I've been researching on windows native api lately.But I've found that the mystery that surround the native api is not worth it because most of the working of the native api can be achieved through the use of win32 api(since each win32 api ultimately calls native api(s) to do the work).

kernel32.dll(wrapper over ntdll.dll)==calls some module in==>ntdll.dll(contains native api)==use SYSENTER==>use interrupt to communicate with hardware.

Still there are a few native api that has no counterpart in win32 api.Is there some link or book that lists this kind of api(s).
Can the readers of the thread post the native api(s) that have no counterpart in win32 api ?

i think that you can include zero byte in name of file / registry key, and thus hide it from win32-subsystem tools. but only malware does this.