDdFlip": "1230h", "NtGdiMakeObjectUnXferable": "12D8h", "NtGdiSTROBJ_vEnumStart": "12F3h", "ZwGdiExtCreateRegion": "108Ch", "ZwUserMagSetContextInformation": "13EAh", "ZwGdiEngCreateBitmap": "1272h", "ZwUserGetPriorityClipboardFormat": "13A9h", "ZwGdiDdDDISetHwProtectionTeardownRecovery": "120Dh", "NtGdiDxgGenericThunk": "1266h", "ZwGdiDdUnlockD3D": "10C8h", "ZwGdiPtInRegion": "12E7h", "NtUserInternalGetWindowIcon": "13D7h", "ZwUserDisableProcessWindowFiltering": "135Eh", "NtGdiEngTransparentBlt": "1288h", "NtUserGetIconInfo": "1052h", "ZwUserKillTimer": "101Eh", "NtGdiDdDDITrimProcessCommitment": "121Eh", "ZwUserDrawCaptionTemp": "1369h", "ZwGdiPATHOBJ_bEnum": "12DEh", "ZwUserDisplayConfigSetDeviceInfo": "1362h", "ZwGdiGetCOPPCompatibleOPMInformation": "129Ch", "ZwUserGetClipboardViewer": "1380h", "ZwGdiPATHOBJ_vGetBounds": "12E2h", "NtGdiGetPerBandInfo": "12C0h", "NtGdiSelectClipPath": "12F7h", "ZwGdiDdDDISharedPrimaryUnLockNotification": "1218h", "NtGdiHfontCreate": "105Fh", "NtGdiDestroyOPMProtectedOutput": "1250h", "ZwUserSetMirrorRendering": "1436h", "NtSetCompositionSurfaceIndependentFlipInfo": "1332h", "ZwUserEndPaint": "101Ch", "NtUserLayoutCompleted": "13DFh", "NtGdiGetTextExtentExW": "12CBh", "NtUserGetInteractiveControlDeviceInfo": "1393h", "ZwGdiCLIPOBJ_ppoGetPath": "1165h", "NtGdiDdDDIOpenSyncObjectFromNtHandle": "11E3h", "ZwDCompositionProcessChannelBatchBuffer": "113Dh", "ZwUserGetWindowDisplayAffinity": "13BBh", "NtUserSetClipboardViewer": "111Bh", "ZwUserRealInternalGetMessage": "10EBh", "NtGdiEllipse": "1267h", "NtGdiSetBitmapBits": "10B6h", "NtUserGetClipboardSequenceNumber": "1058h", "NtUserOpenDesktop": "10A9h", "NtUserGetClassName": "107Dh", "NtUserScrollDC": "106Dh", "ZwUserSetWindowStationUser": "144Bh", "ZwGdiSetTextJustification": "1308h", "NtGdiPolyPolyDraw": "104Bh", "ZwGdiCreateSessionMappedDIBSection": "1178h", "ZwUserUserHandleGrantAccess": "1467h", "ZwGdiDdDDILock2": "11CFh", "ZwUserRegisterServicesProcess": "1408h", "NtGdiGetColorSpaceforBitmap": "12A4h", "NtGdiDdDDIAbandonSwapChain": "118Dh", "NtGdiDdDDIDestroyAllocation2": "11ABh", "ZwDCompositionCreateDwmChannel": "112Eh", "ZwGdiConvertMetafileRect": "116Dh", "NtGdiDdDDIOpenSyncObjectFromNtHandle2": "11E4h", "ZwGdiExcludeClipRect": "109Bh", "ZwGdiEngMarkBandingSurface": "1280h", "ZwUserInvalidateRgn": "10CAh", "ZwGdiIcmBrushInfo": "12D3h", "ZwGdiDdDDIAcquireSwapChain": "1190h", "ZwGdiCreateRoundRectRgn": "1176h", "ZwGdiCombineRgn": "1037h", "ZwGdiFONTOBJ_cGetGlyphs": "128Fh", "ZwUserInjectDeviceInput": "13CFh", "ZwGdiDvpGetVideoPortBandwidth": "125Ah", "ZwGdiGetRegionData": "1043h", "NtGdiLineTo": "1044h", "NtGdiRestoreDC": "103Dh", "NtGdiRectVisible": "1036h", "NtUserWaitForInputIdle": "146Ah", "NtGdiDdDDIOpenSwapChain": "11E2h", "ZwQueryCompositionSurfaceBinding": "1325h", "ZwGdiDdDDIWaitForVerticalBlankEvent2": "122Ah", "NtUserRegisterRawInputDevices": "1407h", "NtGdiGetColorAdjustment": "12A3h", "NtGdiGetCharWidthInfo": "10CEh", "NtGdiBRUSHOBJ_DeleteRbrush": "115Dh", "ZwUserSetWindowFeedbackSetting": "1448h", "ZwUserCopyAcceleratorTable": "102Fh", "NtGdiDdDDIReleaseKeyedMutex2": "1200h", "ZwUserSetWindowRgnEx": "1449h", "ZwTokenManagerThread": "1339h", "ZwUserHardErrorControl": "13C1h", "NtUserInitializeClientPfnArrays": "13CBh", "NtUserEnableMouseInPointer": "1372h", "NtGdiDdDDISetContextInProcessSchedulingPriority": "1206h", "ZwGdiGetNearestColor": "1073h", "ZwDCompositionGetFrameStatistics": "113Bh", "NtGdiClearBitmapAttributes": "1169h", "ZwUserNotifyIMEStatus": "13EFh", "NtGdiDdCreateSurfaceObject": "10C5h", "ZwUserSetParent": "1079h", "NtUserModifyUserStartupInfoFlags": "110Fh", "NtGdiRectangle": "1092h", "ZwGdiDdGetScanLine": "123Dh", "ZwGdiEngLockSurface": "127Fh", "ZwGdiGetEmbedFonts": "12ADh", "ZwGdiDdDDISetContextSchedulingPriority": "1207h", "ZwGdiDdDDIReclaimAllocations2": "11FEh", "NtUserDragDetect": "1365h", "ZwGdiGetMonitorID": "12BAh", "NtUserPeekMessage": "1004h", "ZwQueryCompositionInputIsImplicit": "1320h", "NtGdiDdEndMoCompFrame": "122Fh", "NtUserWaitAvailableMessageEx": "1469h", "NtGdiOffsetRgn": "1080h", "ZwUserHwndQueryRedirectionInfo": "13C5h", "ZwGdiSetUMPDSandboxState": "1309h", "NtUserSetShellWindowEx": "143Dh", "ZwGdiMonoBitmap": "12DBh", "NtGdiDdDDIWaitForSynchronizationObjectFromGpu": "1228h", "ZwRIMGetDevicePreparsedDataLockfree": "132Ah", "NtUserCallHwndParam": "10A0h", "ZwUserIsTopLevelWindow": "13DCh", "NtUserGetDC": "100Dh", "NtUserEndMenu": "1376h", "NtUserGetDisplayAutoRotationPreferencesByProcessId": "1388h", "ZwGdiDdDDISetSyncRefreshCountWaitTarget": "1212h", "ZwQueryCompositionSurfaceRenderingRealization": "1327h", "NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport": "11D5h", "ZwUserChangeClipboardChain": "111Ah", "ZwGdiCreateEllipticRgn": "1171h", "ZwGdiSetFontXform": "12FEh", "NtGdiDdCreateFullscreenSprite": "118Bh", "NtGdiEngAssociateSurface": "126Dh", "ZwGdiDvpFlipVideoPort": "1259h", "ZwUserDwmValidateWindow": "136Fh", "ZwGdiDvpGetVideoPortOutputFormats": "1260h", "ZwUserSetClipboardData": "10D2h", "ZwUserSetSystemTimer": "1440h", "NtUserSetWindowFNID": "1097h", "NtGdiStartDoc": "130Ah", "NtGdiDdCanCreateD3DBuffer": "1187h", "NtGdiDdDDICreateDevice": "11A2h", "NtDCompositionCommitChannel": "1128h", "ZwUserGetHimetricScaleFactorFromPixelLocation": "138Fh", "ZwUserSoundSentry": "1452h", "NtUserGetAncestor": "10B4h", "NtUserGetCPD": "1048h", "NtGdiFONTOBJ_pifi": "1292h", "NtUserOpenWindowStation": "10A2h", "ZwGdiUnloadPrinterDriver": "1311h", "NtGdiResizePalette": "12EDh", "ZwGdiDdDDISetProcessSchedulingPriorityClass": "120Eh", "ZwGdiDdDDIEscape": "11B6h", "NtGdiDdDestroyFullscreenSprite": "122Dh", "ZwGdiGetBitmapDimension": "10FDh", "NtDCompositionTelemetrySetApplicationId": "114Ch", "NtGdiGetDCObject": "1038h", "NtGdiSetMetaRgn": "10E5h", "NtUserUpdateDefaultDesktopThumbnail": "145Fh", "ZwGdiDeleteColorTransform": "124Eh", "ZwGdiDvpWaitForVideoPortSync": "1264h", "ZwUserGetPointerFrameArrivalTimes": "13A4h", "NtUserGetWindowBand": "13B8h", "ZwUserCheckProcessForClipboardAccess": "134Ch", "NtGdiPolyDraw": "12E5h", "NtUserGetListBoxInfo": "1399h", "NtUserNotifyProcessCreate": "108Fh", "ZwGdiCreateClientObj": "10BCh", "NtGdiGetRgnBox": "1069h", "NtGdiAddEmbFontToDC": "1156h", "NtUserGetPointerInfoList": "13A5h", "NtUserChildWindowFromPointEx": "134Fh", "ZwUserPrintWindow": "13F5h", "ZwGdiDdCreateSurface": "10A5h", "ZwGdiGetProcessSessionFonts": "12C3h", "ZwQueryCompositionInputSinkViewId": "1324h", "ZwUserWaitForMsgAndEvent": "146Bh", "ZwGdiDdDestroySurface": "10A7h", "NtUserGetPointerCursorId": "139Eh", "NtUserGetCaretPos": "137Dh", "ZwUserPaintMenuBar": "10EFh", "NtUserQueryBSDRWindow": "13F8h", "NtGdiCreateCompatibleBitmap": "104Eh", "ZwDCompositionEnableDDASupport": "1135h", "NtDCompositionDiscardFrame": "1132h", "NtQueryCompositionSurfaceStatistics": "1328h", "NtGdiGetOutlineTextMetricsInternalW": "10B5h", "ZwUserSetSensorPresence": "1002h", "ZwGdiMakeInfoDC": "12D7h", "ZwGdiDdAlphaBlt": "1184h", "NtUserPerMonitorDPIPhysicalToLogicalPoint": "13F3h", "NtGdiSetLinkedUFIs": "1300h", "NtGdiDdDDICheckSharedResourceAccess": "119Ah", "NtUserInteractiveControlQueryUsage": "13D5h", "ZwUserTranslateAccelerator": "1014h", "ZwUserAcquireInteractiveControlBackgroundAccess": "133Dh", "NtGdiBeginGdiRendering": "1162h", "NtGdiXLATEOBJ_hGetColorTransform": "1319h", "ZwDCompositionSynchronize": "1148h", "NtGdiCLIPOBJ_bEnum": "1163h", "NtGdiInitSpool": "12D5h", "NtUserResolveDesktopForWOW": "1417h", "NtUserSetThreadState": "10DAh", "NtGdiEndDoc": "1269h", "NtGdiDdReenableDirectDrawObject": "1243h", "ZwGdiEngCreateClip": "1273h", "ZwUserBroadcastThemeChangeEvent": "1343h", "NtGdiGetTextCharsetInfo": "1050h", "NtUserValidateRect": "10CFh", "ZwGdiDdDDIUnlock": "121Fh", "NtDCompositionTelemetryAnimationScenarioBegin": "1149h", "NtGdiGetLinkedUFIs": "12B8h", "NtGdiDdDDIReleaseKeyedMutex": "11FFh", "NtDCompositionGetConnectionBatch": "1138h", "ZwUserGetCaretBlinkTime": "10F5h", "NtUserGetDManipHookInitFunction": "1385h", "NtGdiGetStats": "12C8h", "NtUserSetLayeredWindowAttributes": "1431h", "NtGdiDdDDICloseAdapter": "119Ch", "ZwGdiCreateOPMProtectedOutput": "1174h", "ZwUserMapVirtualKeyEx": "105Dh", "NtUserSetWinEventHook": "1105h", "NtGdiDrawEscape": "1253h", "NtGdiDdDDIEnumAdapters2": "11B5h", "ZwUserPromoteMouseInPointer": "13F6h", "NtGdiDdDDIGetMultisampleMethodList": "11C1h", "NtUserUnregisterUserApiHook": "145Eh", "NtUserUpdateWindowInputSinkHints": "1464h", "NtUserFindWindowEx": "1070h", "ZwGdiPatBlt": "105Ch", "NtUserQueryWindow": "1013h", "ZwUserHiliteMenuItem": "13C3h", "ZwGdiDdGetDriverState": "1236h", "ZwUserDisableImmersiveOwner": "135Dh", "ZwGdiDdDDIGetContextInProcessSchedulingPriority": "11BCh", "ZwGdiGetGlyphOutline": "12B6h", "ZwGdiInit": "12D4h", "ZwGdiDdDDIPresent": "11EEh", "ZwGdiCreateServerMetaFile": "1177h", "NtGdiDdDDISetGammaRamp": "120Ch", "ZwGdiFONTOBJ_cGetAllGlyphHandles": "128Eh", "ZwUserInjectGesture": "13D0h", "NtUserSetSystemCursor": "143Fh", "NtGdiDdDDIDestroyContext": "11ACh", "ZwGdiDdReleaseDC": "1244h", "NtDCompositionRegisterThumbnailVisual": "113Fh", "ZwUserSetCapture": "104Ch", "ZwUserGetImeHotKey": "1390h", "NtUserGetInteractiveControlInfo": "1394h", "NtUserSetManipulationInputTarget": "1432h", "NtGdiQueryFontAssocInfo": "10F6h", "ZwGdiGetMiterLimit": "12B9h", "NtUserSetWindowShowState": "144Ah", "NtGdiEngStrokeAndFillPath": "1285h", "ZwUserOpenThreadDesktop": "13F1h", "ZwUserSetAppImeLevel": "141Ch", "ZwUserCallHwnd": "110Dh", "ZwGdiDdGetDC": "1234h", "ZwQueryCompositionSurfaceHDRMetaData": "1326h", "ZwGdiAddRemoteMMInstanceToDC": "1159h", "ZwUserGetClipboardOwner": "10CBh", "ZwUserEmptyClipboard": "10F9h", "ZwUserDwmKernelStartup": "136Eh", "NtGdiDdRenderMoComp": "1245h", "ZwGdiEudcLoadUnloadLink": "128Ch", "NtGdiDdDDIOpenResource": "11E0h", "ZwVisualCaptureBits": "146Fh", "ZwUserCreateAcceleratorTable": "10F2h", "ZwUserSetProp": "104Fh", "ZwUserSetProcessUIAccessZorder": "143Ch", "NtUserSetFocus": "1054h", "NtUserEnableMenuItem": "10D3h", "ZwUserRegisterBSDRWindow": "13FFh", "NtGdiSetBrushAttributes": "12FAh", "ZwUserHidePointerContactVisualization": "13C2h", "ZwUserSelectPalette": "1020h", "ZwUserMNDragOver": "13E7h", "ZwGdiGetKerningPairs": "12B7h", "NtUserGetImeInfoEx": "1391h", "NtUserSetKeyboardState": "10F0h", "NtUserPhysicalToLogicalPoint": "13F4h", "ZwGdiDdGetDriverInfo": "1235h", "ZwUserSetWindowsHookAW": "1102h", "ZwGdiDdDDIGetSharedResourceAdapterLuid": "11CBh", "NtGdiDdDDIPresentMultiPlaneOverlay": "11EFh", "ZwUserCalcMenuBar": "1099h", "ZwGdiD3dContextCreate": "1179h", "ZwGdiDdDDISetAllocationPriority": "1205h", "ZwGdiGetEntry": "12AEh", "NtGdiDdDDICreateContextVirtual": "11A0h", "NtGdiDdDDICreateSwapChain": "11A8h", "ZwGdiUpdateTransform": "1314h", "ZwUserInitializeInputDeviceInjection": "13CCh", "ZwGdiGetCharABCWidthsW": "12A1h", "NtGdiEnumFonts": "128Ah", "ZwGdiDdDDILock": "11CEh", "NtGdiDdDDIWaitForSynchronizationObjectFromCpu": "1227h", "NtUserFlashWindowEx": "1378h", "NtUserGetClipboardAccessToken": "137Fh", "ZwGdiDDCCIGetTimingReport": "117Fh", "ZwGdiStrokePath": "130Dh", "NtUserAcquireIAMKey": "133Ch", "ZwGdiDvpGetVideoPortLine": "125Fh", "NtGdiDdDDISignalSynchronizationObjectFromGpu": "121Bh", "NtUserPostMessage": "1012h", "NtUserSetScrollInfo": "1033h", "ZwGdiDdDDIPollDisplayChildren": "11EDh", "ZwUserEnableTouchPad": "1375h", "ZwGdiSTROBJ_dwGetCodePage": "12F2h", "NtGdiCLIPOBJ_cEnumStart": "1164h", "NtGdiUpdateColors": "1313h", "ZwGdiDdSetGammaRamp": "1248h", "ZwGdiGetCharSet": "100Ch", "NtSetCompositionSurfaceStatistics": "1333h", "NtUserDoSoundDisconnect": "1364h", "NtGdiGetSystemPaletteUse": "1113h", "ZwDCompositionConnectPipe": "112Ah", "NtGdiDdAddAttachedSurface": "1183h", "NtGdiDdDDISetStablePowerState": "1210h", "NtGdiAlphaBlend": "107Eh", "NtGdiGetFontData": "10D8h", "ZwUserInitializeTouchInjection": "13CEh", "NtGdiDDCCIGetVCPFeature": "1180h", "NtUserRemoteConnect": "1410h", "NtUserValidateTimerCallback": "1019h", "NtUserGetPointerDevice": "139Fh", "ZwUserDeleteMenu": "10BEh", "ZwGdiGetCertificateSizeByHandle": "12A0h", "ZwUserSetDisplayConfig": "1426h", "NtGdiDdDDISignalSynchronizationObjectFromCpu": "121Ah", "NtUserShutdownReasonDestroy": "144Fh", "NtUserGetPointerDevices": "13A3h", "ZwGdiDDCCISetVCPFeature": "1182h", "ZwUserUndelegateInput": "1459h", "NtGdiTransparentBlt": "130Fh", "ZwGdiBeginPath": "110Ah", "ZwGdiFullscreenControl": "129Ah", "ZwGdiDdDDICreateKeyedMutex2": "11A4h", "ZwGdiDdDDIConfigureSharedResource": "119Dh", "ZwUserDrawCaption": "1368h", "ZwUserCreateWindowStation": "1356h", "ZwGdiGetBoundsRect": "129Bh", "NtGdiDdDDIOpenKeyedMutex2": "11DEh", "ZwUserSetCursorIconData": "10A6h", "ZwUserRegisterTasklist": "140Bh", "NtUserGetMenuItemRect": "139Bh", "NtGdiDestroyPhysicalMonitor": "1251h", "NtUserDestroyDCompositionHwndTarget": "135Bh", "NtUserDoSoundConnect": "1363h", "ZwUserThunkedMenuItemInfo": "109Ah", "ZwUserSetInformationThread": "10E2h", "NtUserAutoPromoteMouseInPointer": "1340h", "NtGdiEngCreateDeviceSurface": "1275h", "ZwGdiDdDDICheckOcclusion": "1199h", "NtUserLockWindowUpdate": "1107h", "ZwUserRegisterEdgy": "1401h", "NtUserRealWaitMessageEx": "13FEh", "ZwUserDestroyWindow": "109Fh", "NtGdiHLSurfSetInformation": "12D0h", "ZwUserCloseWindowStation": "10B7h", "ZwGdiAbortPath": "1155h", "ZwGdiGetPixel": "10C1h", "NtUserGetPointerDeviceProperties": "13A1h", "NtUserGetWindowPlacement": "10D6h", "ZwGdiDvpDestroyVideoPort": "1258h", "ZwUserConvertMemHandle": "10FEh", "ZwGdiCheckBitmapBits": "1168h", "NtGdiCreateBitmapFromDxSurface2": "116Fh", "NtGdiDdSetColorKey": "1246h", "ZwGdiDvpAcquireNotification": "1254h", "ZwGdiGetCharacterPlacementW": "12A2h", "NtGdiDdDDIEnumAdapters": "11B4h", "ZwDCompositionCreateConnection": "112Dh", "NtGdiCloseFigure": "1101h", "ZwDCompositionUpdatePointerCapture": "1150h", "NtUserGetKeyNameText": "1396h", "NtUserGetProcessUIContextInformation": "13ABh", "NtUserPaintDesktop": "1116h", "NtGdiGetDeviceCapsAll": "12A7h", "ZwGdiDdDDIQueryClockCalibration": "11F4h", "NtGdiSetLayout": "1098h", "NtGdiGetCurrentDpiInfo": "12A5h", "ZwUserGetGuiResources": "138Eh", "ZwUserCountClipboardFormats": "1110h", "ZwGdiDvpGetVideoPortField": "125Ch", "NtUserGetClipboardData": "10FAh", "NtUserGetControlBrush": "107Ch", "ZwUserDestroyMenu": "10DEh", "ZwGdiGetSuggestedOPMProtectedOutputArraySize": "12CAh", "NtUserRemoveProp": "1049h", "ZwUserRealChildWindowFromPoint": "13FDh", "NtUserSetClassLongPtr": "1470h", "NtUserSetWindowDisplayAffinity": "1447h", "NtUserVkKeyScanEx": "102Bh", "ZwGdiDdDDIWaitForSynchronizationObject": "1226h", "ZwUserSetCursor": "101Dh", "NtUserTrackPopupMenuEx": "1456h", "ZwGdiGetCertificate": "129Dh", "NtUserQueryDisplayConfig": "13F9h", "ZwUserSetActivationFilter": "141Ah", "NtUserInheritWindowMonitor": "13C8h", "NtUserMenuItemFromPoint": "13EBh", "ZwGdiGetFontResourceInfoInternalW": "12B2h", "ZwUserShowWindowAsync": "111Ch", "NtUserPostThreadMessage": "1061h", "ZwUserQuerySendMessage": "13FCh", "NtUserDrawAnimatedRects": "1367h", "NtUserTransformPoint": "1457h", "ZwUserCreateWindowEx": "1078h", "NtUserSetPrecisionTouchPadConfiguration": "1438h", "NtGdiDdWaitForVerticalBlank": "124Dh", "ZwGdiDdDDIReclaimAllocations": "11FDh", "ZwUserLinkDpiCursor": "13E0h", "ZwUserSetMenuContextHelpId": "1434h", "NtGdiDdNotifyFullscreenSpriteUpdate": "123Fh", "ZwSetCompositionSurfaceAnalogExclusive": "132Eh", "NtGdiGetTextExtent": "1096h", "ZwGdiColorCorrectPalette": "116Bh", "ZwUserSetThreadDesktop": "1093h", "NtGdiEngDeleteClip": "1277h", "ZwGdiEndPage": "126Bh", "ZwGdiDdDDIQueryAllocationResidency": "11F3h", "NtGdiEngCopyBits": "1271h", "NtDCompositionWaitForChannel": "1151h", "ZwGdiDdDDIGetScanLine": "11C8h", "NtUserClipCursor": "1351h", "ZwGdiFONTOBJ_pfdg": "1291h", "ZwUserGetIconSize": "108Ah", "NtUserDispatchMessage": "1039h", "NtGdiGetDCPoint": "1075h", "ZwGdiDdDDIOpenResourceFromNtHandle": "11E1h", "NtGdiDdDDIDestroyOutputDupl": "11B0h", "ZwUserCallHwndOpt": "1347h", "ZwUserMagControl": "13E8h", "NtGdiDdDDIOpenSyncObjectNtHandleFromName": "11E5h", "NtUserCallOneParam": "1005h", "ZwGdiSetBoundsRect": "10FCh", "NtGdiDdLock": "123Eh", "NtGdiIntersectClipRect": "1023h", "ZwUserSetWindowBand": "1444h", "NtGdiDdDeleteDirectDrawObject": "122Bh", "ZwDCompositionTelemetryAnimationScenarioReference": "114Ah", "ZwDCompositionCurrentBatchId": "112Fh", "ZwGdiGetFontFileInfo": "12B1h", "ZwGdiDdDDIDestroyAllocation": "11AAh", "ZwUserRemoveMenu": "10FBh", "NtGdiXFORMOBJ_iGetXform": "1317h", "ZwGdiDdDDIUnlock2": "1220h", "NtUserRegisterPointerDeviceNotifications": "1405h", "ZwUserReleaseDwmHitTestWaiters": "140Fh", "NtGdiMirrorWindowOrg": "12DAh", "ZwGdiDdDDIDestroySynchronizationObject": "11B3h", "ZwUserCreateCaret": "1035h", "NtGdiDdDDIQueryResourceInfoFromNtHandle": "11F9h", "ZwGdiFontIsLinked": "1297h", "NtUserExcludeUpdateRgn": "1053h", "ZwUserShowScrollBar": "1040h", "ZwUserImpersonateDdeClientWindow": "13C7h", "ZwUserValidateHandleSecure": "1468h", "NtGdiStretchBlt": "1034h", "NtGdiCreatePaletteInternal": "10AEh", "ZwUserTestForInteractiveUser": "1455h", "ZwUserLockWorkStation": "13E3h", "NtUserUpdateLayeredWindow": "1462h", "NtUserTranslateMessage": "1010h", "ZwUserGetRawInputDeviceList": "13B0h", "ZwUserGetWOWClass": "13B7h", "ZwGdiGetPhysicalMonitors": "12C2h", "NtUserOpenInputDesktop": "13F0h", "NtUserWindowFromPhysicalPoint": "146Dh", "NtUserGetProp": "1011h", "ZwUserDestroyAcceleratorTable": "10FFh", "NtCompositionSetDropTarget": "1122h", "NtUserLogicalToPhysicalPoint": "13E5h", "NtGdiDdQueryVisRgnUniqueness": "1242h"} --------------------------------------------------------------------------------