Copyright: Copyright © 2000-2001 Rohitab Batra


 API Monitor 1.5 (Beta)

Context-Sensitive Help

This BETA version of API Monitor supports only Context-Sensitive Help. To use Context-Sensitive help,

•	Click on the [image] button on the top of a dialog box or the [image] button on the toolbar.

•	When you click on one of these, the mouse pointer will change to an arrow and question mark.  Then click somewhere in the API Monitor window, such as another Toolbar button.  The Help topic will be shown for the item you clicked.

Feedback

Please use the Product Support form to report any bugs, submit feedback for request new features.

Mailing List

Subscribe to the Mailing List to receive notifications of product updates, bug fixes and other announcements. This is a very low traffic mailing list with no advertisements.

Discussion Forum

Please visit the API Monitor Discussion Forum.

Version History

For a complete list of changes in the current version, please refer to the Version History.

Copyright

© 2000-2001, Rohitab Batra

software@rohitab.com

http://www.rohitab.com/apimonitor/


New command (File menu)

Use this command to create a new capture document.


Open command (File menu)

Use this command to open an existing capture document.


Save command (File menu)

Use this command to save the active document to its current name and directory.  When you save a document for the first time, API Monitor displays the Save As dialog box so you can name your document.  If you want to change the name and directory of an existing document before you save it, choose the Save As command.


Save As command (File menu)

Use this command to save and name the active document.  API Monitor displays the Save As dialog box so you can name your document.

To save a document with its existing name and directory, use the Save command.


Send Mail command (File menu)

Use this command to send the capture document through electronic mail.  This command presents a mail window with the active document attached to it.  You may then fill out the To: field, Subject: field, etc., and add text to the body of the message if you wish.  When you are finished you may click the "Send" button to send the message.


Recently Used Files (File menu)

Use the numbers and filenames listed at the bottom of the File menu to open the last four documents you closed.  Choose the number that corresponds with the document you want to open.


Exit command (File menu)

Use this command to end your API Monitor session.  You can also use the Close command on the application Control menu.  API Monitor prompts you to save documents with unsaved changes.


Cut command (Edit menu)

Use this command to remove the currently selected data from the document and put it on the clipboard.  This command is unavailable if there is no data currently selected.

Cutting data to the clipboard replaces the contents previously stored there.


Copy command (Edit menu)

Use this command to copy selected data onto the clipboard.  This command is unavailable if there is no data currently selected.

Copying data to the clipboard replaces the contents previously stored there.


Toolbar commnd (View menu)

Use this command to display and hide the Toolbar, which includes buttons for some of the most common commands in API Monitor, such as File Open.  A check mark appears next to the menu item when the Toolbar is displayed.


Toolbar

The toolbar is displayed across the top of the application window, below the menu bar.  The toolbar provides quick mouse access to many tools used in API Monitor,

To hide or display the Toolbar, choose Toolbar from the View menu.


Status Bar command (View menu)

Use this command to display and hide the Status Bar, which describes the action to be executed by the selected menu item or depressed toolbar button, and keyboard latch state. A check mark appears next to the menu item when the Status Bar is displayed.


Status Bar

The status bar is displayed at the bottom of the API Monitor window.  To display or hide the status bar, use the Status Bar command in the View menu.

The left area of the status bar describes actions of menu items as you use the arrow keys to navigate through menus.  This area similarly shows messages that describe the actions of toolbar buttons as you depress them, before releasing them.  If after viewing the description of the toolbar button command you wish not to execute the command, then release the mouse button while the pointer is off the toolbar button.

The right areas of the status bar indicate which of the following keys are latched down:

CAP	The Caps Lock key is latched down.

NUM	The Num Lock key is latched down.

SCRL	The Scroll Lock key is latched down.


About API Monitor command (Help menu)

Use this command to display the copyright notice and version number of your copy of API Monitor.


What’s This? command (Help menu)

Use the Context Help command to obtain help on some portion of API Monitor.  When you choose the Toolbar's Context Help button, the mouse pointer will change to an arrow and question mark.  Then click somewhere in the API Monitor window, such as another Toolbar button.  The Help topic will be shown for the item you clicked.


Title Bar

The title bar is located along the top of a window.  It contains the name of the application and document.

To move the window, drag the title bar.

Note: You can also move dialog boxes by dragging their title bars.


Scroll Bar

Displayed at the right and bottom edges of the document window.  The scroll boxes inside the scroll bars indicate your vertical and horizontal location in the document.  You can use the mouse to scroll to other parts of the document.


Size command (System menu)

Use this command to display a four-headed arrow so you can size the active window with the arrow keys.

After the pointer changes to the four-headed arrow:

1.	Press one of the DIRECTION keys (left, right, up, or down arrow key) to move the pointer to the border you want to move.

2.	Press a DIRECTION key to move the border.

3.	Press ENTER when the window is the size you want.

Note:  This command is unavailable if you maximize the window.


Move command (System menu)

Use this command to display a four-headed arrow so you can move the active window or dialog box with the arrow keys.

Note:  This command is unavailable if you maximize the window.


Minimize command (System menu)

Use this command to reduce the API Monitor window to an icon.


Maximize command (System menu)

Use this command to enlarge the active window to fill the available space.


Close command (System menu)

Use this command to close the active window or dialog box.


Restore command (System menu)

Use this command to return the active window to its size and position before you chose the Maximize or Minimize command.


Find command (Edit menu)

Use this command to find text in the active window.


Find Next command (Edit menu)

Use this command to find the next occurrence of the specified text


Find Previous command (Edit menu)

Use this command to find the previous occurrence of the specified text.


Find

Use this dialog box to find text in the active window.


Delete command (Edit menu)

Use this command to delete the selected items.


Next command (Window menu)

Use this command to switch to the next pane.


Previous command (Window menu)

Use this command to switch to the previous pane.


Select All command (Edit menu)

Use this command to select all items or text in the active pane.


Capture API Events command (Capture menu)

This command starts or stops capturing of API Events. When events are being captured, the button is in a depressed state and the menu item has a check mark next to it.


Clear Events command (Capture menu)

Use this command to clear the items or text in the active pane


 Process Filter command (Capture menu)

This command opens a dialog box where you can select the processes that are to be monitored for API Events.


API Filter command (Capture menu)

This command opens a dialog box where you can select the API categories to be monitored. API Monitor will only display API’s from these categories.


Gridlines command (View menu)

Use this command to show or hide gridlines in the Event Pane


Auto scroll command (View menu)

Use this command to enable or disable auto-scrolling in the Event Pane. When auto scrolling is enabled, the most recent API event will always be visible.


Font command (View menu)

Use this command to change the font of the currently selected pane.


Calculator command (Tools menu)

Use this command to run the Windows Calculator. If Windows Calculator is already running, API Monitor will display that instead of running it again.

Note: Calculator must be installed for this command to work.


IOCTL Decoder command (Tools menu)

This command will open the IOCTL Decoder that can be used to decode IOCTL codes. For the standard IOCTL codes, the name of the code is displayed along with other information like Function, Device Type and Method Type. For custom IOCTL codes, all information, except the name of the IOCTL code is displayed


Error Code Lookup command (Tools menu)

This command will open up the Error Lookup tool that can be used to get a description of an error given the error code. It supports the following types of error codes:

Standard Win32

Network

Windows Sockets

NT Status – Requires Windows NT


MSDN Library command (Help menu)

This command will open up the preferred MSDN Library collection. You must have MSDN Library installed for this command to work.


This command will display help for the currently selected API call in the MSDN library. You must have MSDN Library installed for this command to work.


This button will display help for the currently selected API call in the MSDN library. You must have MSDN Library installed for this command to work.


Closes the dialog box and saves any changes you have made.


Closes the dialog box without saving any changes you have made.


Access Type indicates the type of access that must be requested when the caller opens the file object representing the device


This button adds the process name, listed in the edit box on the left, to the filter list.


This button decodes and displays information about the given IOCTL code.


This is the “Type” field of the driver’s device object.


Selecting this option will disable the process filter. When the process filter is disabled, all processes will be monitored. It is highly recommended to use this option only when absolutely necessary as this can degrade system performance to an unacceptable limit.


Enter an Error code in this box, then press the Lookup button to get a description of the error.


This box displays a description of the error message or an error message if a description could not be found


Select this option to create an Exclude Filter. In this filter type, all processes listed below will be excluded from monitoring


This is the list of processes that will be monitored (Include Filter) or skipped from monitoring (Exclude Filter) depending on the Filter Type. If the filter is disabled, this list is ignored.


Function Code is in the range 0x800 to 0xfff for private I/O control codes defined by customers of Microsoft. Values in the range 0x000 to 0x7ff are reserved by Microsoft for public I/O control codes.


Select this option to create an Include Filter. Only API’s called by the processes listed below will be monitored.


Enter a IOCTL code and press the Decode button to get detailed information about the IOCTL.


This is the name of the IOCTL, as defined by Microsoft.


Select this option to display the error message in the users default language. This has no effect if the default language is English.


Select this option to display the error message in English.


Click this button to get a description of the error code.


Enter the name of a process and click on Add to add it to the filter list below. To get the process name, remove the path and extension of the file used to create the process. For e.g. the process name for C:\WINDOWS\NOTEPAD.EXE is NOTEPAD.


Click this button to remove the currently selected process from the filter list


Transfer type indicates how data is passed to the driver.


The path and name of the executable file that you want to monitor for API calls.


Provides a space for you to specify the directory in which the executable will be run.


Provides a space for you to specify command-line arguments you want to pass to the program at startup.


Click to display an Open dialog box that you can use to locate the executable you want to monitor.


Click to display a Browse window that you can use to select the working directory.


Help Topics command (Help menu)

Use this command to display the opening screen of Help


Using Help command (Help menu)

Use this command for instructions about using Help.


Load Process command (Capture menu)

Use this command to open up the Process Loader that can be used to monitor API’s called by console mode applications or to monitor API’s called very early in the program.


Print Preview command (File menu)

Use this command to display the active document as it would appear when printed.  When you choose this command, the main window will be replaced with a print preview window in which one or two pages will be displayed in their printed format.  The print preview toolbar offers you options to view either one or two pages at a time; move back and forth through the document; zoom in and out of pages; and initiate a print job.


Print Setup command (File menu)

Use this command to select a printer and a printer connection.  This command presents a Print Setup dialog box, where you specify the printer and its connection.


Print command (File menu)

Use this command to print a document.   This command presents a Print dialog box, where you may specify the range of pages to be printed, the number of copies, the destination printer, and other printer setup options.

If you would like to print the file directly, without displaying the Print dialog box, use the toolbar button.


Print command (File menu)

Use this command to print a document.   This command prints the document on the default printer.

 If you would like to specify the range of pages to be printed, the number of copies, the destination printer, and other printer setup options, use the Print command from the File menu.


Displays a list of running processes and NT Services with the Process ID


Use this command to monitor the currently selected process or NT Service.


Monitor Running Process command (Capture menu)

Use this command to monitor a process or  NT Service that is already running. It is recommended that you use this method of monitoring the process only when absolutely necessary, for example, when you wan’t to monitor console mode applications or NT Services. To monitor a standard process like Notepad, you can use the standard method of capturing.


GetProcAddress Hook command (Capture Menu)

Use this command to monitor API’s that are called using LoadLibrary-GetProcAddress. Selecting this options can cause applications to crash under the following condition:

Capture is Started

Application calls GetProcAddress to get API Address

Application calls API

Capture is Stopped

Application calls the API - Will Crash !!!

Note: For this option to work, the “Dynamic-Link Library” category must be selected in the API Filter.


Event Pane

This pane displays a list of Captured API calls. Double-Clicking on an API (or pressing the ENTER key) will display a description of the success or failure of the API. Right Clicking (pressing SHIFT+10) will display a context-menu will additional commands.


Event Pane Header

This header provides a description of columns in the Event Pane.

Process	The name of the process that made the API call.
Process ID	Process Identifier (PID) of the process. A process identifier uniquely identifies the process throughout the system. The Process ID is valid until the process terminates.
Win32 API	API call that was made.
Parameters	Complete list of parameters that were passed to the API.
Return Value	The value returned by the API.
Status	Status that is used to indicate whether the API call passed or failed.
GetLastError	This is the value of the calling threads last-error code (if the API call failed).

The order of these items can be changed by clicking on the item and dragging it to the new position. The width of a column can also be changed by clicking on the vertical line between two items and then dragging with the mouse.


Message Pane

When a capture is started, this Pane displays the process name and process ID of each process that is found. It also displays information about whether the process is being monitored or not. If the process that you wan’t to monitor is not displayed here (for example. if it is a console mode application), you need to use the Load Process command or the Monitor Running Process command, from the Capture menu, to capture API’s from that process.


Process Identifier (PID) of the process. A process identifier uniquely identifies the process throughout the system. The Process ID is valid until the process terminates.


The name of the API that was called.


This is the complete list of parameters that the API was called with. For each parameter, the name of the parameter and the value of the parameter is displayed.


The value returned by the API.


Status that is used to indicate whether the API call passed or failed.


This is the value of the calling threads last-error code.


This provides a description of the error that occurred (if the API call failed)


This is the name of the process that made the API call.


Use this button to view the details of the previous API call.


Use this button to view the details of the next API call.


Check this box to select or clear all Win32 API’s.


Check this box to select or clear all NT Native API’s.


Displays the contents of the buffer in hexadecimal format.


Displays the contents of the buffer in ASCII format. Control characters, like newline, are displayed as a dot.


Click this button to display the contents of the buffer in an easy to read format. The contents of the buffer are displayed in both hexadecimal and ASCII.


Processes and Threads

AssignProcessToJobObject

CommandLineToArgvW

ConvertThreadToFiber

CreateFiber

CreateJobObjectA

CreateJobObjectW

CreateProcessA

CreateProcessA

CreateProcessAsUserA

CreateProcessAsUserW

CreateProcessW

CreateProcessW

CreateRemoteThread

CreateThread

DeleteFiber

ExitProcess

ExitThread

FreeEnvironmentStringsA

FreeEnvironmentStringsW

GetCommandLineA

GetCommandLineW

GetCurrentProcess

GetCurrentProcessId

GetCurrentThread

GetCurrentThreadId

GetEnvironmentStringsA

GetEnvironmentStringsW

GetEnvironmentVariableA

GetEnvironmentVariableW

GetExitCodeProcess

GetExitCodeThread

GetGuiResources

GetPriorityClass

GetProcessAffinityMask

GetProcessPriorityBoost

GetProcessShutdownParameters

GetProcessTimes

GetProcessVersion

GetProcessWorkingSetSize

GetStartupInfoA

GetStartupInfoW

GetThreadPriority

GetThreadPriorityBoost

GetThreadTimes

OpenJobObjectA

OpenJobObjectW

OpenProcess

QueryInformationJobObject

ResumeThread

SetEnvironmentVariableA

SetEnvironmentVariableW

SetInformationJobObject

SetPriorityClass

SetProcessAffinityMask

SetProcessPriorityBoost

SetProcessShutdownParameters

SetProcessWorkingSetSize

SetThreadAffinityMask

SetThreadIdealProcessor

SetThreadPriority

SetThreadPriorityBoost

Sleep

SleepEx

SuspendThread

SwitchToFiber

SwitchToThread

TerminateJobObject

TerminateProcess

TerminateThread

WaitForInputIdle

WinExec


File I/O

_hread

_hwrite

_lclose

_lcreat

_llseek

_lopen

_lread

_lwrite

AreFileApisANSI

CancelIo

CopyFileA

CopyFileW

CreateDirectoryA

CreateDirectoryExA

CreateDirectoryExW

CreateDirectoryW

CreateFileA

CreateFileW

DeleteFileA

DeleteFileW

FindClose

FindCloseChangeNotification

FindFirstChangeNotificationA

FindFirstChangeNotificationW

FindFirstFileA

FindFirstFileW

FindNextFileA

FindNextFileW

FlushFileBuffers

GetCurrentDirectoryA

GetCurrentDirectoryW

GetDiskFreeSpaceA

GetDiskFreeSpaceExA

GetDiskFreeSpaceExW

GetDiskFreeSpaceW

GetDriveTypeA

GetDriveTypeW

GetFileAttributesA

GetFileAttributesExA

GetFileAttributesExW

GetFileAttributesW

GetFileInformationByHandle

GetFileSize

GetFileType

GetFullPathNameA

GetFullPathNameW

GetLogicalDrives

GetLogicalDriveStringsA

GetLogicalDriveStringsW

GetLongPathNameA

GetLongPathNameW

GetShortPathNameA

GetShortPathNameW

GetTempFileNameA

GetTempFileNameW

GetTempPathA

GetTempPathW

LockFile

MoveFileA

MoveFileW

MulDiv

OpenFile

QueryDosDeviceA

QueryDosDeviceW

ReadFile

ReadFileEx

RemoveDirectoryA

RemoveDirectoryW

SearchPathA

SearchPathW

SetCurrentDirectoryA

SetCurrentDirectoryW

SetEndOfFile

SetFileApisToANSI

SetFileApisToOEM

SetFileAttributesA

SetFileAttributesW

SetFilePointer

SetHandleCount

SetVolumeLabelA

SetVolumeLabelW

UnlockFile

WriteFile

WriteFileEx


Device Input and Output

DeviceIoControl


Dynamic-Link Libraries

GetModuleFileNameA

GetModuleFileNameW

GetProcAddress

LoadLibraryA – Always Hooked

LoadLibraryExA – Always Hooked

LoadLibraryExW – Always Hooked

LoadLibraryW – Always Hooked

LoadModule


Registry

GetPrivateProfileIntA

GetPrivateProfileIntW

GetPrivateProfileSectionA

GetPrivateProfileSectionNamesA

GetPrivateProfileSectionNamesW

GetPrivateProfileSectionW

GetPrivateProfileStringA

GetPrivateProfileStringW

GetPrivateProfileStructA

GetPrivateProfileStructW

GetProfileIntA

GetProfileIntW

GetProfileSectionA

GetProfileSectionW

GetProfileStringA

GetProfileStringW

RegCloseKey

RegConnectRegistryA

RegConnectRegistryW

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExW

RegCreateKeyW

RegDeleteKeyA

RegDeleteKeyW

RegDeleteValueA

RegDeleteValueW

RegEnumKeyA

RegEnumKeyExA

RegEnumKeyExW

RegEnumKeyW

RegEnumValueA

RegEnumValueW

RegFlushKey

RegGetKeySecurity

RegLoadKeyA

RegLoadKeyW

RegNotifyChangeKeyValue

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExW

RegOpenKeyW

RegOverridePredefKey

RegQueryInfoKeyA

RegQueryInfoKeyW

RegQueryMultipleValuesA

RegQueryMultipleValuesW

RegQueryValueA

RegQueryValueExA

RegQueryValueExW

RegQueryValueW

RegReplaceKeyA

RegReplaceKeyW

RegRestoreKeyA

RegRestoreKeyW

RegSaveKeyA

RegSaveKeyW

RegSetKeySecurity

RegSetValueA

RegSetValueExA

RegSetValueExW

RegSetValueW

RegUnLoadKeyA

RegUnLoadKeyW

WritePrivateProfileSectionA

WritePrivateProfileSectionW

WritePrivateProfileStringA

WritePrivateProfileStringW

WritePrivateProfileStructA

WritePrivateProfileStructW

WriteProfileSectionA

WriteProfileSectionW

WriteProfileStringA

WriteProfileStringW


Windows NT Security

AccessCheck

AccessCheckAndAuditAlarmA

AccessCheckAndAuditAlarmW

AccessCheckByType

AccessCheckByTypeAndAuditAlarmA

AccessCheckByTypeAndAuditAlarmW

AccessCheckByTypeResultList

AccessCheckByTypeResultListAndAuditAlarmA

AccessCheckByTypeResultListAndAuditAlarmW

AddAccessAllowedAce

AddAccessAllowedAceEx

AddAccessAllowedObjectAce

AddAccessDeniedAce

AddAccessDeniedAceEx

AddAccessDeniedObjectAce

AddAce

AddAuditAccessAce

AddAuditAccessAceEx

AddAuditAccessObjectAce

AdjustTokenGroups

AdjustTokenPrivileges

AllocateAndInitializeSid

AllocateLocallyUniqueId

AreAllAccessesGranted

AreAnyAccessesGranted

BuildExplicitAccessWithNameA

BuildExplicitAccessWithNameW

BuildImpersonateExplicitAccessWithNameA

BuildImpersonateExplicitAccessWithNameW

BuildImpersonateTrusteeA

BuildImpersonateTrusteeW

BuildSecurityDescriptorA

BuildSecurityDescriptorW

BuildTrusteeWithNameA

BuildTrusteeWithNameW

BuildTrusteeWithSidA

BuildTrusteeWithSidW

ConvertToAutoInheritPrivateObjectSecurity

CopySid

CreatePrivateObjectSecurity

CreatePrivateObjectSecurityEx

CreateRestrictedToken

DeleteAce

DestroyPrivateObjectSecurity

DuplicateToken

DuplicateTokenEx

EqualPrefixSid

EqualSid

FindFirstFreeAce

FreeSid

GetAce

GetAclInformation

GetAuditedPermissionsFromAclA

GetAuditedPermissionsFromAclW

GetEffectiveRightsFromAclA

GetEffectiveRightsFromAclW

GetExplicitEntriesFromAclA

GetExplicitEntriesFromAclW

GetFileSecurityA

GetFileSecurityW

GetKernelObjectSecurity

GetLengthSid

GetMultipleTrusteeA

GetMultipleTrusteeOperationA

GetMultipleTrusteeOperationW

GetMultipleTrusteeW

GetNamedSecurityInfoA

GetNamedSecurityInfoW

GetPrivateObjectSecurity

GetSecurityDescriptorControl

GetSecurityDescriptorDacl

GetSecurityDescriptorGroup

GetSecurityDescriptorLength

GetSecurityDescriptorOwner

GetSecurityDescriptorSacl

GetSecurityInfo

GetSidIdentifierAuthority

GetSidLengthRequired

GetSidSubAuthority

GetSidSubAuthorityCount

GetTokenInformation

GetTrusteeFormA

GetTrusteeFormW

GetTrusteeNameA

GetTrusteeNameW

GetTrusteeTypeA

GetTrusteeTypeW

GetUserObjectSecurity

ImpersonateLoggedOnUser

ImpersonateNamedPipeClient

ImpersonateSelf

InitializeAcl

InitializeSecurityDescriptor

InitializeSid

IsTokenRestricted

IsValidAcl

IsValidSecurityDescriptor

IsValidSid

LogonUserA

LogonUserW

LookupAccountNameA

LookupAccountNameW

LookupAccountSidA

LookupAccountSidW

LookupPrivilegeDisplayNameA

LookupPrivilegeDisplayNameW

LookupPrivilegeNameA

LookupPrivilegeNameW

LookupPrivilegeValueA

LookupPrivilegeValueW

LookupSecurityDescriptorPartsA

LookupSecurityDescriptorPartsW

MakeAbsoluteSD

MakeSelfRelativeSD

MapGenericMask

ObjectCloseAuditAlarmA

ObjectCloseAuditAlarmW

ObjectDeleteAuditAlarmA

ObjectDeleteAuditAlarmW

ObjectOpenAuditAlarmA

ObjectOpenAuditAlarmW

ObjectPrivilegeAuditAlarmA

ObjectPrivilegeAuditAlarmW

OpenProcessToken

OpenThreadToken

PrivilegeCheck

PrivilegedServiceAuditAlarmA

PrivilegedServiceAuditAlarmW

RevertToSelf

SetAclInformation

SetEntriesInAclA

SetEntriesInAclW

SetFileSecurityA

SetFileSecurityW

SetKernelObjectSecurity

SetNamedSecurityInfoA

SetNamedSecurityInfoW

SetPrivateObjectSecurity

SetPrivateObjectSecurityEx

SetSecurityDescriptorControl

SetSecurityDescriptorDacl

SetSecurityDescriptorGroup

SetSecurityDescriptorOwner

SetSecurityDescriptorSacl

SetSecurityInfo

SetThreadToken

SetTokenInformation

SetUserObjectSecurity


Services

ChangeServiceConfig2A

ChangeServiceConfig2W

ChangeServiceConfigA

ChangeServiceConfigW

CloseServiceHandle

ControlService

CreateServiceA

CreateServiceW

DeleteService

EnumDependentServicesA

EnumDependentServicesW

EnumServicesStatusA

EnumServicesStatusW

GetServiceDisplayNameA

GetServiceDisplayNameW

GetServiceKeyNameA

GetServiceKeyNameW

LockServiceDatabase

NotifyBootConfigStatus

OpenSCManagerA

OpenSCManagerW

OpenServiceA

OpenServiceW

QueryServiceConfig2A

QueryServiceConfig2W

QueryServiceConfigA

QueryServiceConfigW

QueryServiceLockStatusA

QueryServiceLockStatusW

QueryServiceObjectSecurity

QueryServiceStatus

RegisterServiceCtrlHandlerA

RegisterServiceCtrlHandlerW

SetServiceObjectSecurity

SetServiceStatus

StartServiceA

StartServiceCtrlDispatcherA

StartServiceCtrlDispatcherW

StartServiceW

UnlockServiceDatabase


Network Management

MultinetGetConnectionPerformanceA

MultinetGetConnectionPerformanceW

NetAlertRaise

NetAlertRaiseEx

NetApiBufferAllocate

NetApiBufferFree

NetApiBufferReallocate

NetApiBufferSize

NetConnectionEnum

NetFileClose

NetFileGetInfo

NetGetAnyDCName

NetGetDCName

NetGetDisplayInformationIndex

NetGroupAdd

NetGroupAddUser

NetGroupDel

NetGroupDelUser

NetGroupEnum

NetGroupGetInfo

NetGroupGetUsers

NetGroupSetInfo

NetGroupSetUsers

NetLocalGroupAdd

NetLocalGroupAddMember

NetLocalGroupAddMembers

NetLocalGroupDel

NetLocalGroupDelMember

NetLocalGroupDelMembers

NetLocalGroupEnum

NetLocalGroupGetInfo

NetLocalGroupGetMembers

NetLocalGroupSetInfo

NetLocalGroupSetMembers

NetMessageBufferSend

NetMessageNameAdd

NetMessageNameDel

NetMessageNameEnum

NetMessageNameGetInfo

NetQueryDisplayInformation

NetRemoteComputerSupports

NetRemoteTOd

NetReplExportDirAdd

NetReplExportDirDel

NetReplExportDirEnum

NetReplExportDirGetInfo

NetReplExportDirLock

NetReplExportDirSetInfo

NetReplExportDirUnlock

NetReplGetInfo

NetReplImportDirAdd

NetReplImportDirDel

NetReplImportDirEnum

NetReplImportDirGetInfo

NetReplImportDirLock

NetReplImportDirUnlock

NetReplSetInfo

NetScheduleJobAdd

NetScheduleJobDel

NetScheduleJobEnum

NetScheduleJobGetInfo

NetServerComputerNameAdd

NetServerComputerNameDel

NetServerDiskEnum

NetServerEnum

NetServerEnumEx

NetServerGetInfo

NetServerSetInfo

NetServerTransportAdd

NetServerTransportAddEx

NetServerTransportDel

NetServerTransportEnum

NetSessionDel

NetSessionEnum

NetSessionGetInfo

NetShareAdd

NetShareCheck

NetShareDel

NetShareEnum

NetShareGetInfo

NetShareSetInfo

NetStatisticsGet

NetUseAdd

NetUseDel

NetUseEnum

NetUseGetInfo

NetUserAdd

NetUserChangePassword

NetUserDel

NetUserEnum

NetUserGetGroups

NetUserGetInfo

NetUserGetLocalGroups

NetUserModalsGet

NetUserModalsSet

NetUserSetGroups

NetUserSetInfo

NetWkstaGetInfo

NetWkstaSetInfo

NetWkstaTransportAdd

NetWkstaTransportDel

NetWkstaTransportEnum

NetWkstaUserEnum

NetWkstaUserGetInfo

NetWkstaUserSetInfo

WNetAddConnection2A

WNetAddConnection2W

WNetAddConnection3A

WNetAddConnection3W

WNetAddConnectionA

WNetAddConnectionW

WNetCancelConnection2A

WNetCancelConnection2W

WNetCancelConnectionA

WNetCancelConnectionW

WNetCloseEnum

WNetConnectionDialog

WNetConnectionDialog1A

WNetConnectionDialog1W

WNetDisconnectDialog

WNetDisconnectDialog1A

WNetDisconnectDialog1W

WNetEnumResourceA

WNetEnumResourceW

WNetGetConnectionA

WNetGetConnectionW

WNetGetLastErrorA

WNetGetLastErrorW

WNetGetNetworkInformationA

WNetGetNetworkInformationW

WNetGetProviderNameA

WNetGetProviderNameW

WNetGetResourceInformationA

WNetGetResourceInformationW

WNetGetResourceParentA

WNetGetResourceParentW

WNetGetUniversalNameA

WNetGetUniversalNameW

WNetGetUserA

WNetGetUserW

WNetOpenEnumA

WNetOpenEnumW

WNetUseConnectionA

WnetUseConnectionW


NT Native API – Csr Functions

CsrAllocateCaptureBuffer

CsrAllocateCapturePointer

CsrAllocateMessagePointer

CsrCaptureMessageBuffer

CsrCaptureMessageString

CsrCaptureTimeout

CsrClientCallServer

CsrClientConnectToServer

CsrFreeCaptureBuffer

CsrIdentifyAlertableThread

CsrNewThread

CsrProbeForRead

CsrProbeForWrite

CsrSetPriorityClass


NT Native API – Miscellaneous Functions

DbgBreakPoint

DbgPrint

DbgPrompt

DbgSsHandleKmApiMsg

DbgSsInitialize

DbgUiConnectToDbg

DbgUiContinue

DbgUiWaitStateChange

DbgUserBreakPoint

KiRaiseUserExceptionDispatcher

KiUserApcDispatcher

KiUserCallbackDispatcher

KiUserExceptionDispatcher

NlsAnsiCodePage

NlsMbCodePageTag

NlsMbOemCodePageTag

NtAllocateLocallyUniqueId

NtAllocateUuids

NtCallbackReturn

NtDisplayString

NtQueryOleDirectoryFile

NtQuerySection

NtQuerySystemInformation

NtSetSystemInformation

NtShutdownSystem

NtVdmControl

NtW32Call

PfxFindPrefix

PfxInitialize

PfxInsertPrefix

PfxRemovePrefix

PropertyLengthAsVariant

RestoreEm87Context

SaveEm87Context


NT Native API – Ldr Functions

LdrAccessResource

LdrDisableThreadCalloutsForDll

LdrEnumResources

LdrFindEntryForAddress

LdrFindResource_U

LdrFindResourceDirectory_U

LdrGetDllHandle

LdrGetProcedureAddress

LdrInitializeThunk

LdrLoadDll

LdrProcessRelocationBlock

LdrQueryImageFileExecutionOptions

LdrQueryProcessModuleInformation

LdrShutdownProcess

LdrShutdownThread

LdrUnloadDll

LdrVerifyImageMatchesChecksum


NT Native API – Local Procedure Call

NtAcceptConnectPort

NtCompleteConnectPort

NtConnectPort

NtCreatePort

NtImpersonateClientOfPort

NtListenPort

NtQueryInformationPort

NtReadRequestData

NtReplyPort

NtReplyWaitReceivePort

NtReplyWaitReplyPort

NtRequestPort

NtRequestWaitReplyPort

NtSecureConnectPort

NtWriteRequestData


NT Native API – Security

NtAccessCheck

NtAccessCheckAndAuditAlarm

NtAccessCheckByType

NtAccessCheckByTypeAndAuditAlarm

NtAccessCheckByTypeResultList

NtAdjustGroupsToken

NtAdjustPrivilegesToken

NtCloseObjectAuditAlarm

NtCreateToken

NtDeleteObjectAuditAlarm

NtDuplicateToken

NtFilterToken

NtImpersonateThread

NtOpenObjectAuditAlarm

NtOpenProcessToken

NtOpenThreadToken

NtPrivilegeCheck

NtPrivilegedServiceAuditAlarm

NtPrivilegeObjectAuditAlarm

NtQueryInformationToken

NtQuerySecurityObject

NtSetInformationToken

NtSetSecurityObject


NT Native API – Atoms

NtAddAtom

NtDeleteAtom

NtFindAtom

NtQueryInformationAtom


NT Native API – Processes and Threads

NtAlertResumeThread

NtAlertThread

NtCreateProcess

NtCreateThread

NtCurrentTeb

NtDelayExecution

NtGetContextThread

NtOpenProcess

NtOpenThread

NtQueryInformationProcess

NtQueryInformationThread

NtQueueApcThread

NtResumeThread

NtSetContextThread

NtSetHighWaitLowThread

NtSetInformationProcess

NtSetInformationThread

NtSetLowWaitHighThread

NtSuspendThread

NtTerminateProcess

NtTerminateThread

NtTestAlert

NtYieldExecution


NT Native API – Memory

NtAllocateVirtualMemory

NtAllocateVirtualMemory64

NtAreMappedFilesTheSame

NtCreateSection

NtExtendSection

NtFlushVirtualMemory

NtFreeVirtualMemory

NtFreeVirtualMemory64

NtLockVirtualMemory

NtMapViewOfSection

NtMapViewOfVlmSection

NtOpenSection

NtProtectVirtualMemory

NtProtectVirtualMemory64

NtQueryVirtualMemory

NtQueryVirtualMemory64

NtReadVirtualMemory

NtReadVirtualMemory64

NtUnlockVirtualMemory

NtUnmapViewOfSection

NtUnmapViewOfVlmSection

NtWriteVirtualMemory

NtWriteVirtualMemory64


NT Native API – Jobs

NtAssignProcessToJobObject

NtCreateJobObject

NtOpenJobObject

NtQueryInformationJobObject

NtSetInformationJobObject

NtTerminateJobObject


NT Native API – File and General I/O

NtCancelIoFile

NtCreateFile

NtCreateIoCompletion

NtDeleteFile

NtDeviceIoControlFile

NtFlushBuffersFile

NtFsControlFile

NtLockFile

NtNotifyChangeDirectoryFile

NtOpenFile

NtOpenIoCompletion

NtQueryAttributesFile

NtQueryDirectoryFile

NtQueryEaFile

NtQueryIoCompletion

NtQueryQuotaInformationFile

NtQueryVolumeInformationFile

NtReadFile

NtReadFile64

NtReadFileScatter

NtRemoveIoCompletion

NtSetEaFile

NtSetInformationFile

NtSetIoCompletion

NtSetQuotaInformationFile

NtSetVolumeInformationFile

NtUnlockFile

NtWriteFile

NtWriteFile64

NtWriteFileGather

NtQueryFullAttributesFile

NtQueryInformationFile


NT Native API – Rtl Functions

RtlAbortRXact

RtlAbsoluteToSelfRelativeSD

RtlAcquirePebLock

RtlAcquireResourceExclusive

RtlAcquireResourceShared

RtlAddAccessAllowedAce

RtlAddAccessDeniedAce

RtlAddAce

RtlAddActionToRXact

RtlAddAtomToAtomTable

RtlAddAttributeActionToRXact

RtlAddAuditAccessAce

RtlAddCompoundAce

RtlAdjustPrivilege

RtlAllocateAndInitializeSid

RtlAllocateHandle

RtlAllocateHeap

RtlAnsiCharToUnicodeChar

RtlAnsiStringToUnicodeSize

RtlAnsiStringToUnicodeString

RtlAppendAsciizToString

RtlAppendStringToString

RtlAppendUnicodeStringToString

RtlAppendUnicodeToString

RtlApplyRXact

RtlApplyRXactNoFlush

RtlAreAllAccessesGranted

RtlAreAnyAccessesGranted

RtlAreBitsClear

RtlAreBitsSet

RtlAssert

RtlCaptureStackBackTrace

RtlCharToInteger

RtlCheckRegistryKey

RtlClearAllBits

RtlClearBits

RtlClosePropertySet

RtlCompactHeap

RtlCompareMemory

RtlCompareMemoryUlong

RtlCompareString

RtlCompareUnicodeString

RtlCompareVariants

RtlCompressBuffer

RtlConsoleMultiByteToUnicodeN

RtlConvertExclusiveToShared

RtlConvertLongToLargeInteger

RtlConvertPropertyToVariant

RtlConvertSharedToExclusive

RtlConvertSidToUnicodeString

RtlConvertUiListToApiList

RtlConvertUlongToLargeInteger

RtlConvertVariantToProperty

RtlCopyLuid

RtlCopyLuidAndAttributesArray

RtlCopySecurityDescriptor

RtlCopySid

RtlCopySidAndAttributesArray

RtlCopyString

RtlCopyUnicodeString

RtlCreateAcl

RtlCreateAndSetSD

RtlCreateAtomTable

RtlCreateEnvironment

RtlCreateHeap

RtlCreateProcessParameters

RtlCreatePropertySet

RtlCreateQueryDebugBuffer

RtlCreateRegistryKey

RtlCreateSecurityDescriptor

RtlCreateTagHeap

RtlCreateUnicodeString

RtlCreateUnicodeStringFromAsciiz

RtlCreateUserProcess

RtlCreateUserSecurityObject

RtlCreateUserThread

RtlCustomCPToUnicodeN

RtlCutoverTimeToSystemTime

RtlDecompressBuffer

RtlDecompressFragment

RtlDelete

RtlDeleteAce

RtlDeleteAtomFromAtomTable

RtlDeleteCriticalSection

RtlDeleteElementGenericTable

RtlDeleteNoSplay

RtlDeleteRegistryValue

RtlDeleteResource

RtlDeleteSecurityObject

RtlDeNormalizeProcessParams

RtlDestroyAtomTable

RtlDestroyEnvironment

RtlDestroyHandleTable

RtlDestroyHeap

RtlDestroyProcessParameters

RtlDestroyQueryDebugBuffer

RtlDetermineDosPathNameType_U

RtlDoesFileExists_U

RtlDosPathNameToNtPathName_U

RtlDosSearchPath_U

RtlDowncaseUnicodeString

RtlDumpResource

RtlEmptyAtomTable

RtlEnlargedIntegerMultiply

RtlEnlargedUnsignedDivide

RtlEnlargedUnsignedMultiply

RtlEnterCriticalSection

RtlEnumerateGenericTable

RtlEnumerateGenericTableWithoutSplaying

RtlEnumerateProperties

RtlEnumProcessHeaps

RtlEqualComputerName

RtlEqualDomainName

RtlEqualLuid

RtlEqualPrefixSid

RtlEqualSid

RtlEqualString

RtlEqualUnicodeString

RtlEraseUnicodeString

RtlExpandEnvironmentStrings_U

RtlExtendedIntegerMultiply

RtlExtendedLargeIntegerDivide

RtlExtendedMagicDivide

RtlExtendHeap

RtlFillMemory

RtlFillMemoryUlong

RtlFindClearBits

RtlFindClearBitsAndSet

RtlFindLongestRunClear

RtlFindLongestRunSet

RtlFindMessage

RtlFindSetBits

RtlFindSetBitsAndClear

RtlFirstFreeAce

RtlFlushPropertySet

RtlFormatCurrentUserKeyPath

RtlFormatMessage

RtlFreeAnsiString

RtlFreeHandle

RtlFreeHeap

RtlFreeOemString

RtlFreeSid

RtlFreeUnicodeString

RtlFreeUserThreadStack

RtlGenerate8dot3Name

RtlGetAce

RtlGetCallersAddress

RtlGetCompressionWorkSpaceSize

RtlGetControlSecurityDescriptor

RtlGetCurrentDirectory_U

RtlGetDaclSecurityDescriptor

RtlGetElementGenericTable

RtlGetFullPathName_U

RtlGetGroupSecurityDescriptor

RtlGetLongestNtPathLength

RtlGetNtGlobalFlags

RtlGetNtProductType

RtlGetOwnerSecurityDescriptor

RtlGetProcessHeaps

RtlGetSaclSecurityDescriptor

RtlGetUserInfoHeap

RtlGuidToPropertySetName

RtlIdentifierAuthoritySid

RtlImageDirectoryEntryToData

RtlImageNtHeader

RtlImageRvaToSection

RtlImageRvaToVa

RtlImpersonateSelf

RtlInitAnsiString

RtlInitCodePageTable

RtlInitializeAtomPackage

RtlInitializeBitMap

RtlInitializeContext

RtlInitializeCriticalSection

RtlInitializeCriticalSectionAndSpinCount

RtlInitializeGenericTable

RtlInitializeHandleTable

RtlInitializeResource

RtlInitializeRXact

RtlInitializeSid

RtlInitNlsTables

RtlInitString

RtlInitUnicodeString

RtlInsertElementGenericTable

RtlIntegerToChar

RtlIntegerToUnicodeString

RtlIsDosDeviceName_U

RtlIsGenericTableEmpty

RtlIsNameLegalDOS8Dot3

RtlIsTextUnicode

RtlIsValidHandle

RtlIsValidIndexHandle

RtlLargeIntegerAdd

RtlLargeIntegerArithmeticShift

RtlLargeIntegerDivide

RtlLargeIntegerNegate

RtlLargeIntegerShiftLeft

RtlLargeIntegerShiftRight

RtlLargeIntegerSubtract

RtlLargeIntegerToChar

RtlLeaveCriticalSection

RtlLengthRequiredSid

RtlLengthSecurityDescriptor

RtlLengthSid

RtlLocalTimeToSystemTime

RtlLockHeap

RtlLookupAtomInAtomTable

RtlLookupElementGenericTable

RtlMakeSelfRelativeSD

RtlMapGenericMask

RtlMoveMemory

RtlMultiByteToUnicodeN

RtlMultiByteToUnicodeSize

RtlNewInstanceSecurityObject

RtlNewSecurityGrantedAccess

RtlNewSecurityObject

RtlNormalizeProcessParams

RtlNtStatusToDosError

RtlNumberGenericTableElements

RtlNumberOfClearBits

RtlNumberOfSetBits

RtlOemStringToUnicodeSize

RtlOemStringToUnicodeString

RtlOemToUnicodeN

RtlOnMappedStreamEvent

RtlOpenCurrentUser

RtlPcToFileHeader

RtlPinAtomInAtomTable

RtlpNtCreateKey

RtlpNtEnumerateSubKey

RtlpNtMakeTemporaryKey

RtlpNtOpenKey

RtlpNtQueryValueKey

RtlpNtSetValueKey

RtlPrefixString

RtlPrefixUnicodeString

RtlPropertySetNameToGuid

RtlProtectHeap

RtlpUnWaitCriticalSection

RtlpWaitForCriticalSection

RtlQueryAtomInAtomTable

RtlQueryEnvironmentVariable_U

RtlQueryInformationAcl

RtlQueryProcessBackTraceInformation

RtlQueryProcessDebugInformation

RtlQueryProcessHeapInformation

RtlQueryProcessLockInformation

RtlQueryProperties

RtlQueryPropertyNames

RtlQueryPropertySet

RtlQueryRegistryValues

RtlQuerySecurityObject

RtlQueryTagHeap

RtlQueryTimeZoneInformation

RtlRaiseException

RtlRaiseStatus

RtlRandom

RtlReAllocateHeap

RtlRealPredecessor

RtlRealSuccessor

RtlReleasePebLock

RtlReleaseResource

RtlRemoteCall

RtlResetRtlTranslations

RtlRunDecodeUnicodeString

RtlRunEncodeUnicodeString

RtlSecondsSince1970ToTime

RtlSecondsSince1980ToTime

RtlSelfRelativeToAbsoluteSD

RtlSetAllBits

RtlSetAttributesSecurityDescriptor

RtlSetBits

RtlSetCriticalSectionSpinCount

RtlSetCurrentDirectory_U

RtlSetCurrentEnvironment

RtlSetDaclSecurityDescriptor

RtlSetEnvironmentVariable

RtlSetGroupSecurityDescriptor

RtlSetInformationAcl

RtlSetOwnerSecurityDescriptor

RtlSetProperties

RtlSetPropertyNames

RtlSetPropertySetClassId

RtlSetSaclSecurityDescriptor

RtlSetSecurityObject

RtlSetTimeZoneInformation

RtlSetUnicodeCallouts

RtlSetUserFlagsHeap

RtlSetUserValueHeap

RtlSizeHeap

RtlSplay

RtlStartRXact

RtlSubAuthorityCountSid

RtlSubAuthoritySid

RtlSubtreePredecessor

RtlSubtreeSuccessor

RtlSystemTimeToLocalTime

RtlTimeFieldsToTime

RtlTimeToElapsedTimeFields

RtlTimeToSecondsSince1970

RtlTimeToSecondsSince1980

RtlTimeToTimeFields

RtlTryEnterCriticalSection

RtlUnicodeStringToAnsiSize

RtlUnicodeStringToAnsiString

RtlUnicodeStringToCountedOemString

RtlUnicodeStringToInteger

RtlUnicodeStringToOemSize

RtlUnicodeStringToOemString

RtlUnicodeToCustomCPN

RtlUnicodeToMultiByteN

RtlUnicodeToMultiByteSize

RtlUnicodeToOemN

RtlUniform

RtlUnlockHeap

RtlUnwind

RtlUpcaseUnicodeChar

RtlUpcaseUnicodeString

RtlUpcaseUnicodeStringToAnsiString

RtlUpcaseUnicodeStringToCountedOemString

RtlUpcaseUnicodeStringToOemString

RtlUpcaseUnicodeToCustomCPN

RtlUpcaseUnicodeToMultiByteN

RtlUpcaseUnicodeToOemN

RtlUpperChar

RtlUpperString

RtlUsageHeap

RtlValidAcl

RtlValidateHeap

RtlValidateProcessHeaps

RtlValidSecurityDescriptor

RtlValidSid

RtlWalkHeap

RtlWriteRegistryValue

RtlxAnsiStringToUnicodeSize

RtlxOemStringToUnicodeSize

RtlxUnicodeStringToAnsiSize

RtlxUnicodeStringToOemSize

RtlZeroHeap

RtlZeroMemory


Windows Sockets

accept

bind

closesocket

connect

gethostbyaddr

gethostbyname

gethostname

getpeername

getprotobyname

getprotobynumber

getservbyname

getservbyport

getsockname

getsockopt

htonl

htons

inet_addr

inet_ntoa

ioctlsocket

listen

ntohl

ntohs

recv

recvfrom

select

send

sendto

setsockopt

shutdown

socket

WSAAccept

WSAAddressToStringA

WSAAddressToStringW

WSAAsyncGetHostByAddr

WSAAsyncGetHostByName

WSAAsyncGetProtoByName

WSAAsyncGetProtoByNumber

WSAAsyncGetServByName

WSAAsyncGetServByPort

WSAAsyncSelect

WSACancelAsyncRequest

WSACancelBlockingCall

WSACleanup

WSACloseEvent

WSAConnect

WSACreateEvent

WSADuplicateSocketA

WSADuplicateSocketW

WSAEnumNameSpaceProvidersA

WSAEnumNameSpaceProvidersW

WSAEnumNetworkEvents

WSAEnumProtocolsA

WSAEnumProtocolsW

WSAEventSelect

WSAGetLastError

WSAGetOverlappedResult

WSAGetQOSByName

WSAGetServiceClassInfoA

WSAGetServiceClassInfoW

WSAGetServiceClassNameByClassIdA

WSAGetServiceClassNameByClassIdW

WSAHtonl

WSAHtons

WSAInstallServiceClassA

WSAInstallServiceClassW

WSAIoctl

WSAIsBlocking

WSAJoinLeaf

WSALookupServiceBeginA

WSALookupServiceBeginW

WSALookupServiceEnd

WSALookupServiceNextA

WSALookupServiceNextW

WSANtohl

WSANtohs

WSAProviderConfigChange

WSARecv

WSARecvDisconnect

WSARecvFrom

WSARemoveServiceClass

WSAResetEvent

WSASend

WSASendDisconnect

WSASendTo

WSASetBlockingHook

WSASetEvent

WSASetLastError

WSASetServiceA

WSASetServiceW

WSASocketA

WSASocketW

WSAStartup

WSAStringToAddressA

WSAStringToAddressW

WSAUnhookBlockingHook

WSAWaitForMultipleEvents

WSCDeinstallProvider

WSCEnableNSProvider

WSCEnumProtocols

WSCGetProviderPath

WSCInstallNameSpace

WSCInstallProvider

WSCUnInstallNameSpace


NT Native API – Timers and System Time

NtCancelTimer

NtCreateTimer

NtGetTickCount

NtOpenTimer

NtQueryPerformanceCounter

NtQuerySystemTime

NtQueryTimer

NtQueryTimerResolution

NtSetSystemTime

NtSetTimer

NtSetTimerResolution


NT Native API – Synchronization

NtClearEvent

NtCreateEvent

NtCreateEventPair

NtCreateMutant

NtCreateSemaphore

NtOpenEvent

NtOpenEventPair

NtOpenMutant

NtOpenSemaphore

NtPulseEvent

NtQueryEvent

NtQueryMutant

NtQuerySemaphore

NtReleaseMutant

NtReleaseProcessMutant

NtReleaseSemaphore

NtReleaseThreadMutant

NtResetEvent

NtSetEvent

NtSetHighEventPair

NtSetHighWaitLowEventPair

NtSetLowEventPair

NtSetLowWaitHighEventPair

NtSignalAndWaitForSingleObject

NtWaitForMultipleObjects

NtWaitForSingleObject

NtWaitHighEventPair

NtWaitLowEventPair


NT Native API – Objects

NtClose

NtCreateDirectoryObject

NtCreateSymbolicLinkObject

NtDuplicateObject

NtMakeTemporaryObject

NtOpenDirectoryObject

NtOpenSymbolicLinkObject

NtQueryDirectoryObject

NtQueryObject

NtQuerySymbolicLinkObject

NtSetInformationObject


NT Native API - Error Handling

NtContinue

NtRaiseException

NtRaiseHardError

NtSetDefaultHardErrorPort


NT Native API – Channels

NtCreateChannel

NtListenChannel

NtOpenChannel

NtReplyWaitSendChannel

NtSendWaitReplyChannel

NtSetContextChannel


NT Native API – Registry

NtCreateKey

NtDeleteKey

NtDeleteValueKey

NtEnumerateKey

NtEnumerateValueKey

NtFlushKey

NtInitializeRegistry

NtLoadKey

NtLoadKey2

NtNotifyChangeKey

NtOpenKey

NtQueryKey

NtQueryMultipleValueKey

NtQueryMultiplValueKey

NtQueryValueKey

NtReplaceKey

NtRestoreKey

NtSaveKey

NtSetInformationKey

NtSetValueKey

NtUnloadKey


NT Native API – Special Files

NtCreateMailslotFile

NtCreateNamedPipeFile

NtCreatePagingFile


NT Native API – Debugging and Profiling

NtCreateProfile

NtQueryIntervalProfile

NtRegisterThreadTerminatePort

NtSetIntervalProfile

NtStartProfile

NtStopProfile

NtSystemDebugControl


NT Native API – Processor and Bus

NtEnumerateBus

NtFlushInstructionCache

NtFlushWriteBuffer

NtSetLdtEntries


NT Native API – Plug-and-Play

NtGetPlugPlayEvent

NtPlugPlayControl


NT Native API – Power

NtInitiatePowerAction

NtPowerInformation

NtRequestWakeupLatency

NtSetSystemPowerState

NtSetThreadExecutionState


NT Native API – Drivers

NtLoadDriver

NtRegisterNewDevice

NtUnloadDriver


NT Native API – Execution Environment

NtQueryDefaultLocale

NtQueryDefaultUILanguage

NtQuerySystemEnvironmentValue

NtSetDefaultLocale

NtSetDefaultUILanguage

NtSetSystemEnvironmentValue


Synchronization

Not Supported in this Version


Debugging

ContinueDebugEvent

DebugActiveProcess

DebugBreak

FatalExit

FlushInstructionCache

GetThreadContext

GetThreadSelectorEntry

IsDebuggerPresent

OutputDebugStringA

OutputDebugStringW

ReadProcessMemory

SetDebugErrorLevel

SetThreadContext

WaitForDebugEvent

WriteProcessMemory


Handles and Objects

CloseHandle

DuplicateHandle

GetHandleInformation

SetHandleInformation


Windows

AdjustWindowRect

AdjustWindowRectEx

AllowSetForegroundWindow

AnimateWindow

AnyPopup

ArrangeIconicWindows

BeginDeferWindowPos

BringWindowToTop

CascadeWindows

ChildWindowFromPoint

ChildWindowFromPointEx

CloseWindow

CreateWindowExA

CreateWindowExW

DeferWindowPos

DestroyWindow

EndDeferWindowPos

EnumChildWindows

EnumThreadWindows

EnumWindows

FindWindowA

FindWindowExA

FindWindowExW

FindWindowW

GetAltTabInfoA

GetAltTabInfoW

GetAncestor

GetClientRect

GetDesktopWindow

GetForegroundWindow

GetGUIThreadInfo

GetLastActivePopup

GetLayout

GetParent

GetProcessDefaultLayout

GetTitleBarInfo

GetTopWindow

GetWindow

GetWindowInfo

GetWindowModuleFileNameA

GetWindowModuleFileNameW

GetWindowPlacement

GetWindowRect

GetWindowTextA

GetWindowTextLengthA

GetWindowTextLengthW

GetWindowTextW

GetWindowThreadProcessId

IsChild

IsIconic

IsWindow

IsWindowUnicode

IsWindowVisible

IsZoomed

LockSetForegroundWindow

MoveWindow

OpenIcon

RealChildWindowFromPoint

RealGetWindowClassA

RealGetWindowClassW

SetForegroundWindow

SetLayeredWindowAttributes

SetLayout

SetParent

SetProcessDefaultLayout

SetWindowPlacement

SetWindowPos

SetWindowTextA

SetWindowTextW

ShowOwnedPopups

ShowWindow

ShowWindowAsync

TileWindows

UpdateLayeredWindow

WindowFromPoint


Dialog Boxes

CreateDialogIndirectParamA

CreateDialogIndirectParamW

CreateDialogParamA

CreateDialogParamW

DefDlgProcA

DefDlgProcW

DialogBoxIndirectParamA

DialogBoxIndirectParamW

DialogBoxParamA

DialogBoxParamW

EndDialog

GetDialogBaseUnits

GetDlgCtrlID

GetDlgItem

GetDlgItemInt

GetDlgItemTextA

GetDlgItemTextW

GetNextDlgGroupItem

GetNextDlgTabItem

IsDialogMessageA

IsDialogMessageW

MapDialogRect

MessageBoxA

MessageBoxExA

MessageBoxExW

MessageBoxIndirectA

MessageBoxIndirectW

MessageBoxW

SendDlgItemMessageA

SendDlgItemMessageW

SetDlgItemInt

SetDlgItemTextA

SetDlgItemTextW


Memory Manangement

GetWriteWatch

GlobalMemoryStatus

GlobalMemoryStatusEx

IsBadCodePtr

IsBadReadPtr

IsBadStringPtrA

IsBadStringPtrW

IsBadWritePtr

ResetWriteWatch

AllocateUserPhysicalPages

FreeUserPhysicalPages

MapUserPhysicalPages

MapUserPhysicalPagesScatter

GlobalAlloc

GlobalFlags

GlobalFree

GlobalHandle

GlobalLock

GlobalReAlloc

GlobalSize

GlobalUnlock

LocalAlloc

LocalFlags

LocalFree

LocalHandle

LocalLock

LocalReAlloc

LocalSize

LocalUnlock

GetProcessHeap

GetProcessHeaps

HeapAlloc

HeapCompact

HeapCreate

HeapDestroy

HeapFree

HeapLock

HeapReAlloc

HeapSize

HeapUnlock

HeapValidate

HeapWalk

VirtualAlloc

VirtualAllocEx

VirtualFree

VirtualFreeEx

VirtualLock

VirtualProtect

VirtualProtectEx

VirtualQuery

VirtualQueryEx

VirtualUnlock

GetFreeSpace

GlobalCompact

GlobalFix

GlobalUnfix

GlobalUnWire

GlobalWire

IsBadHugeReadPtr

IsBadHugeWritePtr

LocalCompact

LocalShrink


Window Classes

GetClassInfoA

GetClassInfoW

GetClassInfoExA

GetClassInfoExW

GetClassLongA

GetClassLongW

GetClassLongPtrA

GetClassLongPtrW

RegisterClassA

RegisterClassW

RegisterClassExA

RegisterClassExW

SetClassLongA

SetClassLongW

SetClassLongPtrA

SetClassLongPtrW

SetWindowLongA

SetWindowLongW

SetWindowLongPtrA

SetWindowLongPtrW

UnregisterClassA

UnregisterClassW

GetClassWord

GetWindowWord

SetClassWord

SetWindowWord