Therefore, a few Windows components, such as the Client/Server Runtime Subsystem (CSRSS), are implemented using the Native API.
Native API calls are handled by the kernel via the System Service Descriptor Table (SSDT).
Other common procedures like malloc(), printf(), scanf() are missing (the first because it does not specify a heap to allocate memory from and the second and third because they use the console, accessed only via KERNEL32.DLL).
The vast majority of other Native API routines, by convention, have a 2 or 3 letter prefix, which is: user32.dll and gdi32.dll include several other calls that execute an interrupt into kernel mode.
However, due to performance issues of hardware of that age, it was decided to move the graphics subsystem into kernel mode.