Yes, but the Native API is NTDLL, a userspace wrapper around the system calls. On Windows nothing except NTDLL is meant to invoke system calls directly, and my

Yes, but the Native API is NTDLL, a userspace wrapper around the system calls. On Windows nothing except NTDLL is meant to invoke system calls directly, and my experience was that this is basically true. Some apps will bypass the Win32 subsystem and link against NTDLL directly (which they aren't meant to do), but outside of a handful of very obfuscated video game DRM systems and malware, not much is invoking system calls directly. Changes to the system calls to close exploits are clear, but I'm really curious what software is invoking NtLoadKey directly that Microsoft themselves can't change, and then kept doing it even as the system call evolved over time. These aren't documented even in headers so it takes some reverse engineering to be able to do that.