Windows API

Name Brief Stages Sample Code
NtVirtualAllocXImportant API for memory allocationMemory ManagementVirtualAllocEx();
NtCreateFileImportant API for file creationFile OperationsCreateFile();
NtReadFileImportant API for reading filesFile OperationsReadFile();
NtTerminateProcessImportant API for ending processesProcess ManagementTerminateProcess();
NtOpenProcessImportant API for accessing processesProcess ManagementOpenProcess();
NtQuerySystemInformationImportant API for system info retrievalSystem MonitoringGetSystemInfo();
NtQueryDirectoryFileImportant API for directory queriesFile OperationsFindFirstFile();
NtOpenThreadImportant API for accessing threadsThread ManagementOpenThread();
NtSetInformationFileImportant API for file info modificationFile OperationsSetFileInformationByHandle();
NtQueryInformationProcessImportant API for process info retrievalProcess MonitoringGetProcessInformation();
NtAllocateVirtualMemoryImportant API for virtual memory allocationMemory ManagementVirtualAlloc();
NtFreeVirtualMemoryImportant API for virtual memory releaseMemory ManagementVirtualFree();
NtWriteFileImportant API for writing to filesFile OperationsWriteFile();
NtCloseImportant API for closing handlesHandle ManagementCloseHandle();
NtDelayExecutionImportant API for thread delaysThread ManagementSleep();
NtQueryKeyImportant API for querying registry keysRegistry OperationsRegQueryValueEx();
NtSetValueKeyImportant API for setting registry valuesRegistry OperationsRegSetValueEx();
NtOpenKeyImportant API for opening registry keysRegistry OperationsRegOpenKeyEx();
NtQueryValueKeyImportant API for querying registry valuesRegistry OperationsRegQueryValueEx();
NtEnumerateValueKeyImportant API for enumerating registry valuesRegistry OperationsRegEnumValue();
NtProtectVirtualMemoryImportant API for memory protectionMemory ManagementVirtualProtect();
NtDuplicateObjectImportant API for duplicating handlesHandle ManagementDuplicateHandle();
NtAdjustPrivilegesTokenImportant API for adjusting token privilegesSecurity ManagementAdjustTokenPrivileges();
NtLoadDriverImportant API for loading device driversDriver OperationsLoadDriver();
NtUnloadDriverImportant API for unloading device driversDriver OperationsUnloadDriver();
NtMapViewOfSectionImportant API for mapping view of a sectionMemory ManagementMapViewOfFile();
NtUnmapViewOfSectionImportant API for unmapping view of a sectionMemory ManagementUnmapViewOfFile();
NtQueryVolumeInformationFileImportant API for querying volume informationFile OperationsGetVolumeInformation();
NtDeviceIoControlFileImportant API for device I/O controlDevice OperationsDeviceIoControl();
NtWaitForSingleObjectImportant API for waiting on an objectSynchronizationWaitForSingleObject();
NtWaitForMultipleObjectsImportant API for waiting on multiple objectsSynchronizationWaitForMultipleObjects();
NtSetEventImportant API for setting an eventSynchronizationSetEvent();
NtResetEventImportant API for resetting an eventSynchronizationResetEvent();
NtCreateMutantImportant API for creating a mutexSynchronizationCreateMutex();
NtReleaseMutantImportant API for releasing a mutexSynchronizationReleaseMutex();
NtSuspendThreadImportant API for suspending threadsThread ManagementSuspendThread();
NtResumeThreadImportant API for resuming threadsThread ManagementResumeThread();
NtSetInformationThreadImportant API for setting thread informationThread ManagementSetThreadInformation();
NtQueryPerformanceCounterImportant API for performance counter queriesPerformance MonitoringQueryPerformanceCounter();
NtQuerySemaphoreImportant API for querying semaphoreSynchronizationQuerySemaphore();
NtSetTimerImportant API for setting timersTimer OperationsSetWaitableTimer();
NtCancelTimerImportant API for canceling timersTimer OperationsCancelWaitableTimer();