[PATCH v2 2/7] ntdll: Make syscalls use the SYSCALL calling convention.

8 Dec 2022

diff --git a/dlls/ntdll/unix/debug.c b/dlls/ntdll/unix/debug.c
index aa2d87c304f..8b5a57d1f0a 100644
--- a/dlls/ntdll/unix/debug.c
+++ b/dlls/ntdll/unix/debug.c
@@ -255,7 +255,7 @@ const char * __cdecl __wine_dbg_strdup( const char *str )
 /***********************************************************************
  *		__wine_dbg_write  (NTDLL.@)
  */
-int WINAPI __wine_dbg_write( const char *str, unsigned int len )
+int SYSCALL __wine_dbg_write( const char *str, unsigned int len )
 {
     return write( 2, str, len );
 }
@@ -336,8 +336,8 @@ void dbg_init(void)
 /***********************************************************************
  *              NtTraceControl  (NTDLL.@)
  */
-NTSTATUS WINAPI NtTraceControl( ULONG code, void *inbuf, ULONG inbuf_len,
-                                void *outbuf, ULONG outbuf_len, ULONG *size )
+NTSTATUS SYSCALL NtTraceControl( ULONG code, void *inbuf, ULONG inbuf_len,
+                                 void *outbuf, ULONG outbuf_len, ULONG *size )
 {
     FIXME( "code %u, inbuf %p, inbuf_len %u, outbuf %p, outbuf_len %u, size %p\n",
            (int)code, inbuf, (int)inbuf_len, outbuf, (int)outbuf_len, size );
@@ -348,7 +348,7 @@ NTSTATUS WINAPI NtTraceControl( ULONG code, void *inbuf, ULONG inbuf_len,
 /***********************************************************************
  *              NtSetDebugFilterState  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetDebugFilterState( ULONG component_id, ULONG level, BOOLEAN state )
+NTSTATUS SYSCALL NtSetDebugFilterState( ULONG component_id, ULONG level, BOOLEAN state )
 {
     FIXME( "component_id %#x, level %u, state %#x stub.\n", (int)component_id, (int)level, state );
diff --git a/dlls/ntdll/unix/env.c b/dlls/ntdll/unix/env.c
index 6f1709f4713..fc3347b80eb 100644
--- a/dlls/ntdll/unix/env.c
+++ b/dlls/ntdll/unix/env.c
@@ -2168,7 +2168,7 @@ void *create_startup_info( const UNICODE_STRING *nt_image, const RTL_USER_PROCES
 /**************************************************************************
  *      NtGetNlsSectionPtr  (NTDLL.@)
  */
-NTSTATUS WINAPI NtGetNlsSectionPtr( ULONG type, ULONG id, void *unknown, void **ptr, SIZE_T *size )
+NTSTATUS SYSCALL NtGetNlsSectionPtr( ULONG type, ULONG id, void *unknown, void **ptr, SIZE_T *size )
 {
     static const WCHAR sortdirW[] = {'\','?','?','\','C',':','\','w','i','n','d','o','w','s','\',
                                      'g','l','o','b','a','l','i','z','a','t','i','o','n','\',
@@ -2208,7 +2208,7 @@ NTSTATUS WINAPI NtGetNlsSectionPtr( ULONG type, ULONG id, void *unknown, void **
 /**************************************************************************
  *      NtInitializeNlsFiles  (NTDLL.@)
  */
-NTSTATUS WINAPI NtInitializeNlsFiles( void **ptr, LCID *lcid, LARGE_INTEGER *size )
+NTSTATUS SYSCALL NtInitializeNlsFiles( void **ptr, LCID *lcid, LARGE_INTEGER *size )
 {
     const char *dir = build_dir ? build_dir : data_dir;
     char *path;
@@ -2239,7 +2239,7 @@ NTSTATUS WINAPI NtInitializeNlsFiles( void **ptr, LCID *lcid, LARGE_INTEGER *siz
 /**********************************************************************
  *      NtQueryDefaultLocale  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryDefaultLocale( BOOLEAN user, LCID *lcid )
+NTSTATUS SYSCALL NtQueryDefaultLocale( BOOLEAN user, LCID *lcid )
 {
     *lcid = user ? user_lcid : system_lcid;
     return STATUS_SUCCESS;
@@ -2249,7 +2249,7 @@ NTSTATUS WINAPI NtQueryDefaultLocale( BOOLEAN user, LCID *lcid )
 /**********************************************************************
  *      NtSetDefaultLocale  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetDefaultLocale( BOOLEAN user, LCID lcid )
+NTSTATUS SYSCALL NtSetDefaultLocale( BOOLEAN user, LCID lcid )
 {
     if (user) user_lcid = lcid;
     else system_lcid = lcid;
@@ -2260,7 +2260,7 @@ NTSTATUS WINAPI NtSetDefaultLocale( BOOLEAN user, LCID lcid )
 /**********************************************************************
  *      NtQueryDefaultUILanguage  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryDefaultUILanguage( LANGID *lang )
+NTSTATUS SYSCALL NtQueryDefaultUILanguage( LANGID *lang )
 {
     *lang = user_ui_language;
     return STATUS_SUCCESS;
@@ -2270,7 +2270,7 @@ NTSTATUS WINAPI NtQueryDefaultUILanguage( LANGID *lang )
 /**********************************************************************
  *      NtSetDefaultUILanguage  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetDefaultUILanguage( LANGID lang )
+NTSTATUS SYSCALL NtSetDefaultUILanguage( LANGID lang )
 {
     user_ui_language = lang;
     return STATUS_SUCCESS;
@@ -2280,7 +2280,7 @@ NTSTATUS WINAPI NtSetDefaultUILanguage( LANGID lang )
 /**********************************************************************
  *      NtQueryInstallUILanguage  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInstallUILanguage( LANGID *lang )
+NTSTATUS SYSCALL NtQueryInstallUILanguage( LANGID *lang )
 {
     *lang = LANGIDFROMLCID(system_lcid); /* there is no separate call to set it */
     return STATUS_SUCCESS;
diff --git a/dlls/ntdll/unix/file.c b/dlls/ntdll/unix/file.c
index 957d9f3b801..63a27ec55d6 100644
--- a/dlls/ntdll/unix/file.c
+++ b/dlls/ntdll/unix/file.c
@@ -2603,10 +2603,10 @@ static unsigned int get_cached_dir_data( HANDLE handle, struct dir_data **data_r
 /******************************************************************************
  *              NtQueryDirectoryFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryDirectoryFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc_routine,
-                                      void *apc_context, IO_STATUS_BLOCK *io, void *buffer, ULONG length,
-                                      FILE_INFORMATION_CLASS info_class, BOOLEAN single_entry,
-                                      UNICODE_STRING *mask, BOOLEAN restart_scan )
+NTSTATUS SYSCALL NtQueryDirectoryFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc_routine,
+                                       void *apc_context, IO_STATUS_BLOCK *io, void *buffer, ULONG length,
+                                       FILE_INFORMATION_CLASS info_class, BOOLEAN single_entry,
+                                       UNICODE_STRING *mask, BOOLEAN restart_scan )
 {
     int cwd, fd, needs_close;
     enum server_fd_type type;
@@ -3645,8 +3645,8 @@ NTSTATUS nt_to_unix_file_name( const OBJECT_ATTRIBUTES *attr, char **name_ret, U
  * element doesn't have to exist; in that case STATUS_NO_SUCH_FILE is
  * returned, but the unix name is still filled in properly.
  */
-NTSTATUS WINAPI wine_nt_to_unix_file_name( const OBJECT_ATTRIBUTES *attr, char *nameA, ULONG *size,
-                                          UINT disposition )
+NTSTATUS SYSCALL wine_nt_to_unix_file_name( const OBJECT_ATTRIBUTES *attr, char *nameA, ULONG *size,
+                                           UINT disposition )
 {
     char *buffer = NULL;
     NTSTATUS status;
@@ -3800,7 +3800,7 @@ NTSTATUS unix_to_nt_file_name( const char *name, WCHAR **nt )
 /******************************************************************
  *           wine_unix_to_nt_file_name
  */
-NTSTATUS WINAPI wine_unix_to_nt_file_name( const char *name, WCHAR *buffer, ULONG *size )
+NTSTATUS SYSCALL wine_unix_to_nt_file_name( const char *name, WCHAR *buffer, ULONG *size )
 {
     WCHAR *nt_name = NULL;
     NTSTATUS status;
@@ -3958,10 +3958,10 @@ NTSTATUS open_unix_file( HANDLE *handle, const char *unix_name, ACCESS_MASK acce
 /******************************************************************************
  *              NtCreateFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateFile( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
-                              IO_STATUS_BLOCK *io, LARGE_INTEGER *alloc_size,
-                              ULONG attributes, ULONG sharing, ULONG disposition,
-                              ULONG options, void *ea_buffer, ULONG ea_length )
+NTSTATUS SYSCALL NtCreateFile( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
+                               IO_STATUS_BLOCK *io, LARGE_INTEGER *alloc_size,
+                               ULONG attributes, ULONG sharing, ULONG disposition,
+                               ULONG options, void *ea_buffer, ULONG ea_length )
 {
     OBJECT_ATTRIBUTES new_attr;
     UNICODE_STRING nt_name;
@@ -4063,8 +4063,8 @@ NTSTATUS WINAPI NtCreateFile( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBU
 /******************************************************************************
  *              NtOpenFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenFile( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
-                            IO_STATUS_BLOCK *io, ULONG sharing, ULONG options )
+NTSTATUS SYSCALL NtOpenFile( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
+                             IO_STATUS_BLOCK *io, ULONG sharing, ULONG options )
 {
     return NtCreateFile( handle, access, attr, io, NULL, 0, sharing, FILE_OPEN, options, NULL, 0 );
 }
@@ -4073,9 +4073,9 @@ NTSTATUS WINAPI NtOpenFile( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTE
 /******************************************************************************
  *		NtCreateMailslotFile    (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateMailslotFile( HANDLE *handle, ULONG access, OBJECT_ATTRIBUTES *attr,
-                                      IO_STATUS_BLOCK *io, ULONG options, ULONG quota, ULONG msg_size,
-                                      LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtCreateMailslotFile( HANDLE *handle, ULONG access, OBJECT_ATTRIBUTES *attr,
+                                       IO_STATUS_BLOCK *io, ULONG options, ULONG quota, ULONG msg_size,
+                                       LARGE_INTEGER *timeout )
 {
     unsigned int status;
     data_size_t len;
@@ -4106,11 +4106,11 @@ NTSTATUS WINAPI NtCreateMailslotFile( HANDLE *handle, ULONG access, OBJECT_ATTRI
 /******************************************************************
  *		NtCreateNamedPipeFile    (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateNamedPipeFile( HANDLE *handle, ULONG access, OBJECT_ATTRIBUTES *attr,
-                                       IO_STATUS_BLOCK *io, ULONG sharing, ULONG dispo, ULONG options,
-                                       ULONG pipe_type, ULONG read_mode, ULONG completion_mode,
-                                       ULONG max_inst, ULONG inbound_quota, ULONG outbound_quota,
-                                       LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtCreateNamedPipeFile( HANDLE *handle, ULONG access, OBJECT_ATTRIBUTES *attr,
+                                        IO_STATUS_BLOCK *io, ULONG sharing, ULONG dispo, ULONG options,
+                                        ULONG pipe_type, ULONG read_mode, ULONG completion_mode,
+                                        ULONG max_inst, ULONG inbound_quota, ULONG outbound_quota,
+                                        LARGE_INTEGER *timeout )
 {
     unsigned int status;
     data_size_t len;
@@ -4155,7 +4155,7 @@ NTSTATUS WINAPI NtCreateNamedPipeFile( HANDLE *handle, ULONG access, OBJECT_ATTR
 /******************************************************************
  *              NtDeleteFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtDeleteFile( OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtDeleteFile( OBJECT_ATTRIBUTES *attr )
 {
     HANDLE handle;
     NTSTATUS status;
@@ -4180,8 +4180,8 @@ NTSTATUS WINAPI NtDeleteFile( OBJECT_ATTRIBUTES *attr )
 /******************************************************************************
  *              NtQueryFullAttributesFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryFullAttributesFile( const OBJECT_ATTRIBUTES *attr,
-                                           FILE_NETWORK_OPEN_INFORMATION *info )
+NTSTATUS SYSCALL NtQueryFullAttributesFile( const OBJECT_ATTRIBUTES *attr,
+                                            FILE_NETWORK_OPEN_INFORMATION *info )
 {
     char *unix_name;
     unsigned int status;
@@ -4226,7 +4226,7 @@ NTSTATUS WINAPI NtQueryFullAttributesFile( const OBJECT_ATTRIBUTES *attr,
 /******************************************************************************
  *              NtQueryAttributesFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryAttributesFile( const OBJECT_ATTRIBUTES *attr, FILE_BASIC_INFORMATION *info )
+NTSTATUS SYSCALL NtQueryAttributesFile( const OBJECT_ATTRIBUTES *attr, FILE_BASIC_INFORMATION *info )
 {
     char *unix_name;
     unsigned int status;
@@ -4259,8 +4259,8 @@ NTSTATUS WINAPI NtQueryAttributesFile( const OBJECT_ATTRIBUTES *attr, FILE_BASIC
 /******************************************************************************
  *              NtQueryInformationFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
-                                        void *ptr, ULONG len, FILE_INFORMATION_CLASS class )
+NTSTATUS SYSCALL NtQueryInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
+                                         void *ptr, ULONG len, FILE_INFORMATION_CLASS class )
 {
     static const size_t info_sizes[] =
     {
@@ -4548,8 +4548,8 @@ NTSTATUS WINAPI NtQueryInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
 /******************************************************************************
  *              NtSetInformationFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
-                                      void *ptr, ULONG len, FILE_INFORMATION_CLASS class )
+NTSTATUS SYSCALL NtSetInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
+                                       void *ptr, ULONG len, FILE_INFORMATION_CLASS class )
 {
     int fd, needs_close;
     unsigned int status = STATUS_SUCCESS;
@@ -5330,9 +5330,9 @@ static unsigned int set_pending_write( HANDLE device )
 /******************************************************************************
  *              NtReadFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtReadFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
-                            IO_STATUS_BLOCK *io, void *buffer, ULONG length,
-                            LARGE_INTEGER *offset, ULONG *key )
+NTSTATUS SYSCALL NtReadFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
+                             IO_STATUS_BLOCK *io, void *buffer, ULONG length,
+                             LARGE_INTEGER *offset, ULONG *key )
 {
     int result, unix_handle, needs_close;
     unsigned int options;
@@ -5533,9 +5533,9 @@ err:
 /******************************************************************************
  *              NtReadFileScatter   (NTDLL.@)
  */
-NTSTATUS WINAPI NtReadFileScatter( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
-                                   IO_STATUS_BLOCK *io, FILE_SEGMENT_ELEMENT *segments,
-                                   ULONG length, LARGE_INTEGER *offset, ULONG *key )
+NTSTATUS SYSCALL NtReadFileScatter( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
+                                    IO_STATUS_BLOCK *io, FILE_SEGMENT_ELEMENT *segments,
+                                    ULONG length, LARGE_INTEGER *offset, ULONG *key )
 {
     int result, unix_handle, needs_close;
     unsigned int options, status;
@@ -5610,9 +5610,9 @@ error:
 /******************************************************************************
  *              NtWriteFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWriteFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
-                             IO_STATUS_BLOCK *io, const void *buffer, ULONG length,
-                             LARGE_INTEGER *offset, ULONG *key )
+NTSTATUS SYSCALL NtWriteFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
+                              IO_STATUS_BLOCK *io, const void *buffer, ULONG length,
+                              LARGE_INTEGER *offset, ULONG *key )
 {
     int result, unix_handle, needs_close;
     unsigned int options;
@@ -5840,9 +5840,9 @@ err:
 /******************************************************************************
  *              NtWriteFileGather   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWriteFileGather( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
-                                   IO_STATUS_BLOCK *io, FILE_SEGMENT_ELEMENT *segments,
-                                   ULONG length, LARGE_INTEGER *offset, ULONG *key )
+NTSTATUS SYSCALL NtWriteFileGather( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void *apc_user,
+                                    IO_STATUS_BLOCK *io, FILE_SEGMENT_ELEMENT *segments,
+                                    ULONG length, LARGE_INTEGER *offset, ULONG *key )
 {
     int result, unix_handle, needs_close;
     unsigned int options, status;
@@ -5927,9 +5927,9 @@ NTSTATUS WINAPI NtWriteFileGather( HANDLE file, HANDLE event, PIO_APC_ROUTINE ap
 /******************************************************************************
  *              NtDeviceIoControlFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtDeviceIoControlFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
-                                       IO_STATUS_BLOCK *io, ULONG code, void *in_buffer, ULONG in_size,
-                                       void *out_buffer, ULONG out_size )
+NTSTATUS SYSCALL NtDeviceIoControlFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
+                                        IO_STATUS_BLOCK *io, ULONG code, void *in_buffer, ULONG in_size,
+                                        void *out_buffer, ULONG out_size )
 {
     ULONG device = (code >> 16);
     NTSTATUS status = STATUS_NOT_SUPPORTED;
@@ -6004,9 +6004,9 @@ static void ignore_server_ioctl_struct_holes( ULONG code, const void *in_buffer,
 /******************************************************************************
  *              NtFsControlFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtFsControlFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
-                                 IO_STATUS_BLOCK *io, ULONG code, void *in_buffer, ULONG in_size,
-                                 void *out_buffer, ULONG out_size )
+NTSTATUS SYSCALL NtFsControlFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
+                                  IO_STATUS_BLOCK *io, ULONG code, void *in_buffer, ULONG in_size,
+                                  void *out_buffer, ULONG out_size )
 {
     NTSTATUS status;
@@ -6112,7 +6112,7 @@ NTSTATUS WINAPI NtFsControlFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE ap
 /******************************************************************************
  *              NtFlushBuffersFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtFlushBuffersFile( HANDLE handle, IO_STATUS_BLOCK *io )
+NTSTATUS SYSCALL NtFlushBuffersFile( HANDLE handle, IO_STATUS_BLOCK *io )
 {
     NTSTATUS ret;
     HANDLE wait_handle;
@@ -6170,7 +6170,7 @@ NTSTATUS WINAPI NtFlushBuffersFile( HANDLE handle, IO_STATUS_BLOCK *io )
 /**************************************************************************
  *           NtCancelIoFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCancelIoFile( HANDLE handle, IO_STATUS_BLOCK *io_status )
+NTSTATUS SYSCALL NtCancelIoFile( HANDLE handle, IO_STATUS_BLOCK *io_status )
 {
     unsigned int status;
@@ -6195,7 +6195,7 @@ NTSTATUS WINAPI NtCancelIoFile( HANDLE handle, IO_STATUS_BLOCK *io_status )
 /**************************************************************************
  *           NtCancelIoFileEx   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCancelIoFileEx( HANDLE handle, IO_STATUS_BLOCK *io, IO_STATUS_BLOCK *io_status )
+NTSTATUS SYSCALL NtCancelIoFileEx( HANDLE handle, IO_STATUS_BLOCK *io, IO_STATUS_BLOCK *io_status )
 {
     unsigned int status;
@@ -6220,7 +6220,7 @@ NTSTATUS WINAPI NtCancelIoFileEx( HANDLE handle, IO_STATUS_BLOCK *io, IO_STATUS_
 /**************************************************************************
  *           NtCancelSynchronousIoFile (NTDLL.@)
  */
-NTSTATUS WINAPI NtCancelSynchronousIoFile( HANDLE handle, IO_STATUS_BLOCK *io, IO_STATUS_BLOCK *io_status )
+NTSTATUS SYSCALL NtCancelSynchronousIoFile( HANDLE handle, IO_STATUS_BLOCK *io, IO_STATUS_BLOCK *io_status )
 {
     unsigned int status;
@@ -6242,9 +6242,9 @@ NTSTATUS WINAPI NtCancelSynchronousIoFile( HANDLE handle, IO_STATUS_BLOCK *io, I
 /******************************************************************
  *           NtLockFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtLockFile( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void* apc_user,
-                            IO_STATUS_BLOCK *io_status, LARGE_INTEGER *offset,
-                            LARGE_INTEGER *count, ULONG *key, BOOLEAN dont_wait, BOOLEAN exclusive )
+NTSTATUS SYSCALL NtLockFile( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void* apc_user,
+                             IO_STATUS_BLOCK *io_status, LARGE_INTEGER *offset,
+                             LARGE_INTEGER *count, ULONG *key, BOOLEAN dont_wait, BOOLEAN exclusive )
 {
     static int warn;
     unsigned int ret;
@@ -6301,8 +6301,8 @@ NTSTATUS WINAPI NtLockFile( HANDLE file, HANDLE event, PIO_APC_ROUTINE apc, void
 /******************************************************************
  *           NtUnlockFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtUnlockFile( HANDLE handle, IO_STATUS_BLOCK *io_status, LARGE_INTEGER *offset,
-                              LARGE_INTEGER *count, ULONG *key )
+NTSTATUS SYSCALL NtUnlockFile( HANDLE handle, IO_STATUS_BLOCK *io_status, LARGE_INTEGER *offset,
+                               LARGE_INTEGER *count, ULONG *key )
 {
     unsigned int status;
@@ -6412,9 +6412,9 @@ static BOOL read_changes_apc( void *user, ULONG_PTR *info, unsigned int *status
 /******************************************************************************
  *              NtNotifyChangeDirectoryFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtNotifyChangeDirectoryFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc,
-                                             void *apc_context, IO_STATUS_BLOCK *iosb, void *buffer,
-                                             ULONG buffer_size, ULONG filter, BOOLEAN subtree )
+NTSTATUS SYSCALL NtNotifyChangeDirectoryFile( HANDLE handle, HANDLE event, PIO_APC_ROUTINE apc,
+                                              void *apc_context, IO_STATUS_BLOCK *iosb, void *buffer,
+                                              ULONG buffer_size, ULONG filter, BOOLEAN subtree )
 {
     struct async_fileio_read_changes *fileio;
     unsigned int status;
@@ -6655,9 +6655,9 @@ NTSTATUS get_device_info( int fd, FILE_FS_DEVICE_INFORMATION *info )
 /******************************************************************************
  *              NtQueryVolumeInformationFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryVolumeInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
-                                              void *buffer, ULONG length,
-                                              FS_INFORMATION_CLASS info_class )
+NTSTATUS SYSCALL NtQueryVolumeInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
+                                               void *buffer, ULONG length,
+                                               FS_INFORMATION_CLASS info_class )
 {
     int fd, needs_close;
     unsigned int status;
@@ -6893,8 +6893,8 @@ NTSTATUS WINAPI NtQueryVolumeInformationFile( HANDLE handle, IO_STATUS_BLOCK *io
 /******************************************************************************
  *              NtSetVolumeInformationFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetVolumeInformationFile( HANDLE handle, IO_STATUS_BLOCK *io, void *info,
-                                            ULONG length, FS_INFORMATION_CLASS class )
+NTSTATUS SYSCALL NtSetVolumeInformationFile( HANDLE handle, IO_STATUS_BLOCK *io, void *info,
+                                             ULONG length, FS_INFORMATION_CLASS class )
 {
     FIXME( "(%p,%p,%p,0x%08x,0x%08x) stub\n", handle, io, info, (int)length, class );
     return STATUS_SUCCESS;
@@ -6904,9 +6904,9 @@ NTSTATUS WINAPI NtSetVolumeInformationFile( HANDLE handle, IO_STATUS_BLOCK *io,
 /******************************************************************
  *           NtQueryEaFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryEaFile( HANDLE handle, IO_STATUS_BLOCK *io, void *buffer, ULONG length,
-                               BOOLEAN single_entry, void *list, ULONG list_len,
-                               ULONG *index, BOOLEAN restart )
+NTSTATUS SYSCALL NtQueryEaFile( HANDLE handle, IO_STATUS_BLOCK *io, void *buffer, ULONG length,
+                                BOOLEAN single_entry, void *list, ULONG list_len,
+                                ULONG *index, BOOLEAN restart )
 {
     int fd, needs_close;
     NTSTATUS status;
@@ -6928,7 +6928,7 @@ NTSTATUS WINAPI NtQueryEaFile( HANDLE handle, IO_STATUS_BLOCK *io, void *buffer,
 /******************************************************************
  *           NtSetEaFile   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetEaFile( HANDLE handle, IO_STATUS_BLOCK *io, void *buffer, ULONG length )
+NTSTATUS SYSCALL NtSetEaFile( HANDLE handle, IO_STATUS_BLOCK *io, void *buffer, ULONG length )
 {
     FIXME( "(%p,%p,%p,%d) stub\n", handle, io, buffer, (int)length );
     return STATUS_ACCESS_DENIED;
@@ -6962,8 +6962,8 @@ static void *put_object_type_info( OBJECT_TYPE_INFORMATION *p, struct object_typ
 /**************************************************************************
  *           NtQueryObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryObject( HANDLE handle, OBJECT_INFORMATION_CLASS info_class,
-                               void *ptr, ULONG len, ULONG *used_len )
+NTSTATUS SYSCALL NtQueryObject( HANDLE handle, OBJECT_INFORMATION_CLASS info_class,
+                                void *ptr, ULONG len, ULONG *used_len )
 {
     unsigned int status;
@@ -7161,8 +7161,8 @@ NTSTATUS WINAPI NtQueryObject( HANDLE handle, OBJECT_INFORMATION_CLASS info_clas
 /**************************************************************************
  *           NtSetInformationObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationObject( HANDLE handle, OBJECT_INFORMATION_CLASS info_class,
-                                        void *ptr, ULONG len )
+NTSTATUS SYSCALL NtSetInformationObject( HANDLE handle, OBJECT_INFORMATION_CLASS info_class,
+                                         void *ptr, ULONG len )
 {
     unsigned int status;
diff --git a/dlls/ntdll/unix/process.c b/dlls/ntdll/unix/process.c
index ca153a30bf2..4e34609675a 100644
--- a/dlls/ntdll/unix/process.c
+++ b/dlls/ntdll/unix/process.c
@@ -488,7 +488,7 @@ static NTSTATUS spawn_process( const RTL_USER_PROCESS_PARAMETERS *params, int so
 /***********************************************************************
  *           __wine_unix_spawnvp
  */
-NTSTATUS WINAPI __wine_unix_spawnvp( char * const argv[], int wait )
+NTSTATUS SYSCALL __wine_unix_spawnvp( char * const argv[], int wait )
 {
     pid_t pid, wret;
     int fd[2], status, err;
@@ -673,12 +673,12 @@ static NTSTATUS alloc_handle_list( const PS_ATTRIBUTE *handles_attr, obj_handle_
 /**********************************************************************
  *           NtCreateUserProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateUserProcess( HANDLE *process_handle_ptr, HANDLE *thread_handle_ptr,
-                                     ACCESS_MASK process_access, ACCESS_MASK thread_access,
-                                     OBJECT_ATTRIBUTES *process_attr, OBJECT_ATTRIBUTES *thread_attr,
-                                     ULONG process_flags, ULONG thread_flags,
-                                     RTL_USER_PROCESS_PARAMETERS *params, PS_CREATE_INFO *info,
-                                     PS_ATTRIBUTE_LIST *ps_attr )
+NTSTATUS SYSCALL NtCreateUserProcess( HANDLE *process_handle_ptr, HANDLE *thread_handle_ptr,
+                                      ACCESS_MASK process_access, ACCESS_MASK thread_access,
+                                      OBJECT_ATTRIBUTES *process_attr, OBJECT_ATTRIBUTES *thread_attr,
+                                      ULONG process_flags, ULONG thread_flags,
+                                      RTL_USER_PROCESS_PARAMETERS *params, PS_CREATE_INFO *info,
+                                      PS_ATTRIBUTE_LIST *ps_attr )
 {
     unsigned int status;
     BOOL success = FALSE;
@@ -942,7 +942,7 @@ done:
 /******************************************************************************
  *              NtTerminateProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtTerminateProcess( HANDLE handle, LONG exit_code )
+NTSTATUS SYSCALL NtTerminateProcess( HANDLE handle, LONG exit_code )
 {
     unsigned int ret;
     BOOL self;
@@ -1063,8 +1063,8 @@ void fill_vm_counters( VM_COUNTERS_EX *pvmi, int unix_pid )
 /**********************************************************************
  *           NtQueryInformationProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInformationProcess( HANDLE handle, PROCESSINFOCLASS class, void *info,
-                                           ULONG size, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryInformationProcess( HANDLE handle, PROCESSINFOCLASS class, void *info,
+                                            ULONG size, ULONG *ret_len )
 {
     unsigned int ret = STATUS_SUCCESS;
     ULONG len = 0;
@@ -1529,7 +1529,7 @@ NTSTATUS WINAPI NtQueryInformationProcess( HANDLE handle, PROCESSINFOCLASS class
 /**********************************************************************
  *           NtSetInformationProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationProcess( HANDLE handle, PROCESSINFOCLASS class, void *info, ULONG size )
+NTSTATUS SYSCALL NtSetInformationProcess( HANDLE handle, PROCESSINFOCLASS class, void *info, ULONG size )
 {
     unsigned int ret = STATUS_SUCCESS;
@@ -1655,8 +1655,8 @@ NTSTATUS WINAPI NtSetInformationProcess( HANDLE handle, PROCESSINFOCLASS class,
 /**********************************************************************
  *           NtOpenProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenProcess( HANDLE *handle, ACCESS_MASK access,
-                               const OBJECT_ATTRIBUTES *attr, const CLIENT_ID *id )
+NTSTATUS SYSCALL NtOpenProcess( HANDLE *handle, ACCESS_MASK access,
+                                const OBJECT_ATTRIBUTES *attr, const CLIENT_ID *id )
 {
     unsigned int status;
@@ -1678,7 +1678,7 @@ NTSTATUS WINAPI NtOpenProcess( HANDLE *handle, ACCESS_MASK access,
 /**********************************************************************
  *           NtSuspendProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSuspendProcess( HANDLE handle )
+NTSTATUS SYSCALL NtSuspendProcess( HANDLE handle )
 {
     unsigned int ret;
@@ -1695,7 +1695,7 @@ NTSTATUS WINAPI NtSuspendProcess( HANDLE handle )
 /**********************************************************************
  *           NtResumeProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtResumeProcess( HANDLE handle )
+NTSTATUS SYSCALL NtResumeProcess( HANDLE handle )
 {
     unsigned int ret;
@@ -1712,7 +1712,7 @@ NTSTATUS WINAPI NtResumeProcess( HANDLE handle )
 /**********************************************************************
  *           NtDebugActiveProcess  (NTDLL.@)
  */
-NTSTATUS WINAPI NtDebugActiveProcess( HANDLE process, HANDLE debug )
+NTSTATUS SYSCALL NtDebugActiveProcess( HANDLE process, HANDLE debug )
 {
     unsigned int ret;
@@ -1731,7 +1731,7 @@ NTSTATUS WINAPI NtDebugActiveProcess( HANDLE process, HANDLE debug )
 /**********************************************************************
  *           NtRemoveProcessDebug  (NTDLL.@)
  */
-NTSTATUS WINAPI NtRemoveProcessDebug( HANDLE process, HANDLE debug )
+NTSTATUS SYSCALL NtRemoveProcessDebug( HANDLE process, HANDLE debug )
 {
     unsigned int ret;
@@ -1750,7 +1750,7 @@ NTSTATUS WINAPI NtRemoveProcessDebug( HANDLE process, HANDLE debug )
 /**********************************************************************
  *           NtDebugContinue  (NTDLL.@)
  */
-NTSTATUS WINAPI NtDebugContinue( HANDLE handle, CLIENT_ID *client, NTSTATUS status )
+NTSTATUS SYSCALL NtDebugContinue( HANDLE handle, CLIENT_ID *client, NTSTATUS status )
 {
     unsigned int ret;
diff --git a/dlls/ntdll/unix/registry.c b/dlls/ntdll/unix/registry.c
index d183474b53f..0c48a4f4e94 100644
--- a/dlls/ntdll/unix/registry.c
+++ b/dlls/ntdll/unix/registry.c
@@ -72,8 +72,8 @@ NTSTATUS open_hkcu_key( const char *path, HANDLE *key )
 /******************************************************************************
  *              NtCreateKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateKey( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                             ULONG index, const UNICODE_STRING *class, ULONG options, ULONG *dispos )
+NTSTATUS SYSCALL NtCreateKey( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                              ULONG index, const UNICODE_STRING *class, ULONG options, ULONG *dispos )
 {
     unsigned int ret;
     data_size_t len;
@@ -118,9 +118,9 @@ NTSTATUS WINAPI NtCreateKey( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRI
 /******************************************************************************
  *              NtCreateKeyTransacted  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateKeyTransacted( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                                       ULONG index, const UNICODE_STRING *class, ULONG options,
-                                       HANDLE transacted, ULONG *dispos )
+NTSTATUS SYSCALL NtCreateKeyTransacted( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                        ULONG index, const UNICODE_STRING *class, ULONG options,
+                                        HANDLE transacted, ULONG *dispos )
 {
     FIXME( "(%p,%s,%s,%x,%x,%p,%p)\n", attr->RootDirectory, debugstr_us(attr->ObjectName),
            debugstr_us(class), (int)options, (int)access, transacted, key );
@@ -131,7 +131,7 @@ NTSTATUS WINAPI NtCreateKeyTransacted( HANDLE *key, ACCESS_MASK access, const OB
 /******************************************************************************
  *              NtOpenKeyEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenKeyEx( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, ULONG options )
+NTSTATUS SYSCALL NtOpenKeyEx( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, ULONG options )
 {
     unsigned int ret;
     ULONG attributes;
@@ -164,7 +164,7 @@ NTSTATUS WINAPI NtOpenKeyEx( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRI
 /******************************************************************************
  *              NtOpenKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenKey( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenKey( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     return NtOpenKeyEx( key, access, attr, 0 );
 }
@@ -173,8 +173,8 @@ NTSTATUS WINAPI NtOpenKey( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBU
 /******************************************************************************
  *              NtOpenKeyTransactedEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenKeyTransactedEx( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                                       ULONG options, HANDLE transaction )
+NTSTATUS SYSCALL NtOpenKeyTransactedEx( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                        ULONG options, HANDLE transaction )
 {
     FIXME( "(%p %x %p %x %p)\n", key, (int)access, attr, (int)options, transaction );
     return STATUS_NOT_IMPLEMENTED;
@@ -184,8 +184,8 @@ NTSTATUS WINAPI NtOpenKeyTransactedEx( HANDLE *key, ACCESS_MASK access, const OB
 /******************************************************************************
  *              NtOpenKeyTransacted  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenKeyTransacted( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                                     HANDLE transaction )
+NTSTATUS SYSCALL NtOpenKeyTransacted( HANDLE *key, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                      HANDLE transaction )
 {
     return NtOpenKeyTransactedEx( key, access, attr, 0, transaction );
 }
@@ -194,7 +194,7 @@ NTSTATUS WINAPI NtOpenKeyTransacted( HANDLE *key, ACCESS_MASK access, const OBJE
 /******************************************************************************
  *              NtDeleteKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtDeleteKey( HANDLE key )
+NTSTATUS SYSCALL NtDeleteKey( HANDLE key )
 {
     unsigned int ret;
@@ -213,7 +213,7 @@ NTSTATUS WINAPI NtDeleteKey( HANDLE key )
 /******************************************************************************
  *              NtRenameKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtRenameKey( HANDLE key, UNICODE_STRING *name )
+NTSTATUS SYSCALL NtRenameKey( HANDLE key, UNICODE_STRING *name )
 {
     unsigned int ret;
@@ -355,8 +355,8 @@ static NTSTATUS enumerate_key( HANDLE handle, int index, KEY_INFORMATION_CLASS i
 /******************************************************************************
  *              NtEnumerateKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtEnumerateKey( HANDLE handle, ULONG index, KEY_INFORMATION_CLASS info_class,
-                                void *info, DWORD length, DWORD *result_len )
+NTSTATUS SYSCALL NtEnumerateKey( HANDLE handle, ULONG index, KEY_INFORMATION_CLASS info_class,
+                                 void *info, DWORD length, DWORD *result_len )
 {
     /* -1 means query key, so avoid it here */
     if (index == (ULONG)-1) return STATUS_NO_MORE_ENTRIES;
@@ -367,8 +367,8 @@ NTSTATUS WINAPI NtEnumerateKey( HANDLE handle, ULONG index, KEY_INFORMATION_CLAS
 /******************************************************************************
  *              NtQueryKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryKey( HANDLE handle, KEY_INFORMATION_CLASS info_class,
-                            void *info, DWORD length, DWORD *result_len )
+NTSTATUS SYSCALL NtQueryKey( HANDLE handle, KEY_INFORMATION_CLASS info_class,
+                             void *info, DWORD length, DWORD *result_len )
 {
     return enumerate_key( handle, -1, info_class, info, length, result_len );
 }
@@ -377,7 +377,7 @@ NTSTATUS WINAPI NtQueryKey( HANDLE handle, KEY_INFORMATION_CLASS info_class,
 /******************************************************************************
  *              NtSetInformationKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationKey( HANDLE key, int class, void *info, ULONG length )
+NTSTATUS SYSCALL NtSetInformationKey( HANDLE key, int class, void *info, ULONG length )
 {
     FIXME( "(%p,0x%08x,%p,0x%08x) stub\n", key, class, info, (int)length );
     return STATUS_SUCCESS;
@@ -434,8 +434,8 @@ static void copy_key_value_info( KEY_VALUE_INFORMATION_CLASS info_class, void *i
 /******************************************************************************
  *              NtEnumerateValueKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtEnumerateValueKey( HANDLE handle, ULONG index, KEY_VALUE_INFORMATION_CLASS info_class,
-                                     void *info, DWORD length, DWORD *result_len )
+NTSTATUS SYSCALL NtEnumerateValueKey( HANDLE handle, ULONG index, KEY_VALUE_INFORMATION_CLASS info_class,
+                                      void *info, DWORD length, DWORD *result_len )
 {
     unsigned int ret;
     void *ptr;
@@ -477,9 +477,9 @@ NTSTATUS WINAPI NtEnumerateValueKey( HANDLE handle, ULONG index, KEY_VALUE_INFOR
 /******************************************************************************
  *              NtQueryValueKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryValueKey( HANDLE handle, const UNICODE_STRING *name,
-                                 KEY_VALUE_INFORMATION_CLASS info_class,
-                                 void *info, DWORD length, DWORD *result_len )
+NTSTATUS SYSCALL NtQueryValueKey( HANDLE handle, const UNICODE_STRING *name,
+                                  KEY_VALUE_INFORMATION_CLASS info_class,
+                                  void *info, DWORD length, DWORD *result_len )
 {
     unsigned int ret;
     UCHAR *data_ptr;
@@ -546,8 +546,8 @@ NTSTATUS WINAPI NtQueryValueKey( HANDLE handle, const UNICODE_STRING *name,
 /******************************************************************************
  *              NtQueryMultipleValueKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryMultipleValueKey( HANDLE key, KEY_MULTIPLE_VALUE_INFORMATION *info,
-                                         ULONG count, void *buffer, ULONG length, ULONG *retlen )
+NTSTATUS SYSCALL NtQueryMultipleValueKey( HANDLE key, KEY_MULTIPLE_VALUE_INFORMATION *info,
+                                          ULONG count, void *buffer, ULONG length, ULONG *retlen )
 {
     FIXME( "(%p,%p,0x%08x,%p,0x%08x,%p) stub!\n", key, info, (int)count, buffer, (int)length, retlen );
     return STATUS_SUCCESS;
@@ -557,8 +557,8 @@ NTSTATUS WINAPI NtQueryMultipleValueKey( HANDLE key, KEY_MULTIPLE_VALUE_INFORMAT
 /******************************************************************************
  *              NtSetValueKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetValueKey( HANDLE key, const UNICODE_STRING *name, ULONG index,
-                               ULONG type, const void *data, ULONG count )
+NTSTATUS SYSCALL NtSetValueKey( HANDLE key, const UNICODE_STRING *name, ULONG index,
+                                ULONG type, const void *data, ULONG count )
 {
     unsigned int ret;
@@ -583,7 +583,7 @@ NTSTATUS WINAPI NtSetValueKey( HANDLE key, const UNICODE_STRING *name, ULONG ind
 /******************************************************************************
  *              NtDeleteValueKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtDeleteValueKey( HANDLE key, const UNICODE_STRING *name )
+NTSTATUS SYSCALL NtDeleteValueKey( HANDLE key, const UNICODE_STRING *name )
 {
     unsigned int ret;
@@ -605,10 +605,10 @@ NTSTATUS WINAPI NtDeleteValueKey( HANDLE key, const UNICODE_STRING *name )
 /******************************************************************************
  *              NtNotifyChangeMultipleKeys  (NTDLL.@)
  */
-NTSTATUS WINAPI NtNotifyChangeMultipleKeys( HANDLE key, ULONG count, OBJECT_ATTRIBUTES *attr,
-                                            HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
-                                            IO_STATUS_BLOCK *io, ULONG filter, BOOLEAN subtree,
-                                            void *buffer, ULONG length, BOOLEAN async )
+NTSTATUS SYSCALL NtNotifyChangeMultipleKeys( HANDLE key, ULONG count, OBJECT_ATTRIBUTES *attr,
+                                             HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
+                                             IO_STATUS_BLOCK *io, ULONG filter, BOOLEAN subtree,
+                                             void *buffer, ULONG length, BOOLEAN async )
 {
     unsigned int ret;
@@ -649,9 +649,9 @@ NTSTATUS WINAPI NtNotifyChangeMultipleKeys( HANDLE key, ULONG count, OBJECT_ATTR
 /******************************************************************************
  *              NtNotifyChangeKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtNotifyChangeKey( HANDLE key, HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
-                                   IO_STATUS_BLOCK *io, ULONG filter, BOOLEAN subtree,
-                                   void *buffer, ULONG length, BOOLEAN async )
+NTSTATUS SYSCALL NtNotifyChangeKey( HANDLE key, HANDLE event, PIO_APC_ROUTINE apc, void *apc_context,
+                                    IO_STATUS_BLOCK *io, ULONG filter, BOOLEAN subtree,
+                                    void *buffer, ULONG length, BOOLEAN async )
 {
     return NtNotifyChangeMultipleKeys( key, 0, NULL, event, apc, apc_context,
                                        io, filter, subtree, buffer, length, async );
@@ -661,7 +661,7 @@ NTSTATUS WINAPI NtNotifyChangeKey( HANDLE key, HANDLE event, PIO_APC_ROUTINE apc
 /******************************************************************************
  *              NtFlushKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtFlushKey( HANDLE key )
+NTSTATUS SYSCALL NtFlushKey( HANDLE key )
 {
     unsigned int ret;
@@ -680,7 +680,7 @@ NTSTATUS WINAPI NtFlushKey( HANDLE key )
 /******************************************************************************
  *              NtLoadKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtLoadKey( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *file )
+NTSTATUS SYSCALL NtLoadKey( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *file )
 {
     TRACE( "(%p,%p)\n", attr, file );
     return NtLoadKeyEx( attr, file, 0, 0, 0, 0, NULL, NULL );
@@ -689,7 +689,7 @@ NTSTATUS WINAPI NtLoadKey( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *fil
 /******************************************************************************
  *              NtLoadKey2  (NTDLL.@)
  */
-NTSTATUS WINAPI NtLoadKey2( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *file, ULONG flags )
+NTSTATUS SYSCALL NtLoadKey2( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *file, ULONG flags )
 {
     return NtLoadKeyEx( attr, file, flags, 0, 0, 0, NULL, NULL );
 }
@@ -697,8 +697,8 @@ NTSTATUS WINAPI NtLoadKey2( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *fi
 /******************************************************************************
  *              NtLoadKeyEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtLoadKeyEx( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *file, ULONG flags, HANDLE trustkey,
-                             HANDLE event, ACCESS_MASK access, HANDLE *roothandle, IO_STATUS_BLOCK *iostatus )
+NTSTATUS SYSCALL NtLoadKeyEx( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *file, ULONG flags, HANDLE trustkey,
+                              HANDLE event, ACCESS_MASK access, HANDLE *roothandle, IO_STATUS_BLOCK *iostatus )
 {
     unsigned int ret;
     HANDLE key;
@@ -749,7 +749,7 @@ NTSTATUS WINAPI NtLoadKeyEx( const OBJECT_ATTRIBUTES *attr, OBJECT_ATTRIBUTES *f
 /******************************************************************************
  *              NtUnloadKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtUnloadKey( OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtUnloadKey( OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -774,7 +774,7 @@ NTSTATUS WINAPI NtUnloadKey( OBJECT_ATTRIBUTES *attr )
 /******************************************************************************
  *              NtSaveKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSaveKey( HANDLE key, HANDLE file )
+NTSTATUS SYSCALL NtSaveKey( HANDLE key, HANDLE file )
 {
     unsigned int ret;
@@ -794,7 +794,7 @@ NTSTATUS WINAPI NtSaveKey( HANDLE key, HANDLE file )
 /******************************************************************************
  *              NtRestoreKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtRestoreKey( HANDLE key, HANDLE file, ULONG flags )
+NTSTATUS SYSCALL NtRestoreKey( HANDLE key, HANDLE file, ULONG flags )
 {
     FIXME( "(%p,%p,0x%08x) stub\n", key, file, (int)flags );
     return STATUS_SUCCESS;
@@ -804,7 +804,7 @@ NTSTATUS WINAPI NtRestoreKey( HANDLE key, HANDLE file, ULONG flags )
 /******************************************************************************
  *              NtReplaceKey  (NTDLL.@)
  */
-NTSTATUS WINAPI NtReplaceKey( OBJECT_ATTRIBUTES *attr, HANDLE key, OBJECT_ATTRIBUTES *replace )
+NTSTATUS SYSCALL NtReplaceKey( OBJECT_ATTRIBUTES *attr, HANDLE key, OBJECT_ATTRIBUTES *replace )
 {
     FIXME( "(%s,%p,%s),stub!\n", debugstr_us(attr->ObjectName), key, debugstr_us(replace->ObjectName) );
     return STATUS_SUCCESS;
@@ -818,8 +818,8 @@ NTSTATUS WINAPI NtReplaceKey( OBJECT_ATTRIBUTES *attr, HANDLE key, OBJECT_ATTRIB
  *  unless there is some app which explicitly depends on that, there is
  *  no good reason to reproduce that.
  */
-NTSTATUS WINAPI NtQueryLicenseValue( const UNICODE_STRING *name, ULONG *type,
-                                     void *data, ULONG length, ULONG *retlen )
+NTSTATUS SYSCALL NtQueryLicenseValue( const UNICODE_STRING *name, ULONG *type,
+                                      void *data, ULONG length, ULONG *retlen )
 {
     static const WCHAR nameW[] = {'\','R','e','g','i','s','t','r','y','\',
                                   'M','a','c','h','i','n','e','\',
diff --git a/dlls/ntdll/unix/security.c b/dlls/ntdll/unix/security.c
index 35e5c6abf99..138bb0fd69f 100644
--- a/dlls/ntdll/unix/security.c
+++ b/dlls/ntdll/unix/security.c
@@ -40,7 +40,7 @@ WINE_DEFAULT_DEBUG_CHANNEL(ntdll);
 /***********************************************************************
  *             NtOpenProcessToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenProcessToken( HANDLE process, DWORD access, HANDLE *handle )
+NTSTATUS SYSCALL NtOpenProcessToken( HANDLE process, DWORD access, HANDLE *handle )
 {
     return NtOpenProcessTokenEx( process, access, 0, handle );
 }
@@ -49,7 +49,7 @@ NTSTATUS WINAPI NtOpenProcessToken( HANDLE process, DWORD access, HANDLE *handle
 /***********************************************************************
  *             NtOpenProcessTokenEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenProcessTokenEx( HANDLE process, DWORD access, DWORD attributes, HANDLE *handle )
+NTSTATUS SYSCALL NtOpenProcessTokenEx( HANDLE process, DWORD access, DWORD attributes, HANDLE *handle )
 {
     unsigned int ret;
@@ -74,7 +74,7 @@ NTSTATUS WINAPI NtOpenProcessTokenEx( HANDLE process, DWORD access, DWORD attrib
 /***********************************************************************
  *             NtOpenThreadToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenThreadToken( HANDLE thread, DWORD access, BOOLEAN self, HANDLE *handle )
+NTSTATUS SYSCALL NtOpenThreadToken( HANDLE thread, DWORD access, BOOLEAN self, HANDLE *handle )
 {
     return NtOpenThreadTokenEx( thread, access, self, 0, handle );
 }
@@ -83,8 +83,8 @@ NTSTATUS WINAPI NtOpenThreadToken( HANDLE thread, DWORD access, BOOLEAN self, HA
 /***********************************************************************
  *             NtOpenThreadTokenEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenThreadTokenEx( HANDLE thread, DWORD access, BOOLEAN self, DWORD attributes,
-                                     HANDLE *handle )
+NTSTATUS SYSCALL NtOpenThreadTokenEx( HANDLE thread, DWORD access, BOOLEAN self, DWORD attributes,
+                                      HANDLE *handle )
 {
     unsigned int ret;
@@ -110,8 +110,8 @@ NTSTATUS WINAPI NtOpenThreadTokenEx( HANDLE thread, DWORD access, BOOLEAN self,
 /***********************************************************************
  *             NtDuplicateToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtDuplicateToken( HANDLE token, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
-                                  SECURITY_IMPERSONATION_LEVEL level, TOKEN_TYPE type, HANDLE *handle )
+NTSTATUS SYSCALL NtDuplicateToken( HANDLE token, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
+                                   SECURITY_IMPERSONATION_LEVEL level, TOKEN_TYPE type, HANDLE *handle )
 {
     unsigned int status;
     data_size_t len;
@@ -148,8 +148,8 @@ NTSTATUS WINAPI NtDuplicateToken( HANDLE token, ACCESS_MASK access, OBJECT_ATTRI
 /***********************************************************************
  *             NtQueryInformationToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS class,
-                                         void *info, ULONG length, ULONG *retlen )
+NTSTATUS SYSCALL NtQueryInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS class,
+                                          void *info, ULONG length, ULONG *retlen )
 {
     static const ULONG info_len [] =
     {
@@ -489,8 +489,8 @@ NTSTATUS WINAPI NtQueryInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS c
 /***********************************************************************
  *             NtSetInformationToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS class,
-                                       void *info, ULONG length )
+NTSTATUS SYSCALL NtSetInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS class,
+                                        void *info, ULONG length )
 {
     unsigned int ret = STATUS_NOT_IMPLEMENTED;
@@ -554,9 +554,9 @@ NTSTATUS WINAPI NtSetInformationToken( HANDLE token, TOKEN_INFORMATION_CLASS cla
 /***********************************************************************
  *             NtCreateLowBoxToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateLowBoxToken( HANDLE *token_handle, HANDLE token, ACCESS_MASK access,
-                                     OBJECT_ATTRIBUTES *attr, SID *sid, ULONG count,
-                                     SID_AND_ATTRIBUTES *capabilities, ULONG handle_count, HANDLE *handle )
+NTSTATUS SYSCALL NtCreateLowBoxToken( HANDLE *token_handle, HANDLE token, ACCESS_MASK access,
+                                      OBJECT_ATTRIBUTES *attr, SID *sid, ULONG count,
+                                      SID_AND_ATTRIBUTES *capabilities, ULONG handle_count, HANDLE *handle )
 {
     FIXME("(%p, %p, %x, %p, %p, %u, %p, %u, %p): stub\n",
           token_handle, token, (int)access, attr, sid,
@@ -571,8 +571,8 @@ NTSTATUS WINAPI NtCreateLowBoxToken( HANDLE *token_handle, HANDLE token, ACCESS_
 /***********************************************************************
  *             NtAdjustGroupsToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtAdjustGroupsToken( HANDLE token, BOOLEAN reset, TOKEN_GROUPS *groups,
-                                     ULONG length, TOKEN_GROUPS *prev, ULONG *retlen )
+NTSTATUS SYSCALL NtAdjustGroupsToken( HANDLE token, BOOLEAN reset, TOKEN_GROUPS *groups,
+                                      ULONG length, TOKEN_GROUPS *prev, ULONG *retlen )
 {
     FIXME( "%p %d %p %u %p %p\n", token, reset, groups, (int)length, prev, retlen );
     return STATUS_NOT_IMPLEMENTED;
@@ -582,8 +582,8 @@ NTSTATUS WINAPI NtAdjustGroupsToken( HANDLE token, BOOLEAN reset, TOKEN_GROUPS *
 /***********************************************************************
  *             NtAdjustPrivilegesToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtAdjustPrivilegesToken( HANDLE token, BOOLEAN disable, TOKEN_PRIVILEGES *privs,
-                                         DWORD length, TOKEN_PRIVILEGES *prev, DWORD *retlen )
+NTSTATUS SYSCALL NtAdjustPrivilegesToken( HANDLE token, BOOLEAN disable, TOKEN_PRIVILEGES *privs,
+                                          DWORD length, TOKEN_PRIVILEGES *prev, DWORD *retlen )
 {
     unsigned int ret;
@@ -615,8 +615,8 @@ NTSTATUS WINAPI NtAdjustPrivilegesToken( HANDLE token, BOOLEAN disable, TOKEN_PR
 /***********************************************************************
  *             NtFilterToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtFilterToken( HANDLE token, ULONG flags, TOKEN_GROUPS *disable_sids,
-                               TOKEN_PRIVILEGES *privileges, TOKEN_GROUPS *restrict_sids, HANDLE *new_token )
+NTSTATUS SYSCALL NtFilterToken( HANDLE token, ULONG flags, TOKEN_GROUPS *disable_sids,
+                                TOKEN_PRIVILEGES *privileges, TOKEN_GROUPS *restrict_sids, HANDLE *new_token )
 {
     data_size_t privileges_len = 0;
     data_size_t sids_len = 0;
@@ -678,7 +678,7 @@ NTSTATUS WINAPI NtFilterToken( HANDLE token, ULONG flags, TOKEN_GROUPS *disable_
 /***********************************************************************
  *             NtPrivilegeCheck  (NTDLL.@)
  */
-NTSTATUS WINAPI NtPrivilegeCheck( HANDLE token, PRIVILEGE_SET *privs, BOOLEAN *res )
+NTSTATUS SYSCALL NtPrivilegeCheck( HANDLE token, PRIVILEGE_SET *privs, BOOLEAN *res )
 {
     unsigned int status;
@@ -699,7 +699,7 @@ NTSTATUS WINAPI NtPrivilegeCheck( HANDLE token, PRIVILEGE_SET *privs, BOOLEAN *r
 /***********************************************************************
  *             NtImpersonateAnonymousToken  (NTDLL.@)
  */
-NTSTATUS WINAPI NtImpersonateAnonymousToken( HANDLE thread )
+NTSTATUS SYSCALL NtImpersonateAnonymousToken( HANDLE thread )
 {
     FIXME( "(%p): stub\n", thread );
     return STATUS_NOT_IMPLEMENTED;
@@ -709,9 +709,9 @@ NTSTATUS WINAPI NtImpersonateAnonymousToken( HANDLE thread )
 /***********************************************************************
  *             NtAccessCheck  (NTDLL.@)
  */
-NTSTATUS WINAPI NtAccessCheck( PSECURITY_DESCRIPTOR descr, HANDLE token, ACCESS_MASK access,
-                               GENERIC_MAPPING *mapping, PRIVILEGE_SET *privs, ULONG *retlen,
-                               ULONG *access_granted, NTSTATUS *access_status)
+NTSTATUS SYSCALL NtAccessCheck( PSECURITY_DESCRIPTOR descr, HANDLE token, ACCESS_MASK access,
+                                GENERIC_MAPPING *mapping, PRIVILEGE_SET *privs, ULONG *retlen,
+                                ULONG *access_granted, NTSTATUS *access_status)
 {
     struct object_attributes *objattr;
     data_size_t len;
@@ -763,12 +763,12 @@ NTSTATUS WINAPI NtAccessCheck( PSECURITY_DESCRIPTOR descr, HANDLE token, ACCESS_
 /***********************************************************************
  *             NtAccessCheckAndAuditAlarm  (NTDLL.@)
  */
-NTSTATUS WINAPI NtAccessCheckAndAuditAlarm( UNICODE_STRING *subsystem, HANDLE handle,
-                                            UNICODE_STRING *typename, UNICODE_STRING *objectname,
-                                            PSECURITY_DESCRIPTOR descr, ACCESS_MASK access,
-                                            GENERIC_MAPPING *mapping, BOOLEAN creation,
-                                            ACCESS_MASK *access_granted, BOOLEAN *access_status,
-                                            BOOLEAN *onclose )
+NTSTATUS SYSCALL NtAccessCheckAndAuditAlarm( UNICODE_STRING *subsystem, HANDLE handle,
+                                             UNICODE_STRING *typename, UNICODE_STRING *objectname,
+                                             PSECURITY_DESCRIPTOR descr, ACCESS_MASK access,
+                                             GENERIC_MAPPING *mapping, BOOLEAN creation,
+                                             ACCESS_MASK *access_granted, BOOLEAN *access_status,
+                                             BOOLEAN *onclose )
 {
     FIXME( "(%s, %p, %s, %p, 0x%08x, %p, %d, %p, %p, %p), stub\n",
            debugstr_us(subsystem), handle, debugstr_us(typename), descr, (int)access,
@@ -780,8 +780,8 @@ NTSTATUS WINAPI NtAccessCheckAndAuditAlarm( UNICODE_STRING *subsystem, HANDLE ha
 /***********************************************************************
  *             NtQuerySecurityObject  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySecurityObject( HANDLE handle, SECURITY_INFORMATION info,
-                                       PSECURITY_DESCRIPTOR descr, ULONG length, ULONG *retlen )
+NTSTATUS SYSCALL NtQuerySecurityObject( HANDLE handle, SECURITY_INFORMATION info,
+                                        PSECURITY_DESCRIPTOR descr, ULONG length, ULONG *retlen )
 {
     SECURITY_DESCRIPTOR_RELATIVE *psd = descr;
     unsigned int status;
@@ -840,7 +840,7 @@ NTSTATUS WINAPI NtQuerySecurityObject( HANDLE handle, SECURITY_INFORMATION info,
 /***********************************************************************
  *             NtSetSecurityObject  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetSecurityObject( HANDLE handle, SECURITY_INFORMATION info, PSECURITY_DESCRIPTOR descr )
+NTSTATUS SYSCALL NtSetSecurityObject( HANDLE handle, SECURITY_INFORMATION info, PSECURITY_DESCRIPTOR descr )
 {
     struct object_attributes *objattr;
     struct security_descriptor *sd;
@@ -885,7 +885,7 @@ NTSTATUS WINAPI NtSetSecurityObject( HANDLE handle, SECURITY_INFORMATION info, P
 /***********************************************************************
  *             NtAllocateLocallyUniqueId  (NTDLL.@)
  */
-NTSTATUS WINAPI NtAllocateLocallyUniqueId( LUID *luid )
+NTSTATUS SYSCALL NtAllocateLocallyUniqueId( LUID *luid )
 {
     unsigned int status;
@@ -910,7 +910,7 @@ NTSTATUS WINAPI NtAllocateLocallyUniqueId( LUID *luid )
 /***********************************************************************
  *             NtAllocateUuids  (NTDLL.@)
  */
-NTSTATUS WINAPI NtAllocateUuids( ULARGE_INTEGER *time, ULONG *delta, ULONG *sequence, UCHAR *seed )
+NTSTATUS SYSCALL NtAllocateUuids( ULARGE_INTEGER *time, ULONG *delta, ULONG *sequence, UCHAR *seed )
 {
     FIXME( "(%p,%p,%p,%p), stub.\n", time, delta, sequence, seed );
     return STATUS_SUCCESS;
diff --git a/dlls/ntdll/unix/server.c b/dlls/ntdll/unix/server.c
index 75a766078cd..e659aa9a528 100644
--- a/dlls/ntdll/unix/server.c
+++ b/dlls/ntdll/unix/server.c
@@ -708,7 +708,7 @@ unsigned int server_wait( const select_op_t *select_op, data_size_t size, UINT f
 /***********************************************************************
  *              NtContinue  (NTDLL.@)
  */
-NTSTATUS WINAPI NtContinue( CONTEXT *context, BOOLEAN alertable )
+NTSTATUS SYSCALL NtContinue( CONTEXT *context, BOOLEAN alertable )
 {
     user_apc_t apc;
     NTSTATUS status;
@@ -725,7 +725,7 @@ NTSTATUS WINAPI NtContinue( CONTEXT *context, BOOLEAN alertable )
 /***********************************************************************
  *              NtTestAlert  (NTDLL.@)
  */
-NTSTATUS WINAPI NtTestAlert(void)
+NTSTATUS SYSCALL NtTestAlert(void)
 {
     user_apc_t apc;
     NTSTATUS status;
@@ -1647,8 +1647,8 @@ void server_init_thread( void *entry_point, BOOL *suspend )
 /******************************************************************************
  *           NtDuplicateObject
  */
-NTSTATUS WINAPI NtDuplicateObject( HANDLE source_process, HANDLE source, HANDLE dest_process, HANDLE *dest,
-                                   ACCESS_MASK access, ULONG attributes, ULONG options )
+NTSTATUS SYSCALL NtDuplicateObject( HANDLE source_process, HANDLE source, HANDLE dest_process, HANDLE *dest,
+                                    ACCESS_MASK access, ULONG attributes, ULONG options )
 {
     sigset_t sigset;
     unsigned int ret;
@@ -1709,7 +1709,7 @@ NTSTATUS WINAPI NtDuplicateObject( HANDLE source_process, HANDLE source, HANDLE
 /**************************************************************************
  *           NtCompareObjects   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCompareObjects( HANDLE first, HANDLE second )
+NTSTATUS SYSCALL NtCompareObjects( HANDLE first, HANDLE second )
 {
     unsigned int status;
@@ -1728,7 +1728,7 @@ NTSTATUS WINAPI NtCompareObjects( HANDLE first, HANDLE second )
 /**************************************************************************
  *           NtClose
  */
-NTSTATUS WINAPI NtClose( HANDLE handle )
+NTSTATUS SYSCALL NtClose( HANDLE handle )
 {
     sigset_t sigset;
     HANDLE port;
diff --git a/dlls/ntdll/unix/signal_arm.c b/dlls/ntdll/unix/signal_arm.c
index 9bdb2f6d6fb..fa17bcf1b4a 100644
--- a/dlls/ntdll/unix/signal_arm.c
+++ b/dlls/ntdll/unix/signal_arm.c
@@ -904,7 +904,7 @@ void *get_wow_context( CONTEXT *context )
  *              NtSetContextThread  (NTDLL.@)
  *              ZwSetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
+NTSTATUS SYSCALL NtSetContextThread( HANDLE handle, const CONTEXT *context )
 {
     NTSTATUS ret;
     struct syscall_frame *frame = arm_thread_data()->syscall_frame;
@@ -954,7 +954,7 @@ NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
  *              NtGetContextThread  (NTDLL.@)
  *              ZwGetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtGetContextThread( HANDLE handle, CONTEXT *context )
+NTSTATUS SYSCALL NtGetContextThread( HANDLE handle, CONTEXT *context )
 {
     struct syscall_frame *frame = arm_thread_data()->syscall_frame;
     DWORD needed_flags = context->ContextFlags & ~CONTEXT_ARM;
@@ -1239,7 +1239,7 @@ NTSTATUS WINAPI KeUserModeCallback( ULONG id, const void *args, ULONG len, void
 /***********************************************************************
  *           NtCallbackReturn  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
+NTSTATUS SYSCALL NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
 {
     if (!arm_thread_data()->syscall_frame->prev_frame) return STATUS_NO_CALLBACK_ACTIVE;
     user_mode_callback_return( ret_ptr, ret_len, status, NtCurrentTeb() );
@@ -1514,7 +1514,7 @@ NTSTATUS get_thread_ldt_entry( HANDLE handle, void *data, ULONG len, ULONG *ret_
  *           NtSetLdtEntries   (NTDLL.@)
  *           ZwSetLdtEntries   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
+NTSTATUS SYSCALL NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
 {
     return STATUS_NOT_IMPLEMENTED;
 }
diff --git a/dlls/ntdll/unix/signal_arm64.c b/dlls/ntdll/unix/signal_arm64.c
index 4483303decc..bc6fc660be5 100644
--- a/dlls/ntdll/unix/signal_arm64.c
+++ b/dlls/ntdll/unix/signal_arm64.c
@@ -598,7 +598,7 @@ void *get_wow_context( CONTEXT *context )
  *              NtSetContextThread  (NTDLL.@)
  *              ZwSetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
+NTSTATUS SYSCALL NtSetContextThread( HANDLE handle, const CONTEXT *context )
 {
     struct syscall_frame *frame = arm64_thread_data()->syscall_frame;
     NTSTATUS ret = STATUS_SUCCESS;
@@ -647,7 +647,7 @@ NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
  *              NtGetContextThread  (NTDLL.@)
  *              ZwGetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtGetContextThread( HANDLE handle, CONTEXT *context )
+NTSTATUS SYSCALL NtGetContextThread( HANDLE handle, CONTEXT *context )
 {
     struct syscall_frame *frame = arm64_thread_data()->syscall_frame;
     DWORD needed_flags = context->ContextFlags & ~CONTEXT_ARM64;
@@ -981,7 +981,7 @@ NTSTATUS WINAPI KeUserModeCallback( ULONG id, const void *args, ULONG len, void
 /***********************************************************************
  *           NtCallbackReturn  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
+NTSTATUS SYSCALL NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
 {
     if (!arm64_thread_data()->syscall_frame->prev_frame) return STATUS_NO_CALLBACK_ACTIVE;
     user_mode_callback_return( ret_ptr, ret_len, status, NtCurrentTeb() );
@@ -1310,7 +1310,7 @@ NTSTATUS get_thread_ldt_entry( HANDLE handle, void *data, ULONG len, ULONG *ret_
  *           NtSetLdtEntries   (NTDLL.@)
  *           ZwSetLdtEntries   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
+NTSTATUS SYSCALL NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
 {
     return STATUS_NOT_IMPLEMENTED;
 }
diff --git a/dlls/ntdll/unix/signal_i386.c b/dlls/ntdll/unix/signal_i386.c
index d665e281176..15422aff167 100644
--- a/dlls/ntdll/unix/signal_i386.c
+++ b/dlls/ntdll/unix/signal_i386.c
@@ -886,7 +886,7 @@ void *get_wow_context( CONTEXT *context )
  *              NtSetContextThread  (NTDLL.@)
  *              ZwSetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
+NTSTATUS SYSCALL NtSetContextThread( HANDLE handle, const CONTEXT *context )
 {
     NTSTATUS ret = STATUS_SUCCESS;
     struct syscall_frame *frame = x86_thread_data()->syscall_frame;
@@ -999,7 +999,7 @@ NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
  * Note: we use a small assembly wrapper to save the necessary registers
  *       in case we are fetching the context of the current thread.
  */
-NTSTATUS WINAPI NtGetContextThread( HANDLE handle, CONTEXT *context )
+NTSTATUS SYSCALL NtGetContextThread( HANDLE handle, CONTEXT *context )
 {
     struct syscall_frame *frame = x86_thread_data()->syscall_frame;
     DWORD needed_flags = context->ContextFlags & ~CONTEXT_i386;
@@ -1678,7 +1678,7 @@ NTSTATUS WINAPI KeUserModeCallback( ULONG id, const void *args, ULONG len, void
 /***********************************************************************
  *           NtCallbackReturn  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
+NTSTATUS SYSCALL NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
 {
     if (!x86_thread_data()->syscall_frame->prev_frame) return STATUS_NO_CALLBACK_ACTIVE;
     user_mode_callback_return( ret_ptr, ret_len, status, NtCurrentTeb() );
@@ -2278,7 +2278,7 @@ NTSTATUS get_thread_ldt_entry( HANDLE handle, void *data, ULONG len, ULONG *ret_
  *           NtSetLdtEntries   (NTDLL.@)
  *           ZwSetLdtEntries   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
+NTSTATUS SYSCALL NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
 {
     sigset_t sigset;
diff --git a/dlls/ntdll/unix/signal_x86_64.c b/dlls/ntdll/unix/signal_x86_64.c
index fa8660ca914..715190267af 100644
--- a/dlls/ntdll/unix/signal_x86_64.c
+++ b/dlls/ntdll/unix/signal_x86_64.c
@@ -967,7 +967,7 @@ void *get_wow_context( CONTEXT *context )
  *              NtSetContextThread  (NTDLL.@)
  *              ZwSetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
+NTSTATUS SYSCALL NtSetContextThread( HANDLE handle, const CONTEXT *context )
 {
     NTSTATUS ret = STATUS_SUCCESS;
     DWORD flags = context->ContextFlags & ~CONTEXT_AMD64;
@@ -1071,7 +1071,7 @@ NTSTATUS WINAPI NtSetContextThread( HANDLE handle, const CONTEXT *context )
  *              NtGetContextThread  (NTDLL.@)
  *              ZwGetContextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtGetContextThread( HANDLE handle, CONTEXT *context )
+NTSTATUS SYSCALL NtGetContextThread( HANDLE handle, CONTEXT *context )
 {
     struct syscall_frame *frame = amd64_thread_data()->syscall_frame;
     DWORD needed_flags = context->ContextFlags & ~CONTEXT_AMD64;
@@ -1730,7 +1730,7 @@ NTSTATUS WINAPI KeUserModeCallback( ULONG id, const void *args, ULONG len, void
 /***********************************************************************
  *           NtCallbackReturn  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
+NTSTATUS SYSCALL NtCallbackReturn( void *ret_ptr, ULONG ret_len, NTSTATUS status )
 {
     if (!amd64_thread_data()->syscall_frame->prev_frame) return STATUS_NO_CALLBACK_ACTIVE;
     user_mode_callback_return( ret_ptr, ret_len, status, NtCurrentTeb() );
@@ -2276,7 +2276,7 @@ NTSTATUS get_thread_ldt_entry( HANDLE handle, void *data, ULONG len, ULONG *ret_
  *           NtSetLdtEntries   (NTDLL.@)
  *           ZwSetLdtEntries   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
+NTSTATUS SYSCALL NtSetLdtEntries( ULONG sel1, LDT_ENTRY entry1, ULONG sel2, LDT_ENTRY entry2 )
 {
     return STATUS_NOT_IMPLEMENTED;
 }
diff --git a/dlls/ntdll/unix/sync.c b/dlls/ntdll/unix/sync.c
index a0905963562..95a62cbd100 100644
--- a/dlls/ntdll/unix/sync.c
+++ b/dlls/ntdll/unix/sync.c
@@ -262,8 +262,8 @@ static unsigned int validate_open_object_attributes( const OBJECT_ATTRIBUTES *at
 /******************************************************************************
  *              NtCreateSemaphore (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateSemaphore( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                                   LONG initial, LONG max )
+NTSTATUS SYSCALL NtCreateSemaphore( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                    LONG initial, LONG max )
 {
     unsigned int ret;
     data_size_t len;
@@ -292,7 +292,7 @@ NTSTATUS WINAPI NtCreateSemaphore( HANDLE *handle, ACCESS_MASK access, const OBJ
 /******************************************************************************
  *              NtOpenSemaphore (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenSemaphore( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenSemaphore( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -317,8 +317,8 @@ NTSTATUS WINAPI NtOpenSemaphore( HANDLE *handle, ACCESS_MASK access, const OBJEC
 /******************************************************************************
  *              NtQuerySemaphore (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySemaphore( HANDLE handle, SEMAPHORE_INFORMATION_CLASS class,
-                                  void *info, ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtQuerySemaphore( HANDLE handle, SEMAPHORE_INFORMATION_CLASS class,
+                                   void *info, ULONG len, ULONG *ret_len )
 {
     unsigned int ret;
     SEMAPHORE_BASIC_INFORMATION *out = info;
@@ -351,7 +351,7 @@ NTSTATUS WINAPI NtQuerySemaphore( HANDLE handle, SEMAPHORE_INFORMATION_CLASS cla
 /******************************************************************************
  *              NtReleaseSemaphore (NTDLL.@)
  */
-NTSTATUS WINAPI NtReleaseSemaphore( HANDLE handle, ULONG count, ULONG *previous )
+NTSTATUS SYSCALL NtReleaseSemaphore( HANDLE handle, ULONG count, ULONG *previous )
 {
     unsigned int ret;
@@ -372,8 +372,8 @@ NTSTATUS WINAPI NtReleaseSemaphore( HANDLE handle, ULONG count, ULONG *previous
 /**************************************************************************
  *              NtCreateEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                               EVENT_TYPE type, BOOLEAN state )
+NTSTATUS SYSCALL NtCreateEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                EVENT_TYPE type, BOOLEAN state )
 {
     unsigned int ret;
     data_size_t len;
@@ -402,7 +402,7 @@ NTSTATUS WINAPI NtCreateEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_
 /******************************************************************************
  *              NtOpenEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -427,7 +427,7 @@ NTSTATUS WINAPI NtOpenEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_AT
 /******************************************************************************
  *              NtSetEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetEvent( HANDLE handle, LONG *prev_state )
+NTSTATUS SYSCALL NtSetEvent( HANDLE handle, LONG *prev_state )
 {
     unsigned int ret;
@@ -446,7 +446,7 @@ NTSTATUS WINAPI NtSetEvent( HANDLE handle, LONG *prev_state )
 /******************************************************************************
  *              NtResetEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtResetEvent( HANDLE handle, LONG *prev_state )
+NTSTATUS SYSCALL NtResetEvent( HANDLE handle, LONG *prev_state )
 {
     unsigned int ret;
@@ -465,7 +465,7 @@ NTSTATUS WINAPI NtResetEvent( HANDLE handle, LONG *prev_state )
 /******************************************************************************
  *              NtClearEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtClearEvent( HANDLE handle )
+NTSTATUS SYSCALL NtClearEvent( HANDLE handle )
 {
     /* FIXME: same as NtResetEvent ??? */
     return NtResetEvent( handle, NULL );
@@ -475,7 +475,7 @@ NTSTATUS WINAPI NtClearEvent( HANDLE handle )
 /******************************************************************************
  *              NtPulseEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtPulseEvent( HANDLE handle, LONG *prev_state )
+NTSTATUS SYSCALL NtPulseEvent( HANDLE handle, LONG *prev_state )
 {
     unsigned int ret;
@@ -494,8 +494,8 @@ NTSTATUS WINAPI NtPulseEvent( HANDLE handle, LONG *prev_state )
 /******************************************************************************
  *              NtQueryEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryEvent( HANDLE handle, EVENT_INFORMATION_CLASS class,
-                              void *info, ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryEvent( HANDLE handle, EVENT_INFORMATION_CLASS class,
+                               void *info, ULONG len, ULONG *ret_len )
 {
     unsigned int ret;
     EVENT_BASIC_INFORMATION *out = info;
@@ -528,8 +528,8 @@ NTSTATUS WINAPI NtQueryEvent( HANDLE handle, EVENT_INFORMATION_CLASS class,
 /******************************************************************************
  *              NtCreateMutant (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateMutant( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                                BOOLEAN owned )
+NTSTATUS SYSCALL NtCreateMutant( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                 BOOLEAN owned )
 {
     unsigned int ret;
     data_size_t len;
@@ -556,7 +556,7 @@ NTSTATUS WINAPI NtCreateMutant( HANDLE *handle, ACCESS_MASK access, const OBJECT
 /**************************************************************************
  *              NtOpenMutant (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenMutant( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenMutant( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -581,7 +581,7 @@ NTSTATUS WINAPI NtOpenMutant( HANDLE *handle, ACCESS_MASK access, const OBJECT_A
 /**************************************************************************
  *              NtReleaseMutant (NTDLL.@)
  */
-NTSTATUS WINAPI NtReleaseMutant( HANDLE handle, LONG *prev_count )
+NTSTATUS SYSCALL NtReleaseMutant( HANDLE handle, LONG *prev_count )
 {
     unsigned int ret;
@@ -599,8 +599,8 @@ NTSTATUS WINAPI NtReleaseMutant( HANDLE handle, LONG *prev_count )
 /******************************************************************
  *              NtQueryMutant (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryMutant( HANDLE handle, MUTANT_INFORMATION_CLASS class,
-                               void *info, ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryMutant( HANDLE handle, MUTANT_INFORMATION_CLASS class,
+                                void *info, ULONG len, ULONG *ret_len )
 {
     unsigned int ret;
     MUTANT_BASIC_INFORMATION *out = info;
@@ -634,7 +634,7 @@ NTSTATUS WINAPI NtQueryMutant( HANDLE handle, MUTANT_INFORMATION_CLASS class,
 /**************************************************************************
  *		NtCreateJobObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateJobObject( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtCreateJobObject( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
     data_size_t len;
@@ -659,7 +659,7 @@ NTSTATUS WINAPI NtCreateJobObject( HANDLE *handle, ACCESS_MASK access, const OBJ
 /**************************************************************************
  *		NtOpenJobObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenJobObject( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenJobObject( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -684,7 +684,7 @@ NTSTATUS WINAPI NtOpenJobObject( HANDLE *handle, ACCESS_MASK access, const OBJEC
 /**************************************************************************
  *		NtTerminateJobObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtTerminateJobObject( HANDLE handle, NTSTATUS status )
+NTSTATUS SYSCALL NtTerminateJobObject( HANDLE handle, NTSTATUS status )
 {
     unsigned int ret;
@@ -705,8 +705,8 @@ NTSTATUS WINAPI NtTerminateJobObject( HANDLE handle, NTSTATUS status )
 /**************************************************************************
  *		NtQueryInformationJobObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInformationJobObject( HANDLE handle, JOBOBJECTINFOCLASS class, void *info,
-                                             ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryInformationJobObject( HANDLE handle, JOBOBJECTINFOCLASS class, void *info,
+                                              ULONG len, ULONG *ret_len )
 {
     unsigned int ret;
@@ -800,7 +800,7 @@ NTSTATUS WINAPI NtQueryInformationJobObject( HANDLE handle, JOBOBJECTINFOCLASS c
 /**************************************************************************
  *		NtSetInformationJobObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationJobObject( HANDLE handle, JOBOBJECTINFOCLASS class, void *info, ULONG len )
+NTSTATUS SYSCALL NtSetInformationJobObject( HANDLE handle, JOBOBJECTINFOCLASS class, void *info, ULONG len )
 {
     unsigned int status = STATUS_NOT_IMPLEMENTED;
     JOBOBJECT_BASIC_LIMIT_INFORMATION *basic_limit;
@@ -855,7 +855,7 @@ NTSTATUS WINAPI NtSetInformationJobObject( HANDLE handle, JOBOBJECTINFOCLASS cla
 /**************************************************************************
  *		NtIsProcessInJob (NTDLL.@)
  */
-NTSTATUS WINAPI NtIsProcessInJob( HANDLE process, HANDLE job )
+NTSTATUS SYSCALL NtIsProcessInJob( HANDLE process, HANDLE job )
 {
     unsigned int status;
@@ -875,7 +875,7 @@ NTSTATUS WINAPI NtIsProcessInJob( HANDLE process, HANDLE job )
 /**************************************************************************
  *		NtAssignProcessToJobObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtAssignProcessToJobObject( HANDLE job, HANDLE process )
+NTSTATUS SYSCALL NtAssignProcessToJobObject( HANDLE job, HANDLE process )
 {
     unsigned int status;
@@ -895,8 +895,8 @@ NTSTATUS WINAPI NtAssignProcessToJobObject( HANDLE job, HANDLE process )
 /**********************************************************************
  *           NtCreateDebugObject  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateDebugObject( HANDLE *handle, ACCESS_MASK access,
-                                     OBJECT_ATTRIBUTES *attr, ULONG flags )
+NTSTATUS SYSCALL NtCreateDebugObject( HANDLE *handle, ACCESS_MASK access,
+                                      OBJECT_ATTRIBUTES *attr, ULONG flags )
 {
     unsigned int ret;
     data_size_t len;
@@ -923,8 +923,8 @@ NTSTATUS WINAPI NtCreateDebugObject( HANDLE *handle, ACCESS_MASK access,
 /**********************************************************************
  *           NtSetInformationDebugObject  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationDebugObject( HANDLE handle, DEBUGOBJECTINFOCLASS class,
-                                             void *info, ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtSetInformationDebugObject( HANDLE handle, DEBUGOBJECTINFOCLASS class,
+                                              void *info, ULONG len, ULONG *ret_len )
 {
     unsigned int ret;
     ULONG flags;
@@ -1020,8 +1020,8 @@ static NTSTATUS event_data_to_state_change( const debug_event_t *data, DBGUI_WAI
 /**********************************************************************
  *           NtWaitForDebugEvent  (NTDLL.@)
  */
-NTSTATUS WINAPI NtWaitForDebugEvent( HANDLE handle, BOOLEAN alertable, LARGE_INTEGER *timeout,
-                                     DBGUI_WAIT_STATE_CHANGE *state )
+NTSTATUS SYSCALL NtWaitForDebugEvent( HANDLE handle, BOOLEAN alertable, LARGE_INTEGER *timeout,
+                                      DBGUI_WAIT_STATE_CHANGE *state )
 {
     debug_event_t data;
     unsigned int ret;
@@ -1055,7 +1055,7 @@ NTSTATUS WINAPI NtWaitForDebugEvent( HANDLE handle, BOOLEAN alertable, LARGE_INT
 /**************************************************************************
  *           NtCreateDirectoryObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateDirectoryObject( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtCreateDirectoryObject( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
     data_size_t len;
@@ -1080,7 +1080,7 @@ NTSTATUS WINAPI NtCreateDirectoryObject( HANDLE *handle, ACCESS_MASK access, OBJ
 /**************************************************************************
  *           NtOpenDirectoryObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenDirectoryObject( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenDirectoryObject( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -1105,9 +1105,9 @@ NTSTATUS WINAPI NtOpenDirectoryObject( HANDLE *handle, ACCESS_MASK access, const
 /**************************************************************************
  *           NtQueryDirectoryObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryDirectoryObject( HANDLE handle, DIRECTORY_BASIC_INFORMATION *buffer,
-                                        ULONG size, BOOLEAN single_entry, BOOLEAN restart,
-                                        ULONG *context, ULONG *ret_size )
+NTSTATUS SYSCALL NtQueryDirectoryObject( HANDLE handle, DIRECTORY_BASIC_INFORMATION *buffer,
+                                         ULONG size, BOOLEAN single_entry, BOOLEAN restart,
+                                         ULONG *context, ULONG *ret_size )
 {
     ULONG index = restart ? 0 : *context;
     unsigned int ret;
@@ -1162,8 +1162,8 @@ NTSTATUS WINAPI NtQueryDirectoryObject( HANDLE handle, DIRECTORY_BASIC_INFORMATI
 /**************************************************************************
  *           NtCreateSymbolicLinkObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateSymbolicLinkObject( HANDLE *handle, ACCESS_MASK access,
-                                            OBJECT_ATTRIBUTES *attr, UNICODE_STRING *target )
+NTSTATUS SYSCALL NtCreateSymbolicLinkObject( HANDLE *handle, ACCESS_MASK access,
+                                             OBJECT_ATTRIBUTES *attr, UNICODE_STRING *target )
 {
     unsigned int ret;
     data_size_t len;
@@ -1191,8 +1191,8 @@ NTSTATUS WINAPI NtCreateSymbolicLinkObject( HANDLE *handle, ACCESS_MASK access,
 /**************************************************************************
  *           NtOpenSymbolicLinkObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenSymbolicLinkObject( HANDLE *handle, ACCESS_MASK access,
-                                          const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenSymbolicLinkObject( HANDLE *handle, ACCESS_MASK access,
+                                           const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -1217,7 +1217,7 @@ NTSTATUS WINAPI NtOpenSymbolicLinkObject( HANDLE *handle, ACCESS_MASK access,
 /**************************************************************************
  *           NtQuerySymbolicLinkObject   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySymbolicLinkObject( HANDLE handle, UNICODE_STRING *target, ULONG *length )
+NTSTATUS SYSCALL NtQuerySymbolicLinkObject( HANDLE handle, UNICODE_STRING *target, ULONG *length )
 {
     unsigned int ret;
@@ -1244,7 +1244,7 @@ NTSTATUS WINAPI NtQuerySymbolicLinkObject( HANDLE handle, UNICODE_STRING *target
 /**************************************************************************
  *		NtMakeTemporaryObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtMakeTemporaryObject( HANDLE handle )
+NTSTATUS SYSCALL NtMakeTemporaryObject( HANDLE handle )
 {
     unsigned int ret;
@@ -1263,8 +1263,8 @@ NTSTATUS WINAPI NtMakeTemporaryObject( HANDLE handle )
 /**************************************************************************
  *		NtCreateTimer (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateTimer( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                               TIMER_TYPE type )
+NTSTATUS SYSCALL NtCreateTimer( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                TIMER_TYPE type )
 {
     unsigned int ret;
     data_size_t len;
@@ -1293,7 +1293,7 @@ NTSTATUS WINAPI NtCreateTimer( HANDLE *handle, ACCESS_MASK access, const OBJECT_
 /**************************************************************************
  *		NtOpenTimer (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenTimer( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenTimer( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -1318,8 +1318,8 @@ NTSTATUS WINAPI NtOpenTimer( HANDLE *handle, ACCESS_MASK access, const OBJECT_AT
 /**************************************************************************
  *		NtSetTimer (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetTimer( HANDLE handle, const LARGE_INTEGER *when, PTIMER_APC_ROUTINE callback,
-                            void *arg, BOOLEAN resume, ULONG period, BOOLEAN *state )
+NTSTATUS SYSCALL NtSetTimer( HANDLE handle, const LARGE_INTEGER *when, PTIMER_APC_ROUTINE callback,
+                             void *arg, BOOLEAN resume, ULONG period, BOOLEAN *state )
 {
     unsigned int ret = STATUS_SUCCESS;
@@ -1346,7 +1346,7 @@ NTSTATUS WINAPI NtSetTimer( HANDLE handle, const LARGE_INTEGER *when, PTIMER_APC
 /**************************************************************************
  *		NtCancelTimer (NTDLL.@)
  */
-NTSTATUS WINAPI NtCancelTimer( HANDLE handle, BOOLEAN *state )
+NTSTATUS SYSCALL NtCancelTimer( HANDLE handle, BOOLEAN *state )
 {
     unsigned int ret;
@@ -1364,8 +1364,8 @@ NTSTATUS WINAPI NtCancelTimer( HANDLE handle, BOOLEAN *state )
 /******************************************************************************
  *		NtQueryTimer (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryTimer( HANDLE handle, TIMER_INFORMATION_CLASS class,
-                              void *info, ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryTimer( HANDLE handle, TIMER_INFORMATION_CLASS class,
+                               void *info, ULONG len, ULONG *ret_len )
 {
     TIMER_BASIC_INFORMATION *basic_info = info;
     unsigned int ret;
@@ -1413,8 +1413,8 @@ NTSTATUS WINAPI NtQueryTimer( HANDLE handle, TIMER_INFORMATION_CLASS class,
 /******************************************************************
  *		NtWaitForMultipleObjects (NTDLL.@)
  */
-NTSTATUS WINAPI NtWaitForMultipleObjects( DWORD count, const HANDLE *handles, BOOLEAN wait_any,
-                                          BOOLEAN alertable, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtWaitForMultipleObjects( DWORD count, const HANDLE *handles, BOOLEAN wait_any,
+                                           BOOLEAN alertable, const LARGE_INTEGER *timeout )
 {
     select_op_t select_op;
     UINT i, flags = SELECT_INTERRUPTIBLE;
@@ -1431,7 +1431,7 @@ NTSTATUS WINAPI NtWaitForMultipleObjects( DWORD count, const HANDLE *handles, BO
 /******************************************************************
  *		NtWaitForSingleObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtWaitForSingleObject( HANDLE handle, BOOLEAN alertable, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtWaitForSingleObject( HANDLE handle, BOOLEAN alertable, const LARGE_INTEGER *timeout )
 {
     return NtWaitForMultipleObjects( 1, &handle, FALSE, alertable, timeout );
 }
@@ -1440,8 +1440,8 @@ NTSTATUS WINAPI NtWaitForSingleObject( HANDLE handle, BOOLEAN alertable, const L
 /******************************************************************
  *		NtSignalAndWaitForSingleObject (NTDLL.@)
  */
-NTSTATUS WINAPI NtSignalAndWaitForSingleObject( HANDLE signal, HANDLE wait,
-                                                BOOLEAN alertable, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtSignalAndWaitForSingleObject( HANDLE signal, HANDLE wait,
+                                                 BOOLEAN alertable, const LARGE_INTEGER *timeout )
 {
     select_op_t select_op;
     UINT flags = SELECT_INTERRUPTIBLE;
@@ -1459,7 +1459,7 @@ NTSTATUS WINAPI NtSignalAndWaitForSingleObject( HANDLE signal, HANDLE wait,
 /******************************************************************
  *		NtYieldExecution (NTDLL.@)
  */
-NTSTATUS WINAPI NtYieldExecution(void)
+NTSTATUS SYSCALL NtYieldExecution(void)
 {
 #ifdef HAVE_SCHED_YIELD
     sched_yield();
@@ -1473,7 +1473,7 @@ NTSTATUS WINAPI NtYieldExecution(void)
 /******************************************************************
  *		NtDelayExecution (NTDLL.@)
  */
-NTSTATUS WINAPI NtDelayExecution( BOOLEAN alertable, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtDelayExecution( BOOLEAN alertable, const LARGE_INTEGER *timeout )
 {
     /* if alertable, we need to query the server */
     if (alertable) return server_wait( NULL, 0, SELECT_INTERRUPTIBLE | SELECT_ALERTABLE, timeout );
@@ -1515,7 +1515,7 @@ NTSTATUS WINAPI NtDelayExecution( BOOLEAN alertable, const LARGE_INTEGER *timeou
 /******************************************************************************
  *              NtQueryPerformanceCounter (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryPerformanceCounter( LARGE_INTEGER *counter, LARGE_INTEGER *frequency )
+NTSTATUS SYSCALL NtQueryPerformanceCounter( LARGE_INTEGER *counter, LARGE_INTEGER *frequency )
 {
     counter->QuadPart = monotonic_counter();
     if (frequency) frequency->QuadPart = TICKSPERSEC;
@@ -1526,7 +1526,7 @@ NTSTATUS WINAPI NtQueryPerformanceCounter( LARGE_INTEGER *counter, LARGE_INTEGER
 /***********************************************************************
  *              NtQuerySystemTime (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySystemTime( LARGE_INTEGER *time )
+NTSTATUS SYSCALL NtQuerySystemTime( LARGE_INTEGER *time )
 {
 #ifdef HAVE_CLOCK_GETTIME
     struct timespec ts;
@@ -1564,7 +1564,7 @@ NTSTATUS WINAPI NtQuerySystemTime( LARGE_INTEGER *time )
 /***********************************************************************
  *              NtSetSystemTime (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetSystemTime( const LARGE_INTEGER *new, LARGE_INTEGER *old )
+NTSTATUS SYSCALL NtSetSystemTime( const LARGE_INTEGER *new, LARGE_INTEGER *old )
 {
     LARGE_INTEGER now;
     LONGLONG diff;
@@ -1581,7 +1581,7 @@ NTSTATUS WINAPI NtSetSystemTime( const LARGE_INTEGER *new, LARGE_INTEGER *old )
 /***********************************************************************
  *              NtQueryTimerResolution (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryTimerResolution( ULONG *min_res, ULONG *max_res, ULONG *current_res )
+NTSTATUS SYSCALL NtQueryTimerResolution( ULONG *min_res, ULONG *max_res, ULONG *current_res )
 {
     TRACE( "(%p,%p,%p)\n", min_res, max_res, current_res );
     *max_res = *current_res = 10000; /* See NtSetTimerResolution() */
@@ -1593,7 +1593,7 @@ NTSTATUS WINAPI NtQueryTimerResolution( ULONG *min_res, ULONG *max_res, ULONG *c
 /***********************************************************************
  *              NtSetTimerResolution (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetTimerResolution( ULONG res, BOOLEAN set, ULONG *current_res )
+NTSTATUS SYSCALL NtSetTimerResolution( ULONG res, BOOLEAN set, ULONG *current_res )
 {
     static BOOL has_request = FALSE;
@@ -1621,7 +1621,7 @@ NTSTATUS WINAPI NtSetTimerResolution( ULONG res, BOOLEAN set, ULONG *current_res
 /******************************************************************************
  *              NtSetIntervalProfile (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetIntervalProfile( ULONG interval, KPROFILE_SOURCE source )
+NTSTATUS SYSCALL NtSetIntervalProfile( ULONG interval, KPROFILE_SOURCE source )
 {
     FIXME( "%u,%d\n", (int)interval, source );
     return STATUS_SUCCESS;
@@ -1663,8 +1663,8 @@ NTSTATUS system_time_precise( void *args )
 /******************************************************************************
  *              NtCreateKeyedEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateKeyedEvent( HANDLE *handle, ACCESS_MASK access,
-                                    const OBJECT_ATTRIBUTES *attr, ULONG flags )
+NTSTATUS SYSCALL NtCreateKeyedEvent( HANDLE *handle, ACCESS_MASK access,
+                                     const OBJECT_ATTRIBUTES *attr, ULONG flags )
 {
     unsigned int ret;
     data_size_t len;
@@ -1690,7 +1690,7 @@ NTSTATUS WINAPI NtCreateKeyedEvent( HANDLE *handle, ACCESS_MASK access,
 /******************************************************************************
  *              NtOpenKeyedEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenKeyedEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenKeyedEvent( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -1714,8 +1714,8 @@ NTSTATUS WINAPI NtOpenKeyedEvent( HANDLE *handle, ACCESS_MASK access, const OBJE
 /******************************************************************************
  *              NtWaitForKeyedEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtWaitForKeyedEvent( HANDLE handle, const void *key,
-                                     BOOLEAN alertable, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtWaitForKeyedEvent( HANDLE handle, const void *key,
+                                      BOOLEAN alertable, const LARGE_INTEGER *timeout )
 {
     select_op_t select_op;
     UINT flags = SELECT_INTERRUPTIBLE;
@@ -1733,8 +1733,8 @@ NTSTATUS WINAPI NtWaitForKeyedEvent( HANDLE handle, const void *key,
 /******************************************************************************
  *              NtReleaseKeyedEvent (NTDLL.@)
  */
-NTSTATUS WINAPI NtReleaseKeyedEvent( HANDLE handle, const void *key,
-                                     BOOLEAN alertable, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtReleaseKeyedEvent( HANDLE handle, const void *key,
+                                      BOOLEAN alertable, const LARGE_INTEGER *timeout )
 {
     select_op_t select_op;
     UINT flags = SELECT_INTERRUPTIBLE;
@@ -1752,8 +1752,8 @@ NTSTATUS WINAPI NtReleaseKeyedEvent( HANDLE handle, const void *key,
 /***********************************************************************
  *             NtCreateIoCompletion (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateIoCompletion( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
-                                      ULONG threads )
+NTSTATUS SYSCALL NtCreateIoCompletion( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
+                                       ULONG threads )
 {
     unsigned int status;
     data_size_t len;
@@ -1781,7 +1781,7 @@ NTSTATUS WINAPI NtCreateIoCompletion( HANDLE *handle, ACCESS_MASK access, OBJECT
 /***********************************************************************
  *             NtOpenIoCompletion (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenIoCompletion( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenIoCompletion( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int status;
@@ -1806,8 +1806,8 @@ NTSTATUS WINAPI NtOpenIoCompletion( HANDLE *handle, ACCESS_MASK access, const OB
 /***********************************************************************
  *             NtSetIoCompletion (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetIoCompletion( HANDLE handle, ULONG_PTR key, ULONG_PTR value,
-                                   NTSTATUS status, SIZE_T count )
+NTSTATUS SYSCALL NtSetIoCompletion( HANDLE handle, ULONG_PTR key, ULONG_PTR value,
+                                    NTSTATUS status, SIZE_T count )
 {
     unsigned int ret;
@@ -1830,8 +1830,8 @@ NTSTATUS WINAPI NtSetIoCompletion( HANDLE handle, ULONG_PTR key, ULONG_PTR value
 /***********************************************************************
  *             NtRemoveIoCompletion (NTDLL.@)
  */
-NTSTATUS WINAPI NtRemoveIoCompletion( HANDLE handle, ULONG_PTR *key, ULONG_PTR *value,
-                                      IO_STATUS_BLOCK *io, LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtRemoveIoCompletion( HANDLE handle, ULONG_PTR *key, ULONG_PTR *value,
+                                       IO_STATUS_BLOCK *io, LARGE_INTEGER *timeout )
 {
     unsigned int status;
@@ -1861,8 +1861,8 @@ NTSTATUS WINAPI NtRemoveIoCompletion( HANDLE handle, ULONG_PTR *key, ULONG_PTR *
 /***********************************************************************
  *             NtRemoveIoCompletionEx (NTDLL.@)
  */
-NTSTATUS WINAPI NtRemoveIoCompletionEx( HANDLE handle, FILE_IO_COMPLETION_INFORMATION *info, ULONG count,
-                                        ULONG *written, LARGE_INTEGER *timeout, BOOLEAN alertable )
+NTSTATUS SYSCALL NtRemoveIoCompletionEx( HANDLE handle, FILE_IO_COMPLETION_INFORMATION *info, ULONG count,
+                                         ULONG *written, LARGE_INTEGER *timeout, BOOLEAN alertable )
 {
     unsigned int status;
     ULONG i = 0;
@@ -1904,8 +1904,8 @@ NTSTATUS WINAPI NtRemoveIoCompletionEx( HANDLE handle, FILE_IO_COMPLETION_INFORM
 /***********************************************************************
  *             NtQueryIoCompletion (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryIoCompletion( HANDLE handle, IO_COMPLETION_INFORMATION_CLASS class,
-                                     void *buffer, ULONG len, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryIoCompletion( HANDLE handle, IO_COMPLETION_INFORMATION_CLASS class,
+                                      void *buffer, ULONG len, ULONG *ret_len )
 {
     unsigned int status;
@@ -1941,9 +1941,9 @@ NTSTATUS WINAPI NtQueryIoCompletion( HANDLE handle, IO_COMPLETION_INFORMATION_CL
 /***********************************************************************
  *             NtCreateSection (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateSection( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
-                                 const LARGE_INTEGER *size, ULONG protect,
-                                 ULONG sec_flags, HANDLE file )
+NTSTATUS SYSCALL NtCreateSection( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr,
+                                  const LARGE_INTEGER *size, ULONG protect,
+                                  ULONG sec_flags, HANDLE file )
 {
     unsigned int ret;
     unsigned int file_access;
@@ -1996,7 +1996,7 @@ NTSTATUS WINAPI NtCreateSection( HANDLE *handle, ACCESS_MASK access, const OBJEC
 /***********************************************************************
  *             NtOpenSection (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenSection( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
+NTSTATUS SYSCALL NtOpenSection( HANDLE *handle, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr )
 {
     unsigned int ret;
@@ -2021,8 +2021,8 @@ NTSTATUS WINAPI NtOpenSection( HANDLE *handle, ACCESS_MASK access, const OBJECT_
 /***********************************************************************
  *             NtCreatePort (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreatePort( HANDLE *handle, OBJECT_ATTRIBUTES *attr, ULONG info_len,
-                              ULONG data_len, ULONG *reserved )
+NTSTATUS SYSCALL NtCreatePort( HANDLE *handle, OBJECT_ATTRIBUTES *attr, ULONG info_len,
+                               ULONG data_len, ULONG *reserved )
 {
     FIXME( "(%p,%p,%u,%u,%p),stub!\n", handle, attr, (int)info_len, (int)data_len, reserved );
     return STATUS_NOT_IMPLEMENTED;
@@ -2032,9 +2032,9 @@ NTSTATUS WINAPI NtCreatePort( HANDLE *handle, OBJECT_ATTRIBUTES *attr, ULONG inf
 /***********************************************************************
  *             NtConnectPort (NTDLL.@)
  */
-NTSTATUS WINAPI NtConnectPort( HANDLE *handle, UNICODE_STRING *name, SECURITY_QUALITY_OF_SERVICE *qos,
-                               LPC_SECTION_WRITE *write, LPC_SECTION_READ *read, ULONG *max_len,
-                               void *info, ULONG *info_len )
+NTSTATUS SYSCALL NtConnectPort( HANDLE *handle, UNICODE_STRING *name, SECURITY_QUALITY_OF_SERVICE *qos,
+                                LPC_SECTION_WRITE *write, LPC_SECTION_READ *read, ULONG *max_len,
+                                void *info, ULONG *info_len )
 {
     FIXME( "(%p,%s,%p,%p,%p,%p,%p,%p),stub!\n", handle, debugstr_us(name), qos,
            write, read, max_len, info, info_len );
@@ -2046,9 +2046,9 @@ NTSTATUS WINAPI NtConnectPort( HANDLE *handle, UNICODE_STRING *name, SECURITY_QU
 /***********************************************************************
  *             NtSecureConnectPort (NTDLL.@)
  */
-NTSTATUS WINAPI NtSecureConnectPort( HANDLE *handle, UNICODE_STRING *name, SECURITY_QUALITY_OF_SERVICE *qos,
-                                     LPC_SECTION_WRITE *write, PSID sid, LPC_SECTION_READ *read,
-                                     ULONG *max_len, void *info, ULONG *info_len )
+NTSTATUS SYSCALL NtSecureConnectPort( HANDLE *handle, UNICODE_STRING *name, SECURITY_QUALITY_OF_SERVICE *qos,
+                                      LPC_SECTION_WRITE *write, PSID sid, LPC_SECTION_READ *read,
+                                      ULONG *max_len, void *info, ULONG *info_len )
 {
     FIXME( "(%p,%s,%p,%p,%p,%p,%p,%p,%p),stub!\n", handle, debugstr_us(name), qos,
            write, sid, read, max_len, info, info_len );
@@ -2059,7 +2059,7 @@ NTSTATUS WINAPI NtSecureConnectPort( HANDLE *handle, UNICODE_STRING *name, SECUR
 /***********************************************************************
  *             NtListenPort (NTDLL.@)
  */
-NTSTATUS WINAPI NtListenPort( HANDLE handle, LPC_MESSAGE *msg )
+NTSTATUS SYSCALL NtListenPort( HANDLE handle, LPC_MESSAGE *msg )
 {
     FIXME("(%p,%p),stub!\n", handle, msg );
     return STATUS_NOT_IMPLEMENTED;
@@ -2069,8 +2069,8 @@ NTSTATUS WINAPI NtListenPort( HANDLE handle, LPC_MESSAGE *msg )
 /***********************************************************************
  *             NtAcceptConnectPort (NTDLL.@)
  */
-NTSTATUS WINAPI NtAcceptConnectPort( HANDLE *handle, ULONG id, LPC_MESSAGE *msg, BOOLEAN accept,
-                                     LPC_SECTION_WRITE *write, LPC_SECTION_READ *read )
+NTSTATUS SYSCALL NtAcceptConnectPort( HANDLE *handle, ULONG id, LPC_MESSAGE *msg, BOOLEAN accept,
+                                      LPC_SECTION_WRITE *write, LPC_SECTION_READ *read )
 {
     FIXME("(%p,%u,%p,%d,%p,%p),stub!\n", handle, (int)id, msg, accept, write, read );
     return STATUS_NOT_IMPLEMENTED;
@@ -2080,7 +2080,7 @@ NTSTATUS WINAPI NtAcceptConnectPort( HANDLE *handle, ULONG id, LPC_MESSAGE *msg,
 /***********************************************************************
  *             NtCompleteConnectPort (NTDLL.@)
  */
-NTSTATUS WINAPI NtCompleteConnectPort( HANDLE handle )
+NTSTATUS SYSCALL NtCompleteConnectPort( HANDLE handle )
 {
     FIXME( "(%p),stub!\n", handle );
     return STATUS_NOT_IMPLEMENTED;
@@ -2090,7 +2090,7 @@ NTSTATUS WINAPI NtCompleteConnectPort( HANDLE handle )
 /***********************************************************************
  *             NtRegisterThreadTerminatePort (NTDLL.@)
  */
-NTSTATUS WINAPI NtRegisterThreadTerminatePort( HANDLE handle )
+NTSTATUS SYSCALL NtRegisterThreadTerminatePort( HANDLE handle )
 {
     FIXME( "(%p),stub!\n", handle );
     return STATUS_NOT_IMPLEMENTED;
@@ -2100,7 +2100,7 @@ NTSTATUS WINAPI NtRegisterThreadTerminatePort( HANDLE handle )
 /***********************************************************************
  *             NtRequestWaitReplyPort (NTDLL.@)
  */
-NTSTATUS WINAPI NtRequestWaitReplyPort( HANDLE handle, LPC_MESSAGE *msg_in, LPC_MESSAGE *msg_out )
+NTSTATUS SYSCALL NtRequestWaitReplyPort( HANDLE handle, LPC_MESSAGE *msg_in, LPC_MESSAGE *msg_out )
 {
     FIXME( "(%p,%p,%p),stub!\n", handle, msg_in, msg_out );
     if (msg_in)
@@ -2115,7 +2115,7 @@ NTSTATUS WINAPI NtRequestWaitReplyPort( HANDLE handle, LPC_MESSAGE *msg_in, LPC_
 /***********************************************************************
  *             NtReplyWaitReceivePort (NTDLL.@)
  */
-NTSTATUS WINAPI NtReplyWaitReceivePort( HANDLE handle, ULONG *id, LPC_MESSAGE *reply, LPC_MESSAGE *msg )
+NTSTATUS SYSCALL NtReplyWaitReceivePort( HANDLE handle, ULONG *id, LPC_MESSAGE *reply, LPC_MESSAGE *msg )
 {
     FIXME("(%p,%p,%p,%p),stub!\n", handle, id, reply, msg );
     return STATUS_NOT_IMPLEMENTED;
@@ -2172,7 +2172,7 @@ static ULONG integral_atom_name( WCHAR *buffer, ULONG len, RTL_ATOM atom )
 /***********************************************************************
  *             NtAddAtom (NTDLL.@)
  */
-NTSTATUS WINAPI NtAddAtom( const WCHAR *name, ULONG length, RTL_ATOM *atom )
+NTSTATUS SYSCALL NtAddAtom( const WCHAR *name, ULONG length, RTL_ATOM *atom )
 {
     unsigned int status = is_integral_atom( name, length / sizeof(WCHAR), atom );
@@ -2194,7 +2194,7 @@ NTSTATUS WINAPI NtAddAtom( const WCHAR *name, ULONG length, RTL_ATOM *atom )
 /***********************************************************************
  *             NtDeleteAtom (NTDLL.@)
  */
-NTSTATUS WINAPI NtDeleteAtom( RTL_ATOM atom )
+NTSTATUS SYSCALL NtDeleteAtom( RTL_ATOM atom )
 {
     unsigned int status;
@@ -2211,7 +2211,7 @@ NTSTATUS WINAPI NtDeleteAtom( RTL_ATOM atom )
 /***********************************************************************
  *             NtFindAtom (NTDLL.@)
  */
-NTSTATUS WINAPI NtFindAtom( const WCHAR *name, ULONG length, RTL_ATOM *atom )
+NTSTATUS SYSCALL NtFindAtom( const WCHAR *name, ULONG length, RTL_ATOM *atom )
 {
     unsigned int status = is_integral_atom( name, length / sizeof(WCHAR), atom );
@@ -2233,8 +2233,8 @@ NTSTATUS WINAPI NtFindAtom( const WCHAR *name, ULONG length, RTL_ATOM *atom )
 /***********************************************************************
  *             NtQueryInformationAtom (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInformationAtom( RTL_ATOM atom, ATOM_INFORMATION_CLASS class,
-                                        void *ptr, ULONG size, ULONG *retsize )
+NTSTATUS SYSCALL NtQueryInformationAtom( RTL_ATOM atom, ATOM_INFORMATION_CLASS class,
+                                         void *ptr, ULONG size, ULONG *retsize )
 {
     unsigned int status;
@@ -2379,7 +2379,7 @@ static union tid_alert_entry *get_tid_alert_entry( HANDLE tid )
 /***********************************************************************
  *             NtAlertThreadByThreadId (NTDLL.@)
  */
-NTSTATUS WINAPI NtAlertThreadByThreadId( HANDLE tid )
+NTSTATUS SYSCALL NtAlertThreadByThreadId( HANDLE tid )
 {
     union tid_alert_entry *entry = get_tid_alert_entry( tid );
@@ -2434,7 +2434,7 @@ static LONGLONG update_timeout( ULONGLONG end )
 /***********************************************************************
  *             NtWaitForAlertByThreadId (NTDLL.@)
  */
-NTSTATUS WINAPI NtWaitForAlertByThreadId( const void *address, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtWaitForAlertByThreadId( const void *address, const LARGE_INTEGER *timeout )
 {
     union tid_alert_entry *entry = get_tid_alert_entry( NtCurrentTeb()->ClientId.UniqueThread );
     semaphore_t sem;
@@ -2483,7 +2483,7 @@ NTSTATUS WINAPI NtWaitForAlertByThreadId( const void *address, const LARGE_INTEG
 /***********************************************************************
  *             NtWaitForAlertByThreadId (NTDLL.@)
  */
-NTSTATUS WINAPI NtWaitForAlertByThreadId( const void *address, const LARGE_INTEGER *timeout )
+NTSTATUS SYSCALL NtWaitForAlertByThreadId( const void *address, const LARGE_INTEGER *timeout )
 {
     union tid_alert_entry *entry = get_tid_alert_entry( NtCurrentTeb()->ClientId.UniqueThread );
     NTSTATUS status;
diff --git a/dlls/ntdll/unix/system.c b/dlls/ntdll/unix/system.c
index b9be2f53752..7ee84b65744 100644
--- a/dlls/ntdll/unix/system.c
+++ b/dlls/ntdll/unix/system.c
@@ -2509,8 +2509,8 @@ C_ASSERT( sizeof(struct process_info) <= sizeof(SYSTEM_PROCESS_INFORMATION) );
 /******************************************************************************
  *              NtQuerySystemInformation  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySystemInformation( SYSTEM_INFORMATION_CLASS class,
-                                          void *info, ULONG size, ULONG *ret_size )
+NTSTATUS SYSCALL NtQuerySystemInformation( SYSTEM_INFORMATION_CLASS class,
+                                           void *info, ULONG size, ULONG *ret_size )
 {
     unsigned int ret = STATUS_SUCCESS;
     ULONG len = 0;
@@ -3200,9 +3200,9 @@ NTSTATUS WINAPI NtQuerySystemInformation( SYSTEM_INFORMATION_CLASS class,
 /******************************************************************************
  *              NtQuerySystemInformationEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySystemInformationEx( SYSTEM_INFORMATION_CLASS class,
-                                            void *query, ULONG query_len,
-                                            void *info, ULONG size, ULONG *ret_size )
+NTSTATUS SYSCALL NtQuerySystemInformationEx( SYSTEM_INFORMATION_CLASS class,
+                                             void *query, ULONG query_len,
+                                             void *info, ULONG size, ULONG *ret_size )
 {
     ULONG len = 0;
     unsigned int ret = STATUS_NOT_IMPLEMENTED;
@@ -3319,7 +3319,7 @@ NTSTATUS WINAPI NtQuerySystemInformationEx( SYSTEM_INFORMATION_CLASS class,
 /******************************************************************************
  *              NtSetSystemInformation  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetSystemInformation( SYSTEM_INFORMATION_CLASS class, void *info, ULONG length )
+NTSTATUS SYSCALL NtSetSystemInformation( SYSTEM_INFORMATION_CLASS class, void *info, ULONG length )
 {
     FIXME( "(0x%08x,%p,0x%08x) stub\n", class, info, (int)length );
     return STATUS_SUCCESS;
@@ -3329,8 +3329,8 @@ NTSTATUS WINAPI NtSetSystemInformation( SYSTEM_INFORMATION_CLASS class, void *in
 /******************************************************************************
  *              NtQuerySystemEnvironmentValue  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySystemEnvironmentValue( UNICODE_STRING *name, WCHAR *buffer, ULONG length,
-                                               ULONG *retlen )
+NTSTATUS SYSCALL NtQuerySystemEnvironmentValue( UNICODE_STRING *name, WCHAR *buffer, ULONG length,
+                                                ULONG *retlen )
 {
     FIXME( "(%s, %p, %u, %p), stub\n", debugstr_us(name), buffer, (int)length, retlen );
     return STATUS_NOT_IMPLEMENTED;
@@ -3340,8 +3340,8 @@ NTSTATUS WINAPI NtQuerySystemEnvironmentValue( UNICODE_STRING *name, WCHAR *buff
 /******************************************************************************
  *              NtQuerySystemEnvironmentValueEx  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySystemEnvironmentValueEx( UNICODE_STRING *name, GUID *vendor, void *buffer,
-                                                 ULONG *retlen, ULONG *attrib )
+NTSTATUS SYSCALL NtQuerySystemEnvironmentValueEx( UNICODE_STRING *name, GUID *vendor, void *buffer,
+                                                  ULONG *retlen, ULONG *attrib )
 {
     FIXME( "(%s, %s, %p, %p, %p), stub\n", debugstr_us(name),
            debugstr_guid(vendor), buffer, retlen, attrib );
@@ -3352,8 +3352,8 @@ NTSTATUS WINAPI NtQuerySystemEnvironmentValueEx( UNICODE_STRING *name, GUID *ven
 /******************************************************************************
  *              NtSystemDebugControl  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSystemDebugControl( SYSDBG_COMMAND command, void *in_buff, ULONG in_len,
-                                      void *out_buff, ULONG out_len, ULONG *retlen )
+NTSTATUS SYSCALL NtSystemDebugControl( SYSDBG_COMMAND command, void *in_buff, ULONG in_len,
+                                       void *out_buff, ULONG out_len, ULONG *retlen )
 {
     FIXME( "(%d, %p, %d, %p, %d, %p), stub\n",
            command, in_buff, (int)in_len, out_buff, (int)out_len, retlen );
@@ -3364,7 +3364,7 @@ NTSTATUS WINAPI NtSystemDebugControl( SYSDBG_COMMAND command, void *in_buff, ULO
 /******************************************************************************
  *              NtShutdownSystem  (NTDLL.@)
  */
-NTSTATUS WINAPI NtShutdownSystem( SHUTDOWN_ACTION action )
+NTSTATUS SYSCALL NtShutdownSystem( SHUTDOWN_ACTION action )
 {
     FIXME( "%d\n", action );
     return STATUS_SUCCESS;
@@ -3607,8 +3607,8 @@ static NTSTATUS fill_battery_state( SYSTEM_BATTERY_STATE *bs )
 /******************************************************************************
  *              NtPowerInformation  (NTDLL.@)
  */
-NTSTATUS WINAPI NtPowerInformation( POWER_INFORMATION_LEVEL level, void *input, ULONG in_size,
-                                    void *output, ULONG out_size )
+NTSTATUS SYSCALL NtPowerInformation( POWER_INFORMATION_LEVEL level, void *input, ULONG in_size,
+                                     void *output, ULONG out_size )
 {
     TRACE( "(%d,%p,%d,%p,%d)\n", level, input, (int)in_size, output, (int)out_size );
     switch (level)
@@ -3794,7 +3794,7 @@ NTSTATUS WINAPI NtPowerInformation( POWER_INFORMATION_LEVEL level, void *input,
 /******************************************************************************
  *              NtLoadDriver  (NTDLL.@)
  */
-NTSTATUS WINAPI NtLoadDriver( const UNICODE_STRING *name )
+NTSTATUS SYSCALL NtLoadDriver( const UNICODE_STRING *name )
 {
     FIXME( "(%s), stub!\n", debugstr_us(name) );
     return STATUS_NOT_IMPLEMENTED;
@@ -3804,7 +3804,7 @@ NTSTATUS WINAPI NtLoadDriver( const UNICODE_STRING *name )
 /******************************************************************************
  *              NtUnloadDriver  (NTDLL.@)
  */
-NTSTATUS WINAPI NtUnloadDriver( const UNICODE_STRING *name )
+NTSTATUS SYSCALL NtUnloadDriver( const UNICODE_STRING *name )
 {
     FIXME( "(%s), stub!\n", debugstr_us(name) );
     return STATUS_NOT_IMPLEMENTED;
@@ -3814,7 +3814,7 @@ NTSTATUS WINAPI NtUnloadDriver( const UNICODE_STRING *name )
 /******************************************************************************
  *              NtDisplayString  (NTDLL.@)
  */
-NTSTATUS WINAPI NtDisplayString( UNICODE_STRING *string )
+NTSTATUS SYSCALL NtDisplayString( UNICODE_STRING *string )
 {
     ERR( "%s\n", debugstr_us(string) );
     return STATUS_SUCCESS;
@@ -3824,9 +3824,9 @@ NTSTATUS WINAPI NtDisplayString( UNICODE_STRING *string )
 /******************************************************************************
  *              NtRaiseHardError  (NTDLL.@)
  */
-NTSTATUS WINAPI NtRaiseHardError( NTSTATUS status, ULONG count,
-                                  UNICODE_STRING *params_mask, void **params,
-                                  HARDERROR_RESPONSE_OPTION option, HARDERROR_RESPONSE *response )
+NTSTATUS SYSCALL NtRaiseHardError( NTSTATUS status, ULONG count,
+                                   UNICODE_STRING *params_mask, void **params,
+                                   HARDERROR_RESPONSE_OPTION option, HARDERROR_RESPONSE *response )
 {
     FIXME( "%08x stub\n", (int)status );
     return STATUS_NOT_IMPLEMENTED;
@@ -3836,8 +3836,8 @@ NTSTATUS WINAPI NtRaiseHardError( NTSTATUS status, ULONG count,
 /******************************************************************************
  *              NtInitiatePowerAction  (NTDLL.@)
  */
-NTSTATUS WINAPI NtInitiatePowerAction( POWER_ACTION action, SYSTEM_POWER_STATE state,
-                                       ULONG flags, BOOLEAN async )
+NTSTATUS SYSCALL NtInitiatePowerAction( POWER_ACTION action, SYSTEM_POWER_STATE state,
+                                        ULONG flags, BOOLEAN async )
 {
     FIXME( "(%d,%d,0x%08x,%d),stub\n", action, state, (int)flags, async );
     return STATUS_NOT_IMPLEMENTED;
@@ -3847,7 +3847,7 @@ NTSTATUS WINAPI NtInitiatePowerAction( POWER_ACTION action, SYSTEM_POWER_STATE s
 /******************************************************************************
  *              NtSetThreadExecutionState  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetThreadExecutionState( EXECUTION_STATE new_state, EXECUTION_STATE *old_state )
+NTSTATUS SYSCALL NtSetThreadExecutionState( EXECUTION_STATE new_state, EXECUTION_STATE *old_state )
 {
     static EXECUTION_STATE current = ES_SYSTEM_REQUIRED | ES_DISPLAY_REQUIRED | ES_USER_PRESENT;
diff --git a/dlls/ntdll/unix/thread.c b/dlls/ntdll/unix/thread.c
index d56962e1721..48eb2e6182d 100644
--- a/dlls/ntdll/unix/thread.c
+++ b/dlls/ntdll/unix/thread.c
@@ -1230,9 +1230,9 @@ static void update_attr_list( PS_ATTRIBUTE_LIST *attr, const CLIENT_ID *id, TEB
 /***********************************************************************
  *              NtCreateThread   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateThread( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
-                                HANDLE process, CLIENT_ID *id, CONTEXT *ctx, INITIAL_TEB *teb,
-                                BOOLEAN suspended )
+NTSTATUS SYSCALL NtCreateThread( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
+                                 HANDLE process, CLIENT_ID *id, CONTEXT *ctx, INITIAL_TEB *teb,
+                                 BOOLEAN suspended )
 {
     FIXME( "%p %d %p %p %p %p %p %d, stub!\n",
            handle, (int)access, attr, process, id, ctx, teb, suspended );
@@ -1242,10 +1242,10 @@ NTSTATUS WINAPI NtCreateThread( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRI
 /***********************************************************************
  *              NtCreateThreadEx   (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreateThreadEx( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
-                                  HANDLE process, PRTL_THREAD_START_ROUTINE start, void *param,
-                                  ULONG flags, ULONG_PTR zero_bits, SIZE_T stack_commit,
-                                  SIZE_T stack_reserve, PS_ATTRIBUTE_LIST *attr_list )
+NTSTATUS SYSCALL NtCreateThreadEx( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
+                                   HANDLE process, PRTL_THREAD_START_ROUTINE start, void *param,
+                                   ULONG flags, ULONG_PTR zero_bits, SIZE_T stack_commit,
+                                   SIZE_T stack_reserve, PS_ATTRIBUTE_LIST *attr_list )
 {
     static const ULONG supported_flags = THREAD_CREATE_FLAGS_CREATE_SUSPENDED | THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER;
     sigset_t sigset;
@@ -1508,7 +1508,7 @@ NTSTATUS send_debug_event( EXCEPTION_RECORD *rec, CONTEXT *context, BOOL first_c
 /*******************************************************************
  *		NtRaiseException (NTDLL.@)
  */
-NTSTATUS WINAPI NtRaiseException( EXCEPTION_RECORD *rec, CONTEXT *context, BOOL first_chance )
+NTSTATUS SYSCALL NtRaiseException( EXCEPTION_RECORD *rec, CONTEXT *context, BOOL first_chance )
 {
     NTSTATUS status = send_debug_event( rec, context, first_chance );
@@ -1542,8 +1542,8 @@ TEB * WINAPI NtCurrentTeb(void)
 /***********************************************************************
  *              NtOpenThread   (NTDLL.@)
  */
-NTSTATUS WINAPI NtOpenThread( HANDLE *handle, ACCESS_MASK access,
-                              const OBJECT_ATTRIBUTES *attr, const CLIENT_ID *id )
+NTSTATUS SYSCALL NtOpenThread( HANDLE *handle, ACCESS_MASK access,
+                               const OBJECT_ATTRIBUTES *attr, const CLIENT_ID *id )
 {
     unsigned int ret;
@@ -1565,7 +1565,7 @@ NTSTATUS WINAPI NtOpenThread( HANDLE *handle, ACCESS_MASK access,
 /******************************************************************************
  *              NtSuspendThread   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSuspendThread( HANDLE handle, ULONG *count )
+NTSTATUS SYSCALL NtSuspendThread( HANDLE handle, ULONG *count )
 {
     unsigned int ret;
@@ -1585,7 +1585,7 @@ NTSTATUS WINAPI NtSuspendThread( HANDLE handle, ULONG *count )
 /******************************************************************************
  *              NtResumeThread   (NTDLL.@)
  */
-NTSTATUS WINAPI NtResumeThread( HANDLE handle, ULONG *count )
+NTSTATUS SYSCALL NtResumeThread( HANDLE handle, ULONG *count )
 {
     unsigned int ret;
@@ -1605,7 +1605,7 @@ NTSTATUS WINAPI NtResumeThread( HANDLE handle, ULONG *count )
 /******************************************************************************
  *              NtAlertResumeThread   (NTDLL.@)
  */
-NTSTATUS WINAPI NtAlertResumeThread( HANDLE handle, ULONG *count )
+NTSTATUS SYSCALL NtAlertResumeThread( HANDLE handle, ULONG *count )
 {
     FIXME( "stub: should alert thread %p\n", handle );
     return NtResumeThread( handle, count );
@@ -1615,7 +1615,7 @@ NTSTATUS WINAPI NtAlertResumeThread( HANDLE handle, ULONG *count )
 /******************************************************************************
  *              NtAlertThread   (NTDLL.@)
  */
-NTSTATUS WINAPI NtAlertThread( HANDLE handle )
+NTSTATUS SYSCALL NtAlertThread( HANDLE handle )
 {
     FIXME( "stub: %p\n", handle );
     return STATUS_NOT_IMPLEMENTED;
@@ -1625,7 +1625,7 @@ NTSTATUS WINAPI NtAlertThread( HANDLE handle )
 /******************************************************************************
  *              NtTerminateThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtTerminateThread( HANDLE handle, LONG exit_code )
+NTSTATUS SYSCALL NtTerminateThread( HANDLE handle, LONG exit_code )
 {
     unsigned int ret;
     BOOL self;
@@ -1651,8 +1651,8 @@ NTSTATUS WINAPI NtTerminateThread( HANDLE handle, LONG exit_code )
 /******************************************************************************
  *              NtQueueApcThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueueApcThread( HANDLE handle, PNTAPCFUNC func, ULONG_PTR arg1,
-                                  ULONG_PTR arg2, ULONG_PTR arg3 )
+NTSTATUS SYSCALL NtQueueApcThread( HANDLE handle, PNTAPCFUNC func, ULONG_PTR arg1,
+                                   ULONG_PTR arg2, ULONG_PTR arg3 )
 {
     unsigned int ret;
@@ -1942,8 +1942,8 @@ static BOOL is_process_wow64( const CLIENT_ID *id )
 /******************************************************************************
  *              NtQueryInformationThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryInformationThread( HANDLE handle, THREADINFOCLASS class,
-                                          void *data, ULONG length, ULONG *ret_len )
+NTSTATUS SYSCALL NtQueryInformationThread( HANDLE handle, THREADINFOCLASS class,
+                                           void *data, ULONG length, ULONG *ret_len )
 {
     unsigned int status;
@@ -2208,8 +2208,8 @@ NTSTATUS WINAPI NtQueryInformationThread( HANDLE handle, THREADINFOCLASS class,
 /******************************************************************************
  *              NtSetInformationThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationThread( HANDLE handle, THREADINFOCLASS class,
-                                        const void *data, ULONG length )
+NTSTATUS SYSCALL NtSetInformationThread( HANDLE handle, THREADINFOCLASS class,
+                                         const void *data, ULONG length )
 {
     unsigned int status;
@@ -2421,7 +2421,7 @@ NTSTATUS WINAPI NtSetInformationThread( HANDLE handle, THREADINFOCLASS class,
 /******************************************************************************
  *              NtGetCurrentProcessorNumber  (NTDLL.@)
  */
-ULONG WINAPI NtGetCurrentProcessorNumber(void)
+ULONG SYSCALL NtGetCurrentProcessorNumber(void)
 {
     ULONG processor;
@@ -2458,8 +2458,8 @@ ULONG WINAPI NtGetCurrentProcessorNumber(void)
 /******************************************************************************
  *              NtGetNextThread  (NTDLL.@)
  */
-NTSTATUS WINAPI NtGetNextThread( HANDLE process, HANDLE thread, ACCESS_MASK access, ULONG attributes,
-                                 ULONG flags, HANDLE *handle )
+NTSTATUS SYSCALL NtGetNextThread( HANDLE process, HANDLE thread, ACCESS_MASK access, ULONG attributes,
+                                  ULONG flags, HANDLE *handle )
 {
     HANDLE ret_handle = 0;
     unsigned int ret;
diff --git a/dlls/ntdll/unix/virtual.c b/dlls/ntdll/unix/virtual.c
index 0f66429fc9d..af348296fb4 100644
--- a/dlls/ntdll/unix/virtual.c
+++ b/dlls/ntdll/unix/virtual.c
@@ -3854,8 +3854,8 @@ static NTSTATUS allocate_virtual_memory( void **ret, SIZE_T *size_ptr, ULONG typ
  *             NtAllocateVirtualMemory   (NTDLL.@)
  *             ZwAllocateVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtAllocateVirtualMemory( HANDLE process, PVOID *ret, ULONG_PTR zero_bits,
-                                         SIZE_T *size_ptr, ULONG type, ULONG protect )
+NTSTATUS SYSCALL NtAllocateVirtualMemory( HANDLE process, PVOID *ret, ULONG_PTR zero_bits,
+                                          SIZE_T *size_ptr, ULONG type, ULONG protect )
 {
     ULONG_PTR limit;
@@ -3906,9 +3906,9 @@ NTSTATUS WINAPI NtAllocateVirtualMemory( HANDLE process, PVOID *ret, ULONG_PTR z
  *             NtAllocateVirtualMemoryEx   (NTDLL.@)
  *             ZwAllocateVirtualMemoryEx   (NTDLL.@)
  */
-NTSTATUS WINAPI NtAllocateVirtualMemoryEx( HANDLE process, PVOID *ret, SIZE_T *size_ptr, ULONG type,
-                                           ULONG protect, MEM_EXTENDED_PARAMETER *parameters,
-                                           ULONG count )
+NTSTATUS SYSCALL NtAllocateVirtualMemoryEx( HANDLE process, PVOID *ret, SIZE_T *size_ptr, ULONG type,
+                                            ULONG protect, MEM_EXTENDED_PARAMETER *parameters,
+                                            ULONG count )
 {
     ULONG_PTR limit = 0;
     ULONG_PTR align = 0;
@@ -4002,7 +4002,7 @@ NTSTATUS WINAPI NtAllocateVirtualMemoryEx( HANDLE process, PVOID *ret, SIZE_T *s
  *             NtFreeVirtualMemory   (NTDLL.@)
  *             ZwFreeVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtFreeVirtualMemory( HANDLE process, PVOID *addr_ptr, SIZE_T *size_ptr, ULONG type )
+NTSTATUS SYSCALL NtFreeVirtualMemory( HANDLE process, PVOID *addr_ptr, SIZE_T *size_ptr, ULONG type )
 {
     struct file_view *view;
     char *base;
@@ -4091,8 +4091,8 @@ NTSTATUS WINAPI NtFreeVirtualMemory( HANDLE process, PVOID *addr_ptr, SIZE_T *si
  *             NtProtectVirtualMemory   (NTDLL.@)
  *             ZwProtectVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtProtectVirtualMemory( HANDLE process, PVOID *addr_ptr, SIZE_T *size_ptr,
-                                        ULONG new_prot, ULONG *old_prot )
+NTSTATUS SYSCALL NtProtectVirtualMemory( HANDLE process, PVOID *addr_ptr, SIZE_T *size_ptr,
+                                         ULONG new_prot, ULONG *old_prot )
 {
     struct file_view *view;
     sigset_t sigset;
@@ -4516,9 +4516,9 @@ static unsigned int get_memory_section_name( HANDLE process, LPCVOID addr,
  *             NtQueryVirtualMemory   (NTDLL.@)
  *             ZwQueryVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQueryVirtualMemory( HANDLE process, LPCVOID addr,
-                                      MEMORY_INFORMATION_CLASS info_class,
-                                      PVOID buffer, SIZE_T len, SIZE_T *res_len )
+NTSTATUS SYSCALL NtQueryVirtualMemory( HANDLE process, LPCVOID addr,
+                                       MEMORY_INFORMATION_CLASS info_class,
+                                       PVOID buffer, SIZE_T len, SIZE_T *res_len )
 {
     NTSTATUS status;
@@ -4565,7 +4565,7 @@ NTSTATUS WINAPI NtQueryVirtualMemory( HANDLE process, LPCVOID addr,
  *             NtLockVirtualMemory   (NTDLL.@)
  *             ZwLockVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtLockVirtualMemory( HANDLE process, PVOID *addr, SIZE_T *size, ULONG unknown )
+NTSTATUS SYSCALL NtLockVirtualMemory( HANDLE process, PVOID *addr, SIZE_T *size, ULONG unknown )
 {
     unsigned int status = STATUS_SUCCESS;
@@ -4602,7 +4602,7 @@ NTSTATUS WINAPI NtLockVirtualMemory( HANDLE process, PVOID *addr, SIZE_T *size,
  *             NtUnlockVirtualMemory   (NTDLL.@)
  *             ZwUnlockVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtUnlockVirtualMemory( HANDLE process, PVOID *addr, SIZE_T *size, ULONG unknown )
+NTSTATUS SYSCALL NtUnlockVirtualMemory( HANDLE process, PVOID *addr, SIZE_T *size, ULONG unknown )
 {
     unsigned int status = STATUS_SUCCESS;
@@ -4639,9 +4639,9 @@ NTSTATUS WINAPI NtUnlockVirtualMemory( HANDLE process, PVOID *addr, SIZE_T *size
  *             NtMapViewOfSection   (NTDLL.@)
  *             ZwMapViewOfSection   (NTDLL.@)
  */
-NTSTATUS WINAPI NtMapViewOfSection( HANDLE handle, HANDLE process, PVOID *addr_ptr, ULONG_PTR zero_bits,
-                                    SIZE_T commit_size, const LARGE_INTEGER *offset_ptr, SIZE_T *size_ptr,
-                                    SECTION_INHERIT inherit, ULONG alloc_type, ULONG protect )
+NTSTATUS SYSCALL NtMapViewOfSection( HANDLE handle, HANDLE process, PVOID *addr_ptr, ULONG_PTR zero_bits,
+                                     SIZE_T commit_size, const LARGE_INTEGER *offset_ptr, SIZE_T *size_ptr,
+                                     SECTION_INHERIT inherit, ULONG alloc_type, ULONG protect )
 {
     unsigned int res;
     SIZE_T mask = granularity_mask;
@@ -4713,8 +4713,8 @@ NTSTATUS WINAPI NtMapViewOfSection( HANDLE handle, HANDLE process, PVOID *addr_p
  *             NtMapViewOfSectionEx   (NTDLL.@)
  *             ZwMapViewOfSectionEx   (NTDLL.@)
  */
-NTSTATUS WINAPI NtMapViewOfSectionEx( HANDLE handle, HANDLE process, PVOID *addr_ptr, const LARGE_INTEGER *offset_ptr,
-        SIZE_T *size_ptr, ULONG alloc_type, ULONG protect, MEM_EXTENDED_PARAMETER *params, ULONG params_count )
+NTSTATUS SYSCALL NtMapViewOfSectionEx( HANDLE handle, HANDLE process, PVOID *addr_ptr, const LARGE_INTEGER *offset_ptr,
+         SIZE_T *size_ptr, ULONG alloc_type, ULONG protect, MEM_EXTENDED_PARAMETER *params, ULONG params_count )
 {
     if (params)
         FIXME("Ignoring extended parameters.\n");
@@ -4726,7 +4726,7 @@ NTSTATUS WINAPI NtMapViewOfSectionEx( HANDLE handle, HANDLE process, PVOID *addr
  *             NtUnmapViewOfSection   (NTDLL.@)
  *             ZwUnmapViewOfSection   (NTDLL.@)
  */
-NTSTATUS WINAPI NtUnmapViewOfSection( HANDLE process, PVOID addr )
+NTSTATUS SYSCALL NtUnmapViewOfSection( HANDLE process, PVOID addr )
 {
     struct file_view *view;
     unsigned int status = STATUS_NOT_MAPPED_VIEW;
@@ -4787,7 +4787,7 @@ NTSTATUS WINAPI NtUnmapViewOfSection( HANDLE process, PVOID addr )
  *             NtUnmapViewOfSectionEx   (NTDLL.@)
  *             ZwUnmapViewOfSectionEx   (NTDLL.@)
  */
-NTSTATUS WINAPI NtUnmapViewOfSectionEx( HANDLE process, PVOID addr, ULONG flags )
+NTSTATUS SYSCALL NtUnmapViewOfSectionEx( HANDLE process, PVOID addr, ULONG flags )
 {
     if (flags) FIXME("Ignoring flags %#x.\n", (int)flags);
     return NtUnmapViewOfSection( process, addr );
@@ -4831,8 +4831,8 @@ void virtual_fill_image_information( const pe_image_info_t *pe_info, SECTION_IMA
  *             NtQuerySection   (NTDLL.@)
  *             ZwQuerySection   (NTDLL.@)
  */
-NTSTATUS WINAPI NtQuerySection( HANDLE handle, SECTION_INFORMATION_CLASS class, void *ptr,
-                                SIZE_T size, SIZE_T *ret_size )
+NTSTATUS SYSCALL NtQuerySection( HANDLE handle, SECTION_INFORMATION_CLASS class, void *ptr,
+                                 SIZE_T size, SIZE_T *ret_size )
 {
     unsigned int status;
     pe_image_info_t image_info;
@@ -4885,8 +4885,8 @@ NTSTATUS WINAPI NtQuerySection( HANDLE handle, SECTION_INFORMATION_CLASS class,
  *             NtFlushVirtualMemory   (NTDLL.@)
  *             ZwFlushVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtFlushVirtualMemory( HANDLE process, LPCVOID *addr_ptr,
-                                      SIZE_T *size_ptr, ULONG unknown )
+NTSTATUS SYSCALL NtFlushVirtualMemory( HANDLE process, LPCVOID *addr_ptr,
+                                       SIZE_T *size_ptr, ULONG unknown )
 {
     struct file_view *view;
     unsigned int status = STATUS_SUCCESS;
@@ -4933,8 +4933,8 @@ NTSTATUS WINAPI NtFlushVirtualMemory( HANDLE process, LPCVOID *addr_ptr,
  *             NtGetWriteWatch   (NTDLL.@)
  *             ZwGetWriteWatch   (NTDLL.@)
  */
-NTSTATUS WINAPI NtGetWriteWatch( HANDLE process, ULONG flags, PVOID base, SIZE_T size, PVOID *addresses,
-                                 ULONG_PTR *count, ULONG *granularity )
+NTSTATUS SYSCALL NtGetWriteWatch( HANDLE process, ULONG flags, PVOID base, SIZE_T size, PVOID *addresses,
+                                  ULONG_PTR *count, ULONG *granularity )
 {
     NTSTATUS status = STATUS_SUCCESS;
     sigset_t sigset;
@@ -4979,7 +4979,7 @@ NTSTATUS WINAPI NtGetWriteWatch( HANDLE process, ULONG flags, PVOID base, SIZE_T
  *             NtResetWriteWatch   (NTDLL.@)
  *             ZwResetWriteWatch   (NTDLL.@)
  */
-NTSTATUS WINAPI NtResetWriteWatch( HANDLE process, PVOID base, SIZE_T size )
+NTSTATUS SYSCALL NtResetWriteWatch( HANDLE process, PVOID base, SIZE_T size )
 {
     NTSTATUS status = STATUS_SUCCESS;
     sigset_t sigset;
@@ -5007,8 +5007,8 @@ NTSTATUS WINAPI NtResetWriteWatch( HANDLE process, PVOID base, SIZE_T size )
  *             NtReadVirtualMemory   (NTDLL.@)
  *             ZwReadVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtReadVirtualMemory( HANDLE process, const void *addr, void *buffer,
-                                     SIZE_T size, SIZE_T *bytes_read )
+NTSTATUS SYSCALL NtReadVirtualMemory( HANDLE process, const void *addr, void *buffer,
+                                      SIZE_T size, SIZE_T *bytes_read )
 {
     unsigned int status;
@@ -5037,8 +5037,8 @@ NTSTATUS WINAPI NtReadVirtualMemory( HANDLE process, const void *addr, void *buf
  *             NtWriteVirtualMemory   (NTDLL.@)
  *             ZwWriteVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWriteVirtualMemory( HANDLE process, void *addr, const void *buffer,
-                                      SIZE_T size, SIZE_T *bytes_written )
+NTSTATUS SYSCALL NtWriteVirtualMemory( HANDLE process, void *addr, const void *buffer,
+                                       SIZE_T size, SIZE_T *bytes_written )
 {
     unsigned int status;
@@ -5067,7 +5067,7 @@ NTSTATUS WINAPI NtWriteVirtualMemory( HANDLE process, void *addr, const void *bu
  *             NtAreMappedFilesTheSame   (NTDLL.@)
  *             ZwAreMappedFilesTheSame   (NTDLL.@)
  */
-NTSTATUS WINAPI NtAreMappedFilesTheSame(PVOID addr1, PVOID addr2)
+NTSTATUS SYSCALL NtAreMappedFilesTheSame(PVOID addr1, PVOID addr2)
 {
     struct file_view *view1, *view2;
     unsigned int status;
@@ -5139,10 +5139,10 @@ static NTSTATUS prefetch_memory( HANDLE process, ULONG_PTR count,
  *           NtSetInformationVirtualMemory   (NTDLL.@)
  *           ZwSetInformationVirtualMemory   (NTDLL.@)
  */
-NTSTATUS WINAPI NtSetInformationVirtualMemory( HANDLE process,
-                                               VIRTUAL_MEMORY_INFORMATION_CLASS info_class,
-                                               ULONG_PTR count, PMEMORY_RANGE_ENTRY addresses,
-                                               PVOID ptr, ULONG size )
+NTSTATUS SYSCALL NtSetInformationVirtualMemory( HANDLE process,
+                                                VIRTUAL_MEMORY_INFORMATION_CLASS info_class,
+                                                ULONG_PTR count, PMEMORY_RANGE_ENTRY addresses,
+                                                PVOID ptr, ULONG size )
 {
     TRACE("(%p, info_class=%d, %lu, %p, %p, %u)\n",
           process, info_class, count, addresses, ptr, (int)size);
@@ -5166,7 +5166,7 @@ NTSTATUS WINAPI NtSetInformationVirtualMemory( HANDLE process,
 /**********************************************************************
  *           NtFlushInstructionCache  (NTDLL.@)
  */
-NTSTATUS WINAPI NtFlushInstructionCache( HANDLE handle, const void *addr, SIZE_T size )
+NTSTATUS SYSCALL NtFlushInstructionCache( HANDLE handle, const void *addr, SIZE_T size )
 {
 #if defined(__x86_64__) || defined(__i386__)
     /* no-op */
@@ -5191,7 +5191,7 @@ NTSTATUS WINAPI NtFlushInstructionCache( HANDLE handle, const void *addr, SIZE_T
 /**********************************************************************
  *           NtFlushProcessWriteBuffers  (NTDLL.@)
  */
-void WINAPI NtFlushProcessWriteBuffers(void)
+void SYSCALL NtFlushProcessWriteBuffers(void)
 {
     static int once = 0;
     if (!once++) FIXME( "stub\n" );
@@ -5201,8 +5201,8 @@ void WINAPI NtFlushProcessWriteBuffers(void)
 /**********************************************************************
  *           NtCreatePagingFile  (NTDLL.@)
  */
-NTSTATUS WINAPI NtCreatePagingFile( UNICODE_STRING *name, LARGE_INTEGER *min_size,
-                                    LARGE_INTEGER *max_size, LARGE_INTEGER *actual_size )
+NTSTATUS SYSCALL NtCreatePagingFile( UNICODE_STRING *name, LARGE_INTEGER *min_size,
+                                     LARGE_INTEGER *max_size, LARGE_INTEGER *actual_size )
 {
     FIXME( "(%s %p %p %p) stub\n", debugstr_us(name), min_size, max_size, actual_size );
     return STATUS_SUCCESS;
@@ -5214,8 +5214,8 @@ NTSTATUS WINAPI NtCreatePagingFile( UNICODE_STRING *name, LARGE_INTEGER *min_siz
  *             NtWow64AllocateVirtualMemory64   (NTDLL.@)
  *             ZwWow64AllocateVirtualMemory64   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWow64AllocateVirtualMemory64( HANDLE process, ULONG64 *ret, ULONG64 zero_bits,
-                                                ULONG64 *size_ptr, ULONG type, ULONG protect )
+NTSTATUS SYSCALL NtWow64AllocateVirtualMemory64( HANDLE process, ULONG64 *ret, ULONG64 zero_bits,
+                                                 ULONG64 *size_ptr, ULONG type, ULONG protect )
 {
     void *base;
     SIZE_T size;
@@ -5270,8 +5270,8 @@ NTSTATUS WINAPI NtWow64AllocateVirtualMemory64( HANDLE process, ULONG64 *ret, UL
  *             NtWow64ReadVirtualMemory64   (NTDLL.@)
  *             ZwWow64ReadVirtualMemory64   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWow64ReadVirtualMemory64( HANDLE process, ULONG64 addr, void *buffer,
-                                            ULONG64 size, ULONG64 *bytes_read )
+NTSTATUS SYSCALL NtWow64ReadVirtualMemory64( HANDLE process, ULONG64 addr, void *buffer,
+                                             ULONG64 size, ULONG64 *bytes_read )
 {
     unsigned int status;
@@ -5302,8 +5302,8 @@ NTSTATUS WINAPI NtWow64ReadVirtualMemory64( HANDLE process, ULONG64 addr, void *
  *             NtWow64WriteVirtualMemory64   (NTDLL.@)
  *             ZwWow64WriteVirtualMemory64   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWow64WriteVirtualMemory64( HANDLE process, ULONG64 addr, const void *buffer,
-                                             ULONG64 size, ULONG64 *bytes_written )
+NTSTATUS SYSCALL NtWow64WriteVirtualMemory64( HANDLE process, ULONG64 addr, const void *buffer,
+                                              ULONG64 size, ULONG64 *bytes_written )
 {
     unsigned int status;
@@ -5334,8 +5334,8 @@ NTSTATUS WINAPI NtWow64WriteVirtualMemory64( HANDLE process, ULONG64 addr, const
  *             NtWow64GetNativeSystemInformation   (NTDLL.@)
  *             ZwWow64GetNativeSystemInformation   (NTDLL.@)
  */
-NTSTATUS WINAPI NtWow64GetNativeSystemInformation( SYSTEM_INFORMATION_CLASS class, void *info,
-                                                   ULONG len, ULONG *retlen )
+NTSTATUS SYSCALL NtWow64GetNativeSystemInformation( SYSTEM_INFORMATION_CLASS class, void *info,
+                                                    ULONG len, ULONG *retlen )
 {
     switch (class)
     {
diff --git a/include/wine/debug.h b/include/wine/debug.h
index c20924818dd..6b41289f490 100644
--- a/include/wine/debug.h
+++ b/include/wine/debug.h
@@ -108,7 +108,7 @@ struct __wine_debug_channel
 #define WINE_FIXME_(ch) WINE_FIXME
 #endif
-extern int WINAPI __wine_dbg_write( const char *str, unsigned int len );
+extern int SYSCALL __wine_dbg_write( const char *str, unsigned int len );
 extern unsigned char __cdecl __wine_dbg_get_channel_flags( struct __wine_debug_channel *channel );
 extern const char * __cdecl __wine_dbg_strdup( const char *str );
 extern int __cdecl __wine_dbg_output( const char *str );
diff --git a/include/winternl.h b/include/winternl.h
index 5a99827fe65..36e2508b368 100644
--- a/include/winternl.h
+++ b/include/winternl.h
@@ -3960,274 +3960,274 @@ NTSYSAPI void      WINAPI LdrShutdownThread(void);
 NTSYSAPI NTSTATUS  WINAPI LdrUnloadDll(HMODULE);
 NTSYSAPI NTSTATUS  WINAPI LdrUnlockLoaderLock(ULONG,ULONG_PTR);
 NTSYSAPI NTSTATUS  WINAPI LdrUnregisterDllNotification(void*);
-NTSYSAPI NTSTATUS  WINAPI NtAcceptConnectPort(PHANDLE,ULONG,PLPC_MESSAGE,BOOLEAN,PLPC_SECTION_WRITE,PLPC_SECTION_READ);
-NTSYSAPI NTSTATUS  WINAPI NtAccessCheck(PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PULONG,NTSTATUS*);
-NTSYSAPI NTSTATUS  WINAPI NtAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtAddAtom(const WCHAR*,ULONG,RTL_ATOM*);
-NTSYSAPI NTSTATUS  WINAPI NtAdjustGroupsToken(HANDLE,BOOLEAN,PTOKEN_GROUPS,ULONG,PTOKEN_GROUPS,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
-NTSYSAPI NTSTATUS  WINAPI NtAlertResumeThread(HANDLE,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtAlertThread(HANDLE ThreadHandle);
-NTSYSAPI NTSTATUS  WINAPI NtAlertThreadByThreadId(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtAllocateLocallyUniqueId(PLUID lpLuid);
-NTSYSAPI NTSTATUS  WINAPI NtAllocateUuids(PULARGE_INTEGER,PULONG,PULONG,PUCHAR);
-NTSYSAPI NTSTATUS  WINAPI NtAllocateVirtualMemory(HANDLE,PVOID*,ULONG_PTR,SIZE_T*,ULONG,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtAllocateVirtualMemoryEx(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG,MEM_EXTENDED_PARAMETER*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtAreMappedFilesTheSame(PVOID,PVOID);
-NTSYSAPI NTSTATUS  WINAPI NtAssignProcessToJobObject(HANDLE,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtCallbackReturn(PVOID,ULONG,NTSTATUS);
-NTSYSAPI NTSTATUS  WINAPI NtCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
-NTSYSAPI NTSTATUS  WINAPI NtCancelIoFileEx(HANDLE,PIO_STATUS_BLOCK,PIO_STATUS_BLOCK);
-NTSYSAPI NTSTATUS  WINAPI NtCancelSynchronousIoFile(HANDLE,PIO_STATUS_BLOCK,PIO_STATUS_BLOCK);
-NTSYSAPI NTSTATUS  WINAPI NtCancelTimer(HANDLE, BOOLEAN*);
-NTSYSAPI NTSTATUS  WINAPI NtClearEvent(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtClose(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtAcceptConnectPort(PHANDLE,ULONG,PLPC_MESSAGE,BOOLEAN,PLPC_SECTION_WRITE,PLPC_SECTION_READ);
+NTSYSAPI NTSTATUS  SYSCALL NtAccessCheck(PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PULONG,NTSTATUS*);
+NTSYSAPI NTSTATUS  SYSCALL NtAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtAddAtom(const WCHAR*,ULONG,RTL_ATOM*);
+NTSYSAPI NTSTATUS  SYSCALL NtAdjustGroupsToken(HANDLE,BOOLEAN,PTOKEN_GROUPS,ULONG,PTOKEN_GROUPS,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
+NTSYSAPI NTSTATUS  SYSCALL NtAlertResumeThread(HANDLE,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtAlertThread(HANDLE ThreadHandle);
+NTSYSAPI NTSTATUS  SYSCALL NtAlertThreadByThreadId(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtAllocateLocallyUniqueId(PLUID lpLuid);
+NTSYSAPI NTSTATUS  SYSCALL NtAllocateUuids(PULARGE_INTEGER,PULONG,PULONG,PUCHAR);
+NTSYSAPI NTSTATUS  SYSCALL NtAllocateVirtualMemory(HANDLE,PVOID*,ULONG_PTR,SIZE_T*,ULONG,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtAllocateVirtualMemoryEx(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG,MEM_EXTENDED_PARAMETER*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtAreMappedFilesTheSame(PVOID,PVOID);
+NTSYSAPI NTSTATUS  SYSCALL NtAssignProcessToJobObject(HANDLE,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtCallbackReturn(PVOID,ULONG,NTSTATUS);
+NTSYSAPI NTSTATUS  SYSCALL NtCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
+NTSYSAPI NTSTATUS  SYSCALL NtCancelIoFileEx(HANDLE,PIO_STATUS_BLOCK,PIO_STATUS_BLOCK);
+NTSYSAPI NTSTATUS  SYSCALL NtCancelSynchronousIoFile(HANDLE,PIO_STATUS_BLOCK,PIO_STATUS_BLOCK);
+NTSYSAPI NTSTATUS  SYSCALL NtCancelTimer(HANDLE, BOOLEAN*);
+NTSYSAPI NTSTATUS  SYSCALL NtClearEvent(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtClose(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtCompareObjects(HANDLE,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtCompleteConnectPort(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtContinue(PCONTEXT,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtCreateDebugObject(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
-NTSYSAPI NTSTATUS  WINAPI NtCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,EVENT_TYPE,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtCompareObjects(HANDLE,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtCompleteConnectPort(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtContinue(PCONTEXT,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateDebugObject(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,EVENT_TYPE,BOOLEAN);
 NTSYSAPI NTSTATUS  WINAPI NtCreateEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
-NTSYSAPI NTSTATUS  WINAPI NtCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtCreateIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtCreateJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtCreateKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,HANDLE,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtCreateKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtCreateLowBoxToken(HANDLE*,HANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,SID*,ULONG,SID_AND_ATTRIBUTES*,ULONG,HANDLE*);
-NTSYSAPI NTSTATUS  WINAPI NtCreateMailslotFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtCreateMutant(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtCreateNamedPipeFile(PHANDLE,ULONG,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtCreatePagingFile(PUNICODE_STRING,PLARGE_INTEGER,PLARGE_INTEGER,PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtCreatePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,HANDLE,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateLowBoxToken(HANDLE*,HANDLE,ACCESS_MASK,OBJECT_ATTRIBUTES*,SID*,ULONG,SID_AND_ATTRIBUTES*,ULONG,HANDLE*);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateMailslotFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,PLARGE_INTEGER);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateMutant(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateNamedPipeFile(PHANDLE,ULONG,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,PLARGE_INTEGER);
+NTSYSAPI NTSTATUS  SYSCALL NtCreatePagingFile(PUNICODE_STRING,PLARGE_INTEGER,PLARGE_INTEGER,PLARGE_INTEGER);
+NTSYSAPI NTSTATUS  SYSCALL NtCreatePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtCreateProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,BOOLEAN,HANDLE,HANDLE,HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtCreateProfile(PHANDLE,HANDLE,PVOID,ULONG,ULONG,PVOID,ULONG,KPROFILE_SOURCE,KAFFINITY);
-NTSYSAPI NTSTATUS  WINAPI NtCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtCreateSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,LONG,LONG);
-NTSYSAPI NTSTATUS  WINAPI NtCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
-NTSYSAPI NTSTATUS  WINAPI NtCreateThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PCONTEXT,PINITIAL_TEB,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtCreateThreadEx(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,HANDLE,PRTL_THREAD_START_ROUTINE,void*,ULONG,ULONG_PTR,SIZE_T,SIZE_T,PS_ATTRIBUTE_LIST*);
-NTSYSAPI NTSTATUS  WINAPI NtCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,LONG,LONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PCONTEXT,PINITIAL_TEB,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateThreadEx(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,HANDLE,PRTL_THREAD_START_ROUTINE,void*,ULONG,ULONG_PTR,SIZE_T,SIZE_T,PS_ATTRIBUTE_LIST*);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
 NTSYSAPI NTSTATUS  WINAPI NtCreateToken(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,TOKEN_TYPE,PLUID,PLARGE_INTEGER,PTOKEN_USER,PTOKEN_GROUPS,PTOKEN_PRIVILEGES,PTOKEN_OWNER,PTOKEN_PRIMARY_GROUP,PTOKEN_DEFAULT_DACL,PTOKEN_SOURCE);
-NTSYSAPI NTSTATUS  WINAPI NtCreateUserProcess(HANDLE*,HANDLE*,ACCESS_MASK,ACCESS_MASK,OBJECT_ATTRIBUTES*,OBJECT_ATTRIBUTES*,ULONG,ULONG,RTL_USER_PROCESS_PARAMETERS*,PS_CREATE_INFO*,PS_ATTRIBUTE_LIST*);
-NTSYSAPI NTSTATUS  WINAPI NtDebugActiveProcess(HANDLE,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtDebugContinue(HANDLE,CLIENT_ID*,NTSTATUS);
-NTSYSAPI NTSTATUS  WINAPI NtDelayExecution(BOOLEAN,const LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtDeleteAtom(RTL_ATOM);
-NTSYSAPI NTSTATUS  WINAPI NtDeleteFile(POBJECT_ATTRIBUTES);
-NTSYSAPI NTSTATUS  WINAPI NtDeleteKey(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtDeleteValueKey(HANDLE,const UNICODE_STRING *);
-NTSYSAPI NTSTATUS  WINAPI NtDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtDisplayString(PUNICODE_STRING);
-NTSYSAPI NTSTATUS  WINAPI NtDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
-NTSYSAPI NTSTATUS  WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtCreateUserProcess(HANDLE*,HANDLE*,ACCESS_MASK,ACCESS_MASK,OBJECT_ATTRIBUTES*,OBJECT_ATTRIBUTES*,ULONG,ULONG,RTL_USER_PROCESS_PARAMETERS*,PS_CREATE_INFO*,PS_ATTRIBUTE_LIST*);
+NTSYSAPI NTSTATUS  SYSCALL NtDebugActiveProcess(HANDLE,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtDebugContinue(HANDLE,CLIENT_ID*,NTSTATUS);
+NTSYSAPI NTSTATUS  SYSCALL NtDelayExecution(BOOLEAN,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtDeleteAtom(RTL_ATOM);
+NTSYSAPI NTSTATUS  SYSCALL NtDeleteFile(POBJECT_ATTRIBUTES);
+NTSYSAPI NTSTATUS  SYSCALL NtDeleteKey(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtDeleteValueKey(HANDLE,const UNICODE_STRING *);
+NTSYSAPI NTSTATUS  SYSCALL NtDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtDisplayString(PUNICODE_STRING);
+NTSYSAPI NTSTATUS  SYSCALL NtDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
+NTSYSAPI NTSTATUS  SYSCALL NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtFilterToken(HANDLE,ULONG,TOKEN_GROUPS*,TOKEN_PRIVILEGES*,TOKEN_GROUPS*,HANDLE*);
-NTSYSAPI NTSTATUS  WINAPI NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
-NTSYSAPI NTSTATUS  WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
-NTSYSAPI NTSTATUS  WINAPI NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
-NTSYSAPI NTSTATUS  WINAPI NtFlushKey(HANDLE);
-NTSYSAPI void      WINAPI NtFlushProcessWriteBuffers(void);
-NTSYSAPI NTSTATUS  WINAPI NtFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtFilterToken(HANDLE,ULONG,TOKEN_GROUPS*,TOKEN_PRIVILEGES*,TOKEN_GROUPS*,HANDLE*);
+NTSYSAPI NTSTATUS  SYSCALL NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
+NTSYSAPI NTSTATUS  SYSCALL NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
+NTSYSAPI NTSTATUS  SYSCALL NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
+NTSYSAPI NTSTATUS  SYSCALL NtFlushKey(HANDLE);
+NTSYSAPI void      SYSCALL NtFlushProcessWriteBuffers(void);
+NTSYSAPI NTSTATUS  SYSCALL NtFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
 NTSYSAPI NTSTATUS  WINAPI NtFlushWriteBuffer(VOID);
-NTSYSAPI NTSTATUS  WINAPI NtFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtGetContextThread(HANDLE,CONTEXT*);
-NTSYSAPI ULONG     WINAPI NtGetCurrentProcessorNumber(void);
-NTSYSAPI NTSTATUS  WINAPI NtGetNextThread(HANDLE,HANDLE,ACCESS_MASK,ULONG,ULONG,HANDLE*);
-NTSYSAPI NTSTATUS  WINAPI NtGetNlsSectionPtr(ULONG,ULONG,void*,void**,SIZE_T*);
+NTSYSAPI NTSTATUS  SYSCALL NtFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtGetContextThread(HANDLE,CONTEXT*);
+NTSYSAPI ULONG     SYSCALL NtGetCurrentProcessorNumber(void);
+NTSYSAPI NTSTATUS  SYSCALL NtGetNextThread(HANDLE,HANDLE,ACCESS_MASK,ULONG,ULONG,HANDLE*);
+NTSYSAPI NTSTATUS  SYSCALL NtGetNlsSectionPtr(ULONG,ULONG,void*,void**,SIZE_T*);
 NTSYSAPI NTSTATUS  WINAPI NtGetPlugPlayEvent(ULONG,ULONG,PVOID,ULONG);
 NTSYSAPI ULONG     WINAPI NtGetTickCount(VOID);
-NTSYSAPI NTSTATUS  WINAPI NtGetWriteWatch(HANDLE,ULONG,PVOID,SIZE_T,PVOID*,ULONG_PTR*,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtImpersonateAnonymousToken(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtGetWriteWatch(HANDLE,ULONG,PVOID,SIZE_T,PVOID*,ULONG_PTR*,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtImpersonateAnonymousToken(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtImpersonateClientOfPort(HANDLE,PPORT_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtImpersonateThread(HANDLE,HANDLE,PSECURITY_QUALITY_OF_SERVICE);
-NTSYSAPI NTSTATUS  WINAPI NtInitializeNlsFiles(void**,LCID*,LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtInitializeNlsFiles(void**,LCID*,LARGE_INTEGER*);
 NTSYSAPI NTSTATUS  WINAPI NtInitializeRegistry(BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtIsProcessInJob(HANDLE,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtListenPort(HANDLE,PLPC_MESSAGE);
-NTSYSAPI NTSTATUS  WINAPI NtLoadDriver(const UNICODE_STRING *);
-NTSYSAPI NTSTATUS  WINAPI NtLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
-NTSYSAPI NTSTATUS  WINAPI NtLoadKey2(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtLoadKeyEx(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *,ULONG,HANDLE,HANDLE,ACCESS_MASK,HANDLE *,IO_STATUS_BLOCK *);
-NTSYSAPI NTSTATUS  WINAPI NtLockFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,ULONG*,BOOLEAN,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtMakeTemporaryObject(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG_PTR,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtMapViewOfSectionEx(HANDLE,HANDLE,PVOID*,const LARGE_INTEGER*,SIZE_T*,ULONG,ULONG,MEM_EXTENDED_PARAMETER*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtNotifyChangeDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,ULONG,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtNotifyChangeMultipleKeys(HANDLE,ULONG,OBJECT_ATTRIBUTES*,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtOpenDirectoryObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
+NTSYSAPI NTSTATUS  SYSCALL NtInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtIsProcessInJob(HANDLE,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtListenPort(HANDLE,PLPC_MESSAGE);
+NTSYSAPI NTSTATUS  SYSCALL NtLoadDriver(const UNICODE_STRING *);
+NTSYSAPI NTSTATUS  SYSCALL NtLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
+NTSYSAPI NTSTATUS  SYSCALL NtLoadKey2(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtLoadKeyEx(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *,ULONG,HANDLE,HANDLE,ACCESS_MASK,HANDLE *,IO_STATUS_BLOCK *);
+NTSYSAPI NTSTATUS  SYSCALL NtLockFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,ULONG*,BOOLEAN,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtMakeTemporaryObject(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG_PTR,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtMapViewOfSectionEx(HANDLE,HANDLE,PVOID*,const LARGE_INTEGER*,SIZE_T*,ULONG,ULONG,MEM_EXTENDED_PARAMETER*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtNotifyChangeDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,ULONG,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtNotifyChangeMultipleKeys(HANDLE,ULONG,OBJECT_ATTRIBUTES*,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenDirectoryObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
 NTSYSAPI NTSTATUS  WINAPI NtOpenEventPair(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtOpenIoCompletion(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
-NTSYSAPI NTSTATUS  WINAPI NtOpenKeyEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtOpenKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtOpenKeyTransactedEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtOpenKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenMutant(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenIoCompletion(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenKeyEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenKeyTransactedEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenMutant(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
 NTSYSAPI NTSTATUS  WINAPI NtOpenObjectAuditAlarm(PUNICODE_STRING,PHANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,ACCESS_MASK,PPRIVILEGE_SET,BOOLEAN,BOOLEAN,PBOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenProcessToken(HANDLE,DWORD,HANDLE *);
-NTSYSAPI NTSTATUS  WINAPI NtOpenProcessTokenEx(HANDLE,DWORD,DWORD,HANDLE *);
-NTSYSAPI NTSTATUS  WINAPI NtOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
-NTSYSAPI NTSTATUS  WINAPI NtOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
-NTSYSAPI NTSTATUS  WINAPI NtOpenThreadTokenEx(HANDLE,DWORD,BOOLEAN,DWORD,HANDLE *);
-NTSYSAPI NTSTATUS  WINAPI NtOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
-NTSYSAPI NTSTATUS  WINAPI NtPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtPrivilegeCheck(HANDLE,PPRIVILEGE_SET,PBOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenProcessToken(HANDLE,DWORD,HANDLE *);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenProcessTokenEx(HANDLE,DWORD,DWORD,HANDLE *);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenThreadTokenEx(HANDLE,DWORD,BOOLEAN,DWORD,HANDLE *);
+NTSYSAPI NTSTATUS  SYSCALL NtOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
+NTSYSAPI NTSTATUS  SYSCALL NtPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtPrivilegeCheck(HANDLE,PPRIVILEGE_SET,PBOOLEAN);
 NTSYSAPI NTSTATUS  WINAPI NtPrivilegeObjectAuditAlarm(PUNICODE_STRING,HANDLE,HANDLE,ULONG,PPRIVILEGE_SET,BOOLEAN);
 NTSYSAPI NTSTATUS  WINAPI NtPrivilegedServiceAuditAlarm(PUNICODE_STRING,PUNICODE_STRING,HANDLE,PPRIVILEGE_SET,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtProtectVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtPulseEvent(HANDLE,LONG*);
-NTSYSAPI NTSTATUS  WINAPI NtQueueApcThread(HANDLE,PNTAPCFUNC,ULONG_PTR,ULONG_PTR,ULONG_PTR);
-NTSYSAPI NTSTATUS  WINAPI NtQueryAttributesFile(const OBJECT_ATTRIBUTES*,FILE_BASIC_INFORMATION*);
-NTSYSAPI NTSTATUS  WINAPI NtQueryDefaultLocale(BOOLEAN,LCID*);
-NTSYSAPI NTSTATUS  WINAPI NtQueryDefaultUILanguage(LANGID*);
-NTSYSAPI NTSTATUS  WINAPI NtQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PULONG,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtQueryEvent(HANDLE,EVENT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInformationAtom(RTL_ATOM,ATOM_INFORMATION_CLASS,PVOID,ULONG,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtProtectVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtPulseEvent(HANDLE,LONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueueApcThread(HANDLE,PNTAPCFUNC,ULONG_PTR,ULONG_PTR,ULONG_PTR);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryAttributesFile(const OBJECT_ATTRIBUTES*,FILE_BASIC_INFORMATION*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryDefaultLocale(BOOLEAN,LCID*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryDefaultUILanguage(LANGID*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PULONG,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryEvent(HANDLE,EVENT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInformationAtom(RTL_ATOM,ATOM_INFORMATION_CLASS,PVOID,ULONG,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG,PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtQueryInformationPort(HANDLE,PORT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryInstallUILanguage(LANGID*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryInstallUILanguage(LANGID*);
 NTSYSAPI NTSTATUS  WINAPI NtQueryIntervalProfile(KPROFILE_SOURCE,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryIoCompletion(HANDLE,IO_COMPLETION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
-NTSYSAPI NTSTATUS  WINAPI NtQueryMultipleValueKey(HANDLE,PKEY_MULTIPLE_VALUE_INFORMATION,ULONG,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryMutant(HANDLE,MUTANT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryIoCompletion(HANDLE,IO_COMPLETION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryMultipleValueKey(HANDLE,PKEY_MULTIPLE_VALUE_INFORMATION,ULONG,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryMutant(HANDLE,MUTANT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtQueryOpenSubKeys(POBJECT_ATTRIBUTES,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryPerformanceCounter(PLARGE_INTEGER, PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySemaphore(HANDLE,SEMAPHORE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySystemEnvironmentValue(PUNICODE_STRING,PWCHAR,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySystemEnvironmentValueEx(PUNICODE_STRING,GUID*,void*,ULONG*,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySystemInformationEx(SYSTEM_INFORMATION_CLASS,void*,ULONG,void*,ULONG,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtQuerySystemTime(PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtQueryTimer(HANDLE,TIMER_INFORMATION_CLASS,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryTimerResolution(PULONG,PULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
-NTSYSAPI NTSTATUS  WINAPI NtQueryLicenseValue(const UNICODE_STRING *,ULONG *,PVOID,ULONG,ULONG *);
-NTSYSAPI NTSTATUS  WINAPI NtQueryVirtualMemory(HANDLE,LPCVOID,MEMORY_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
-NTSYSAPI NTSTATUS  WINAPI NtQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
-NTSYSAPI NTSTATUS  WINAPI NtRaiseException(PEXCEPTION_RECORD,PCONTEXT,BOOL);
-NTSYSAPI NTSTATUS  WINAPI NtRaiseHardError(NTSTATUS,ULONG,PUNICODE_STRING,PVOID*,HARDERROR_RESPONSE_OPTION,PHARDERROR_RESPONSE);
-NTSYSAPI NTSTATUS  WINAPI NtReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtReadFileScatter(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryPerformanceCounter(PLARGE_INTEGER, PLARGE_INTEGER);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySemaphore(HANDLE,SEMAPHORE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySystemEnvironmentValue(PUNICODE_STRING,PWCHAR,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySystemEnvironmentValueEx(PUNICODE_STRING,GUID*,void*,ULONG*,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySystemInformationEx(SYSTEM_INFORMATION_CLASS,void*,ULONG,void*,ULONG,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtQuerySystemTime(PLARGE_INTEGER);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryTimer(HANDLE,TIMER_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryTimerResolution(PULONG,PULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryLicenseValue(const UNICODE_STRING *,ULONG *,PVOID,ULONG,ULONG *);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryVirtualMemory(HANDLE,LPCVOID,MEMORY_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
+NTSYSAPI NTSTATUS  SYSCALL NtQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
+NTSYSAPI NTSTATUS  SYSCALL NtRaiseException(PEXCEPTION_RECORD,PCONTEXT,BOOL);
+NTSYSAPI NTSTATUS  SYSCALL NtRaiseHardError(NTSTATUS,ULONG,PUNICODE_STRING,PVOID*,HARDERROR_RESPONSE_OPTION,PHARDERROR_RESPONSE);
+NTSYSAPI NTSTATUS  SYSCALL NtReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtReadFileScatter(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtReadRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtReadVirtualMemory(HANDLE,const void*,void*,SIZE_T,SIZE_T*);
-NTSYSAPI NTSTATUS  WINAPI NtRegisterThreadTerminatePort(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtReleaseKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtReleaseMutant(HANDLE,PLONG);
-NTSYSAPI NTSTATUS  WINAPI NtReleaseSemaphore(HANDLE,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtRemoveIoCompletion(HANDLE,PULONG_PTR,PULONG_PTR,PIO_STATUS_BLOCK,PLARGE_INTEGER);
-NTSYSAPI NTSTATUS  WINAPI NtRemoveIoCompletionEx(HANDLE,FILE_IO_COMPLETION_INFORMATION*,ULONG,ULONG*,LARGE_INTEGER*,BOOLEAN);
-NTSYSAPI NTSTATUS  WINAPI NtRemoveProcessDebug(HANDLE,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtRenameKey(HANDLE,UNICODE_STRING*);
-NTSYSAPI NTSTATUS  WINAPI NtReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
+NTSYSAPI NTSTATUS  SYSCALL NtReadVirtualMemory(HANDLE,const void*,void*,SIZE_T,SIZE_T*);
+NTSYSAPI NTSTATUS  SYSCALL NtRegisterThreadTerminatePort(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtReleaseKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtReleaseMutant(HANDLE,PLONG);
+NTSYSAPI NTSTATUS  SYSCALL NtReleaseSemaphore(HANDLE,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtRemoveIoCompletion(HANDLE,PULONG_PTR,PULONG_PTR,PIO_STATUS_BLOCK,PLARGE_INTEGER);
+NTSYSAPI NTSTATUS  SYSCALL NtRemoveIoCompletionEx(HANDLE,FILE_IO_COMPLETION_INFORMATION*,ULONG,ULONG*,LARGE_INTEGER*,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtRemoveProcessDebug(HANDLE,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtRenameKey(HANDLE,UNICODE_STRING*);
+NTSYSAPI NTSTATUS  SYSCALL NtReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
 NTSYSAPI NTSTATUS  WINAPI NtReplyPort(HANDLE,PLPC_MESSAGE);
-NTSYSAPI NTSTATUS  WINAPI NtReplyWaitReceivePort(HANDLE,PULONG,PLPC_MESSAGE,PLPC_MESSAGE);
+NTSYSAPI NTSTATUS  SYSCALL NtReplyWaitReceivePort(HANDLE,PULONG,PLPC_MESSAGE,PLPC_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtReplyWaitReceivePortEx(HANDLE,PVOID*,PPORT_MESSAGE,PPORT_MESSAGE,PLARGE_INTEGER);
 NTSYSAPI NTSTATUS  WINAPI NtReplyWaitReplyPort(HANDLE,PLPC_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtRequestPort(HANDLE,PLPC_MESSAGE);
-NTSYSAPI NTSTATUS  WINAPI NtRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
-NTSYSAPI NTSTATUS  WINAPI NtResetEvent(HANDLE,LONG*);
-NTSYSAPI NTSTATUS  WINAPI NtResetWriteWatch(HANDLE,PVOID,SIZE_T);
-NTSYSAPI NTSTATUS  WINAPI NtRestoreKey(HANDLE,HANDLE,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtResumeProcess(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtResumeThread(HANDLE,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSaveKey(HANDLE,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetContextThread(HANDLE,const CONTEXT*);
-NTSYSAPI NTSTATUS  WINAPI NtSetDebugFilterState(ULONG,ULONG,BOOLEAN);
+NTSYSAPI NTSTATUS  SYSCALL NtRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
+NTSYSAPI NTSTATUS  SYSCALL NtResetEvent(HANDLE,LONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtResetWriteWatch(HANDLE,PVOID,SIZE_T);
+NTSYSAPI NTSTATUS  SYSCALL NtRestoreKey(HANDLE,HANDLE,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtResumeProcess(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtResumeThread(HANDLE,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSaveKey(HANDLE,HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetContextThread(HANDLE,const CONTEXT*);
+NTSYSAPI NTSTATUS  SYSCALL NtSetDebugFilterState(ULONG,ULONG,BOOLEAN);
 NTSYSAPI NTSTATUS  WINAPI NtSetDefaultHardErrorPort(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtSetDefaultLocale(BOOLEAN,LCID);
-NTSYSAPI NTSTATUS  WINAPI NtSetDefaultUILanguage(LANGID);
-NTSYSAPI NTSTATUS  WINAPI NtSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetEvent(HANDLE,LONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtSetDefaultLocale(BOOLEAN,LCID);
+NTSYSAPI NTSTATUS  SYSCALL NtSetDefaultUILanguage(LANGID);
+NTSYSAPI NTSTATUS  SYSCALL NtSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetEvent(HANDLE,LONG*);
 NTSYSAPI NTSTATUS  WINAPI NtSetHighEventPair(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtSetHighWaitLowEventPair(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtSetHighWaitLowThread(VOID);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationDebugObject(HANDLE,DEBUGOBJECTINFOCLASS,PVOID,ULONG,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationKey(HANDLE,const int,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetInformationVirtualMemory(HANDLE,VIRTUAL_MEMORY_INFORMATION_CLASS,ULONG_PTR,PMEMORY_RANGE_ENTRY,PVOID,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetIntervalProfile(ULONG,KPROFILE_SOURCE);
-NTSYSAPI NTSTATUS  WINAPI NtSetIoCompletion(HANDLE,ULONG_PTR,ULONG_PTR,NTSTATUS,SIZE_T);
-NTSYSAPI NTSTATUS  WINAPI NtSetLdtEntries(ULONG,LDT_ENTRY,ULONG,LDT_ENTRY);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationDebugObject(HANDLE,DEBUGOBJECTINFOCLASS,PVOID,ULONG,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationKey(HANDLE,const int,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetInformationVirtualMemory(HANDLE,VIRTUAL_MEMORY_INFORMATION_CLASS,ULONG_PTR,PMEMORY_RANGE_ENTRY,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetIntervalProfile(ULONG,KPROFILE_SOURCE);
+NTSYSAPI NTSTATUS  SYSCALL NtSetIoCompletion(HANDLE,ULONG_PTR,ULONG_PTR,NTSTATUS,SIZE_T);
+NTSYSAPI NTSTATUS  SYSCALL NtSetLdtEntries(ULONG,LDT_ENTRY,ULONG,LDT_ENTRY);
 NTSYSAPI NTSTATUS  WINAPI NtSetLowEventPair(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtSetLowWaitHighEventPair(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtSetLowWaitHighThread(VOID);
-NTSYSAPI NTSTATUS  WINAPI NtSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
+NTSYSAPI NTSTATUS  SYSCALL NtSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
 NTSYSAPI NTSTATUS  WINAPI NtSetSystemEnvironmentValue(PUNICODE_STRING,PUNICODE_STRING);
-NTSYSAPI NTSTATUS  WINAPI NtSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
 NTSYSAPI NTSTATUS  WINAPI NtSetSystemPowerState(POWER_ACTION,SYSTEM_POWER_STATE,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtSetThreadExecutionState(EXECUTION_STATE,EXECUTION_STATE*);
-NTSYSAPI NTSTATUS  WINAPI NtSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
-NTSYSAPI NTSTATUS  WINAPI NtSetTimerResolution(ULONG,BOOLEAN,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
-NTSYSAPI NTSTATUS  WINAPI NtSignalAndWaitForSingleObject(HANDLE,HANDLE,BOOLEAN,const LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtShutdownSystem(SHUTDOWN_ACTION);
+NTSYSAPI NTSTATUS  SYSCALL NtSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtSetThreadExecutionState(EXECUTION_STATE,EXECUTION_STATE*);
+NTSYSAPI NTSTATUS  SYSCALL NtSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
+NTSYSAPI NTSTATUS  SYSCALL NtSetTimerResolution(ULONG,BOOLEAN,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
+NTSYSAPI NTSTATUS  SYSCALL NtSignalAndWaitForSingleObject(HANDLE,HANDLE,BOOLEAN,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtShutdownSystem(SHUTDOWN_ACTION);
 NTSYSAPI NTSTATUS  WINAPI NtStartProfile(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtStopProfile(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtSuspendProcess(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtSuspendThread(HANDLE,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtSystemDebugControl(SYSDBG_COMMAND,PVOID,ULONG,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtTerminateJobObject(HANDLE,NTSTATUS);
-NTSYSAPI NTSTATUS  WINAPI NtTerminateProcess(HANDLE,LONG);
-NTSYSAPI NTSTATUS  WINAPI NtTerminateThread(HANDLE,LONG);
-NTSYSAPI NTSTATUS  WINAPI NtTestAlert(VOID);
-NTSYSAPI NTSTATUS  WINAPI NtTraceControl(ULONG,void*,ULONG,void*,ULONG,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtUnloadDriver(const UNICODE_STRING *);
-NTSYSAPI NTSTATUS  WINAPI NtUnloadKey(POBJECT_ATTRIBUTES);
+NTSYSAPI NTSTATUS  SYSCALL NtSuspendProcess(HANDLE);
+NTSYSAPI NTSTATUS  SYSCALL NtSuspendThread(HANDLE,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtSystemDebugControl(SYSDBG_COMMAND,PVOID,ULONG,PVOID,ULONG,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtTerminateJobObject(HANDLE,NTSTATUS);
+NTSYSAPI NTSTATUS  SYSCALL NtTerminateProcess(HANDLE,LONG);
+NTSYSAPI NTSTATUS  SYSCALL NtTerminateThread(HANDLE,LONG);
+NTSYSAPI NTSTATUS  SYSCALL NtTestAlert(VOID);
+NTSYSAPI NTSTATUS  SYSCALL NtTraceControl(ULONG,void*,ULONG,void*,ULONG,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtUnloadDriver(const UNICODE_STRING *);
+NTSYSAPI NTSTATUS  SYSCALL NtUnloadKey(POBJECT_ATTRIBUTES);
 NTSYSAPI NTSTATUS  WINAPI NtUnloadKeyEx(POBJECT_ATTRIBUTES,HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtUnlockFile(HANDLE,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtUnlockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtUnmapViewOfSection(HANDLE,PVOID);
-NTSYSAPI NTSTATUS  WINAPI NtUnmapViewOfSectionEx(HANDLE,PVOID,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtUnlockFile(HANDLE,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtUnlockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtUnmapViewOfSection(HANDLE,PVOID);
+NTSYSAPI NTSTATUS  SYSCALL NtUnmapViewOfSectionEx(HANDLE,PVOID,ULONG);
 NTSYSAPI NTSTATUS  WINAPI NtVdmControl(ULONG,PVOID);
-NTSYSAPI NTSTATUS  WINAPI NtWaitForAlertByThreadId(const void*,const LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtWaitForDebugEvent(HANDLE,BOOLEAN,LARGE_INTEGER*,DBGUI_WAIT_STATE_CHANGE*);
-NTSYSAPI NTSTATUS  WINAPI NtWaitForKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
-NTSYSAPI NTSTATUS  WINAPI NtWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtWaitForAlertByThreadId(const void*,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtWaitForDebugEvent(HANDLE,BOOLEAN,LARGE_INTEGER*,DBGUI_WAIT_STATE_CHANGE*);
+NTSYSAPI NTSTATUS  SYSCALL NtWaitForKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
+NTSYSAPI NTSTATUS  SYSCALL NtWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
 NTSYSAPI NTSTATUS  WINAPI NtWaitHighEventPair(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtWaitLowEventPair(HANDLE);
-NTSYSAPI NTSTATUS  WINAPI NtWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtWriteFileGather(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtWriteFileGather(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtWriteRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG);
-NTSYSAPI NTSTATUS  WINAPI NtWriteVirtualMemory(HANDLE,void*,const void*,SIZE_T,SIZE_T*);
-NTSYSAPI NTSTATUS  WINAPI NtYieldExecution(void);
+NTSYSAPI NTSTATUS  SYSCALL NtWriteVirtualMemory(HANDLE,void*,const void*,SIZE_T,SIZE_T*);
+NTSYSAPI NTSTATUS  SYSCALL NtYieldExecution(void);
NTSYSAPI NTSTATUS  WINAPI RtlAbsoluteToSelfRelativeSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PULONG);
 NTSYSAPI void      WINAPI RtlAcquirePebLock(void);
@@ -4632,10 +4632,10 @@ NTSYSAPI NTSTATUS  WINAPI RtlWow64GetThreadContext(HANDLE,WOW64_CONTEXT*);
 NTSYSAPI NTSTATUS  WINAPI RtlWow64GetThreadSelectorEntry(HANDLE,THREAD_DESCRIPTOR_INFORMATION*,ULONG,ULONG*);
 NTSYSAPI NTSTATUS  WINAPI RtlWow64SetThreadContext(HANDLE,const WOW64_CONTEXT*);
 #else
-NTSYSAPI NTSTATUS  WINAPI NtWow64AllocateVirtualMemory64(HANDLE,ULONG64*,ULONG64,ULONG64*,ULONG,ULONG);
-NTSYSAPI NTSTATUS  WINAPI NtWow64GetNativeSystemInformation(SYSTEM_INFORMATION_CLASS,void*,ULONG,ULONG*);
-NTSYSAPI NTSTATUS  WINAPI NtWow64ReadVirtualMemory64(HANDLE,ULONG64,void*,ULONG64,ULONG64*);
-NTSYSAPI NTSTATUS  WINAPI NtWow64WriteVirtualMemory64(HANDLE,ULONG64,const void*,ULONG64,ULONG64*);
+NTSYSAPI NTSTATUS  SYSCALL NtWow64AllocateVirtualMemory64(HANDLE,ULONG64*,ULONG64,ULONG64*,ULONG,ULONG);
+NTSYSAPI NTSTATUS  SYSCALL NtWow64GetNativeSystemInformation(SYSTEM_INFORMATION_CLASS,void*,ULONG,ULONG*);
+NTSYSAPI NTSTATUS  SYSCALL NtWow64ReadVirtualMemory64(HANDLE,ULONG64,void*,ULONG64,ULONG64*);
+NTSYSAPI NTSTATUS  SYSCALL NtWow64WriteVirtualMemory64(HANDLE,ULONG64,const void*,ULONG64,ULONG64*);
 NTSYSAPI LONGLONG  WINAPI RtlConvertLongToLargeInteger(LONG);
 NTSYSAPI ULONGLONG WINAPI RtlConvertUlongToLargeInteger(ULONG);
 NTSYSAPI LONGLONG  WINAPI RtlEnlargedIntegerMultiply(INT,INT);
@@ -4695,9 +4695,9 @@ NTSYSAPI void      WINAPI TpWaitForWork(TP_WORK *,BOOL);
/* Wine internal functions */
-NTSYSAPI NTSTATUS WINAPI wine_nt_to_unix_file_name( const OBJECT_ATTRIBUTES *attr, char *nameA, ULONG *size,
+NTSYSAPI NTSTATUS SYSCALL wine_nt_to_unix_file_name( const OBJECT_ATTRIBUTES *attr, char *nameA, ULONG *size,
                                                     UINT disposition );
-NTSYSAPI NTSTATUS WINAPI wine_unix_to_nt_file_name( const char *name, WCHAR *buffer, ULONG *size );
+NTSYSAPI NTSTATUS SYSCALL wine_unix_to_nt_file_name( const char *name, WCHAR *buffer, ULONG *size );
/***********************************************************************
@@ -4787,7 +4787,7 @@ static inline PLIST_ENTRY RemoveTailList(PLIST_ENTRY le)
/* Wine internal functions */
-extern NTSTATUS WINAPI __wine_unix_spawnvp( char * const argv[], int wait );
+extern NTSTATUS SYSCALL __wine_unix_spawnvp( char * const argv[], int wait );
/* The thread information for 16-bit threads */
 /* NtCurrentTeb()->SubSystemTib points to this */
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/1752

    

2025

2024

2023

2022

[PATCH v2 2/7] ntdll: Make syscalls use the SYSCALL calling convention.