ntdll.h

// Header file with undocumented all structures we need to make our alternative function work
// Source: https ://github.com/x64dbg/x64dbg/blob/development/src/dbg/ntdll/ntdll.h

// Alternatively, these structures are only partially available in the official winternl.h header
// but they can be found on the internet or through reverse engineering
// https://github.com/wine-mirror/wine/blob/master/include/winternl.h

#pragma once

#ifndef _NTDLL_H
#define _NTDLL_H

#pragma once

#ifdef __cplusplus
extern "C" {
#endif

#ifndef WIN32_NO_STATUS
#define WIN32_NO_STATUS
#endif
#include <Windows.h>
#undef WIN32_NO_STATUS
#include <ntstatus.h>
#include <intrin.h>

#define NT_SUCCESS(Status)              ((NTSTATUS)(Status) >= 0)
#define NT_ERROR(Status)                ((((ULONG)(Status)) >> 30) == 3)

#define FASTCALL __fastcall

#ifndef _Reserved_
#define _Reserved_
#endif

#define ALIGN_DOWN(length, type) \
    ((ULONG)(length) & ~(sizeof(type) - 1))

#define ALIGN_UP(length, type) \
    (ALIGN_DOWN(((ULONG)(length) + sizeof(type) - 1), type))

#define MIN(a,b)    (((a) < (b)) ? (a) : (b))
#define MAX(a,b)    (((a) > (b)) ? (a) : (b))

    typedef LONG NTSTATUS, * PNTSTATUS;
    typedef LONG KPRIORITY, * PKPRIORITY;
    typedef ULONG LOGICAL, * PLOGICAL;

    typedef struct _CLIENT_ID
    {
        HANDLE UniqueProcess;
        HANDLE UniqueThread;
    } CLIENT_ID, * PCLIENT_ID;

    enum KPROCESSOR_MODE
    {
        KernelMode,
        UserMode
    };

    typedef enum _KTHREAD_STATE
    {
        Initialized,
        Ready,
        Running,
        Standby,
        Terminated,
        Waiting,
        Transition,
        DeferredReady,
        GateWaitObsolete,
        WaitingForProcessInSwap,
        MaximumThreadState
    } KTHREAD_STATE, * PKTHREAD_STATE;

    typedef enum _KWAIT_REASON
    {
        Executive,
        FreePage,
        PageIn,
        PoolAllocation,
        DelayExecution,
        Suspended,
        UserRequest,
        WrExecutive,
        WrFreePage,
        WrPageIn,
        WrPoolAllocation,
        WrDelayExecution,
        WrSuspended,
        WrUserRequest,
        WrEventPair,
        WrQueue,
        WrLpcReceive,
        WrLpcReply,
        WrVirtualMemory,
        WrPageOut,
        WrRendezvous,
        WrKeyedEvent,
        WrTerminated,
        WrProcessInSwap,
        WrCpuRateControl,
        WrCalloutStack,
        WrKernel,
        WrResource,
        WrPushLock,
        WrMutex,
        WrQuantumEnd,
        WrDispatchInt,
        WrPreempted,
        WrYieldExecution,
        WrFastMutex,
        WrGuardedMutex,
        WrRundown,
        WrAlertByThreadId,
        WrDeferredPreempt,
        MaximumWaitReason
    } KWAIT_REASON;

    typedef enum _EVENT_TYPE
    {
        NotificationEvent,
        SynchronizationEvent
    } EVENT_TYPE;

    typedef enum _TIMER_TYPE
    {
        NotificationTimer,
        SynchronizationTimer
    } TIMER_TYPE;

    typedef enum _WAIT_TYPE
    {
        WaitAll,
        WaitAny,
        WaitNotification,
        WaitDequeue
    } WAIT_TYPE;

    typedef enum _SECTION_INHERIT
    {
        ViewShare = 1,
        ViewUnmap = 2
    } SECTION_INHERIT;

#define HARDERROR_OVERRIDE_ERRORMODE        0x10000000

    typedef enum _HARDERROR_RESPONSE_OPTION
    {
        OptionAbortRetryIgnore,
        OptionOk,
        OptionOkCancel,
        OptionRetryCancel,
        OptionYesNo,
        OptionYesNoCancel,
        OptionShutdownSystem,
        OptionOkNoWait,
        OptionCancelTryContinue
    } HARDERROR_RESPONSE_OPTION, * PHARDERROR_RESPONSE_OPTION;

    typedef enum _HARDERROR_RESPONSE
    {
        ResponseReturnToCaller,
        ResponseNotHandled,
        ResponseAbort,
        ResponseCancel,
        ResponseIgnore,
        ResponseNo,
        ResponseOk,
        ResponseRetry,
        ResponseYes,
        ResponseTryAgain,
        ResponseContinue
    } HARDERROR_RESPONSE, * PHARDERROR_RESPONSE;

    typedef struct _UNICODE_STRING
    {
        USHORT Length;
        USHORT MaximumLength;
        PWSTR Buffer;
    } UNICODE_STRING, * PUNICODE_STRING;
    typedef const UNICODE_STRING* PCUNICODE_STRING;

#define DECLARE_UNICODE_STRING_SIZE(_var, _size) \
WCHAR _var ## _buffer[_size]; \
__pragma(warning(push)) \
__pragma(warning(disable:4221)) __pragma(warning(disable:4204)) \
UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } \
__pragma(warning(pop))

#define DECLARE_STATIC_UNICODE_STRING_SIZE(_var, _size) \
WCHAR _var ## _buffer[_size]; \
__pragma(warning(push)) \
__pragma(warning(disable:4221)) __pragma(warning(disable:4204)) \
static UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } \
__pragma(warning(pop))

#if defined(__clang__)
#define RTL_CONSTANT_STRING(s) \
__pragma(clang diagnostic push) \
__pragma(clang diagnostic ignored "-Wwritable-strings") \
{ sizeof(s) - sizeof((s)[0]), sizeof(s), s } \
__pragma(clang diagnostic pop)
#else
#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), (PWSTR)s }
#define RTL_CONSTANT_ANSI_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), (PSTR)s }
#endif

    FORCEINLINE
        VOID
        RtlInitEmptyUnicodeString(
            _Out_ PUNICODE_STRING UnicodeString,
            _In_ PWCHAR Buffer,
            _In_ USHORT BufferSize)
    {
        UnicodeString->Length = 0;
        UnicodeString->MaximumLength = BufferSize;
        UnicodeString->Buffer = Buffer;
    }

    typedef struct _STRING
    {
        USHORT Length;
        USHORT MaximumLength;
        PCHAR Buffer;
    } ANSI_STRING, * PANSI_STRING;

    typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
    {
        ULONG SessionId;
        ULONG SizeOfBuf;
        PVOID Buffer;
    } SYSTEM_SESSION_PROCESS_INFORMATION, * PSYSTEM_SESSION_PROCESS_INFORMATION;

    typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
    {
        BOOLEAN KernelDebuggerEnabled;
        BOOLEAN KernelDebuggerNotPresent;
    } SYSTEM_KERNEL_DEBUGGER_INFORMATION, * PSYSTEM_KERNEL_DEBUGGER_INFORMATION;

    typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
    {
        BOOLEAN DebuggerAllowed;
        BOOLEAN DebuggerEnabled;
        BOOLEAN DebuggerPresent;
    } SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX, * PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX;

    typedef struct _LDT_INFORMATION
    {
        ULONG Start;
        ULONG Length;
        LDT_ENTRY LdtEntries[1];
    } PROCESS_LDT_INFORMATION, * PPROCESS_LDT_INFORMATION;

    typedef struct _KERNEL_USER_TIMES
    {
        LARGE_INTEGER CreateTime;
        LARGE_INTEGER ExitTime;
        LARGE_INTEGER KernelTime;
        LARGE_INTEGER UserTime;
    } KERNEL_USER_TIMES, * PKERNEL_USER_TIMES;

    typedef struct _SYSTEM_THREAD_INFORMATION
    {
        LARGE_INTEGER KernelTime;
        LARGE_INTEGER UserTime;
        LARGE_INTEGER CreateTime;
        ULONG WaitTime;
        PVOID StartAddress;
        CLIENT_ID ClientId;
        KPRIORITY Priority;
        LONG BasePriority;
        ULONG ContextSwitches;
        ULONG ThreadState;
        KWAIT_REASON WaitReason;
    } SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION;

    typedef struct _SYSTEM_PROCESS_INFORMATION
    {
        ULONG NextEntryOffset;
        ULONG NumberOfThreads;
        LARGE_INTEGER WorkingSetPrivateSize; // Since Vista
        ULONG HardFaultCount; // Since Windows 7
        ULONG NumberOfThreadsHighWatermark; // Since Windows 7
        ULONGLONG CycleTime; // Since Windows 7
        LARGE_INTEGER CreateTime;
        LARGE_INTEGER UserTime;
        LARGE_INTEGER KernelTime;
        UNICODE_STRING ImageName;
        KPRIORITY BasePriority;
        HANDLE UniqueProcessId;
        HANDLE InheritedFromUniqueProcessId;
        ULONG HandleCount;
        ULONG SessionId;
        ULONG_PTR UniqueProcessKey; // Since Vista (requires SystemExtendedProcessInformation)
        SIZE_T PeakVirtualSize;
        SIZE_T VirtualSize;
        ULONG PageFaultCount;
        SIZE_T PeakWorkingSetSize;
        SIZE_T WorkingSetSize;
        SIZE_T QuotaPeakPagedPoolUsage;
        SIZE_T QuotaPagedPoolUsage;
        SIZE_T QuotaPeakNonPagedPoolUsage;
        SIZE_T QuotaNonPagedPoolUsage;
        SIZE_T PagefileUsage;
        SIZE_T PeakPagefileUsage;
        SIZE_T PrivatePageCount;
        LARGE_INTEGER ReadOperationCount;
        LARGE_INTEGER WriteOperationCount;
        LARGE_INTEGER OtherOperationCount;
        LARGE_INTEGER ReadTransferCount;
        LARGE_INTEGER WriteTransferCount;
        LARGE_INTEGER OtherTransferCount;
        SYSTEM_THREAD_INFORMATION Threads[1];
    } SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;

    typedef struct _PROCESS_SESSION_INFORMATION
    {
        ULONG SessionId;
    } PROCESS_SESSION_INFORMATION, * PPROCESS_SESSION_INFORMATION;

    // File attribute values
#define FILE_ATTRIBUTE_READONLY                 0x00000001
#define FILE_ATTRIBUTE_HIDDEN                   0x00000002
#define FILE_ATTRIBUTE_SYSTEM                   0x00000004

#define FILE_ATTRIBUTE_DIRECTORY                0x00000010
#define FILE_ATTRIBUTE_ARCHIVE                  0x00000020
#define FILE_ATTRIBUTE_DEVICE                   0x00000040
#define FILE_ATTRIBUTE_NORMAL                   0x00000080

#define FILE_ATTRIBUTE_TEMPORARY                0x00000100
#define FILE_ATTRIBUTE_SPARSE_FILE              0x00000200
#define FILE_ATTRIBUTE_REPARSE_POINT            0x00000400
#define FILE_ATTRIBUTE_COMPRESSED               0x00000800

#define FILE_ATTRIBUTE_OFFLINE                  0x00001000
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED      0x00002000
#define FILE_ATTRIBUTE_ENCRYPTED                0x00004000

#define FILE_ATTRIBUTE_INTEGRITY_STREAM         0x00008000
#define FILE_ATTRIBUTE_VIRTUAL                  0x00010000
#define FILE_ATTRIBUTE_NO_SCRUB_DATA            0x00020000

#define FILE_ATTRIBUTE_EA                       0x00040000
#define FILE_ATTRIBUTE_PINNED                   0x00080000
#define FILE_ATTRIBUTE_UNPINNED                 0x00100000
#define FILE_ATTRIBUTE_RECALL_ON_OPEN           0x00040000
#define FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS    0x00400000

#if NTDDI_VERSION < NTDDI_WIN8
#define FILE_ATTRIBUTE_VALID_FLAGS              0x00007fb7
#define FILE_ATTRIBUTE_VALID_SET_FLAGS          0x000031a7
#elif NTDDI_VERSION < NTDDI_WIN10_RS2
#define FILE_ATTRIBUTE_VALID_FLAGS              0x0002ffb7
#define FILE_ATTRIBUTE_VALID_SET_FLAGS          0x000231a7
#else
#define FILE_ATTRIBUTE_VALID_FLAGS              0x005affb7
#define FILE_ATTRIBUTE_VALID_SET_FLAGS          0x001a31a7
#endif

// File create disposition values
#define FILE_SUPERSEDE                          0x00000000
#define FILE_OPEN                               0x00000001
#define FILE_CREATE                             0x00000002
#define FILE_OPEN_IF                            0x00000003
#define FILE_OVERWRITE                          0x00000004
#define FILE_OVERWRITE_IF                       0x00000005
#define FILE_MAXIMUM_DISPOSITION                0x00000005

// File create/open option flags
#define FILE_DIRECTORY_FILE                     0x00000001
#define FILE_WRITE_THROUGH                      0x00000002
#define FILE_SEQUENTIAL_ONLY                    0x00000004
#define FILE_NO_INTERMEDIATE_BUFFERING          0x00000008

#define FILE_SYNCHRONOUS_IO_ALERT               0x00000010
#define FILE_SYNCHRONOUS_IO_NONALERT            0x00000020
#define FILE_NON_DIRECTORY_FILE                 0x00000040
#define FILE_CREATE_TREE_CONNECTION             0x00000080

#define FILE_COMPLETE_IF_OPLOCKED               0x00000100
#define FILE_NO_EA_KNOWLEDGE                    0x00000200
#define FILE_OPEN_FOR_RECOVERY                  0x00000400
#define FILE_RANDOM_ACCESS                      0x00000800

#define FILE_DELETE_ON_CLOSE                    0x00001000
#define FILE_OPEN_BY_FILE_ID                    0x00002000
#define FILE_OPEN_FOR_BACKUP_INTENT             0x00004000
#define FILE_NO_COMPRESSION                     0x00008000

#if NTDDI_VERSION >= NTDDI_WIN7
#define FILE_OPEN_REQUIRING_OPLOCK              0x00010000
#define FILE_DISALLOW_EXCLUSIVE                 0x00020000
#endif
#if NTDDI_VERSION >= NTDDI_WIN8
#define FILE_SESSION_AWARE                      0x00040000
#endif

#define FILE_RESERVE_OPFILTER                   0x00100000
#define FILE_OPEN_REPARSE_POINT                 0x00200000
#define FILE_OPEN_NO_RECALL                     0x00400000
#define FILE_OPEN_FOR_FREE_SPACE_QUERY          0x00800000

#define FILE_VALID_OPTION_FLAGS                 0x00ffffff
#define FILE_VALID_PIPE_OPTION_FLAGS            0x00000032
#define FILE_VALID_MAILSLOT_OPTION_FLAGS        0x00000032
#define FILE_VALID_SET_FLAGS                    0x00000036

// Named pipe type flags
#define FILE_PIPE_BYTE_STREAM_TYPE              0x00000000
#define FILE_PIPE_MESSAGE_TYPE                  0x00000001
#define FILE_PIPE_ACCEPT_REMOTE_CLIENTS         0x00000000
#define FILE_PIPE_REJECT_REMOTE_CLIENTS         0x00000002
#define FILE_PIPE_TYPE_VALID_MASK               0x00000003

// Named pipe completion mode flags
#define FILE_PIPE_QUEUE_OPERATION               0x00000000
#define FILE_PIPE_COMPLETE_OPERATION            0x00000001

// Named pipe read mode flags
#define FILE_PIPE_BYTE_STREAM_MODE              0x00000000
#define FILE_PIPE_MESSAGE_MODE                  0x00000001

// NamedPipeConfiguration flags
#define FILE_PIPE_INBOUND                       0x00000000
#define FILE_PIPE_OUTBOUND                      0x00000001
#define FILE_PIPE_FULL_DUPLEX                   0x00000002

// NamedPipeState flags
#define FILE_PIPE_DISCONNECTED_STATE            0x00000001
#define FILE_PIPE_LISTENING_STATE               0x00000002
#define FILE_PIPE_CONNECTED_STATE               0x00000003
#define FILE_PIPE_CLOSING_STATE                 0x00000004

// NamedPipeEnd flags
#define FILE_PIPE_CLIENT_END                    0x00000000
#define FILE_PIPE_SERVER_END                    0x00000001

    typedef struct _FILE_BASIC_INFORMATION
    {
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        ULONG FileAttributes;
    } FILE_BASIC_INFORMATION, * PFILE_BASIC_INFORMATION;

    typedef struct _FILE_STANDARD_INFORMATION
    {
        LARGE_INTEGER AllocationSize;
        LARGE_INTEGER EndOfFile;
        ULONG NumberOfLinks;
        BOOLEAN DeletePending;
        BOOLEAN Directory;
    } FILE_STANDARD_INFORMATION, * PFILE_STANDARD_INFORMATION;

    typedef struct _FILE_POSITION_INFORMATION
    {
        LARGE_INTEGER CurrentByteOffset;
    } FILE_POSITION_INFORMATION, * PFILE_POSITION_INFORMATION;

    typedef struct _THREAD_BASIC_INFORMATION
    {
        NTSTATUS ExitStatus;
        PVOID TebBaseAddress;
        CLIENT_ID ClientId;
        ULONG_PTR AffinityMask;
        KPRIORITY Priority;
        LONG BasePriority;
    } THREAD_BASIC_INFORMATION, * PTHREAD_BASIC_INFORMATION;

    typedef struct _MEMORY_REGION_INFORMATION
    {
        PVOID AllocationBase;
        ULONG AllocationProtect;
        union
        {
            ULONG RegionType;
            struct
            {
                ULONG Private : 1;
                ULONG MappedDataFile : 1;
                ULONG MappedImage : 1;
                ULONG MappedPageFile : 1;
                ULONG MappedPhysical : 1;
                ULONG DirectMapped : 1;
                ULONG Reserved : 26;
            } s;
        } u;
        SIZE_T RegionSize;
        SIZE_T CommitSize;
    } MEMORY_REGION_INFORMATION, * PMEMORY_REGION_INFORMATION;

    typedef struct _SECTION_BASIC_INFORMATION
    {
        PVOID BaseAddress;
        ULONG AllocationAttributes;
        LARGE_INTEGER MaximumSize;
    } SECTION_BASIC_INFORMATION, * PSECTION_BASIC_INFORMATION;

    typedef struct _SECTION_IMAGE_INFORMATION
    {
        PVOID TransferAddress; // Entry point
        ULONG ZeroBits;
        SIZE_T MaximumStackSize;
        SIZE_T CommittedStackSize;
        ULONG SubSystemType;
        union
        {
            struct
            {
                USHORT SubSystemMinorVersion;
                USHORT SubSystemMajorVersion;
            } s1;
            ULONG SubSystemVersion;
        } u1;
        union
        {
            struct
            {
                USHORT MajorOperatingSystemVersion;
                USHORT MinorOperatingSystemVersion;
            } s2;
            ULONG OperatingSystemVersion;
        } u2;
        USHORT ImageCharacteristics;
        USHORT DllCharacteristics;
        USHORT Machine;
        BOOLEAN ImageContainsCode;
        union
        {
            UCHAR ImageFlags;
            struct
            {
                UCHAR ComPlusNativeReady : 1;
                UCHAR ComPlusILOnly : 1;
                UCHAR ImageDynamicallyRelocated : 1;
                UCHAR ImageMappedFlat : 1;
                UCHAR BaseBelow4gb : 1;
                UCHAR ComPlusPrefer32bit : 1;
                UCHAR Reserved : 2;
            } s3;
        } u3;
        ULONG LoaderFlags;
        ULONG ImageFileSize;
        ULONG CheckSum;
    } SECTION_IMAGE_INFORMATION, * PSECTION_IMAGE_INFORMATION;

    typedef struct _SECTION_INTERNAL_IMAGE_INFORMATION
    {
        SECTION_IMAGE_INFORMATION SectionInformation;
        union
        {
            ULONG ExtendedFlags;
            struct
            {
                ULONG ImageReturnFlowGuardEnabled : 1;
                ULONG ImageReturnFlowGuardStrict : 1;
                ULONG ImageExportSuppressionEnabled : 1;
                ULONG Reserved : 29;
            } s;
        } u;
    } SECTION_INTERNAL_IMAGE_INFORMATION, * PSECTION_INTERNAL_IMAGE_INFORMATION;

    typedef struct _OBJECT_ATTRIBUTES
    {
        ULONG Length;
        HANDLE RootDirectory;
        PUNICODE_STRING ObjectName;
        ULONG Attributes;
        PVOID SecurityDescriptor;
        PVOID SecurityQualityOfService;
    } OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;

    // https://stackoverflow.com/questions/36961152/detect-windows-kit-8-0-and-windows-kit-8-1-sdks
#if defined(WINAPI_PARTITION_APP)
#if defined(WINAPI_FAMILY_SYSTEM)
#define USING_WINDOWS_10_SDK
#elif (WINAPI_PARTITION_APP == 0x00000002) || (WINAPI_PARTITION_APP == 1)
#define USING_WINDOWS_8_x_SDK
#endif
#endif

// This struct was included in winnt.h starting in the Windows 8.0 SDK
#if !(defined(USING_WINDOWS_8_x_SDK) || defined(USING_WINDOWS_10_SDK))
    typedef struct _EXCEPTION_REGISTRATION_RECORD
    {
        _EXCEPTION_REGISTRATION_RECORD* Next;
        _EXCEPTION_DISPOSITION Handler;
    } EXCEPTION_REGISTRATION_RECORD, * PEXCEPTION_REGISTRATION_RECORD;
#endif

#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT            0x00000001
#define LDR_GET_DLL_HANDLE_EX_PIN                           0x00000002

#define LDR_GET_PROCEDURE_ADDRESS_EX_DONT_RECORD_FORWARDER  0x00000001

#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS           0x00000001
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY                  0x00000002

#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID            0
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED      1
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED  2

#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS         0x00000001

    typedef struct _LDR_RESOURCE_INFO
    {
        ULONG_PTR Type;
        ULONG_PTR Name;
        ULONG_PTR Language;
    } LDR_RESOURCE_INFO, * PLDR_RESOURCE_INFO;

    typedef struct _LDR_ENUM_RESOURCE_INFO
    {
        ULONG_PTR Type;
        ULONG_PTR Name;
        ULONG_PTR Language;
        PVOID Data;
        SIZE_T Size;
        ULONG_PTR Reserved;
    } LDR_ENUM_RESOURCE_INFO, * PLDR_ENUM_RESOURCE_INFO;

#define LDR_FIND_RESOURCE_LANGUAGE_CAN_FALLBACK             0x00000000
#define LDR_FIND_RESOURCE_LANGUAGE_EXACT                    0x00000004
#define LDR_FIND_RESOURCE_LANGUAGE_REDIRECT_VERSION         0x00000008

    typedef struct _RTL_PROCESS_MODULE_INFORMATION
    {
        HANDLE Section;
        PVOID MappedBase;
        PVOID ImageBase;
        ULONG ImageSize;
        ULONG Flags;
        USHORT LoadOrderIndex;
        USHORT InitOrderIndex;
        USHORT LoadCount;
        USHORT OffsetToFileName;
        UCHAR FullPathName[256];
    } RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;

    typedef struct _RTL_PROCESS_MODULES
    {
        ULONG NumberOfModules;
        RTL_PROCESS_MODULE_INFORMATION Modules[1];
    } RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;

    typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
    {
        USHORT NextOffset;
        RTL_PROCESS_MODULE_INFORMATION BaseInfo;
        ULONG ImageChecksum;
        ULONG TimeDateStamp;
        PVOID DefaultBase;
    } RTL_PROCESS_MODULE_INFORMATION_EX, * PRTL_PROCESS_MODULE_INFORMATION_EX;

    typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
    {
        USHORT UniqueProcessId;
        USHORT CreatorBackTraceIndex;
        UCHAR ObjectTypeIndex;
        UCHAR HandleAttributes;
        USHORT HandleValue;
        PVOID Object;
        ULONG GrantedAccess;
    } SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

    typedef struct _SYSTEM_HANDLE_INFORMATION
    {
        ULONG NumberOfHandles;
        SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
    } SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;

    typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
    {
        PVOID Object;
        ULONG_PTR UniqueProcessId;
        ULONG_PTR HandleValue;
        ULONG GrantedAccess;
        USHORT CreatorBackTraceIndex;
        USHORT ObjectTypeIndex;
        ULONG HandleAttributes;
        ULONG Reserved;
    } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;

    typedef struct _SYSTEM_HANDLE_INFORMATION_EX
    {
        ULONG_PTR NumberOfHandles;
        ULONG_PTR Reserved;
        SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
    } SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX;

    typedef struct _OBJECT_BASIC_INFORMATION
    {
        ULONG Attributes;
        ACCESS_MASK GrantedAccess;
        ULONG HandleCount;
        ULONG PointerCount;
        ULONG PagedPoolCharge;
        ULONG NonPagedPoolCharge;
        ULONG Reserved[3];
        ULONG NameInfoSize;
        ULONG TypeInfoSize;
        ULONG SecurityDescriptorSize;
        LARGE_INTEGER CreationTime;
    } OBJECT_BASIC_INFORMATION, * POBJECT_BASIC_INFORMATION;

    typedef struct _OBJECT_NAME_INFORMATION
    {
        UNICODE_STRING Name;
    } OBJECT_NAME_INFORMATION, * POBJECT_NAME_INFORMATION;

    typedef struct _OBJECT_TYPE_INFORMATION
    {
        UNICODE_STRING TypeName;
        ULONG TotalNumberOfObjects;
        ULONG TotalNumberOfHandles;
        ULONG TotalPagedPoolUsage;
        ULONG TotalNonPagedPoolUsage;
        ULONG TotalNamePoolUsage;
        ULONG TotalHandleTableUsage;
        ULONG HighWaterNumberOfObjects;
        ULONG HighWaterNumberOfHandles;
        ULONG HighWaterPagedPoolUsage;
        ULONG HighWaterNonPagedPoolUsage;
        ULONG HighWaterNamePoolUsage;
        ULONG HighWaterHandleTableUsage;
        ULONG InvalidAttributes;
        GENERIC_MAPPING GenericMapping;
        ULONG ValidAccessMask;
        BOOLEAN SecurityRequired;
        BOOLEAN MaintainHandleCount;
        UCHAR TypeIndex; // Since Windows 8.1
        CHAR ReservedByte;
        ULONG PoolType;
        ULONG DefaultPagedPoolCharge;
        ULONG DefaultNonPagedPoolCharge;
    } OBJECT_TYPE_INFORMATION, * POBJECT_TYPE_INFORMATION;

    typedef struct _OBJECT_TYPES_INFORMATION
    {
        ULONG NumberOfTypes;
        OBJECT_TYPE_INFORMATION TypeInformation[1];
    } OBJECT_TYPES_INFORMATION, * POBJECT_TYPES_INFORMATION;

    typedef struct _OBJECT_HANDLE_FLAG_INFORMATION
    {
        BOOLEAN Inherit;
        BOOLEAN ProtectFromClose;
    } OBJECT_HANDLE_FLAG_INFORMATION, * POBJECT_HANDLE_FLAG_INFORMATION;

    typedef struct _DBGKM_EXCEPTION
    {
        EXCEPTION_RECORD ExceptionRecord;
        ULONG FirstChance;
    } DBGKM_EXCEPTION, * PDBGKM_EXCEPTION;

    typedef struct _DBGKM_CREATE_THREAD
    {
        ULONG SubSystemKey;
        PVOID StartAddress;
    } DBGKM_CREATE_THREAD, * PDBGKM_CREATE_THREAD;

    typedef struct _DBGKM_CREATE_PROCESS
    {
        ULONG SubSystemKey;
        HANDLE FileHandle;
        PVOID BaseOfImage;
        ULONG DebugInfoFileOffset;
        ULONG DebugInfoSize;
        DBGKM_CREATE_THREAD InitialThread;
    } DBGKM_CREATE_PROCESS, * PDBGKM_CREATE_PROCESS;

    typedef struct _DBGKM_EXIT_THREAD
    {
        NTSTATUS ExitStatus;
    } DBGKM_EXIT_THREAD, * PDBGKM_EXIT_THREAD;

    typedef struct _DBGKM_EXIT_PROCESS
    {
        NTSTATUS ExitStatus;
    } DBGKM_EXIT_PROCESS, * PDBGKM_EXIT_PROCESS;

    typedef struct _DBGKM_LOAD_DLL
    {
        HANDLE FileHandle;
        PVOID BaseOfDll;
        ULONG DebugInfoFileOffset;
        ULONG DebugInfoSize;
        PVOID NamePointer;
    } DBGKM_LOAD_DLL, * PDBGKM_LOAD_DLL;

    typedef struct _DBGKM_UNLOAD_DLL
    {
        PVOID BaseAddress;
    } DBGKM_UNLOAD_DLL, * PDBGKM_UNLOAD_DLL;

    typedef enum _DBG_STATE
    {
        DbgIdle,
        DbgReplyPending,
        DbgCreateThreadStateChange,
        DbgCreateProcessStateChange,
        DbgExitThreadStateChange,
        DbgExitProcessStateChange,
        DbgExceptionStateChange,
        DbgBreakpointStateChange,
        DbgSingleStepStateChange,
        DbgLoadDllStateChange,
        DbgUnloadDllStateChange
    } DBG_STATE, * PDBG_STATE;

    typedef struct _DBGUI_CREATE_THREAD
    {
        HANDLE HandleToThread;
        DBGKM_CREATE_THREAD NewThread;
    } DBGUI_CREATE_THREAD, * PDBGUI_CREATE_THREAD;

    typedef struct _DBGUI_CREATE_PROCESS
    {
        HANDLE HandleToProcess;
        HANDLE HandleToThread;
        DBGKM_CREATE_PROCESS NewProcess;
    } DBGUI_CREATE_PROCESS, * PDBGUI_CREATE_PROCESS;

    typedef struct _DBGUI_WAIT_STATE_CHANGE
    {
        DBG_STATE NewState;
        CLIENT_ID AppClientId;
        union
        {
            DBGKM_EXCEPTION Exception;
            DBGUI_CREATE_THREAD CreateThread;
            DBGUI_CREATE_PROCESS CreateProcessInfo;
            DBGKM_EXIT_THREAD ExitThread;
            DBGKM_EXIT_PROCESS ExitProcess;
            DBGKM_LOAD_DLL LoadDll;
            DBGKM_UNLOAD_DLL UnloadDll;
        } StateInfo;
    } DBGUI_WAIT_STATE_CHANGE, * PDBGUI_WAIT_STATE_CHANGE;

    typedef struct _DBGSS_THREAD_DATA
    {
        struct _DBGSS_THREAD_DATA* Next;
        HANDLE ThreadHandle;
        HANDLE ProcessHandle;
        ULONG ProcessId;
        ULONG ThreadId;
        BOOLEAN HandleMarked;
    } DBGSS_THREAD_DATA, * PDBGSS_THREAD_DATA;

#define DbgSsSetThreadData(d) \
    NtCurrentTeb()->DbgSsReserved[0] = d

#define DbgSsGetThreadData() \
    ((PDBGSS_THREAD_DATA)NtCurrentTeb()->DbgSsReserved[0])

    typedef USHORT RTL_ATOM, * PRTL_ATOM;
    typedef long SECURITY_STATUS;

    typedef struct _RTL_SPLAY_LINKS
    {
        struct _RTL_SPLAY_LINKS* Parent;
        struct _RTL_SPLAY_LINKS* LeftChild;
        struct _RTL_SPLAY_LINKS* RightChild;
    } RTL_SPLAY_LINKS, * PRTL_SPLAY_LINKS;

#define RtlInitializeSplayLinks(Links) \
{ \
    PRTL_SPLAY_LINKS _SplayLinks; \
    _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
    _SplayLinks->Parent = _SplayLinks; \
    _SplayLinks->LeftChild = NULL; \
    _SplayLinks->RightChild = NULL; \
}

    typedef struct _PREFIX_TABLE_ENTRY
    {
        SHORT NodeTypeCode;
        SHORT NameLength;
        struct _PREFIX_TABLE_ENTRY* NextPrefixTree;
        RTL_SPLAY_LINKS Links;
        PANSI_STRING Prefix;
    } PREFIX_TABLE_ENTRY, * PPREFIX_TABLE_ENTRY;

    typedef struct _PREFIX_TABLE
    {
        SHORT NodeTypeCode;
        SHORT NameLength;
        PPREFIX_TABLE_ENTRY NextPrefixTree;
    } PREFIX_TABLE, * PPREFIX_TABLE;

    typedef struct _RTL_BITMAP
    {
        ULONG SizeOfBitMap;
        PULONG Buffer;
    } RTL_BITMAP, * PRTL_BITMAP;

    typedef struct _RTL_BITMAP_RUN
    {
        ULONG StartingIndex;
        ULONG NumberOfBits;
    } RTL_BITMAP_RUN, * PRTL_BITMAP_RUN;

    typedef enum
    {
        RtlBsdItemVersionNumber = 0x00,
        RtlBsdItemProductType,
        RtlBsdItemAabEnabled,
        RtlBsdItemAabTimeout,
        RtlBsdItemBootGood,
        RtlBsdItemBootShutdown,
        RtlBsdItemMax
    } RTL_BSD_ITEM_TYPE, * PRTL_BSD_ITEM_TYPE;

#define DUPLICATE_CLOSE_SOURCE      0x00000001
#define DUPLICATE_SAME_ACCESS       0x00000002
#define DUPLICATE_SAME_ATTRIBUTES   0x00000004

#define RTL_WALK_MAX_STACK_DEPTH    128

    // These cannot be ORed together
#define RTL_WALK_KERNEL_MODE_STACK  0x00000000 // Kernel mode callers only
#define RTL_WALK_USER_MODE_STACK    0x00000001
#define RTL_WALK_TRACE_HANDLES      0x00000300

    typedef struct _RTL_PROCESS_VERIFIER_OPTIONS
    {
        ULONG SizeStruct;
        ULONG Option;
        UCHAR OptionData[1];
    } RTL_PROCESS_VERIFIER_OPTIONS, * PRTL_PROCESS_VERIFIER_OPTIONS;

    typedef struct _RTL_DEBUG_INFORMATION
    {
        HANDLE SectionHandleClient;
        PVOID ViewBaseClient;
        PVOID ViewBaseTarget;
        ULONG_PTR ViewBaseDelta;
        HANDLE EventPairClient;
        HANDLE EventPairTarget;
        HANDLE TargetProcessId;
        HANDLE TargetThreadHandle;
        ULONG Flags;
        SIZE_T OffsetFree;
        SIZE_T CommitSize;
        SIZE_T ViewSize;
        union
        {
            PRTL_PROCESS_MODULES Modules;
            PRTL_PROCESS_MODULE_INFORMATION_EX ModulesEx;
        };
        struct _RTL_PROCESS_BACKTRACES* BackTraces;
        struct _RTL_PROCESS_HEAPS* Heaps;
        struct _RTL_PROCESS_LOCKS* Locks;
        PVOID SpecificHeap;
        HANDLE TargetProcessHandle;
        PRTL_PROCESS_VERIFIER_OPTIONS VerifierOptions;
        PVOID ProcessHeap;
        HANDLE CriticalSectionHandle;
        HANDLE CriticalSectionOwnerThread;
        PVOID Reserved[4];
    } RTL_DEBUG_INFORMATION, * PRTL_DEBUG_INFORMATION;

    typedef
        VOID
        (*PPS_APC_ROUTINE)(
            _In_opt_ PVOID ApcArgument1,
            _In_opt_ PVOID ApcArgument2,
            _In_opt_ PVOID ApcArgument3
            );

    typedef struct _RTLP_CURDIR_REF* PRTLP_CURDIR_REF;

    typedef struct _RTL_RELATIVE_NAME_U
    {
        UNICODE_STRING RelativeName;
        HANDLE ContainingDirectory;
        PRTLP_CURDIR_REF CurDirRef;
    } RTL_RELATIVE_NAME_U, * PRTL_RELATIVE_NAME_U;

    typedef enum _RTL_PATH_TYPE
    {
        RtlPathTypeUnknown,
        RtlPathTypeUncAbsolute,
        RtlPathTypeDriveAbsolute,
        RtlPathTypeDriveRelative,
        RtlPathTypeRooted,
        RtlPathTypeRelative,
        RtlPathTypeLocalDevice,
        RtlPathTypeRootLocalDevice,
    } RTL_PATH_TYPE;

#define DOS_MAX_COMPONENT_LENGTH 255
#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5)

    typedef struct _CURDIR
    {
        UNICODE_STRING DosPath;
        HANDLE Handle;
    } CURDIR, * PCURDIR;

#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002
#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003

    typedef struct _RTL_DRIVE_LETTER_CURDIR
    {
        USHORT Flags;
        USHORT Length;
        ULONG TimeStamp;
        UNICODE_STRING DosPath;
    } RTL_DRIVE_LETTER_CURDIR, * PRTL_DRIVE_LETTER_CURDIR;

#define RTL_MAX_DRIVE_LETTERS 32
#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001

    typedef struct _LDR_SERVICE_TAG_RECORD
    {
        struct _LDR_SERVICE_TAG_RECORD* Next;
        ULONG ServiceTag;
    } LDR_SERVICE_TAG_RECORD, * PLDR_SERVICE_TAG_RECORD;

    typedef struct _LDRP_CSLIST
    {
        PSINGLE_LIST_ENTRY Tail;
    } LDRP_CSLIST, * PLDRP_CSLIST;

    typedef enum _LDR_DDAG_STATE
    {
        LdrModulesMerged = -5,
        LdrModulesInitError = -4,
        LdrModulesSnapError = -3,
        LdrModulesUnloaded = -2,
        LdrModulesUnloading = -1,
        LdrModulesPlaceHolder = 0,
        LdrModulesMapping = 1,
        LdrModulesMapped = 2,
        LdrModulesWaitingForDependencies = 3,
        LdrModulesSnapping = 4,
        LdrModulesSnapped = 5,
        LdrModulesCondensed = 6,
        LdrModulesReadyToInit = 7,
        LdrModulesInitializing = 8,
        LdrModulesReadyToRun = 9
    } LDR_DDAG_STATE;

    typedef struct _LDR_DDAG_NODE
    {
        LIST_ENTRY Modules;
        PLDR_SERVICE_TAG_RECORD ServiceTagList;
        ULONG LoadCount;
        ULONG LoadWhileUnloadingCount;
        ULONG LowestLink;
        union
        {
            LDRP_CSLIST Dependencies;
            SINGLE_LIST_ENTRY RemovalLink;
        };
        LDRP_CSLIST IncomingDependencies;
        LDR_DDAG_STATE State;
        SINGLE_LIST_ENTRY CondenseLink;
        ULONG PreorderNumber;
    } LDR_DDAG_NODE, * PLDR_DDAG_NODE;

    typedef struct _LDR_DEPENDENCY_RECORD
    {
        SINGLE_LIST_ENTRY DependencyLink;
        PLDR_DDAG_NODE DependencyNode;
        SINGLE_LIST_ENTRY IncomingDependencyLink;
        PLDR_DDAG_NODE IncomingDependencyNode;
    } LDR_DEPENDENCY_RECORD, * PLDR_DEPENDENCY_RECORD;

    typedef enum _LDR_DLL_LOAD_REASON
    {
        LoadReasonStaticDependency,
        LoadReasonStaticForwarderDependency,
        LoadReasonDynamicForwarderDependency,
        LoadReasonDelayloadDependency,
        LoadReasonDynamicLoad,
        LoadReasonAsImageLoad,
        LoadReasonAsDataLoad,
        LoadReasonUnknown = -1
    } LDR_DLL_LOAD_REASON, * PLDR_DLL_LOAD_REASON;

#define LDRP_PACKAGED_BINARY            0x00000001
#define LDRP_IMAGE_DLL                  0x00000004
#define LDRP_LOAD_IN_PROGRESS           0x00001000
#define LDRP_ENTRY_PROCESSED            0x00004000
#define LDRP_DONT_CALL_FOR_THREADS      0x00040000
#define LDRP_PROCESS_ATTACH_CALLED      0x00080000
#define LDRP_PROCESS_ATTACH_FAILED      0x00100000
#define LDRP_IMAGE_NOT_AT_BASE          0x00200000 // Vista and below
#define LDRP_COR_IMAGE                  0x00400000
#define LDRP_DONT_RELOCATE              0x00800000
#define LDRP_REDIRECTED                 0x10000000
#define LDRP_COMPAT_DATABASE_PROCESSED  0x80000000

#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, BaseNameHashValue)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, ImplicitPathOptions)

#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3

    typedef struct _RTL_BALANCED_NODE
    {
        union
        {
            struct _RTL_BALANCED_NODE* Children[2];
            struct
            {
                struct _RTL_BALANCED_NODE* Left;
                struct _RTL_BALANCED_NODE* Right;
            } s;
        };
        union
        {
            UCHAR Red : 1;
            UCHAR Balance : 2;
            ULONG_PTR ParentValue;
        } u;
    } RTL_BALANCED_NODE, * PRTL_BALANCED_NODE;

    typedef struct _LDR_DATA_TABLE_ENTRY
    {
        LIST_ENTRY InLoadOrderLinks;
        LIST_ENTRY InMemoryOrderLinks;
        union
        {
            LIST_ENTRY InInitializationOrderLinks;
            LIST_ENTRY InProgressLinks;
        };
        PVOID DllBase;
        PVOID EntryPoint;
        ULONG SizeOfImage;
        UNICODE_STRING FullDllName;
        UNICODE_STRING BaseDllName;
        union
        {
            UCHAR FlagGroup[4];
            ULONG Flags;
            struct
            {
                ULONG PackagedBinary : 1;
                ULONG MarkedForRemoval : 1;
                ULONG ImageDll : 1;
                ULONG LoadNotificationsSent : 1;
                ULONG TelemetryEntryProcessed : 1;
                ULONG ProcessStaticImport : 1;
                ULONG InLegacyLists : 1;
                ULONG InIndexes : 1;
                ULONG ShimDll : 1;
                ULONG InExceptionTable : 1;
                ULONG ReservedFlags1 : 2;
                ULONG LoadInProgress : 1;
                ULONG LoadConfigProcessed : 1;
                ULONG EntryProcessed : 1;
                ULONG ProtectDelayLoad : 1;
                ULONG ReservedFlags3 : 2;
                ULONG DontCallForThreads : 1;
                ULONG ProcessAttachCalled : 1;
                ULONG ProcessAttachFailed : 1;
                ULONG CorDeferredValidate : 1;
                ULONG CorImage : 1;
                ULONG DontRelocate : 1;
                ULONG CorILOnly : 1;
                ULONG ReservedFlags5 : 3;
                ULONG Redirected : 1;
                ULONG ReservedFlags6 : 2;
                ULONG CompatDatabaseProcessed : 1;
            } s;
        } u;
        USHORT ObsoleteLoadCount;
        USHORT TlsIndex;
        LIST_ENTRY HashLinks;
        ULONG TimeDateStamp;
        struct _ACTIVATION_CONTEXT* EntryPointActivationContext;
        PVOID Lock;
        PLDR_DDAG_NODE DdagNode;
        LIST_ENTRY NodeModuleLink;
        struct _LDRP_LOAD_CONTEXT* LoadContext;
        PVOID ParentDllBase;
        PVOID SwitchBackContext;
        RTL_BALANCED_NODE BaseAddressIndexNode;
        RTL_BALANCED_NODE MappingInfoIndexNode;
        ULONG_PTR OriginalBase;
        LARGE_INTEGER LoadTime;
        ULONG BaseNameHashValue;
        LDR_DLL_LOAD_REASON LoadReason;
        ULONG ImplicitPathOptions;
        ULONG ReferenceCount;
        ULONG DependentLoadFlags;
        UCHAR SigningLevel; // Since Windows 10 RS2
    } LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

    typedef struct _INITIAL_TEB
    {
        struct
        {
            PVOID OldStackBase;
            PVOID OldStackLimit;
        } OldInitialTeb;
        PVOID StackBase;
        PVOID StackLimit;
        PVOID StackAllocationBase;
    } INITIAL_TEB, * PINITIAL_TEB;

    typedef struct _IO_STATUS_BLOCK
    {
        union
        {
            NTSTATUS Status;
            PVOID Pointer;
        };
        ULONG_PTR Information;
    } IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;

    typedef
        VOID
        (NTAPI*
            PIO_APC_ROUTINE)(
                _In_ PVOID ApcContext,
                _In_ PIO_STATUS_BLOCK IoStatusBlock,
                _In_ ULONG Reserved
                );

    typedef struct _FILE_IO_COMPLETION_INFORMATION
    {
        PVOID KeyContext;
        PVOID ApcContext;
        IO_STATUS_BLOCK IoStatusBlock;
    } FILE_IO_COMPLETION_INFORMATION, * PFILE_IO_COMPLETION_INFORMATION;

    typedef struct _FILE_COMPLETION_INFORMATION
    {
        HANDLE Port;
        PVOID Key;
    } FILE_COMPLETION_INFORMATION, * PFILE_COMPLETION_INFORMATION;

#ifdef __cplusplus
    typedef enum _PRIORITY_CLASS : UCHAR
    {
        Undefined,
        Idle,
        Normal,
        High,
        Realtime,
        BelowNormal,
        AboveNormal
    } PRIORITY_CLASS;
#else
    typedef UCHAR PRIORITY_CLASS;
#endif

    typedef struct _PROCESS_PRIORITY_CLASS
    {
        BOOLEAN Foreground;
        PRIORITY_CLASS PriorityClass;
    } PROCESS_PRIORITY_CLASS, * PPROCESS_PRIORITY_CLASS;

    typedef struct _PS_ATTRIBUTE
    {
        ULONG_PTR Attribute;                // PROC_THREAD_ATTRIBUTE_XXX | PROC_THREAD_ATTRIBUTE_XXX modifiers, see ProcThreadAttributeValue macro and Windows Internals 6 (372)
        SIZE_T Size;                        // Size of Value or *ValuePtr
        union
        {
            ULONG_PTR Value;                // Reserve 8 bytes for data (such as a Handle or a data pointer)
            PVOID ValuePtr;                 // data pointer
        };
        PSIZE_T ReturnLength;               // Either 0 or specifies size of data returned to caller via "ValuePtr"
    } PS_ATTRIBUTE, * PPS_ATTRIBUTE;

    typedef struct _PS_ATTRIBUTE_LIST
    {
        SIZE_T TotalLength;                 // sizeof(PS_ATTRIBUTE_LIST)
        PS_ATTRIBUTE Attributes[2];         // Depends on how many attribute entries should be supplied to NtCreateUserProcess
    } PS_ATTRIBUTE_LIST, * PPS_ATTRIBUTE_LIST;

    typedef struct _PS_MEMORY_RESERVE
    {
        PVOID ReserveAddress;
        SIZE_T ReserveSize;
    } PS_MEMORY_RESERVE, * PPS_MEMORY_RESERVE;

#define PS_ATTRIBUTE_NUMBER_MASK    0x0000ffff
#define PS_ATTRIBUTE_THREAD         0x00010000 // Attribute may be used with thread creation
#define PS_ATTRIBUTE_INPUT          0x00020000 // Attribute is input only
#define PS_ATTRIBUTE_ADDITIVE       0x00040000 // Attribute may be "accumulated", e.g. bitmasks, counters, etc.

    typedef enum _PS_ATTRIBUTE_NUM
    {
        PsAttributeParentProcess,                   // in HANDLE
        PsAttributeDebugPort,                       // in HANDLE
        PsAttributeToken,                           // in HANDLE
        PsAttributeClientId,                        // out PCLIENT_ID
        PsAttributeTebAddress,                      // out PTEB
        PsAttributeImageName,                       // in PWSTR
        PsAttributeImageInfo,                       // out PSECTION_IMAGE_INFORMATION
        PsAttributeMemoryReserve,                   // in PPS_MEMORY_RESERVE
        PsAttributePriorityClass,                   // in UCHAR
        PsAttributeErrorMode,                       // in ULONG
        PsAttributeStdHandleInfo,                   // in PPS_STD_HANDLE_INFO
        PsAttributeHandleList,                      // in PHANDLE
        PsAttributeGroupAffinity,                   // in PGROUP_AFFINITY
        PsAttributePreferredNode,                   // in PUSHORT
        PsAttributeIdealProcessor,                  // in PPROCESSOR_NUMBER
        PsAttributeUmsThread,                       // see MSDN UpdateProceThreadAttributeList (CreateProcessW) - in PUMS_CREATE_THREAD_ATTRIBUTES
        PsAttributeMitigationOptions,               // in UCHAR
        PsAttributeProtectionLevel,                 // in ULONG
        PsAttributeSecureProcess,                   // since THRESHOLD (Virtual Secure Mode, Device Guard)
        PsAttributeJobList,
        PsAttributeChildProcessPolicy,              // since THRESHOLD2
        PsAttributeAllApplicationPackagesPolicy,    // since REDSTONE
        PsAttributeWin32kFilter,
        PsAttributeSafeOpenPromptOriginClaim,
        PsAttributeBnoIsolation,
        PsAttributeDesktopAppPolicy,
        PsAttributeMax
    } PS_ATTRIBUTE_NUM;

#define PsAttributeValue(Number, Thread, Input, Additive) \
    (((Number) & PS_ATTRIBUTE_NUMBER_MASK) | \
    ((Thread) ? PS_ATTRIBUTE_THREAD : 0) | \
    ((Input) ? PS_ATTRIBUTE_INPUT : 0) | \
    ((Additive) ? PS_ATTRIBUTE_ADDITIVE : 0))

#define PS_ATTRIBUTE_PARENT_PROCESS \
    PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE) // 0x60000
#define PS_ATTRIBUTE_DEBUG_PORT \
    PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE) // 0x60001
#define PS_ATTRIBUTE_TOKEN \
    PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE) // 0x60002
#define PS_ATTRIBUTE_CLIENT_ID \
    PsAttributeValue(PsAttributeClientId, TRUE, FALSE, FALSE) // 0x10003
#define PS_ATTRIBUTE_TEB_ADDRESS \
    PsAttributeValue(PsAttributeTebAddress, TRUE, FALSE, FALSE) // 0x10004
#define PS_ATTRIBUTE_IMAGE_NAME \
    PsAttributeValue(PsAttributeImageName, FALSE, TRUE, FALSE) // 0x20005
#define PS_ATTRIBUTE_IMAGE_INFO \
    PsAttributeValue(PsAttributeImageInfo, FALSE, FALSE, FALSE) // 0x6
#define PS_ATTRIBUTE_MEMORY_RESERVE \
    PsAttributeValue(PsAttributeMemoryReserve, FALSE, TRUE, FALSE) // 0x20007
#define PS_ATTRIBUTE_PRIORITY_CLASS \
    PsAttributeValue(PsAttributePriorityClass, FALSE, TRUE, FALSE) // 0x20008
#define PS_ATTRIBUTE_ERROR_MODE \
    PsAttributeValue(PsAttributeErrorMode, FALSE, TRUE, FALSE) // 0x20009
#define PS_ATTRIBUTE_STD_HANDLE_INFO \
    PsAttributeValue(PsAttributeStdHandleInfo, FALSE, TRUE, FALSE) // 0x2000A
#define PS_ATTRIBUTE_HANDLE_LIST \
    PsAttributeValue(PsAttributeHandleList, FALSE, TRUE, FALSE) // 0x2000B
#define PS_ATTRIBUTE_GROUP_AFFINITY \
    PsAttributeValue(PsAttributeGroupAffinity, TRUE, TRUE, FALSE) // 0x2000C
#define PS_ATTRIBUTE_PREFERRED_NODE \
    PsAttributeValue(PsAttributePreferredNode, FALSE, TRUE, FALSE) // 0x2000D
#define PS_ATTRIBUTE_IDEAL_PROCESSOR \
    PsAttributeValue(PsAttributeIdealProcessor, TRUE, TRUE, FALSE) // 0x2000E
#define PS_ATTRIBUTE_MITIGATION_OPTIONS \
    PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, TRUE) // 0x60010
#define PS_ATTRIBUTE_PROTECTION_LEVEL \
    PsAttributeValue(PsAttributeProtectionLevel, FALSE, TRUE, FALSE) // 0x20011

    typedef enum _PS_STD_HANDLE_STATE
    {
        PsNeverDuplicate,
        PsRequestDuplicate, // Duplicate standard handles specified by PseudoHandleMask, and only if StdHandleSubsystemType matches the image subsystem
        PsAlwaysDuplicate, // Always duplicate standard handles
        PsMaxStdHandleStates
    } PS_STD_HANDLE_STATE;

#define HANDLE_DETACHED_PROCESS     ((HANDLE)-1)
#define HANDLE_CREATE_NEW_CONSOLE   ((HANDLE)-2)
#define HANDLE_CREATE_NO_WINDOW     ((HANDLE)-3)

#define PS_STD_INPUT_HANDLE         0x1
#define PS_STD_OUTPUT_HANDLE        0x2
#define PS_STD_ERROR_HANDLE         0x4

    typedef struct _PS_STD_HANDLE_INFO
    {
        union
        {
            ULONG Flags;
            struct
            {
                ULONG StdHandleState : 2; // PS_STD_HANDLE_STATE
                ULONG PseudoHandleMask : 3; // PS_STD_*
            } s;
        };
        ULONG StdHandleSubsystemType;
    } PS_STD_HANDLE_INFO, * PPS_STD_HANDLE_INFO;

    typedef struct _PS_BNO_ISOLATION_PARAMETERS
    {
        UNICODE_STRING IsolationPrefix;
        ULONG HandleCount;
        PVOID* Handles;
        BOOLEAN IsolationEnabled;
    } PS_BNO_ISOLATION_PARAMETERS, * PPS_BNO_ISOLATION_PARAMETERS;

    typedef enum _PS_MITIGATION_OPTION
    {
        PS_MITIGATION_OPTION_NX,
        PS_MITIGATION_OPTION_SEHOP,
        PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES,
        PS_MITIGATION_OPTION_HEAP_TERMINATE,
        PS_MITIGATION_OPTION_BOTTOM_UP_ASLR,
        PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR,
        PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS,
        PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE,
        PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE,
        PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE,
        PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD,
        PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES,
        PS_MITIGATION_OPTION_FONT_DISABLE,
        PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE,
        PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL,
        PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32,
        PS_MITIGATION_OPTION_RETURN_FLOW_GUARD,
        PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY,
        PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD,
        PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT
    } PS_MITIGATION_OPTION;

    typedef enum _PS_CREATE_STATE
    {
        PsCreateInitialState,
        PsCreateFailOnFileOpen,
        PsCreateFailOnSectionCreate,
        PsCreateFailExeFormat,
        PsCreateFailMachineMismatch,
        PsCreateFailExeName, // Debugger specified
        PsCreateSuccess,
        PsCreateMaximumStates
    } PS_CREATE_STATE;

    typedef struct _PS_CREATE_INFO
    {
        SIZE_T Size;
        PS_CREATE_STATE State;
        union
        {
            // PsCreateInitialState
            struct
            {
                union
                {
                    ULONG InitFlags;
                    struct
                    {
                        UCHAR WriteOutputOnExit : 1;
                        UCHAR DetectManifest : 1;
                        UCHAR IFEOSkipDebugger : 1;
                        UCHAR IFEODoNotPropagateKeyState : 1;
                        UCHAR SpareBits1 : 4;
                        UCHAR SpareBits2 : 8;
                        USHORT ProhibitedImageCharacteristics : 16;
                    } s1;
                } u1;
                ACCESS_MASK AdditionalFileAccess;
            } InitState;

            // PsCreateFailOnSectionCreate
            struct
            {
                HANDLE FileHandle;
            } FailSection;

            // PsCreateFailExeFormat
            struct
            {
                USHORT DllCharacteristics;
            } ExeFormat;

            // PsCreateFailExeName
            struct
            {
                HANDLE IFEOKey;
            } ExeName;

            // PsCreateSuccess
            struct
            {
                union
                {
                    ULONG OutputFlags;
                    struct
                    {
                        UCHAR ProtectedProcess : 1;
                        UCHAR AddressSpaceOverride : 1;
                        UCHAR DevOverrideEnabled : 1; // From Image File Execution Options
                        UCHAR ManifestDetected : 1;
                        UCHAR ProtectedProcessLight : 1;
                        UCHAR SpareBits1 : 3;
                        UCHAR SpareBits2 : 8;
                        USHORT SpareBits3 : 16;
                    } s2;
                } u2;
                HANDLE FileHandle;
                HANDLE SectionHandle;
                ULONGLONG UserProcessParametersNative;
                ULONG UserProcessParametersWow64;
                ULONG CurrentParameterFlags;
                ULONGLONG PebAddressNative;
                ULONG PebAddressWow64;
                ULONGLONG ManifestAddress;
                ULONG ManifestSize;
            } SuccessState;
        };
    } PS_CREATE_INFO, * PPS_CREATE_INFO;

#define PROCESS_CREATE_FLAGS_BREAKAWAY              0x00000001
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT       0x00000002
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES        0x00000004
#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
#define PROCESS_CREATE_FLAGS_LARGE_PAGES            0x00000010

    // Only usable with NtCreateUserProcess (Vista+):
#define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL  0x00000020
#define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS      0x00000040 // Only allowed if the calling process is itself protected
#define PROCESS_CREATE_FLAGS_CREATE_SESSION         0x00000080
#define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT    0x00000100

    typedef enum _MEMORY_RESERVE_TYPE
    {
        MemoryReserveUserApc,
        MemoryReserveIoCompletion,
        MemoryReserveTypeMax
    } MEMORY_RESERVE_TYPE;

    typedef struct _PROCESS_HANDLE_TRACING_ENABLE
    {
        ULONG Flags;
    } PROCESS_HANDLE_TRACING_ENABLE, * PPROCESS_HANDLE_TRACING_ENABLE;

#define PROCESS_HANDLE_TRACING_MAX_SLOTS 0x20000

    typedef struct _PROCESS_HANDLE_TRACING_ENABLE_EX
    {
        ULONG Flags;
        ULONG TotalSlots;
    } PROCESS_HANDLE_TRACING_ENABLE_EX, * PPROCESS_HANDLE_TRACING_ENABLE_EX;

    // Source: http://processhacker.sourceforge.net
    typedef enum _PROCESSINFOCLASS
    {
        ProcessBasicInformation, // q: PROCESS_BASIC_INFORMATION, PROCESS_EXTENDED_BASIC_INFORMATION
        ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
        ProcessIoCounters, // q: IO_COUNTERS
        ProcessVmCounters, // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
        ProcessTimes, // q: KERNEL_USER_TIMES
        ProcessBasePriority, // s: KPRIORITY
        ProcessRaisePriority, // s: ULONG
        ProcessDebugPort, // q: HANDLE
        ProcessExceptionPort, // s: HANDLE
        ProcessAccessToken, // s: PROCESS_ACCESS_TOKEN
        ProcessLdtInformation, // qs: PROCESS_LDT_INFORMATION // 10
        ProcessLdtSize, // s: PROCESS_LDT_SIZE
        ProcessDefaultHardErrorMode, // qs: ULONG
        ProcessIoPortHandlers, // (kernel-mode only)
        ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS
        ProcessWorkingSetWatch, // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
        ProcessUserModeIOPL,
        ProcessEnableAlignmentFaultFixup, // s: BOOLEAN
        ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS
        ProcessWx86Information,
        ProcessHandleCount, // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
        ProcessAffinityMask, // s: KAFFINITY
        ProcessPriorityBoost, // qs: ULONG
        ProcessDeviceMap, // qs: PROCESS_DEVICEMAP_INFORMATION, PROCESS_DEVICEMAP_INFORMATION_EX
        ProcessSessionInformation, // q: PROCESS_SESSION_INFORMATION
        ProcessForegroundInformation, // s: PROCESS_FOREGROUND_BACKGROUND
        ProcessWow64Information, // q: ULONG_PTR
        ProcessImageFileName, // q: UNICODE_STRING
        ProcessLUIDDeviceMapsEnabled, // q: ULONG
        ProcessBreakOnTermination, // qs: ULONG
        ProcessDebugObjectHandle, // q: HANDLE // 30
        ProcessDebugFlags, // qs: ULONG
        ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables
        ProcessIoPriority, // qs: IO_PRIORITY_HINT
        ProcessExecuteFlags, // qs: ULONG
        ProcessResourceManagement,
        ProcessCookie, // q: ULONG
        ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
        ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
        ProcessPagePriority, // q: ULONG
        ProcessInstrumentationCallback, // 40
        ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
        ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]
        ProcessImageFileNameWin32, // q: UNICODE_STRING
        ProcessImageFileMapping, // q: HANDLE (input)
        ProcessAffinityUpdateMode, // qs: PROCESS_AFFINITY_UPDATE_MODE
        ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE
        ProcessGroupInformation, // q: USHORT[]
        ProcessTokenVirtualizationEnabled, // s: ULONG
        ProcessConsoleHostProcess, // q: ULONG_PTR
        ProcessWindowInformation, // q: PROCESS_WINDOW_INFORMATION // 50
        ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8
        ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION
        ProcessDynamicFunctionTableInformation,
        ProcessHandleCheckingMode,
        ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
        ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
        ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
        ProcessHandleTable, // since WINBLUE
        ProcessCheckStackExtentsMode,
        ProcessCommandLineInformation, // q: UNICODE_STRING // 60
        ProcessProtectionInformation, // q: PS_PROTECTION
        ProcessMemoryExhaustion, // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
        ProcessFaultInformation, // PROCESS_FAULT_INFORMATION
        ProcessTelemetryIdInformation, // PROCESS_TELEMETRY_ID_INFORMATION
        ProcessCommitReleaseInformation, // PROCESS_COMMIT_RELEASE_INFORMATION
        ProcessDefaultCpuSetsInformation,
        ProcessAllowedCpuSetsInformation,
        ProcessSubsystemProcess,
        ProcessJobMemoryInformation, // PROCESS_JOB_MEMORY_INFO
        ProcessInPrivate, // since THRESHOLD2 // 70
        ProcessRaiseUMExceptionOnInvalidHandleClose,
        ProcessIumChallengeResponse,
        ProcessChildProcessInformation, // PROCESS_CHILD_PROCESS_INFORMATION
        ProcessHighGraphicsPriorityInformation,
        ProcessSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
        ProcessEnergyValues, // PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES
        ProcessActivityThrottleState, // PROCESS_ACTIVITY_THROTTLE_STATE
        ProcessActivityThrottlePolicy, // PROCESS_ACTIVITY_THROTTLE_POLICY
        ProcessWin32kSyscallFilterInformation,
        ProcessDisableSystemAllowedCpuSets,
        ProcessWakeInformation, // PROCESS_WAKE_INFORMATION
        ProcessEnergyTrackingState, // PROCESS_ENERGY_TRACKING_STATE
        MaxProcessInfoClass
    } PROCESSINFOCLASS;

    // Source: http://processhacker.sourceforge.net
    typedef enum _SYSTEM_INFORMATION_CLASS
    {
        SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
        SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
        SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
        SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
        SystemPathInformation, // not implemented
        SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
        SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
        SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
        SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
        SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION
        SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10
        SystemModuleInformation, // q: RTL_PROCESS_MODULES
        SystemLocksInformation, // q: RTL_PROCESS_LOCKS
        SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
        SystemPagedPoolInformation, // not implemented
        SystemNonPagedPoolInformation, // not implemented
        SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
        SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
        SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
        SystemVdmInstemulInformation, // q
        SystemVdmBopInformation, // not implemented // 20
        SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
        SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
        SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION
        SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
        SystemFullMemoryInformation, // not implemented
        SystemLoadGdiDriverInformation, // s (kernel-mode only)
        SystemUnloadGdiDriverInformation, // s (kernel-mode only)
        SystemTimeAdjustmentInformation, // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
        SystemSummaryMemoryInformation, // not implemented
        SystemMirrorMemoryInformation, // s (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
        SystemPerformanceTraceInformation, // q; s: (type depends on EVENT_TRACE_INFORMATION_CLASS)
        SystemObsolete0, // not implemented
        SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
        SystemCrashDumpStateInformation, // s (requires SeDebugPrivilege)
        SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
        SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
        SystemRegistryQuotaInformation, // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
        SystemExtendServiceTableInformation, // s (requires SeLoadDriverPrivilege) // loads win32k only
        SystemPrioritySeperation, // s (requires SeTcbPrivilege)
        SystemVerifierAddDriverInformation, // s (requires SeDebugPrivilege) // 40
        SystemVerifierRemoveDriverInformation, // s (requires SeDebugPrivilege)
        SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION
        SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
        SystemCurrentTimeZoneInformation, // q
        SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
        SystemTimeSlipNotification, // s (requires SeSystemtimePrivilege)
        SystemSessionCreate, // not implemented
        SystemSessionDetach, // not implemented
        SystemSessionInformation, // not implemented
        SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
        SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
        SystemVerifierThunkExtend, // s (kernel-mode only)
        SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
        SystemLoadGdiDriverInSystemSpace, // s (kernel-mode only) (same as SystemLoadGdiDriverInformation)
        SystemNumaProcessorMap, // q
        SystemPrefetcherInformation, // q: PREFETCHER_INFORMATION; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
        SystemExtendedProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
        SystemRecommendedSharedDataAlignment, // q
        SystemComPlusPackage, // q; s
        SystemNumaAvailableMemory, // 60
        SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION
        SystemEmulationBasicInformation, // q
        SystemEmulationProcessorInformation,
        SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
        SystemLostDelayedWriteInformation, // q: ULONG
        SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
        SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
        SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
        SystemHotpatchInformation, // q; s
        SystemObjectSecurityMode, // q // 70
        SystemWatchdogTimerHandler, // s (kernel-mode only)
        SystemWatchdogTimerInformation, // q (kernel-mode only); s (kernel-mode only)
        SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION
        SystemWow64SharedInformationObsolete, // not implemented
        SystemRegisterFirmwareTableInformationHandler, // s (kernel-mode only)
        SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION
        SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX
        SystemVerifierTriageInformation, // not implemented
        SystemSuperfetchInformation, // q; s: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
        SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
        SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
        SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege)
        SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[]
        SystemVerifierCancellationInformation, // not implemented // name:wow64:whNT32QuerySystemVerifierCancellationInformation
        SystemProcessorPowerInformationEx, // not implemented
        SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
        SystemSpecialPoolInformation, // q; s (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
        SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
        SystemErrorPortInformation, // s (requires SeTcbPrivilege)
        SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
        SystemHypervisorInformation, // q; s (kernel-mode only)
        SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX
        SystemTimeZoneInformation, // s (requires SeTimeZonePrivilege)
        SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
        SystemCoverageInformation, // q; s // name:wow64:whNT32QuerySystemCoverageInformation; ExpCovQueryInformation
        SystemPrefetchPatchInformation, // not implemented
        SystemVerifierFaultsInformation, // s (requires SeDebugPrivilege)
        SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
        SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
        SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100
        SystemNumaProximityNodeInformation, // q
        SystemDynamicTimeZoneInformation, // q; s (requires SeTimeZonePrivilege)
        SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
        SystemProcessorMicrocodeUpdateInformation, // s
        SystemProcessorBrandString, // q // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
        SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
        SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship
        SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[]
        SystemStoreInformation, // q; s // SmQueryStoreInformation
        SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
        SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
        SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
        SystemCpuQuotaInformation, // q; s // PsQueryCpuQuotaInformation
        SystemNativeBasicInformation, // not implemented
        SystemSpare1, // not implemented
        SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
        SystemTpmBootEntropyInformation, // q: TPM_BOOT_ENTROPY_NT_RESULT // ExQueryTpmBootEntropyInformation
        SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
        SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
        SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
        SystemNodeDistanceInformation, // q
        SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
        SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
        SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
        SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
        SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
        SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION
        SystemBadPageInformation,
        SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
        SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
        SystemEntropyInterruptTimingCallback,
        SystemConsoleInformation, // q: SYSTEM_CONSOLE_INFORMATION
        SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION
        SystemThrottleNotificationInformation,
        SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
        SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
        SystemDeviceDataEnumerationInformation,
        SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
        SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
        SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
        SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // since WINBLUE
        SystemSpare0,
        SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
        SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
        SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
        SystemEntropyInterruptTimingRawInformation,
        SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
        SystemFullProcessInformation, // q: SYSTEM_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
        SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
        SystemBootMetadataInformation, // 150
        SystemSoftRebootInformation,
        SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
        SystemOfflineDumpConfigInformation,
        SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
        SystemRegistryReconciliationInformation,
        SystemEdidInformation,
        SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
        SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
        SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
        SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160
        SystemVmGenerationCountInformation,
        SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
        SystemKernelDebuggerFlags,
        SystemCodeIntegrityPolicyInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
        SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
        SystemHardwareSecurityTestInterfaceResultsInformation,
        SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
        SystemAllowedCpuSetsInformation,
        SystemDmaProtectionInformation, // q: SYSTEM_DMA_PROTECTION_INFORMATION
        SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
        SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
        SystemCodeIntegrityPolicyFullInformation,
        SystemAffinitizedInterruptProcessorInformation,
        SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
        SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
        SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
        SystemWin32WerStartCallout,
        SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
        SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // since REDSTONE
        SystemInterruptSteeringInformation, // 180
        SystemSupportedProcessorArchitectures,
        SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
        SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
        SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
        SystemControlFlowTransition,
        SystemKernelDebuggingAllowed,
        SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE
        SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
        SystemCodeIntegrityPoliciesFullInformation,
        SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
        SystemIntegrityQuotaInformation,
        SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
        MaxSystemInfoClass
    } SYSTEM_INFORMATION_CLASS;

    typedef enum _OBJECT_INFORMATION_CLASS
    {
        ObjectBasicInformation, // OBJECT_BASIC_INFORMATION
        ObjectNameInformation, // OBJECT_NAME_INFORMATION
        ObjectTypeInformation, // OBJECT_TYPE_INFORMATION
        ObjectTypesInformation, // OBJECT_TYPES_INFORMATION
        ObjectHandleFlagInformation, // OBJECT_HANDLE_FLAG_INFORMATION
        ObjectSessionInformation,
        ObjectSessionObjectInformation,
        MaxObjectInfoClass
    } OBJECT_INFORMATION_CLASS;

    //Source: http://processhacker.sourceforge.net
    typedef enum _THREADINFOCLASS
    {
        ThreadBasicInformation, // q: THREAD_BASIC_INFORMATION
        ThreadTimes, // q: KERNEL_USER_TIMES
        ThreadPriority, // s: KPRIORITY
        ThreadBasePriority, // s: LONG
        ThreadAffinityMask, // s: KAFFINITY
        ThreadImpersonationToken, // s: HANDLE
        ThreadDescriptorTableEntry, // q: DESCRIPTOR_TABLE_ENTRY (or WOW64_DESCRIPTOR_TABLE_ENTRY)
        ThreadEnableAlignmentFaultFixup, // s: BOOLEAN
        ThreadEventPair,
        ThreadQuerySetWin32StartAddress, // q: PVOID
        ThreadZeroTlsCell, // 10
        ThreadPerformanceCount, // q: LARGE_INTEGER
        ThreadAmILastThread, // q: ULONG
        ThreadIdealProcessor, // s: ULONG
        ThreadPriorityBoost, // qs: ULONG
        ThreadSetTlsArrayAddress,
        ThreadIsIoPending, // q: ULONG
        ThreadHideFromDebugger, // s: void
        ThreadBreakOnTermination, // qs: ULONG
        ThreadSwitchLegacyState,
        ThreadIsTerminated, // q: ULONG // 20
        ThreadLastSystemCall, // q: THREAD_LAST_SYSCALL_INFORMATION
        ThreadIoPriority, // qs: IO_PRIORITY_HINT
        ThreadCycleTime, // q: THREAD_CYCLE_TIME_INFORMATION
        ThreadPagePriority, // q: ULONG
        ThreadActualBasePriority,
        ThreadTebInformation, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_SET_CONTEXT)
        ThreadCSwitchMon,
        ThreadCSwitchPmu,
        ThreadWow64Context, // q: WOW64_CONTEXT
        ThreadGroupInformation, // q: GROUP_AFFINITY // 30
        ThreadUmsInformation, // q: THREAD_UMS_INFORMATION
        ThreadCounterProfiling,
        ThreadIdealProcessorEx, // q: PROCESSOR_NUMBER
        ThreadCpuAccountingInformation, // since WIN8
        ThreadSuspendCount, // since WINBLUE
        ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD
        ThreadContainerId, // q: GUID
        ThreadNameInformation, // qs: THREAD_NAME_INFORMATION
        ThreadSelectedCpuSets,
        ThreadSystemThreadInformation, // q: SYSTEM_THREAD_INFORMATION // 40
        ThreadActualGroupAffinity, // since THRESHOLD2
        ThreadDynamicCodePolicyInfo,
        ThreadExplicitCaseSensitivity,
        ThreadWorkOnBehalfTicket,
        ThreadSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
        ThreadDbgkWerReportActive,
        ThreadAttachContainer,
        MaxThreadInfoClass
    } THREADINFOCLASS;

    typedef enum _FSINFOCLASS
    {
        FileFsVolumeInformation = 1,    // FILE_FS_VOLUME_INFORMATION
        FileFsLabelInformation = 2,    // FILE_FS_LABEL_INFORMATION
        FileFsSizeInformation = 3,    // FILE_FS_SIZE_INFORMATION
        FileFsDeviceInformation = 4,    // FILE_FS_DEVICE_INFORMATION
        FileFsAttributeInformation = 5,    // FILE_FS_ATTRIBUTE_INFORMATION
        FileFsControlInformation = 6,    // FILE_FS_CONTROL_INFORMATION
        FileFsFullSizeInformation = 7,    // FILE_FS_FULL_SIZE_INFORMATION
        FileFsObjectIdInformation = 8,    // FILE_FS_OBJECTID_INFORMATION
        FileFsDriverPathInformation = 9,    // FILE_FS_DRIVER_PATH_INFORMATION
        FileFsVolumeFlagsInformation = 10,   // FILE_FS_VOLUME_FLAGS_INFORMATION
        FileFsSectorSizeInformation = 11,   // FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8
        FileFsDataCopyInformation = 12,   // FILE_FS_DATA_COPY_INFORMATION
        FileFsMetadataSizeInformation = 13,   // FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD
        FileFsMaximumInformation
    } FS_INFORMATION_CLASS, * PFS_INFORMATION_CLASS;

    typedef enum _MEMORY_INFORMATION_CLASS
    {
        MemoryBasicInformation, // MEMORY_BASIC_INFORMATION
        MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION
        MemoryMappedFilenameInformation, // UNICODE_STRING
        MemoryRegionInformation, // MEMORY_REGION_INFORMATION
        MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION
        MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION
        MemoryImageInformation, // MEMORY_IMAGE_INFORMATION
        MemoryRegionInformationEx,
        MemoryPrivilegedBasicInformation
    } MEMORY_INFORMATION_CLASS;

    typedef enum _SECTION_INFORMATION_CLASS
    {
        SectionBasicInformation,
        SectionImageInformation,
        SectionRelocationInformation, // name:wow64:whNtQuerySection_SectionRelocationInformation
        SectionOriginalBaseInformation, // PVOID BaseAddress
        SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2
        MaxSectionInfoClass
    } SECTION_INFORMATION_CLASS;

    // Boot condition flags (NtInitializeRegistry)
#define REG_INIT_BOOT_SM                0x0000
#define REG_INIT_BOOT_SETUP             0x0001
#define REG_INIT_BOOT_ACCEPTED_BASE     0x0002
#define REG_INIT_BOOT_ACCEPTED_MAX      REG_INIT_BOOT_ACCEPTED_BASE + 999

#define REG_MAX_KEY_VALUE_NAME_LENGTH   32767
#define REG_MAX_KEY_NAME_LENGTH         512

    typedef enum _KEY_INFORMATION_CLASS
    {
        KeyBasicInformation, // KEY_BASIC_INFORMATION
        KeyNodeInformation, // KEY_NODE_INFORMATION
        KeyFullInformation, // KEY_FULL_INFORMATION
        KeyNameInformation, // KEY_NAME_INFORMATION
        KeyCachedInformation, // KEY_CACHED_INFORMATION
        KeyFlagsInformation, // KEY_FLAGS_INFORMATION
        KeyVirtualizationInformation, // KEY_VIRTUALIZATION_INFORMATION
        KeyHandleTagsInformation, // KEY_HANDLE_TAGS_INFORMATION
        KeyTrustInformation, // KEY_TRUST_INFORMATION
        KeyLayerInformation, // KEY_LAYER_INFORMATION
        MaxKeyInfoClass
    } KEY_INFORMATION_CLASS;

    typedef struct _KEY_BASIC_INFORMATION
    {
        LARGE_INTEGER LastWriteTime;
        ULONG TitleIndex;
        ULONG NameLength;
        WCHAR Name[1];
    } KEY_BASIC_INFORMATION, * PKEY_BASIC_INFORMATION;

    typedef struct _KEY_NODE_INFORMATION
    {
        LARGE_INTEGER LastWriteTime;
        ULONG TitleIndex;
        ULONG ClassOffset;
        ULONG ClassLength;
        ULONG NameLength;
        WCHAR Name[1];
        // ...
        // WCHAR Class[1];
    } KEY_NODE_INFORMATION, * PKEY_NODE_INFORMATION;

    typedef struct _KEY_FULL_INFORMATION
    {
        LARGE_INTEGER LastWriteTime;
        ULONG TitleIndex;
        ULONG ClassOffset;
        ULONG ClassLength;
        ULONG SubKeys;
        ULONG MaxNameLen;
        ULONG MaxClassLen;
        ULONG Values;
        ULONG MaxValueNameLen;
        ULONG MaxValueDataLen;
        WCHAR Class[1];
    } KEY_FULL_INFORMATION, * PKEY_FULL_INFORMATION;

    typedef struct _KEY_NAME_INFORMATION
    {
        ULONG NameLength;
        WCHAR Name[1];
    } KEY_NAME_INFORMATION, * PKEY_NAME_INFORMATION;

    typedef struct _KEY_CACHED_INFORMATION
    {
        LARGE_INTEGER LastWriteTime;
        ULONG TitleIndex;
        ULONG SubKeys;
        ULONG MaxNameLen;
        ULONG Values;
        ULONG MaxValueNameLen;
        ULONG MaxValueDataLen;
        ULONG NameLength;
        WCHAR Name[1];
    } KEY_CACHED_INFORMATION, * PKEY_CACHED_INFORMATION;

    typedef struct _KEY_FLAGS_INFORMATION
    {
        ULONG UserFlags;
    } KEY_FLAGS_INFORMATION, * PKEY_FLAGS_INFORMATION;

    typedef struct _KEY_VIRTUALIZATION_INFORMATION
    {
        ULONG VirtualizationCandidate : 1; // Tells whether the key is part of the virtualization namespace scope (only HKLM\Software for now).
        ULONG VirtualizationEnabled : 1; // Tells whether virtualization is enabled on this key. Can be 1 only if above flag is 1.
        ULONG VirtualTarget : 1; // Tells if the key is a virtual key. Can be 1 only if above 2 are 0. Valid only on the virtual store key handles.
        ULONG VirtualStore : 1; // Tells if the key is a part of the virtual store path. Valid only on the virtual store key handles.
        ULONG VirtualSource : 1; // Tells if the key has ever been virtualized, can be 1 only if VirtualizationCandidate is 1.
        ULONG Reserved : 27;
    } KEY_VIRTUALIZATION_INFORMATION, * PKEY_VIRTUALIZATION_INFORMATION;

    // private
    typedef struct _KEY_TRUST_INFORMATION
    {
        ULONG TrustedKey : 1;
        ULONG Reserved : 31;
    } KEY_TRUST_INFORMATION, * PKEY_TRUST_INFORMATION;

    // private
    typedef struct _KEY_LAYER_INFORMATION
    {
        ULONG IsTombstone;
        ULONG IsSupersedeLocal;
        ULONG IsSupersedeTree;
        ULONG ClassIsInherited;
        ULONG Reserved;
    } KEY_LAYER_INFORMATION, * PKEY_LAYER_INFORMATION;

    typedef enum _KEY_SET_INFORMATION_CLASS
    {
        KeyWriteTimeInformation, // KEY_WRITE_TIME_INFORMATION
        KeyWow64FlagsInformation, // KEY_WOW64_FLAGS_INFORMATION
        KeyControlFlagsInformation, // KEY_CONTROL_FLAGS_INFORMATION
        KeySetVirtualizationInformation, // KEY_SET_VIRTUALIZATION_INFORMATION
        KeySetDebugInformation,
        KeySetHandleTagsInformation, // KEY_HANDLE_TAGS_INFORMATION
        MaxKeySetInfoClass
    } KEY_SET_INFORMATION_CLASS;

    typedef struct _KEY_WRITE_TIME_INFORMATION
    {
        LARGE_INTEGER LastWriteTime;
    } KEY_WRITE_TIME_INFORMATION, * PKEY_WRITE_TIME_INFORMATION;

    typedef struct _KEY_WOW64_FLAGS_INFORMATION
    {
        ULONG UserFlags;
    } KEY_WOW64_FLAGS_INFORMATION, * PKEY_WOW64_FLAGS_INFORMATION;

    typedef struct _KEY_HANDLE_TAGS_INFORMATION
    {
        ULONG HandleTags;
    } KEY_HANDLE_TAGS_INFORMATION, * PKEY_HANDLE_TAGS_INFORMATION;

    typedef struct _KEY_CONTROL_FLAGS_INFORMATION
    {
        ULONG ControlFlags;
    } KEY_CONTROL_FLAGS_INFORMATION, * PKEY_CONTROL_FLAGS_INFORMATION;

    typedef struct _KEY_SET_VIRTUALIZATION_INFORMATION
    {
        ULONG VirtualTarget : 1;
        ULONG VirtualStore : 1;
        ULONG VirtualSource : 1; // true if key has been virtualized at least once
        ULONG Reserved : 29;
    } KEY_SET_VIRTUALIZATION_INFORMATION, * PKEY_SET_VIRTUALIZATION_INFORMATION;

    typedef enum _KEY_VALUE_INFORMATION_CLASS
    {
        KeyValueBasicInformation, // KEY_VALUE_BASIC_INFORMATION
        KeyValueFullInformation, // KEY_VALUE_FULL_INFORMATION
        KeyValuePartialInformation, // KEY_VALUE_PARTIAL_INFORMATION
        KeyValueFullInformationAlign64,
        KeyValuePartialInformationAlign64, // KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
        KeyValueLayerInformation, // KEY_VALUE_LAYER_INFORMATION
        MaxKeyValueInfoClass
    } KEY_VALUE_INFORMATION_CLASS;

    typedef struct _KEY_VALUE_BASIC_INFORMATION
    {
        ULONG TitleIndex;
        ULONG Type;
        ULONG NameLength;
        WCHAR Name[1];
    } KEY_VALUE_BASIC_INFORMATION, * PKEY_VALUE_BASIC_INFORMATION;

    typedef struct _KEY_VALUE_FULL_INFORMATION
    {
        ULONG TitleIndex;
        ULONG Type;
        ULONG DataOffset;
        ULONG DataLength;
        ULONG NameLength;
        WCHAR Name[1];
        // ...
        // UCHAR Data[1];
    } KEY_VALUE_FULL_INFORMATION, * PKEY_VALUE_FULL_INFORMATION;

    typedef struct _KEY_VALUE_PARTIAL_INFORMATION
    {
        ULONG TitleIndex;
        ULONG Type;
        ULONG DataLength;
        UCHAR Data[1];
    } KEY_VALUE_PARTIAL_INFORMATION, * PKEY_VALUE_PARTIAL_INFORMATION;

    typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
    {
        ULONG Type;
        ULONG DataLength;
        UCHAR Data[1];
    } KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, * PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64;

    // private
    typedef struct _KEY_VALUE_LAYER_INFORMATION
    {
        ULONG IsTombstone;
        ULONG Reserved;
    } KEY_VALUE_LAYER_INFORMATION, * PKEY_VALUE_LAYER_INFORMATION;

    typedef struct _KEY_VALUE_ENTRY
    {
        PUNICODE_STRING ValueName;
        ULONG DataLength;
        ULONG DataOffset;
        ULONG Type;
    } KEY_VALUE_ENTRY, * PKEY_VALUE_ENTRY;

    typedef enum _REG_ACTION
    {
        KeyAdded,
        KeyRemoved,
        KeyModified
    } REG_ACTION;

    typedef struct _REG_NOTIFY_INFORMATION
    {
        ULONG NextEntryOffset;
        REG_ACTION Action;
        ULONG KeyLength;
        WCHAR Key[1];
    } REG_NOTIFY_INFORMATION, * PREG_NOTIFY_INFORMATION;

    typedef struct _KEY_PID_ARRAY
    {
        HANDLE PID;
        UNICODE_STRING KeyName;
    } KEY_PID_ARRAY, * PKEY_PID_ARRAY;

    typedef struct _KEY_OPEN_SUBKEYS_INFORMATION
    {
        ULONG Count;
        KEY_PID_ARRAY KeyArray[1];
    } KEY_OPEN_SUBKEYS_INFORMATION, * PKEY_OPEN_SUBKEYS_INFORMATION;

    typedef enum _SYSDBG_COMMAND
    {
        SysDbgQueryModuleInformation,
        SysDbgQueryTraceInformation,
        SysDbgSetTracepoint,
        SysDbgSetSpecialCall,
        SysDbgClearSpecialCalls,
        SysDbgQuerySpecialCalls,
        SysDbgBreakPoint,
        SysDbgQueryVersion,
        SysDbgReadVirtual,
        SysDbgWriteVirtual,
        SysDbgReadPhysical,
        SysDbgWritePhysical,
        SysDbgReadControlSpace,
        SysDbgWriteControlSpace,
        SysDbgReadIoSpace,
        SysDbgWriteIoSpace,
        SysDbgReadMsr,
        SysDbgWriteMsr,
        SysDbgReadBusData,
        SysDbgWriteBusData,
        SysDbgCheckLowMemory,
        SysDbgEnableKernelDebugger,
        SysDbgDisableKernelDebugger,
        SysDbgGetAutoKdEnable,
        SysDbgSetAutoKdEnable,
        SysDbgGetPrintBufferSize,
        SysDbgSetPrintBufferSize,
        SysDbgGetKdUmExceptionEnable,
        SysDbgSetKdUmExceptionEnable,
        SysDbgGetTriageDump,
        SysDbgGetKdBlockEnable,
        SysDbgSetKdBlockEnable,
        SysDbgRegisterForUmBreakInfo,
        SysDbgGetUmBreakPid,
        SysDbgClearUmBreakPid,
        SysDbgGetUmAttachPid,
        SysDbgClearUmAttachPid,
        SysDbgGetLiveKernelDump
    } SYSDBG_COMMAND, * PSYSDBG_COMMAND;

    typedef enum _DEBUGOBJECTINFOCLASS
    {
        DebugObjectFlags = 1,
        MaxDebugObjectInfoClass
    } DEBUGOBJECTINFOCLASS, * PDEBUGOBJECTINFOCLASS;

    //Source: http://processhacker.sourceforge.net
    typedef enum _FILE_INFORMATION_CLASS
    {
        FileDirectoryInformation = 1, // FILE_DIRECTORY_INFORMATION
        FileFullDirectoryInformation, // FILE_FULL_DIR_INFORMATION
        FileBothDirectoryInformation, // FILE_BOTH_DIR_INFORMATION
        FileBasicInformation, // FILE_BASIC_INFORMATION
        FileStandardInformation, // FILE_STANDARD_INFORMATION
        FileInternalInformation, // FILE_INTERNAL_INFORMATION
        FileEaInformation, // FILE_EA_INFORMATION
        FileAccessInformation, // FILE_ACCESS_INFORMATION
        FileNameInformation, // FILE_NAME_INFORMATION
        FileRenameInformation, // FILE_RENAME_INFORMATION // 10
        FileLinkInformation, // FILE_LINK_INFORMATION
        FileNamesInformation, // FILE_NAMES_INFORMATION
        FileDispositionInformation, // FILE_DISPOSITION_INFORMATION
        FilePositionInformation, // FILE_POSITION_INFORMATION
        FileFullEaInformation, // FILE_FULL_EA_INFORMATION
        FileModeInformation, // FILE_MODE_INFORMATION
        FileAlignmentInformation, // FILE_ALIGNMENT_INFORMATION
        FileAllInformation, // FILE_ALL_INFORMATION
        FileAllocationInformation, // FILE_ALLOCATION_INFORMATION
        FileEndOfFileInformation, // FILE_END_OF_FILE_INFORMATION // 20
        FileAlternateNameInformation, // FILE_NAME_INFORMATION
        FileStreamInformation, // FILE_STREAM_INFORMATION
        FilePipeInformation, // FILE_PIPE_INFORMATION
        FilePipeLocalInformation, // FILE_PIPE_LOCAL_INFORMATION
        FilePipeRemoteInformation, // FILE_PIPE_REMOTE_INFORMATION
        FileMailslotQueryInformation, // FILE_MAILSLOT_QUERY_INFORMATION
        FileMailslotSetInformation, // FILE_MAILSLOT_SET_INFORMATION
        FileCompressionInformation, // FILE_COMPRESSION_INFORMATION
        FileObjectIdInformation, // FILE_OBJECTID_INFORMATION
        FileCompletionInformation, // FILE_COMPLETION_INFORMATION // 30
        FileMoveClusterInformation, // FILE_MOVE_CLUSTER_INFORMATION
        FileQuotaInformation, // FILE_QUOTA_INFORMATION
        FileReparsePointInformation, // FILE_REPARSE_POINT_INFORMATION
        FileNetworkOpenInformation, // FILE_NETWORK_OPEN_INFORMATION
        FileAttributeTagInformation, // FILE_ATTRIBUTE_TAG_INFORMATION
        FileTrackingInformation, // FILE_TRACKING_INFORMATION
        FileIdBothDirectoryInformation, // FILE_ID_BOTH_DIR_INFORMATION
        FileIdFullDirectoryInformation, // FILE_ID_FULL_DIR_INFORMATION
        FileValidDataLengthInformation, // FILE_VALID_DATA_LENGTH_INFORMATION
        FileShortNameInformation, // FILE_NAME_INFORMATION // 40
        FileIoCompletionNotificationInformation, // FILE_IO_COMPLETION_NOTIFICATION_INFORMATION // since VISTA
        FileIoStatusBlockRangeInformation, // FILE_IOSTATUSBLOCK_RANGE_INFORMATION
        FileIoPriorityHintInformation, // FILE_IO_PRIORITY_HINT_INFORMATION
        FileSfioReserveInformation, // FILE_SFIO_RESERVE_INFORMATION
        FileSfioVolumeInformation, // FILE_SFIO_VOLUME_INFORMATION
        FileHardLinkInformation, // FILE_LINKS_INFORMATION
        FileProcessIdsUsingFileInformation, // FILE_PROCESS_IDS_USING_FILE_INFORMATION
        FileNormalizedNameInformation, // FILE_NAME_INFORMATION
        FileNetworkPhysicalNameInformation, // FILE_NETWORK_PHYSICAL_NAME_INFORMATION
        FileIdGlobalTxDirectoryInformation, // FILE_ID_GLOBAL_TX_DIR_INFORMATION // since WIN7 // 50
        FileIsRemoteDeviceInformation, // FILE_IS_REMOTE_DEVICE_INFORMATION
        FileUnusedInformation,
        FileNumaNodeInformation, // FILE_NUMA_NODE_INFORMATION
        FileStandardLinkInformation, // FILE_STANDARD_LINK_INFORMATION
        FileRemoteProtocolInformation, // FILE_REMOTE_PROTOCOL_INFORMATION
        FileRenameInformationBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION // since WIN8
        FileLinkInformationBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION
        FileVolumeNameInformation, // FILE_VOLUME_NAME_INFORMATION
        FileIdInformation, // FILE_ID_INFORMATION
        FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION
        FileReplaceCompletionInformation, // FILE_COMPLETION_INFORMATION // since WINBLUE
        FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION
        FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD
        FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE
        FileRenameInformationEx,
        FileRenameInformationExBypassAccessCheck,
        FileDesiredStorageClassInformation, // FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2
        FileStatInformation, // FILE_STAT_INFORMATION
        FileMaximumInformation
    } FILE_INFORMATION_CLASS, * PFILE_INFORMATION_CLASS;

    typedef struct _SYSTEM_BASIC_INFORMATION
    {
        ULONG Reserved;
        ULONG TimerResolution;
        ULONG PageSize;
        ULONG NumberOfPhysicalPages;
        ULONG LowestPhysicalPageNumber;
        ULONG HighestPhysicalPageNumber;
        ULONG AllocationGranularity;
        ULONG_PTR MinimumUserModeAddress;
        ULONG_PTR MaximumUserModeAddress;
        ULONG_PTR ActiveProcessorsAffinityMask;
        CCHAR NumberOfProcessors;
    } SYSTEM_BASIC_INFORMATION, * PSYSTEM_BASIC_INFORMATION;

    typedef struct _FILE_PIPE_PEEK_BUFFER
    {
        ULONG NamedPipeState;
        ULONG ReadDataAvailable;
        ULONG NumberOfMessages;
        ULONG MessageLength;
        CHAR Data[1];
    } FILE_PIPE_PEEK_BUFFER, * PFILE_PIPE_PEEK_BUFFER;

    typedef struct _NAMED_PIPE_CREATE_PARAMETERS
    {
        ULONG NamedPipeType;
        ULONG ReadMode;
        ULONG CompletionMode;
        ULONG MaximumInstances;
        ULONG InboundQuota;
        ULONG OutboundQuota;
        LARGE_INTEGER DefaultTimeout;
        BOOLEAN TimeoutSpecified;
    } NAMED_PIPE_CREATE_PARAMETERS, * PNAMED_PIPE_CREATE_PARAMETERS;

    typedef struct _FILE_NETWORK_OPEN_INFORMATION
    {
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER AllocationSize;
        LARGE_INTEGER EndOfFile;
        ULONG FileAttributes;
    } FILE_NETWORK_OPEN_INFORMATION, * PFILE_NETWORK_OPEN_INFORMATION;

    typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
    {
        LARGE_INTEGER BootTime;
        LARGE_INTEGER CurrentTime;
        LARGE_INTEGER TimeZoneBias;
        ULONG TimeZoneId;
        ULONG Reserved;
        ULONGLONG BootTimeBias;
        ULONGLONG SleepTimeBias;
    } SYSTEM_TIMEOFDAY_INFORMATION, * PSYSTEM_TIMEOFDAY_INFORMATION;

    typedef struct _SYSTEM_CONSOLE_INFORMATION
    {
        ULONG DriverLoaded : 1;
        ULONG Spare : 31;
    } SYSTEM_CONSOLE_INFORMATION, * PSYSTEM_CONSOLE_INFORMATION;

    typedef struct _KSYSTEM_TIME
    {
        ULONG LowPart;
        LONG High1Time;
        LONG High2Time;
    } KSYSTEM_TIME, * PKSYSTEM_TIME;

    typedef struct _PROCESS_ACCESS_TOKEN
    {
        HANDLE Token; // Needs TOKEN_ASSIGN_PRIMARY access
        HANDLE Thread; // Handle to initial/only thread; needs THREAD_QUERY_INFORMATION access
    } PROCESS_ACCESS_TOKEN, * PPROCESS_ACCESS_TOKEN;

#ifdef __cplusplus
    typedef enum _PS_PROTECTED_TYPE : UCHAR
    {
        PsProtectedTypeNone,
        PsProtectedTypeProtectedLight,
        PsProtectedTypeProtected,
        PsProtectedTypeMax
    } PS_PROTECTED_TYPE;
#else
    typedef UCHAR PS_PROTECTED_TYPE;
#endif

#ifdef __cplusplus
    typedef enum _PS_PROTECTED_SIGNER : UCHAR
    {
        PsProtectedSignerNone,
        PsProtectedSignerAuthenticode,
        PsProtectedSignerCodeGen,
        PsProtectedSignerAntimalware,
        PsProtectedSignerLsa,
        PsProtectedSignerWindows,
        PsProtectedSignerWinTcb,
        PsProtectedSignerWinSystem,
        PsProtectedSignerApp,
        PsProtectedSignerMax
    } PS_PROTECTED_SIGNER;
#else
    typedef UCHAR PS_PROTECTED_SIGNER;
#endif

    typedef struct _PS_PROTECTION
    {
        union
        {
            struct
            {
                PS_PROTECTED_TYPE Type : 3;
                BOOLEAN Audit : 1;
                PS_PROTECTED_SIGNER Signer : 4;
            } s;
            UCHAR Level;
        };
    } PS_PROTECTION, * PPS_PROTECTION;

#define RTL_CREATE_ENVIRONMENT_TRANSLATE            0x1 // Translate from multi-byte to Unicode
#define RTL_CREATE_ENVIRONMENT_TRANSLATE_FROM_OEM   0x2 // Translate from OEM to Unicode (Translate flag must also be set)
#define RTL_CREATE_ENVIRONMENT_EMPTY                0x4 // Create empty environment block

    typedef struct _RTL_BUFFER
    {
        PUCHAR Buffer;
        PUCHAR StaticBuffer;
        SIZE_T Size;
        SIZE_T StaticSize;
        SIZE_T ReservedForAllocatedSize; // for future doubling
        PVOID ReservedForIMalloc; // for future pluggable growth
    } RTL_BUFFER, * PRTL_BUFFER;

    typedef struct _RTL_UNICODE_STRING_BUFFER
    {
        UNICODE_STRING String;
        RTL_BUFFER ByteBuffer;
        UCHAR MinimumStaticBufferForTerminalNul[sizeof(WCHAR)];
    } RTL_UNICODE_STRING_BUFFER, * PRTL_UNICODE_STRING_BUFFER;

    typedef struct _RTL_USER_PROCESS_PARAMETERS
    {
        ULONG MaximumLength;
        ULONG Length;

        ULONG Flags;
        ULONG DebugFlags;

        HANDLE ConsoleHandle;
        ULONG ConsoleFlags;
        HANDLE StandardInput;
        HANDLE StandardOutput;
        HANDLE StandardError;

        CURDIR CurrentDirectory;
        UNICODE_STRING DllPath;
        UNICODE_STRING ImagePathName;
        UNICODE_STRING CommandLine;
        PWCHAR Environment;

        ULONG StartingX;
        ULONG StartingY;
        ULONG CountX;
        ULONG CountY;
        ULONG CountCharsX;
        ULONG CountCharsY;
        ULONG FillAttribute;

        ULONG WindowFlags;
        ULONG ShowWindowFlags;
        UNICODE_STRING WindowTitle;
        UNICODE_STRING DesktopInfo;
        UNICODE_STRING ShellInfo;
        UNICODE_STRING RuntimeData;
        RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];

        ULONG_PTR EnvironmentSize;
        ULONG_PTR EnvironmentVersion;
        PVOID PackageDependencyData;
        ULONG ProcessGroupId;
        ULONG LoaderThreads;
    } RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;

#define RTL_USER_PROCESS_PARAMETERS_NORMALIZED              0x01
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER            0x02
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_KERNEL          0x04
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_SERVER          0x08
#define RTL_USER_PROCESS_PARAMETERS_RESERVE_1MB             0x20
#define RTL_USER_PROCESS_PARAMETERS_RESERVE_16MB            0x40
#define RTL_USER_PROCESS_PARAMETERS_CASE_SENSITIVE          0x80
#define RTL_USER_PROCESS_PARAMETERS_DISABLE_HEAP_DECOMMIT   0x100
#define RTL_USER_PROCESS_PARAMETERS_DLL_REDIRECTION_LOCAL   0x1000
#define RTL_USER_PROCESS_PARAMETERS_APP_MANIFEST_PRESENT    0x2000
#define RTL_USER_PROCESS_PARAMETERS_IMAGE_KEY_MISSING       0x4000
#define RTL_USER_PROCESS_PARAMETERS_NX_OPTIN                0x20000

    typedef struct _RTL_USER_PROCESS_INFORMATION
    {
        ULONG Length;
        HANDLE Process;
        HANDLE Thread;
        CLIENT_ID ClientId;
        SECTION_IMAGE_INFORMATION ImageInformation;
    } RTL_USER_PROCESS_INFORMATION, * PRTL_USER_PROCESS_INFORMATION;

    // Handle tag bits for PEB stdio file handles
#define PEB_STDIO_HANDLE_NATIVE     0
#define PEB_STDIO_HANDLE_SUBSYS     1
#define PEB_STDIO_HANDLE_PM         2
#define PEB_STDIO_HANDLE_RESERVED   3

#define GDI_HANDLE_BUFFER_SIZE32    34
#define GDI_HANDLE_BUFFER_SIZE64    60

#ifndef _WIN64
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
#else
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64
#endif

    typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32];
    typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64];
    typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];

#define FLS_MAXIMUM_AVAILABLE 128
#define TLS_MINIMUM_AVAILABLE 64
#define TLS_EXPANSION_SLOTS 1024

    typedef struct _PEB_LDR_DATA
    {
        ULONG Length;
        BOOLEAN Initialized;
        HANDLE SsHandle;
        LIST_ENTRY InLoadOrderModuleList;
        LIST_ENTRY InMemoryOrderModuleList;
        LIST_ENTRY InInitializationOrderModuleList;
        PVOID EntryInProgress;
        BOOLEAN ShutdownInProgress;
        HANDLE ShutdownThreadId;
    } PEB_LDR_DATA, * PPEB_LDR_DATA;

    typedef struct _ACTIVATION_CONTEXT_STACK
    {
        struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* ActiveFrame;
        LIST_ENTRY FrameListCache;
        ULONG Flags;
        ULONG NextCookieSequenceNumber;
        ULONG StackId;
    } ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK;

    typedef struct _PEB
    {
        BOOLEAN InheritedAddressSpace;
        BOOLEAN ReadImageFileExecOptions;
        BOOLEAN BeingDebugged;
        union
        {
            BOOLEAN BitField;
            struct
            {
                BOOLEAN ImageUsesLargePages : 1;
                BOOLEAN IsProtectedProcess : 1;
                BOOLEAN IsImageDynamicallyRelocated : 1;
                BOOLEAN SkipPatchingUser32Forwarders : 1;
                BOOLEAN IsPackagedProcess : 1;
                BOOLEAN IsAppContainer : 1;
                BOOLEAN IsProtectedProcessLight : 1;
                BOOLEAN IsLongPathAwareProcess : 1;
            } s1;
        } u1;

        HANDLE Mutant;

        PVOID ImageBaseAddress;
        PPEB_LDR_DATA Ldr;
        PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
        PVOID SubSystemData;
        PVOID ProcessHeap;
        PRTL_CRITICAL_SECTION FastPebLock;
        PVOID AtlThunkSListPtr;
        PVOID IFEOKey;
        union
        {
            ULONG CrossProcessFlags;
            struct
            {
                ULONG ProcessInJob : 1;
                ULONG ProcessInitializing : 1;
                ULONG ProcessUsingVEH : 1;
                ULONG ProcessUsingVCH : 1;
                ULONG ProcessUsingFTH : 1;
                ULONG ProcessPreviouslyThrottled : 1;
                ULONG ProcessCurrentlyThrottled : 1;
                ULONG ReservedBits0 : 25;
            } s2;
        } u2;
        union
        {
            PVOID KernelCallbackTable;
            PVOID UserSharedInfoPtr;
        } u3;
        ULONG SystemReserved[1];
        ULONG AtlThunkSListPtr32;
        PVOID ApiSetMap;
        ULONG TlsExpansionCounter;
        PVOID TlsBitmap;
        ULONG TlsBitmapBits[2];

        PVOID ReadOnlySharedMemoryBase;
        PVOID SharedData; // HotpatchInformation
        PVOID* ReadOnlyStaticServerData;

        PVOID AnsiCodePageData; // PCPTABLEINFO
        PVOID OemCodePageData; // PCPTABLEINFO
        PVOID UnicodeCaseTableData; // PNLSTABLEINFO

        ULONG NumberOfProcessors;
        ULONG NtGlobalFlag;

        LARGE_INTEGER CriticalSectionTimeout;
        SIZE_T HeapSegmentReserve;
        SIZE_T HeapSegmentCommit;
        SIZE_T HeapDeCommitTotalFreeThreshold;
        SIZE_T HeapDeCommitFreeBlockThreshold;

        ULONG NumberOfHeaps;
        ULONG MaximumNumberOfHeaps;
        PVOID* ProcessHeaps; // PHEAP

        PVOID GdiSharedHandleTable;
        PVOID ProcessStarterHelper;
        ULONG GdiDCAttributeList;

        PRTL_CRITICAL_SECTION LoaderLock;

        ULONG OSMajorVersion;
        ULONG OSMinorVersion;
        USHORT OSBuildNumber;
        USHORT OSCSDVersion;
        ULONG OSPlatformId;
        ULONG ImageSubsystem;
        ULONG ImageSubsystemMajorVersion;
        ULONG ImageSubsystemMinorVersion;
        ULONG_PTR ActiveProcessAffinityMask;
        GDI_HANDLE_BUFFER GdiHandleBuffer;
        PVOID PostProcessInitRoutine;

        PVOID TlsExpansionBitmap;
        ULONG TlsExpansionBitmapBits[32];

        ULONG SessionId;

        ULARGE_INTEGER AppCompatFlags;
        ULARGE_INTEGER AppCompatFlagsUser;
        PVOID pShimData;
        PVOID AppCompatInfo; // APPCOMPAT_EXE_DATA

        UNICODE_STRING CSDVersion;

        PVOID ActivationContextData; // ACTIVATION_CONTEXT_DATA
        PVOID ProcessAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
        PVOID SystemDefaultActivationContextData; // ACTIVATION_CONTEXT_DATA
        PVOID SystemAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP

        SIZE_T MinimumStackCommit;

        PVOID* FlsCallback;
        LIST_ENTRY FlsListHead;
        PVOID FlsBitmap;
        ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
        ULONG FlsHighIndex;

        PVOID WerRegistrationData;
        PVOID WerShipAssertPtr;
        PVOID pUnused; // pContextData
        PVOID pImageHeaderHash;
        union
        {
            ULONG TracingFlags;
            struct
            {
                ULONG HeapTracingEnabled : 1;
                ULONG CritSecTracingEnabled : 1;
                ULONG LibLoaderTracingEnabled : 1;
                ULONG SpareTracingBits : 29;
            } s3;
        } u4;
        ULONGLONG CsrServerReadOnlySharedMemoryBase;
        PVOID TppWorkerpListLock;
        LIST_ENTRY TppWorkerpList;
        PVOID WaitOnAddressHashTable[128];
        PVOID TelemetryCoverageHeader; // REDSTONE3
        ULONG CloudFileFlags;
    } PEB, * PPEB;

#define GDI_BATCH_BUFFER_SIZE 310

    typedef struct _GDI_TEB_BATCH
    {
        ULONG Offset;
        ULONG_PTR HDC;
        ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
    } GDI_TEB_BATCH, * PGDI_TEB_BATCH;

    typedef struct _TEB_ACTIVE_FRAME_CONTEXT
    {
        ULONG Flags;
        PSTR FrameName;
    } TEB_ACTIVE_FRAME_CONTEXT, * PTEB_ACTIVE_FRAME_CONTEXT;

    typedef struct _TEB_ACTIVE_FRAME
    {
        ULONG Flags;
        struct _TEB_ACTIVE_FRAME* Previous;
        PTEB_ACTIVE_FRAME_CONTEXT Context;
    } TEB_ACTIVE_FRAME, * PTEB_ACTIVE_FRAME;

    typedef struct _TEB
    {
        NT_TIB NtTib;

        PVOID EnvironmentPointer;
        CLIENT_ID ClientId;
        PVOID ActiveRpcHandle;
        PVOID ThreadLocalStoragePointer;
        PPEB ProcessEnvironmentBlock;

        ULONG LastErrorValue;
        ULONG CountOfOwnedCriticalSections;
        PVOID CsrClientThread;
        PVOID Win32ThreadInfo;
        ULONG User32Reserved[26];
        ULONG UserReserved[5];
        PVOID WOW32Reserved;
        LCID CurrentLocale;
        ULONG FpSoftwareStatusRegister;
        PVOID ReservedForDebuggerInstrumentation[16];
#ifdef _WIN64
        PVOID SystemReserved1[30];
#else
        PVOID SystemReserved1[26];
#endif
        CHAR PlaceholderCompatibilityMode;
        CHAR PlaceholderReserved[11];
        ULONG ProxiedProcessId;
        ACTIVATION_CONTEXT_STACK ActivationStack;

        UCHAR WorkingOnBehalfTicket[8];
        NTSTATUS ExceptionCode;

        PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
        ULONG_PTR InstrumentationCallbackSp;
        ULONG_PTR InstrumentationCallbackPreviousPc;
        ULONG_PTR InstrumentationCallbackPreviousSp;
#ifdef _WIN64
        ULONG TxFsContext;
#endif
        BOOLEAN InstrumentationCallbackDisabled;
#ifndef _WIN64
        UCHAR SpareBytes[23];
        ULONG TxFsContext;
#endif
        GDI_TEB_BATCH GdiTebBatch;
        CLIENT_ID RealClientId;
        HANDLE GdiCachedProcessHandle;
        ULONG GdiClientPID;
        ULONG GdiClientTID;
        PVOID GdiThreadLocalInfo;
        ULONG_PTR Win32ClientInfo[62];
        PVOID glDispatchTable[233];
        ULONG_PTR glReserved1[29];
        PVOID glReserved2;
        PVOID glSectionInfo;
        PVOID glSection;
        PVOID glTable;
        PVOID glCurrentRC;
        PVOID glContext;

        NTSTATUS LastStatusValue;
        UNICODE_STRING StaticUnicodeString;
        WCHAR StaticUnicodeBuffer[261];

        PVOID DeallocationStack;
        PVOID TlsSlots[64];
        LIST_ENTRY TlsLinks;

        PVOID Vdm;
        PVOID ReservedForNtRpc;
        PVOID DbgSsReserved[2];

        ULONG HardErrorMode;
#ifdef _WIN64
        PVOID Instrumentation[11];
#else
        PVOID Instrumentation[9];
#endif
        GUID ActivityId;

        PVOID SubProcessTag;
        PVOID PerflibData;
        PVOID EtwTraceData;
        PVOID WinSockData;
        ULONG GdiBatchCount;

        union
        {
            PROCESSOR_NUMBER CurrentIdealProcessor;
            ULONG IdealProcessorValue;
            struct
            {
                UCHAR ReservedPad0;
                UCHAR ReservedPad1;
                UCHAR ReservedPad2;
                UCHAR IdealProcessor;
            } s1;
        } u1;

        ULONG GuaranteedStackBytes;
        PVOID ReservedForPerf;
        PVOID ReservedForOle;
        ULONG WaitingOnLoaderLock;
        PVOID SavedPriorityState;
        ULONG_PTR ReservedForCodeCoverage;
        PVOID ThreadPoolData;
        PVOID* TlsExpansionSlots;
#ifdef _WIN64
        PVOID DeallocationBStore;
        PVOID BStoreLimit;
#endif
        ULONG MuiGeneration;
        ULONG IsImpersonating;
        PVOID NlsCache;
        PVOID pShimData;
        USHORT HeapVirtualAffinity;
        USHORT LowFragHeapDataSlot;
        HANDLE CurrentTransactionHandle;
        PTEB_ACTIVE_FRAME ActiveFrame;
        PVOID FlsData;

        PVOID PreferredLanguages;
        PVOID UserPrefLanguages;
        PVOID MergedPrefLanguages;
        ULONG MuiImpersonation;

        union
        {
            USHORT CrossTebFlags;
            USHORT SpareCrossTebBits : 16;
        } u2;
        union
        {
            USHORT SameTebFlags;
            struct
            {
                USHORT SafeThunkCall : 1;
                USHORT InDebugPrint : 1;
                USHORT HasFiberData : 1;
                USHORT SkipThreadAttach : 1;
                USHORT WerInShipAssertCode : 1;
                USHORT RanProcessInit : 1;
                USHORT ClonedThread : 1;
                USHORT SuppressDebugMsg : 1;
                USHORT DisableUserStackWalk : 1;
                USHORT RtlExceptionAttached : 1;
                USHORT InitialThread : 1;
                USHORT SessionAware : 1;
                USHORT LoadOwner : 1;
                USHORT LoaderWorker : 1;
                USHORT SkipLoaderInit : 1;
                USHORT SpareSameTebBits : 1;
            } s2;
        } u3;

        PVOID TxnScopeEnterCallback;
        PVOID TxnScopeExitCallback;
        PVOID TxnScopeContext;
        ULONG LockCount;
        LONG WowTebOffset;
        PVOID ResourceRetValue;
        PVOID ReservedForWdf;
        ULONGLONG ReservedForCrt;
        GUID EffectiveContainerId;
    } TEB, * PTEB;

    typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
    {
        StandardDesign,
        NEC98x86,
        EndAlternatives
    } ALTERNATIVE_ARCHITECTURE_TYPE;

#define PROCESSOR_FEATURE_MAX       64

#define MAX_WOW64_SHARED_ENTRIES    16

#define NX_SUPPORT_POLICY_ALWAYSOFF 0
#define NX_SUPPORT_POLICY_ALWAYSON  1
#define NX_SUPPORT_POLICY_OPTIN     2
#define NX_SUPPORT_POLICY_OPTOUT    3

#pragma pack(push, 4)
    typedef struct _KUSER_SHARED_DATA
    {
        ULONG TickCountLowDeprecated;
        ULONG TickCountMultiplier;

        volatile KSYSTEM_TIME InterruptTime;
        volatile KSYSTEM_TIME SystemTime;
        volatile KSYSTEM_TIME TimeZoneBias;

        USHORT ImageNumberLow;
        USHORT ImageNumberHigh;

        WCHAR NtSystemRoot[260];

        ULONG MaxStackTraceDepth;

        ULONG CryptoExponent;

        ULONG TimeZoneId;
        ULONG LargePageMinimum;
        ULONG AitSamplingValue;
        ULONG AppCompatFlag;
        ULONGLONG RNGSeedVersion;
        ULONG GlobalValidationRunlevel;
        LONG TimeZoneBiasStamp;

        ULONG NtBuildNumber;
        ULONG NtProductType;
        BOOLEAN ProductTypeIsValid;
        UCHAR Reserved0[1];
        USHORT NativeProcessorArchitecture;

        ULONG NtMajorVersion;
        ULONG NtMinorVersion;

        BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];

        ULONG Reserved1;
        ULONG Reserved3;

        volatile ULONG TimeSlip;

        ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
        ULONG BootId;

        LARGE_INTEGER SystemExpirationDate;

        ULONG SuiteMask;

        BOOLEAN KdDebuggerEnabled;
        union
        {
            UCHAR MitigationPolicies;
            struct
            {
                UCHAR NXSupportPolicy : 2;
                UCHAR SEHValidationPolicy : 2;
                UCHAR CurDirDevicesSkippedForDlls : 2;
                UCHAR Reserved : 2;
            } s1;
        } u1;
        UCHAR Reserved6[2];

        volatile ULONG ActiveConsoleId;

        volatile ULONG DismountCount;

        ULONG ComPlusPackage;

        ULONG LastSystemRITEventTickCount;

        ULONG NumberOfPhysicalPages;

        BOOLEAN SafeBootMode;
        UCHAR VirtualizationFlags;
        UCHAR Reserved12[2];

        union
        {
            ULONG SharedDataFlags;
            struct
            {
                ULONG DbgErrorPortPresent : 1;
                ULONG DbgElevationEnabled : 1;
                ULONG DbgVirtEnabled : 1;
                ULONG DbgInstallerDetectEnabled : 1;
                ULONG DbgLkgEnabled : 1;
                ULONG DbgDynProcessorEnabled : 1;
                ULONG DbgConsoleBrokerEnabled : 1;
                ULONG DbgSecureBootEnabled : 1;
                ULONG DbgMultiSessionSku : 1;
                ULONG DbgMultiUsersInSessionSku : 1;
                ULONG SpareBits : 22;
            } s2;
        } u2;
        ULONG DataFlagsPad[1];

        ULONGLONG TestRetInstruction;
        LONGLONG QpcFrequency;
        ULONG SystemCall;
        ULONG SystemCallPad0;
        ULONGLONG SystemCallPad[2];

        union
        {
            volatile KSYSTEM_TIME TickCount;
            volatile ULONG64 TickCountQuad;
            ULONG ReservedTickCountOverlay[3];
        };
        ULONG TickCountPad[1];

        ULONG Cookie;
        ULONG CookiePad[1];

        LONGLONG ConsoleSessionForegroundProcessId;
        ULONGLONG TimeUpdateLock;
        ULONGLONG BaselineSystemTimeQpc;
        ULONGLONG BaselineInterruptTimeQpc;
        ULONGLONG QpcSystemTimeIncrement;
        ULONGLONG QpcInterruptTimeIncrement;
        UCHAR QpcSystemTimeIncrementShift;
        UCHAR QpcInterruptTimeIncrementShift;

        USHORT UnparkedProcessorCount;
        ULONG EnclaveFeatureMask[4];
        ULONG Reserved8;
        USHORT UserModeGlobalLogger[16];
        ULONG ImageFileExecutionOptions;

        ULONG LangGenerationCount;
        ULONGLONG Reserved4;
        volatile ULONG64 InterruptTimeBias;
        volatile ULONG64 QpcBias;

        ULONG ActiveProcessorCount;
        volatile UCHAR ActiveGroupCount;
        UCHAR Reserved9;
        union
        {
            USHORT QpcData;
            struct
            {
                UCHAR QpcBypassEnabled : 1;
                UCHAR QpcShift : 1;
            } s3;
        } u3;

        LARGE_INTEGER TimeZoneBiasEffectiveStart;
        LARGE_INTEGER TimeZoneBiasEffectiveEnd;
        XSTATE_CONFIGURATION XState;
    } KUSER_SHARED_DATA, * PKUSER_SHARED_DATA;
#pragma pack(pop)

#ifdef __cplusplus
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x4, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x8, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x14, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x20, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberLow) == 0x2c, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberHigh) == 0x2e, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x30, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, MaxStackTraceDepth) == 0x238, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, CryptoExponent) == 0x23c, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneId) == 0x240, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ProductTypeIsValid) == 0x268, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved1) == 0x2b4, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved3) == 0x2b8, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeSlip) == 0x2bc, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, AlternativeArchitecture) == 0x2c0, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemExpirationDate) == 0x2c8, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SuiteMask) == 0x2d0, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, DismountCount) == 0x2dc, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ComPlusPackage) == 0x2e0, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LastSystemRITEventTickCount) == 0x2e4, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TestRetInstruction) == 0x2f8, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallPad) == 0x310, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320, "Offset check");
    static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8, "Offset check");
#endif

#if !defined(_KERNEL_MODE) && !defined(KERNELMODE)
#define USER_SHARED_DATA            0x7FFE0000
#define SharedUserData              ((KUSER_SHARED_DATA * const)USER_SHARED_DATA)
#else
#if defined(_M_IX86)
#define KI_USER_SHARED_DATA     0xFFDF0000
#elif defined (_M_AMD64)
#define KI_USER_SHARED_DATA     0xFFFFF78000000000Ui64
#elif defined (_M_ARM)
#define KI_USER_SHARED_DATA     0xFFFF9000
#elif defined(M_ARM64)
#define KI_USER_SHARED_DATA     0xFFFFF78000000000Ui64
#endif
#define SharedUserData              ((KUSER_SHARED_DATA * const)KI_USER_SHARED_DATA)
#endif

    typedef struct _PROCESS_BASIC_INFORMATION
    {
        NTSTATUS ExitStatus;
        PPEB PebBaseAddress;
        ULONG_PTR AffinityMask;
        KPRIORITY BasePriority;
        HANDLE UniqueProcessId;
        HANDLE InheritedFromUniqueProcessId;
    } PROCESS_BASIC_INFORMATION, * PPROCESS_BASIC_INFORMATION;

    typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION
    {
        SIZE_T Size; // Set to sizeof structure on input
        PROCESS_BASIC_INFORMATION BasicInfo;
        union
        {
            ULONG Flags;
            struct
            {
                ULONG IsProtectedProcess : 1;
                ULONG IsWow64Process : 1;
                ULONG IsProcessDeleting : 1;
                ULONG IsCrossSessionCreate : 1;
                ULONG IsFrozen : 1;
                ULONG IsBackground : 1;
                ULONG IsStronglyNamed : 1;
                ULONG IsSecureProcess : 1;
                ULONG IsSubsystemProcess : 1;
                ULONG SpareBits : 23;
            } s;
        } u;
    } PROCESS_EXTENDED_BASIC_INFORMATION, * PPROCESS_EXTENDED_BASIC_INFORMATION;

    typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION
    {
        SYSTEM_THREAD_INFORMATION ThreadInfo;
        PVOID StackBase;
        PVOID StackLimit;
        PVOID Win32StartAddress;
        PTEB TebBase; // Since Vista
        ULONG_PTR Reserved2;
        ULONG_PTR Reserved3;
        ULONG_PTR Reserved4;
    } SYSTEM_EXTENDED_THREAD_INFORMATION, * PSYSTEM_EXTENDED_THREAD_INFORMATION;

#ifndef FIELD_OFFSET
#if !defined(__clang__)
#define FIELD_OFFSET(type, field)   ((LONG)(LONG_PTR)&(((type *)0)->field))
#else
#define FIELD_OFFSET(type, field)   ((LONG)__builtin_offsetof(type, field))
#endif
#endif
#ifndef UFIELD_OFFSET
#if !defined(__clang__)
#define UFIELD_OFFSET(type, field)  ((ULONG)(LONG_PTR)&(((type *)0)->field))
#else
#define UFIELD_OFFSET(type, field)  ((ULONG)__builtin_offsetof(type, field))
#endif
#endif

#define PTR_ADD_OFFSET(Pointer, Offset) ((PVOID)((ULONG_PTR)(Pointer) + (ULONG_PTR)(Offset)))
#define PTR_SUB_OFFSET(Pointer, Offset) ((PVOID)((ULONG_PTR)(Pointer) - (ULONG_PTR)(Offset)))
#define ALIGN_DOWN_BY(Address, Align) ((ULONG_PTR)(Address) & ~(Align - 1))
#define ALIGN_DOWN_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_DOWN_BY(Pointer, Align))
#define ALIGN_DOWN_POINTER(Pointer, Type) ((PVOID)ALIGN_DOWN(Pointer, Type))
#define ALIGN_UP_BY(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1))
#define ALIGN_UP_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_UP_BY(Pointer, Align))
#define ALIGN_UP_POINTER(Pointer, Type) ((PVOID)ALIGN_UP(Pointer, Type))

#define InitializeObjectAttributes( p, n, a, r, s ) {   \
    (p)->Length = sizeof( OBJECT_ATTRIBUTES );          \
    (p)->RootDirectory = r;                             \
    (p)->Attributes = a;                                \
    (p)->ObjectName = n;                                \
    (p)->SecurityDescriptor = s;                        \
    (p)->SecurityQualityOfService = NULL;               \
    }

#define OBJ_INHERIT                                 0x00000002L
#define OBJ_PERMANENT                               0x00000010L
#define OBJ_EXCLUSIVE                               0x00000020L
#define OBJ_CASE_INSENSITIVE                        0x00000040L
#define OBJ_OPENIF                                  0x00000080L
#define OBJ_OPENLINK                                0x00000100L
#define OBJ_KERNEL_HANDLE                           0x00000200L
#define OBJ_FORCE_ACCESS_CHECK                      0x00000400L
#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP           0x00000800
#define OBJ_DONT_REPARSE                            0x00001000
#define OBJ_VALID_ATTRIBUTES                        0x00001FF2

#if NTDDI_VERSION >= NTDDI_VISTA
#define THREAD_ALL_ACCESS                           (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    0xFFFF)
#else
#define THREAD_ALL_ACCESS                           (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    0x3FF)
#endif

#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED        0x00000001
#define THREAD_CREATE_FLAGS_SUPPRESS_DLLMAINS       0x00000002
#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER      0x00000004
#define THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR 0x00000010 // ?
#define THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET  0x00000020 // ?
#define THREAD_CREATE_FLAGS_INITIAL_THREAD          0x00000080

#define DEBUG_READ_EVENT                            0x0001
#define DEBUG_PROCESS_ASSIGN                        0x0002
#define DEBUG_SET_INFORMATION                       0x0004
#define DEBUG_QUERY_INFORMATION                     0x0008

#define DEBUG_ALL_ACCESS                            (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    DEBUG_READ_EVENT | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | \
                                                    DEBUG_QUERY_INFORMATION)

#define DEBUG_KILL_ON_CLOSE                         0x1

#ifndef IO_COMPLETION_QUERY_STATE
#define IO_COMPLETION_QUERY_STATE                   0x0001
#endif
#ifndef IO_COMPLETION_MODIFY_STATE
#define IO_COMPLETION_MODIFY_STATE                  0x0002
#endif
#ifndef IO_COMPLETION_ALL_ACCESS
#define IO_COMPLETION_ALL_ACCESS                    (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    IO_COMPLETION_QUERY_STATE | IO_COMPLETION_MODIFY_STATE)
#endif

#ifndef SEMAPHORE_ALL_ACCESS
#define SEMAPHORE_QUERY_STATE                       0x0001
#define SEMAPHORE_MODIFY_STATE                      0x0002

#define SEMAPHORE_ALL_ACCESS                        (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    SEMAPHORE_QUERY_STATE | SEMAPHORE_MODIFY_STATE)
#endif

#ifndef MUTANT_ALL_ACCESS
#define MUTANT_QUERY_STATE                          0x0001

#define MUTANT_ALL_ACCESS                           (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    MUTANT_QUERY_STATE)
#endif

#ifndef EVENT_ALL_ACCESS
#define EVENT_QUERY_STATE                           0x0001
#define EVENT_MODIFY_STATE                          0x0002

#define EVENT_ALL_ACCESS                            (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
                                                    EVENT_QUERY_STATE | EVENT_MODIFY_STATE)
#endif

#define KEYEDEVENT_WAIT                             0x0001
#define KEYEDEVENT_WAKE                             0x0002
#define KEYEDEVENT_ALL_ACCESS                       (STANDARD_RIGHTS_REQUIRED | \
                                                    KEYEDEVENT_WAIT | KEYEDEVENT_WAKE)

#define DIRECTORY_QUERY                             0x0001
#define DIRECTORY_TRAVERSE                          0x0002
#define DIRECTORY_CREATE_OBJECT                     0x0004
#define DIRECTORY_CREATE_SUBDIRECTORY               0x0008

#define DIRECTORY_ALL_ACCESS                        (STANDARD_RIGHTS_REQUIRED | \
                                                    DIRECTORY_QUERY | DIRECTORY_TRAVERSE | \
                                                    DIRECTORY_CREATE_OBJECT | DIRECTORY_CREATE_SUBDIRECTORY)

#define SYMBOLIC_LINK_QUERY                         0x0001

#define SYMBOLIC_LINK_ALL_ACCESS                    (STANDARD_RIGHTS_REQUIRED | \
                                                    SYMBOLIC_LINK_QUERY)

#ifndef TOKEN_ALL_ACCESS
#define TOKEN_ASSIGN_PRIMARY                        0x0001
#define TOKEN_DUPLICATE                             0x0002
#define TOKEN_IMPERSONATE                           0x0004
#define TOKEN_QUERY                                 0x0008
#define TOKEN_QUERY_SOURCE                          0x0010
#define TOKEN_ADJUST_PRIVILEGES                     0x0020
#define TOKEN_ADJUST_GROUPS                         0x0040
#define TOKEN_ADJUST_DEFAULT                        0x0080
#define TOKEN_ADJUST_SESSIONID                      0x0100

#define TOKEN_ALL_ACCESS_P                          (STANDARD_RIGHTS_REQUIRED | \
                                                    TOKEN_ASSIGN_PRIMARY | \
                                                    TOKEN_DUPLICATE | \
                                                    TOKEN_IMPERSONATE | \
                                                    TOKEN_QUERY | \
                                                    TOKEN_QUERY_SOURCE | \
                                                    TOKEN_ADJUST_PRIVILEGES | \
                                                    TOKEN_ADJUST_GROUPS | \
                                                    TOKEN_ADJUST_DEFAULT)

#define TOKEN_ALL_ACCESS                            (TOKEN_ALL_ACCESS_P | \
                                                    TOKEN_ADJUST_SESSIONID)
#endif

#define WORKER_FACTORY_RELEASE_WORKER               0x0001
#define WORKER_FACTORY_WAIT                         0x0002
#define WORKER_FACTORY_SET_INFORMATION              0x0004
#define WORKER_FACTORY_QUERY_INFORMATION            0x0008
#define WORKER_FACTORY_READY_WORKER                 0x0010
#define WORKER_FACTORY_SHUTDOWN                     0x0020

#define WORKER_FACTORY_ALL_ACCESS                   (STANDARD_RIGHTS_REQUIRED | \
                                                    WORKER_FACTORY_RELEASE_WORKER | \
                                                    WORKER_FACTORY_WAIT | \
                                                    WORKER_FACTORY_SET_INFORMATION | \
                                                    WORKER_FACTORY_QUERY_INFORMATION | \
                                                    WORKER_FACTORY_READY_WORKER | \
                                                    WORKER_FACTORY_SHUTDOWN)

#define NtCurrentProcess        ((HANDLE)(LONG_PTR)-1)
#define NtCurrentThread         ((HANDLE)(LONG_PTR)-2)
#define NtCurrentPeb()          (NtCurrentTeb()->ProcessEnvironmentBlock)
#define NtCurrentProcessId()    (NtCurrentTeb()->ClientId.UniqueProcess)
#define NtCurrentThreadId()     (NtCurrentTeb()->ClientId.UniqueThread)
#define RtlProcessHeap()        (NtCurrentPeb()->ProcessHeap)

    typedef struct _RTL_HEAP_ENTRY
    {
        SIZE_T Size;
        USHORT Flags;
        USHORT AllocatorBackTraceIndex;
        union
        {
            struct
            {
                SIZE_T Settable;
                ULONG Tag;
            } s1;
            struct
            {
                SIZE_T CommittedSize;
                PVOID FirstBlock;
            } s2;
        } u;
    } RTL_HEAP_ENTRY, * PRTL_HEAP_ENTRY;

#define RTL_HEAP_BUSY               (USHORT)0x0001
#define RTL_HEAP_SEGMENT            (USHORT)0x0002
#define RTL_HEAP_SETTABLE_VALUE     (USHORT)0x0010
#define RTL_HEAP_SETTABLE_FLAG1     (USHORT)0x0020
#define RTL_HEAP_SETTABLE_FLAG2     (USHORT)0x0040
#define RTL_HEAP_SETTABLE_FLAG3     (USHORT)0x0080
#define RTL_HEAP_SETTABLE_FLAGS     (USHORT)0x00e0
#define RTL_HEAP_UNCOMMITTED_RANGE  (USHORT)0x0100
#define RTL_HEAP_PROTECTED_ENTRY    (USHORT)0x0200

    typedef struct _RTL_HEAP_TAG
    {
        ULONG NumberOfAllocations;
        ULONG NumberOfFrees;
        SIZE_T BytesAllocated;
        USHORT TagIndex;
        USHORT CreatorBackTraceIndex;
        WCHAR TagName[24];
    } RTL_HEAP_TAG, * PRTL_HEAP_TAG;

    typedef struct _RTL_HEAP_INFORMATION
    {
        PVOID BaseAddress;
        ULONG Flags;
        USHORT EntryOverhead;
        USHORT CreatorBackTraceIndex;
        SIZE_T BytesAllocated;
        SIZE_T BytesCommitted;
        ULONG NumberOfTags;
        ULONG NumberOfEntries;
        ULONG NumberOfPseudoTags;
        ULONG PseudoTagGranularity;
        ULONG Reserved[5];
        PRTL_HEAP_TAG Tags;
        PRTL_HEAP_ENTRY Entries;
    } RTL_HEAP_INFORMATION, * PRTL_HEAP_INFORMATION;

    typedef struct _RTL_PROCESS_HEAPS
    {
        ULONG NumberOfHeaps;
        RTL_HEAP_INFORMATION Heaps[1];
    } RTL_PROCESS_HEAPS, * PRTL_PROCESS_HEAPS;

    typedef
        NTSTATUS
        (NTAPI*
            PRTL_HEAP_COMMIT_ROUTINE)(
                _In_ PVOID Base,
                _Inout_ PVOID* CommitAddress,
                _Inout_ PSIZE_T CommitSize
                );

    typedef struct _RTL_HEAP_PARAMETERS
    {
        ULONG Length;
        SIZE_T SegmentReserve;
        SIZE_T SegmentCommit;
        SIZE_T DeCommitFreeBlockThreshold;
        SIZE_T DeCommitTotalFreeThreshold;
        SIZE_T MaximumAllocationSize;
        SIZE_T VirtualMemoryThreshold;
        SIZE_T InitialCommit;
        SIZE_T InitialReserve;
        PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
        SIZE_T Reserved[2];
    } RTL_HEAP_PARAMETERS, * PRTL_HEAP_PARAMETERS;

#define HEAP_SETTABLE_USER_VALUE 0x00000100
#define HEAP_SETTABLE_USER_FLAG1 0x00000200
#define HEAP_SETTABLE_USER_FLAG2 0x00000400
#define HEAP_SETTABLE_USER_FLAG3 0x00000800
#define HEAP_SETTABLE_USER_FLAGS 0x00000e00

#define HEAP_CLASS_0 0x00000000 // Process heap
#define HEAP_CLASS_1 0x00001000 // Private heap
#define HEAP_CLASS_2 0x00002000 // Kernel heap
#define HEAP_CLASS_3 0x00003000 // GDI heap
#define HEAP_CLASS_4 0x00004000 // User heap
#define HEAP_CLASS_5 0x00005000 // Console heap
#define HEAP_CLASS_6 0x00006000 // User desktop heap
#define HEAP_CLASS_7 0x00007000 // CSR shared heap
#define HEAP_CLASS_8 0x00008000 // CSR port heap
#define HEAP_CLASS_MASK 0x0000f000

    typedef struct _RTL_HEAP_TAG_INFO
    {
        ULONG NumberOfAllocations;
        ULONG NumberOfFrees;
        SIZE_T BytesAllocated;
    } RTL_HEAP_TAG_INFO, * PRTL_HEAP_TAG_INFO;

#define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS

    typedef struct _RTL_HEAP_WALK_ENTRY
    {
        PVOID DataAddress;
        SIZE_T DataSize;
        UCHAR OverheadBytes;
        UCHAR SegmentIndex;
        USHORT Flags;
        union
        {
            struct
            {
                SIZE_T Settable;
                USHORT TagIndex;
                USHORT AllocatorBackTraceIndex;
                ULONG Reserved[2];
            } Block;
            struct
            {
                ULONG CommittedSize;
                ULONG UnCommittedSize;
                PVOID FirstEntry;
                PVOID LastEntry;
            } Segment;
        };
    } RTL_HEAP_WALK_ENTRY, * PRTL_HEAP_WALK_ENTRY;

    // HEAP_INFORMATION_CLASS. winnt.h is incomplete
#define HeapCompatibilityInformation 0x0 // q; s: ULONG
#define HeapEnableTerminationOnCorruption 0x1 // q; s: NULL
#define HeapExtendedInformation 0x2 // q; s: HEAP_EXTENDED_INFORMATION
#define HeapOptimizeResources 0x3 // q; s: HEAP_OPTIMIZE_RESOURCES_INFORMATION 
#define HeapTaggingInformation 0x4
#define HeapStackDatabase 0x5
#define HeapDetailedFailureInformation 0x80000001
#define HeapSetDebuggingInformation 0x80000002 // q; s: HEAP_DEBUGGING_INFORMATION

    typedef struct _PROCESS_HEAP_INFORMATION
    {
        ULONG_PTR ReserveSize;
        ULONG_PTR CommitSize;
        ULONG NumberOfHeaps;
        ULONG_PTR FirstHeapInformationOffset;
    } PROCESS_HEAP_INFORMATION, * PPROCESS_HEAP_INFORMATION;

    typedef struct _HEAP_INFORMATION
    {
        ULONG_PTR Address;
        ULONG Mode;
        ULONG_PTR ReserveSize;
        ULONG_PTR CommitSize;
        ULONG_PTR FirstRegionInformationOffset;
        ULONG_PTR NextHeapInformationOffset;
    } HEAP_INFORMATION, * PHEAP_INFORMATION;

    typedef struct _HEAP_EXTENDED_INFORMATION
    {
        HANDLE Process;
        ULONG_PTR Heap;
        ULONG Level;
        PVOID CallbackRoutine;
        PVOID CallbackContext;
        PROCESS_HEAP_INFORMATION ProcessHeapInformation;
        HEAP_INFORMATION HeapInformation;
    } HEAP_EXTENDED_INFORMATION, * PHEAP_EXTENDED_INFORMATION;

    typedef
        NTSTATUS
        (NTAPI*
            PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)(
                _In_ LONG Reserved,
                _In_ PVOID HeapHandle,
                _In_ PVOID BaseAddress,
                _In_ SIZE_T BlockSize,
                _In_ ULONG StackTraceDepth,
                _In_ PVOID* StackTrace
                );

    typedef struct _HEAP_DEBUGGING_INFORMATION
    {
        PVOID InterceptorFunction;
        USHORT InterceptorValue;
        ULONG ExtendedOptions;
        ULONG StackTraceDepth;
        SIZE_T MinTotalBlockSize;
        SIZE_T MaxTotalBlockSize;
        PRTL_HEAP_LEAK_ENUMERATION_ROUTINE HeapLeakEnumerationRoutine;
    } HEAP_DEBUGGING_INFORMATION, * PHEAP_DEBUGGING_INFORMATION;

    typedef
        NTSTATUS
        (NTAPI*
            PRTL_ENUM_HEAPS_ROUTINE)(
                _In_ PVOID HeapHandle,
                _In_ PVOID Parameter
                );

    typedef
        NTSTATUS
        (NTAPI*
            PUSER_THREAD_START_ROUTINE)(
                _In_ PVOID ThreadParameter
                );

#define LDR_FORMAT_MESSAGE_FROM_SYSTEM_MESSAGE_TABLE    11

#define RTL_ERRORMODE_NOGPFAULTERRORBOX                 0x0020
#define RTL_ERRORMODE_NOOPENFILEERRORBOX                0x0040

#define RTL_ACQUIRE_PRIVILEGE_REVERT                    0x00000001
#define RTL_ACQUIRE_PRIVILEGE_PROCESS                   0x00000002

    typedef
        VOID
        (NTAPI*
            PLDR_IMPORT_MODULE_CALLBACK)(
                _In_ PVOID Parameter,
                _In_ PSTR ModuleName
                );

    typedef struct _LDR_IMPORT_CALLBACK_INFO
    {
        PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine;
        PVOID ImportCallbackParameter;
    } LDR_IMPORT_CALLBACK_INFO, * PLDR_IMPORT_CALLBACK_INFO;

    typedef struct _LDR_SECTION_INFO
    {
        HANDLE SectionHandle;
        ACCESS_MASK DesiredAccess;
        POBJECT_ATTRIBUTES ObjectAttributes;
        ULONG SectionPageProtection;
        ULONG AllocationAttributes;
    } LDR_SECTION_INFO, * PLDR_SECTION_INFO;

    typedef struct _LDR_VERIFY_IMAGE_INFO
    {
        ULONG Size;
        ULONG Flags;
        LDR_IMPORT_CALLBACK_INFO CallbackInfo;
        LDR_SECTION_INFO SectionInfo;
        USHORT ImageCharacteristics;
    } LDR_VERIFY_IMAGE_INFO, * PLDR_VERIFY_IMAGE_INFO;

    typedef enum _SEMAPHORE_INFORMATION_CLASS
    {
        SemaphoreBasicInformation
    } SEMAPHORE_INFORMATION_CLASS;

    typedef struct _SEMAPHORE_BASIC_INFORMATION
    {
        LONG CurrentCount;
        LONG MaximumCount;
    } SEMAPHORE_BASIC_INFORMATION, * PSEMAPHORE_BASIC_INFORMATION;

    typedef enum _TIMER_INFORMATION_CLASS
    {
        TimerBasicInformation
    } TIMER_INFORMATION_CLASS;

    typedef struct _TIMER_BASIC_INFORMATION
    {
        LARGE_INTEGER RemainingTime;
        BOOLEAN TimerState;
    } TIMER_BASIC_INFORMATION, * PTIMER_BASIC_INFORMATION;

    typedef
        VOID
        (NTAPI*
            PTIMER_APC_ROUTINE)(
                _In_ PVOID TimerContext,
                _In_ ULONG TimerLowValue,
                _In_ LONG TimerHighValue
                );

    typedef enum _TIMER_SET_INFORMATION_CLASS
    {
        TimerSetCoalescableTimer,
        MaxTimerInfoClass
    } TIMER_SET_INFORMATION_CLASS;

    typedef struct _TIMER_SET_COALESCABLE_TIMER_INFO
    {
        _In_ LARGE_INTEGER DueTime;
        _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine;
        _In_opt_ PVOID TimerContext;
        _In_opt_ struct _COUNTED_REASON_CONTEXT* WakeContext;
        _In_opt_ ULONG Period;
        _In_ ULONG TolerableDelay;
        _Out_opt_ PBOOLEAN PreviousState;
    } TIMER_SET_COALESCABLE_TIMER_INFO, * PTIMER_SET_COALESCABLE_TIMER_INFO;

    typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE
    {
        ULONG64 Version;
        UNICODE_STRING Name;
    } TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, * PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;

    typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
    {
        PVOID pValue;
        ULONG ValueLength;
    } TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, * PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;

    typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
    {
        UNICODE_STRING Name;
        USHORT ValueType;
        USHORT Reserved;
        ULONG Flags;
        ULONG ValueCount;
        union
        {
            PLONG64 pInt64;
            PULONG64 pUint64;
            PUNICODE_STRING pString;
            PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
            PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
        } Values;
    } TOKEN_SECURITY_ATTRIBUTE_V1, * PTOKEN_SECURITY_ATTRIBUTE_V1;

#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1    1
#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION       TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1

    typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
    {
        USHORT Version;
        USHORT Reserved;
        ULONG AttributeCount;
        union
        {
            PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
        } Attribute;
    } TOKEN_SECURITY_ATTRIBUTES_INFORMATION, * PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;

    typedef enum _FILTER_BOOT_OPTION_OPERATION
    {
        FilterBootOptionOperationOpenSystemStore,
        FilterBootOptionOperationSetElement,
        FilterBootOptionOperationDeleteElement,
        FilterBootOptionOperationMax
    } FILTER_BOOT_OPTION_OPERATION;

    typedef enum _IO_SESSION_EVENT
    {
        IoSessionEventIgnore,
        IoSessionEventCreated,
        IoSessionEventTerminated,
        IoSessionEventConnected,
        IoSessionEventDisconnected,
        IoSessionEventLogon,
        IoSessionEventLogoff,
        IoSessionEventMax
    } IO_SESSION_EVENT;

    typedef enum _IO_SESSION_STATE
    {
        IoSessionStateCreated,
        IoSessionStateInitialized,
        IoSessionStateConnected,
        IoSessionStateDisconnected,
        IoSessionStateDisconnectedLoggedOn,
        IoSessionStateLoggedOn,
        IoSessionStateLoggedOff,
        IoSessionStateTerminated,
        IoSessionStateMax
    } IO_SESSION_STATE;

    typedef struct _PORT_MESSAGE PORT_MESSAGE, * PPORT_MESSAGE;
    typedef struct _TP_ALPC TP_ALPC, * PTP_ALPC;

    typedef
        VOID
        (NTAPI*
            PTP_ALPC_CALLBACK)(
                _Inout_ PTP_CALLBACK_INSTANCE Instance,
                _Inout_opt_ PVOID Context,
                _In_ PTP_ALPC Alpc
                );

    typedef
        VOID
        (NTAPI*
            PTP_ALPC_CALLBACK_EX)(
                _Inout_ PTP_CALLBACK_INSTANCE Instance,
                _Inout_opt_ PVOID Context,
                _In_ PTP_ALPC Alpc,
                _In_ PVOID ApcContext
                );

    typedef
        VOID
        (NTAPI*
            PTP_IO_CALLBACK)(
                _Inout_ PTP_CALLBACK_INSTANCE Instance,
                _Inout_opt_ PVOID Context,
                _In_ PVOID ApcContext,
                _In_ PIO_STATUS_BLOCK IoSB,
                _In_ PTP_IO Io
                );

    typedef enum _IO_COMPLETION_INFORMATION_CLASS
    {
        IoCompletionBasicInformation
    } IO_COMPLETION_INFORMATION_CLASS;

    typedef struct _IO_COMPLETION_BASIC_INFORMATION
    {
        LONG Depth;
    } IO_COMPLETION_BASIC_INFORMATION, * PIO_COMPLETION_BASIC_INFORMATION;

    typedef enum _WORKERFACTORYINFOCLASS
    {
        WorkerFactoryTimeout,
        WorkerFactoryRetryTimeout,
        WorkerFactoryIdleTimeout,
        WorkerFactoryBindingCount,
        WorkerFactoryThreadMinimum,
        WorkerFactoryThreadMaximum,
        WorkerFactoryPaused,
        WorkerFactoryBasicInformation,
        WorkerFactoryAdjustThreadGoal,
        WorkerFactoryCallbackType,
        WorkerFactoryStackInformation, // 10
        WorkerFactoryThreadBasePriority,
        WorkerFactoryTimeoutWaiters, // since THRESHOLD
        WorkerFactoryFlags,
        WorkerFactoryThreadSoftMaximum,
        MaxWorkerFactoryInfoClass
    } WORKERFACTORYINFOCLASS, * PWORKERFACTORYINFOCLASS;

    typedef struct _WORKER_FACTORY_BASIC_INFORMATION
    {
        LARGE_INTEGER Timeout;
        LARGE_INTEGER RetryTimeout;
        LARGE_INTEGER IdleTimeout;
        BOOLEAN Paused;
        BOOLEAN TimerSet;
        BOOLEAN QueuedToExWorker;
        BOOLEAN MayCreate;
        BOOLEAN CreateInProgress;
        BOOLEAN InsertedIntoQueue;
        BOOLEAN Shutdown;
        ULONG BindingCount;
        ULONG ThreadMinimum;
        ULONG ThreadMaximum;
        ULONG PendingWorkerCount;
        ULONG WaitingWorkerCount;
        ULONG TotalWorkerCount;
        ULONG ReleaseCount;
        LONGLONG InfiniteWaitGoal;
        PVOID StartRoutine;
        PVOID StartParameter;
        HANDLE ProcessId;
        SIZE_T StackReserve;
        SIZE_T StackCommit;
        NTSTATUS LastThreadCreationStatus;
    } WORKER_FACTORY_BASIC_INFORMATION, * PWORKER_FACTORY_BASIC_INFORMATION;

    typedef struct _BOOT_ENTRY
    {
        ULONG Version;
        ULONG Length;
        ULONG Id;
        ULONG Attributes;
        ULONG FriendlyNameOffset;
        ULONG BootFilePathOffset;
        ULONG OsOptionsLength;
        UCHAR OsOptions[1];
    } BOOT_ENTRY, * PBOOT_ENTRY;

    typedef struct _BOOT_ENTRY_LIST
    {
        ULONG NextEntryOffset;
        BOOT_ENTRY BootEntry;
    } BOOT_ENTRY_LIST, * PBOOT_ENTRY_LIST;

    typedef struct _BOOT_OPTIONS
    {
        ULONG Version;
        ULONG Length;
        ULONG Timeout;
        ULONG CurrentBootEntryId;
        ULONG NextBootEntryId;
        WCHAR HeadlessRedirection[1];
    } BOOT_OPTIONS, * PBOOT_OPTIONS;

    typedef struct _FILE_PATH
    {
        ULONG Version;
        ULONG Length;
        ULONG Type;
        UCHAR FilePath[1];
    } FILE_PATH, * PFILE_PATH;

    typedef struct _EFI_DRIVER_ENTRY
    {
        ULONG Version;
        ULONG Length;
        ULONG Id;
        ULONG FriendlyNameOffset;
        ULONG DriverFilePathOffset;
    } EFI_DRIVER_ENTRY, * PEFI_DRIVER_ENTRY;

    typedef struct _EFI_DRIVER_ENTRY_LIST
    {
        ULONG NextEntryOffset;
        EFI_DRIVER_ENTRY DriverEntry;
    } EFI_DRIVER_ENTRY_LIST, * PEFI_DRIVER_ENTRY_LIST;

    FORCEINLINE
        VOID
        InitializeListHead(
            _Out_ PLIST_ENTRY ListHead
        )
    {
        ListHead->Flink = ListHead->Blink = ListHead;
    }

    FORCEINLINE
        BOOLEAN
        IsListEmpty(
            _In_ PLIST_ENTRY ListHead
        )
    {
        return ListHead->Flink == ListHead;
    }

    FORCEINLINE
        BOOLEAN
        RemoveEntryList(
            _In_ PLIST_ENTRY Entry
        )
    {
        PLIST_ENTRY Flink = Entry->Flink;
        PLIST_ENTRY Blink = Entry->Blink;
        Blink->Flink = Flink;
        Flink->Blink = Blink;

        return Flink == Blink;
    }

    FORCEINLINE
        PLIST_ENTRY
        RemoveHeadList(
            _Inout_ PLIST_ENTRY ListHead
        )
    {
        PLIST_ENTRY Entry = ListHead->Flink;
        PLIST_ENTRY Flink = Entry->Flink;
        ListHead->Flink = Flink;
        Flink->Blink = ListHead;

        return Entry;
    }

    FORCEINLINE
        PLIST_ENTRY
        RemoveTailList(
            _Inout_ PLIST_ENTRY ListHead
        )
    {
        PLIST_ENTRY Entry = ListHead->Blink;
        PLIST_ENTRY Blink = Entry->Blink;
        ListHead->Blink = Blink;
        Blink->Flink = ListHead;

        return Entry;
    }

    FORCEINLINE
        VOID
        InsertTailList(
            _Inout_ PLIST_ENTRY ListHead,
            _Inout_ PLIST_ENTRY Entry
        )
    {
        PLIST_ENTRY Blink = ListHead->Blink;
        Entry->Flink = ListHead;
        Entry->Blink = Blink;
        Blink->Flink = Entry;
        ListHead->Blink = Entry;
    }

    FORCEINLINE
        VOID
        InsertHeadList(
            _Inout_ PLIST_ENTRY ListHead,
            _Inout_ PLIST_ENTRY Entry
        )
    {
        PLIST_ENTRY Flink = ListHead->Flink;
        Entry->Flink = Flink;
        Entry->Blink = ListHead;
        Flink->Blink = Entry;
        ListHead->Flink = Entry;
    }

    FORCEINLINE
        VOID
        AppendTailList(
            _Inout_ PLIST_ENTRY ListHead,
            _Inout_ PLIST_ENTRY ListToAppend
        )
    {
        PLIST_ENTRY ListEnd = ListHead->Blink;

        ListHead->Blink->Flink = ListToAppend;
        ListHead->Blink = ListToAppend->Blink;
        ListToAppend->Blink->Flink = ListHead;
        ListToAppend->Blink = ListEnd;
    }

    FORCEINLINE
        PSINGLE_LIST_ENTRY
        PopEntryList(
            _Inout_ PSINGLE_LIST_ENTRY ListHead
        )
    {
        PSINGLE_LIST_ENTRY FirstEntry = ListHead->Next;

        if (FirstEntry)
            ListHead->Next = FirstEntry->Next;

        return FirstEntry;
    }

    FORCEINLINE
        VOID
        PushEntryList(
            _Inout_ PSINGLE_LIST_ENTRY ListHead,
            _Inout_ PSINGLE_LIST_ENTRY Entry
        )
    {
        Entry->Next = ListHead->Next;
        ListHead->Next = Entry;
    }

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateProcess(
            _Out_ PHANDLE ProcessHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ HANDLE ParentProcess,
            _In_ BOOLEAN InheritObjectTable,
            _In_opt_ HANDLE SectionHandle,
            _In_opt_ HANDLE DebugPort,
            _In_opt_ HANDLE ExceptionPort
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateProcessEx(
            _Out_ PHANDLE ProcessHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ HANDLE ParentProcess,
            _In_ ULONG Flags,
            _In_opt_ HANDLE SectionHandle,
            _In_opt_ HANDLE DebugPort,
            _In_opt_ HANDLE ExceptionPort,
            _In_ BOOLEAN InJob
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateUserProcess(
            _Out_ PHANDLE ProcessHandle,
            _Out_ PHANDLE ThreadHandle,
            _In_ ACCESS_MASK ProcessDesiredAccess,
            _In_ ACCESS_MASK ThreadDesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ProcessObjectAttributes,
            _In_opt_ POBJECT_ATTRIBUTES ThreadObjectAttributes,
            _In_ ULONG ProcessFlags,
            _In_ ULONG ThreadFlags,
            _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
            _Inout_ PPS_CREATE_INFO CreateInfo,
            _In_ PPS_ATTRIBUTE_LIST AttributeList
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationProcess(
            _In_ HANDLE ProcessHandle,
            _In_ PROCESSINFOCLASS ProcessInformationClass,
            _In_ PVOID ProcessInformation,
            _In_ ULONG ProcessInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationProcess(
            _In_ HANDLE ProcessHandle,
            _In_ PROCESSINFOCLASS ProcessInformationClass,
            _Out_ PVOID ProcessInformation,
            _In_ ULONG ProcessInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryObject(
            _In_ HANDLE Handle,
            _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
            _Out_opt_ PVOID ObjectInformation,
            _In_ ULONG ObjectInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySystemInformation(
            _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
            _Out_opt_ PVOID SystemInformation,
            _In_ ULONG SystemInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySystemInformationEx(
            _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
            _In_ PVOID InputBuffer,
            _In_ ULONG InputBufferLength,
            _Out_ PVOID SystemInformation,
            _In_ ULONG SystemInformationLength,
            _Out_opt_ PULONG ReturnLength
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetSystemInformation(
            _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
            _In_opt_ PVOID SystemInformation,
            _In_ ULONG SystemInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationThread(
            _In_ HANDLE ThreadHandle,
            _In_ THREADINFOCLASS ThreadInformationClass,
            _In_ PVOID ThreadInformation,
            _In_ ULONG ThreadInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationThread(
            _In_ HANDLE ThreadHandle,
            _In_ THREADINFOCLASS ThreadInformationClass,
            _Out_ PVOID ThreadInformation,
            _In_ ULONG ThreadInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnmapViewOfSection(
            _In_ HANDLE ProcessHandle,
            _In_ PVOID BaseAddress
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtExtendSection(
            _In_ HANDLE SectionHandle,
            _Inout_ PLARGE_INTEGER NewSectionSize
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSuspendThread(
            _In_ HANDLE ThreadHandle,
            _Out_opt_ PULONG PreviousSuspendCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtResumeThread(
            _In_ HANDLE ThreadHandle,
            _Out_opt_ PULONG PreviousSuspendCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSuspendProcess(
            _In_ HANDLE ProcessHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtResumeProcess(
            _In_ HANDLE ProcessHandle
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSCALLAPI
        ULONG
        NTAPI
        NtGetCurrentProcessorNumber(
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSignalAndWaitForSingleObject(
            _In_ HANDLE SignalHandle,
            _In_ HANDLE WaitHandle,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForSingleObject(
            _In_ HANDLE Handle,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForMultipleObjects(
            _In_ ULONG Count,
            _In_ PHANDLE Handles,
            _In_ WAIT_TYPE WaitType,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForMultipleObjects32(
            _In_ ULONG Count,
            _In_ PHANDLE Handles,
            _In_ WAIT_TYPE WaitType,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetSecurityObject(
            _In_ HANDLE Handle,
            _In_ SECURITY_INFORMATION SecurityInformation,
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySecurityObject(
            _In_ HANDLE Handle,
            _In_ SECURITY_INFORMATION SecurityInformation,
            _Out_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_ ULONG Length,
            _Out_ PULONG LengthNeeded
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueueApcThread(
            _In_ HANDLE ThreadHandle,
            _In_ PPS_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcArgument1,
            _In_opt_ PVOID ApcArgument2,
            _In_opt_ PVOID ApcArgument3
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueueApcThreadEx(
            _In_ HANDLE ThreadHandle,
            _In_opt_ HANDLE UserApcReserveHandle,
            _In_ PPS_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcArgument1,
            _In_opt_ PVOID ApcArgument2,
            _In_opt_ PVOID ApcArgument3
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtProtectVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _Inout_ PSIZE_T RegionSize,
            _In_ ULONG NewProtect,
            _Out_ PULONG OldProtect
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFlushBuffersFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFlushInstructionCache(
            _In_ HANDLE ProcessHandle,
            _In_opt_ PVOID BaseAddress,
            _In_ SIZE_T Length
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFlushWriteBuffer(
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFsControlFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG FsControlCode,
            _In_opt_ PVOID InputBuffer,
            _In_ ULONG InputBufferLength,
            _Out_opt_ PVOID OutputBuffer,
            _In_ ULONG OutputBufferLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLockFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PLARGE_INTEGER ByteOffset,
            _In_ PLARGE_INTEGER Length,
            _In_ ULONG Key,
            _In_ BOOLEAN FailImmediately,
            _In_ BOOLEAN ExclusiveLock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnlockFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PLARGE_INTEGER ByteOffset,
            _In_ PLARGE_INTEGER Length,
            _In_ ULONG Key
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFlushVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _Inout_ PSIZE_T RegionSize,
            _Out_ PIO_STATUS_BLOCK IoStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _In_ PVOID BaseAddress,
            _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
            _Out_ PVOID MemoryInformation,
            _In_ SIZE_T MemoryInformationLength,
            _Out_opt_ PSIZE_T ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLockVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _Inout_ PSIZE_T RegionSize,
            _In_ ULONG MapType
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnlockVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _Inout_ PSIZE_T RegionSize,
            _In_ ULONG MapType
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSystemDebugControl(
            _In_ SYSDBG_COMMAND Command,
            _Inout_opt_ PVOID InputBuffer,
            _In_ ULONG InputBufferLength,
            _Out_opt_ PVOID OutputBuffer,
            _In_ ULONG OutputBufferLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtYieldExecution(
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtClose(
            _In_ HANDLE Handle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryAttributesFile(
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Out_ PFILE_BASIC_INFORMATION FileInformation
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryFullAttributesFile(
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ PVOID FileInformation,
            _In_ ULONG Length,
            _In_ FILE_INFORMATION_CLASS FileInformationClass
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PVOID FileInformation,
            _In_ ULONG Length,
            _In_ FILE_INFORMATION_CLASS FileInformationClass
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetQuotaInformationFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PVOID Buffer,
            _In_ ULONG Length
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetVolumeInformationFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PVOID FsInformation,
            _In_ ULONG Length,
            _In_ FS_INFORMATION_CLASS FsInformationClass
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateFile(
            _Out_ PHANDLE FileHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_opt_ PLARGE_INTEGER AllocationSize,
            _In_ ULONG FileAttributes,
            _In_ ULONG ShareAccess,
            _In_ ULONG CreateDisposition,
            _In_ ULONG CreateOptions,
            _In_opt_ PVOID EaBuffer,
            _In_ ULONG EaLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateNamedPipeFile(
            _Out_ PHANDLE FileHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG ShareAccess,
            _In_ ULONG CreateDisposition,
            _In_ ULONG CreateOptions,
            _In_ ULONG NamedPipeType,
            _In_ ULONG ReadMode,
            _In_ ULONG CompletionMode,
            _In_ ULONG MaximumInstances,
            _In_ ULONG InboundQuota,
            _In_ ULONG OutboundQuota,
            _In_opt_ PLARGE_INTEGER DefaultTimeout
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateMailslotFile(
            _Out_ PHANDLE FileHandle,
            _In_ ULONG DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG CreateOptions,
            _In_ ULONG MailslotQuota,
            _In_ ULONG MaximumMessageSize,
            _In_ PLARGE_INTEGER ReadTimeout
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCancelIoFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCancelIoFileEx(
            _In_ HANDLE FileHandle,
            _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCancelSynchronousIoFile(
            _In_ HANDLE ThreadHandle,
            _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateSymbolicLinkObject(
            _Out_ PHANDLE LinkHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ PUNICODE_STRING LinkTarget
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenSymbolicLinkObject(
            _Out_ PHANDLE LinkHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySymbolicLinkObject(
            _In_ HANDLE LinkHandle,
            _Inout_ PUNICODE_STRING LinkTarget,
            _Out_opt_ PULONG ReturnedLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtGetContextThread(
            _In_ HANDLE ThreadHandle,
            _Inout_ PCONTEXT ThreadContext
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetContextThread(
            _In_ HANDLE ThreadHandle,
            _In_ PCONTEXT ThreadContext
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenProcess(
            _Out_ PHANDLE ProcessHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ PCLIENT_ID ClientId
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtTerminateProcess(
            _In_opt_ HANDLE ProcessHandle,
            _In_ NTSTATUS ExitStatus
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtGetNextProcess(
            _In_ HANDLE ProcessHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ ULONG HandleAttributes,
            _In_ ULONG Flags,
            _Out_ PHANDLE NewProcessHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtGetNextThread(
            _In_ HANDLE ProcessHandle,
            _In_ HANDLE ThreadHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ ULONG HandleAttributes,
            _In_ ULONG Flags,
            _Out_ PHANDLE NewThreadHandle
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateDebugObject(
            _Out_ PHANDLE DebugObjectHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ ULONG Flags
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDebugActiveProcess(
            _In_ HANDLE ProcessHandle,
            _In_ HANDLE DebugObjectHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtContinue(
            _In_ PCONTEXT ContextRecord,
            _In_ BOOLEAN TestAlert
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRaiseException(
            _In_ PEXCEPTION_RECORD ExceptionRecord,
            _In_ PCONTEXT ContextRecord,
            _In_ BOOLEAN FirstChance
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateThread(
            _Out_ PHANDLE ThreadHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ HANDLE ProcessHandle,
            _Out_ PCLIENT_ID ClientId,
            _In_ PCONTEXT ThreadContext,
            _In_ PINITIAL_TEB InitialTeb,
            _In_ BOOLEAN CreateSuspended
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateThreadEx(
            _Out_ PHANDLE ThreadHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ HANDLE ProcessHandle,
            _In_ PUSER_THREAD_START_ROUTINE StartRoutine,
            _In_opt_ PVOID Argument,
            _In_ ULONG CreateFlags,
            _In_opt_ ULONG_PTR ZeroBits,
            _In_opt_ SIZE_T StackSize,
            _In_opt_ SIZE_T MaximumStackSize,
            _In_opt_ PPS_ATTRIBUTE_LIST AttributeList
        );
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAllocateReserveObject(
            _Out_ PHANDLE MemoryReserveHandle,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ MEMORY_RESERVE_TYPE Type
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRegisterThreadTerminatePort(
            _In_ HANDLE PortHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRaiseHardError(
            _In_ NTSTATUS ErrorStatus,
            _In_ ULONG NumberOfParameters,
            _In_opt_ ULONG UnicodeStringParameterMask,
            _In_ PULONG_PTR Parameters,
            _In_ HARDERROR_RESPONSE_OPTION ResponseOption,
            _Out_ PHARDERROR_RESPONSE Response
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAllocateVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _In_ ULONG_PTR ZeroBits,
            _Inout_ PSIZE_T RegionSize,
            _In_ ULONG AllocationType,
            _In_ ULONG Protect
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFreeVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _Inout_ PSIZE_T RegionSize,
            _In_ ULONG FreeType
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReadVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _In_opt_ PVOID BaseAddress,
            _Out_ PVOID Buffer,
            _In_ SIZE_T BufferSize,
            _Out_opt_ PSIZE_T NumberOfBytesRead
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWriteVirtualMemory(
            _In_ HANDLE ProcessHandle,
            _In_opt_ PVOID BaseAddress,
            _In_ CONST VOID* Buffer,
            _In_ SIZE_T BufferSize,
            _Out_opt_ PSIZE_T NumberOfBytesWritten
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAllocateUserPhysicalPages(
            _In_ HANDLE ProcessHandle,
            _Inout_ PULONG_PTR NumberOfPages,
            _Out_ PULONG_PTR UserPfnArray
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtMapUserPhysicalPages(
            _In_ PVOID VirtualAddress,
            _In_ ULONG_PTR NumberOfPages,
            _In_ PULONG_PTR UserPfnArray
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtMapUserPhysicalPagesScatter(
            _In_ PVOID* VirtualAddresses,
            _In_ ULONG_PTR NumberOfPages,
            _In_ PULONG_PTR UserPfnArray
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFreeUserPhysicalPages(
            _In_ HANDLE ProcessHandle,
            _Inout_ PULONG_PTR NumberOfPages,
            _In_ PULONG_PTR UserPfnArray
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySection(
            _In_ HANDLE SectionHandle,
            _In_ SECTION_INFORMATION_CLASS SectionInformationClass,
            _Out_ PVOID SectionInformation,
            _In_ SIZE_T SectionInformationLength,
            _Out_opt_ PSIZE_T ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAreMappedFilesTheSame(
            _In_ PVOID File1MappedAsAnImage,
            _In_ PVOID File2MappedAsFile
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateSection(
            _Out_ PHANDLE SectionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ PLARGE_INTEGER MaximumSize,
            _In_ ULONG SectionPageProtection,
            _In_ ULONG AllocationAttributes,
            _In_opt_ HANDLE FileHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenSection(
            _Out_ PHANDLE SectionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtMapViewOfSection(
            _In_ HANDLE SectionHandle,
            _In_ HANDLE ProcessHandle,
            _Inout_ PVOID* BaseAddress,
            _In_ ULONG_PTR ZeroBits,
            _In_ SIZE_T CommitSize,
            _Inout_opt_ PLARGE_INTEGER SectionOffset,
            _Inout_ PSIZE_T ViewSize,
            _In_ SECTION_INHERIT InheritDisposition,
            _In_ ULONG AllocationType,
            _In_ ULONG Win32Protect
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenSession(
            _Out_ PHANDLE SessionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtNotifyChangeDirectoryFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ FILE_NOTIFY_INFORMATION Buffer,
            _In_ ULONG Length,
            _In_ ULONG CompletionFilter,
            _In_ BOOLEAN WatchTree
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenFile(
            _Out_ PHANDLE FileHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG ShareAccess,
            _In_ ULONG OpenOptions
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryDirectoryFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ PVOID FileInformation,
            _In_ ULONG Length,
            _In_ FILE_INFORMATION_CLASS FileInformationClass,
            _In_ BOOLEAN ReturnSingleEntry,
            _In_opt_ PUNICODE_STRING FileName,
            _In_ BOOLEAN RestartScan
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryEaFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ PVOID Buffer,
            _In_ ULONG Length,
            _In_ BOOLEAN ReturnSingleEntry,
            _In_ PVOID EaList,
            _In_ ULONG EaListLength,
            _In_opt_ PULONG EaIndex,
            _In_ BOOLEAN RestartScan
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetEaFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PVOID Buffer,
            _In_ ULONG Length
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLoadDriver(
            _In_ PUNICODE_STRING DriverServiceName
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnloadDriver(
            _In_ PUNICODE_STRING DriverServiceName
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReadFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ PVOID Buffer,
            _In_ ULONG Length,
            _In_opt_ PLARGE_INTEGER ByteOffset,
            _In_opt_ PULONG Key
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReadFileScatter(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
            _In_ ULONG Length,
            _In_opt_ PLARGE_INTEGER ByteOffset,
            _In_opt_ PULONG Key
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWriteFileGather(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
            _In_ ULONG Length,
            _In_opt_ PLARGE_INTEGER ByteOffset,
            _In_opt_ PULONG Key
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeleteFile(
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWriteFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PVOID Buffer,
            _In_ ULONG Length,
            _In_opt_ PLARGE_INTEGER ByteOffset,
            _In_opt_ PULONG Key
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeviceIoControlFile(
            _In_ HANDLE FileHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG IoControlCode,
            _In_opt_ PVOID InputBuffer,
            _In_ ULONG InputBufferLength,
            _Out_opt_ PVOID OutputBuffer,
            _In_ ULONG OutputBufferLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationObject(
            _In_ HANDLE Handle,
            _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
            _In_ PVOID ObjectInformation,
            _In_ ULONG ObjectInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDuplicateObject(
            _In_ HANDLE SourceProcessHandle,
            _In_ HANDLE SourceHandle,
            _In_opt_ HANDLE TargetProcessHandle,
            _Out_opt_ PHANDLE TargetHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ ULONG HandleAttributes,
            _In_ ULONG Options
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtMakePermanentObject(
            _In_ HANDLE Object
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtMakeTemporaryObject(
            _In_ HANDLE Handle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateDirectoryObject(
            _Out_ PHANDLE DirectoryHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenDirectoryObject(
            _Out_ PHANDLE DirectoryHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryDirectoryObject(
            _In_ HANDLE DirectoryHandle,
            _Out_ PVOID Buffer,
            _In_ ULONG BufferLength,
            _In_ BOOLEAN ReturnSingleEntry,
            _In_ BOOLEAN RestartScan,
            _Inout_ PULONG Context,
            _Out_opt_ PULONG ReturnLength
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreatePrivateNamespace(
            _Out_ PHANDLE NamespaceHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ PVOID BoundaryDescriptor
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenPrivateNamespace(
            _Out_ PHANDLE NamespaceHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ PVOID BoundaryDescriptor
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeletePrivateNamespace(
            _In_ HANDLE NamespaceHandle
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenThread(
            _Out_ PHANDLE ThreadHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ PCLIENT_ID ClientId
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtTerminateThread(
            _In_opt_ HANDLE ThreadHandle,
            _In_ NTSTATUS ExitStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySystemTime(
            _Out_ PLARGE_INTEGER SystemTime
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetSystemTime(
            _In_opt_ PLARGE_INTEGER SystemTime,
            _Out_opt_ PLARGE_INTEGER PreviousTime
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryTimerResolution(
            _Out_ PULONG MaximumTime,
            _Out_ PULONG MinimumTime,
            _Out_ PULONG CurrentTime
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetTimerResolution(
            _In_ ULONG DesiredTime,
            _In_ BOOLEAN SetResolution,
            _Out_ PULONG ActualTime
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryPerformanceCounter(
            _Out_ PLARGE_INTEGER PerformanceCounter,
            _Out_opt_ PLARGE_INTEGER PerformanceFrequency
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAllocateLocallyUniqueId(
            _Out_ PLUID Luid
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetUuidSeed(
            _In_ PCHAR Seed
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAllocateUuids(
            _Out_ PULARGE_INTEGER Time,
            _Out_ PULONG Range,
            _Out_ PULONG Sequence,
            _Out_ PCHAR Seed
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateEvent(
            _Out_ PHANDLE EventHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ EVENT_TYPE EventType,
            _In_ BOOLEAN InitialState
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenEvent(
            _Out_ PHANDLE EventHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetEvent(
            _In_ HANDLE EventHandle,
            _Out_opt_ PLONG PreviousState
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtResetEvent(
            _In_ HANDLE EventHandle,
            _Out_opt_ PLONG PreviousState
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtClearEvent(
            _In_ HANDLE EventHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryQuotaInformationFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ PVOID Buffer,
            _In_ ULONG Length,
            _In_ BOOLEAN ReturnSingleEntry,
            _In_opt_ PVOID SidList,
            _In_ ULONG SidListLength,
            _In_opt_ PSID StartSid,
            _In_ BOOLEAN RestartScan
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryVolumeInformationFile(
            _In_ HANDLE FileHandle,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _Out_ PVOID FsInformation,
            _In_ ULONG Length,
            _In_ FS_INFORMATION_CLASS FsInformationClass
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateKey(
            _Out_ PHANDLE KeyHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Reserved_ ULONG TitleIndex,
            _In_opt_ PUNICODE_STRING Class,
            _In_ ULONG CreateOptions,
            _Out_opt_ PULONG Disposition
        );

#if NTDDI_VERSION >= PNTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateKeyTransacted(
            _Out_ PHANDLE KeyHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Reserved_ ULONG TitleIndex,
            _In_opt_ PUNICODE_STRING Class,
            _In_ ULONG CreateOptions,
            _In_ HANDLE TransactionHandle,
            _Out_opt_ PULONG Disposition
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenKey(
            _Out_ PHANDLE KeyHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

#if NTDDI_VERSION >= PNTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenKeyTransacted(
            _Out_ PHANDLE KeyHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ HANDLE TransactionHandle
        );
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenKeyEx(
            _Out_ PHANDLE KeyHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ ULONG OpenOptions
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenKeyTransactedEx(
            _Out_ PHANDLE KeyHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ ULONG OpenOptions,
            _In_ HANDLE TransactionHandle
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeleteKey(
            _In_ HANDLE KeyHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRenameKey(
            _In_ HANDLE KeyHandle,
            _In_ PUNICODE_STRING NewName
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeleteValueKey(
            _In_ HANDLE KeyHandle,
            _In_ PUNICODE_STRING ValueName
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryKey(
            _In_ HANDLE KeyHandle,
            _In_ KEY_INFORMATION_CLASS KeyInformationClass,
            _Out_ PVOID KeyInformation,
            _In_ ULONG Length,
            _Out_ PULONG ResultLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationKey(
            _In_ HANDLE KeyHandle,
            _In_ KEY_SET_INFORMATION_CLASS KeySetInformationClass,
            _In_ PVOID KeySetInformation,
            _In_ ULONG KeySetInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryValueKey(
            _In_ HANDLE KeyHandle,
            _In_ PUNICODE_STRING ValueName,
            _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
            _Out_ PVOID KeyValueInformation,
            _In_ ULONG Length,
            _Out_ PULONG ResultLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetValueKey(
            _In_ HANDLE KeyHandle,
            _In_ PUNICODE_STRING ValueName,
            _In_opt_ ULONG TitleIndex,
            _In_ ULONG Type,
            _In_ PVOID Data,
            _In_ ULONG DataSize
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryMultipleValueKey(
            _In_ HANDLE KeyHandle,
            _Inout_ PKEY_VALUE_ENTRY ValueEntries,
            _In_ ULONG EntryCount,
            _Out_ PVOID ValueBuffer,
            _Inout_ PULONG BufferLength,
            _Out_opt_ PULONG RequiredBufferLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnumerateKey(
            _In_ HANDLE KeyHandle,
            _In_ ULONG Index,
            _In_ KEY_INFORMATION_CLASS KeyInformationClass,
            _Out_ PVOID KeyInformation,
            _In_ ULONG Length,
            _Out_ PULONG ResultLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnumerateValueKey(
            _In_ HANDLE KeyHandle,
            _In_ ULONG Index,
            _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
            _Out_ PVOID KeyValueInformation,
            _In_ ULONG Length,
            _Out_ PULONG ResultLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFlushKey(
            _In_ HANDLE KeyHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCompactKeys(
            _In_ ULONG Count,
            _In_ PHANDLE KeyArray
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCompressKey(
            _In_ HANDLE Key
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLoadKey(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _In_ POBJECT_ATTRIBUTES SourceFile
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLoadKey2(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _In_ POBJECT_ATTRIBUTES SourceFile,
            _In_ ULONG Flags
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLoadKeyEx(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _In_ POBJECT_ATTRIBUTES SourceFile,
            _In_ ULONG Flags,
            _In_opt_ HANDLE TrustClassKey,
            _In_opt_ HANDLE Event,
            _In_opt_ ACCESS_MASK DesiredAccess,
            _Out_opt_ PHANDLE RootHandle,
            _Out_opt_ PIO_STATUS_BLOCK IoStatus
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReplaceKey(
            _In_ POBJECT_ATTRIBUTES NewFile,
            _In_ HANDLE TargetHandle,
            _In_ POBJECT_ATTRIBUTES OldFile
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSaveKey(
            _In_ HANDLE KeyHandle,
            _In_ HANDLE FileHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSaveKeyEx(
            _In_ HANDLE KeyHandle,
            _In_ HANDLE FileHandle,
            _In_ ULONG Format
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSaveMergedKeys(
            _In_ HANDLE HighPrecedenceKeyHandle,
            _In_ HANDLE LowPrecedenceKeyHandle,
            _In_ HANDLE FileHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRestoreKey(
            _In_ HANDLE KeyHandle,
            _In_ HANDLE FileHandle,
            _In_ ULONG Flags
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnloadKey(
            _In_ POBJECT_ATTRIBUTES TargetKey
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnloadKey2(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _In_ ULONG Flags
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUnloadKeyEx(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _In_opt_ HANDLE Event
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtNotifyChangeKey(
            _In_ HANDLE KeyHandle,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG CompletionFilter,
            _In_ BOOLEAN WatchTree,
            _Out_ PVOID Buffer,
            _In_ ULONG BufferSize,
            _In_ BOOLEAN Asynchronous
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtNotifyChangeMultipleKeys(
            _In_ HANDLE MasterKeyHandle,
            _In_opt_ ULONG Count,
            _In_ POBJECT_ATTRIBUTES SubordinateObjects,
            _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
            _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ ULONG CompletionFilter,
            _In_ BOOLEAN WatchTree,
            _Out_ PVOID Buffer,
            _In_ ULONG BufferSize,
            _In_ BOOLEAN Asynchronous
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryOpenSubKeys(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _Out_ PULONG HandleCount
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryOpenSubKeysEx(
            _In_ POBJECT_ATTRIBUTES TargetKey,
            _In_ ULONG BufferLength,
            _Out_ PVOID Buffer,
            _Out_ PULONG RequiredSize
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtInitializeRegistry(
            _In_ USHORT BootCondition
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLockRegistryKey(
            _In_ HANDLE KeyHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtLockProductActivationKeys(
            _Inout_opt_ ULONG* pPrivateVer,
            _Out_opt_ ULONG* pSafeMode
        );

#if NTDDI_VERSION >= PNTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFreezeRegistry(
            _In_ ULONG TimeOutInSeconds
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtThawRegistry(
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDelayExecution(
            _In_ BOOLEAN Alertable,
            _In_ PLARGE_INTEGER DelayInterval
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCallbackReturn(
            _In_ PVOID OutputBuffer,
            _In_ ULONG OutputLength,
            _In_ NTSTATUS Status
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        VOID
        NTAPI
        NtFlushProcessWriteBuffers(
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryDebugFilterState(
            _In_ ULONG ComponentId,
            _In_ ULONG Level
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetDebugFilterState(
            _In_ ULONG ComponentId,
            _In_ ULONG Level,
            _In_ BOOLEAN State
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRemoveProcessDebug(
            _In_ HANDLE ProcessHandle,
            _In_ HANDLE DebugObjectHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForDebugEvent(
            _In_ HANDLE DebugObjectHandle,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout,
            _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDebugContinue(
            _In_ HANDLE DebugObjectHandle,
            _In_ PCLIENT_ID ClientId,
            _In_ NTSTATUS ContinueStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationDebugObject(
            _In_ HANDLE DebugObjectHandle,
            _In_ DEBUGOBJECTINFOCLASS DebugObjectInformationClass,
            _In_ PVOID DebugInformation,
            _In_ ULONG DebugInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenProcessToken(
            _In_ HANDLE ProcessHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _Out_ PHANDLE TokenHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenProcessTokenEx(
            _In_ HANDLE ProcessHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ ULONG HandleAttributes,
            _Out_ PHANDLE TokenHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenThreadToken(
            _In_ HANDLE ThreadHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ BOOLEAN OpenAsSelf,
            _Out_ PHANDLE TokenHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenThreadTokenEx(
            _In_ HANDLE ThreadHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ BOOLEAN OpenAsSelf,
            _In_ ULONG HandleAttributes,
            _Out_ PHANDLE TokenHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateToken(
            _Out_ PHANDLE TokenHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ TOKEN_TYPE TokenType,
            _In_ PLUID AuthenticationId,
            _In_ PLARGE_INTEGER ExpirationTime,
            _In_ PTOKEN_USER User,
            _In_ PTOKEN_GROUPS Groups,
            _In_ PTOKEN_PRIVILEGES Privileges,
            _In_opt_ PTOKEN_OWNER Owner,
            _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
            _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
            _In_ PTOKEN_SOURCE TokenSource
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDuplicateToken(
            _In_ HANDLE ExistingTokenHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ BOOLEAN EffectiveOnly,
            _In_ TOKEN_TYPE TokenType,
            _Out_ PHANDLE NewTokenHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAdjustPrivilegesToken(
            _In_ HANDLE TokenHandle,
            _In_ BOOLEAN DisableAllPrivileges,
            _In_opt_ PTOKEN_PRIVILEGES NewState,
            _In_ ULONG BufferLength,
            _Out_opt_ PTOKEN_PRIVILEGES PreviousState,
            _Out_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAdjustGroupsToken(
            _In_ HANDLE TokenHandle,
            _In_ BOOLEAN ResetToDefault,
            _In_opt_ PTOKEN_GROUPS NewState,
            _In_opt_ ULONG BufferLength,
            _Out_ PTOKEN_GROUPS PreviousState,
            _Out_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFilterToken(
            _In_ HANDLE ExistingTokenHandle,
            _In_ ULONG Flags,
            _In_opt_ PTOKEN_GROUPS SidsToDisable,
            _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
            _In_opt_ PTOKEN_GROUPS RestrictedSids,
            _Out_ PHANDLE NewTokenHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationToken(
            _In_ HANDLE TokenHandle,
            _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
            _In_ PVOID TokenInformation,
            _In_ ULONG TokenInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCompareTokens(
            _In_ HANDLE FirstTokenHandle,
            _In_ HANDLE SecondTokenHandle,
            _Out_ PBOOLEAN Equal
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPrivilegeCheck(
            _In_ HANDLE ClientToken,
            _Inout_ PPRIVILEGE_SET RequiredPrivileges,
            _Out_ PBOOLEAN Result
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtImpersonateAnonymousToken(
            _In_ HANDLE ThreadHandle
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySecurityAttributesToken(
            _In_ HANDLE TokenHandle,
            _In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,
            _In_ ULONG NumberOfAttributes,
            _Out_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION Buffer,
            _In_ ULONG Length,
            _Out_ PULONG ReturnLength
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAccessCheck(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_ HANDLE ClientToken,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ PGENERIC_MAPPING GenericMapping,
            _Out_ PPRIVILEGE_SET PrivilegeSet,
            _Inout_ PULONG PrivilegeSetLength,
            _Out_ PACCESS_MASK GrantedAccess,
            _Out_ PNTSTATUS AccessStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAccessCheckByType(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_opt_ PSID PrincipalSelfSid,
            _In_ HANDLE ClientToken,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_TYPE_LIST ObjectTypeList,
            _In_ ULONG ObjectTypeListLength,
            _In_ PGENERIC_MAPPING GenericMapping,
            _Out_ PPRIVILEGE_SET PrivilegeSet,
            _Inout_ PULONG PrivilegeSetLength,
            _Out_ PACCESS_MASK GrantedAccess,
            _Out_ PNTSTATUS AccessStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAccessCheckByTypeResultList(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_opt_ PSID PrincipalSelfSid,
            _In_ HANDLE ClientToken,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_TYPE_LIST ObjectTypeList,
            _In_ ULONG ObjectTypeListLength,
            _In_ PGENERIC_MAPPING GenericMapping,
            _Out_ PPRIVILEGE_SET PrivilegeSet,
            _Inout_ PULONG PrivilegeSetLength,
            _Out_ PACCESS_MASK GrantedAccess,
            _Out_ PNTSTATUS AccessStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateIoCompletion(
            _Out_ PHANDLE IoCompletionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ ULONG Count
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenIoCompletion(
            _Out_ PHANDLE IoCompletionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryIoCompletion(
            _In_ HANDLE IoCompletionHandle,
            _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
            _Out_ PVOID IoCompletionInformation,
            _In_ ULONG IoCompletionInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetIoCompletion(
            _In_ HANDLE IoCompletionHandle,
            _In_opt_ PVOID KeyContext,
            _In_opt_ PVOID ApcContext,
            _In_ NTSTATUS IoStatus,
            _In_ ULONG_PTR IoStatusInformation
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetIoCompletionEx(
            _In_ HANDLE IoCompletionHandle,
            _In_ HANDLE IoCompletionPacketHandle,
            _In_opt_ PVOID KeyContext,
            _In_opt_ PVOID ApcContext,
            _In_ NTSTATUS IoStatus,
            _In_ ULONG_PTR IoStatusInformation
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRemoveIoCompletion(
            _In_ HANDLE IoCompletionHandle,
            _Out_ PVOID* KeyContext,
            _Out_ PVOID* ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_opt_ PLARGE_INTEGER Timeout
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRemoveIoCompletionEx(
            _In_ HANDLE IoCompletionHandle,
            _Out_ PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,
            _In_ ULONG Count,
            _Out_ PULONG NumEntriesRemoved,
            _In_opt_ PLARGE_INTEGER Timeout,
            _In_ BOOLEAN Alertable
        );
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtNotifyChangeSession(
            _In_ HANDLE SessionHandle,
            _In_ ULONG ChangeSequenceNumber,
            _In_ PLARGE_INTEGER ChangeTimeStamp,
            _In_ IO_SESSION_EVENT Event,
            _In_ IO_SESSION_STATE NewState,
            _In_ IO_SESSION_STATE PreviousState,
            _In_ PVOID Payload,
            _In_ ULONG PayloadSize
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateMutant(
            _Out_ PHANDLE MutantHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ BOOLEAN InitialOwner
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenMutant(
            _Out_ PHANDLE MutantHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReleaseMutant(
            _In_ HANDLE MutantHandle,
            _Out_opt_ PLONG PreviousCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAlertThread(
            _In_ HANDLE ThreadHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAlertResumeThread(
            _In_ HANDLE ThreadHandle,
            _Out_opt_ PULONG PreviousSuspendCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtTestAlert(
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtImpersonateThread(
            _In_ HANDLE ServerThreadHandle,
            _In_ HANDLE ClientThreadHandle,
            _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateSemaphore(
            _Out_ PHANDLE SemaphoreHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ LONG InitialCount,
            _In_ LONG MaximumCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenSemaphore(
            _Out_ PHANDLE SemaphoreHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReleaseSemaphore(
            _In_ HANDLE SemaphoreHandle,
            _In_ LONG ReleaseCount,
            _Out_opt_ PLONG PreviousCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySemaphore(
            _In_ HANDLE SemaphoreHandle,
            _In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
            _Out_ PVOID SemaphoreInformation,
            _In_ ULONG SemaphoreInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateTimer(
            _Out_ PHANDLE TimerHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ TIMER_TYPE TimerType
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenTimer(
            _Out_ PHANDLE TimerHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetTimer(
            _In_ HANDLE TimerHandle,
            _In_ PLARGE_INTEGER DueTime,
            _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine,
            _In_opt_ PVOID TimerContext,
            _In_ BOOLEAN ResumeTimer,
            _In_opt_ LONG Period,
            _Out_opt_ PBOOLEAN PreviousState
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetTimerEx(
            _In_ HANDLE TimerHandle,
            _In_ TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
            _Inout_ PVOID TimerSetInformation,
            _In_ ULONG TimerSetInformationLength
        );
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCancelTimer(
            _In_ HANDLE TimerHandle,
            _Out_opt_ PBOOLEAN CurrentState
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryTimer(
            _In_ HANDLE TimerHandle,
            _In_ TIMER_INFORMATION_CLASS TimerInformationClass,
            _Out_ PVOID TimerInformation,
            _In_ ULONG TimerInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateKeyedEvent(
            _Out_ PHANDLE KeyedEventHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ ULONG Flags
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenKeyedEvent(
            _Out_ PHANDLE KeyedEventHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReleaseKeyedEvent(
            _In_ HANDLE KeyedEventHandle,
            _In_ PVOID KeyValue,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForKeyedEvent(
            _In_ HANDLE KeyedEventHandle,
            _In_ PVOID KeyValue,
            _In_ BOOLEAN Alertable,
            _In_opt_ PLARGE_INTEGER Timeout
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtUmsThreadYield(
            _In_ PVOID SchedulerParam
        );
#endif

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateTransactionManager(
            _Out_ PHANDLE TmHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ PUNICODE_STRING LogFileName,
            _In_opt_ ULONG CreateOptions,
            _In_opt_ ULONG CommitStrength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenTransactionManager(
            _Out_ PHANDLE TmHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ PUNICODE_STRING LogFileName,
            _In_opt_ LPGUID TmIdentity,
            _In_opt_ ULONG OpenOptions
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRenameTransactionManager(
            _In_ PUNICODE_STRING LogFileName,
            _In_ LPGUID ExistingTransactionManagerGuid
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRollforwardTransactionManager(
            _In_ HANDLE TransactionManagerHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRecoverTransactionManager(
            _In_ HANDLE TransactionManagerHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationTransactionManager(
            _In_ HANDLE TransactionManagerHandle,
            _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
            _Out_ PVOID TransactionManagerInformation,
            _In_ ULONG TransactionManagerInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationTransactionManager(
            _In_opt_ HANDLE TmHandle,
            _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
            _In_ PVOID TransactionManagerInformation,
            _In_ ULONG TransactionManagerInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnumerateTransactionObject(
            _In_opt_ HANDLE RootObjectHandle,
            _In_ KTMOBJECT_TYPE QueryType,
            _Inout_updates_bytes_(ObjectCursorLength) PKTMOBJECT_CURSOR ObjectCursor,
            _In_ ULONG ObjectCursorLength,
            _Out_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateTransaction(
            _Out_ PHANDLE TransactionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ LPGUID Uow,
            _In_opt_ HANDLE TmHandle,
            _In_opt_ ULONG CreateOptions,
            _In_opt_ ULONG IsolationLevel,
            _In_opt_ ULONG IsolationFlags,
            _In_opt_ PLARGE_INTEGER Timeout,
            _In_opt_ PUNICODE_STRING Description
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenTransaction(
            _Out_ PHANDLE TransactionHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ LPGUID Uow,
            _In_opt_ HANDLE TmHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationTransaction(
            _In_ HANDLE TransactionHandle,
            _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
            _Out_ PVOID TransactionInformation,
            _In_ ULONG TransactionInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationTransaction(
            _In_ HANDLE TransactionHandle,
            _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
            _In_ PVOID TransactionInformation,
            _In_ ULONG TransactionInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCommitTransaction(
            _In_ HANDLE TransactionHandle,
            _In_ BOOLEAN Wait
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRollbackTransaction(
            _In_ HANDLE TransactionHandle,
            _In_ BOOLEAN Wait
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateEnlistment(
            _Out_ PHANDLE EnlistmentHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ HANDLE ResourceManagerHandle,
            _In_ HANDLE TransactionHandle,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ ULONG CreateOptions,
            _In_ NOTIFICATION_MASK NotificationMask,
            _In_opt_ PVOID EnlistmentKey
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenEnlistment(
            _Out_ PHANDLE EnlistmentHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ HANDLE ResourceManagerHandle,
            _In_ LPGUID EnlistmentGuid,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
            _Out_ PVOID EnlistmentInformation,
            _In_ ULONG EnlistmentInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationEnlistment(
            _In_opt_ HANDLE EnlistmentHandle,
            _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
            _In_ PVOID EnlistmentInformation,
            _In_ ULONG EnlistmentInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRecoverEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PVOID EnlistmentKey
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPrePrepareEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPrepareEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCommitEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRollbackEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPrePrepareComplete(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPrepareComplete(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCommitComplete(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReadOnlyEnlistment(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRollbackComplete(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSinglePhaseReject(
            _In_ HANDLE EnlistmentHandle,
            _In_opt_ PLARGE_INTEGER TmVirtualClock
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateResourceManager(
            _Out_ PHANDLE ResourceManagerHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ HANDLE TmHandle,
            _In_ LPGUID RmGuid,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_opt_ ULONG CreateOptions,
            _In_opt_ PUNICODE_STRING Description
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtOpenResourceManager(
            _Out_ PHANDLE ResourceManagerHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_ HANDLE TmHandle,
            _In_opt_ LPGUID ResourceManagerGuid,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRecoverResourceManager(
            _In_ HANDLE ResourceManagerHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtGetNotificationResourceManager(
            _In_ HANDLE ResourceManagerHandle,
            _Out_ PTRANSACTION_NOTIFICATION TransactionNotification,
            _In_ ULONG NotificationLength,
            _In_opt_ PLARGE_INTEGER Timeout,
            _Out_opt_ PULONG ReturnLength,
            _In_ ULONG Asynchronous,
            _In_opt_ ULONG_PTR AsynchronousContext
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationResourceManager(
            _In_ HANDLE ResourceManagerHandle,
            _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
            _Out_ PVOID ResourceManagerInformation,
            _In_ ULONG ResourceManagerInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationResourceManager(
            _In_ HANDLE ResourceManagerHandle,
            _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
            _In_ PVOID ResourceManagerInformation,
            _In_ ULONG ResourceManagerInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtRegisterProtocolAddressInformation(
            _In_ HANDLE ResourceManager,
            _In_ PCRM_PROTOCOL_ID ProtocolId,
            _In_ ULONG ProtocolInformationSize,
            _In_ PVOID ProtocolInformation,
            _In_opt_ ULONG CreateOptions
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPropagationComplete(
            _In_ HANDLE ResourceManagerHandle,
            _In_ ULONG RequestCookie,
            _In_ ULONG BufferLength,
            _In_ PVOID Buffer
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtPropagationFailed(
            _In_ HANDLE ResourceManagerHandle,
            _In_ ULONG RequestCookie,
            _In_ NTSTATUS PropStatus
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtFreezeTransactions(
            _In_ PLARGE_INTEGER FreezeTimeout,
            _In_ PLARGE_INTEGER ThawTimeout
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtThawTransactions(
        );
#endif

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtCreateWorkerFactory(
            _Out_ PHANDLE WorkerFactoryHandleReturn,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ HANDLE CompletionPortHandle,
            _In_ HANDLE WorkerProcessHandle,
            _In_ PUSER_THREAD_START_ROUTINE StartRoutine,
            _In_opt_ PVOID StartParameter,
            _In_opt_ ULONG MaxThreadCount,
            _In_opt_ SIZE_T StackReserve,
            _In_opt_ SIZE_T StackCommit
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryInformationWorkerFactory(
            _In_ HANDLE WorkerFactoryHandle,
            _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
            _Out_ PVOID WorkerFactoryInformation,
            _In_ ULONG WorkerFactoryInformationLength,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationWorkerFactory(
            _In_ HANDLE WorkerFactoryHandle,
            _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
            _In_ PVOID WorkerFactoryInformation,
            _In_ ULONG WorkerFactoryInformationLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtShutdownWorkerFactory(
            _In_ HANDLE WorkerFactoryHandle,
            _Inout_ volatile LONG* PendingWorkerCount
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtReleaseWorkerFactoryWorker(
            _In_ HANDLE WorkerFactoryHandle
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWorkerFactoryWorkerReady(
            _In_ HANDLE WorkerFactoryHandle
        );
#endif

#if NTDDI_VERSION >= NTDDI_VISTA
#if NTDDI_VERSION >= NTDDI_WIN8 || defined(_WIN64)
    // Windows 8+ declaration, but can be used on any x64 Windows Vista+
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForWorkViaWorkerFactory(
            _In_ HANDLE WorkerFactoryHandle,
            _Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket,
            _In_ ULONG Count,
            _Out_ PULONG NumEntriesRemoved,
            _In_ PLARGE_INTEGER Unknown // Wrong type (but works)
        );
#else
    // Windows Vista/7 x86
    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtWaitForWorkViaWorkerFactory(
            _In_ HANDLE WorkerFactoryHandle,
            _Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket
        );
#endif
#endif

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySystemEnvironmentValue(
            _In_ PUNICODE_STRING VariableName,
            _Out_ PWSTR VariableValue,
            _In_ USHORT ValueLength,
            _Out_opt_ PUSHORT ReturnLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetSystemEnvironmentValue(
            _In_ PUNICODE_STRING VariableName,
            _In_ PUNICODE_STRING VariableValue
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQuerySystemEnvironmentValueEx(
            _In_ PUNICODE_STRING VariableName,
            _In_ LPGUID VendorGuid,
            _Out_ PVOID Value,
            _Inout_ PULONG ValueLength,
            _Out_opt_ PULONG Attributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetSystemEnvironmentValueEx(
            _In_ PUNICODE_STRING VariableName,
            _In_ LPGUID VendorGuid,
            _In_ PVOID Value,
            _In_ ULONG ValueLength,
            _In_ ULONG Attributes
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnumerateSystemEnvironmentValuesEx(
            _In_ ULONG InformationClass,
            _Out_ PVOID Buffer,
            _Inout_ PULONG BufferLength
        );

#if NTDDI_VERSION >= NTDDI_VISTA

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAddBootEntry(
            _In_ PBOOT_ENTRY BootEntry,
            _Out_opt_ PULONG Id
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeleteBootEntry(
            _In_ ULONG Id
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtModifyBootEntry(
            _In_ PBOOT_ENTRY BootEntry
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnumerateBootEntries(
            _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
            _Inout_ PULONG BufferLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryBootEntryOrder(
            _Out_writes_opt_(*Count) PULONG Ids,
            _Inout_ PULONG Count
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetBootEntryOrder(
            _In_reads_(Count) PULONG Ids,
            _In_ ULONG Count
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryBootOptions(
            _Out_writes_bytes_opt_(*BootOptionsLength) PBOOT_OPTIONS BootOptions,
            _Inout_ PULONG BootOptionsLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetBootOptions(
            _In_ PBOOT_OPTIONS BootOptions,
            _In_ ULONG FieldsToChange
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtTranslateFilePath(
            _In_ PFILE_PATH InputFilePath,
            _In_ ULONG OutputType,
            _Out_writes_bytes_opt_(*OutputFilePathLength) PFILE_PATH OutputFilePath,
            _Inout_opt_ PULONG OutputFilePathLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtAddDriverEntry(
            _In_ PEFI_DRIVER_ENTRY DriverEntry,
            _Out_opt_ PULONG Id
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDeleteDriverEntry(
            _In_ ULONG Id
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtModifyDriverEntry(
            _In_ PEFI_DRIVER_ENTRY DriverEntry
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnumerateDriverEntries(
            _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
            _Inout_ PULONG BufferLength
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtQueryDriverEntryOrder(
            _Out_writes_opt_(*Count) PULONG Ids,
            _Inout_ PULONG Count
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetDriverEntryOrder(
            _In_reads_(Count) PULONG Ids,
            _In_ ULONG Count
        );

#endif

#if NTDDI_VERSION >= NTDDI_WIN7

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSerializeBoot(
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtEnableLastKnownGood(
        );

    NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtDisableLastKnownGood(
        );

#endif

    NTSYSAPI
        ULONG
        __cdecl
        DbgPrint(
            _In_ PCH Format,
            ...
        );

    NTSYSAPI
        ULONG
        __cdecl
        DbgPrintEx(
            _In_ ULONG ComponentId,
            _In_ ULONG Level,
            _In_ PCSTR Format,
            ...
        );

    NTSYSAPI
        VOID
        NTAPI
        DbgBreakPoint(
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiConnectToDbg(
        );

    NTSYSAPI
        HANDLE
        NTAPI
        DbgUiGetThreadDebugObject(
        );

    NTSYSAPI
        VOID
        NTAPI
        DbgUiSetThreadDebugObject(
            _In_ HANDLE DebugObject
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiWaitStateChange(
            _Out_ PDBGUI_WAIT_STATE_CHANGE StateChange,
            _In_opt_ PLARGE_INTEGER Timeout
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiContinue(
            _In_ PCLIENT_ID AppClientId,
            _In_ NTSTATUS ContinueStatus
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiStopDebugging(
            _In_ HANDLE Process
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiDebugActiveProcess(
            _In_ HANDLE Process
        );

    NTSYSAPI
        VOID
        NTAPI
        DbgUiRemoteBreakin(
            _In_ PVOID Context
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiIssueRemoteBreakin(
            _In_ HANDLE Process
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        DbgUiConvertStateChangeStructure(
            _In_ PDBGUI_WAIT_STATE_CHANGE StateChange,
            _Out_ DEBUG_EVENT* DebugEvent
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrLoadDll(
            _In_opt_ PCWSTR DllPath,
            _In_opt_ PULONG DllCharacteristics,
            _In_ PUNICODE_STRING DllName,
            _Out_ PVOID* DllHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetDllHandle(
            _In_opt_ PCWSTR DllPath,
            _In_opt_ PULONG DllCharacteristics,
            _In_ PUNICODE_STRING DllName,
            _Out_ PVOID* DllHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetDllHandleEx(
            _In_ ULONG Flags,
            _In_opt_ PCWSTR DllPath,
            _In_opt_ PULONG DllCharacteristics,
            _In_ PUNICODE_STRING DllName,
            _Out_opt_ PVOID* DllHandle
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetDllHandleByMapping(
            _In_ PVOID Base,
            _Out_ PVOID* DllHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetDllHandleByName(
            _In_opt_ PUNICODE_STRING BaseDllName,
            _In_opt_ PUNICODE_STRING FullDllName,
            _Out_ PVOID* DllHandle
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetProcedureAddress(
            _In_ PVOID DllHandle,
            _In_opt_ CONST PANSI_STRING ProcedureName,
            _In_opt_ ULONG ProcedureNumber,
            _Out_ PVOID* ProcedureAddress
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetProcedureAddressEx(
            _In_ PVOID DllHandle,
            _In_opt_ PANSI_STRING ProcedureName,
            _In_opt_ ULONG ProcedureNumber,
            _Out_ PVOID* ProcedureAddress,
            _In_ ULONG Flags
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrLockLoaderLock(
            _In_ ULONG Flags,
            _Out_opt_ ULONG* Disposition,
            _Out_ PVOID* Cookie
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrUnlockLoaderLock(
            _In_ ULONG Flags,
            _Inout_ PVOID Cookie
        );

    NTSYSAPI
        PIMAGE_BASE_RELOCATION
        NTAPI
        LdrProcessRelocationBlock(
            _In_ ULONG_PTR VA,
            _In_ ULONG SizeOfBlock,
            _In_ PUSHORT NextOffset,
            _In_ LONG_PTR Diff
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrUnloadDll(
            _In_ PVOID DllHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrDisableThreadCalloutsForDll(
            _In_ PVOID DllHandle
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrOpenImageFileOptionsKey(
            _In_ PUNICODE_STRING SubKey,
            _In_ BOOLEAN Wow64,
            _Out_ PHANDLE NewKeyHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrQueryImageFileKeyOption(
            _In_ HANDLE KeyHandle,
            _In_ PCWSTR ValueName,
            _In_ ULONG Type,
            _Out_ PVOID Buffer,
            _In_ ULONG BufferSize,
            _Out_opt_ PULONG ReturnedLength
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrVerifyImageMatchesChecksum(
            _In_ HANDLE ImageFileHandle,
            _In_opt_ PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine,
            _In_ PVOID ImportCallbackParameter,
            _Out_opt_ PUSHORT ImageCharacteristics
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrVerifyImageMatchesChecksumEx(
            _In_ HANDLE ImageFileHandle,
            _Inout_ PLDR_VERIFY_IMAGE_INFO VerifyInfo
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrFindResourceDirectory_U(
            _In_ PVOID DllHandle,
            _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
            _In_ ULONG ResourceIdPathLength,
            _Out_ PIMAGE_RESOURCE_DIRECTORY* ResourceDirectory
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrFindResource_U(
            _In_ PVOID DllHandle,
            _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
            _In_ ULONG ResourceIdPathLength,
            _Out_ PIMAGE_RESOURCE_DATA_ENTRY* ResourceDataEntry
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrFindResourceEx_U(
            _In_opt_ ULONG Flags,
            _In_ PVOID DllHandle,
            _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
            _In_ ULONG ResourceIdPathLength,
            _Out_ PIMAGE_RESOURCE_DATA_ENTRY* ResourceDataEntry
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlAssert(
            _In_ PVOID VoidFailedAssertion,
            _In_ PVOID VoidFileName,
            _In_ ULONG LineNumber,
            _In_opt_ PSTR MutableMessage
        );

    NTSYSAPI
        DECLSPEC_NORETURN
        VOID
        NTAPI
        RtlRaiseStatus(
            _In_ NTSTATUS Status
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlRaiseException(
            _In_ PEXCEPTION_RECORD ExceptionRecord
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlConnectToSm(
            _In_ PUNICODE_STRING ApiPortName,
            _In_ HANDLE ApiPortHandle,
            _In_ DWORD ProcessImageType,
            _Out_ PHANDLE SmssConnection
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSendMsgToSm(
            _In_ HANDLE ApiPortHandle,
            _In_ PPORT_MESSAGE MessageData
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlRegisterThreadWithCsrss(
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlEnterCriticalSection(
            _Inout_ PRTL_CRITICAL_SECTION CriticalSection
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlLeaveCriticalSection(
            _Inout_ PRTL_CRITICAL_SECTION CriticalSection
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        LOGICAL
        NTAPI
        RtlIsCriticalSectionLocked(
            _In_ PRTL_CRITICAL_SECTION CriticalSection
        );

    NTSYSAPI
        LOGICAL
        NTAPI
        RtlIsCriticalSectionLockedByThread(
            _In_ PRTL_CRITICAL_SECTION CriticalSection
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlGetCriticalSectionRecursionCount(
            _In_ PRTL_CRITICAL_SECTION CriticalSection
        );
#endif

    NTSYSAPI
        LOGICAL
        NTAPI
        RtlTryEnterCriticalSection(
            _Inout_ PRTL_CRITICAL_SECTION CriticalSection
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlInitializeCriticalSection(
            _Out_ PRTL_CRITICAL_SECTION CriticalSection
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlEnableEarlyCriticalSectionEventCreation(
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlInitializeCriticalSectionAndSpinCount(
            _Out_ PRTL_CRITICAL_SECTION CriticalSection,
            _In_ ULONG SpinCount
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlSetCriticalSectionSpinCount(
            _Inout_ PRTL_CRITICAL_SECTION CriticalSection,
            _In_ ULONG SpinCount
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDeleteCriticalSection(
            _Inout_ PRTL_CRITICAL_SECTION CriticalSection
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        BOOL
        NTAPI
        RtlQueryPerformanceFrequency(
            _Out_ PLARGE_INTEGER Frequency
        );
#else
    FORCEINLINE
        BOOL
        NTAPI
        RtlQueryPerformanceFrequency(
            _Out_ PLARGE_INTEGER Frequency
        )
    {
        LARGE_INTEGER _;
        return NT_SUCCESS(NtQueryPerformanceCounter(&_,
            Frequency));
    }
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        BOOL
        NTAPI
        RtlQueryPerformanceCounter(
            _Out_ PLARGE_INTEGER PerformanceCount
        );
#else
    FORCEINLINE
        BOOL
        NTAPI
        RtlQueryPerformanceCounter(
            _Out_ PLARGE_INTEGER PerformanceCount
        )
    {
        return NT_SUCCESS(NtQueryPerformanceCounter(PerformanceCount,
            NULL));
    }
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetCompressionWorkSpaceSize(
            _In_ USHORT CompressionFormatAndEngine,
            _Out_ PULONG CompressBufferWorkSpaceSize,
            _Out_ PULONG CompressFragmentWorkSpaceSize
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCompressBuffer(
            _In_ USHORT CompressionFormatAndEngine,
            _In_ PUCHAR UncompressedBuffer,
            _In_ ULONG UncompressedBufferSize,
            _Out_ PUCHAR CompressedBuffer,
            _In_ ULONG CompressedBufferSize,
            _In_ ULONG UncompressedChunkSize,
            _Out_ PULONG FinalCompressedSize,
            _In_ PVOID WorkSpace
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDecompressBuffer(
            _In_ USHORT CompressionFormat,
            _Out_ PUCHAR UncompressedBuffer,
            _In_ ULONG UncompressedBufferSize,
            _In_ PUCHAR CompressedBuffer,
            _In_ ULONG CompressedBufferSize,
            _Out_ PULONG FinalUncompressedSize
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlCreateHeap(
            _In_ ULONG Flags,
            _In_opt_ PVOID HeapBase,
            _In_opt_ SIZE_T ReserveSize,
            _In_opt_ SIZE_T CommitSize,
            _In_opt_ PVOID Lock,
            _In_opt_ PRTL_HEAP_PARAMETERS Parameters
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlDestroyHeap(
            _Inout_ PVOID HeapHandle
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlAllocateHeap(
            _In_ PVOID HeapHandle,
            _In_opt_ ULONG Flags,
            _In_ SIZE_T Size
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlFreeHeap(
            _In_ PVOID HeapHandle,
            _In_opt_ ULONG Flags,
            _Inout_opt_ PVOID BaseAddress
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlWalkHeap(
            _In_ PVOID HeapHandle,
            _Inout_ PRTL_HEAP_WALK_ENTRY Entry
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryHeapInformation(
            _In_ PVOID HeapHandle,
            _In_ HEAP_INFORMATION_CLASS HeapInformationClass,
            _Out_opt_ PVOID HeapInformation,
            _In_opt_ SIZE_T HeapInformationLength,
            _Out_opt_ PSIZE_T ReturnLength
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetHeapInformation(
            _In_ PVOID HeapHandle,
            _In_ HEAP_INFORMATION_CLASS HeapInformationClass,
            _In_opt_ PVOID HeapInformation,
            _In_opt_ SIZE_T HeapInformationLength
        );

    NTSYSAPI
        SIZE_T
        NTAPI
        RtlSizeHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_ PVOID BaseAddress
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlZeroHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlProtectHeap(
            _In_ PVOID HeapHandle,
            _In_ BOOLEAN MakeReadOnly
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlLockHeap(
            _In_ PVOID HeapHandle
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlUnlockHeap(
            _In_ PVOID HeapHandle
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlReAllocateHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _Inout_opt_ PVOID BaseAddress,
            _In_ SIZE_T Size
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlGetUserInfoHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_ PVOID BaseAddress,
            _Out_opt_ PVOID* UserValue,
            _Out_opt_ PULONG UserFlags
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlSetUserValueHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_ PVOID BaseAddress,
            _In_ PVOID UserValue
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlSetUserFlagsHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_ PVOID BaseAddress,
            _In_ ULONG UserFlagsReset,
            _In_ ULONG UserFlagsSet
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlCreateTagHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_opt_ PWSTR TagPrefix,
            _In_ PWSTR TagNames
        );

    NTSYSAPI
        PWSTR
        NTAPI
        RtlQueryTagHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_ USHORT TagIndex,
            _In_ BOOLEAN ResetCounters,
            _Out_opt_ PRTL_HEAP_TAG_INFO TagInfo
        );

    NTSYSAPI
        SIZE_T
        NTAPI
        RtlCompactHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlValidateHeap(
            _In_ PVOID HeapHandle,
            _In_ ULONG Flags,
            _In_ PVOID BaseAddress
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlValidateProcessHeaps(
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlGetProcessHeaps(
            _In_ ULONG NumberOfHeaps,
            _Out_ PVOID* ProcessHeaps
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlEnumProcessHeaps(
            _In_ PRTL_ENUM_HEAPS_ROUTINE EnumRoutine,
            _In_ PVOID Parameter
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlUniform(
            _Inout_ PULONG Seed
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlRandom(
            _Inout_ PULONG Seed
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlRandomEx(
            _Inout_ PULONG Seed
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlFindMessage(
            _In_ PVOID DllHandle,
            _In_ ULONG MessageTableId,
            _In_ ULONG MessageLanguageId,
            _In_ ULONG MessageId,
            _Out_ PMESSAGE_RESOURCE_ENTRY* MessageEntry
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlFormatMessage(
            _In_ PCWSTR MessageFormat,
            _In_ ULONG MaximumWidth,
            _In_ BOOLEAN IgnoreInserts,
            _In_ BOOLEAN ArgumentsAreAnsi,
            _In_ BOOLEAN ArgumentsAreAnArray,
            _In_ va_list* Arguments,
            _Out_ PWSTR Buffer,
            _In_ ULONG Length,
            _Out_opt_ PULONG ReturnLength
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlNtStatusToDosError(
            _In_ NTSTATUS Status
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlNtStatusToDosErrorNoTeb(
            _In_ NTSTATUS Status
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetLastNtStatus(
        );

    NTSYSAPI
        LONG
        NTAPI
        RtlGetLastWin32Error(
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlSetLastWin32ErrorAndNtStatusFromNtStatus(
            _In_ NTSTATUS Status
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlSetLastWin32Error(
            _In_ LONG Win32Error
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlRestoreLastWin32Error(
            _In_ LONG Win32Error
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        ULONG
        NTAPI
        RtlGetThreadErrorMode(
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetThreadErrorMode(
            _In_ ULONG NewMode,
            _Out_opt_ PULONG OldMode
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlUpcaseUnicodeString(
            _Out_ PUNICODE_STRING DestinationString,
            _In_ PCUNICODE_STRING SourceString,
            _In_ BOOLEAN AllocateDestinationString
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlInitUnicodeString(
            _Out_ PUNICODE_STRING DestinationString,
            _In_opt_ PWSTR SourceString
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlInitAnsiString(
            _Out_ PANSI_STRING DestinationString,
            _In_opt_ PSTR SourceString
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlCopyUnicodeString(
            _Out_ PUNICODE_STRING DestinationString,
            _In_ PCUNICODE_STRING SourceString
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAppendUnicodeToString(
            _In_ PUNICODE_STRING Destination,
            _In_opt_ PCWSTR Source
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAnsiStringToUnicodeString(
            _Inout_ PUNICODE_STRING DestinationString,
            _In_ PANSI_STRING SourceString,
            _In_ BOOLEAN AllocateDestinationString
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlUnicodeStringToAnsiString(
            _Inout_ PANSI_STRING DestinationString,
            _In_ PUNICODE_STRING SourceString,
            _In_ BOOLEAN AllocateDestinationString
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlFreeAnsiString(
            _Inout_ PANSI_STRING AnsiString
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDefaultNpAcl(
            _Out_ PACL* Dacl
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateEnvironment(
            _In_ BOOLEAN CloneCurrentEnvironment,
            _Out_ PVOID* Environment
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateEnvironmentEx(
            _In_ PVOID SourceEnv,
            _Out_ PVOID* Environment,
            _In_ ULONG Flags
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDestroyEnvironment(
            _In_ PVOID Environment
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetCurrentEnvironment(
            _In_ PVOID Environment,
            _Out_opt_ PVOID* PreviousEnvironment
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetEnvironmentVar(
            _In_opt_ PWSTR* Environment,
            _In_ PWSTR Name,
            _In_ SIZE_T NameLength,
            _In_ PWSTR Value,
            _In_ SIZE_T ValueLength
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetEnvironmentVariable(
            _In_opt_ PVOID* Environment,
            _In_ PUNICODE_STRING Name,
            _In_ PUNICODE_STRING Value
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryEnvironmentVariable(
            _In_opt_ PVOID Environment,
            _In_ PWSTR Name,
            _In_ SIZE_T NameLength,
            _Out_ PWSTR Value,
            _In_ SIZE_T ValueLength,
            _Out_ PSIZE_T ReturnLength
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryEnvironmentVariable_U(
            _In_opt_ PVOID Environment,
            _In_ PUNICODE_STRING Name,
            _Out_ PUNICODE_STRING Value
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlExpandEnvironmentStrings(
            _In_opt_ PVOID Environment,
            _In_ PWSTR Src,
            _In_ SIZE_T SrcLength,
            _Out_ PWSTR Dst,
            _In_ SIZE_T DstLength,
            _Out_opt_ PSIZE_T ReturnLength
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlExpandEnvironmentStrings_U(
            _In_opt_ PVOID Environment,
            _In_ PUNICODE_STRING Source,
            _Out_ PUNICODE_STRING Destination,
            _Out_opt_ PULONG ReturnedLength
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetEnvironmentStrings(
            _In_ PWCHAR NewEnvironment,
            _In_ SIZE_T NewEnvironmentSize
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateProcessParameters(
            _Out_ PRTL_USER_PROCESS_PARAMETERS* pProcessParameters,
            _In_ PUNICODE_STRING ImagePathName,
            _In_opt_ PUNICODE_STRING DllPath,
            _In_opt_ PUNICODE_STRING CurrentDirectory,
            _In_opt_ PUNICODE_STRING CommandLine,
            _In_opt_ PVOID Environment,
            _In_opt_ PUNICODE_STRING WindowTitle,
            _In_opt_ PUNICODE_STRING DesktopInfo,
            _In_opt_ PUNICODE_STRING ShellInfo,
            _In_opt_ PUNICODE_STRING RuntimeData
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateProcessParametersEx(
            _Out_ PRTL_USER_PROCESS_PARAMETERS* pProcessParameters,
            _In_ PUNICODE_STRING ImagePathName,
            _In_opt_ PUNICODE_STRING DllPath,
            _In_opt_ PUNICODE_STRING CurrentDirectory,
            _In_opt_ PUNICODE_STRING CommandLine,
            _In_opt_ PVOID Environment,
            _In_opt_ PUNICODE_STRING WindowTitle,
            _In_opt_ PUNICODE_STRING DesktopInfo,
            _In_opt_ PUNICODE_STRING ShellInfo,
            _In_opt_ PUNICODE_STRING RuntimeData,
            _In_ ULONG Flags // Pass RTL_USER_PROCESS_PARAMETERS_NORMALIZED to keep parameters normalized
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDestroyProcessParameters(
            _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters
        );

    NTSYSAPI
        PRTL_USER_PROCESS_PARAMETERS
        NTAPI
        RtlNormalizeProcessParams(
            _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters
        );

    NTSYSAPI
        PRTL_USER_PROCESS_PARAMETERS
        NTAPI
        RtlDeNormalizeProcessParams(
            _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateUserProcess(
            _In_ PUNICODE_STRING NtImagePathName,
            _In_ ULONG AttributesDeprecated,
            _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
            _In_opt_ PSECURITY_DESCRIPTOR ProcessSecurityDescriptor,
            _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
            _In_opt_ HANDLE ParentProcess,
            _In_ BOOLEAN InheritHandles,
            _In_opt_ HANDLE DebugPort,
            _In_opt_ HANDLE TokenHandle, // used to be ExceptionPort
            _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateUserThread(
            _In_ HANDLE Process,
            _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
            _In_ BOOLEAN CreateSuspended,
            _In_opt_ ULONG ZeroBits,
            _In_opt_ SIZE_T MaximumStackSize,
            _In_opt_ SIZE_T CommittedStackSize,
            _In_ PUSER_THREAD_START_ROUTINE StartAddress,
            _In_opt_ PVOID Parameter,
            _Out_opt_ PHANDLE Thread,
            _Out_opt_ PCLIENT_ID ClientId
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDosApplyFileIsolationRedirection_Ustr(
            _In_ ULONG Flags,
            _In_ PUNICODE_STRING OriginalName,
            _In_ PUNICODE_STRING Extension,
            _Inout_ PUNICODE_STRING StaticString,
            _Inout_ PUNICODE_STRING DynamicString,
            _Inout_ PUNICODE_STRING* NewName,
            _In_ PULONG NewFlags,
            _In_ PSIZE_T FileNameSize,
            _In_ PSIZE_T RequiredLength
        );

    NTSYSAPI
        PIMAGE_NT_HEADERS
        NTAPI
        RtlImageNtHeader(
            _In_ PVOID ImageBase
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlImageNtHeaderEx(
            _In_opt_ ULONG Flags,
            _In_ PVOID Base,
            _In_ ULONG64 Size,
            _Out_ PIMAGE_NT_HEADERS* OutHeaders
        );
#endif

    NTSYSAPI
        PVOID
        NTAPI
        RtlImageDirectoryEntryToData(
            _In_ PVOID ImageBase,
            _In_ BOOLEAN MappedAsImage,
            _In_ USHORT DirectoryEntry,
            _Out_ PULONG Size
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlPcToFileHeader(
            _In_ PVOID PcValue,
            _Out_ PVOID* BaseOfImage
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlAddressInSectionTable(
            _In_ PIMAGE_NT_HEADERS NtHeaders,
            _In_ PVOID BaseOfImage,
            _In_ ULONG VirtualAddress
        );

    NTSYSAPI
        PIMAGE_SECTION_HEADER
        NTAPI
        RtlImageRvaToSection(
            _In_ PIMAGE_NT_HEADERS NtHeaders,
            _In_ PVOID Base,
            _In_ ULONG Rva
        );

    NTSYSAPI
        PVOID
        NTAPI
        RtlImageRvaToVa(
            _In_ PIMAGE_NT_HEADERS NtHeaders,
            _In_ PVOID Base,
            _In_ ULONG Rva,
            _Inout_opt_ PIMAGE_SECTION_HEADER* LastRvaSection
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryProcessHeapInformation(
            _Inout_ PRTL_DEBUG_INFORMATION Buffer
        );

    NTSYSAPI
        PRTL_DEBUG_INFORMATION
        NTAPI
        RtlCreateQueryDebugBuffer(
            _In_opt_ ULONG MaximumCommit,
            _In_ BOOLEAN UseEventPair
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryProcessDebugInformation(
            _In_ HANDLE UniqueProcessId,
            _In_ ULONG Flags,
            _Inout_ PRTL_DEBUG_INFORMATION Buffer
        );

#ifdef _WIN64
    NTSYSAPI
        VOID
        WINAPI
        RtlRestoreContext(
            _In_ PCONTEXT ContextRecord,
            _In_opt_ PEXCEPTION_RECORD ExceptionRecord
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAdjustPrivilege(
            _In_ ULONG Privilege,
            _In_ BOOLEAN Enable,
            _In_ BOOLEAN Client,
            _Out_ PBOOLEAN WasEnabled
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAcquirePrivilege(
            _In_ PULONG Privilege,
            _In_ ULONG NumPriv,
            _In_ ULONG Flags,
            _Out_ PVOID* ReturnedState
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlReleasePrivilege(
            _In_ PVOID StatePointer
        );
#endif

    NTSYSAPI
        ULONG
        NTAPI
        RtlGetFullPathName_U(
            _In_ PWSTR FileName,
            _In_ ULONG BufferLength,
            _Out_ PWSTR Buffer,
            _Out_opt_ PWSTR* FilePart
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlDosPathNameToNtPathName_U(
            _In_ PCWSTR DosFileName,
            _Out_ PUNICODE_STRING NtFileName,
            _Out_opt_ PWSTR* FilePart,
            _Reserved_ PVOID Reserved
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlDosPathNameToRelativeNtPathName_U(
            _In_ PCWSTR DosFileName,
            _Out_ PUNICODE_STRING NtFileName,
            _Out_opt_ PWSTR* FilePart,
            _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDosPathNameToRelativeNtPathName_U_WithStatus(
            _In_ PWSTR DosFileName,
            _Out_ PUNICODE_STRING NtFileName,
            _Out_opt_ PWSTR* FilePart,
            _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
        );
#endif

    NTSYSAPI
        RTL_PATH_TYPE
        NTAPI
        RtlDetermineDosPathNameType_U(
            _In_ PCWSTR Path
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetFullPathName_UstrEx(
            _In_ PUNICODE_STRING FileName,
            _In_opt_ PUNICODE_STRING StaticString,
            _In_opt_ PUNICODE_STRING DynamicString,
            _Out_opt_ PUNICODE_STRING* StringUsed,
            _Out_opt_ PSIZE_T FilePartSize,
            _Out_opt_ PBOOLEAN NameInvalid,
            _Out_ RTL_PATH_TYPE* PathType,
            _Out_opt_ PSIZE_T LengthNeeded
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetCurrentDirectory_U(
            _In_ PUNICODE_STRING PathName
        );

#if NTDDI_VERSION >= NTDDI_WS03
    NTSYSAPI
        VOID
        NTAPI
        RtlReleaseRelativeName(
            _In_ PRTL_RELATIVE_NAME_U RelativeName
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlNtPathNameToDosPathName(
            _In_ ULONG Flags,
            _Inout_ PRTL_UNICODE_STRING_BUFFER Path,
            _Out_opt_ PULONG Disposition,
            _Inout_opt_ PWSTR* FilePart
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        VOID
        NTAPI
        RtlInitializeSRWLock(
            _Out_ PRTL_SRWLOCK SRWLock
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlAcquireSRWLockExclusive(
            _Inout_ PRTL_SRWLOCK SRWLock
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlAcquireSRWLockShared(
            _Inout_ PRTL_SRWLOCK SRWLock
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlReleaseSRWLockExclusive(
            _Inout_ PRTL_SRWLOCK SRWLock
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlReleaseSRWLockShared(
            _Inout_ PRTL_SRWLOCK SRWLock
        );
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlTryAcquireSRWLockExclusive(
            _Inout_ PRTL_SRWLOCK SRWLock
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlTryAcquireSRWLockShared(
            _Inout_ PRTL_SRWLOCK SRWLock
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlAcquireReleaseSRWLockExclusive(
            _Inout_ PRTL_SRWLOCK SRWLock
        );
#endif

    NTSYSAPI
        ULONG
        NTAPI
        RtlWalkFrameChain(
            _Out_ PVOID* Callers,
            _In_ ULONG Count,
            _In_ ULONG Flags
        );

    NTSYSAPI
        PPREFIX_TABLE_ENTRY
        NTAPI
        PfxFindPrefix(
            _In_ PPREFIX_TABLE PrefixTable,
            _In_ PANSI_STRING FullName
        );

    NTSYSAPI
        VOID
        NTAPI
        PfxInitialize(
            _Out_ PPREFIX_TABLE PrefixTable
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        PfxInsertPrefix(
            _In_ PPREFIX_TABLE PrefixTable,
            _In_ PANSI_STRING Prefix,
            _Out_ PPREFIX_TABLE_ENTRY PrefixTableEntry
        );

    NTSYSAPI
        VOID
        NTAPI
        PfxRemovePrefix(
            _In_ PPREFIX_TABLE PrefixTable,
            _In_ PPREFIX_TABLE_ENTRY PrefixTableEntry
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAbsoluteToSelfRelativeSD(
            _In_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
            _Out_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
            _Inout_ PULONG BufferLength
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAddAccessAllowedAce(
            _Inout_ PACL Acl,
            _In_ ULONG AceRevision,
            _In_ ACCESS_MASK AccessMask,
            _In_ PSID Sid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAddAccessAllowedAceEx(
            _Inout_ PACL Acl,
            _In_ ULONG AceRevision,
            _In_ ULONG AceFlags,
            _In_ ACCESS_MASK AccessMask,
            _In_ PSID Sid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAddAce(
            _Inout_ PACL Acl,
            _In_ ULONG AceRevision,
            _In_ ULONG StartingAceIndex,
            _In_ PVOID AceList,
            _In_ ULONG AceListLength
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAddAtomToAtomTable(
            _In_ PVOID AtomTableHandle,
            _In_ PWSTR AtomName,
            _Inout_opt_ PRTL_ATOM Atom
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAppendUnicodeStringToString(
            PUNICODE_STRING Destination,
            PCUNICODE_STRING Source
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlAreAllAccessesGranted(
            _In_ ACCESS_MASK GrantedAccess,
            _In_ ACCESS_MASK DesiredAccess
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlAreAnyAccessesGranted(
            _In_ ACCESS_MASK GrantedAccess,
            _In_ ACCESS_MASK DesiredAccess
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlAreBitsClear(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG StartingIndex,
            _In_ ULONG Length
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlAreBitsSet(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG StartingIndex,
            _In_ ULONG Length
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlCaptureContext(
            _Out_ PCONTEXT ContextRecord
        );

    NTSYSAPI
        USHORT
        NTAPI
        RtlCaptureStackBackTrace(
            _In_ ULONG FramesToSkip,
            _In_ ULONG FramesToCapture,
            _Out_ PVOID* BackTrace,
            _Out_opt_ PULONG BackTraceHash
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlClearAllBits(
            _In_ PRTL_BITMAP BitMapHeader
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlClearBits(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG StartingIndex,
            _In_ ULONG NumberToClear
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateSystemVolumeInformationFolder(
            _In_ PCUNICODE_STRING VolumeRootPath
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        LONG
        NTAPI
        RtlCompareAltitudes(
            _In_ PCUNICODE_STRING Altitude1,
            _In_ PCUNICODE_STRING Altitude2
        );
#endif

    NTSYSAPI
        LONG
        NTAPI
        RtlCompareUnicodeString(
            _In_ PCUNICODE_STRING String1,
            _In_ PCUNICODE_STRING String2,
            _In_ BOOLEAN CaseInSensitive
        );

    NTSYSAPI
        ULONG32
        NTAPI
        RtlComputeCrc32(
            _In_ ULONG32 PartialCrc,
            _In_ PVOID Buffer,
            _In_ ULONG Length
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlConvertSidToUnicodeString(
            _Inout_ PUNICODE_STRING UnicodeString,
            _In_ PSID Sid,
            _In_ BOOLEAN AllocateDestinationString
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlCopyLuid(
            _Out_ PLUID DestinationLuid,
            _In_ PLUID SourceLuid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCopySid(
            _In_ ULONG DestinationSidLength,
            _Out_ PSID DestinationSid,
            _In_ PSID SourceSid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateAcl(
            _Out_ PACL Acl,
            _In_ ULONG AclLength,
            _In_ ULONG AclRevision
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateAtomTable(
            _In_ ULONG NumberOfBuckets,
            _Out_ PVOID* AtomTableHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDecompressFragment(
            _In_ USHORT CompressionFormat,
            _Out_ PUCHAR UncompressedFragment,
            _In_ ULONG UncompressedFragmentSize,
            _In_ PUCHAR CompressedBuffer,
            _In_ ULONG CompressedBufferSize,
            _In_ ULONG FragmentOffset,
            _Out_ PULONG FinalUncompressedSize,
            _In_ PVOID WorkSpace
        );

    NTSYSAPI
        PRTL_SPLAY_LINKS
        NTAPI
        RtlDelete(
            _In_ PRTL_SPLAY_LINKS Links
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDeleteAce(
            _Inout_ PACL Acl,
            _In_ ULONG AceIndex
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDeleteAtomFromAtomTable(
            _In_ PVOID AtomTableHandle,
            _In_ RTL_ATOM Atom
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlDeleteNoSplay(
            _In_ PRTL_SPLAY_LINKS Links,
            _Inout_ PRTL_SPLAY_LINKS* Root
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDowncaseUnicodeString(
            _Out_ PUNICODE_STRING DestinationString,
            _In_ PCUNICODE_STRING SourceString,
            _In_ BOOLEAN AllocateDestinationString
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDuplicateUnicodeString(
            _In_ ULONG Flags,
            _In_ UNICODE_STRING* StringIn,
            _Out_ UNICODE_STRING* StringOut
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlEmptyAtomTable(
            _In_ PVOID AtomTableHandle,
            _In_ BOOLEAN IncludePinnedAtoms
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlEqualSid(
            _In_ PSID Sid1,
            _In_ PSID Sid2
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlEqualString(
            _In_ PANSI_STRING String1,
            _In_ PANSI_STRING String2,
            _In_ BOOLEAN CaseInSensitive
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlEqualUnicodeString(
            _In_ PCUNICODE_STRING String1,
            _In_ PCUNICODE_STRING String2,
            _In_ BOOLEAN CaseInSensitive
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindClearBits(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG NumberToFind,
            _In_ ULONG HintIndex
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindClearBitsAndSet(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG NumberToFind,
            _In_ ULONG HintIndex
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindClearRuns(
            _In_ PRTL_BITMAP BitMapHeader,
            _Out_ PRTL_BITMAP_RUN RunArray,
            _In_ ULONG SizeOfRunArray,
            _In_ BOOLEAN LocateLongestRuns
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindLastBackwardRunClear(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG FromIndex,
            _In_ PULONG StartingRunIndex
        );

    NTSYSAPI
        CCHAR
        NTAPI
        RtlFindLeastSignificantBit(
            _In_ ULONGLONG Set
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindLongestRunClear(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ PULONG StartingIndex
        );

    NTSYSAPI
        CCHAR
        NTAPI
        RtlFindMostSignificantBit(
            _In_ ULONGLONG Set
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindNextForwardRunClear(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG FromIndex,
            _In_ PULONG StartingRunIndex
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindSetBits(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG NumberToFind,
            _In_ ULONG HintIndex
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlFindSetBitsAndClear(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG NumberToFind,
            _In_ ULONG HintIndex
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlGetCallersAddress(
            _Out_ PVOID* CallersAddress,
            _Out_ PVOID* CallersCaller
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetDaclSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _Out_ PBOOLEAN DaclPresent,
            _Out_ PACL* Dacl,
            _Out_ PBOOLEAN DaclDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetGroupSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _Out_ PSID* Group,
            _Out_ PBOOLEAN GroupDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetOwnerSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _Out_ PSID* Owner,
            _Out_ PBOOLEAN OwnerDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetSaclSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _Out_ PBOOLEAN SaclPresent,
            _Out_ PACL* Sacl,
            _Out_ PBOOLEAN SaclDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetSetBootStatusData(
            _In_ HANDLE Handle,
            _In_ BOOLEAN Get,
            _In_ RTL_BSD_ITEM_TYPE DataItem,
            _In_ PVOID DataBuffer,
            _In_ ULONG DataBufferLength,
            _Out_opt_ PULONG ByteRead
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateBootStatusDataFile(
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetVersion(
            _Out_ PRTL_OSVERSIONINFOW lpVersionInformation
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGUIDFromString(
            _In_ PUNICODE_STRING GuidString,
            _Out_ GUID* Guid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlHashUnicodeString(
            _In_ UNICODE_STRING* String,
            _In_ BOOLEAN CaseInSensitive,
            _In_ ULONG HashAlgorithm,
            _Out_ PULONG HashValue
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlInitializeSid(
            _Out_ PSID Sid,
            _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
            _In_ UCHAR SubAuthorityCount
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlLengthRequiredSid(
            _In_ ULONG SubAuthorityCount
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlLengthSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlLengthSid(
            _In_ PSID Sid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlLockBootStatusData(
            _Out_ PHANDLE BootStatusDataHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlLookupAtomInAtomTable(
            _In_ PVOID AtomTableHandle,
            _In_ PWSTR AtomName,
            _Out_opt_ PRTL_ATOM Atom
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlMapSecurityErrorToNtStatus(
            _In_ SECURITY_STATUS Error
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlMultiByteToUnicodeN(
            _Out_ PWCH UnicodeString,
            _In_ ULONG MaxBytesInUnicodeString,
            _Out_opt_ PULONG BytesInUnicodeString,
            _In_ PCSTR MultiByteString,
            _In_ ULONG BytesInMultiByteString
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlMultiByteToUnicodeSize(
            _Out_ PULONG BytesInUnicodeString,
            _In_ PCSTR MultiByteString,
            _In_ ULONG BytesInMultiByteString
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfClearBits(
            _In_ PRTL_BITMAP BitMapHeader
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfSetBits(
            _In_ PRTL_BITMAP BitMapHeader
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryAtomInAtomTable(
            _In_ PVOID AtomTableHandle,
            _In_ RTL_ATOM Atom,
            _Out_opt_ PULONG AtomUsage,
            _Out_opt_ PULONG AtomFlags,
            _Inout_opt_ PWSTR AtomName,
            _Inout_opt_ PULONG AtomNameLength
        );

    NTSYSAPI
        PRTL_SPLAY_LINKS
        NTAPI
        RtlRealPredecessor(
            _In_ PRTL_SPLAY_LINKS Links
        );

    NTSYSAPI
        PRTL_SPLAY_LINKS
        NTAPI
        RtlRealSuccessor(
            _In_ PRTL_SPLAY_LINKS Links
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlRunDecodeUnicodeString(
            _In_ UCHAR Seed,
            _Inout_ PUNICODE_STRING String
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlRunEncodeUnicodeString(
            _In_opt_ PUCHAR Seed,
            _Inout_ PUNICODE_STRING String
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSelfRelativeToAbsoluteSD(
            _In_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
            _Out_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
            _Inout_ PULONG AbsoluteSecurityDescriptorSize,
            _Out_ PACL Dacl,
            _Inout_ PULONG DaclSize,
            _Out_ PACL Sacl,
            _Inout_ PULONG SaclSize,
            _Out_opt_ PSID Owner,
            _Inout_ PULONG OwnerSize,
            _Out_opt_ PSID PrimaryGroup,
            _Inout_ PULONG PrimaryGroupSize
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSelfRelativeToAbsoluteSD2(
            _Inout_ PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
            _Inout_ PULONG pBufferSize
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlSetAllBits(
            _In_ PRTL_BITMAP BitMapHeader
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlSetBits(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG StartingIndex,
            _In_ ULONG NumberToSet
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetDaclSecurityDescriptor(
            _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_ BOOLEAN DaclPresent,
            _In_opt_ PACL Dacl,
            _In_ BOOLEAN DaclDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetGroupSecurityDescriptor(
            _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_opt_ PSID Group,
            _In_opt_ BOOLEAN GroupDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetOwnerSecurityDescriptor(
            _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_opt_ PSID Owner,
            _In_ BOOLEAN OwnerDefaulted
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlSetSaclSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_ BOOLEAN SaclPresent,
            _In_opt_ PACL Sacl,
            _In_opt_ BOOLEAN SaclDefaulted
        );

    NTSYSAPI
        PRTL_SPLAY_LINKS
        NTAPI
        RtlSplay(
            _Inout_ PRTL_SPLAY_LINKS Links
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlStringFromGUID(
            _In_ REFGUID Guid,
            _Out_ PUNICODE_STRING GuidString
        );

    NTSYSAPI
        PUCHAR
        NTAPI
        RtlSubAuthorityCountSid(
            _In_ PSID Sid
        );

    NTSYSAPI
        PULONG
        NTAPI
        RtlSubAuthoritySid(
            _In_ PSID Sid,
            _In_ ULONG SubAuthority
        );

    NTSYSAPI
        PRTL_SPLAY_LINKS
        NTAPI
        RtlSubtreePredecessor(
            _In_ PRTL_SPLAY_LINKS Links
        );

    NTSYSAPI
        PRTL_SPLAY_LINKS
        NTAPI
        RtlSubtreeSuccessor(
            _In_ PRTL_SPLAY_LINKS Links
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlTestBit(
            _In_ PRTL_BITMAP BitMapHeader,
            _In_ ULONG BitNumber
        );
#endif

    NTSYSAPI
        VOID
        NTAPI
        RtlUnlockBootStatusData(
            _In_ HANDLE BootStatusDataHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCreateSecurityDescriptor(
            _Out_ PSECURITY_DESCRIPTOR SecurityDescriptor,
            _In_ ULONG Revision
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlValidRelativeSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptorInput,
            _In_ ULONG SecurityDescriptorLength,
            _In_ SECURITY_INFORMATION RequiredInformation
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlValidSecurityDescriptor(
            _In_ PSECURITY_DESCRIPTOR SecurityDescriptor
        );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlValidSid(
            _In_ PSID Sid
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlVerifyVersionInfo(
            _In_ RTL_OSVERSIONINFOEXW VersionInfo,
            _In_ ULONG TypeMask,
            _In_ ULONGLONG ConditionMask
        );

    NTSYSAPI
        ULONGLONG
        NTAPI
        VerSetConditionMask(
            _In_ ULONGLONG ConditionMask,
            _In_ ULONG TypeMask,
            _In_ UCHAR Condition
        );

#if NTDDI_VERSION >= NTDDI_VISTA
    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocPool(
            _Out_ PTP_POOL* PoolReturn,
            _Reserved_ PVOID Reserved
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        NTSTATUS
        NTAPI
        TpDisablePoolCallbackChecks(
            _Inout_ PTP_POOL Pool
        );
#endif

    NTSYSAPI
        VOID
        NTAPI
        TpReleasePool(
            _Inout_ PTP_POOL Pool
        );

    NTSYSAPI
        VOID
        NTAPI
        TpSetPoolMaxThreads(
            _Inout_ PTP_POOL Pool,
            _In_ LONG MaxThreads
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpSetPoolMinThreads(
            _Inout_ PTP_POOL Pool,
            _In_ LONG MinThreads
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        NTSTATUS
        NTAPI
        TpQueryPoolStackInformation(
            _In_ PTP_POOL Pool,
            _Out_ PTP_POOL_STACK_INFORMATION PoolStackInformation
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpSetPoolStackInformation(
            _Inout_ PTP_POOL Pool,
            _In_ PTP_POOL_STACK_INFORMATION PoolStackInformation
        );
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocCleanupGroup(
            _Out_ PTP_CLEANUP_GROUP* CleanupGroupReturn
        );

    NTSYSAPI
        VOID
        NTAPI
        TpReleaseCleanupGroup(
            _Inout_ PTP_CLEANUP_GROUP CleanupGroup
        );

    NTSYSAPI
        VOID
        NTAPI
        TpReleaseCleanupGroupMembers(
            _Inout_ PTP_CLEANUP_GROUP CleanupGroup,
            _In_ LOGICAL CancelPendingCallbacks,
            _Inout_opt_ PVOID CleanupParameter
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpSimpleTryPost(
            _In_ PTP_SIMPLE_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocWork(
            _Out_ PTP_WORK* WorkReturn,
            _In_ PTP_WORK_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );

    NTSYSAPI
        VOID
        NTAPI
        TpReleaseWork(
            _Inout_ PTP_WORK Work
        );

    NTSYSAPI
        VOID
        NTAPI
        TpPostWork(
            _Inout_ PTP_WORK Work
        );

    NTSYSAPI
        VOID
        NTAPI
        TpWaitForWork(
            _Inout_ PTP_WORK Work,
            _In_ LOGICAL CancelPendingCallbacks
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocTimer(
            _Out_ PTP_TIMER* Timer,
            _In_ PTP_TIMER_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );

    NTSYSAPI
        VOID
        NTAPI
        TpReleaseTimer(
            _Inout_ PTP_TIMER Timer
        );

    NTSYSAPI
        VOID
        NTAPI
        TpSetTimer(
            _Inout_ PTP_TIMER Timer,
            _In_opt_ PLARGE_INTEGER DueTime,
            _In_ LONG Period,
            _In_opt_ LONG WindowLength
        );

    NTSYSAPI
        LOGICAL
        NTAPI
        TpIsTimerSet(
            _In_ PTP_TIMER Timer
        );

    NTSYSAPI
        VOID
        NTAPI
        TpWaitForTimer(
            _Inout_ PTP_TIMER Timer,
            _In_ LOGICAL CancelPendingCallbacks
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocWait(
            _Out_ PTP_WAIT* WaitReturn,
            _In_ PTP_WAIT_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );

    NTSYSAPI
        VOID
        NTAPI
        TpReleaseWait(
            _Inout_ PTP_WAIT Wait
        );

    NTSYSAPI
        VOID
        NTAPI
        TpSetWait(
            _Inout_ PTP_WAIT Wait,
            _In_opt_ HANDLE Handle,
            _In_opt_ PLARGE_INTEGER Timeout
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocIoCompletion(
            _Out_ PTP_IO* IoReturn,
            _In_ HANDLE File,
            _In_ PTP_IO_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );

    NTSYSAPI
        VOID
        NTAPI
        TpWaitForIoCompletion(
            _Inout_ PTP_IO Io,
            _In_ LOGICAL CancelPendingCallbacks
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocAlpcCompletion(
            _Out_ PTP_ALPC* AlpcReturn,
            _In_ HANDLE AlpcPort,
            _In_ PTP_ALPC_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAllocAlpcCompletionEx(
            _Out_ PTP_ALPC* AlpcReturn,
            _In_ HANDLE AlpcPort,
            _In_ PTP_ALPC_CALLBACK_EX Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
        );
#endif

    NTSYSAPI
        VOID
        NTAPI
        TpReleaseAlpcCompletion(
            _Inout_ PTP_ALPC Alpc
        );

    NTSYSAPI
        VOID
        NTAPI
        TpWaitForAlpcCompletion(
            _Inout_ PTP_ALPC Alpc
        );
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAlpcRegisterCompletionList(
            _Inout_ PTP_ALPC Alpc
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        TpAlpcUnregisterCompletionList(
            _Inout_ PTP_ALPC Alpc
        );
#endif

#ifdef __cplusplus
};
#endif

#endif // _NTDLL_H