Windows API - User mode matched kernel mode

Processes	User mode	Kernel mode
	NtTerminateProcess	PsTerminateProcess/PspTerminateProcess
	NtOpenProcess	PsLookupProcessByProcessId, ObOpenObjectByPointer
Threads	User mode	Kernel mode
	NtTerminateThread	PspTerminateThreadByPointer
	NtOpenThread	PsLookupThreadByThreadId, ObOpenObjectByPointer
	NtGetContextThread	PsGetContextThread
	NtSetContextThread	PsSetContextThread
Virtual memory	User mode	Kernel mode
	NtProtectVirtualMemory	MiProtectVirtualMemory
	NtReadVirtualMemory	MmCopyVirtualMemory
	NtWriteVirtualMemory	MmCopyVirtualMemory
File system	User mode	Kernel mode
	NtCreateFile	IoCreateFile
	NtDeviceIoControlFile /NtFsControlFile	IopXxxControlFile
Objects	User mode	Kernel mode
	NtClose	ObCloseHandle/ObpCloseHandle
	NtDuplicateObject	ObDuplicateObject
	NtQueryObject	ObQueryNameString
System call	User mode	Kernel mode
	KiIntSystemCall	KiSystemService
	KiFastSystemCall	KiFastCallEntry