kd> dd nt!KeServiceDescriptorTable
80552180 80501030 00000000 0000011c 805014a4
80552190 00000000 00000000 00000000 00000000
805521a0 00000000 00000000 00000000 00000000
805521b0 00000000 00000000 00000000 00000000
805521c0 00002710 bf80db87 00000000 00000000
805521d0 f94559e0 81692050 816720f0 806dff40
805521e0 00000000 00000000 00000000 00000000
805521f0 67b093c0 01c88fe4 00000000 00000000
kd> dps 80501030 l 11C
80501030  8059847e nt!NtAcceptConnectPort
80501034  805e5664 nt!NtAccessCheck
80501038  805e8eaa nt!NtAccessCheckAndAuditAlarm
8050103c  805e5696 nt!NtAccessCheckByType
80501040  805e8ee4 nt!NtAccessCheckByTypeAndAuditAlarm
80501044  805e56cc nt!NtAccessCheckByTypeResultList
80501048  805e8f28 nt!NtAccessCheckByTypeResultListAndAuditAlarm
8050104c  805e8f6c nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
80501050  8060a5d4 nt!NtAddAtom
80501054  8060b318 nt!NtQueryBootOptions
80501058  805e09fc nt!NtAdjustGroupsToken
8050105c  805e0654 nt!NtAdjustPrivilegesToken
80501060  805c9662 nt!NtAlertResumeThread
80501064  805c9612 nt!NtAlertThread
80501068  8060abfa nt!NtAllocateLocallyUniqueId
8050106c  805aa06c nt!NtAllocateUserPhysicalPages
80501070  8060a212 nt!NtAllocateUuids
80501074  8059c8f4 nt!NtAllocateVirtualMemory
80501078  805a44be nt!NtAreMappedFilesTheSame
8050107c  805cb140 nt!NtAssignProcessToJobObject
80501080  804fed04 nt!NtCallbackReturn
80501084  8060b856 nt!NtCancelDeviceWakeupRequest
80501088  8056abd0 nt!NtCancelIoFile
8050108c  805341dc nt!NtCancelTimer
80501090  806038e4 nt!NtClearEvent
80501094  805b06f8 nt!NtClose
80501098  805e93e4 nt!NtCloseObjectAuditAlarm
8050109c  806187aa nt!NtCompactKeys
805010a0  805ed8d6 nt!NtCompareTokens
805010a4  80598b6c nt!NtCompleteConnectPort
805010a8  806189fe nt!NtCompressKey
805010ac  8059841e nt!NtConnectPort
805010b0  8053ffd0 nt!NtContinue
805010b4  806369f0 nt!NtCreateDebugObject
805010b8  805b25f4 nt!NtCreateDirectoryObject
805010bc  80603934 nt!NtCreateEvent
805010c0  8060bb9c nt!NtCreateEventPair
805010c4  8056d136 nt!NtCreateFile
805010c8  8056b9c8 nt!NtCreateIoCompletion
805010cc  805ca104 nt!NtCreateJobObject
805010d0  805c9e3c nt!NtCreateJobSet
805010d4  80618bda nt!NtCreateKey
805010d8  8056d244 nt!NtCreateMailslotFile
805010dc  8060bf94 nt!NtCreateMutant
805010e0  8056d170 nt!NtCreateNamedPipeFile
805010e4  8059f8de nt!NtCreatePagingFile
805010e8  80598f3a nt!NtCreatePort
805010ec  805c5cc6 nt!NtCreateProcess
805010f0  805c5c10 nt!NtCreateProcessEx
805010f4  8060c3b4 nt!NtCreateProfile
805010f8  8059f222 nt!NtCreateSection
805010fc  80609930 nt!NtCreateSemaphore
80501100  805b93fc nt!NtCreateSymbolicLinkObject
80501104  805c5aae nt!NtCreateThread
80501108  8060b864 nt!NtCreateTimer
8050110c  805edc7e nt!NtCreateToken
80501110  80598f5e nt!NtCreateWaitablePort
80501114  80637acc nt!NtDebugActiveProcess
80501118  80637c1c nt!NtDebugContinue
8050111c  8060b268 nt!NtDelayExecution
80501120  8060aa8a nt!NtDeleteAtom
80501124  8060b856 nt!NtCancelDeviceWakeupRequest
80501128  8056ad16 nt!NtDeleteFile
8050112c  8061906a nt!NtDeleteKey
80501130  805e94f0 nt!NtDeleteObjectAuditAlarm
80501134  8061923a nt!NtDeleteValueKey
80501138  8056d2fc nt!NtDeviceIoControlFile
8050113c  806078a4 nt!NtDisplayString
80501140  805b21d4 nt!NtDuplicateObject
80501144  805e189a nt!NtDuplicateToken
80501148  8060b318 nt!NtQueryBootOptions
8050114c  8061941a nt!NtEnumerateKey
80501150  8060b30a nt!NtEnumerateSystemEnvironmentValuesEx
80501154  80619684 nt!NtEnumerateValueKey
80501158  805a7be4 nt!NtExtendSection
8050115c  805e1a46 nt!NtFilterToken
80501160  8060a83e nt!NtFindAtom
80501164  8056ade2 nt!NtFlushBuffersFile
80501168  805aa8f6 nt!NtFlushInstructionCache
8050116c  806198ee nt!NtFlushKey
80501170  805a05ee nt!NtFlushVirtualMemory
80501174  805aa898 nt!NtFlushWriteBuffer
80501178  805aa408 nt!NtFreeUserPhysicalPages
8050117c  805a6ebe nt!NtFreeVirtualMemory
80501180  8056d330 nt!NtFsControlFile
80501184  805c5fc0 nt!NtGetContextThread
80501188  805bce0e nt!NtGetDevicePowerState
8050118c  8058d316 nt!NtGetPlugPlayEvent
80501190  8051cc4e nt!NtGetWriteWatch
80501194  805ed5ca nt!NtImpersonateAnonymousToken
80501198  80598fc8 nt!NtImpersonateClientOfPort
8050119c  805cc2d8 nt!NtImpersonateThread
805011a0  80616bb2 nt!NtInitializeRegistry
805011a4  805bcbf4 nt!NtInitiatePowerAction
805011a8  805c9d00 nt!NtIsProcessInJob
805011ac  805bcdfa nt!NtIsSystemResumeAutomatic
805011b0  805991d4 nt!NtListenPort
805011b4  80578322 nt!NtLoadDriver
805011b8  8061a90a nt!NtLoadKey
805011bc  8061a554 nt!NtLoadKey2
805011c0  8056d364 nt!NtLockFile
805011c4  80607e06 nt!NtLockProductActivationKeys
805011c8  80618aaa nt!NtLockRegistryKey
805011cc  805aa9fe nt!NtLockVirtualMemory
805011d0  805b3a74 nt!NtMakePermanentObject
805011d4  805b079c nt!NtMakeTemporaryObject
805011d8  805a9360 nt!NtMapUserPhysicalPages
805011dc  805a9938 nt!NtMapUserPhysicalPagesScatter
805011e0  805a5f3e nt!NtMapViewOfSection
805011e4  8060b856 nt!NtCancelDeviceWakeupRequest
805011e8  8056df94 nt!NtNotifyChangeDirectoryFile
805011ec  8061a8d4 nt!NtNotifyChangeKey
805011f0  806199f0 nt!NtNotifyChangeMultipleKeys
805011f4  805b26c6 nt!NtOpenDirectoryObject
805011f8  80603a34 nt!NtOpenEvent
805011fc  8060bc74 nt!NtOpenEventPair
80501200  8056e254 nt!NtOpenFile
80501204  8056baa0 nt!NtOpenIoCompletion
80501208  805ca28a nt!NtOpenJobObject
8050120c  80619f70 nt!NtOpenKey
80501210  8060c06c nt!NtOpenMutant
80501214  805e8fb2 nt!NtOpenObjectAuditAlarm
80501218  805bfb56 nt!NtOpenProcess
8050121c  805e2292 nt!NtOpenProcessToken
80501220  805e1e98 nt!NtOpenProcessTokenEx
80501224  8059e258 nt!NtOpenSection
80501228  80609a2a nt!NtOpenSemaphore
8050122c  805b95e2 nt!NtOpenSymbolicLinkObject
80501230  805bfde2 nt!NtOpenThread
80501234  805e22b0 nt!NtOpenThreadToken
80501238  805e2008 nt!NtOpenThreadTokenEx
8050123c  8060b986 nt!NtOpenTimer
80501240  80639cbe nt!NtPlugPlayControl
80501244  805bdc42 nt!NtPowerInformation
80501248  805ec67c nt!NtPrivilegeCheck
8050124c  805e82c4 nt!NtPrivilegeObjectAuditAlarm
80501250  805e84b0 nt!NtPrivilegedServiceAuditAlarm
80501254  805ac4c6 nt!NtProtectVirtualMemory
80501258  80603aec nt!NtPulseEvent
8050125c  8056afc8 nt!NtQueryAttributesFile
80501260  8060b318 nt!NtQueryBootOptions
80501264  8060b318 nt!NtQueryBootOptions
80501268  8053b206 nt!NtQueryDebugFilterState
8050126c  80605658 nt!NtQueryDefaultLocale
80501270  806062b8 nt!NtQueryDefaultUILanguage
80501274  8056df2e nt!NtQueryDirectoryFile
80501278  805b2766 nt!NtQueryDirectoryObject
8050127c  8056e284 nt!NtQueryEaFile
80501280  80603bb4 nt!NtQueryEvent
80501284  8056b100 nt!NtQueryFullAttributesFile
80501288  8060aab2 nt!NtQueryInformationAtom
8050128c  8056eb00 nt!NtQueryInformationFile
80501290  805ca75c nt!NtQueryInformationJobObject
80501294  80599232 nt!NtQueryInformationPort
80501298  805c14bc nt!NtQueryInformationProcess
8050129c  805c0088 nt!NtQueryInformationThread
805012a0  805e2390 nt!NtQueryInformationToken
805012a4  80605a56 nt!NtQueryInstallUILanguage
805012a8  8060c836 nt!NtQueryIntervalProfile
805012ac  8056bb48 nt!NtQueryIoCompletion
805012b0  8061a294 nt!NtQueryKey
805012b4  80617da8 nt!NtQueryMultipleValueKey
805012b8  8060c114 nt!NtQueryMutant
805012bc  805b8abc nt!NtQueryObject
805012c0  8061840e nt!NtQueryOpenSubKeys
805012c4  8060c8c4 nt!NtQueryPerformanceCounter
805012c8  8056f94a nt!NtQueryQuotaInformationFile
805012cc  805ac688 nt!NtQuerySection
805012d0  805b4440 nt!NtQuerySecurityObject
805012d4  80609ae2 nt!NtQuerySemaphore
805012d8  805b9682 nt!NtQuerySymbolicLinkObject
805012dc  8060b334 nt!NtQuerySystemEnvironmentValue
805012e0  8060b2fc nt!NtSetSystemEnvironmentValueEx
805012e4  80606338 nt!NtQuerySystemInformation
805012e8  806081ba nt!NtQuerySystemTime
805012ec  8060ba3e nt!NtQueryTimer
805012f0  80607a72 nt!NtQueryTimerResolution
805012f4  80616c94 nt!NtQueryValueKey
805012f8  805acd0e nt!NtQueryVirtualMemory
805012fc  8056fe3a nt!NtQueryVolumeInformationFile
80501300  805c5d0c nt!NtQueueApcThread
80501304  80540018 nt!NtRaiseException
80501308  80609754 nt!NtRaiseHardError
8050130c  80570602 nt!NtReadFile
80501310  80570b90 nt!NtReadFileScatter
80501314  80599cba nt!NtReadRequestData
80501318  805a81d0 nt!NtReadVirtualMemory
8050131c  805c725c nt!NtRegisterThreadTerminatePort
80501320  8060c24c nt!NtReleaseMutant
80501324  80609c12 nt!NtReleaseSemaphore
80501328  8056be40 nt!NtRemoveIoCompletion
8050132c  80637b9c nt!NtRemoveProcessDebug
80501330  80618600 nt!NtRenameKey
80501334  8061a7ba nt!NtReplaceKey
80501338  8059933a nt!NtReplyPort
8050133c  8059a302 nt!NtReplyWaitReceivePort
80501340  80599d0a nt!NtReplyWaitReceivePortEx
80501344  80599624 nt!NtReplyWaitReplyPort
80501348  805bcd8c nt!NtRequestDeviceWakeup
8050134c  80596898 nt!NtRequestPort
80501350  80596bc4 nt!NtRequestWaitReplyPort
80501354  805bcb9a nt!NtRequestWakeupLatency
80501358  80603cc6 nt!NtResetEvent
8050135c  8051d12e nt!NtResetWriteWatch
80501360  80616fe2 nt!NtRestoreKey
80501364  805c95bc nt!NtResumeProcess
80501368  805c949e nt!NtResumeThread
8050136c  80617084 nt!NtSaveKey
80501370  80617114 nt!NtSaveKeyEx
80501374  806171e0 nt!NtSaveMergedKeys
80501378  80597bb2 nt!NtSecureConnectPort
8050137c  8060b318 nt!NtQueryBootOptions
80501380  8060b318 nt!NtQueryBootOptions
80501384  805c61d0 nt!NtSetContextThread
80501388  8063a854 nt!NtSetDebugFilterState
8050138c  806095fe nt!NtSetDefaultHardErrorPort
80501390  806057a8 nt!NtSetDefaultLocale
80501394  8060601a nt!NtSetDefaultUILanguage
80501398  8056e7a0 nt!NtSetEaFile
8050139c  80603d86 nt!NtSetEvent
805013a0  80603e50 nt!NtSetEventBoostPriority
805013a4  8060bf30 nt!NtSetHighEventPair
805013a8  8060be60 nt!NtSetHighWaitLowEventPair
805013ac  80637566 nt!NtSetInformationDebugObject
805013b0  8056f104 nt!NtSetInformationFile
805013b4  805cb46c nt!NtSetInformationJobObject
805013b8  80617974 nt!NtSetInformationKey
805013bc  805b7f00 nt!NtSetInformationObject
805013c0  805c2614 nt!NtSetInformationProcess
805013c4  805c05d4 nt!NtSetInformationThread
805013c8  805ee9f8 nt!NtSetInformationToken
805013cc  8060c398 nt!NtSetIntervalProfile
805013d0  8056bdde nt!NtSetIoCompletion
805013d4  805c83e8 nt!NtSetLdtEntries
805013d8  8060becc nt!NtSetLowEventPair
805013dc  8060bdf4 nt!NtSetLowWaitHighEventPair
805013e0  8056f928 nt!NtSetQuotaInformationFile
805013e4  805b4374 nt!NtSetSecurityObject
805013e8  8060b5b8 nt!NtSetSystemEnvironmentValue
805013ec  8060b2fc nt!NtSetSystemEnvironmentValueEx
805013f0  80604686 nt!NtSetSystemInformation
805013f4  80646de8 nt!NtSetSystemPowerState
805013f8  80608d7a nt!NtSetSystemTime
805013fc  805bcaae nt!NtSetThreadExecutionState
80501400  80534318 nt!NtSetTimer
80501404  8060824c nt!NtSetTimerResolution
80501408  8060a0c8 nt!NtSetUuidSeed
8050140c  8061729a nt!NtSetValueKey
80501410  8057025e nt!NtSetVolumeInformationFile
80501414  80607868 nt!NtShutdownSystem
80501418  80521ed6 nt!NtSignalAndWaitForSingleObject
8050141c  8060c5e2 nt!NtStartProfile
80501420  8060c78c nt!NtStopProfile
80501424  805c9566 nt!NtSuspendProcess
80501428  805c93d8 nt!NtSuspendThread
8050142c  8060c9b0 nt!NtSystemDebugControl
80501430  805cbfd6 nt!NtTerminateJobObject
80501434  805c74a6 nt!NtTerminateProcess
80501438  805c76a0 nt!NtTerminateThread
8050143c  805c9726 nt!NtTestAlert
80501440  805309e4 nt!NtTraceEvent
80501444  8060b326 nt!NtTranslateFilePath
80501448  805784b6 nt!NtUnloadDriver
8050144c  80617562 nt!NtUnloadKey
80501450  80617750 nt!NtUnloadKeyEx
80501454  8056d710 nt!NtUnlockFile
80501458  805aaf8c nt!NtUnlockVirtualMemory
8050145c  805a6d54 nt!NtUnmapViewOfSection
80501460  805efdb0 nt!NtVdmControl
80501464  806372ce nt!NtWaitForDebugEvent
80501468  805b4aac nt!NtWaitForMultipleObjects
8050146c  805b49c2 nt!NtWaitForSingleObject
80501470  8060bd90 nt!NtWaitHighEventPair
80501474  8060bd2c nt!NtWaitLowEventPair
80501478  805710a0 nt!NtWriteFile
8050147c  805716b0 nt!NtWriteFileGather
80501480  80599ce2 nt!NtWriteRequestData
80501484  805a82da nt!NtWriteVirtualMemory
80501488  805016d0 nt!NtYieldExecution
8050148c  8060ce08 nt!NtCreateKeyedEvent
80501490  8060cef2 nt!NtOpenKeyedEvent
80501494  8060cfa4 nt!NtReleaseKeyedEvent
80501498  8060d230 nt!NtWaitForKeyedEvent
8050149c  805c0058 nt!NtQueryPortInformationProcess