> Представляете, у NT есть native api, оно отличается от WinAPI.

$ grep Nt wine/dlls/ntoskrnl.exe/tests/ntoskrnl.c
static BOOL (WINAPI *pRtlDosPathNameToNtPathName_U)(const WCHAR *, UNICODE_STRING *, WCHAR **, CURDIR *);
    test_input->teststr_offset = (SIZE_T)((BYTE *)&teststr - (BYTE *)NtCurrentTeb()->Peb->ImageBaseAddress);
        ok(GetLastError() == RtlNtStatusToDosError(expect_status), "got error %u\n", GetLastError());
    ret = NtDeviceIoControlFile(device, NULL, NULL, NULL, &io,
    ret = NtDeviceIoControlFile(file, event, NULL, (void *)456, &io,
    ret = NtRemoveIoCompletion(port, &key, &value, &io, &zero);
    ret = NtDeviceIoControlFile(file, event, NULL, NULL, &io,
    ret = NtDeviceIoControlFile(file, NULL, NULL, NULL, &io,
        ret = NtDeviceIoControlFile(file, event, NULL, (void *)456, &io,
        ret = NtRemoveIoCompletion(port, &key, &value, &io, &zero);
    ret = NtDeviceIoControlFile(file, NULL, return_status_apc, (void *)456, &io,
    status = NtQueryObject(device, ObjectNameInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryObject(device, ObjectTypeInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryInformationFile(device, &io, buffer, sizeof(buffer), FileNameInformation);
    status = NtQueryVolumeInformationFile(device, &io, buffer, sizeof(buffer), FileFsVolumeInformation);
    status = NtQueryObject(file, ObjectNameInformation, buffer, sizeof(buffer), &size);
    status = NtQueryObject(file, ObjectNameInformation, buffer, size - 2, &size);
    status = NtQueryObject(file, ObjectNameInformation, buffer, sizeof(*name_info), &size);
    status = NtQueryObject(file, ObjectTypeInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryInformationFile(file, &io, buffer, sizeof(buffer), FileNameInformation);
    status = NtQueryVolumeInformationFile(file, &io, buffer, sizeof(buffer), FileFsVolumeInformation);
    status = NtQueryVolumeInformationFile(file, &io, buffer, sizeof(buffer), FileFsAttributeInformation);
    status = NtQueryObject(file, ObjectNameInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryInformationFile(file, &io, buffer, sizeof(buffer), FileNameInformation);
    status = NtQueryObject(file, ObjectNameInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryInformationFile(file, &io, buffer, sizeof(buffer), FileNameInformation);
    status = NtQueryObject(file, ObjectNameInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryInformationFile(file, &io, buffer, sizeof(buffer), FileNameInformation);
    status = NtQueryObject(file, ObjectNameInformation, buffer, sizeof(buffer), NULL);
    status = NtQueryInformationFile(file, &io, buffer, sizeof(buffer), FileNameInformation);
    status = NtQueryVolumeInformationFile(file, &io, buffer, sizeof(buffer), FileFsSizeInformation);
    status = NtQueryVolumeInformationFile(file, &io, buffer, sizeof(buffer), FileFsFullSizeInformation);
    status = NtQueryVolumeInformationFile(file, &io, buffer, sizeof(buffer), FileFsSizeInformation);
    status = NtQueryVolumeInformationFile(file, &io, buffer, sizeof(buffer), FileFsFullSizeInformation);
    ret = NtOpenFile(&child, SYNCHRONIZE, &attr, &io, 0, FILE_SYNCHRONOUS_IO_NONALERT);
    ret = NtOpenFile(&child, SYNCHRONIZE, &attr, &io, 0, 0);
    ret = NtOpenFile(&tmp, SYNCHRONIZE, &attr, &io, 0, FILE_SYNCHRONOUS_IO_NONALERT);
    ret = NtOpenFile(&tmp, SYNCHRONIZE, &attr, &io, 0, FILE_SYNCHRONOUS_IO_NONALERT);
    pRtlDosPathNameToNtPathName_U = (void *)GetProcAddress(GetModuleHandleA("ntdll"), "RtlDosPathNameToNtPathName_U");