NtCreateProcessStateChange

Process → NTSTATUS

NtCreateProcessStateChange is a Windows NT kernel system call, in the Process category, returning NTSTATUS. Its syscall number is not the same on every Windows release: across the 8 version-and-architecture pairs recorded here it takes 5 distinct values, from 0x00BD to 0x00C1.

The number is an index into the system service table of one particular build, not a stable identifier, so it is not portable between Windows versions. The table below gives the value recorded for each.

Numbers across OS versions (8)

OS VersionArchitectureNumber
Windows 11 and Server 11 21H2 x64 0x00BE (190)
Windows 11 and Server 11 22H2 x64 0x00BF (191)
Windows 11 and Server 11 23H2 x64 0x00BF (191)
Windows 11 and Server 11 24H2 x64 0x00C1 (193)
Windows 11 and Server 11 25H2 x64 0x00C1 (193)
Windows 11 and Server Server 2022 x64 0x00BD (189)
Windows 11 and Server Server 2025 x64 0x00C1 (193)
Windows 11 and Server Server 23H2 x64 0x00C0 (192)