title: Windows Native API: When and why use Zw vs Nt prefixed api calls?
body: <p>In Native API Microsoft exports two versions of each api call, one prefixed with Zw and one with Nt, for eg. ZwCreateThread and NtCreateThread.</p>
  
  <p>My question is what is the difference between those two versions of the calls and when and why one should use Zw or Nt exclusively?
  To my understanding Zw version ensures that the caller resides in kernel mode, whereas Nt doesn't.</p>
  
  <p>I am also wondering about the specific meaning for Zw and Nt prefixes/abbreviations?
  One can guess Nt probably refers to NT(New Technology) Windows family or Native(probably not)?
  As for Zw, does it stand for something? </p>