Windows 2000 System Services list
Webcrazy
TSU00@263.net)
Windows 2000 Server Build 2195 SP0 Chinese version exports 248 System Services from NToskrnl.exe (X86 Single processor versions), and 639 System Services are exported from Win2k.sys. The NTCall command for Softice for Windows NT / 2000 can be displayed for these System Service, refer to "Softice Command Reference". I am listed in all System Service. The most available reference is the function name corresponding to each System Service. Under normal circumstances, Microsoft provides a Windows API corresponding to a SYSTEM Service. For example, from the following line:
0020 0008: 804A0C2D Params = 0B NTCREATEFILE
It can be seen that it corresponds to Windows API CREATEFILE.
It should be explained that this list is closely related to the version of Windows NT / 2000, different build numbers, installed different SP packages, this list is generally different. How to manage these System Services, see "
That talk about Windows NT / 2000 internal data structure. "
To track the system calling this nearly a thousand SYSTEM service, please download a small software at this site:
Strace for Windows 2000!
: ntcall
Service Table Address: 804704d8 Number of Services: 000000F8
0000 0008: 804AB3BF params = 06 NTACCEPTCONNECTPORT
0001 0008: 804AE86B params = 08 NTACCESSCHECK
0002 0008: 804BDEF3 params = 0B NTACCESSCHECKANDAUDITALARM
0003 0008: 8050B034 params = 0B NTACCESSCHECKBYTYPE
0004 0008: 804C11F4 params = 10 NTACCESSCHECKBYTYPEANDAUDITAlarm
0005 0008: 80459214 params = 0b NTACCESSCHECKBYTYPERESULTLIST
0006 0008: 8050C2FF params = 10 NTAccessCheckbyTyperesultListAduDitaRM
0007 0008: 8050C33F params = 11 NtaccesscheckByTyperesultListandauditaarmbyhan
0008 0008: 804B581C params = 03 NTADDAM
0009 0008: 80508874 params = 06 ntadjustGroupstoke
000A 0008: 8049860A Params = 06 NTADJUSTPRIVILEGESTOKEN
000B 0008: 804FC7E2 params = 02 ntalertResumethread
000c 0008: 804955f7 params = 01 ntalertthread
000D 0008: 8049C8A6 params = 01 ntallocatelocallyuniqueID
000E 0008: 80448472 params = 03 ntallocateuserphysicalpages
000f 0008: 804A8D50 params = 04 ntallocateuuiDS
0010 0008: 804B6BFB params = 06 ntallocatevirtualMemory0011 0008: 804F0CEF params = 02 ntaremappedfilesthesame
0012 0008: 804FCB95 params = 02 NTASSIGNPROCESSTOJOBOBIECT
0011 0008: 8040189A params = 03 ntcallbackreturn
0014 0008: 804D06CB params = 02 ntcanceliofile
0015 0008: 80418F66 params = 02 NTCANCELTIMER
0016 0008: 804F69D4 params = 01 NTCANCELDEVICEWAKEUPREQUEST
0017 0008: 8049E0CC params = 01 NTCLEAREVENT
0018 0008: 8044C422 params = 01 ntclose
0019 0008: 80496F58 params = 03 NTCloseObjectauditararm
001a 0008: 804AB849 params = 01 NTcompleteConnectport
001B 0008: 804AA9DA params = 08 NTCONNECTPORT
001c 0008: 80465250 params = 02 NTCONTINUE
001D 0008: 804F4BD5 params = 03 NTCREATEDIRECTORYOBJECT
001E 0008: 8049BC80 params = 05 NTCREATEEVENT
001f 0008: 804CA7A5 params = 03 NTCREATEEVENTPAIR
0020 0008: 804A0C2D Params = 0B NTCREATEFILE
0021 0008: 804C18F5 params = 04 ntcreateiocompletion
0022 0008: 804FC8B8 params = 03 NTCREATEJOBOBJECT
0023 0008: 804A83BE Params = 07 NTCREATEKEY
0024 0008: 8048D3DA params = 08 NTCREATEMAILSLOTFILE
0025 0008: 8049FCA5 params = 04 ntcreatemutant
0026 0008: 8049628A params = 0e NTCREATENAMEDPIPEFILEFILE
0027 0008: 804EE260 params = 04 ntcreatepagingfile
0028 0008: 804A098F params = 05 NTCREATEPORT
0029 0008: 804AD948 params = 08 ntcreateprocess
002A 0008: 804C9D6F params = 09 NTCREATEPROFILE
002b 0008: 804aeff6 params = 07 NTCREATeSecion
002c 0008: 804970f9 params = 05 NTCREATESEMAPHORE
002D 0008: 8049C6C4 params = 04 NTCREATESYMBOLICLICOBJECT
002e 0008: 804969C1 params = 08 NTCREATTHREAD
002F 0008: 804C1C6E params = 04 ntcreatetimer0030 0008: 8050E543 params = 0d NTCREATETOKEN
0031 0008: 804EC375 params = 05 ntcreatewaitableport
0032 0008: 804C0467 params = 02 NTDELAYEXECUTION
0033 0008: 804C0528 params = 01 NTDELETOMOM
0034 0008: 804D0833 params = 01 NTDELETEFILE
0035 0008: 804BD3C5 params = 01 NTDELETEKEY
0036 0008: 80491D0C params = 03 NTDELETEOBJECTAUDITALARMMMMMMMMM
0037 0008: 804A1309 params = 02 NTDELETEVALUEKEYKEY
0038 0008: 804A8EF6 params = 0A NTDEVICEIOCONTROLFILE
0039 0008: 804C61B4 params = 01 NTDISPLAYSTRING
003 38: 8049fe25 params = 07 NTDUPLICATEOBJECT
003b 0008: 8049cf2e params = 06 NTDUPLICATETOKEN
003c 0008: 8049736D params = 06 nTenumerateKey
003D 0008: 804C0A3C params = 06 nTenumeratevalueKey
00338: 8049051D params = 02 NTEXTENDSECTION
003f 0008: 80509361 params = 06 NTFILTERTOKEN
0040 0008: 804B95ED Params = 03 NTFINDAM
0041 0008: 804BA31A params = 02 NTFLUSHBUFFERSFILE
0042 0008: 80496667 params = 03 NTFLUSHINSTRUCTIONCACHE
0043 0008: 804AE2C6 params = 01 NTFLUSHKEY
0044 0008: 804B0F9C params = 04 NTFLUSHVIRTUALMEMORY
0045 0008: 804F19A4 params = 00 NTFLUSHWRITEBUFFER
0046 0008: 80448A9D Params = 03 NTFreeUserphysicalPages
0047 0008: 804A9828 params = 04 ntfreevirtualmemory
0048 0008: 804A8B14 params = 0A NTFSCONTROLFILE
0049 0008: 804C4F1B Params = 02 NtgetContextthread
004A 0008: 804F69EA params = 02 NtgetDevicePowerstate
004b 0008: 804bc159 params = 04 NTGETPLUGPLAYEVENT
004c 0008: 80460086 params = 00 NTGETTICKCOUNT
004D 0008: 804490E4 params = 07 NtGetWritewatch
004e 0008: 8050EFE4 params = 01 ntimpersonateAnonymoustoke
004F 0008: 80495FCD params = 02 ntimpersonateclientofport
0050 0008: 80452C84 params = 03 NTIMPERSONATTHREAD
0051 0008: 8051E159 params = 01 NtinitializeRegistry
0052 0008: 804F67D0 params = 04 ntinitiatepowraction
0053 0008: 804F69DC params = 00 NtissystemResumeautomatic
0054 0008: 804EC598 params = 02 ntlistenport
0055 0008: 8052A603 params = 01 NTLOADDRIVER
0056 0008: 8051EDF3 params = 02 ntlykey
0057 0008: 8045fa4e params = 03 ntloadkey2
0058 0008: 804AA339 params = 0A NTLOCKFILE
0059 0008: 804f19fb params = 04 NTLOCKVIRTUALMEMORY
005A 0008: 804B4D99 params = 01 ntmaketemporaryObject
005B 0008: 80447B61 params = 03 NTMapUserphysicalPages
005C 0008: 80447F74 params = 03 NTMapUserphysicalPagessCatter
005d 0008: 804A8767 params = 0A NTMAPVIEWOFSECTION
005E 0008: 8049844D params = 09 NTNOTIFYCHANGEDIRECTORYFILE
005F 0008: 804A00E4 params = 0A NTNOTIFYCHANGEKEY
0060 0008: 804A0112 Params = 0C NTNOTIFYCHANGEMULTIPLES
0061 0008: 804B9BCA params = 03 NTOPENDIRECTORYOBJECT
0062 0008: 804B570A params = 03 NTOPENEVENT
0063 0008: 804CA891 params = 03 NTOPENEVENTPAIR
0064 0008: 804A35F9 params = 06 NTOPENFILE
0065 0008: 804D4F31 params = 03 NTOPENIOCOMPLETION
0066 0008: 804FCCD params = 03 NTOPENJOBOBJECT
0067 0008: 804AA4F2 params = 03 NTOPENKEY
0068 0008: 804B86D0 params = 03 NTOPENMUTANT
0069 0008: 804A79E0 params = 0C NTOPENOBJECTAUDITALARMMMMMMM
006 0008: 8049E77A params = 04 NTOPENPROCESS
006b 0008: 804b5234 params = 03 NTOPENPROCESSTOKEN
006C 0008: 804ac198 params = 03 NTOPENSECTION
006D 0008: 804BC50F params = 03 NTOPENSEMAPHORE
006E 0008: 804c0953 params = 03 ntopensymboliclinkObject006f 0008: 804B67E5 params = 04 NTOPENTHREAD
0070 0008: 804A0E36 params = 04 NTOPENTHREADTOKEN
0071 0008: 804CA46B params = 03 NTOPENTIMER
0072 0008: 804AFC32 params = 03 NTPLUGPLAYCONTROL
0073 0008: 804c3755 params = 05 ntpowerInformation
0074 0008: 80495E38 params = 03 NTPRIVILECHECK
0075 0008: 8050BA39 params = 05 NTPrivilegedServiceAuditararm
0076 0008: 8050B815 params = 06 NtprivileGeObjectAuditaMM
0077 0008: 804B038B Params = 05 NtProtectVirtualMemory
0078 0008: 804C1A4E Params = 02 NTPULSeevent
0079 0008: 804AA8CE params = 05 ntQueryInformationatom
007 0008: 80499EE5 params = 02 NTQueryattributesfile
007B 0008: 8049EB50 params = 02 NTQueryDefaultlocale
007C 0008: 804BE87B params = 01 NTQueryDefaultuilanguage
007d 0008: 804A2459 params = 0b NTQueryDirectoryFile
007E 0008: 804C33FE params = 07 ntquerydirectoryObject
007f 0008: 804D5963 params = 09 ntqueryeafile
0080 0008: 804AAF98 params = 05 NTQueryEvent
0081 0008: 804BCAB3 params = 02 ntqueryfullattributesfile
0082 0008: 804AE525 params = 05 NTQueryInformationFile
0083 0008: 804ADF19 params = 05 NTQueryInformationJobject
0084 0008: 804Be337 params = 05 NTQueryiocompletion
0085 0008: 804EC616 params = 05 NTQueryInformationPort
0088 0008: 804B4426 params = 05 NTQueryInformationProcess
0087 0008: 804A9AB9 params = 05 NTQueryInformationthread
0088 0008: 804990BD params = 05 NTQueryInformationToken
0089 0008: 804BBCE1 params = 01 NTQueryInstalluilanguage
008A 0008: 804CA33D Params = 02 NTQueryIntervalprofile
008B 0008: 8049923A params = 05 ntquerykey
008C 0008: 8051F4A8 params = 06 ntquerymultiplevalueKey008D 0008: 804CA604 params = 05 NTQuerymutant
008E 0008: 804BAE69 params = 05 NTQUERYOBJECT
008f 0008: 8051fb4c params = 02 ntQueryopensubkeys
0090 0008: 804B9B2D Params = 02 NTQueryperFormanceCounter
0091 0008: 804D6865 params = 09 ntqueryquotainformationfile
0092 0008: 804989AC params = 05 ntquerysection
0093 0008: 8044C94A params = 05 ntquerysecurityObject
0094 0008: 804C9009 params = 05 ntquerysemaphore
0095 0008: 804B984F params = 03 ntquerysymboliclinkObject
0096 0008: 804C97BE params = 04 NTQuerySystemNVironmentValue
0097 0008: 804BF933 params = 04 NTQuerySystemInformation
0098 0008: 804BB77C params = 01 NTQuerySystemTime
0099 0008: 804BAD4C params = 05 NTQueryTimer
009A 0008: 804ACF1A params = 03 NTQueryTimerResolution
009b 0008: 8049A077 params = 06 NTQueryValueKey
009C 0008: 8049C3CD params = 06 NTQueryVirtualMemory
009D 0008: 8049EC21 params = 05 NTQueryVolumeInformationFile
009E 0008: 804B13FF params = 05 ntqueueapcthread
009f 0008: 80465298 params = 03 NTRAISEEXCEPTION
00A0 0008: 804C8C74 params = 06 NTRAISEHARDERROR
00A1 0008: 804BB7FD params = 09 NTREADFILE
00A2 0008: 804D7508 params = 09 ntreadfilescatter
00A3 0008: 804A9014 params = 06 NTREADREQUESTDATA
00A4 0008: 804Be05f params = 05 NTREADVIRTUALMORY
00A5 0008: 804959A2 params = 01 ntregisterthreadterminateport
00A6 0008: 804BBC18 params = 02 NTRELESEMUTANT
00A7 0008: 804A71EB params = 03 NTRELESESEMAPHORE
00A8 0008: 804B219F Params = 05 NTREMOVEIOCOMPLETION
00A9 0008: 8051F2D7 params = 03 NtreplaceKey
00aa 0008: 8049E519 params = 02 ntreplyport00Ab 0008: 804B3E83 params = 04 ntreplywaitreceport
00ac 0008: 8043374a params = 05 ntreplywaitreceiveportex
00AD 0008: 804EC819 params = 02 ntreplywaitreplyport
00AE 0008: 804F6972 params = 01 ntrequestdeviceWakeup
00AF 0008: 804B5A2E Params = 02 NTREQUESTPORT
00b0 0008: 804B3AC6 params = 03 ntrequestwaitreplyport
00b1 0008: 804f677c params = 01 ntrequestwakeuplatency
00b2 0008: 8048C413 params = 02 NTRESETEVENT
00b3 0008: 804495CA params = 03 NtResetWritewatch
00b4 0008: 8051EA0C params = 03 NtRestoreKey
00b5 0008: 804B4998 params = 02 NTRESUMETHREAD
00b6 0008: 80492f99 params = 02 ntsavekey
00b7 0008: 8051EB70 params = 03 ntsavemergedKeys
00b8 0008: 80432E23 params = 09 ntsecureConnectport
00b9 0008: 804A0FA6 params = 05 ntsetiocompletion
00ba 0008: 804914C5 params = 02 ntsetContextThread
00bb 0008: 804c8f0b params = 01 ntsetdefaultharderrport
00bc 0008: 804c6470 params = 02 ntsetdefaultlocale
00BD 0008: 804C6A3E Params = 01 NtSetDefaultuilanguage
00be 0008: 804d5ed0 params = 04 ntseteafile
00bf 0008: 804A745D Params = 02 Ntsetevent
00c0 0008: 804CAB33 params = 01 ntsethigheventpair
00c1 0008: 804CAA79 params = 01 ntsethighwaitloweventpair
00c2 0008: 804C1308 params = 05 ntsetInformationFile
00c3 0008: 804fd998 params = 04 ntsetInformationJobject
00c4 0008: 8051EFDD params = 04 NtsetInformationKey
00c5 0008: 804B7435 params = 04 ntsetInformationObject
00c6 0008: 8049BFC8 params = 04 ntsetinformation processs
00c7 0008: 804C0067 params = 04 ntsetinformationthread
00c8 0008: 8050f572 params = 04 ntsetinformationToken
00c9 0008: 804CA32B params = 02 ntsetintervalprofile00ca 0008: 804910AD params = 06 ntsetldtence
00cb 0008: 804caadd params = 01 ntsetloweventpair
00cc 0008: 804caa15 params = 01 ntsetlowwaithigheventpair
00cd 0008: 804D6DD0 params = 04 ntsetquotainformationfile
00ce 0008: 8044c855 params = 03 ntsetsecurityObject
00cf 0008: 804c9A48 params = 02 ntsetsystemenvironmentValue
00d0 0008: 8048C5C0 params = 03 ntsetsysteminformation
00d1 0008: 80488947 params = 03 ntsetsystempowerstate
00d2 0008: 8048cbe7 params = 02 ntsetsystemtime
00d3 0008: 804B2CA2 params = 02 ntsetthreadexecutionState
00d4 0008: 804190FF params = 07 ntsettimer
00d5 0008: 804C1B95 params = 03 ntsettimerResolution
00d6 0008: 804C93B5 params = 01 ntsetuuidseed
00d7 0008: 804B8D90 params = 06 NtSetValueKey
00d8 0008: 804d6eec params = 05 ntsetvolumeinformationfile
00d9 0008: 804C6182 params = 01 ntshutdownsystem
00da 0008: 8044d2b1 params = 04 ntsignalandwaitforsingleObject
00db 0008: 804c9fe0 params = 01 ntstartprofile
00dc 0008: 804CA287 params = 01 ntstopprofile
00dd 0008: 804c522b params = 02 ntspendthread
00DE 0008: 8052A462 params = 06 NTSYSTEMDEBUGCONTROL
00df 0008: 804fe766 params = 02 NTTERMINATEJOBOBIECT
00E0 0008: 804A2FAC params = 02 NTTERMINATEPROCESS
00E1 0008: 804BDF29 params = 02 NTTERMINATTHREAD
00E2 0008: 804B5218 params = 00 NTTESTALERT
00E3 0008: 8052A7D0 params = 01 NTUNLOADDRIVER
00E4 0008: 8051EE05 params = 01 ntunloadKey
00E5 0008: 804A81B4 params = 05 NTUNLOCKFILE
00E6 0008: 804C0554 params = 04 NTUNLOCKVIRTUALMORY
00E7 0008: 804BA027 params = 02 NTUNMAPVIEWOFSECTION
00E8 0008: 804C3B5D Params = 02 NTVDMControl00E9 0008: 8044D4A2 params = 05 NTWAITFORMULTIPLEOBJECTS
00Ea 0008: 8049adc3 params = 03 NTWAITFORSINGLEOBJECT
00eb 0008: 804ca9b7 params = 01 NTWAIGHEVENTPAIR
00ec 0008: 804ca959 params = 01 NTWAITLOWEVENTPAIR
00Ed 0008: 80497920 params = 09 ntwritefile
00EE 0008: 804D7D76 params = 09 ntwritefilegather
00EF 0008: 804B848C params = 06 NTWRITEREQUESTDATA
00F0 0008: 804AC248 params = 05 NTWRITEVIRTUALMORY
00F1 0008: 804EB56F params = 02 NTCREATECHANNEL
00F2 0008: 804EB56F params = 02 NTCREATECHANNEL
00F3 0008: 804EB56F params = 02 NTCREATECHANNEL
00F4 0008: 80432D65 params = 03 ntreplywaitsendchannel
00F5 0008: 80445DB5 params = 04 mmmemoryusage
00F6 0008: 804F69D4 params = 01 NTCANCELDEVICEWAKEUPREQUEST
00F7 0008: 80432D6D params = 00 NtyieldExecution
Service Table Address: A0186BC0 Number of Services: 0000027F
1000 0008: A01094E2 params = 01 NTGDIABORTDOC
1001 0008: A01219E2 params = 01 NTGDIABORTPATH
1002 0008: A0003E72 params = 06 NTGDIADDFONTRESOURCEW
1003 0008: A01160FA params = 04 NTGDIADDREMOTEFONTTODC
1004 0008: A0123843 params = 05 NTGDIADDFONTMEMRESOURCEEX
1005 0008: A0109B0C params = 02 NTGDIREMOVEMERGEFONT
1006 0008: A010A1E6 params = 03 NTGDIADDREMOMMMINSTANCETODC
1007 0008: A0106FB1 params = 0c NTGDIALPHABLEND
1008 0008: A0122F7E params = 06 NTGDIANGLEARC
1009 0008: A00AA5B4 params = 00 NTGDIANYLINKEDFONTS
100A 0008: A0123725 params = 01 NTGDIFONTISLINKED
100B 0008: A00BB83F Params = 0A NTGDIARCINTERNAL
100C 0008: A0082128 params = 01 NTGDIBEGINPATH
100D 0008: A001B344 params = 0b NTGDIBITBLT
100E 0008: A01234E0 params = 01 NTGDICANCELDC100F 0008: A0125354 params = 08 NTGDICHECKTMAPBITS
1010 0008: A008209C params = 01 NTGDICLOSEFIGURE
1011 0008: A01254AE Params = 06 NTGDicolorcorRectPalette
1012 0008: A005F6C4 params = 04 NTGDICOMBINERGN
1013 0008: A0079AD1 params = 03 NTGDicombineTransform
1014 0008: A00661CB params = 01 NTGDIMPUTEXFORMCOEFFICIENTS
1015 0008: A0040082 params = 04 ntgdiconsoletextout
1016 0008: A007498E Params = 02 NTGDICONVERTMETAFILILERECT
1017 0008: A002D968 params = 05 NTGDICREATEBITMAP
1018 0008: A005CE0C params = 01 NTGDicReateClientobj
1019 0008: A009D3DD params = 01 NTGDICREATECOLORSPACE
101A 0008: A0125007 Params = 08 NTGDicReateColortransform
101B 0008: A0029297 Params = 03 NTGDicReateCompaBitmap
101C 0008: A001Feee params = 01 NTGDicReateCompAfeeDC
101D 0008: A0069475 params = 06 NTGDICREATEDIBBRUSH
101E 0008: A004866E Params = 0b NTGDicreatedIbitMapinternal
101F 0008: A005B055 params = 09 NTGDICREATEDIBSECTION
1020 0008: A010D03C params = 04 NTGDicReateellLipTicRGN
1021 0008: A0092FD9 params = 01 NTGDICREATEHALFTONEPALETTE
1022 0008: A009652C params = 03 NTGDICREATEHATCHBRUSHINTERNAL
1023 0008: A0071E8F params = 01 NTGDICREATEMETAFILEDC
1024 0008: A00687CD params = 02 NTGDICREATEPALETTEINTERNALNALNALNALNAL
1025 0008: A005B56F Params = 03 NTGDicreatePatternbrushinternal
1026 0008: A00587E5 params = 04 NTGDicReatepen
1027 0008: A005BF41 params = 04 NTGDicReateRectrgnn
1028 0008: A010D151 params = 06 NTGDicreateroundRectrgn
1029 0008: A00DD23F params = 06 NTGDicReateServerMetafile
102A 0008: A002E0EC params = 02 NTGDICREATESOLIDBRUSH
102B 0008: A0127E16 params = 04 NTGDID3DCONTEXTCREATE102C 0008: A01281B5 params = 01 NTGDID3DCONTEXTDESTROY
102D 0008: A0128246 Params = 01 NTGDID3DCONTEXTDESTROYALL
102E 0008: A012861E Params = 01 NTGDID3DVALIDATEXTURESTAGESTATE
102F 0008: A01282B4 params = 07 nTGDID3DDRAWPRIMTIVES2
1030 0008: A01287F0 params = 01 NTGDIDDGETDRIVERSTATE
1031 0008: A012B6D3 params = 03 NTGDIDDADDATTACHEDSURFACE
1032 0008: A012D628 params = 03 NTGDIDDALPHABLT
1033 0008: A00BE4A8 params = 02 NTGDIDATTACHSURFACE
1034 0008: A012CDA8 params = 02 NTGDIDDBEGINMOCOMPFRAME
1035 0008: A012A368 params = 03 NTGDIDDBLT
1036 0008: A008F85C params = 02 NTGDIDDCANCREATESURFACE
1037 0008: A012AFB0 params = 02 NTGDIDDCANCREATED3DBUFFER
1038 0008: A012BF17 params = 02 NTGDIDDCOLORCONTROL
1039 0008: A008E4C3 params = 01 NTGDIDDCREATEDIRECTDRAWOBJECT
103A 0008: A008F0A2 params = 08 NTGDIDDCREATESURFACE
103B 0008: A008F0A2 params = 08 NTGDIDDCREATESURFACE
103C 0008: A012C76A params = 02 NTGDIDDCREATEMOCOMP
103D 0008: A00BE1E5 params = 06 NTGDIDDCREATESURFACEOBJECT
103E 0008: A00902B4 params = 01 nTGDIDDELETEDIRECTDRAWOBJECT
103F 0008: A009036D Params = 01 NTGDIDDELESURFACEOBJECT
1040 0008: A012CD39 params = 02 NTGDIDDSTROYMOCOMP
1041 0008: A00Bedc5 params = 02 NTGDIDDESTROYSURFACE
1042 0008: A012B60A params = 01 NTGDIDDESTROYD3DBUFFER
1043 0008: A012D012 params = 02 NTGDIDDENDMOCOMPFRAME
1044 0008: A00Bea69 params = 05 NTGDIDDFLIP
1045 0008: A012BD7E Params = 02 NTGDIDDFLIPTOGDISURFACE
1046 0008: A00BDDC7 params = 02 NTGDIDDGETAVAILDRIVERMEMORY
1047 0008: A012ACEE params = 02 NTGDIDDGETBLTSTATUS
1048 0008: A00BE355 params = 02 NTGDIDDGETDC1049 0008: A008F4B8 params = 02 NTGDIDDGETDRIVERINFOFO
104A 0008: A012C1CF params = 03 nTGDIDDGETDXHANDLE
104B 0008: A00BE5F0 params = 02 NTGDIDDGETFLIPSTATUS
104C 0008: A012CBE4 params = 02 NTGDIDDGETINTERNALMOCompInfo
104D 0008: A012CA01 params = 02 NTGDIDDGETMOCOMPBUFFINFO
104E 0008: A012C313 params = 02 NTGDIDDGETMOCOMPGUIDS
104F 0008: A012C4C7 params = 02 NTGDIDDGETMOCOMPFORMATS
1050 0008: A012BB38 params = 02 NTGDIDDGETSCANLINE
1051 0008: A008FA5F params = 03 NTGDIDDLOCK
1052 0008: A012AADA params = 02 NTGDIDDLOCKD3D
1053 0008: A008F2E1 params = 0b NTGDIDDQUERYDIRECTDRAWOBJECT
1054 0008: A012D4E1 params = 02 NTGDIDDQUERYMOCOMPSTATUS
1055 0008: A008F1B1 params = 02 NTGDIDDREENABEDIRECTDRAWOBJECT
1056 0008: A00BDC3E params = 01 nTGDIDDRELEASEDC
1057 0008: A012D19A params = 02 NTGDIDDRENDERMOCOMP
1058 0008: A009E92D params = 02 NTGDIDDRESETVISRGN
1059 0008: A00BD839 params = 02 NTGDIDDSETCOLORKEY
105A 0008: A012BC66 params = 02 NTGDIDDSETEXCLUSIVEMODE
105B 0008: A012DAD0 params = 03 NTGDIDDSETGAMMARAMP
105C 0008: A012DC42 params = 03 NTGDIDDCREATESURFACEX
105D 0008: A012B9DA params = 03 NTGDIDDSETOVERLAYPSITION
105E 0008: A00Becc9 params = 02 NTGDIDDUNATTACHSURFACE
105F 0008: A008FB41 params = 02 NTGDIDDUNLOCK
1060 0008: A012ABDD params = 02 NTGDIDDUNLOCKD3D
1061 0008: A00BE74A params = 03 NTGDIDDUPDATEOVERLAY
1062 0008: A012AE25 params = 02 NTGDIDDWAITFORVERTICALBLANK
1063 0008: A012EE56 params = 02 NTGDIDVPCANCREATEVIDEOPORT
1064 0008: A013064F Params = 02 NTGDIDVPCOLORCONTROL
1065 0008: A012EF9E Params = 02 NTGDIDVPCREATEVIDEOPORT1066 0008: A012F1EE params = 02 NTGDIDVPDESTROYVIDEOPORT
1067 0008: A012F25D params = 04 NTGDIDVPFLIPVIDEOPORT
1068 0008: A012F3DC params = 02 NTGDIDVPGETVIDEOPORTBANDWIDTH
1069 0008: A012F57B Params = 02 NTGDIDVPGETVIDEOPORTFIELD
106A 0008: A012F6B4 params = 02 NTGDIDVPGETVIDEOPORTFLIPSTATUS
106B 0008: A012F7CA params = 02 NTGDIDVPGETVIDEOPORTINPUTFORMATS
106C 0008: A012FB7B Params = 02 NTGDIDVPGETVIDEOPORTLINE
106D 0008: A012F991 params = 02 NTGDIDVPGETVIDEOPORTOUTPUTFORMATS
106E 0008: A012FC61 params = 02 NTGDIDVPGETVIDEOPORTCONNECTINFO
106F 0008: A012FE1E params = 02 NTGDIDVPGETVIDESIGNALSTATUS
1070 0008: A012FF04 params = 04 NTGDIDVPUPDATEVIDEOPORT
1071 0008: A013051F Params = 02 NTGDIDVPWAITFORVIDEOPORTSYNC
1072 0008: A005CDD9 params = 01 NTGDIDELETECLIENTOBJ
1073 0008: A009D482 params = 01 NTGDIDELETECOLORSPACE
1074 0008: A012527D Params = 02 NTGDIDELETECOLORTRANSFORM
1075 0008: A002161D params = 01 NTGDIDELETEOBJECTAPP
1076 0008: A009EBef params = 04 NTGDIDESCRIBEPIXELFORMAT
1077 0008: A00BF9B3 params = 02 NTGDIGETPERBANDINFO
1078 0008: A00BF1EB Params = 04 NTGDIDOBANDING
1079 0008: A005AB35 params = 06 NTGDIDOPALETTE
107A 0008: A012309F params = 04 NTGDIDRAWESCAPE
107B 0008: A0082DF1 params = 05 NTGDIELLIPSE
107C 0008: A000B19A params = 01 NTGDIENABLEEUDC
107D 0008: A0070295 params = 01 NTGDIENDDOC
107E 0008: A006FF6A params = 01 NTGDIENDPAGE
107F 0008: A0082066 params = 01 NTGDIENDPATH
1080 0008: A00AD466 params = 05 NTGDIENUMFONTCHUNK
1081 0008: A00AD5CD params = 01 NTGDIENUMFONTCLOSE
1082 0008: A00ACCA2 params = 07 NTGDIENUMFONTOPEN1083 0008: A00B3512 params = 04 NTGDIENUMOBJECTS
1084 0008: A00B7C39 params = 02 NTGDIEQUALRGN
1085 0008: A0132C42 params = 04 NTGDIEUDCENUMFACENAMELINKW
1086 0008: A0132AA5 params = 07 NTGDIEUDCLOADUNLOADLINK
1087 0008: A003CA50 params = 05 NTGDIEXCLUDECLIPRECT
1088 0008: A0086F77 params = 0b NTGDIEXTCREATEPEN
1089 0008: A006F5AD params = 03 NTGDIEXTCREATEREGION
108A 0008: A00B2E12 params = 08 NTGDIEXTESCAPE
108B 0008: A0133BFF params = 05 NTGDIEXTFLOODFILL
108C 0008: A002873A params = 03 NTGDIEXTGETOBJECTW
108D 0008: A0021B1A params = 03 NTGDIEXTSELECTCLIPRGN
108E 0008: A0067926 params = 09 NTGDIEXTTEXTOUTW
108F 0008: A00948AF params = 01 NTGDIFILLPATH
1090 0008: A00B617B Params = 03 NTGDIFILLRGN
1091 0008: A0121AFA params = 01 NTGDIFLATTENPATH
1092 0008: A001A344 params = 00 NTGDIFLUSHUSERBATCH
1093 0008: A0017DB4 params = 00 GREFLUSH
1094 0008: A012417C params = 02 NTGDIFORCEUFIMAPPING
1095 0008: A010D23C params = 05 NTGDIFRAMERGN
1096 0008: A0110C02 params = 05 NTGDIFULLSCREENCONTROL
1097 0008: A0081565 params = 04 NTGDiGetAndSetDCDWORD
1098 0008: A00255F3 params = 02 NTGDIGTAPPCLIPBOX
1099 0008: A005B2DF params = 03 NTGDiGetBitmapbits
109A 0008: A00BDF03 params = 02 NTGDIGETBITMAPDIMENSITION
109B 0008: A00AAC75 params = 03 NTGDIGETBOUNDSRECT
109C 0008: A00B6968 params = 06 NTGDIGTCHARABCWIDTHSW
109D 0008: A01221AA params = 06 NTGDIGTCHARACTERPLACEMENTW
109E 0008: A0022444 params = 01 NTGDIGETCHARSET
109F 0008: A0069708 params = 06 NTGDIGETCHARWIDTHW
10A0 0008: A00B6D60 params = 02 NTGDIGETCHARWIDTHINFO
10A1 0008: A0123343 params = 02 NTGDiGetColoraDjustment10A2 0008: A0134508 params = 01 NTGDIGETCOLORSPACEFORBITMAP
10A3 0008: A002F1B2 params = 03 NTGDIGETDCDWORD
10A4 0008: A00293B2 params = 01 NTGDIGETDCFORBITMAP
10A5 0008: A00293D8 params = 02 NTGDIGETDCOBJECT
10A6 0008: A00D9A1E Params = 03 NTGDIGETDCPOINT
10A7 0008: A0123590 params = 02 NTGDIGETDEVICECAPS
10A8 0008: A01256FA params = 02 NTGDIGETDEVICEGAMMARAMP
10A9 0008: A00B1A2D Params = 02 NTGDiGETDEVICECAPSALL
10AA 0008: A0038145 Params = 09 NTGDIGETDIBITSIINTERNAL
10Ab 0008: A0078D7B params = 02 NTGDIGETM
10ac 0008: A01324A2 params = 03 NTGDIGETEUDCTIMESTAMPEX
10AD 0008: A00A3190 params = 05 NTGDIGETFONTDATA
10AE 0008: A0123B0D Params = 07 NTGDIGETFONTRESOURCEINFOINTERNALW
10AF 0008: A0124556 params = 05 NTGDIGETGLYPHINDICESW
10B0 0008: A01243FD params = 06 NTGDIGETGLYPHINDICESWINTERNAL
10B1 0008: A01231BF params = 08 NTGDIGETGLYPHOUTLINE
10b2 0008: A0078F28 params = 03 NTGDIGETKERNINGPAIRS
10b3 0008: A0109657 params = 03 NTGDIGETLINKEDUFIS
10B4 0008: A0122FF7 params = 02 NTGDiGETMITERLIMIT
10B5 0008: A01154D8 params = 03 NTGDiGETMONITORID
10b6 0008: A00604DF params = 02 NTGDIGTNEARESTCOLOR
10b7 0008: A007B200 params = 02 NTGDIGETNEARESTPALETTEINDEX
10B8 0008: A00AA766 params = 02 NTGDiGETObjectBitmaphandle
10b9 0008: A00ADBC3 params = 04 NTGDIGETOUTLINETEXTMETRICSINTERNALW
10ba 0008: A0121FAD params = 04 NTGDIGETPATH
10BB 0008: A009280A params = 03 NTGDIGETPIEL
10BC 0008: A002F8EC params = 03 NTGDiGETRAMRGN
10BD 0008: A00D804C params = 02 NTGDiGETRASTERIZERCAPS
10BE 0008: A0124611 params = 02 NTGDiGETREALIZATIONINFO10BF 0008: A00A9677 params = 03 NTGDiGETREGONDATA
10C0 0008: A00671AB params = 02 NTGDiGETRGNBOX
10C1 0008: A00DD5E8 params = 07 NTGDiGetServerMetafilebits
10C2 0008: A00A288B Params = 04 NTGDIGETSPOOLMESSAGE
10C3 0008: A0135567 params = 05 nTGDiGetStats
10C4 0008: A001B00D params = 01 NTGDIGETSTOCKOBJECT
10c5 0008: A009A6DF params = 05 NTGDIGETSTRINGBITMAPW
10C6 0008: A0068AF2 params = 01 NTGDIGETSYSTEMPALETTEUSE
10C7 0008: A0065B26 params = 03 NTGDIGETTEXTCHARSETINFO
10C8 0008: A0039EE7 params = 05 NTGDIGETTEXTEXTENT
10C9 0008: A0098EEC params = 08 NTGDIGETTEXTEXTENTEXWWWW
10CA 0008: A003E679 params = 04 NTGDIGETTEXTFACEW
10CB 0008: A005FEA3 params = 03 NTGDIGETTEXTMETRICSW
10cc 0008: A0071CAF params = 03 NTGDIGETTRANSFORM
10CD 0008: A0123C84 params = 06 NTGDIGETUFI
10CE 0008: A0123D62 params = 0A NTGDIGETUFIPATHNAME
10CF 0008: A0124573 params = 02 NTGDiGetFontunicore InderAns
10D0 0008: A00395AA params = 07 NTGDIGETWIDTHTABLE
10D1 0008: A01188FC params = 06 NTGDIGRADIENTFILL
10D2 0008: A0030683 params = 05 NTGDIHFONTCREATE
10D3 0008: A0125D37 params = 08 NTGDIICMBRUSHINFO
10D4 0008: A008A30F params = 00 NTGDIINIT
10D5 0008: A000434B params = 00 NTGDIINITSPOOL
10D6 0008: A0026CF5 params = 05 NTGDIINTERSECTCLIPRECT
10D7 0008: A0067FD9 params = 02 NTGDIINVERTRGN
10D8 0008: A0058971 Params = 03 NTGDILINETO
10D9 0008: A0124300 params = 05 NTGDIMAKEFONTDIR
10DA 0008: A00AA48B Params = 02 NTGDIMAKEINFODC
10db 0008: A0096540 params = 0d NTGDIMASKBLT
10DC 0008: A0071Ece params = 03 NTGDIMODIFYWORLDTRANSFORM
10dd 0008: A01273D5 params = 01 NTGDIMONOBITMAP10DE 0008: A012350C params = 04 NTGDIMOVETO
10DF 0008: A00A24F6 params = 03 nTGDioffsetClipRGN
10E0 0008: A0069B43 params = 03 NTGDIOFFSETRGN
10E1 0008: A00489A8 params = 07 NTGDIOPENDCW
10E2 0008: A003C6E3 params = 06 NTGDIPATBLT
10E3 0008: A0029E4D Params = 05 NTGDIPOLYPATBLT
10E4 0008: A0121D2E params = 01 NTGDIPATHTOREGION
10E5 0008: A0119FEC params = 0b NTGDIPLGBLT
10E6 0008: A0122A70 params = 04 NTGDIPOLYDRAW
10E7 0008: A003C41C params = 05 NTGDIPOLYPOLYDRAW
10E8 0008: A0122B8F params = 04 NTGDIPOLYTEXTOUTW
10E9 0008: A01236FC params = 03 NTGDIPTINREGION
Ten 10EA 0008: A010D729 params = 03 NTGDIPTVISIBLE
10EB 0008: A00AA4DE params = 03 NTGDIQUERYFONTS
10EC 0008: A008A2F3 params = 01 NTGDIQUERYFONTASSOCINFO
10ed 0008: A0080B37 params = 05 NTGDIRECTANGLE
10EE 0008: A0123614 params = 02 NTGDIRECTINREGION
10EF 0008: A0047177 Params = 02 NTGDIRECTVISIBLE
10F0 0008: A0123969 Params = 06 NTGDIREMOVEFONTRESOURESW
10f1 0008: A0123AF6 params = 01 NTGDIREMOVEFONTMEMRESOURCEEX
10F2 0008: A0079504 params = 05 nTGDIRESETDC
10F3 0008: A0127685 params = 02 NTGDIRESIZEPALETTE
10F4 0008: A0028D4A params = 02 NTGDIRESTOREDC
10F5 0008: A00DA867 params = 07 NTGDIRECT
10F6 0008: A0028E18 params = 01 NTGDISAVEDC
10F7 0008: A011975F Params = 06 NTGDISCALEVIEWPORTEXTEX
10F8 0008: A0124024 params = 06 NTGDISCALEWINDOWEXTEX
10F9 0008: A0019874 params = 02 NTGDISELECTBITMAP
10FA 0008: A01234EC params = 02 NTGDILECTBRUSH
10fb 0008: A00BF8E1 params = 02 NTGDISELECTCLIPPATH
10FC 0008: A0065590 Params = 02 NTGDISELECTFONT
10FD 0008: A01234FC params = 02 NTGDISELECTPEN10FE 0008: A00688C1 params = 03 NTGDITBITMAPBITS
10FF 0008: A01240ee params = 04 NTGDisetBitmapdimension
1100 0008: A00AAC19 params = 03 NTGDISETBOUNDSRECT
1101 0008: A007AFAD params = 04 NTGDisetbrushorg
1102 0008: A01233BA params = 02 NTGDisetcoloraDjustment
1103 0008: A009D367 params = 02 NTGDisetcolorspace
1104 0008: A0125A93 params = 02 NTGDISETDEVICEGAMMARAMP
1105 0008: A00292AB Params = 10 NTGDISETDIBITSTODEVICEINTERNAL
1106 0008: A000B4E9 params = 01 NTGDisetfontenumeration
1107 0008: A006FA48 params = 03 NTGDisetFontxform
1108 0008: A006FD22 params = 03 NTGDISETICMODE
1109 0008: A00C09B6 params = 03 nTGDisetlinkedufis
110A 0008: A0127B8B Params = 03 NTGDisetmagiccolors
110B 0008: A0071FE7 params = 01 NTGDISETMETARGN
110C 0008: A0071F7B Params = 03 NTGDisetMiterlimit
110D 0008: A0124018 params = 01 NTGDIGETDEVICEWIDTH
110E 0008: A012400C params = 01 NTGDIMIRRORWINDOWORG
110F 0008: A00302CA params = 03 nTGDisetlayout
1110 0008: A00925EB Params = 04 NTGDISETPIEL
1111 0008: A01365E1 params = 02 NTGDITPIXELFORMAT
1112 0008: A01235F9 params = 05 NTGDITRECTRGN
1113 0008: A01235A0 params = 02 NTGDISETSYSTEMPALETTEUSE
1114 0008: A01358FB params = 03 NTGDISETTEXTJUSTIFICATION
1115 0008: A00919DE params = 03 NTGDISETUPPPUBLICCFONT
1116 0008: A006FB5 params = 05 NTGDISETVIRTUALRESOLUTION
1117 0008: A006F8BE params = 03 NTGDISTSIZEDEVICE
1118 0008: A0071AA4 params = 04 ntgdistartdoc
1119 0008: A0070474 params = 01 NTGDistAg
111A 0008: A003022B Params = 0c NTGDistRetChblt
111B 0008: A0059D6F Params = 10 NTGDistRetChdibitsinternal111C 0008: A00BF555 params = 01 NTGDISTROKEANDFILLPATH
111D 0008: A0121E76 params = 01 NTGDISTROKEPATH
111E 0008: A01367B4 params = 01 NTGDISWAPBUFFERS
111F 0008: A0081472 params = 05 NTGDITRANSFORMPOINTS
1120 0008: A009E2EE params = 0b NTGDitransparentblt
1121 0008: A0124203 params = 02 NTGDIUNLOADPRINTERDRIVER
1122 0008: A012383D params = 01 NTGDIUNMAPMEMFONT
1123 0008: A01235ed params = 01 NTGDIUNREALIZEOBJECT
1124 0008: A0127841 Params = 01 NTGDIUPDATECOLORS
1125 0008: A0121B91 Params = 01 NTGDIWIDENPATH
1126 0008: A008C8AA params = 02 NTUSERACTIVATEKEYBOARDLAYOUT
1127 0008: A0066215 Params = 03 NTUSERALTERWINDOWSTYLE
1128 0008: A0063401 Params = 03 NTUSERASSOCIATEINPUTCONTEXT
1129 0008: A00A57F3 params = 03 NTUSERATTACHREADINPUT
112A 0008: A0025EF3 params = 02 NTUSERBEGINPAINT
112B 0008: A0069B03 Params = 08 NTUSERBITBLTSYSBMP
112C 0008: A00E534F Params = 01 NTUSERBLOCKINPUT
112D 0008: A000919C params = 04 NTUSERBUILDHIMCLIST
112e 0008: A0041D01 params = 07 NTUSERBUILDHWNDLIST
112F 0008: A009AFBC params = 04 NTUSERBUILDNAMELIST
1130 0008: A00E5071 params = 04 NTUSERBUILDPROPLIST
1131 0008: A00A4247 params = 02 NTUSERCALLHWND
1132 0008: A002F888 params = 02 NTUSERCALLHWNDLOCK
1133 0008: A000B627 params = 02 NTUSERCALLHWNDOPT
1134 0008: A0065897 Params = 03 NTUSERCALLHWNDPARAM
1135 0008: A0065529 Params = 03 NTUSERCALLHWNDPARAMLOCK
1136 0008: A0066136 params = 02 NTUSERCALLMSGFILTER
1137 0008: A003F4EC params = 04 NTUserCallNexthookex
1138 0008: A00167F8 params = 01 NTUserCallnoparam
1139 0008: A0016832 params = 02 NTUserCalloneParam113a 0008: A0065714 params = 03 NTUSERCALLTWOPARAM
113B 0008: A009C2F0 params = 02 NtuserChangeClipboardchain
113C 0008: A00E557B Params = 05 NTUserChangeDisplaySettings
113D 0008: A008C30C params = 02 NTUserCheckimehotkey
113E 0008: A009C92E Params = 03 NTUserCheckMenuItem
113F 0008: A009C54F Params = 04 NTUserChildWindowFromPointex
1140 0008: A00E3E98 params = 01 NTUSERCLIPCURSOR
1141 0008: A0067DF2 params = 00 NTUSERCLOSECLIPBOARD
1142 0008: A00A3F81 params = 01 NTUSERCLOSEDESKTOP
1143 0008: A00A3F43 params = 01 NTUSERCLOSEWINDOWSTATION
1144 0008: A008C0EC params = 03 NTUserconsolecontrol
1145 0008: A00B574C params = 02 NTUserConvertMemHandle
1146 0008: A00A37D3 params = 03 NTUSERCOPYACCELERATORTABLE
1147 0008: A006A0A6 params = 00 NTUserCountClipboardFormats
1148 0008: A00A5D9A params = 02 NTUserCreateAcceleratorTable
1149 0008: A00669ED Params = 04 NTUsercreateCaret
114A 0008: A000539B Params = 05 NTUSERCREATEDESKTOP
114B 0008: A00A6826 Params = 01 NTUSERCREATEINPUTCONTEXT
114C 0008: A007ADF7 params = 04 NtuserCreatelocalMemHandle
114D 0008: A0034EDD params = 0d NTUserCreateWindowex
114E 0008: A0004908 params = 06 NTUSERCREATEWINDOWSTATION
114F 0008: A00BACA9 params = 03 NTUSERDDEGETQUALISERVICE
1150 0008: A009A165 params = 05 NTUSERDDEINIALIZE
1151 0008: A00E3Feb params = 03 NTUSERDDESETQUALISERVICE
1152 0008: A003E3BB Params = 08 NTUSERDEFERWINDOWPOS
1153 0008: A006A4F7 params = 02 NTUSERDEFSETTEXT
1154 0008: A00A69B7 params = 03 NTUSERDELETEMENU
1155 0008: A00B8194 params = 01 NTUSERDESTROYACCELERATORTABLE
1156 0008: A004611F Params = 02 NTUSERDESTROYCURSOR1157 0008: A0067315 params = 01 NTUSERDESTROYINPUTCONTEXT
1158 0008: A0066387 params = 01 NTUSERDESTROYMENU
1159 0008: A0047504 params = 01 NTUSERDESTROYWINDOW
115A 0008: A000050C params = 01 NTUSERDISABLETHREADIME
115B 0008: A00208F6 params = 01 NTUSERDISPATCHMESSAGE
115C 0008: A00E51B6 params = 03 NTUSERDRAGDETECT
115D 0008: A00E2C7B Params = 05 NTUSERDRAGOBJECT
115E 0008: A00E4238 params = 04 NTUSERDRAWANIMATEDRECTS
115F 0008: A00E4311 params = 04 NTUSERDRAPTION
1160 0008: A0045976 Params = 07 NTUSERDRAWCAPTIONTEMP
1161 0008: A0029F20 params = 0b NTUserDrawiconex
1162 0008: A00E55D1 params = 05 NTUSERDRAWMENUBARTEMP
1163 0008: A00B5539 Params = 00 NTUSEREMPTYCLIPBOARD
1164 0008: A006C00A params = 03 NTUSERENABLEMENUITEM
1165 0008: A0091EA6 params = 03 NTUSERENABLESCROLLBAR
1166 0008: A0022F59 params = 02 NTUSERENDDEFERWINDOWPOSEX
1167 0008: A00E43DE params = 00 NTUSERENDMENU
1168 0008: A0025D32 params = 02 NTUSERENDPAINT
1169 0008: A008E47B Params = 04 NTUSERENUMDISPLAYDEVICES
116A 0008: A00B8840 params = 04 NTUSERENUMDISPLAYMONITORS
116B 0008: A008DAA3 params = 04 NTUSERENUMDISPLAYSETTINGS
116C 0008: A00E338B Params = 01 NTUSEREVENT
116D 0008: A003CBA1 params = 02 NTUSEREXCLUDEUPDATERGN
116E 0008: A006A3B9 params = 04 NTUSERFILLWINDOW
116F 0008: A002DE77 params = 03 NTUserfindexistingCursoricon
1170 0008: A0046B6F params = 05 NTUserfindWindowex
1171 0008: A00E7118 params = 01 NTUserflashWindowex
1172 0008: A00E3BC9 params = 06 NTUSERGETALTTABINFO
1173 0008: A00E3B4C params = 02 NTUSERGETANCESTOR
1174 0008: A00E6DB0 params = 01 NTUSERGETAPPIMELEVEL1175 0008: A005F783 params = 01 NTUSERGETASYNCKEYSTATE
1176 0008: A0066265 params = 00 NTUSERGETCARETBLINKTIME
1177 0008: A00B4FB7 params = 01 NTUSERGETCARETPOS
1178 0008: A005Bbaa params = 05 NTUSERGETCLASSINFO
1179 0008: A0060078 params = 03 NTUSERGETCLASSNAME
117A 0008: A00B566F Params = 02 NTUSERGETCLIPBOARDDATA
117B 0008: A006665F Params = 03 NTUSERGETCLIPBOARDMATNAME
117C 0008: A00662EE Params = 00 NTUSERGETCLIPBOARDOWNER
117D 0008: A0030297 params = 00 NTUSERGETCLIPBOARDSEQUENCENUMBER
117E 0008: A00E4424 params = 00 NTUSERGETCLIPBOARDVIEWER
117F 0008: A00E3F26 params = 01 NTUSERGETCLIPCURSOR
1180 0008: A00E38EA Params = 02 NTUSERGETCOMBOXINFOFO
1181 0008: A0027F77 params = 03 NTUSERGETCONTROLBRUSH
1182 0008: A00AC31A Params = 04 NTUSERGETCONTROLOROR
1183 0008: A006715F Params = 03 NTUSERGETCPD
1184 0008: A006A16C params = 04 NTUSERGETCURSORFRAMEINFO
1185 0008: A00E39C4 params = 01 NTUSERGETCURSORINFOFO
1186 0008: A00215C6 params = 01 NTUSERGETDC
1187 0008: A0093048 params = 03 NTUSERGETDCEX
1188 0008: A004882E Params = 00 NTUSERGETDOUBLICKTIME
1189 0008: A006031A params = 00 NTUSERGETFOREGROUNDOW
118A 0008: A009C89D Params = 02 NTUSERGETGUIRESOURESOURESURES
118B 0008: A00E375A params = 02 NTUSERGETGUITHREADINFO
118C 0008: A00468DD params = 06 NTUSERGETICONIONIY
118D 0008: A0046845 Params = 04 NTUSERGETICONSIZE
118E 0008: A00B79C8 params = 04 NTUSERGETIMEHOTKEY
118F 0008: A0062105 params = 02 NTUSERGETIMEINFOEX
1190 0008: A00E3430 params = 03 NTUSERGETINTERNALWINDOWPOS
1191 0008: A00929E6 params = 02 NTUSERGETKEYBOARDLAYOUTLIST1192 0008: A009A639 params = 01 NTUSERGETKEYBOARDLAYOUTNAME
1193 0008: A002F4F1 params = 01 NTUSERGETKEYBOARDSTATE
1194 0008: A007AB94 params = 03 NTUSERGETKEYNAMETEXT
1195 0008: A001C028 params = 01 NTUSERGETKEYSTATE
1196 0008: A00E399A Params = 01 NTUSERGETLISTBOXINFO
1197 0008: A00E3CF2 params = 04 NTUSERGETMENUBARINFOFO
1198 0008: A00E40F5 params = 02 NTUSERGETMENUINDEX
1199 0008: A00BDA40 params = 04 NTUSERGETMENUITEMRECT
119A 0008: A0017995 Params = 04 NTUSERGETMESSAGE
119B 0008: A00E49CC params = 05 NTUSERGETMOUSEMOVEPOINTSEX
119C 0008: A008AA06 params = 05 NTUSERGETOBJECTINFORMATION
119D 0008: A006A0C5 params = 00 NTUSERGETOPENCLIPBOARDWINDOW
119E 0008: A00E4449 params = 02 NTUSERGETPRIORITYCLIPBOARDFORMAT
119F 0008: A008A29B Params = 00 NTUSERGETPROCESSWINDOWSTATION
11A0 0008: A00E3A99 params = 03 NTUSERGETSCROLLBARINFO
11A1 0008: A0063F3C params = 02 NTUSERGETSYSTEMUENU
11A2 0008: A008A21F Params = 02 NTUSERGETTHREADESKTOP
11A3 0008: A0017E72 params = 01 NTUSERGETTHREADSTATE
11A4 0008: A00E381B Params = 02 NTUSERGETTIBARINFOFO
11A5 0008: A00618CD params = 03 NTUSERGETUPDATERECT
11A6 0008: A0067B88 params = 03 NTUSERGETUPDATERGN
11A7 0008: A00662BC params = 01 NTUSERGETWINDOWDC
11A8 0008: A0093347 Params = 02 NTUSERGETWINDOWPLACEments
11A9 0008: A00D9975 params = 02 NTUSERGETWOWCLASS
11AA 0008: A00E276B Params = 03 NTUSERHARDERRORCONTROL
11AB 0008: A00656B0 params = 01 NTUSERHIDECARET
11ac 0008: A00A917D Params = 04 NTUSERHILITEMENUITEM
11AD 0008: A00E536B Params = 02 NTUSERIMPERSONATEDDECLIENTWINDOW
11AE 0008: A0014817 params = 03 ntuserInitialize11af 0008: A00108A3 params = 04 NTUSERINIALIZECLIENTPFNARRAYS
11B0 0008: A00E351E Params = 0b Ntuserinittask
11B1 0008: A009C7F9 params = 03 NTUSERINTERNALGETWINDOWTEXT
11b2 0008: A002F43D params = 03 NTUSERINVALIDATERECT
11B3 0008: A0068349 params = 03 NTUSERINVALIDATERGN
11B4 0008: A005FA40 params = 01 NTUSERISCLIPBOARDFORMATAVAILABLE
11b5 0008: A001AC2C params = 02 NTUserkillTimer
11B6 0008: A00BA0DB params = 06 NTUserLoadKeyboardLayoutex
11b7 0008: A0009607 params = 01 NtUserLockWindowStation
11b8 0008: A00D98F4 params = 01 NTUserLockWindowUpdate
11B9 0008: A00E2A3A params = 00 NtUserLockworkStation
11ba 0008: A0067350 params = 04 NTUSERMAPVIRTUALKEYEX
11BB 0008: A00E4D0A params = 04 NTUSERMENUITEMFROMPOINT
11BC 0008: A001B89A params = 07 NTUSERMESSAGECALL
11BD 0008: A00AC3D0 params = 03 NTUSERMINMAXIMIZE
11BE 0008: A00E45BC params = 00 NTUSERMNDRAGLEVE
11BF 0008: A00E4502 params = 02 NTUSERMNDRAGOVER
11C0 0008: A00A42BE params = 02 NTUSERMODIFYUSERSTARTUPINFOFLAGS
11C1 0008: A00A5633 params = 06 NTUSERMOVEWINDOW
11C2 0008: A00610F4 params = 03 NTUserNotifyimeStatus
11c3 0008: A008A633 params = 04 NTUserNotifyProcessCreate
11c4 0008: A00E3703 params = 04 NTUserNotifywinevent
11c5 0008: A0067EAD params = 02 NTUSEROPENCLIPBOARD
11C6 0008: A00A421B Params = 03 NTUSEROPENDESKTOP
11c7 0008: A000B699 params = 03 NTUSEROPENININPUTDESKTOP
11C8 0008: A009ADBC params = 02 NTUSEROPENWINDOWSTATION
11c9 0008: A008948B params = 01 NTUserPaintDesktop
11ca 0008: A0017DBC params = 05 NTUSERPEEKMESSAGE
11CB 0008: A0018C7B params = 04 NTUSERPOSTMESSAGE11CC 0008: A0048BCE params = 04 NTUSERPOSTHREADMESSAGE
11CD 0008: A008A7A4 params = 03 NTUserverProcessConnect
11CE 0008: A009E217 params = 05 NTUserQueryInformationthRead
11cf 0008: A00603BD params = 02 NTUserQueryInputContext
11D0 0008: A00E523A Params = 01 NTUserQuerysendMessage
11D1 0008: A00E6EFF params = 05 NTUserQueryuserCounters
11D2 0008: A002F5BE params = 02 NTUserQueryWindow
11d3 0008: A00E3B93 params = 03 NTUSERREALCHILDWINDOWFROMPOINT
11D4 0008: A002F2B4 params = 04 NTUSERREDRAMS = 04 NTUSERREDRAMS = 04 NTUserRedrawWindow
11D5 0008: A005B98B params = 06 NTUSERREGISTERCLASSEXWOW
11D6 0008: A0000C81 params = 04 NTUSERREGISTERHOTKEY
11D7 0008: A00E365E Params = 01 NTUSERREGISTERTASKLIST
11D8 0008: A0020596 Params = 01 NTUSERREGISTERWINDOWMESSAGE
11D9 0008: A0069191 Params = 03 NTUSERREMOVEMENU
11DA 0008: A0063B65 params = 02 NTUSERREMOVEPROP
11db 0008: A009A4D9 params = 04 NTUSERRESOLVEDESKTOP
11dc 0008: A00E2A8C params = 01 NTUSERRESOLVEDESKTOPFORWOW
11dd 0008: A00B76FB Params = 04 NTUSERSBGETPARMS
11de 0008: A0040899 params = 07 NTUSERSCROLLDC
11df 0008: A00ABB92 params = 08 NTUSERSCROLLWINDOWEX
11E0 0008: A002895B Params = 03 NTUSERSELECTPALETTE
11E1 0008: A0088DAD params = 03 NTUSERSENDINPUT
11E2 0008: A005CC07 params = 06 NTUSERSENDMESSAGECALLBACK
11E3 0008: A004732D Params = 04 NTUSERSENDNOTIFYMESSAGE
11E4 0008: A006A44E Params = 01 NTUSERSETACTIVEWINDOW
11E5 0008: A00E6D4A params = 02 NTUSERSETAPPIMELEVEL
11E6 0008: A0065F2F params = 01 NTUSERSETCAPTURE
11E7 0008: A00B7034 params = 04 NTUSERSETCLASSLONG
11E8 0008: A00E4601 params = 03 NTUSERSETCLASSWORD 11E9 0008: A00B598A params = 03 NTUSERSETCLIPBOARDDATA
11ea 0008: A009A07E Params = 01 NTUSERSETCLIPBOARDVIEWER
11eb 0008: A008C828 params = 02 NTUSERSETCONSOLERVEKEYS
11ec 0008: A001C1AE Params = 01 NTUSERSETCURSOR
11ed 0008: A00E4BCF params = 02 NTUSERSETCURSORCONTENTS
11ee 0008: A00464EF Params = 04 NTUSERSETCURSORICONDATA
11ef 0008: A00E4166 params = 02 NTUSERSETDBGTAG
11F0 0008: A0060FE9 params = 01 NTUSERSETFOCUS
11f1 0008: A00B9CF3 params = 05 NTUSERSETIMEHOTKEY
11F2 0008: A000BF04 params = 01 NTUSERSETIMEINFOEX
11f3 0008: A006259A params = 02 NTUSERSETIMEOWNERWINDOW
11F4 0008: A008BF60 params = 04 NTUSERSETINFORMATIONPROCESS
11F5 0008: A008C7D4 params = 04 NTUSERSETINFORMATIONTHREAD
11F6 0008: A00E3DC7 params = 04 NTUSERSETINTERNALWINDOWPOS
11F7 0008: A006114D Params = 01 NTUSERSETKEYBOARDSTATE
11F8 0008: A000BFE1 params = 01 NTUSERSETLOGONNNOTIFYWINDOW
11F9 0008: A00AC0BD params = 03 NTUSERSETMENU
11fa 0008: A00E41DA params = 02 NTUSERSETMENUCONTEXTHELPID
11fb 0008: A00B8158 Params = 03 NTUSERSETMENUDEFAULTITEM
11FC 0008: A00E420E params = 01 NTUSERSETMENUFLAGRTOL
11fd 0008: A00E27AD params = 04 NTUSERSETOBJECTINFORMATION
11FE 0008: A00A5835 params = 02 NTUSERSETPARENT
11FF 0008: A00A41FD params = 01 NTUSERSETPROCESSWINDOWSTATION
1200 0008: A0063ADE params = 03 NTUSERSETPROP
1201 0008: A00E414C params = 02 NTUSERSETRIPFLAGS
1202 0008: A0018FE4 params = 04 NTUSERSETSCROLLINFO
1203 0008: A000AE4D params = 02 NTUSERSETSHELLWINDOWEX
1204 0008: A00E4634 params = 04 NTUSERSETSYSCOLORS
1205 0008: A00E4B7F params = 02 NTUSERSETSYSTEMCURSOR1206 0008: A00B75A0 params = 02 NTUSERSETSYSTEMMENU
1207 0008: A00E5209 params = 04 NTUSERSETSYSTEMTIMER
1208 0008: A00A419E Params = 01 NTUSERSETTHREADESKTOP
1209 0008: A00092D6 params = 02 NTUSERSETTHREADLAYOUTHANDLES
120A 0008: A006A350 Params = 02 NTUSERSETTHREADSTATE
120B 0008: A001ADEF Params = 04 NTUSERSETIMER
120C 0008: A00345E1 params = 02 NTUSERSETWINDOWFNID
120D 0008: A0033F35 params = 04 NTUSERSETWINDOWLONG
120E 0008: A0094D95 params = 02 NTUSERSETWINDOWPLACEments
120F 0008: A0032167 Params = 07 NTUSERSETWINDOWPOS
1210 0008: A00A3765 Params = 03 NTUSERSETWINDOWRGN
1211 0008: A000099c params = 03 NTUSERSETWINDOWSHOOKAW
1212 0008: A0068F92 params = 06 NTUSERSETWINDOWSHOKEX
1213 0008: A0008F96 params = 04 NTUSERSETWINDOWSTATIONUSER
1214 0008: A0058038 params = 03 NTUSERSETWINDOWORD
1215 0008: A00E3688 params = 08 NTUSERSETWINEVENTHOK
1216 0008: A00656E2 params = 01 NTUSERSHOWCARET
1217 0008: A00664CC params = 03 NTUSERSHOWSCROLLBAR
1218 0008: A0060D91 params = 02 NTUSERSHOWWINDOW
1219 0008: A009A3C6 params = 02 NTUSERSHOWWINDOWASYNC
121A 0008: A00E4DCD params = 00 NTUSERSOTSENTRY
121B 0008: A000B742 Params = 01 NTUSERSWITCHDESKTOP
121C 0008: A0036934 Params = 04 NTUSERSYSTEMPARETERSINFO
121D 0008: A00D9B82 Params = 01 NTUSERTESTFORINTERACTIVEUSER
121E 0008: A00B7654 params = 02 NTUSERTHUNKEDMENUINFO
121F 0008: A00A5EEF params = 06 NTUSERTHUNKEDMENUITEMINFO
1220 0008: A00A9907 params = 07 NTUSERTOUNICODEEX
1221 0008: A009C44A params = 01 NTUSERTRACKMOUSEEVENT
1222 0008: A00E486A Params = 06 NTUSERTRACKPOPUPMENUEX1223 0008: A009367E Params = 03 NTUSERTRANSLATEACCELERATOR
1224 0008: A003F950 params = 02 NTUSERTRANSLATEMESSAGE
1225 0008: A0068CFA params = 01 NTUserunhookWindowsHookex
1226 0008: A00E36D7 params = 01 NTUserunhookwinevent
1227 0008: A00E5192 params = 01 NTUSERUNLOADKEYBOARDLAYOUT
1228 0008: A00007C1 params = 01 NTUSERUNLOCKWINDOWSTATION
1229 0008: A0092253 Params = 03 NTUSERUNREGISTERCLASS
122A 0008: A00E496E Params = 02 NTUserunregisterhotKey
122B 0008: A0061EA6 params = 03 NTUSERUPDATEINPUTCONTEXT
122C 0008: A00E32EC Params = 03 NTUSERUPDATEINSTANCE
122D 0008: A00AB067 params = 09 NTUSERUPDATELAYEREDWINDOW
122E 0008: A00E7255 params = 04 NTUSERSETLAYEREDWINDOWATTRIBUTES
122F 0008: A000784F Params = 02 NTUserupdatePerusersystemParameters
1230 0008: A00E4E0F Params = 03 NTUSERUSERHANDLRANTACCESS
1231 0008: A00E4DF3 params = 01 NTUSERVALIDATEHANDLECURECURECURECURECURECURECURECURE
1232 0008: A003C843 Params = 02 NTUSERVALIDATERECT
1233 0008: A003FE73 params = 03 NTUSERVKKEYSCANEX
1234 0008: A009B09E Params = 03 NTUSERWAITFORINPUTIDLE
1235 0008: A00D6257 params = 01 NTUSERWAITFORMSGANDEVENT
1236 0008: A0017E4D Params = 00 NtUserWaitMessage
1237 0008: A00E27A8 params = 06 NTUSERWIN32POOLALLOCATIONSTATSTATS
1238 0008: A005F75B Params = 02 NTUSERWINDOWFROMPOINT
1239 0008: A00D9B1D Params = 00 NTUSERYIELDTASK
123A 0008: A00E260D params = 03 NTUSERREMOTECONNECT
123B 0008: A00E2653 params = 04 NTUSERREMOTEREDRAWRECTANGLE
123C 0008: A00E269C params = 00 NTUSERREMOTEREDRAWSCREEN
123D 0008: A00E26EC params = 00 NTUSERREMOTESTOPSCREENUPDATES
123E 0008: A00E2725 params = 03 NTUSERCTXDISPLAYIOCTL123F 0008: A00714B5 params = 03 NTGDIENGASSOCIATESURFACE
1240 0008: A00716F6 params = 06 NTGDIENGCREATEBITMAP
1241 0008: A00712EC params = 04 NTGDIENGCREATEDEVICESURFACE
1242 0008: A0138DE7 params = 04 NTGDIENGCREATEDEVICEBITMAP
1243 0008: A00B11E7 params = 06 NTGDIENGCREATEPALETTE
1244 0008: A0139399 params = 03 NTGDIENGComputeglyphset
1245 0008: A0136B7D Params = 06 NTGDIENGCOPYBITS
1246 0008: A00Aeaff params = 01 NTGDIENGDELETEPALETTE
1247 0008: A0070627 params = 01 NTGDIENGDELESURFACE
1248 0008: A0138605 params = 03 NTGDIENGERASURFACE
1249 0008: A0070605 params = 01 NTGDIENGUNLOCKSURFACE
124A 0008: A007144C params = 01 NTGDIENGLOCKSURFACE
124B 0008: A0073D52 Params = 0b NTGDIENGBITBLT
124C 0008: A00A1048 Params = 0b NTGDIENGSTRETCHBLT
124D 0008: A013731B Params = 0B NTGDIENGPLGBLT
124E 0008: A00C0B98 params = 01 NTGDIENGMARKBANDINGSURFACE
124F 0008: A00A1D15 params = 08 NTGDIENGSTROKEPATH
1250 0008: A0137971 Params = 07 NTGDIENGFILLPATH
1251 0008: A00C0367 params = 0A NTGDIENGSTROKEANDFILLPATH
1252 0008: A0137C08 params = 05 NTGDIENGPAINT
1253 0008: A009F0AF params = 09 NTGDIENGLINETO
1254 0008: A0137DFB params = 07 NTGDIENGALPHABLEND
1255 0008: A0137FF2 params = 0A NTGDIENGGRADIENTFILL
1256 0008: A013825B Params = 08 NTGDIENGTRANSPARENTBLT
1257 0008: A0072369 params = 0A NTGDIENGTEXTOUT
1258 0008: A0136F8D params = 0d NTGDIENGSTRETCHBLTROP
1259 0008: A013926B Params = 04 NTGDIXLATEOBJCGETPALETTE
125A 0008: A0139306 Params = 02 NTGDIXLATEOBJIXLATE
125B 0008: A0139234 Params = 01 NTGDIXLATEOBJHGETCOLORTRANSFORM
125C 0008: A01387A9 params = 03 NTGDICLIPOBJBENUM125D 0008: A0138765 params = 05 NTGDICLIPOBJCENUMSTART
125E 0008: A01386E1 params = 01 NTGDICLIPOBJPPOGETPATH
125F 0008: A0138707 params = 01 NTGDIENGDELETEPATH
1260 0008: A0138729 Params = 00 NTGDIENGCREATECLIP
1261 0008: A0138743 Params = 01 NTGDIENGDELETECLIP
1262 0008: A01388BE Params = 01 NTGDIBRUSHOBJULGETBRUSHCOLOR
1263 0008: A0138839 Params = 02 NTGDIBRUSHOBJPVALLOCRBRUSH
1264 0008: A013887D params = 01 NTGDIBRUSHOBJPVGETRBRUSH
1265 0008: A01388FF params = 01 NTGDIBRUSHOBJHGETCOLORTRANSFORM
1266 0008: A0079856 Params = 05 NTGDIXFORMOBJBAPPLYXFORM
1267 0008: A006FC3E Params = 02 NTGDIXFORMOBJIGETXFORM
1268 0008: A00797EB params = 03 NTGDIFONTOBJVGETINFO
1269 0008: A006FE46 params = 01 NTGDIFONTOBJPXOGETXFORM
126A 0008: A0070CA1 params = 05 NTGDIFONTOBJCGETGETGLYPHS
126B 0008: A0070095 Params = 01 NTGDIFONTOBJPIFI
126C 0008: A0138B10 params = 01 NTGDIFONTOBJPFDG
126D 0008: A0138C0B params = 02 NTGDIFONTOBJPQUERYGLYPHATTRS
126E 0008: A0139158 params = 02 NTGDIFONTOBJPVTRUETYPEFONTFILE
126F 0008: A0138A13 params = 02 NTGDIFONTOBJCGETALLGLYPHHANDLES
1270 0008: A0138D53 params = 03 NTGDISTROBJBENUM
1271 0008: A006FF54 params = 03 NTGDISTROBJBENUMPOSITIONSONLY
1272 0008: A0079737 params = 04 NTGDISTROBJBGETVAnceWidths
1273 0008: A006FCEF params = 01 NTGDISTROBJVENUMSTART
1274 0008: A0138D8C params = 01 NTGDISTROBJDWGETCODEPAGE
1275 0008: A0138E20 params = 02 NTGDIPATHOBJVGETBOUNDs
1276 0008: A0138EAC params = 02 NTGDIPATHOBJBENUM
1277 0008: A0138F99 params = 01 NTGDIPATHOBJVENUMSTART
1278 0008: A0138FC5 params = 04 nTGDIPATHOBJVENUMSTARTCLIPLINES1279 0008: A013906C params = 03 NTGDIPATHOBJBENUMCLIPLINES
127A 0008: A0138DC3 params = 01 NTGDIGETDHPDEV
127B 0008: A0139345 Params = 01 NTGDIENGCHECKABORT
127C 0008: A0139409 params = 04 NTGDIHTGET8BPPFORMATPALETTE
127D 0008: A0139498 params = 06 NTGDIHTGET8BPPPMASKPALETTE
127E 0008: A0119AB8 params = 01 NTGDIUPDATETRANSFORM
