Process Hacker
ntzwapi.h
Go to the documentation of this file.
1 #ifndef _NTZWAPI_H
2 #define _NTZWAPI_H
3 
4 // This file was automatically generated. Do not edit.
5 
6 NTSYSCALLAPI
7 NTSTATUS
8 NTAPI
9 ZwAcceptConnectPort(
10  _Out_ PHANDLE PortHandle,
11  _In_opt_ PVOID PortContext,
12  _In_ PPORT_MESSAGE ConnectionRequest,
13  _In_ BOOLEAN AcceptConnection,
14  _Inout_opt_ PPORT_VIEW ServerView,
15  _Out_opt_ PREMOTE_PORT_VIEW ClientView
16  );
17 
18 NTSYSCALLAPI
19 NTSTATUS
20 NTAPI
21 ZwAccessCheck(
22  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
23  _In_ HANDLE ClientToken,
24  _In_ ACCESS_MASK DesiredAccess,
25  _In_ PGENERIC_MAPPING GenericMapping,
26  _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
27  _Inout_ PULONG PrivilegeSetLength,
28  _Out_ PACCESS_MASK GrantedAccess,
29  _Out_ PNTSTATUS AccessStatus
30  );
31 
32 NTSYSCALLAPI
33 NTSTATUS
34 NTAPI
35 ZwAccessCheckAndAuditAlarm(
36  _In_ PUNICODE_STRING SubsystemName,
37  _In_opt_ PVOID HandleId,
38  _In_ PUNICODE_STRING ObjectTypeName,
39  _In_ PUNICODE_STRING ObjectName,
40  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
41  _In_ ACCESS_MASK DesiredAccess,
42  _In_ PGENERIC_MAPPING GenericMapping,
43  _In_ BOOLEAN ObjectCreation,
44  _Out_ PACCESS_MASK GrantedAccess,
45  _Out_ PNTSTATUS AccessStatus,
46  _Out_ PBOOLEAN GenerateOnClose
47  );
48 
49 NTSYSCALLAPI
50 NTSTATUS
51 NTAPI
52 ZwAccessCheckByType(
53  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
54  _In_opt_ PSID PrincipalSelfSid,
55  _In_ HANDLE ClientToken,
56  _In_ ACCESS_MASK DesiredAccess,
57  _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
58  _In_ ULONG ObjectTypeListLength,
59  _In_ PGENERIC_MAPPING GenericMapping,
60  _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
61  _Inout_ PULONG PrivilegeSetLength,
62  _Out_ PACCESS_MASK GrantedAccess,
63  _Out_ PNTSTATUS AccessStatus
64  );
65 
66 NTSYSCALLAPI
67 NTSTATUS
68 NTAPI
69 ZwAccessCheckByTypeAndAuditAlarm(
70  _In_ PUNICODE_STRING SubsystemName,
71  _In_opt_ PVOID HandleId,
72  _In_ PUNICODE_STRING ObjectTypeName,
73  _In_ PUNICODE_STRING ObjectName,
74  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
75  _In_opt_ PSID PrincipalSelfSid,
76  _In_ ACCESS_MASK DesiredAccess,
77  _In_ AUDIT_EVENT_TYPE AuditType,
78  _In_ ULONG Flags,
79  _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
80  _In_ ULONG ObjectTypeListLength,
81  _In_ PGENERIC_MAPPING GenericMapping,
82  _In_ BOOLEAN ObjectCreation,
83  _Out_ PACCESS_MASK GrantedAccess,
84  _Out_ PNTSTATUS AccessStatus,
85  _Out_ PBOOLEAN GenerateOnClose
86  );
87 
88 NTSYSCALLAPI
89 NTSTATUS
90 NTAPI
91 ZwAccessCheckByTypeResultList(
92  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
93  _In_opt_ PSID PrincipalSelfSid,
94  _In_ HANDLE ClientToken,
95  _In_ ACCESS_MASK DesiredAccess,
96  _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
97  _In_ ULONG ObjectTypeListLength,
98  _In_ PGENERIC_MAPPING GenericMapping,
99  _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
100  _Inout_ PULONG PrivilegeSetLength,
101  _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
102  _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus
103  );
104 
105 NTSYSCALLAPI
106 NTSTATUS
107 NTAPI
108 ZwAccessCheckByTypeResultListAndAuditAlarm(
109  _In_ PUNICODE_STRING SubsystemName,
110  _In_opt_ PVOID HandleId,
111  _In_ PUNICODE_STRING ObjectTypeName,
112  _In_ PUNICODE_STRING ObjectName,
113  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
114  _In_opt_ PSID PrincipalSelfSid,
115  _In_ ACCESS_MASK DesiredAccess,
116  _In_ AUDIT_EVENT_TYPE AuditType,
117  _In_ ULONG Flags,
118  _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
119  _In_ ULONG ObjectTypeListLength,
120  _In_ PGENERIC_MAPPING GenericMapping,
121  _In_ BOOLEAN ObjectCreation,
122  _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
123  _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
124  _Out_ PBOOLEAN GenerateOnClose
125  );
126 
127 NTSYSCALLAPI
128 NTSTATUS
129 NTAPI
130 ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(
131  _In_ PUNICODE_STRING SubsystemName,
132  _In_opt_ PVOID HandleId,
133  _In_ HANDLE ClientToken,
134  _In_ PUNICODE_STRING ObjectTypeName,
135  _In_ PUNICODE_STRING ObjectName,
136  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
137  _In_opt_ PSID PrincipalSelfSid,
138  _In_ ACCESS_MASK DesiredAccess,
139  _In_ AUDIT_EVENT_TYPE AuditType,
140  _In_ ULONG Flags,
141  _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
142  _In_ ULONG ObjectTypeListLength,
143  _In_ PGENERIC_MAPPING GenericMapping,
144  _In_ BOOLEAN ObjectCreation,
145  _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
146  _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
147  _Out_ PBOOLEAN GenerateOnClose
148  );
149 
150 NTSYSCALLAPI
151 NTSTATUS
152 NTAPI
153 ZwAcquireCMFViewOwnership(
154  _Out_ PULONGLONG TimeStamp,
155  _Out_ PBOOLEAN tokenTaken,
156  _In_ BOOLEAN replaceExisting
157  );
158 
159 NTSYSCALLAPI
160 NTSTATUS
161 NTAPI
162 ZwAddAtom(
163  _In_reads_bytes_opt_(Length) PWSTR AtomName,
164  _In_ ULONG Length,
165  _Out_opt_ PRTL_ATOM Atom
166  );
167 
168 NTSYSCALLAPI
169 NTSTATUS
170 NTAPI
171 ZwAddBootEntry(
172  _In_ PBOOT_ENTRY BootEntry,
173  _Out_opt_ PULONG Id
174  );
175 
176 NTSYSCALLAPI
177 NTSTATUS
178 NTAPI
179 ZwAddDriverEntry(
180  _In_ PEFI_DRIVER_ENTRY DriverEntry,
181  _Out_opt_ PULONG Id
182  );
183 
184 NTSYSCALLAPI
185 NTSTATUS
186 NTAPI
187 ZwAdjustGroupsToken(
188  _In_ HANDLE TokenHandle,
189  _In_ BOOLEAN ResetToDefault,
190  _In_opt_ PTOKEN_GROUPS NewState,
191  _In_opt_ ULONG BufferLength,
192  _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
193  _Out_ PULONG ReturnLength
194  );
195 
196 NTSYSCALLAPI
197 NTSTATUS
198 NTAPI
199 ZwAdjustPrivilegesToken(
200  _In_ HANDLE TokenHandle,
201  _In_ BOOLEAN DisableAllPrivileges,
202  _In_opt_ PTOKEN_PRIVILEGES NewState,
203  _In_ ULONG BufferLength,
204  _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
205  _Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
206  );
207 
208 NTSYSCALLAPI
209 NTSTATUS
210 NTAPI
211 ZwAdjustTokenClaimsAndDeviceGroups(
212  _In_ HANDLE TokenHandle,
213  _In_ BOOLEAN UserResetToDefault,
214  _In_ BOOLEAN DeviceResetToDefault,
215  _In_ BOOLEAN DeviceGroupsResetToDefault,
216  _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewUserState,
217  _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewDeviceState,
218  _In_opt_ PTOKEN_GROUPS NewDeviceGroupsState,
219  _In_ ULONG UserBufferLength,
220  _Out_writes_bytes_to_opt_(UserBufferLength, *UserReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousUserState,
221  _In_ ULONG DeviceBufferLength,
222  _Out_writes_bytes_to_opt_(DeviceBufferLength, *DeviceReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousDeviceState,
223  _In_ ULONG DeviceGroupsBufferLength,
224  _Out_writes_bytes_to_opt_(DeviceGroupsBufferLength, *DeviceGroupsReturnBufferLength) PTOKEN_GROUPS PreviousDeviceGroups,
225  _Out_opt_ PULONG UserReturnLength,
226  _Out_opt_ PULONG DeviceReturnLength,
227  _Out_opt_ PULONG DeviceGroupsReturnBufferLength
228  );
229 
230 NTSYSCALLAPI
231 NTSTATUS
232 NTAPI
233 ZwAlertResumeThread(
234  _In_ HANDLE ThreadHandle,
235  _Out_opt_ PULONG PreviousSuspendCount
236  );
237 
238 NTSYSCALLAPI
239 NTSTATUS
240 NTAPI
241 ZwAlertThread(
242  _In_ HANDLE ThreadHandle
243  );
244 
245 NTSYSCALLAPI
246 NTSTATUS
247 NTAPI
248 ZwAllocateLocallyUniqueId(
249  _Out_ PLUID Luid
250  );
251 
252 NTSYSCALLAPI
253 NTSTATUS
254 NTAPI
255 ZwAllocateReserveObject(
256  _Out_ PHANDLE MemoryReserveHandle,
257  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
258  _In_ MEMORY_RESERVE_TYPE Type
259  );
260 
261 NTSYSCALLAPI
262 NTSTATUS
263 NTAPI
264 ZwAllocateUserPhysicalPages(
265  _In_ HANDLE ProcessHandle,
266  _Inout_ PULONG_PTR NumberOfPages,
267  _Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray
268  );
269 
270 NTSYSCALLAPI
271 NTSTATUS
272 NTAPI
273 ZwAllocateUuids(
274  _Out_ PULARGE_INTEGER Time,
275  _Out_ PULONG Range,
276  _Out_ PULONG Sequence,
277  _Out_ PCHAR Seed
278  );
279 
280 NTSYSCALLAPI
281 NTSTATUS
282 NTAPI
283 ZwAllocateVirtualMemory(
284  _In_ HANDLE ProcessHandle,
285  _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
286  _In_ ULONG_PTR ZeroBits,
287  _Inout_ PSIZE_T RegionSize,
288  _In_ ULONG AllocationType,
289  _In_ ULONG Protect
290  );
291 
292 NTSYSCALLAPI
293 NTSTATUS
294 NTAPI
295 ZwAlpcAcceptConnectPort(
296  _Out_ PHANDLE PortHandle,
297  _In_ HANDLE ConnectionPortHandle,
298  _In_ ULONG Flags,
299  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
300  _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
301  _In_opt_ PVOID PortContext,
302  _In_reads_bytes_(ConnectionRequest->u1.s1.TotalLength) PPORT_MESSAGE ConnectionRequest,
303  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
304  _In_ BOOLEAN AcceptConnection
305  );
306 
307 NTSYSCALLAPI
308 NTSTATUS
309 NTAPI
310 ZwAlpcCancelMessage(
311  _In_ HANDLE PortHandle,
312  _In_ ULONG Flags,
313  _In_ PALPC_CONTEXT_ATTR MessageContext
314  );
315 
316 NTSYSCALLAPI
317 NTSTATUS
318 NTAPI
319 ZwAlpcConnectPort(
320  _Out_ PHANDLE PortHandle,
321  _In_ PUNICODE_STRING PortName,
322  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
323  _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
324  _In_ ULONG Flags,
325  _In_opt_ PSID RequiredServerSid,
326  _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
327  _Inout_opt_ PULONG BufferLength,
328  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
329  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
330  _In_opt_ PLARGE_INTEGER Timeout
331  );
332 
333 NTSYSCALLAPI
334 NTSTATUS
335 NTAPI
336 ZwAlpcConnectPortEx(
337  _Out_ PHANDLE PortHandle,
338  _In_ POBJECT_ATTRIBUTES ConnectionPortObjectAttributes,
339  _In_opt_ POBJECT_ATTRIBUTES ClientPortObjectAttributes,
340  _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
341  _In_ ULONG Flags,
342  _In_opt_ PSECURITY_DESCRIPTOR ServerSecurityRequirements,
343  _Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
344  _Inout_opt_ PSIZE_T BufferLength,
345  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
346  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
347  _In_opt_ PLARGE_INTEGER Timeout
348  );
349 
350 NTSYSCALLAPI
351 NTSTATUS
352 NTAPI
353 ZwAlpcCreatePort(
354  _Out_ PHANDLE PortHandle,
355  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
356  _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes
357  );
358 
359 NTSYSCALLAPI
360 NTSTATUS
361 NTAPI
362 ZwAlpcCreatePortSection(
363  _In_ HANDLE PortHandle,
364  _In_ ULONG Flags,
365  _In_opt_ HANDLE SectionHandle,
366  _In_ SIZE_T SectionSize,
367  _Out_ PALPC_HANDLE AlpcSectionHandle,
368  _Out_ PSIZE_T ActualSectionSize
369  );
370 
371 NTSYSCALLAPI
372 NTSTATUS
373 NTAPI
374 ZwAlpcCreateResourceReserve(
375  _In_ HANDLE PortHandle,
376  _Reserved_ ULONG Flags,
377  _In_ SIZE_T MessageSize,
378  _Out_ PALPC_HANDLE ResourceId
379  );
380 
381 NTSYSCALLAPI
382 NTSTATUS
383 NTAPI
384 ZwAlpcCreateSectionView(
385  _In_ HANDLE PortHandle,
386  _Reserved_ ULONG Flags,
387  _Inout_ PALPC_DATA_VIEW_ATTR ViewAttributes
388  );
389 
390 NTSYSCALLAPI
391 NTSTATUS
392 NTAPI
393 ZwAlpcCreateSecurityContext(
394  _In_ HANDLE PortHandle,
395  _Reserved_ ULONG Flags,
396  _Inout_ PALPC_SECURITY_ATTR SecurityAttribute
397  );
398 
399 NTSYSCALLAPI
400 NTSTATUS
401 NTAPI
402 ZwAlpcDeletePortSection(
403  _In_ HANDLE PortHandle,
404  _Reserved_ ULONG Flags,
405  _In_ ALPC_HANDLE SectionHandle
406  );
407 
408 NTSYSCALLAPI
409 NTSTATUS
410 NTAPI
411 ZwAlpcDeleteResourceReserve(
412  _In_ HANDLE PortHandle,
413  _Reserved_ ULONG Flags,
414  _In_ ALPC_HANDLE ResourceId
415  );
416 
417 NTSYSCALLAPI
418 NTSTATUS
419 NTAPI
420 ZwAlpcDeleteSectionView(
421  _In_ HANDLE PortHandle,
422  _Reserved_ ULONG Flags,
423  _In_ PVOID ViewBase
424  );
425 
426 NTSYSCALLAPI
427 NTSTATUS
428 NTAPI
429 ZwAlpcDeleteSecurityContext(
430  _In_ HANDLE PortHandle,
431  _Reserved_ ULONG Flags,
432  _In_ ALPC_HANDLE ContextHandle
433  );
434 
435 NTSYSCALLAPI
436 NTSTATUS
437 NTAPI
438 ZwAlpcDisconnectPort(
439  _In_ HANDLE PortHandle,
440  _In_ ULONG Flags
441  );
442 
443 NTSYSCALLAPI
444 NTSTATUS
445 NTAPI
446 ZwAlpcImpersonateClientContainerOfPort(
447  _In_ HANDLE PortHandle,
448  _In_ PPORT_MESSAGE Message,
449  _In_ ULONG Flags
450  );
451 
452 NTSYSCALLAPI
453 NTSTATUS
454 NTAPI
455 ZwAlpcImpersonateClientOfPort(
456  _In_ HANDLE PortHandle,
457  _In_ PPORT_MESSAGE Message,
458  _In_ PVOID Flags
459  );
460 
461 NTSYSCALLAPI
462 NTSTATUS
463 NTAPI
464 ZwAlpcOpenSenderProcess(
465  _Out_ PHANDLE ProcessHandle,
466  _In_ HANDLE PortHandle,
467  _In_ PPORT_MESSAGE PortMessage,
468  _In_ ULONG Flags,
469  _In_ ACCESS_MASK DesiredAccess,
470  _In_ POBJECT_ATTRIBUTES ObjectAttributes
471  );
472 
473 NTSYSCALLAPI
474 NTSTATUS
475 NTAPI
476 ZwAlpcOpenSenderThread(
477  _Out_ PHANDLE ThreadHandle,
478  _In_ HANDLE PortHandle,
479  _In_ PPORT_MESSAGE PortMessage,
480  _In_ ULONG Flags,
481  _In_ ACCESS_MASK DesiredAccess,
482  _In_ POBJECT_ATTRIBUTES ObjectAttributes
483  );
484 
485 NTSYSCALLAPI
486 NTSTATUS
487 NTAPI
488 ZwAlpcQueryInformation(
489  _In_opt_ HANDLE PortHandle,
490  _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,
491  _Inout_updates_bytes_to_(Length, *ReturnLength) PVOID PortInformation,
492  _In_ ULONG Length,
493  _Out_opt_ PULONG ReturnLength
494  );
495 
496 NTSYSCALLAPI
497 NTSTATUS
498 NTAPI
499 ZwAlpcQueryInformationMessage(
500  _In_ HANDLE PortHandle,
501  _In_ PPORT_MESSAGE PortMessage,
502  _In_ ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass,
503  _Out_writes_bytes_to_opt_(Length, *ReturnLength) PVOID MessageInformation,
504  _In_ ULONG Length,
505  _Out_opt_ PULONG ReturnLength
506  );
507 
508 NTSYSCALLAPI
509 NTSTATUS
510 NTAPI
511 ZwAlpcRevokeSecurityContext(
512  _In_ HANDLE PortHandle,
513  _Reserved_ ULONG Flags,
514  _In_ ALPC_HANDLE ContextHandle
515  );
516 
517 NTSYSCALLAPI
518 NTSTATUS
519 NTAPI
520 ZwAlpcSendWaitReceivePort(
521  _In_ HANDLE PortHandle,
522  _In_ ULONG Flags,
523  _In_reads_bytes_opt_(SendMessage->u1.s1.TotalLength) PPORT_MESSAGE SendMessage,
524  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
525  _Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ReceiveMessage,
526  _Inout_opt_ PSIZE_T BufferLength,
527  _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
528  _In_opt_ PLARGE_INTEGER Timeout
529  );
530 
531 NTSYSCALLAPI
532 NTSTATUS
533 NTAPI
534 ZwAlpcSetInformation(
535  _In_ HANDLE PortHandle,
536  _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,
537  _In_reads_bytes_opt_(Length) PVOID PortInformation,
538  _In_ ULONG Length
539  );
540 
541 NTSYSCALLAPI
542 NTSTATUS
543 NTAPI
544 ZwAreMappedFilesTheSame(
545  _In_ PVOID File1MappedAsAnImage,
546  _In_ PVOID File2MappedAsFile
547  );
548 
549 NTSYSCALLAPI
550 NTSTATUS
551 NTAPI
552 ZwAssignProcessToJobObject(
553  _In_ HANDLE JobHandle,
554  _In_ HANDLE ProcessHandle
555  );
556 
557 NTSYSCALLAPI
558 NTSTATUS
559 NTAPI
560 ZwAssignProcessToSiloObject(
561  _In_ HANDLE SiloHandle,
562  _In_ HANDLE ProcessHandle
563  );
564 
565 NTSYSCALLAPI
566 NTSTATUS
567 NTAPI
568 ZwAssociateWaitCompletionPacket(
569  _In_ HANDLE WaitCompletionPacketHandle,
570  _In_ HANDLE IoCompletionHandle,
571  _In_ HANDLE TargetObjectHandle,
572  _In_opt_ PVOID KeyContext,
573  _In_opt_ PVOID ApcContext,
574  _In_ NTSTATUS IoStatus,
575  _In_ ULONG_PTR IoStatusInformation,
576  _Out_opt_ PBOOLEAN AlreadySignaled
577  );
578 
579 NTSYSCALLAPI
580 NTSTATUS
581 NTAPI
582 ZwAttachThreadIdSiloToCurrentThread(
583  _In_ HANDLE ThreadId,
584  _Out_ PHANDLE PreviousSiloHandle,
585  _Out_opt_ PBOOLEAN bChangedSilo
586  );
587 
588 NTSYSCALLAPI
589 NTSTATUS
590 NTAPI
591 ZwAttachThreadSiloToCurrentThread(
592  _In_ HANDLE ThreadHandle,
593  _Out_ PHANDLE PreviousSiloHandle,
594  _Out_opt_ PBOOLEAN bChangedSilo
595  );
596 
597 NTSYSCALLAPI
598 NTSTATUS
599 NTAPI
600 ZwCallbackReturn(
601  _In_reads_bytes_opt_(OutputLength) PVOID OutputBuffer,
602  _In_ ULONG OutputLength,
603  _In_ NTSTATUS Status
604  );
605 
606 NTSYSCALLAPI
607 NTSTATUS
608 NTAPI
609 ZwCancelIoFile(
610  _In_ HANDLE FileHandle,
611  _Out_ PIO_STATUS_BLOCK IoStatusBlock
612  );
613 
614 NTSYSCALLAPI
615 NTSTATUS
616 NTAPI
617 ZwCancelIoFileEx(
618  _In_ HANDLE FileHandle,
619  _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
620  _Out_ PIO_STATUS_BLOCK IoStatusBlock
621  );
622 
623 NTSYSCALLAPI
624 NTSTATUS
625 NTAPI
626 ZwCancelSynchronousIoFile(
627  _In_ HANDLE ThreadHandle,
628  _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
629  _Out_ PIO_STATUS_BLOCK IoStatusBlock
630  );
631 
632 NTSYSCALLAPI
633 NTSTATUS
634 NTAPI
635 ZwCancelTimer(
636  _In_ HANDLE TimerHandle,
637  _Out_opt_ PBOOLEAN CurrentState
638  );
639 
640 NTSYSCALLAPI
641 NTSTATUS
642 NTAPI
643 ZwCancelTimer2(
644  _In_ HANDLE TimerHandle,
645  _In_ PT2_CANCEL_PARAMETERS Parameters
646  );
647 
648 NTSYSCALLAPI
649 NTSTATUS
650 NTAPI
651 ZwCancelWaitCompletionPacket(
652  _In_ HANDLE WaitCompletionPacketHandle,
653  _In_ BOOLEAN RemoveSignaledPacket
654  );
655 
656 NTSYSCALLAPI
657 NTSTATUS
658 NTAPI
659 ZwClearEvent(
660  _In_ HANDLE EventHandle
661  );
662 
663 NTSYSCALLAPI
664 NTSTATUS
665 NTAPI
666 ZwClose(
667  _In_ HANDLE Handle
668  );
669 
670 NTSYSCALLAPI
671 NTSTATUS
672 NTAPI
673 ZwCloseObjectAuditAlarm(
674  _In_ PUNICODE_STRING SubsystemName,
675  _In_opt_ PVOID HandleId,
676  _In_ BOOLEAN GenerateOnClose
677  );
678 
679 NTSYSCALLAPI
680 NTSTATUS
681 NTAPI
682 ZwCommitComplete(
683  _In_ HANDLE EnlistmentHandle,
684  _In_opt_ PLARGE_INTEGER TmVirtualClock
685  );
686 
687 NTSYSCALLAPI
688 NTSTATUS
689 NTAPI
690 ZwCommitEnlistment(
691  _In_ HANDLE EnlistmentHandle,
692  _In_opt_ PLARGE_INTEGER TmVirtualClock
693  );
694 
695 NTSYSCALLAPI
696 NTSTATUS
697 NTAPI
698 ZwCommitTransaction(
699  _In_ HANDLE TransactionHandle,
700  _In_ BOOLEAN Wait
701  );
702 
703 NTSYSCALLAPI
704 NTSTATUS
705 NTAPI
706 ZwCompactKeys(
707  _In_ ULONG Count,
708  _In_reads_(Count) HANDLE KeyArray[]
709  );
710 
711 NTSYSCALLAPI
712 NTSTATUS
713 NTAPI
714 ZwCompareObjects(
715  _In_ HANDLE FirstObjectHandle,
716  _In_ HANDLE SecondObjectHandle
717  );
718 
719 NTSYSCALLAPI
720 NTSTATUS
721 NTAPI
722 ZwCompareTokens(
723  _In_ HANDLE FirstTokenHandle,
724  _In_ HANDLE SecondTokenHandle,
725  _Out_ PBOOLEAN Equal
726  );
727 
728 NTSYSCALLAPI
729 NTSTATUS
730 NTAPI
731 ZwCompleteConnectPort(
732  _In_ HANDLE PortHandle
733  );
734 
735 NTSYSCALLAPI
736 NTSTATUS
737 NTAPI
738 ZwCompressKey(
739  _In_ HANDLE Key
740  );
741 
742 NTSYSCALLAPI
743 NTSTATUS
744 NTAPI
745 ZwConnectPort(
746  _Out_ PHANDLE PortHandle,
747  _In_ PUNICODE_STRING PortName,
748  _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
749  _Inout_opt_ PPORT_VIEW ClientView,
750  _Inout_opt_ PREMOTE_PORT_VIEW ServerView,
751  _Out_opt_ PULONG MaxMessageLength,
752  _Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,
753  _Inout_opt_ PULONG ConnectionInformationLength
754  );
755 
756 NTSYSCALLAPI
757 NTSTATUS
758 NTAPI
759 ZwContinue(
760  _In_ PCONTEXT ContextRecord,
761  _In_ BOOLEAN TestAlert
762  );
763 
764 NTSYSCALLAPI
765 NTSTATUS
766 NTAPI
767 ZwCreateDebugObject(
768  _Out_ PHANDLE DebugObjectHandle,
769  _In_ ACCESS_MASK DesiredAccess,
770  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
771  _In_ ULONG Flags
772  );
773 
774 NTSYSCALLAPI
775 NTSTATUS
776 NTAPI
777 ZwCreateDirectoryObject(
778  _Out_ PHANDLE DirectoryHandle,
779  _In_ ACCESS_MASK DesiredAccess,
780  _In_ POBJECT_ATTRIBUTES ObjectAttributes
781  );
782 
783 NTSYSCALLAPI
784 NTSTATUS
785 NTAPI
786 ZwCreateDirectoryObjectEx(
787  _Out_ PHANDLE DirectoryHandle,
788  _In_ ACCESS_MASK DesiredAccess,
789  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
790  _In_ HANDLE ShadowDirectoryHandle,
791  _In_ ULONG Flags
792  );
793 
794 NTSYSCALLAPI
795 NTSTATUS
796 NTAPI
797 ZwCreateEnlistment(
798  _Out_ PHANDLE EnlistmentHandle,
799  _In_ ACCESS_MASK DesiredAccess,
800  _In_ HANDLE ResourceManagerHandle,
801  _In_ HANDLE TransactionHandle,
802  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
803  _In_opt_ ULONG CreateOptions,
804  _In_ NOTIFICATION_MASK NotificationMask,
805  _In_opt_ PVOID EnlistmentKey
806  );
807 
808 NTSYSCALLAPI
809 NTSTATUS
810 NTAPI
811 ZwCreateEvent(
812  _Out_ PHANDLE EventHandle,
813  _In_ ACCESS_MASK DesiredAccess,
814  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
815  _In_ EVENT_TYPE EventType,
816  _In_ BOOLEAN InitialState
817  );
818 
819 NTSYSCALLAPI
820 NTSTATUS
821 NTAPI
822 ZwCreateEventPair(
823  _Out_ PHANDLE EventPairHandle,
824  _In_ ACCESS_MASK DesiredAccess,
825  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
826  );
827 
828 NTSYSCALLAPI
829 NTSTATUS
830 NTAPI
831 ZwCreateFile(
832  _Out_ PHANDLE FileHandle,
833  _In_ ACCESS_MASK DesiredAccess,
834  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
835  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
836  _In_opt_ PLARGE_INTEGER AllocationSize,
837  _In_ ULONG FileAttributes,
838  _In_ ULONG ShareAccess,
839  _In_ ULONG CreateDisposition,
840  _In_ ULONG CreateOptions,
841  _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
842  _In_ ULONG EaLength
843  );
844 
845 NTSYSCALLAPI
846 NTSTATUS
847 NTAPI
848 ZwCreateIRTimer(
849  _Out_ PHANDLE TimerHandle,
850  _In_ ACCESS_MASK DesiredAccess
851  );
852 
853 NTSYSCALLAPI
854 NTSTATUS
855 NTAPI
856 ZwCreateIoCompletion(
857  _Out_ PHANDLE IoCompletionHandle,
858  _In_ ACCESS_MASK DesiredAccess,
859  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
860  _In_opt_ ULONG Count
861  );
862 
863 NTSYSCALLAPI
864 NTSTATUS
865 NTAPI
866 ZwCreateJobObject(
867  _Out_ PHANDLE JobHandle,
868  _In_ ACCESS_MASK DesiredAccess,
869  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
870  );
871 
872 NTSYSCALLAPI
873 NTSTATUS
874 NTAPI
875 ZwCreateJobSet(
876  _In_ ULONG NumJob,
877  _In_reads_(NumJob) PJOB_SET_ARRAY UserJobSet,
878  _In_ ULONG Flags
879  );
880 
881 NTSYSCALLAPI
882 NTSTATUS
883 NTAPI
884 ZwCreateKey(
885  _Out_ PHANDLE KeyHandle,
886  _In_ ACCESS_MASK DesiredAccess,
887  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
888  _Reserved_ ULONG TitleIndex,
889  _In_opt_ PUNICODE_STRING Class,
890  _In_ ULONG CreateOptions,
891  _Out_opt_ PULONG Disposition
892  );
893 
894 NTSYSCALLAPI
895 NTSTATUS
896 NTAPI
897 ZwCreateKeyTransacted(
898  _Out_ PHANDLE KeyHandle,
899  _In_ ACCESS_MASK DesiredAccess,
900  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
901  _Reserved_ ULONG TitleIndex,
902  _In_opt_ PUNICODE_STRING Class,
903  _In_ ULONG CreateOptions,
904  _In_ HANDLE TransactionHandle,
905  _Out_opt_ PULONG Disposition
906  );
907 
908 NTSYSCALLAPI
909 NTSTATUS
910 NTAPI
911 ZwCreateKeyedEvent(
912  _Out_ PHANDLE KeyedEventHandle,
913  _In_ ACCESS_MASK DesiredAccess,
914  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
915  _In_ ULONG Flags
916  );
917 
918 NTSYSCALLAPI
919 NTSTATUS
920 NTAPI
921 ZwCreateLowBoxToken(
922  _Out_ PHANDLE TokenHandle,
923  _In_ HANDLE ExistingTokenHandle,
924  _In_ ACCESS_MASK DesiredAccess,
925  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
926  _In_ PSID PackageSid,
927  _In_ ULONG CapabilityCount,
928  _In_reads_opt_(CapabilityCount) PSID_AND_ATTRIBUTES Capabilities,
929  _In_ ULONG HandleCount,
930  _In_reads_opt_(HandleCount) HANDLE *Handles
931  );
932 
933 NTSYSCALLAPI
934 NTSTATUS
935 NTAPI
936 ZwCreateMailslotFile(
937  _Out_ PHANDLE FileHandle,
938  _In_ ULONG DesiredAccess,
939  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
940  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
941  _In_ ULONG CreateOptions,
942  _In_ ULONG MailslotQuota,
943  _In_ ULONG MaximumMessageSize,
944  _In_ PLARGE_INTEGER ReadTimeout
945  );
946 
947 NTSYSCALLAPI
948 NTSTATUS
949 NTAPI
950 ZwCreateMutant(
951  _Out_ PHANDLE MutantHandle,
952  _In_ ACCESS_MASK DesiredAccess,
953  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
954  _In_ BOOLEAN InitialOwner
955  );
956 
957 NTSYSCALLAPI
958 NTSTATUS
959 NTAPI
960 ZwCreateNamedPipeFile(
961  _Out_ PHANDLE FileHandle,
962  _In_ ULONG DesiredAccess,
963  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
964  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
965  _In_ ULONG ShareAccess,
966  _In_ ULONG CreateDisposition,
967  _In_ ULONG CreateOptions,
968  _In_ ULONG NamedPipeType,
969  _In_ ULONG ReadMode,
970  _In_ ULONG CompletionMode,
971  _In_ ULONG MaximumInstances,
972  _In_ ULONG InboundQuota,
973  _In_ ULONG OutboundQuota,
974  _In_opt_ PLARGE_INTEGER DefaultTimeout
975  );
976 
977 NTSYSCALLAPI
978 NTSTATUS
979 NTAPI
980 ZwCreatePagingFile(
981  _In_ PUNICODE_STRING PageFileName,
982  _In_ PLARGE_INTEGER MinimumSize,
983  _In_ PLARGE_INTEGER MaximumSize,
984  _In_ ULONG Priority
985  );
986 
987 NTSYSCALLAPI
988 NTSTATUS
989 NTAPI
990 ZwCreatePartition(
991  _Out_ PHANDLE PartitionHandle,
992  _In_ ACCESS_MASK DesiredAccess,
993  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
994  _In_ ULONG PreferredNode
995  );
996 
997 NTSYSCALLAPI
998 NTSTATUS
999 NTAPI
1000 ZwCreatePort(
1001  _Out_ PHANDLE PortHandle,
1002  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1003  _In_ ULONG MaxConnectionInfoLength,
1004  _In_ ULONG MaxMessageLength,
1005  _In_opt_ ULONG MaxPoolUsage
1006  );
1007 
1008 NTSYSCALLAPI
1009 NTSTATUS
1010 NTAPI
1011 ZwCreatePrivateNamespace(
1012  _Out_ PHANDLE NamespaceHandle,
1013  _In_ ACCESS_MASK DesiredAccess,
1014  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
1015  _In_ PVOID BoundaryDescriptor
1016  );
1017 
1018 NTSYSCALLAPI
1019 NTSTATUS
1020 NTAPI
1021 ZwCreateProcess(
1022  _Out_ PHANDLE ProcessHandle,
1023  _In_ ACCESS_MASK DesiredAccess,
1024  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1025  _In_ HANDLE ParentProcess,
1026  _In_ BOOLEAN InheritObjectTable,
1027  _In_opt_ HANDLE SectionHandle,
1028  _In_opt_ HANDLE DebugPort,
1029  _In_opt_ HANDLE ExceptionPort
1030  );
1031 
1032 NTSYSCALLAPI
1033 NTSTATUS
1034 NTAPI
1035 ZwCreateProcessEx(
1036  _Out_ PHANDLE ProcessHandle,
1037  _In_ ACCESS_MASK DesiredAccess,
1038  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1039  _In_ HANDLE ParentProcess,
1040  _In_ ULONG Flags,
1041  _In_opt_ HANDLE SectionHandle,
1042  _In_opt_ HANDLE DebugPort,
1043  _In_opt_ HANDLE ExceptionPort,
1044  _In_ ULONG JobMemberLevel
1045  );
1046 
1047 NTSYSCALLAPI
1048 NTSTATUS
1049 NTAPI
1050 ZwCreateProfile(
1051  _Out_ PHANDLE ProfileHandle,
1052  _In_opt_ HANDLE Process,
1053  _In_ PVOID ProfileBase,
1054  _In_ SIZE_T ProfileSize,
1055  _In_ ULONG BucketSize,
1056  _In_reads_bytes_(BufferSize) PULONG Buffer,
1057  _In_ ULONG BufferSize,
1058  _In_ KPROFILE_SOURCE ProfileSource,
1059  _In_ KAFFINITY Affinity
1060  );
1061 
1062 NTSYSCALLAPI
1063 NTSTATUS
1064 NTAPI
1065 ZwCreateProfileEx(
1066  _Out_ PHANDLE ProfileHandle,
1067  _In_opt_ HANDLE Process,
1068  _In_ PVOID ProfileBase,
1069  _In_ SIZE_T ProfileSize,
1070  _In_ ULONG BucketSize,
1071  _In_reads_bytes_(BufferSize) PULONG Buffer,
1072  _In_ ULONG BufferSize,
1073  _In_ KPROFILE_SOURCE ProfileSource,
1074  _In_ USHORT GroupCount,
1075  _In_reads_(GroupCount) PGROUP_AFFINITY GroupAffinity
1076  );
1077 
1078 NTSYSCALLAPI
1079 NTSTATUS
1080 NTAPI
1081 ZwCreateResourceManager(
1082  _Out_ PHANDLE ResourceManagerHandle,
1083  _In_ ACCESS_MASK DesiredAccess,
1084  _In_ HANDLE TmHandle,
1085  _In_ LPGUID RmGuid,
1086  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1087  _In_opt_ ULONG CreateOptions,
1088  _In_opt_ PUNICODE_STRING Description
1089  );
1090 
1091 NTSYSCALLAPI
1092 NTSTATUS
1093 NTAPI
1094 ZwCreateSection(
1095  _Out_ PHANDLE SectionHandle,
1096  _In_ ACCESS_MASK DesiredAccess,
1097  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1098  _In_opt_ PLARGE_INTEGER MaximumSize,
1099  _In_ ULONG SectionPageProtection,
1100  _In_ ULONG AllocationAttributes,
1101  _In_opt_ HANDLE FileHandle
1102  );
1103 
1104 NTSYSCALLAPI
1105 NTSTATUS
1106 NTAPI
1107 ZwCreateSemaphore(
1108  _Out_ PHANDLE SemaphoreHandle,
1109  _In_ ACCESS_MASK DesiredAccess,
1110  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1111  _In_ LONG InitialCount,
1112  _In_ LONG MaximumCount
1113  );
1114 
1115 NTSYSCALLAPI
1116 NTSTATUS
1117 NTAPI
1118 ZwCreateSiloObject(
1119  _Out_ PHANDLE SiloHandle,
1120  _In_ ACCESS_MASK DesiredAccess,
1121  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
1122  );
1123 
1124 NTSYSCALLAPI
1125 NTSTATUS
1126 NTAPI
1127 ZwCreateSymbolicLinkObject(
1128  _Out_ PHANDLE LinkHandle,
1129  _In_ ACCESS_MASK DesiredAccess,
1130  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
1131  _In_ PUNICODE_STRING LinkTarget
1132  );
1133 
1134 NTSYSCALLAPI
1135 NTSTATUS
1136 NTAPI
1137 ZwCreateThread(
1138  _Out_ PHANDLE ThreadHandle,
1139  _In_ ACCESS_MASK DesiredAccess,
1140  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1141  _In_ HANDLE ProcessHandle,
1142  _Out_ PCLIENT_ID ClientId,
1143  _In_ PCONTEXT ThreadContext,
1144  _In_ PINITIAL_TEB InitialTeb,
1145  _In_ BOOLEAN CreateSuspended
1146  );
1147 
1148 NTSYSCALLAPI
1149 NTSTATUS
1150 NTAPI
1151 ZwCreateThreadEx(
1152  _Out_ PHANDLE ThreadHandle,
1153  _In_ ACCESS_MASK DesiredAccess,
1154  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1155  _In_ HANDLE ProcessHandle,
1156  _In_ PVOID StartRoutine, // PUSER_THREAD_START_ROUTINE
1157  _In_opt_ PVOID Argument,
1158  _In_ ULONG CreateFlags, // THREAD_CREATE_FLAGS_*
1159  _In_ SIZE_T ZeroBits,
1160  _In_ SIZE_T StackSize,
1161  _In_ SIZE_T MaximumStackSize,
1162  _In_opt_ PPS_ATTRIBUTE_LIST AttributeList
1163  );
1164 
1165 NTSYSCALLAPI
1166 NTSTATUS
1167 NTAPI
1168 ZwCreateTimer(
1169  _Out_ PHANDLE TimerHandle,
1170  _In_ ACCESS_MASK DesiredAccess,
1171  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1172  _In_ TIMER_TYPE TimerType
1173  );
1174 
1175 NTSYSCALLAPI
1176 NTSTATUS
1177 NTAPI
1178 ZwCreateTimer2(
1179  _Out_ PHANDLE TimerHandle,
1180  _In_opt_ PVOID Reserved1,
1181  _In_opt_ PVOID Reserved2,
1182  _In_ ULONG Attributes,
1183  _In_ ACCESS_MASK DesiredAccess
1184  );
1185 
1186 NTSYSCALLAPI
1187 NTSTATUS
1188 NTAPI
1189 ZwCreateToken(
1190  _Out_ PHANDLE TokenHandle,
1191  _In_ ACCESS_MASK DesiredAccess,
1192  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1193  _In_ TOKEN_TYPE TokenType,
1194  _In_ PLUID AuthenticationId,
1195  _In_ PLARGE_INTEGER ExpirationTime,
1196  _In_ PTOKEN_USER User,
1197  _In_ PTOKEN_GROUPS Groups,
1198  _In_ PTOKEN_PRIVILEGES Privileges,
1199  _In_opt_ PTOKEN_OWNER Owner,
1200  _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
1201  _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
1202  _In_ PTOKEN_SOURCE TokenSource
1203  );
1204 
1205 NTSYSCALLAPI
1206 NTSTATUS
1207 NTAPI
1208 ZwCreateTokenEx(
1209  _Out_ PHANDLE TokenHandle,
1210  _In_ ACCESS_MASK DesiredAccess,
1211  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1212  _In_ TOKEN_TYPE TokenType,
1213  _In_ PLUID AuthenticationId,
1214  _In_ PLARGE_INTEGER ExpirationTime,
1215  _In_ PTOKEN_USER User,
1216  _In_ PTOKEN_GROUPS Groups,
1217  _In_ PTOKEN_PRIVILEGES Privileges,
1218  _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,
1219  _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,
1220  _In_opt_ PTOKEN_GROUPS DeviceGroups,
1221  _In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,
1222  _In_opt_ PTOKEN_OWNER Owner,
1223  _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
1224  _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
1225  _In_ PTOKEN_SOURCE TokenSource
1226  );
1227 
1228 NTSYSCALLAPI
1229 NTSTATUS
1230 NTAPI
1231 ZwCreateTransaction(
1232  _Out_ PHANDLE TransactionHandle,
1233  _In_ ACCESS_MASK DesiredAccess,
1234  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1235  _In_opt_ LPGUID Uow,
1236  _In_opt_ HANDLE TmHandle,
1237  _In_opt_ ULONG CreateOptions,
1238  _In_opt_ ULONG IsolationLevel,
1239  _In_opt_ ULONG IsolationFlags,
1240  _In_opt_ PLARGE_INTEGER Timeout,
1241  _In_opt_ PUNICODE_STRING Description
1242  );
1243 
1244 NTSYSCALLAPI
1245 NTSTATUS
1246 NTAPI
1247 ZwCreateTransactionManager(
1248  _Out_ PHANDLE TmHandle,
1249  _In_ ACCESS_MASK DesiredAccess,
1250  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1251  _In_opt_ PUNICODE_STRING LogFileName,
1252  _In_opt_ ULONG CreateOptions,
1253  _In_opt_ ULONG CommitStrength
1254  );
1255 
1256 NTSYSCALLAPI
1257 NTSTATUS
1258 NTAPI
1259 ZwCreateUserProcess(
1260  _Out_ PHANDLE ProcessHandle,
1261  _Out_ PHANDLE ThreadHandle,
1262  _In_ ACCESS_MASK ProcessDesiredAccess,
1263  _In_ ACCESS_MASK ThreadDesiredAccess,
1264  _In_opt_ POBJECT_ATTRIBUTES ProcessObjectAttributes,
1265  _In_opt_ POBJECT_ATTRIBUTES ThreadObjectAttributes,
1266  _In_ ULONG ProcessFlags, // PROCESS_CREATE_FLAGS_*
1267  _In_ ULONG ThreadFlags, // THREAD_CREATE_FLAGS_*
1268  _In_opt_ PVOID ProcessParameters, // PRTL_USER_PROCESS_PARAMETERS
1269  _Inout_ PPS_CREATE_INFO CreateInfo,
1270  _In_opt_ PPS_ATTRIBUTE_LIST AttributeList
1271  );
1272 
1273 NTSYSCALLAPI
1274 NTSTATUS
1275 NTAPI
1276 ZwCreateWaitCompletionPacket(
1277  _Out_ PHANDLE WaitCompletionPacketHandle,
1278  _In_ ACCESS_MASK DesiredAccess,
1279  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
1280  );
1281 
1282 NTSYSCALLAPI
1283 NTSTATUS
1284 NTAPI
1285 ZwCreateWaitablePort(
1286  _Out_ PHANDLE PortHandle,
1287  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1288  _In_ ULONG MaxConnectionInfoLength,
1289  _In_ ULONG MaxMessageLength,
1290  _In_opt_ ULONG MaxPoolUsage
1291  );
1292 
1293 NTSYSCALLAPI
1294 NTSTATUS
1295 NTAPI
1296 ZwCreateWnfStateName(
1297  _Out_ PWNF_STATE_NAME StateName,
1298  _In_ WNF_STATE_NAME_LIFETIME NameLifetime,
1299  _In_ WNF_DATA_SCOPE DataScope,
1300  _In_ BOOLEAN PersistData,
1301  _In_opt_ PCWNF_TYPE_ID TypeId,
1302  _In_ ULONG MaximumStateSize,
1303  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor
1304  );
1305 
1306 NTSYSCALLAPI
1307 NTSTATUS
1308 NTAPI
1309 ZwCreateWorkerFactory(
1310  _Out_ PHANDLE WorkerFactoryHandleReturn,
1311  _In_ ACCESS_MASK DesiredAccess,
1312  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1313  _In_ HANDLE CompletionPortHandle,
1314  _In_ HANDLE WorkerProcessHandle,
1315  _In_ PVOID StartRoutine,
1316  _In_opt_ PVOID StartParameter,
1317  _In_opt_ ULONG MaxThreadCount,
1318  _In_opt_ SIZE_T StackReserve,
1319  _In_opt_ SIZE_T StackCommit
1320  );
1321 
1322 NTSYSCALLAPI
1323 NTSTATUS
1324 NTAPI
1325 ZwDebugActiveProcess(
1326  _In_ HANDLE ProcessHandle,
1327  _In_ HANDLE DebugObjectHandle
1328  );
1329 
1330 NTSYSCALLAPI
1331 NTSTATUS
1332 NTAPI
1333 ZwDebugContinue(
1334  _In_ HANDLE DebugObjectHandle,
1335  _In_ PCLIENT_ID ClientId,
1336  _In_ NTSTATUS ContinueStatus
1337  );
1338 
1339 NTSYSCALLAPI
1340 NTSTATUS
1341 NTAPI
1342 ZwDelayExecution(
1343  _In_ BOOLEAN Alertable,
1344  _In_ PLARGE_INTEGER DelayInterval
1345  );
1346 
1347 NTSYSCALLAPI
1348 NTSTATUS
1349 NTAPI
1350 ZwDeleteAtom(
1351  _In_ RTL_ATOM Atom
1352  );
1353 
1354 NTSYSCALLAPI
1355 NTSTATUS
1356 NTAPI
1357 ZwDeleteBootEntry(
1358  _In_ ULONG Id
1359  );
1360 
1361 NTSYSCALLAPI
1362 NTSTATUS
1363 NTAPI
1364 ZwDeleteDriverEntry(
1365  _In_ ULONG Id
1366  );
1367 
1368 NTSYSCALLAPI
1369 NTSTATUS
1370 NTAPI
1371 ZwDeleteFile(
1372  _In_ POBJECT_ATTRIBUTES ObjectAttributes
1373  );
1374 
1375 NTSYSCALLAPI
1376 NTSTATUS
1377 NTAPI
1378 ZwDeleteKey(
1379  _In_ HANDLE KeyHandle
1380  );
1381 
1382 NTSYSCALLAPI
1383 NTSTATUS
1384 NTAPI
1385 ZwDeleteObjectAuditAlarm(
1386  _In_ PUNICODE_STRING SubsystemName,
1387  _In_opt_ PVOID HandleId,
1388  _In_ BOOLEAN GenerateOnClose
1389  );
1390 
1391 NTSYSCALLAPI
1392 NTSTATUS
1393 NTAPI
1394 ZwDeletePrivateNamespace(
1395  _In_ HANDLE NamespaceHandle
1396  );
1397 
1398 NTSYSCALLAPI
1399 NTSTATUS
1400 NTAPI
1401 ZwDeleteValueKey(
1402  _In_ HANDLE KeyHandle,
1403  _In_ PUNICODE_STRING ValueName
1404  );
1405 
1406 NTSYSCALLAPI
1407 NTSTATUS
1408 NTAPI
1409 ZwDeleteWnfStateData(
1410  _In_ PCWNF_STATE_NAME StateName,
1411  _In_opt_ const PVOID ExplicitScope
1412  );
1413 
1414 NTSYSCALLAPI
1415 NTSTATUS
1416 NTAPI
1417 ZwDeleteWnfStateName(
1418  _In_ PCWNF_STATE_NAME StateName
1419  );
1420 
1421 NTSYSCALLAPI
1422 NTSTATUS
1423 NTAPI
1424 ZwDetachSiloFromCurrentThread(
1425  _In_ HANDLE SiloHandle
1426  );
1427 
1428 NTSYSCALLAPI
1429 NTSTATUS
1430 NTAPI
1431 ZwDeviceIoControlFile(
1432  _In_ HANDLE FileHandle,
1433  _In_opt_ HANDLE Event,
1434  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1435  _In_opt_ PVOID ApcContext,
1436  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1437  _In_ ULONG IoControlCode,
1438  _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
1439  _In_ ULONG InputBufferLength,
1440  _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
1441  _In_ ULONG OutputBufferLength
1442  );
1443 
1444 NTSYSCALLAPI
1445 NTSTATUS
1446 NTAPI
1447 ZwDisableLastKnownGood(
1448  VOID
1449  );
1450 
1451 NTSYSCALLAPI
1452 NTSTATUS
1453 NTAPI
1454 ZwDisplayString(
1455  _In_ PUNICODE_STRING String
1456  );
1457 
1458 NTSYSCALLAPI
1459 NTSTATUS
1460 NTAPI
1461 ZwDrawText(
1462  _In_ PUNICODE_STRING String
1463  );
1464 
1465 NTSYSCALLAPI
1466 NTSTATUS
1467 NTAPI
1468 ZwDuplicateObject(
1469  _In_ HANDLE SourceProcessHandle,
1470  _In_ HANDLE SourceHandle,
1471  _In_opt_ HANDLE TargetProcessHandle,
1472  _Out_opt_ PHANDLE TargetHandle,
1473  _In_ ACCESS_MASK DesiredAccess,
1474  _In_ ULONG HandleAttributes,
1475  _In_ ULONG Options
1476  );
1477 
1478 NTSYSCALLAPI
1479 NTSTATUS
1480 NTAPI
1481 ZwDuplicateToken(
1482  _In_ HANDLE ExistingTokenHandle,
1483  _In_ ACCESS_MASK DesiredAccess,
1484  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
1485  _In_ BOOLEAN EffectiveOnly,
1486  _In_ TOKEN_TYPE TokenType,
1487  _Out_ PHANDLE NewTokenHandle
1488  );
1489 
1490 NTSYSCALLAPI
1491 NTSTATUS
1492 NTAPI
1493 ZwEnableLastKnownGood(
1494  VOID
1495  );
1496 
1497 NTSYSCALLAPI
1498 NTSTATUS
1499 NTAPI
1500 ZwEnumerateBootEntries(
1501  _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
1502  _Inout_ PULONG BufferLength
1503  );
1504 
1505 NTSYSCALLAPI
1506 NTSTATUS
1507 NTAPI
1508 ZwEnumerateDriverEntries(
1509  _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
1510  _Inout_ PULONG BufferLength
1511  );
1512 
1513 NTSYSCALLAPI
1514 NTSTATUS
1515 NTAPI
1516 ZwEnumerateKey(
1517  _In_ HANDLE KeyHandle,
1518  _In_ ULONG Index,
1519  _In_ KEY_INFORMATION_CLASS KeyInformationClass,
1520  _Out_writes_bytes_opt_(Length) PVOID KeyInformation,
1521  _In_ ULONG Length,
1522  _Out_ PULONG ResultLength
1523  );
1524 
1525 NTSYSCALLAPI
1526 NTSTATUS
1527 NTAPI
1528 ZwEnumerateSystemEnvironmentValuesEx(
1529  _In_ ULONG InformationClass,
1530  _Out_ PVOID Buffer,
1531  _Inout_ PULONG BufferLength
1532  );
1533 
1534 NTSYSCALLAPI
1535 NTSTATUS
1536 NTAPI
1537 ZwEnumerateTransactionObject(
1538  _In_opt_ HANDLE RootObjectHandle,
1539  _In_ KTMOBJECT_TYPE QueryType,
1540  _Inout_updates_bytes_(ObjectCursorLength) PKTMOBJECT_CURSOR ObjectCursor,
1541  _In_ ULONG ObjectCursorLength,
1542  _Out_ PULONG ReturnLength
1543  );
1544 
1545 NTSYSCALLAPI
1546 NTSTATUS
1547 NTAPI
1548 ZwEnumerateValueKey(
1549  _In_ HANDLE KeyHandle,
1550  _In_ ULONG Index,
1551  _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
1552  _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,
1553  _In_ ULONG Length,
1554  _Out_ PULONG ResultLength
1555  );
1556 
1557 NTSYSCALLAPI
1558 NTSTATUS
1559 NTAPI
1560 ZwExtendSection(
1561  _In_ HANDLE SectionHandle,
1562  _Inout_ PLARGE_INTEGER NewSectionSize
1563  );
1564 
1565 NTSYSCALLAPI
1566 NTSTATUS
1567 NTAPI
1568 ZwFilterBootOption(
1569  _In_ FILTER_BOOT_OPTION_OPERATION FilterOperation,
1570  _In_ ULONG ObjectType,
1571  _In_ ULONG ElementType,
1572  _In_reads_bytes_opt_(DataSize) PVOID Data,
1573  _In_ ULONG DataSize
1574  );
1575 
1576 NTSYSCALLAPI
1577 NTSTATUS
1578 NTAPI
1579 ZwFilterToken(
1580  _In_ HANDLE ExistingTokenHandle,
1581  _In_ ULONG Flags,
1582  _In_opt_ PTOKEN_GROUPS SidsToDisable,
1583  _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
1584  _In_opt_ PTOKEN_GROUPS RestrictedSids,
1585  _Out_ PHANDLE NewTokenHandle
1586  );
1587 
1588 NTSYSCALLAPI
1589 NTSTATUS
1590 NTAPI
1591 ZwFilterTokenEx(
1592  _In_ HANDLE ExistingTokenHandle,
1593  _In_ ULONG Flags,
1594  _In_opt_ PTOKEN_GROUPS SidsToDisable,
1595  _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
1596  _In_opt_ PTOKEN_GROUPS RestrictedSids,
1597  _In_ ULONG DisableUserClaimsCount,
1598  _In_opt_ PUNICODE_STRING UserClaimsToDisable,
1599  _In_ ULONG DisableDeviceClaimsCount,
1600  _In_opt_ PUNICODE_STRING DeviceClaimsToDisable,
1601  _In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,
1602  _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,
1603  _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,
1604  _In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,
1605  _Out_ PHANDLE NewTokenHandle
1606  );
1607 
1608 NTSYSCALLAPI
1609 NTSTATUS
1610 NTAPI
1611 ZwFindAtom(
1612  _In_reads_bytes_opt_(Length) PWSTR AtomName,
1613  _In_ ULONG Length,
1614  _Out_opt_ PRTL_ATOM Atom
1615  );
1616 
1617 NTSYSCALLAPI
1618 NTSTATUS
1619 NTAPI
1620 ZwFlushBuffersFile(
1621  _In_ HANDLE FileHandle,
1622  _Out_ PIO_STATUS_BLOCK IoStatusBlock
1623  );
1624 
1625 NTSYSCALLAPI
1626 NTSTATUS
1627 NTAPI
1628 ZwFlushBuffersFileEx(
1629  _In_ HANDLE FileHandle,
1630  _In_ ULONG Flags,
1631  _In_reads_bytes_(ParametersSize) PVOID Parameters,
1632  _In_ ULONG ParametersSize,
1633  _Out_ PIO_STATUS_BLOCK IoStatusBlock
1634  );
1635 
1636 NTSYSCALLAPI
1637 NTSTATUS
1638 NTAPI
1639 ZwFlushInstallUILanguage(
1640  _In_ LANGID InstallUILanguage,
1641  _In_ ULONG SetComittedFlag
1642  );
1643 
1644 NTSYSCALLAPI
1645 NTSTATUS
1646 NTAPI
1647 ZwFlushInstructionCache(
1648  _In_ HANDLE ProcessHandle,
1649  _In_opt_ PVOID BaseAddress,
1650  _In_ SIZE_T Length
1651  );
1652 
1653 NTSYSCALLAPI
1654 NTSTATUS
1655 NTAPI
1656 ZwFlushKey(
1657  _In_ HANDLE KeyHandle
1658  );
1659 
1660 NTSYSCALLAPI
1661 VOID
1662 NTAPI
1663 ZwFlushProcessWriteBuffers(
1664  VOID
1665  );
1666 
1667 NTSYSCALLAPI
1668 NTSTATUS
1669 NTAPI
1670 ZwFlushWriteBuffer(
1671  VOID
1672  );
1673 
1674 NTSYSCALLAPI
1675 NTSTATUS
1676 NTAPI
1677 ZwFreeUserPhysicalPages(
1678  _In_ HANDLE ProcessHandle,
1679  _Inout_ PULONG_PTR NumberOfPages,
1680  _In_reads_(*NumberOfPages) PULONG_PTR UserPfnArray
1681  );
1682 
1683 NTSYSCALLAPI
1684 NTSTATUS
1685 NTAPI
1686 ZwFreeVirtualMemory(
1687  _In_ HANDLE ProcessHandle,
1688  _Inout_ PVOID *BaseAddress,
1689  _Inout_ PSIZE_T RegionSize,
1690  _In_ ULONG FreeType
1691  );
1692 
1693 NTSYSCALLAPI
1694 NTSTATUS
1695 NTAPI
1696 ZwFreezeRegistry(
1697  _In_ ULONG TimeOutInSeconds
1698  );
1699 
1700 NTSYSCALLAPI
1701 NTSTATUS
1702 NTAPI
1703 ZwFreezeTransactions(
1704  _In_ PLARGE_INTEGER FreezeTimeout,
1705  _In_ PLARGE_INTEGER ThawTimeout
1706  );
1707 
1708 NTSYSCALLAPI
1709 NTSTATUS
1710 NTAPI
1711 ZwFsControlFile(
1712  _In_ HANDLE FileHandle,
1713  _In_opt_ HANDLE Event,
1714  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1715  _In_opt_ PVOID ApcContext,
1716  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1717  _In_ ULONG FsControlCode,
1718  _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
1719  _In_ ULONG InputBufferLength,
1720  _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
1721  _In_ ULONG OutputBufferLength
1722  );
1723 
1724 NTSYSCALLAPI
1725 NTSTATUS
1726 NTAPI
1727 ZwGetCachedSigningLevel(
1728  _In_ HANDLE File,
1729  _Out_ PULONG Flags,
1730  _Out_ PSE_SIGNING_LEVEL SigningLevel,
1731  _Out_writes_bytes_to_opt_(*ThumbprintSize, *ThumbprintSize) PUCHAR Thumbprint,
1732  _Inout_opt_ PULONG ThumbprintSize,
1733  _Out_opt_ PULONG ThumbprintAlgorithm
1734  );
1735 
1736 NTSYSCALLAPI
1737 NTSTATUS
1738 NTAPI
1739 ZwGetCompleteWnfStateSubscription(
1740  _In_opt_ PWNF_STATE_NAME OldDescriptorStateName,
1741  _In_opt_ ULONG64 *OldSubscriptionId,
1742  _In_opt_ ULONG OldDescriptorEventMask,
1743  _In_opt_ ULONG OldDescriptorStatus,
1744  _Out_writes_bytes_(DescriptorSize) PWNF_DELIVERY_DESCRIPTOR NewDeliveryDescriptor,
1745  _In_ ULONG DescriptorSize
1746  );
1747 
1748 NTSYSCALLAPI
1749 NTSTATUS
1750 NTAPI
1751 ZwGetContextThread(
1752  _In_ HANDLE ThreadHandle,
1753  _Inout_ PCONTEXT ThreadContext
1754  );
1755 
1756 NTSYSCALLAPI
1757 ULONG
1758 NTAPI
1759 ZwGetCurrentProcessorNumber(
1760  VOID
1761  );
1762 
1763 NTSYSCALLAPI
1764 NTSTATUS
1765 NTAPI
1766 ZwGetDevicePowerState(
1767  _In_ HANDLE Device,
1768  _Out_ PDEVICE_POWER_STATE State
1769  );
1770 
1771 NTSYSCALLAPI
1772 NTSTATUS
1773 NTAPI
1774 ZwGetMUIRegistryInfo(
1775  _In_ ULONG Flags,
1776  _Inout_ PULONG DataSize,
1777  _Out_ PVOID Data
1778  );
1779 
1780 NTSYSCALLAPI
1781 NTSTATUS
1782 NTAPI
1783 ZwGetNextProcess(
1784  _In_ HANDLE ProcessHandle,
1785  _In_ ACCESS_MASK DesiredAccess,
1786  _In_ ULONG HandleAttributes,
1787  _In_ ULONG Flags,
1788  _Out_ PHANDLE NewProcessHandle
1789  );
1790 
1791 NTSYSCALLAPI
1792 NTSTATUS
1793 NTAPI
1794 ZwGetNextThread(
1795  _In_ HANDLE ProcessHandle,
1796  _In_ HANDLE ThreadHandle,
1797  _In_ ACCESS_MASK DesiredAccess,
1798  _In_ ULONG HandleAttributes,
1799  _In_ ULONG Flags,
1800  _Out_ PHANDLE NewThreadHandle
1801  );
1802 
1803 NTSYSCALLAPI
1804 NTSTATUS
1805 NTAPI
1806 ZwGetNlsSectionPtr(
1807  _In_ ULONG SectionType,
1808  _In_ ULONG SectionData,
1809  _In_ PVOID ContextData,
1810  _Out_ PVOID *SectionPointer,
1811  _Out_ PULONG SectionSize
1812  );
1813 
1814 NTSYSCALLAPI
1815 NTSTATUS
1816 NTAPI
1817 ZwGetNotificationResourceManager(
1818  _In_ HANDLE ResourceManagerHandle,
1819  _Out_ PTRANSACTION_NOTIFICATION TransactionNotification,
1820  _In_ ULONG NotificationLength,
1821  _In_opt_ PLARGE_INTEGER Timeout,
1822  _Out_opt_ PULONG ReturnLength,
1823  _In_ ULONG Asynchronous,
1824  _In_opt_ ULONG_PTR AsynchronousContext
1825  );
1826 
1827 NTSYSCALLAPI
1828 NTSTATUS
1829 NTAPI
1830 ZwGetPlugPlayEvent(
1831  _In_ HANDLE EventHandle,
1832  _In_opt_ PVOID Context,
1833  _Out_writes_bytes_(EventBufferSize) PPLUGPLAY_EVENT_BLOCK EventBlock,
1834  _In_ ULONG EventBufferSize
1835  );
1836 
1837 NTSYSCALLAPI
1838 NTSTATUS
1839 NTAPI
1840 ZwGetWriteWatch(
1841  _In_ HANDLE ProcessHandle,
1842  _In_ ULONG Flags,
1843  _In_ PVOID BaseAddress,
1844  _In_ SIZE_T RegionSize,
1845  _Out_writes_(*EntriesInUserAddressArray) PVOID *UserAddressArray,
1846  _Inout_ PULONG_PTR EntriesInUserAddressArray,
1847  _Out_ PULONG Granularity
1848  );
1849 
1850 NTSYSCALLAPI
1851 NTSTATUS
1852 NTAPI
1853 ZwImpersonateAnonymousToken(
1854  _In_ HANDLE ThreadHandle
1855  );
1856 
1857 NTSYSCALLAPI
1858 NTSTATUS
1859 NTAPI
1860 ZwImpersonateClientOfPort(
1861  _In_ HANDLE PortHandle,
1862  _In_ PPORT_MESSAGE Message
1863  );
1864 
1865 NTSYSCALLAPI
1866 NTSTATUS
1867 NTAPI
1868 ZwImpersonateThread(
1869  _In_ HANDLE ServerThreadHandle,
1870  _In_ HANDLE ClientThreadHandle,
1871  _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos
1872  );
1873 
1874 NTSYSCALLAPI
1875 NTSTATUS
1876 NTAPI
1877 ZwInitializeNlsFiles(
1878  _Out_ PVOID *BaseAddress,
1879  _Out_ PLCID DefaultLocaleId,
1880  _Out_ PLARGE_INTEGER DefaultCasingTableSize
1881  );
1882 
1883 NTSYSCALLAPI
1884 NTSTATUS
1885 NTAPI
1886 ZwInitializeRegistry(
1887  _In_ USHORT BootCondition
1888  );
1889 
1890 NTSYSCALLAPI
1891 NTSTATUS
1892 NTAPI
1893 ZwInitiatePowerAction(
1894  _In_ POWER_ACTION SystemAction,
1895  _In_ SYSTEM_POWER_STATE LightestSystemState,
1896  _In_ ULONG Flags, // POWER_ACTION_* flags
1897  _In_ BOOLEAN Asynchronous
1898  );
1899 
1900 NTSYSCALLAPI
1901 NTSTATUS
1902 NTAPI
1903 ZwIsProcessInJob(
1904  _In_ HANDLE ProcessHandle,
1905  _In_opt_ HANDLE JobHandle
1906  );
1907 
1908 NTSYSCALLAPI
1909 BOOLEAN
1910 NTAPI
1911 ZwIsSystemResumeAutomatic(
1912  VOID
1913  );
1914 
1915 NTSYSCALLAPI
1916 NTSTATUS
1917 NTAPI
1918 ZwIsUILanguageComitted(
1919  VOID
1920  );
1921 
1922 NTSYSCALLAPI
1923 NTSTATUS
1924 NTAPI
1925 ZwListenPort(
1926  _In_ HANDLE PortHandle,
1927  _Out_ PPORT_MESSAGE ConnectionRequest
1928  );
1929 
1930 NTSYSCALLAPI
1931 NTSTATUS
1932 NTAPI
1933 ZwLoadDriver(
1934  _In_ PUNICODE_STRING DriverServiceName
1935  );
1936 
1937 NTSYSCALLAPI
1938 NTSTATUS
1939 NTAPI
1940 ZwLoadKey(
1941  _In_ POBJECT_ATTRIBUTES TargetKey,
1942  _In_ POBJECT_ATTRIBUTES SourceFile
1943  );
1944 
1945 NTSYSCALLAPI
1946 NTSTATUS
1947 NTAPI
1948 ZwLoadKey2(
1949  _In_ POBJECT_ATTRIBUTES TargetKey,
1950  _In_ POBJECT_ATTRIBUTES SourceFile,
1951  _In_ ULONG Flags
1952  );
1953 
1954 NTSYSCALLAPI
1955 NTSTATUS
1956 NTAPI
1957 ZwLoadKeyEx(
1958  _In_ POBJECT_ATTRIBUTES TargetKey,
1959  _In_ POBJECT_ATTRIBUTES SourceFile,
1960  _In_ ULONG Flags,
1961  _In_opt_ HANDLE TrustClassKey,
1962  _In_opt_ HANDLE Event,
1963  _In_opt_ ACCESS_MASK DesiredAccess,
1964  _Out_opt_ PHANDLE RootHandle,
1965  _Out_opt_ PIO_STATUS_BLOCK IoStatus
1966  );
1967 
1968 NTSYSCALLAPI
1969 NTSTATUS
1970 NTAPI
1971 ZwLockFile(
1972  _In_ HANDLE FileHandle,
1973  _In_opt_ HANDLE Event,
1974  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1975  _In_opt_ PVOID ApcContext,
1976  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1977  _In_ PLARGE_INTEGER ByteOffset,
1978  _In_ PLARGE_INTEGER Length,
1979  _In_ ULONG Key,
1980  _In_ BOOLEAN FailImmediately,
1981  _In_ BOOLEAN ExclusiveLock
1982  );
1983 
1984 NTSYSCALLAPI
1985 NTSTATUS
1986 NTAPI
1987 ZwLockProductActivationKeys(
1988  _Inout_opt_ ULONG *pPrivateVer,
1989  _Out_opt_ ULONG *pSafeMode
1990  );
1991 
1992 NTSYSCALLAPI
1993 NTSTATUS
1994 NTAPI
1995 ZwLockRegistryKey(
1996  _In_ HANDLE KeyHandle
1997  );
1998 
1999 NTSYSCALLAPI
2000 NTSTATUS
2001 NTAPI
2002 ZwLockVirtualMemory(
2003  _In_ HANDLE ProcessHandle,
2004  _Inout_ PVOID *BaseAddress,
2005  _Inout_ PSIZE_T RegionSize,
2006  _In_ ULONG MapType
2007  );
2008 
2009 NTSYSCALLAPI
2010 NTSTATUS
2011 NTAPI
2012 ZwMakePermanentObject(
2013  _In_ HANDLE Handle
2014  );
2015 
2016 NTSYSCALLAPI
2017 NTSTATUS
2018 NTAPI
2019 ZwMakeTemporaryObject(
2020  _In_ HANDLE Handle
2021  );
2022 
2023 NTSYSCALLAPI
2024 NTSTATUS
2025 NTAPI
2026 ZwManagePartition(
2027  _In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass,
2028  _In_ PVOID PartitionInformation,
2029  _In_ ULONG PartitionInformationLength
2030  );
2031 
2032 NTSYSCALLAPI
2033 NTSTATUS
2034 NTAPI
2035 ZwMapCMFModule(
2036  _In_ ULONG What,
2037  _In_ ULONG Index,
2038  _Out_opt_ PULONG CacheIndexOut,
2039  _Out_opt_ PULONG CacheFlagsOut,
2040  _Out_opt_ PULONG ViewSizeOut,
2041  _Out_opt_ PVOID *BaseAddress
2042  );
2043 
2044 NTSYSCALLAPI
2045 NTSTATUS
2046 NTAPI
2047 ZwMapUserPhysicalPages(
2048  _In_ PVOID VirtualAddress,
2049  _In_ ULONG_PTR NumberOfPages,
2050  _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray
2051  );
2052 
2053 NTSYSCALLAPI
2054 NTSTATUS
2055 NTAPI
2056 ZwMapUserPhysicalPagesScatter(
2057  _In_reads_(NumberOfPages) PVOID *VirtualAddresses,
2058  _In_ ULONG_PTR NumberOfPages,
2059  _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray
2060  );
2061 
2062 NTSYSCALLAPI
2063 NTSTATUS
2064 NTAPI
2065 ZwMapViewOfSection(
2066  _In_ HANDLE SectionHandle,
2067  _In_ HANDLE ProcessHandle,
2068  _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,
2069  _In_ ULONG_PTR ZeroBits,
2070  _In_ SIZE_T CommitSize,
2071  _Inout_opt_ PLARGE_INTEGER SectionOffset,
2072  _Inout_ PSIZE_T ViewSize,
2073  _In_ SECTION_INHERIT InheritDisposition,
2074  _In_ ULONG AllocationType,
2075  _In_ ULONG Win32Protect
2076  );
2077 
2078 NTSYSCALLAPI
2079 NTSTATUS
2080 NTAPI
2081 ZwModifyBootEntry(
2082  _In_ PBOOT_ENTRY BootEntry
2083  );
2084 
2085 NTSYSCALLAPI
2086 NTSTATUS
2087 NTAPI
2088 ZwModifyDriverEntry(
2089  _In_ PEFI_DRIVER_ENTRY DriverEntry
2090  );
2091 
2092 NTSYSCALLAPI
2093 NTSTATUS
2094 NTAPI
2095 ZwNotifyChangeDirectoryFile(
2096  _In_ HANDLE FileHandle,
2097  _In_opt_ HANDLE Event,
2098  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
2099  _In_opt_ PVOID ApcContext,
2100  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2101  _Out_writes_bytes_(Length) PVOID Buffer,
2102  _In_ ULONG Length,
2103  _In_ ULONG CompletionFilter,
2104  _In_ BOOLEAN WatchTree
2105  );
2106 
2107 NTSYSCALLAPI
2108 NTSTATUS
2109 NTAPI
2110 ZwNotifyChangeKey(
2111  _In_ HANDLE KeyHandle,
2112  _In_opt_ HANDLE Event,
2113  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
2114  _In_opt_ PVOID ApcContext,
2115  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2116  _In_ ULONG CompletionFilter,
2117  _In_ BOOLEAN WatchTree,
2118  _Out_writes_bytes_opt_(BufferSize) PVOID Buffer,
2119  _In_ ULONG BufferSize,
2120  _In_ BOOLEAN Asynchronous
2121  );
2122 
2123 NTSYSCALLAPI
2124 NTSTATUS
2125 NTAPI
2126 ZwNotifyChangeMultipleKeys(
2127  _In_ HANDLE MasterKeyHandle,
2128  _In_opt_ ULONG Count,
2129  _In_reads_opt_(Count) OBJECT_ATTRIBUTES SubordinateObjects[],
2130  _In_opt_ HANDLE Event,
2131  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
2132  _In_opt_ PVOID ApcContext,
2133  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2134  _In_ ULONG CompletionFilter,
2135  _In_ BOOLEAN WatchTree,
2136  _Out_writes_bytes_opt_(BufferSize) PVOID Buffer,
2137  _In_ ULONG BufferSize,
2138  _In_ BOOLEAN Asynchronous
2139  );
2140 
2141 NTSYSCALLAPI
2142 NTSTATUS
2143 NTAPI
2144 ZwNotifyChangeSession(
2145  _In_ HANDLE SessionHandle,
2146  _In_ ULONG ChangeSequenceNumber,
2147  _In_ PLARGE_INTEGER ChangeTimeStamp,
2148  _In_ IO_SESSION_EVENT Event,
2149  _In_ IO_SESSION_STATE NewState,
2150  _In_ IO_SESSION_STATE PreviousState,
2151  _In_reads_bytes_opt_(PayloadSize) PVOID Payload,
2152  _In_ ULONG PayloadSize
2153  );
2154 
2155 NTSYSCALLAPI
2156 NTSTATUS
2157 NTAPI
2158 ZwOpenDirectoryObject(
2159  _Out_ PHANDLE DirectoryHandle,
2160  _In_ ACCESS_MASK DesiredAccess,
2161  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2162  );
2163 
2164 NTSYSCALLAPI
2165 NTSTATUS
2166 NTAPI
2167 ZwOpenEnlistment(
2168  _Out_ PHANDLE EnlistmentHandle,
2169  _In_ ACCESS_MASK DesiredAccess,
2170  _In_ HANDLE ResourceManagerHandle,
2171  _In_ LPGUID EnlistmentGuid,
2172  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
2173  );
2174 
2175 NTSYSCALLAPI
2176 NTSTATUS
2177 NTAPI
2178 ZwOpenEvent(
2179  _Out_ PHANDLE EventHandle,
2180  _In_ ACCESS_MASK DesiredAccess,
2181  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2182  );
2183 
2184 NTSYSCALLAPI
2185 NTSTATUS
2186 NTAPI
2187 ZwOpenEventPair(
2188  _Out_ PHANDLE EventPairHandle,
2189  _In_ ACCESS_MASK DesiredAccess,
2190  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2191  );
2192 
2193 NTSYSCALLAPI
2194 NTSTATUS
2195 NTAPI
2196 ZwOpenFile(
2197  _Out_ PHANDLE FileHandle,
2198  _In_ ACCESS_MASK DesiredAccess,
2199  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2200  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2201  _In_ ULONG ShareAccess,
2202  _In_ ULONG OpenOptions
2203  );
2204 
2205 NTSYSCALLAPI
2206 NTSTATUS
2207 NTAPI
2208 ZwOpenIoCompletion(
2209  _Out_ PHANDLE IoCompletionHandle,
2210  _In_ ACCESS_MASK DesiredAccess,
2211  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2212  );
2213 
2214 NTSYSCALLAPI
2215 NTSTATUS
2216 NTAPI
2217 ZwOpenJobObject(
2218  _Out_ PHANDLE JobHandle,
2219  _In_ ACCESS_MASK DesiredAccess,
2220  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2221  );
2222 
2223 NTSYSCALLAPI
2224 NTSTATUS
2225 NTAPI
2226 ZwOpenJobObjectToken(
2227  _In_ HANDLE JobHandle,
2228  _In_ ACCESS_MASK DesiredAccess,
2229  _Out_ PHANDLE TokenHandle
2230  );
2231 
2232 NTSYSCALLAPI
2233 NTSTATUS
2234 NTAPI
2235 ZwOpenKey(
2236  _Out_ PHANDLE KeyHandle,
2237  _In_ ACCESS_MASK DesiredAccess,
2238  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2239  );
2240 
2241 NTSYSCALLAPI
2242 NTSTATUS
2243 NTAPI
2244 ZwOpenKeyEx(
2245  _Out_ PHANDLE KeyHandle,
2246  _In_ ACCESS_MASK DesiredAccess,
2247  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2248  _In_ ULONG OpenOptions
2249  );
2250 
2251 NTSYSCALLAPI
2252 NTSTATUS
2253 NTAPI
2254 ZwOpenKeyTransacted(
2255  _Out_ PHANDLE KeyHandle,
2256  _In_ ACCESS_MASK DesiredAccess,
2257  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2258  _In_ HANDLE TransactionHandle
2259  );
2260 
2261 NTSYSCALLAPI
2262 NTSTATUS
2263 NTAPI
2264 ZwOpenKeyTransactedEx(
2265  _Out_ PHANDLE KeyHandle,
2266  _In_ ACCESS_MASK DesiredAccess,
2267  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2268  _In_ ULONG OpenOptions,
2269  _In_ HANDLE TransactionHandle
2270  );
2271 
2272 NTSYSCALLAPI
2273 NTSTATUS
2274 NTAPI
2275 ZwOpenKeyedEvent(
2276  _Out_ PHANDLE KeyedEventHandle,
2277  _In_ ACCESS_MASK DesiredAccess,
2278  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2279  );
2280 
2281 NTSYSCALLAPI
2282 NTSTATUS
2283 NTAPI
2284 ZwOpenMutant(
2285  _Out_ PHANDLE MutantHandle,
2286  _In_ ACCESS_MASK DesiredAccess,
2287  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2288  );
2289 
2290 NTSYSCALLAPI
2291 NTSTATUS
2292 NTAPI
2293 ZwOpenObjectAuditAlarm(
2294  _In_ PUNICODE_STRING SubsystemName,
2295  _In_opt_ PVOID HandleId,
2296  _In_ PUNICODE_STRING ObjectTypeName,
2297  _In_ PUNICODE_STRING ObjectName,
2298  _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
2299  _In_ HANDLE ClientToken,
2300  _In_ ACCESS_MASK DesiredAccess,
2301  _In_ ACCESS_MASK GrantedAccess,
2302  _In_opt_ PPRIVILEGE_SET Privileges,
2303  _In_ BOOLEAN ObjectCreation,
2304  _In_ BOOLEAN AccessGranted,
2305  _Out_ PBOOLEAN GenerateOnClose
2306  );
2307 
2308 NTSYSCALLAPI
2309 NTSTATUS
2310 NTAPI
2311 ZwOpenPartition(
2312  _Out_ PHANDLE PartitionHandle,
2313  _In_ ACCESS_MASK DesiredAccess,
2314  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2315  );
2316 
2317 NTSYSCALLAPI
2318 NTSTATUS
2319 NTAPI
2320 ZwOpenPrivateNamespace(
2321  _Out_ PHANDLE NamespaceHandle,
2322  _In_ ACCESS_MASK DesiredAccess,
2323  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
2324  _In_ PVOID BoundaryDescriptor
2325  );
2326 
2327 NTSYSCALLAPI
2328 NTSTATUS
2329 NTAPI
2330 ZwOpenProcess(
2331  _Out_ PHANDLE ProcessHandle,
2332  _In_ ACCESS_MASK DesiredAccess,
2333  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2334  _In_opt_ PCLIENT_ID ClientId
2335  );
2336 
2337 NTSYSCALLAPI
2338 NTSTATUS
2339 NTAPI
2340 ZwOpenProcessToken(
2341  _In_ HANDLE ProcessHandle,
2342  _In_ ACCESS_MASK DesiredAccess,
2343  _Out_ PHANDLE TokenHandle
2344  );
2345 
2346 NTSYSCALLAPI
2347 NTSTATUS
2348 NTAPI
2349 ZwOpenProcessTokenEx(
2350  _In_ HANDLE ProcessHandle,
2351  _In_ ACCESS_MASK DesiredAccess,
2352  _In_ ULONG HandleAttributes,
2353  _Out_ PHANDLE TokenHandle
2354  );
2355 
2356 NTSYSCALLAPI
2357 NTSTATUS
2358 NTAPI
2359 ZwOpenResourceManager(
2360  _Out_ PHANDLE ResourceManagerHandle,
2361  _In_ ACCESS_MASK DesiredAccess,
2362  _In_ HANDLE TmHandle,
2363  _In_opt_ LPGUID ResourceManagerGuid,
2364  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
2365  );
2366 
2367 NTSYSCALLAPI
2368 NTSTATUS
2369 NTAPI
2370 ZwOpenSection(
2371  _Out_ PHANDLE SectionHandle,
2372  _In_ ACCESS_MASK DesiredAccess,
2373  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2374  );
2375 
2376 NTSYSCALLAPI
2377 NTSTATUS
2378 NTAPI
2379 ZwOpenSemaphore(
2380  _Out_ PHANDLE SemaphoreHandle,
2381  _In_ ACCESS_MASK DesiredAccess,
2382  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2383  );
2384 
2385 NTSYSCALLAPI
2386 NTSTATUS
2387 NTAPI
2388 ZwOpenSession(
2389  _Out_ PHANDLE SessionHandle,
2390  _In_ ACCESS_MASK DesiredAccess,
2391  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2392  );
2393 
2394 NTSYSCALLAPI
2395 NTSTATUS
2396 NTAPI
2397 ZwOpenSiloObject(
2398  _Out_ PHANDLE SiloHandle,
2399  _In_ ACCESS_MASK DesiredAccess,
2400  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2401  _In_opt_ HANDLE SiloId
2402  );
2403 
2404 NTSYSCALLAPI
2405 NTSTATUS
2406 NTAPI
2407 ZwOpenSymbolicLinkObject(
2408  _Out_ PHANDLE LinkHandle,
2409  _In_ ACCESS_MASK DesiredAccess,
2410  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2411  );
2412 
2413 NTSYSCALLAPI
2414 NTSTATUS
2415 NTAPI
2416 ZwOpenThread(
2417  _Out_ PHANDLE ThreadHandle,
2418  _In_ ACCESS_MASK DesiredAccess,
2419  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2420  _In_opt_ PCLIENT_ID ClientId
2421  );
2422 
2423 NTSYSCALLAPI
2424 NTSTATUS
2425 NTAPI
2426 ZwOpenThreadToken(
2427  _In_ HANDLE ThreadHandle,
2428  _In_ ACCESS_MASK DesiredAccess,
2429  _In_ BOOLEAN OpenAsSelf,
2430  _Out_ PHANDLE TokenHandle
2431  );
2432 
2433 NTSYSCALLAPI
2434 NTSTATUS
2435 NTAPI
2436 ZwOpenThreadTokenEx(
2437  _In_ HANDLE ThreadHandle,
2438  _In_ ACCESS_MASK DesiredAccess,
2439  _In_ BOOLEAN OpenAsSelf,
2440  _In_ ULONG HandleAttributes,
2441  _Out_ PHANDLE TokenHandle
2442  );
2443 
2444 NTSYSCALLAPI
2445 NTSTATUS
2446 NTAPI
2447 ZwOpenTimer(
2448  _Out_ PHANDLE TimerHandle,
2449  _In_ ACCESS_MASK DesiredAccess,
2450  _In_ POBJECT_ATTRIBUTES ObjectAttributes
2451  );
2452 
2453 NTSYSCALLAPI
2454 NTSTATUS
2455 NTAPI
2456 ZwOpenTransaction(
2457  _Out_ PHANDLE TransactionHandle,
2458  _In_ ACCESS_MASK DesiredAccess,
2459  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2460  _In_ LPGUID Uow,
2461  _In_opt_ HANDLE TmHandle
2462  );
2463 
2464 NTSYSCALLAPI
2465 NTSTATUS
2466 NTAPI
2467 ZwOpenTransactionManager(
2468  _Out_ PHANDLE TmHandle,
2469  _In_ ACCESS_MASK DesiredAccess,
2470  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
2471  _In_opt_ PUNICODE_STRING LogFileName,
2472  _In_opt_ LPGUID TmIdentity,
2473  _In_opt_ ULONG OpenOptions
2474  );
2475 
2476 NTSYSCALLAPI
2477 NTSTATUS
2478 NTAPI
2479 ZwPlugPlayControl(
2480  _In_ PLUGPLAY_CONTROL_CLASS PnPControlClass,
2481  _Inout_updates_bytes_(PnPControlDataLength) PVOID PnPControlData,
2482  _In_ ULONG PnPControlDataLength
2483  );
2484 
2485 NTSYSCALLAPI
2486 NTSTATUS
2487 NTAPI
2488 ZwPowerInformation(
2489  _In_ POWER_INFORMATION_LEVEL InformationLevel,
2490  _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
2491  _In_ ULONG InputBufferLength,
2492  _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
2493  _In_ ULONG OutputBufferLength
2494  );
2495 
2496 NTSYSCALLAPI
2497 NTSTATUS
2498 NTAPI
2499 ZwPrePrepareComplete(
2500  _In_ HANDLE EnlistmentHandle,
2501  _In_opt_ PLARGE_INTEGER TmVirtualClock
2502  );
2503 
2504 NTSYSCALLAPI
2505 NTSTATUS
2506 NTAPI
2507 ZwPrePrepareEnlistment(
2508  _In_ HANDLE EnlistmentHandle,
2509  _In_opt_ PLARGE_INTEGER TmVirtualClock
2510  );
2511 
2512 NTSYSCALLAPI
2513 NTSTATUS
2514 NTAPI
2515 ZwPrepareComplete(
2516  _In_ HANDLE EnlistmentHandle,
2517  _In_opt_ PLARGE_INTEGER TmVirtualClock
2518  );
2519 
2520 NTSYSCALLAPI
2521 NTSTATUS
2522 NTAPI
2523 ZwPrepareEnlistment(
2524  _In_ HANDLE EnlistmentHandle,
2525  _In_opt_ PLARGE_INTEGER TmVirtualClock
2526  );
2527 
2528 NTSYSCALLAPI
2529 NTSTATUS
2530 NTAPI
2531 ZwPrivilegeCheck(
2532  _In_ HANDLE ClientToken,
2533  _Inout_ PPRIVILEGE_SET RequiredPrivileges,
2534  _Out_ PBOOLEAN Result
2535  );
2536 
2537 NTSYSCALLAPI
2538 NTSTATUS
2539 NTAPI
2540 ZwPrivilegeObjectAuditAlarm(
2541  _In_ PUNICODE_STRING SubsystemName,
2542  _In_opt_ PVOID HandleId,
2543  _In_ HANDLE ClientToken,
2544  _In_ ACCESS_MASK DesiredAccess,
2545  _In_ PPRIVILEGE_SET Privileges,
2546  _In_ BOOLEAN AccessGranted
2547  );
2548 
2549 NTSYSCALLAPI
2550 NTSTATUS
2551 NTAPI
2552 ZwPrivilegedServiceAuditAlarm(
2553  _In_ PUNICODE_STRING SubsystemName,
2554  _In_ PUNICODE_STRING ServiceName,
2555  _In_ HANDLE ClientToken,
2556  _In_ PPRIVILEGE_SET Privileges,
2557  _In_ BOOLEAN AccessGranted
2558  );
2559 
2560 NTSYSCALLAPI
2561 NTSTATUS
2562 NTAPI
2563 ZwPropagationComplete(
2564  _In_ HANDLE ResourceManagerHandle,
2565  _In_ ULONG RequestCookie,
2566  _In_ ULONG BufferLength,
2567  _In_ PVOID Buffer
2568  );
2569 
2570 NTSYSCALLAPI
2571 NTSTATUS
2572 NTAPI
2573 ZwPropagationFailed(
2574  _In_ HANDLE ResourceManagerHandle,
2575  _In_ ULONG RequestCookie,
2576  _In_ NTSTATUS PropStatus
2577  );
2578 
2579 NTSYSCALLAPI
2580 NTSTATUS
2581 NTAPI
2582 ZwProtectVirtualMemory(
2583  _In_ HANDLE ProcessHandle,
2584  _Inout_ PVOID *BaseAddress,
2585  _Inout_ PSIZE_T RegionSize,
2586  _In_ ULONG NewProtect,
2587  _Out_ PULONG OldProtect
2588  );
2589 
2590 NTSYSCALLAPI
2591 NTSTATUS
2592 NTAPI
2593 ZwPulseEvent(
2594  _In_ HANDLE EventHandle,
2595  _Out_opt_ PLONG PreviousState
2596  );
2597 
2598 NTSYSCALLAPI
2599 NTSTATUS
2600 NTAPI
2601 ZwQueryAttributesFile(
2602  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2603  _Out_ PFILE_BASIC_INFORMATION FileInformation
2604  );
2605 
2606 NTSYSCALLAPI
2607 NTSTATUS
2608 NTAPI
2609 ZwQueryBootEntryOrder(
2610  _Out_writes_opt_(*Count) PULONG Ids,
2611  _Inout_ PULONG Count
2612  );
2613 
2614 NTSYSCALLAPI
2615 NTSTATUS
2616 NTAPI
2617 ZwQueryBootOptions(
2618  _Out_writes_bytes_opt_(*BootOptionsLength) PBOOT_OPTIONS BootOptions,
2619  _Inout_ PULONG BootOptionsLength
2620  );
2621 
2622 NTSYSCALLAPI
2623 NTSTATUS
2624 NTAPI
2625 ZwQueryDebugFilterState(
2626  _In_ ULONG ComponentId,
2627  _In_ ULONG Level
2628  );
2629 
2630 NTSYSCALLAPI
2631 NTSTATUS
2632 NTAPI
2633 ZwQueryDefaultLocale(
2634  _In_ BOOLEAN UserProfile,
2635  _Out_ PLCID DefaultLocaleId
2636  );
2637 
2638 NTSYSCALLAPI
2639 NTSTATUS
2640 NTAPI
2641 ZwQueryDefaultUILanguage(
2642  _Out_ LANGID *DefaultUILanguageId
2643  );
2644 
2645 NTSYSCALLAPI
2646 NTSTATUS
2647 NTAPI
2648 ZwQueryDirectoryFile(
2649  _In_ HANDLE FileHandle,
2650  _In_opt_ HANDLE Event,
2651  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
2652  _In_opt_ PVOID ApcContext,
2653  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2654  _Out_writes_bytes_(Length) PVOID FileInformation,
2655  _In_ ULONG Length,
2656  _In_ FILE_INFORMATION_CLASS FileInformationClass,
2657  _In_ BOOLEAN ReturnSingleEntry,
2658  _In_opt_ PUNICODE_STRING FileName,
2659  _In_ BOOLEAN RestartScan
2660  );
2661 
2662 NTSYSCALLAPI
2663 NTSTATUS
2664 NTAPI
2665 ZwQueryDirectoryObject(
2666  _In_ HANDLE DirectoryHandle,
2667  _Out_writes_bytes_opt_(Length) PVOID Buffer,
2668  _In_ ULONG Length,
2669  _In_ BOOLEAN ReturnSingleEntry,
2670  _In_ BOOLEAN RestartScan,
2671  _Inout_ PULONG Context,
2672  _Out_opt_ PULONG ReturnLength
2673  );
2674 
2675 NTSYSCALLAPI
2676 NTSTATUS
2677 NTAPI
2678 ZwQueryDriverEntryOrder(
2679  _Out_writes_opt_(*Count) PULONG Ids,
2680  _Inout_ PULONG Count
2681  );
2682 
2683 NTSYSCALLAPI
2684 NTSTATUS
2685 NTAPI
2686 ZwQueryEaFile(
2687  _In_ HANDLE FileHandle,
2688  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2689  _Out_writes_bytes_(Length) PVOID Buffer,
2690  _In_ ULONG Length,
2691  _In_ BOOLEAN ReturnSingleEntry,
2692  _In_reads_bytes_opt_(EaListLength) PVOID EaList,
2693  _In_ ULONG EaListLength,
2694  _In_opt_ PULONG EaIndex,
2695  _In_ BOOLEAN RestartScan
2696  );
2697 
2698 NTSYSCALLAPI
2699 NTSTATUS
2700 NTAPI
2701 ZwQueryEvent(
2702  _In_ HANDLE EventHandle,
2703  _In_ EVENT_INFORMATION_CLASS EventInformationClass,
2704  _Out_writes_bytes_(EventInformationLength) PVOID EventInformation,
2705  _In_ ULONG EventInformationLength,
2706  _Out_opt_ PULONG ReturnLength
2707  );
2708 
2709 NTSYSCALLAPI
2710 NTSTATUS
2711 NTAPI
2712 ZwQueryFullAttributesFile(
2713  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
2714  _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation
2715  );
2716 
2717 NTSYSCALLAPI
2718 NTSTATUS
2719 NTAPI
2720 ZwQueryInformationAtom(
2721  _In_ RTL_ATOM Atom,
2722  _In_ ATOM_INFORMATION_CLASS AtomInformationClass,
2723  _Out_writes_bytes_(AtomInformationLength) PVOID AtomInformation,
2724  _In_ ULONG AtomInformationLength,
2725  _Out_opt_ PULONG ReturnLength
2726  );
2727 
2728 NTSYSCALLAPI
2729 NTSTATUS
2730 NTAPI
2731 ZwQueryInformationEnlistment(
2732  _In_ HANDLE EnlistmentHandle,
2733  _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
2734  _Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
2735  _In_ ULONG EnlistmentInformationLength,
2736  _Out_opt_ PULONG ReturnLength
2737  );
2738 
2739 NTSYSCALLAPI
2740 NTSTATUS
2741 NTAPI
2742 ZwQueryInformationFile(
2743  _In_ HANDLE FileHandle,
2744  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2745  _Out_writes_bytes_(Length) PVOID FileInformation,
2746  _In_ ULONG Length,
2747  _In_ FILE_INFORMATION_CLASS FileInformationClass
2748  );
2749 
2750 NTSYSCALLAPI
2751 NTSTATUS
2752 NTAPI
2753 ZwQueryInformationJobObject(
2754  _In_opt_ HANDLE JobHandle,
2755  _In_ JOBOBJECTINFOCLASS JobObjectInformationClass,
2756  _Out_writes_bytes_(JobObjectInformationLength) PVOID JobObjectInformation,
2757  _In_ ULONG JobObjectInformationLength,
2758  _Out_opt_ PULONG ReturnLength
2759  );
2760 
2761 NTSYSCALLAPI
2762 NTSTATUS
2763 NTAPI
2764 ZwQueryInformationPort(
2765  _In_ HANDLE PortHandle,
2766  _In_ PORT_INFORMATION_CLASS PortInformationClass,
2767  _Out_writes_bytes_to_(Length, *ReturnLength) PVOID PortInformation,
2768  _In_ ULONG Length,
2769  _Out_opt_ PULONG ReturnLength
2770  );
2771 
2772 NTSYSCALLAPI
2773 NTSTATUS
2774 NTAPI
2775 ZwQueryInformationProcess(
2776  _In_ HANDLE ProcessHandle,
2777  _In_ PROCESSINFOCLASS ProcessInformationClass,
2778  _Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
2779  _In_ ULONG ProcessInformationLength,
2780  _Out_opt_ PULONG ReturnLength
2781  );
2782 
2783 NTSYSCALLAPI
2784 NTSTATUS
2785 NTAPI
2786 ZwQueryInformationResourceManager(
2787  _In_ HANDLE ResourceManagerHandle,
2788  _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
2789  _Out_writes_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
2790  _In_ ULONG ResourceManagerInformationLength,
2791  _Out_opt_ PULONG ReturnLength
2792  );
2793 
2794 NTSYSCALLAPI
2795 NTSTATUS
2796 NTAPI
2797 ZwQueryInformationSiloObject(
2798  _In_opt_ HANDLE SiloHandle,
2799  _In_ SILOOBJECTINFOCLASS SiloObjectInformationClass,
2800  _Out_writes_bytes_(SiloObjectInformationLength) PVOID SiloObjectInformation,
2801  _In_ ULONG SiloObjectInformationLength,
2802  _Out_opt_ PULONG ReturnLength
2803  );
2804 
2805 NTSYSCALLAPI
2806 NTSTATUS
2807 NTAPI
2808 ZwQueryInformationThread(
2809  _In_ HANDLE ThreadHandle,
2810  _In_ THREADINFOCLASS ThreadInformationClass,
2811  _Out_writes_bytes_(ThreadInformationLength) PVOID ThreadInformation,
2812  _In_ ULONG ThreadInformationLength,
2813  _Out_opt_ PULONG ReturnLength
2814  );
2815 
2816 NTSYSCALLAPI
2817 NTSTATUS
2818 NTAPI
2819 ZwQueryInformationToken(
2820  _In_ HANDLE TokenHandle,
2821  _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
2822  _Out_writes_bytes_(TokenInformationLength) PVOID TokenInformation,
2823  _In_ ULONG TokenInformationLength,
2824  _Out_ PULONG ReturnLength
2825  );
2826 
2827 NTSYSCALLAPI
2828 NTSTATUS
2829 NTAPI
2830 ZwQueryInformationTransaction(
2831  _In_ HANDLE TransactionHandle,
2832  _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
2833  _Out_writes_bytes_(TransactionInformationLength) PVOID TransactionInformation,
2834  _In_ ULONG TransactionInformationLength,
2835  _Out_opt_ PULONG ReturnLength
2836  );
2837 
2838 NTSYSCALLAPI
2839 NTSTATUS
2840 NTAPI
2841 ZwQueryInformationTransactionManager(
2842  _In_ HANDLE TransactionManagerHandle,
2843  _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
2844  _Out_writes_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
2845  _In_ ULONG TransactionManagerInformationLength,
2846  _Out_opt_ PULONG ReturnLength
2847  );
2848 
2849 NTSYSCALLAPI
2850 NTSTATUS
2851 NTAPI
2852 ZwQueryInformationWorkerFactory(
2853  _In_ HANDLE WorkerFactoryHandle,
2854  _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
2855  _Out_writes_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,
2856  _In_ ULONG WorkerFactoryInformationLength,
2857  _Out_opt_ PULONG ReturnLength
2858  );
2859 
2860 NTSYSCALLAPI
2861 NTSTATUS
2862 NTAPI
2863 ZwQueryInstallUILanguage(
2864  _Out_ LANGID *InstallUILanguageId
2865  );
2866 
2867 NTSYSCALLAPI
2868 NTSTATUS
2869 NTAPI
2870 ZwQueryIntervalProfile(
2871  _In_ KPROFILE_SOURCE ProfileSource,
2872  _Out_ PULONG Interval
2873  );
2874 
2875 NTSYSCALLAPI
2876 NTSTATUS
2877 NTAPI
2878 ZwQueryIoCompletion(
2879  _In_ HANDLE IoCompletionHandle,
2880  _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
2881  _Out_writes_bytes_(IoCompletionInformation) PVOID IoCompletionInformation,
2882  _In_ ULONG IoCompletionInformationLength,
2883  _Out_opt_ PULONG ReturnLength
2884  );
2885 
2886 NTSYSCALLAPI
2887 NTSTATUS
2888 NTAPI
2889 ZwQueryKey(
2890  _In_ HANDLE KeyHandle,
2891  _In_ KEY_INFORMATION_CLASS KeyInformationClass,
2892  _Out_writes_bytes_opt_(Length) PVOID KeyInformation,
2893  _In_ ULONG Length,
2894  _Out_ PULONG ResultLength
2895  );
2896 
2897 NTSYSCALLAPI
2898 NTSTATUS
2899 NTAPI
2900 ZwQueryLicenseValue(
2901  _In_ PUNICODE_STRING ValueName,
2902  _Out_opt_ PULONG Type,
2903  _Out_writes_bytes_to_opt_(DataSize, *ResultDataSize) PVOID Data,
2904  _In_ ULONG DataSize,
2905  _Out_ PULONG ResultDataSize
2906  );
2907 
2908 NTSYSCALLAPI
2909 NTSTATUS
2910 NTAPI
2911 ZwQueryMultipleValueKey(
2912  _In_ HANDLE KeyHandle,
2913  _Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries,
2914  _In_ ULONG EntryCount,
2915  _Out_writes_bytes_(*BufferLength) PVOID ValueBuffer,
2916  _Inout_ PULONG BufferLength,
2917  _Out_opt_ PULONG RequiredBufferLength
2918  );
2919 
2920 NTSYSCALLAPI
2921 NTSTATUS
2922 NTAPI
2923 ZwQueryMutant(
2924  _In_ HANDLE MutantHandle,
2925  _In_ MUTANT_INFORMATION_CLASS MutantInformationClass,
2926  _Out_writes_bytes_(MutantInformationLength) PVOID MutantInformation,
2927  _In_ ULONG MutantInformationLength,
2928  _Out_opt_ PULONG ReturnLength
2929  );
2930 
2931 NTSYSCALLAPI
2932 NTSTATUS
2933 NTAPI
2934 ZwQueryObject(
2935  _In_ HANDLE Handle,
2936  _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
2937  _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
2938  _In_ ULONG ObjectInformationLength,
2939  _Out_opt_ PULONG ReturnLength
2940  );
2941 
2942 NTSYSCALLAPI
2943 NTSTATUS
2944 NTAPI
2945 ZwQueryOpenSubKeys(
2946  _In_ POBJECT_ATTRIBUTES TargetKey,
2947  _Out_ PULONG HandleCount
2948  );
2949 
2950 NTSYSCALLAPI
2951 NTSTATUS
2952 NTAPI
2953 ZwQueryOpenSubKeysEx(
2954  _In_ POBJECT_ATTRIBUTES TargetKey,
2955  _In_ ULONG BufferLength,
2956  _Out_writes_bytes_(BufferLength) PVOID Buffer,
2957  _Out_ PULONG RequiredSize
2958  );
2959 
2960 NTSYSCALLAPI
2961 NTSTATUS
2962 NTAPI
2963 ZwQueryPerformanceCounter(
2964  _Out_ PLARGE_INTEGER PerformanceCounter,
2965  _Out_opt_ PLARGE_INTEGER PerformanceFrequency
2966  );
2967 
2968 NTSYSCALLAPI
2969 NTSTATUS
2970 NTAPI
2971 ZwQueryPortInformationProcess(
2972  VOID
2973  );
2974 
2975 NTSYSCALLAPI
2976 NTSTATUS
2977 NTAPI
2978 ZwQueryQuotaInformationFile(
2979  _In_ HANDLE FileHandle,
2980  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
2981  _Out_writes_bytes_(Length) PVOID Buffer,
2982  _In_ ULONG Length,
2983  _In_ BOOLEAN ReturnSingleEntry,
2984  _In_reads_bytes_opt_(SidListLength) PVOID SidList,
2985  _In_ ULONG SidListLength,
2986  _In_opt_ PSID StartSid,
2987  _In_ BOOLEAN RestartScan
2988  );
2989 
2990 NTSYSCALLAPI
2991 NTSTATUS
2992 NTAPI
2993 ZwQuerySection(
2994  _In_ HANDLE SectionHandle,
2995  _In_ SECTION_INFORMATION_CLASS SectionInformationClass,
2996  _Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation,
2997  _In_ SIZE_T SectionInformationLength,
2998  _Out_opt_ PSIZE_T ReturnLength
2999  );
3000 
3001 NTSYSCALLAPI
3002 NTSTATUS
3003 NTAPI
3004 ZwQuerySecurityAttributesToken(
3005  _In_ HANDLE TokenHandle,
3006  _In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,
3007  _In_ ULONG NumberOfAttributes,
3008  _Out_writes_bytes_(Length) PVOID Buffer, // PTOKEN_SECURITY_ATTRIBUTES_INFORMATION
3009  _In_ ULONG Length,
3010  _Out_ PULONG ReturnLength
3011  );
3012 
3013 NTSYSCALLAPI
3014 NTSTATUS
3015 NTAPI
3016 ZwQuerySecurityObject(
3017  _In_ HANDLE Handle,
3018  _In_ SECURITY_INFORMATION SecurityInformation,
3019  _Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
3020  _In_ ULONG Length,
3021  _Out_ PULONG LengthNeeded
3022  );
3023 
3024 NTSYSCALLAPI
3025 NTSTATUS
3026 NTAPI
3027 ZwQuerySemaphore(
3028  _In_ HANDLE SemaphoreHandle,
3029  _In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
3030  _Out_writes_bytes_(SemaphoreInformationLength) PVOID SemaphoreInformation,
3031  _In_ ULONG SemaphoreInformationLength,
3032  _Out_opt_ PULONG ReturnLength
3033  );
3034 
3035 NTSYSCALLAPI
3036 NTSTATUS
3037 NTAPI
3038 ZwQuerySymbolicLinkObject(
3039  _In_ HANDLE LinkHandle,
3040  _Inout_ PUNICODE_STRING LinkTarget,
3041  _Out_opt_ PULONG ReturnedLength
3042  );
3043 
3044 NTSYSCALLAPI
3045 NTSTATUS
3046 NTAPI
3047 ZwQuerySystemEnvironmentValue(
3048  _In_ PUNICODE_STRING VariableName,
3049  _Out_writes_bytes_(ValueLength) PWSTR VariableValue,
3050  _In_ USHORT ValueLength,
3051  _Out_opt_ PUSHORT ReturnLength
3052  );
3053 
3054 NTSYSCALLAPI
3055 NTSTATUS
3056 NTAPI
3057 ZwQuerySystemEnvironmentValueEx(
3058  _In_ PUNICODE_STRING VariableName,
3059  _In_ LPGUID VendorGuid,
3060  _Out_writes_bytes_opt_(*ValueLength) PVOID Value,
3061  _Inout_ PULONG ValueLength,
3062  _Out_opt_ PULONG Attributes
3063  );
3064 
3065 NTSYSCALLAPI
3066 NTSTATUS
3067 NTAPI
3068 ZwQuerySystemInformation(
3069  _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
3070  _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
3071  _In_ ULONG SystemInformationLength,
3072  _Out_opt_ PULONG ReturnLength
3073  );
3074 
3075 NTSYSCALLAPI
3076 NTSTATUS
3077 NTAPI
3078 ZwQuerySystemInformationEx(
3079  _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
3080  _In_reads_bytes_(InputBufferLength) PVOID InputBuffer,
3081  _In_ ULONG InputBufferLength,
3082  _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
3083  _In_ ULONG SystemInformationLength,
3084  _Out_opt_ PULONG ReturnLength
3085  );
3086 
3087 NTSYSCALLAPI
3088 NTSTATUS
3089 NTAPI
3090 ZwQuerySystemTime(
3091  _Out_ PLARGE_INTEGER SystemTime
3092  );
3093 
3094 NTSYSCALLAPI
3095 NTSTATUS
3096 NTAPI
3097 ZwQueryTimer(
3098  _In_ HANDLE TimerHandle,
3099  _In_ TIMER_INFORMATION_CLASS TimerInformationClass,
3100  _Out_writes_bytes_(TimerInformationLength) PVOID TimerInformation,
3101  _In_ ULONG TimerInformationLength,
3102  _Out_opt_ PULONG ReturnLength
3103  );
3104 
3105 NTSYSCALLAPI
3106 NTSTATUS
3107 NTAPI
3108 ZwQueryTimerResolution(
3109  _Out_ PULONG MaximumTime,
3110  _Out_ PULONG MinimumTime,
3111  _Out_ PULONG CurrentTime
3112  );
3113 
3114 NTSYSCALLAPI
3115 NTSTATUS
3116 NTAPI
3117 ZwQueryValueKey(
3118  _In_ HANDLE KeyHandle,
3119  _In_ PUNICODE_STRING ValueName,
3120  _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
3121  _Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,
3122  _In_ ULONG Length,
3123  _Out_ PULONG ResultLength
3124  );
3125 
3126 NTSYSCALLAPI
3127 NTSTATUS
3128 NTAPI
3129 ZwQueryVirtualMemory(
3130  _In_ HANDLE ProcessHandle,
3131  _In_ PVOID BaseAddress,
3132  _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
3133  _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
3134  _In_ SIZE_T MemoryInformationLength,
3135  _Out_opt_ PSIZE_T ReturnLength
3136  );
3137 
3138 NTSYSCALLAPI
3139 NTSTATUS
3140 NTAPI
3141 ZwQueryVolumeInformationFile(
3142  _In_ HANDLE FileHandle,
3143  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3144  _Out_writes_bytes_(Length) PVOID FsInformation,
3145  _In_ ULONG Length,
3146  _In_ FSINFOCLASS FsInformationClass
3147  );
3148 
3149 NTSYSCALLAPI
3150 NTSTATUS
3151 NTAPI
3152 ZwQueryWnfStateData(
3153  _In_ PCWNF_STATE_NAME StateName,
3154  _In_opt_ PCWNF_TYPE_ID TypeId,
3155  _In_opt_ const VOID* ExplicitScope,
3156  _Out_ PWNF_CHANGE_STAMP ChangeStamp,
3157  _Out_writes_bytes_to_opt_(*BufferSize, *BufferSize) PVOID Buffer,
3158  _Inout_ PULONG BufferSize
3159  );
3160 
3161 NTSYSCALLAPI
3162 NTSTATUS
3163 NTAPI
3164 ZwQueryWnfStateNameInformation(
3165  _In_ PCWNF_STATE_NAME StateName,
3166  _In_ WNF_STATE_NAME_INFORMATION NameInfoClass,
3167  _In_opt_ const PVOID ExplicitScope,
3168  _Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer,
3169  _In_ ULONG InfoBufferSize
3170  );
3171 
3172 NTSYSCALLAPI
3173 NTSTATUS
3174 NTAPI
3175 ZwQueueApcThread(
3176  _In_ HANDLE ThreadHandle,
3177  _In_ PPS_APC_ROUTINE ApcRoutine,
3178  _In_opt_ PVOID ApcArgument1,
3179  _In_opt_ PVOID ApcArgument2,
3180  _In_opt_ PVOID ApcArgument3
3181  );
3182 
3183 NTSYSCALLAPI
3184 NTSTATUS
3185 NTAPI
3186 ZwQueueApcThreadEx(
3187  _In_ HANDLE ThreadHandle,
3188  _In_opt_ HANDLE UserApcReserveHandle,
3189  _In_ PPS_APC_ROUTINE ApcRoutine,
3190  _In_opt_ PVOID ApcArgument1,
3191  _In_opt_ PVOID ApcArgument2,
3192  _In_opt_ PVOID ApcArgument3
3193  );
3194 
3195 NTSYSCALLAPI
3196 NTSTATUS
3197 NTAPI
3198 ZwRaiseException(
3199  _In_ PEXCEPTION_RECORD ExceptionRecord,
3200  _In_ PCONTEXT ContextRecord,
3201  _In_ BOOLEAN FirstChance
3202  );
3203 
3204 NTSYSCALLAPI
3205 NTSTATUS
3206 NTAPI
3207 ZwRaiseHardError(
3208  _In_ NTSTATUS ErrorStatus,
3209  _In_ ULONG NumberOfParameters,
3210  _In_ ULONG UnicodeStringParameterMask,
3211  _In_reads_(NumberOfParameters) PULONG_PTR Parameters,
3212  _In_ ULONG ValidResponseOptions,
3213  _Out_ PULONG Response
3214  );
3215 
3216 NTSYSCALLAPI
3217 NTSTATUS
3218 NTAPI
3219 ZwReadFile(
3220  _In_ HANDLE FileHandle,
3221  _In_opt_ HANDLE Event,
3222  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
3223  _In_opt_ PVOID ApcContext,
3224  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3225  _Out_writes_bytes_(Length) PVOID Buffer,
3226  _In_ ULONG Length,
3227  _In_opt_ PLARGE_INTEGER ByteOffset,
3228  _In_opt_ PULONG Key
3229  );
3230 
3231 NTSYSCALLAPI
3232 NTSTATUS
3233 NTAPI
3234 ZwReadFileScatter(
3235  _In_ HANDLE FileHandle,
3236  _In_opt_ HANDLE Event,
3237  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
3238  _In_opt_ PVOID ApcContext,
3239  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3240  _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
3241  _In_ ULONG Length,
3242  _In_opt_ PLARGE_INTEGER ByteOffset,
3243  _In_opt_ PULONG Key
3244  );
3245 
3246 NTSYSCALLAPI
3247 NTSTATUS
3248 NTAPI
3249 ZwReadOnlyEnlistment(
3250  _In_ HANDLE EnlistmentHandle,
3251  _In_opt_ PLARGE_INTEGER TmVirtualClock
3252  );
3253 
3254 NTSYSCALLAPI
3255 NTSTATUS
3256 NTAPI
3257 ZwReadRequestData(
3258  _In_ HANDLE PortHandle,
3259  _In_ PPORT_MESSAGE Message,
3260  _In_ ULONG DataEntryIndex,
3261  _Out_writes_bytes_to_(BufferSize, *NumberOfBytesRead) PVOID Buffer,
3262  _In_ SIZE_T BufferSize,
3263  _Out_opt_ PSIZE_T NumberOfBytesRead
3264  );
3265 
3266 NTSYSCALLAPI
3267 NTSTATUS
3268 NTAPI
3269 ZwReadVirtualMemory(
3270  _In_ HANDLE ProcessHandle,
3271  _In_opt_ PVOID BaseAddress,
3272  _Out_writes_bytes_(BufferSize) PVOID Buffer,
3273  _In_ SIZE_T BufferSize,
3274  _Out_opt_ PSIZE_T NumberOfBytesRead
3275  );
3276 
3277 NTSYSCALLAPI
3278 NTSTATUS
3279 NTAPI
3280 ZwRecoverEnlistment(
3281  _In_ HANDLE EnlistmentHandle,
3282  _In_opt_ PVOID EnlistmentKey
3283  );
3284 
3285 NTSYSCALLAPI
3286 NTSTATUS
3287 NTAPI
3288 ZwRecoverResourceManager(
3289  _In_ HANDLE ResourceManagerHandle
3290  );
3291 
3292 NTSYSCALLAPI
3293 NTSTATUS
3294 NTAPI
3295 ZwRecoverTransactionManager(
3296  _In_ HANDLE TransactionManagerHandle
3297  );
3298 
3299 NTSYSCALLAPI
3300 NTSTATUS
3301 NTAPI
3302 ZwRegisterProtocolAddressInformation(
3303  _In_ HANDLE ResourceManager,
3304  _In_ PCRM_PROTOCOL_ID ProtocolId,
3305  _In_ ULONG ProtocolInformationSize,
3306  _In_ PVOID ProtocolInformation,
3307  _In_opt_ ULONG CreateOptions
3308  );
3309 
3310 NTSYSCALLAPI
3311 NTSTATUS
3312 NTAPI
3313 ZwRegisterThreadTerminatePort(
3314  _In_ HANDLE PortHandle
3315  );
3316 
3317 NTSYSCALLAPI
3318 NTSTATUS
3319 NTAPI
3320 ZwReleaseCMFViewOwnership(
3321  VOID
3322  );
3323 
3324 NTSYSCALLAPI
3325 NTSTATUS
3326 NTAPI
3327 ZwReleaseKeyedEvent(
3328  _In_ HANDLE KeyedEventHandle,
3329  _In_ PVOID KeyValue,
3330  _In_ BOOLEAN Alertable,
3331  _In_opt_ PLARGE_INTEGER Timeout
3332  );
3333 
3334 NTSYSCALLAPI
3335 NTSTATUS
3336 NTAPI
3337 ZwReleaseMutant(
3338  _In_ HANDLE MutantHandle,
3339  _Out_opt_ PLONG PreviousCount
3340  );
3341 
3342 NTSYSCALLAPI
3343 NTSTATUS
3344 NTAPI
3345 ZwReleaseSemaphore(
3346  _In_ HANDLE SemaphoreHandle,
3347  _In_ LONG ReleaseCount,
3348  _Out_opt_ PLONG PreviousCount
3349  );
3350 
3351 NTSYSCALLAPI
3352 NTSTATUS
3353 NTAPI
3354 ZwReleaseWorkerFactoryWorker(
3355  _In_ HANDLE WorkerFactoryHandle
3356  );
3357 
3358 NTSYSCALLAPI
3359 NTSTATUS
3360 NTAPI
3361 ZwRemoveIoCompletion(
3362  _In_ HANDLE IoCompletionHandle,
3363  _Out_ PVOID *KeyContext,
3364  _Out_ PVOID *ApcContext,
3365  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3366  _In_opt_ PLARGE_INTEGER Timeout
3367  );
3368 
3369 NTSYSCALLAPI
3370 NTSTATUS
3371 NTAPI
3372 ZwRemoveIoCompletionEx(
3373  _In_ HANDLE IoCompletionHandle,
3374  _Out_writes_to_(Count, *NumEntriesRemoved) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,
3375  _In_ ULONG Count,
3376  _Out_ PULONG NumEntriesRemoved,
3377  _In_opt_ PLARGE_INTEGER Timeout,
3378  _In_ BOOLEAN Alertable
3379  );
3380 
3381 NTSYSCALLAPI
3382 NTSTATUS
3383 NTAPI
3384 ZwRemoveProcessDebug(
3385  _In_ HANDLE ProcessHandle,
3386  _In_ HANDLE DebugObjectHandle
3387  );
3388 
3389 NTSYSCALLAPI
3390 NTSTATUS
3391 NTAPI
3392 ZwRenameKey(
3393  _In_ HANDLE KeyHandle,
3394  _In_ PUNICODE_STRING NewName
3395  );
3396 
3397 NTSYSCALLAPI
3398 NTSTATUS
3399 NTAPI
3400 ZwRenameTransactionManager(
3401  _In_ PUNICODE_STRING LogFileName,
3402  _In_ LPGUID ExistingTransactionManagerGuid
3403  );
3404 
3405 NTSYSCALLAPI
3406 NTSTATUS
3407 NTAPI
3408 ZwReplaceKey(
3409  _In_ POBJECT_ATTRIBUTES NewFile,
3410  _In_ HANDLE TargetHandle,
3411  _In_ POBJECT_ATTRIBUTES OldFile
3412  );
3413 
3414 NTSYSCALLAPI
3415 NTSTATUS
3416 NTAPI
3417 ZwReplacePartitionUnit(
3418  _In_ PUNICODE_STRING TargetInstancePath,
3419  _In_ PUNICODE_STRING SpareInstancePath,
3420  _In_ ULONG Flags
3421  );
3422 
3423 NTSYSCALLAPI
3424 NTSTATUS
3425 NTAPI
3426 ZwReplyPort(
3427  _In_ HANDLE PortHandle,
3428  _In_reads_bytes_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage
3429  );
3430 
3431 NTSYSCALLAPI
3432 NTSTATUS
3433 NTAPI
3434 ZwReplyWaitReceivePort(
3435  _In_ HANDLE PortHandle,
3436  _Out_opt_ PVOID *PortContext,
3437  _In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,
3438  _Out_ PPORT_MESSAGE ReceiveMessage
3439  );
3440 
3441 NTSYSCALLAPI
3442 NTSTATUS
3443 NTAPI
3444 ZwReplyWaitReceivePortEx(
3445  _In_ HANDLE PortHandle,
3446  _Out_opt_ PVOID *PortContext,
3447  _In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,
3448  _Out_ PPORT_MESSAGE ReceiveMessage,
3449  _In_opt_ PLARGE_INTEGER Timeout
3450  );
3451 
3452 NTSYSCALLAPI
3453 NTSTATUS
3454 NTAPI
3455 ZwReplyWaitReplyPort(
3456  _In_ HANDLE PortHandle,
3457  _Inout_ PPORT_MESSAGE ReplyMessage
3458  );
3459 
3460 NTSYSCALLAPI
3461 NTSTATUS
3462 NTAPI
3463 ZwRequestPort(
3464  _In_ HANDLE PortHandle,
3465  _In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage
3466  );
3467 
3468 NTSYSCALLAPI
3469 NTSTATUS
3470 NTAPI
3471 ZwRequestWaitReplyPort(
3472  _In_ HANDLE PortHandle,
3473  _In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage,
3474  _Out_ PPORT_MESSAGE ReplyMessage
3475  );
3476 
3477 NTSYSCALLAPI
3478 NTSTATUS
3479 NTAPI
3480 ZwRequestWakeupLatency(
3481  _In_ LATENCY_TIME latency
3482  );
3483 
3484 NTSYSCALLAPI
3485 NTSTATUS
3486 NTAPI
3487 ZwResetEvent(
3488  _In_ HANDLE EventHandle,
3489  _Out_opt_ PLONG PreviousState
3490  );
3491 
3492 NTSYSCALLAPI
3493 NTSTATUS
3494 NTAPI
3495 ZwResetWriteWatch(
3496  _In_ HANDLE ProcessHandle,
3497  _In_ PVOID BaseAddress,
3498  _In_ SIZE_T RegionSize
3499  );
3500 
3501 NTSYSCALLAPI
3502 NTSTATUS
3503 NTAPI
3504 ZwRestoreKey(
3505  _In_ HANDLE KeyHandle,
3506  _In_ HANDLE FileHandle,
3507  _In_ ULONG Flags
3508  );
3509 
3510 NTSYSCALLAPI
3511 NTSTATUS
3512 NTAPI
3513 ZwResumeProcess(
3514  _In_ HANDLE ProcessHandle
3515  );
3516 
3517 NTSYSCALLAPI
3518 NTSTATUS
3519 NTAPI
3520 ZwResumeThread(
3521  _In_ HANDLE ThreadHandle,
3522  _Out_opt_ PULONG PreviousSuspendCount
3523  );
3524 
3525 NTSYSCALLAPI
3526 NTSTATUS
3527 NTAPI
3528 ZwRevertContainerImpersonation(
3529  VOID
3530  );
3531 
3532 NTSYSCALLAPI
3533 NTSTATUS
3534 NTAPI
3535 ZwRollbackComplete(
3536  _In_ HANDLE EnlistmentHandle,
3537  _In_opt_ PLARGE_INTEGER TmVirtualClock
3538  );
3539 
3540 NTSYSCALLAPI
3541 NTSTATUS
3542 NTAPI
3543 ZwRollbackEnlistment(
3544  _In_ HANDLE EnlistmentHandle,
3545  _In_opt_ PLARGE_INTEGER TmVirtualClock
3546  );
3547 
3548 NTSYSCALLAPI
3549 NTSTATUS
3550 NTAPI
3551 ZwRollbackTransaction(
3552  _In_ HANDLE TransactionHandle,
3553  _In_ BOOLEAN Wait
3554  );
3555 
3556 NTSYSCALLAPI
3557 NTSTATUS
3558 NTAPI
3559 ZwRollforwardTransactionManager(
3560  _In_ HANDLE TransactionManagerHandle,
3561  _In_opt_ PLARGE_INTEGER TmVirtualClock
3562  );
3563 
3564 NTSYSCALLAPI
3565 NTSTATUS
3566 NTAPI
3567 ZwSaveKey(
3568  _In_ HANDLE KeyHandle,
3569  _In_ HANDLE FileHandle
3570  );
3571 
3572 NTSYSCALLAPI
3573 NTSTATUS
3574 NTAPI
3575 ZwSaveKeyEx(
3576  _In_ HANDLE KeyHandle,
3577  _In_ HANDLE FileHandle,
3578  _In_ ULONG Format
3579  );
3580 
3581 NTSYSCALLAPI
3582 NTSTATUS
3583 NTAPI
3584 ZwSaveMergedKeys(
3585  _In_ HANDLE HighPrecedenceKeyHandle,
3586  _In_ HANDLE LowPrecedenceKeyHandle,
3587  _In_ HANDLE FileHandle
3588  );
3589 
3590 NTSYSCALLAPI
3591 NTSTATUS
3592 NTAPI
3593 ZwSecureConnectPort(
3594  _Out_ PHANDLE PortHandle,
3595  _In_ PUNICODE_STRING PortName,
3596  _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
3597  _Inout_opt_ PPORT_VIEW ClientView,
3598  _In_opt_ PSID RequiredServerSid,
3599  _Inout_opt_ PREMOTE_PORT_VIEW ServerView,
3600  _Out_opt_ PULONG MaxMessageLength,
3601  _Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,
3602  _Inout_opt_ PULONG ConnectionInformationLength
3603  );
3604 
3605 NTSYSCALLAPI
3606 NTSTATUS
3607 NTAPI
3608 ZwSerializeBoot(
3609  VOID
3610  );
3611 
3612 NTSYSCALLAPI
3613 NTSTATUS
3614 NTAPI
3615 ZwSetBootEntryOrder(
3616  _In_reads_(Count) PULONG Ids,
3617  _In_ ULONG Count
3618  );
3619 
3620 NTSYSCALLAPI
3621 NTSTATUS
3622 NTAPI
3623 ZwSetBootOptions(
3624  _In_ PBOOT_OPTIONS BootOptions,
3625  _In_ ULONG FieldsToChange
3626  );
3627 
3628 NTSYSCALLAPI
3629 NTSTATUS
3630 NTAPI
3631 ZwSetCachedSigningLevel(
3632  _In_ ULONG Flags,
3633  _In_ SE_SIGNING_LEVEL InputSigningLevel,
3634  _In_reads_(SourceFileCount) PHANDLE SourceFiles,
3635  _In_ ULONG SourceFileCount,
3636  _In_opt_ HANDLE TargetFile
3637  );
3638 
3639 NTSYSCALLAPI
3640 NTSTATUS
3641 NTAPI
3642 ZwSetContextThread(
3643  _In_ HANDLE ThreadHandle,
3644  _In_ PCONTEXT ThreadContext
3645  );
3646 
3647 NTSYSCALLAPI
3648 NTSTATUS
3649 NTAPI
3650 ZwSetDebugFilterState(
3651  _In_ ULONG ComponentId,
3652  _In_ ULONG Level,
3653  _In_ BOOLEAN State
3654  );
3655 
3656 NTSYSCALLAPI
3657 NTSTATUS
3658 NTAPI
3659 ZwSetDefaultHardErrorPort(
3660  _In_ HANDLE DefaultHardErrorPort
3661  );
3662 
3663 NTSYSCALLAPI
3664 NTSTATUS
3665 NTAPI
3666 ZwSetDefaultLocale(
3667  _In_ BOOLEAN UserProfile,
3668  _In_ LCID DefaultLocaleId
3669  );
3670 
3671 NTSYSCALLAPI
3672 NTSTATUS
3673 NTAPI
3674 ZwSetDefaultUILanguage(
3675  _In_ LANGID DefaultUILanguageId
3676  );
3677 
3678 NTSYSCALLAPI
3679 NTSTATUS
3680 NTAPI
3681 ZwSetDriverEntryOrder(
3682  _In_reads_(Count) PULONG Ids,
3683  _In_ ULONG Count
3684  );
3685 
3686 NTSYSCALLAPI
3687 NTSTATUS
3688 NTAPI
3689 ZwSetEaFile(
3690  _In_ HANDLE FileHandle,
3691  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3692  _In_reads_bytes_(Length) PVOID Buffer,
3693  _In_ ULONG Length
3694  );
3695 
3696 NTSYSCALLAPI
3697 NTSTATUS
3698 NTAPI
3699 ZwSetEvent(
3700  _In_ HANDLE EventHandle,
3701  _Out_opt_ PLONG PreviousState
3702  );
3703 
3704 NTSYSCALLAPI
3705 NTSTATUS
3706 NTAPI
3707 ZwSetEventBoostPriority(
3708  _In_ HANDLE EventHandle
3709  );
3710 
3711 NTSYSCALLAPI
3712 NTSTATUS
3713 NTAPI
3714 ZwSetHighEventPair(
3715  _In_ HANDLE EventPairHandle
3716  );
3717 
3718 NTSYSCALLAPI
3719 NTSTATUS
3720 NTAPI
3721 ZwSetHighWaitLowEventPair(
3722  _In_ HANDLE EventPairHandle
3723  );
3724 
3725 NTSYSCALLAPI
3726 NTSTATUS
3727 NTAPI
3728 ZwSetIRTimer(
3729  _In_ HANDLE TimerHandle,
3730  _In_opt_ PLARGE_INTEGER DueTime
3731  );
3732 
3733 NTSYSCALLAPI
3734 NTSTATUS
3735 NTAPI
3736 ZwSetInformationDebugObject(
3737  _In_ HANDLE DebugObjectHandle,
3738  _In_ DEBUGOBJECTINFOCLASS DebugObjectInformationClass,
3739  _In_ PVOID DebugInformation,
3740  _In_ ULONG DebugInformationLength,
3741  _Out_opt_ PULONG ReturnLength
3742  );
3743 
3744 NTSYSCALLAPI
3745 NTSTATUS
3746 NTAPI
3747 ZwSetInformationEnlistment(
3748  _In_opt_ HANDLE EnlistmentHandle,
3749  _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
3750  _In_reads_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
3751  _In_ ULONG EnlistmentInformationLength
3752  );
3753 
3754 NTSYSCALLAPI
3755 NTSTATUS
3756 NTAPI
3757 ZwSetInformationFile(
3758  _In_ HANDLE FileHandle,
3759  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3760  _In_reads_bytes_(Length) PVOID FileInformation,
3761  _In_ ULONG Length,
3762  _In_ FILE_INFORMATION_CLASS FileInformationClass
3763  );
3764 
3765 NTSYSCALLAPI
3766 NTSTATUS
3767 NTAPI
3768 ZwSetInformationJobObject(
3769  _In_ HANDLE JobHandle,
3770  _In_ JOBOBJECTINFOCLASS JobObjectInformationClass,
3771  _In_reads_bytes_(JobObjectInformationLength) PVOID JobObjectInformation,
3772  _In_ ULONG JobObjectInformationLength
3773  );
3774 
3775 NTSYSCALLAPI
3776 NTSTATUS
3777 NTAPI
3778 ZwSetInformationKey(
3779  _In_ HANDLE KeyHandle,
3780  _In_ KEY_SET_INFORMATION_CLASS KeySetInformationClass,
3781  _In_reads_bytes_(KeySetInformationLength) PVOID KeySetInformation,
3782  _In_ ULONG KeySetInformationLength
3783  );
3784 
3785 NTSYSCALLAPI
3786 NTSTATUS
3787 NTAPI
3788 ZwSetInformationObject(
3789  _In_ HANDLE Handle,
3790  _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
3791  _In_reads_bytes_(ObjectInformationLength) PVOID ObjectInformation,
3792  _In_ ULONG ObjectInformationLength
3793  );
3794 
3795 NTSYSCALLAPI
3796 NTSTATUS
3797 NTAPI
3798 ZwSetInformationProcess(
3799  _In_ HANDLE ProcessHandle,
3800  _In_ PROCESSINFOCLASS ProcessInformationClass,
3801  _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation,
3802  _In_ ULONG ProcessInformationLength
3803  );
3804 
3805 NTSYSCALLAPI
3806 NTSTATUS
3807 NTAPI
3808 ZwSetInformationResourceManager(
3809  _In_ HANDLE ResourceManagerHandle,
3810  _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
3811  _In_reads_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
3812  _In_ ULONG ResourceManagerInformationLength
3813  );
3814 
3815 NTSYSCALLAPI
3816 NTSTATUS
3817 NTAPI
3818 ZwSetInformationSiloObject(
3819  _In_opt_ HANDLE SiloHandle,
3820  _In_ SILOOBJECTINFOCLASS SiloObjectInformationClass,
3821  _In_reads_bytes_(SiloObjectInformationLength) PVOID SiloObjectInformation,
3822  _In_ ULONG SiloObjectInformationLength
3823  );
3824 
3825 NTSYSCALLAPI
3826 NTSTATUS
3827 NTAPI
3828 ZwSetInformationThread(
3829  _In_ HANDLE ThreadHandle,
3830  _In_ THREADINFOCLASS ThreadInformationClass,
3831  _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation,
3832  _In_ ULONG ThreadInformationLength
3833  );
3834 
3835 NTSYSCALLAPI
3836 NTSTATUS
3837 NTAPI
3838 ZwSetInformationToken(
3839  _In_ HANDLE TokenHandle,
3840  _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
3841  _In_reads_bytes_(TokenInformationLength) PVOID TokenInformation,
3842  _In_ ULONG TokenInformationLength
3843  );
3844 
3845 NTSYSCALLAPI
3846 NTSTATUS
3847 NTAPI
3848 ZwSetInformationTransaction(
3849  _In_ HANDLE TransactionHandle,
3850  _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
3851  _In_reads_bytes_(TransactionInformationLength) PVOID TransactionInformation,
3852  _In_ ULONG TransactionInformationLength
3853  );
3854 
3855 NTSYSCALLAPI
3856 NTSTATUS
3857 NTAPI
3858 ZwSetInformationTransactionManager(
3859  _In_opt_ HANDLE TmHandle,
3860  _In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
3861  _In_reads_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
3862  _In_ ULONG TransactionManagerInformationLength
3863  );
3864 
3865 NTSYSCALLAPI
3866 NTSTATUS
3867 NTAPI
3868 ZwSetInformationVirtualMemory(
3869  _In_ HANDLE ProcessHandle,
3870  _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,
3871  _In_ ULONG_PTR NumberOfEntries,
3872  _In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,
3873  _In_reads_bytes_ (VmInformationLength) PVOID VmInformation,
3874  _In_ ULONG VmInformationLength
3875  );
3876 
3877 NTSYSCALLAPI
3878 NTSTATUS
3879 NTAPI
3880 ZwSetInformationWorkerFactory(
3881  _In_ HANDLE WorkerFactoryHandle,
3882  _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
3883  _In_reads_bytes_(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,
3884  _In_ ULONG WorkerFactoryInformationLength
3885  );
3886 
3887 NTSYSCALLAPI
3888 NTSTATUS
3889 NTAPI
3890 ZwSetIntervalProfile(
3891  _In_ ULONG Interval,
3892  _In_ KPROFILE_SOURCE Source
3893  );
3894 
3895 NTSYSCALLAPI
3896 NTSTATUS
3897 NTAPI
3898 ZwSetIoCompletion(
3899  _In_ HANDLE IoCompletionHandle,
3900  _In_opt_ PVOID KeyContext,
3901  _In_opt_ PVOID ApcContext,
3902  _In_ NTSTATUS IoStatus,
3903  _In_ ULONG_PTR IoStatusInformation
3904  );
3905 
3906 NTSYSCALLAPI
3907 NTSTATUS
3908 NTAPI
3909 ZwSetIoCompletionEx(
3910  _In_ HANDLE IoCompletionHandle,
3911  _In_ HANDLE IoCompletionPacketHandle,
3912  _In_opt_ PVOID KeyContext,
3913  _In_opt_ PVOID ApcContext,
3914  _In_ NTSTATUS IoStatus,
3915  _In_ ULONG_PTR IoStatusInformation
3916  );
3917 
3918 NTSYSCALLAPI
3919 NTSTATUS
3920 NTAPI
3921 ZwSetLdtEntries(
3922  _In_ ULONG Selector0,
3923  _In_ ULONG Entry0Low,
3924  _In_ ULONG Entry0Hi,
3925  _In_ ULONG Selector1,
3926  _In_ ULONG Entry1Low,
3927  _In_ ULONG Entry1Hi
3928  );
3929 
3930 NTSYSCALLAPI
3931 NTSTATUS
3932 NTAPI
3933 ZwSetLowEventPair(
3934  _In_ HANDLE EventPairHandle
3935  );
3936 
3937 NTSYSCALLAPI
3938 NTSTATUS
3939 NTAPI
3940 ZwSetLowWaitHighEventPair(
3941  _In_ HANDLE EventPairHandle
3942  );
3943 
3944 NTSYSCALLAPI
3945 NTSTATUS
3946 NTAPI
3947 ZwSetQuotaInformationFile(
3948  _In_ HANDLE FileHandle,
3949  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
3950  _In_reads_bytes_(Length) PVOID Buffer,
3951  _In_ ULONG Length
3952  );
3953 
3954 NTSYSCALLAPI
3955 NTSTATUS
3956 NTAPI
3957 ZwSetSecurityObject(
3958  _In_ HANDLE Handle,
3959  _In_ SECURITY_INFORMATION SecurityInformation,
3960  _In_ PSECURITY_DESCRIPTOR SecurityDescriptor
3961  );
3962 
3963 NTSYSCALLAPI
3964 NTSTATUS
3965 NTAPI
3966 ZwSetSystemEnvironmentValue(
3967  _In_ PUNICODE_STRING VariableName,
3968  _In_ PUNICODE_STRING VariableValue
3969  );
3970 
3971 NTSYSCALLAPI
3972 NTSTATUS
3973 NTAPI
3974 ZwSetSystemEnvironmentValueEx(
3975  _In_ PUNICODE_STRING VariableName,
3976  _In_ LPGUID VendorGuid,
3977  _In_reads_bytes_opt_(ValueLength) PVOID Value,
3978  _In_ ULONG ValueLength,
3979  _In_ ULONG Attributes
3980  );
3981 
3982 NTSYSCALLAPI
3983 NTSTATUS
3984 NTAPI
3985 ZwSetSystemInformation(
3986  _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
3987  _In_reads_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
3988  _In_ ULONG SystemInformationLength
3989  );
3990 
3991 NTSYSCALLAPI
3992 NTSTATUS
3993 NTAPI
3994 ZwSetSystemPowerState(
3995  _In_ POWER_ACTION SystemAction,
3996  _In_ SYSTEM_POWER_STATE LightestSystemState,
3997  _In_ ULONG Flags // POWER_ACTION_* flags
3998  );
3999 
4000 NTSYSCALLAPI
4001 NTSTATUS
4002 NTAPI
4003 ZwSetSystemTime(
4004  _In_opt_ PLARGE_INTEGER SystemTime,
4005  _Out_opt_ PLARGE_INTEGER PreviousTime
4006  );
4007 
4008 NTSYSCALLAPI
4009 NTSTATUS
4010 NTAPI
4011 ZwSetThreadExecutionState(
4012  _In_ EXECUTION_STATE NewFlags, // ES_* flags
4013  _Out_ EXECUTION_STATE *PreviousFlags
4014  );
4015 
4016 NTSYSCALLAPI
4017 NTSTATUS
4018 NTAPI
4019 ZwSetTimer(
4020  _In_ HANDLE TimerHandle,
4021  _In_ PLARGE_INTEGER DueTime,
4022  _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine,
4023  _In_opt_ PVOID TimerContext,
4024  _In_ BOOLEAN ResumeTimer,
4025  _In_opt_ LONG Period,
4026  _Out_opt_ PBOOLEAN PreviousState
4027  );
4028 
4029 NTSYSCALLAPI
4030 NTSTATUS
4031 NTAPI
4032 ZwSetTimer2(
4033  _In_ HANDLE TimerHandle,
4034  _In_ PLARGE_INTEGER DueTime,
4035  _In_opt_ PLARGE_INTEGER Period,
4036  _In_ PT2_SET_PARAMETERS Parameters
4037  );
4038 
4039 NTSYSCALLAPI
4040 NTSTATUS
4041 NTAPI
4042 ZwSetTimerEx(
4043  _In_ HANDLE TimerHandle,
4044  _In_ TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
4045  _Inout_updates_bytes_opt_(TimerSetInformationLength) PVOID TimerSetInformation,
4046  _In_ ULONG TimerSetInformationLength
4047  );
4048 
4049 NTSYSCALLAPI
4050 NTSTATUS
4051 NTAPI
4052 ZwSetTimerResolution(
4053  _In_ ULONG DesiredTime,
4054  _In_ BOOLEAN SetResolution,
4055  _Out_ PULONG ActualTime
4056  );
4057 
4058 NTSYSCALLAPI
4059 NTSTATUS
4060 NTAPI
4061 ZwSetUuidSeed(
4062  _In_ PCHAR Seed
4063  );
4064 
4065 NTSYSCALLAPI
4066 NTSTATUS
4067 NTAPI
4068 ZwSetValueKey(
4069  _In_ HANDLE KeyHandle,
4070  _In_ PUNICODE_STRING ValueName,
4071  _In_opt_ ULONG TitleIndex,
4072  _In_ ULONG Type,
4073  _In_reads_bytes_opt_(DataSize) PVOID Data,
4074  _In_ ULONG DataSize
4075  );
4076 
4077 NTSYSCALLAPI
4078 NTSTATUS
4079 NTAPI
4080 ZwSetVolumeInformationFile(
4081  _In_ HANDLE FileHandle,
4082  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
4083  _In_reads_bytes_(Length) PVOID FsInformation,
4084  _In_ ULONG Length,
4085  _In_ FSINFOCLASS FsInformationClass
4086  );
4087 
4088 NTSYSCALLAPI
4089 NTSTATUS
4090 NTAPI
4091 ZwSetWnfProcessNotificationEvent(
4092  _In_ HANDLE NotificationEvent
4093  );
4094 
4095 NTSYSCALLAPI
4096 NTSTATUS
4097 NTAPI
4098 ZwShutdownSystem(
4099  _In_ SHUTDOWN_ACTION Action
4100  );
4101 
4102 NTSYSCALLAPI
4103 NTSTATUS
4104 NTAPI
4105 ZwShutdownWorkerFactory(
4106  _In_ HANDLE WorkerFactoryHandle,
4107  _Inout_ volatile LONG *PendingWorkerCount
4108  );
4109 
4110 NTSYSCALLAPI
4111 NTSTATUS
4112 NTAPI
4113 ZwSignalAndWaitForSingleObject(
4114  _In_ HANDLE SignalHandle,
4115  _In_ HANDLE WaitHandle,
4116  _In_ BOOLEAN Alertable,
4117  _In_opt_ PLARGE_INTEGER Timeout
4118  );
4119 
4120 NTSYSCALLAPI
4121 NTSTATUS
4122 NTAPI
4123 ZwSinglePhaseReject(
4124  _In_ HANDLE EnlistmentHandle,
4125  _In_opt_ PLARGE_INTEGER TmVirtualClock
4126  );
4127 
4128 NTSYSCALLAPI
4129 NTSTATUS
4130 NTAPI
4131 ZwStartProfile(
4132  _In_ HANDLE ProfileHandle
4133  );
4134 
4135 NTSYSCALLAPI
4136 NTSTATUS
4137 NTAPI
4138 ZwStopProfile(
4139  _In_ HANDLE ProfileHandle
4140  );
4141 
4142 NTSYSCALLAPI
4143 NTSTATUS
4144 NTAPI
4145 ZwSubscribeWnfStateChange(
4146  _In_ PCWNF_STATE_NAME StateName,
4147  _In_opt_ WNF_CHANGE_STAMP ChangeStamp,
4148  _In_ ULONG EventMask,
4149  _Out_opt_ PULONG64 SubscriptionId
4150  );
4151 
4152 NTSYSCALLAPI
4153 NTSTATUS
4154 NTAPI
4155 ZwSuspendProcess(
4156  _In_ HANDLE ProcessHandle
4157  );
4158 
4159 NTSYSCALLAPI
4160 NTSTATUS
4161 NTAPI
4162 ZwSuspendThread(
4163  _In_ HANDLE ThreadHandle,
4164  _Out_opt_ PULONG PreviousSuspendCount
4165  );
4166 
4167 NTSYSCALLAPI
4168 NTSTATUS
4169 NTAPI
4170 ZwSystemDebugControl(
4171  _In_ SYSDBG_COMMAND Command,
4172  _Inout_updates_bytes_opt_(InputBufferLength) PVOID InputBuffer,
4173  _In_ ULONG InputBufferLength,
4174  _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
4175  _In_ ULONG OutputBufferLength,
4176  _Out_opt_ PULONG ReturnLength
4177  );
4178 
4179 NTSYSCALLAPI
4180 NTSTATUS
4181 NTAPI
4182 ZwTerminateJobObject(
4183  _In_ HANDLE JobHandle,
4184  _In_ NTSTATUS ExitStatus
4185  );
4186 
4187 NTSYSCALLAPI
4188 NTSTATUS
4189 NTAPI
4190 ZwTerminateProcess(
4191  _In_opt_ HANDLE ProcessHandle,
4192  _In_ NTSTATUS ExitStatus
4193  );
4194 
4195 NTSYSCALLAPI
4196 NTSTATUS
4197 NTAPI
4198 ZwTerminateSiloObject(
4199  _In_ HANDLE SiloHandle,
4200  _In_ NTSTATUS ExitStatus
4201  );
4202 
4203 NTSYSCALLAPI
4204 NTSTATUS
4205 NTAPI
4206 ZwTerminateThread(
4207  _In_opt_ HANDLE ThreadHandle,
4208  _In_ NTSTATUS ExitStatus
4209  );
4210 
4211 NTSYSCALLAPI
4212 NTSTATUS
4213 NTAPI
4214 ZwTestAlert(
4215  VOID
4216  );
4217 
4218 NTSYSCALLAPI
4219 NTSTATUS
4220 NTAPI
4221 ZwThawRegistry(
4222  VOID
4223  );
4224 
4225 NTSYSCALLAPI
4226 NTSTATUS
4227 NTAPI
4228 ZwThawTransactions(
4229  VOID
4230  );
4231 
4232 NTSYSCALLAPI
4233 NTSTATUS
4234 NTAPI
4235 ZwTraceControl(
4236  _In_ ULONG FunctionCode,
4237  _In_reads_bytes_opt_(InBufferLen) PVOID InBuffer,
4238  _In_ ULONG InBufferLen,
4239  _Out_writes_bytes_opt_(OutBufferLen) PVOID OutBuffer,
4240  _In_ ULONG OutBufferLen,
4241  _Out_ PULONG ReturnLength
4242  );
4243 
4244 NTSYSCALLAPI
4245 NTSTATUS
4246 NTAPI
4247 ZwTraceEvent(
4248  _In_ HANDLE TraceHandle,
4249  _In_ ULONG Flags,
4250  _In_ ULONG FieldSize,
4251  _In_ PVOID Fields
4252  );
4253 
4254 NTSYSCALLAPI
4255 NTSTATUS
4256 NTAPI
4257 ZwTranslateFilePath(
4258  _In_ PFILE_PATH InputFilePath,
4259  _In_ ULONG OutputType,
4260  _Out_writes_bytes_opt_(*OutputFilePathLength) PFILE_PATH OutputFilePath,
4261  _Inout_opt_ PULONG OutputFilePathLength
4262  );
4263 
4264 NTSYSCALLAPI
4265 NTSTATUS
4266 NTAPI
4267 ZwUmsThreadYield(
4268  _In_ PVOID SchedulerParam
4269  );
4270 
4271 NTSYSCALLAPI
4272 NTSTATUS
4273 NTAPI
4274 ZwUnloadDriver(
4275  _In_ PUNICODE_STRING DriverServiceName
4276  );
4277 
4278 NTSYSCALLAPI
4279 NTSTATUS
4280 NTAPI
4281 ZwUnloadKey(
4282  _In_ POBJECT_ATTRIBUTES TargetKey
4283  );
4284 
4285 NTSYSCALLAPI
4286 NTSTATUS
4287 NTAPI
4288 ZwUnloadKey2(
4289  _In_ POBJECT_ATTRIBUTES TargetKey,
4290  _In_ ULONG Flags
4291  );
4292 
4293 NTSYSCALLAPI
4294 NTSTATUS
4295 NTAPI
4296 ZwUnloadKeyEx(
4297  _In_ POBJECT_ATTRIBUTES TargetKey,
4298  _In_opt_ HANDLE Event
4299  );
4300 
4301 NTSYSCALLAPI
4302 NTSTATUS
4303 NTAPI
4304 ZwUnlockFile(
4305  _In_ HANDLE FileHandle,
4306  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
4307  _In_ PLARGE_INTEGER ByteOffset,
4308  _In_ PLARGE_INTEGER Length,
4309  _In_ ULONG Key
4310  );
4311 
4312 NTSYSCALLAPI
4313 NTSTATUS
4314 NTAPI
4315 ZwUnlockVirtualMemory(
4316  _In_ HANDLE ProcessHandle,
4317  _Inout_ PVOID *BaseAddress,
4318  _Inout_ PSIZE_T RegionSize,
4319  _In_ ULONG MapType
4320  );
4321 
4322 NTSYSCALLAPI
4323 NTSTATUS
4324 NTAPI
4325 ZwUnmapViewOfSection(
4326  _In_ HANDLE ProcessHandle,
4327  _In_opt_ PVOID BaseAddress
4328  );
4329 
4330 NTSYSCALLAPI
4331 NTSTATUS
4332 NTAPI
4333 ZwUnmapViewOfSectionEx(
4334  _In_ HANDLE ProcessHandle,
4335  _In_opt_ PVOID BaseAddress,
4336  _In_ ULONG Flags
4337  );
4338 
4339 NTSYSCALLAPI
4340 NTSTATUS
4341 NTAPI
4342 ZwUnsubscribeWnfStateChange(
4343  _In_ PCWNF_STATE_NAME StateName
4344  );
4345 
4346 NTSYSCALLAPI
4347 NTSTATUS
4348 NTAPI
4349 ZwUpdateWnfStateData(
4350  _In_ PCWNF_STATE_NAME StateName,
4351  _In_reads_bytes_opt_(Length) const VOID* Buffer,
4352  _In_opt_ ULONG Length,
4353  _In_opt_ PCWNF_TYPE_ID TypeId,
4354  _In_opt_ const PVOID ExplicitScope,
4355  _In_ WNF_CHANGE_STAMP MatchingChangeStamp,
4356  _In_ LOGICAL CheckStamp
4357  );
4358 
4359 NTSYSCALLAPI
4360 NTSTATUS
4361 NTAPI
4362 ZwVdmControl(
4363  _In_ VDMSERVICECLASS Service,
4364  _Inout_ PVOID ServiceData
4365  );
4366 
4367 NTSYSCALLAPI
4368 NTSTATUS
4369 NTAPI
4370 ZwWaitForDebugEvent(
4371  _In_ HANDLE DebugObjectHandle,
4372  _In_ BOOLEAN Alertable,
4373  _In_opt_ PLARGE_INTEGER Timeout,
4374  _Out_ PVOID WaitStateChange
4375  );
4376 
4377 NTSYSCALLAPI
4378 NTSTATUS
4379 NTAPI
4380 ZwWaitForKeyedEvent(
4381  _In_ HANDLE KeyedEventHandle,
4382  _In_ PVOID KeyValue,
4383  _In_ BOOLEAN Alertable,
4384  _In_opt_ PLARGE_INTEGER Timeout
4385  );
4386 
4387 NTSYSCALLAPI
4388 NTSTATUS
4389 NTAPI
4390 ZwWaitForMultipleObjects(
4391  _In_ ULONG Count,
4392  _In_reads_(Count) HANDLE Handles[],
4393  _In_ WAIT_TYPE WaitType,
4394  _In_ BOOLEAN Alertable,
4395  _In_opt_ PLARGE_INTEGER Timeout
4396  );
4397 
4398 NTSYSCALLAPI
4399 NTSTATUS
4400 NTAPI
4401 ZwWaitForMultipleObjects32(
4402  _In_ ULONG Count,
4403  _In_reads_(Count) LONG Handles[],
4404  _In_ WAIT_TYPE WaitType,
4405  _In_ BOOLEAN Alertable,
4406  _In_opt_ PLARGE_INTEGER Timeout
4407  );
4408 
4409 NTSYSCALLAPI
4410 NTSTATUS
4411 NTAPI
4412 ZwWaitForSingleObject(
4413  _In_ HANDLE Handle,
4414  _In_ BOOLEAN Alertable,
4415  _In_opt_ PLARGE_INTEGER Timeout
4416  );
4417 
4418 NTSYSCALLAPI
4419 NTSTATUS
4420 NTAPI
4421 ZwWaitForWorkViaWorkerFactory(
4422  _In_ HANDLE WorkerFactoryHandle,
4423  _Out_ struct _FILE_IO_COMPLETION_INFORMATION *MiniPacket
4424  );
4425 
4426 NTSYSCALLAPI
4427 NTSTATUS
4428 NTAPI
4429 ZwWaitHighEventPair(
4430  _In_ HANDLE EventPairHandle
4431  );
4432 
4433 NTSYSCALLAPI
4434 NTSTATUS
4435 NTAPI
4436 ZwWaitLowEventPair(
4437  _In_ HANDLE EventPairHandle
4438  );
4439 
4440 NTSYSCALLAPI
4441 NTSTATUS
4442 NTAPI
4443 ZwWorkerFactoryWorkerReady(
4444  _In_ HANDLE WorkerFactoryHandle
4445  );
4446 
4447 NTSYSCALLAPI
4448 NTSTATUS
4449 NTAPI
4450 ZwWriteFile(
4451  _In_ HANDLE FileHandle,
4452  _In_opt_ HANDLE Event,
4453  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
4454  _In_opt_ PVOID ApcContext,
4455  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
4456  _In_reads_bytes_(Length) PVOID Buffer,
4457  _In_ ULONG Length,
4458  _In_opt_ PLARGE_INTEGER ByteOffset,
4459  _In_opt_ PULONG Key
4460  );
4461 
4462 NTSYSCALLAPI
4463 NTSTATUS
4464 NTAPI
4465 ZwWriteFileGather(
4466  _In_ HANDLE FileHandle,
4467  _In_opt_ HANDLE Event,
4468  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
4469  _In_opt_ PVOID ApcContext,
4470  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
4471  _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
4472  _In_ ULONG Length,
4473  _In_opt_ PLARGE_INTEGER ByteOffset,
4474  _In_opt_ PULONG Key
4475  );
4476 
4477 NTSYSCALLAPI
4478 NTSTATUS
4479 NTAPI
4480 ZwWriteRequestData(
4481  _In_ HANDLE PortHandle,
4482  _In_ PPORT_MESSAGE Message,
4483  _In_ ULONG DataEntryIndex,
4484  _In_reads_bytes_(BufferSize) PVOID Buffer,
4485  _In_ SIZE_T BufferSize,
4486  _Out_opt_ PSIZE_T NumberOfBytesWritten
4487  );
4488 
4489 NTSYSCALLAPI
4490 NTSTATUS
4491 NTAPI
4492 ZwWriteVirtualMemory(
4493  _In_ HANDLE ProcessHandle,
4494  _In_opt_ PVOID BaseAddress,
4495  _In_reads_bytes_(BufferSize) PVOID Buffer,
4496  _In_ SIZE_T BufferSize,
4497  _Out_opt_ PSIZE_T NumberOfBytesWritten
4498  );
4499 
4500 NTSYSCALLAPI
4501 NTSTATUS
4502 NTAPI
4503 ZwYieldExecution(
4504  VOID
4505  );
4506 
4507 #endif