/*

    ALPC syscall are in alpc.txt
    NtWow64* are still in winfunc (make a syswow.txt?)

*/


NTSTATUS NtQueryLicenseValue(
    PUNICODE_STRING Name,
    ULONG *Type,
    PVOID Buffer,
    ULONG Length,
    ULONG *DataLength
);

NTSTATUS WINAPI NtQueryEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
    _In_ ULONG EaListLength,
    _In_opt_ PULONG EaIndex,
    _In_ BOOLEAN RestartScan
);

NTSTATUS WINAPI NtSetEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _In_reads_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length
);


NTSTATUS WINAPI NtCreateProcessEx(
    _Out_ PHANDLE ProcessHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ HANDLE ParentProcess,
    _In_ ULONG Flags,
    _In_ HANDLE SectionHandle,
    _In_ HANDLE DebugPort,
    _In_ HANDLE ExceptionPort,
    _In_ BOOLEAN InJob
);


NTSTATUS WINAPI NtCreateNamedPipeFile(
    _Out_ PHANDLE             NamedPipeFileHandle,
    _In_ ACCESS_MASK          DesiredAccess,
    _In_ POBJECT_ATTRIBUTES   ObjectAttributes,
    _Out_ PIO_STATUS_BLOCK    IoStatusBlock,
    _In_ ULONG                ShareAccess,
    _In_ ULONG                CreateDisposition,
    _In_ ULONG                CreateOptions,
    _In_ BOOLEAN              WriteModeMessage,
    _In_ BOOLEAN              ReadModeMessage,
    _In_ BOOLEAN              NonBlocking,
    _In_ ULONG                MaxInstances,
    _In_ ULONG                InBufferSize,
    _In_ ULONG                OutBufferSize,
    _In_ PLARGE_INTEGER       DefaultTimeOut
);


NTSTATUS WINAPI NtCreateFile(
  _Out_    PHANDLE            FileHandle,
  _In_     ACCESS_MASK        DesiredAccess,
  _In_     POBJECT_ATTRIBUTES ObjectAttributes,
  _Out_    PIO_STATUS_BLOCK   IoStatusBlock,
  _In_opt_ PLARGE_INTEGER     AllocationSize,
  _In_     ULONG              FileAttributes,
  _In_     ULONG              ShareAccess,
  _In_     ULONG              CreateDisposition,
  _In_     ULONG              CreateOptions,
  _In_     PVOID              EaBuffer,
  _In_     ULONG              EaLength
);


NTSTATUS WINAPI NtOpenFile(
  _Out_ PHANDLE           FileHandle,
  _In_ ACCESS_MASK        DesiredAccess,
  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
  _Out_ PIO_STATUS_BLOCK  IoStatusBlock,
  _In_ ULONG              ShareAccess,
  _In_ ULONG              OpenOptions
);


NTSTATUS WINAPI NtCreateSymbolicLinkObject (
  _Out_ PHANDLE             pHandle,
  _In_ ACCESS_MASK          DesiredAccess,
  _In_ POBJECT_ATTRIBUTES   ObjectAttributes,
  _In_ PUNICODE_STRING      DestinationName
);


NTSTATUS WINAPI NtSetInformationProcess(
  _In_ HANDLE               ProcessHandle,
  _In_ PROCESSINFOCLASS ProcessInformationClass,
  _In_ PVOID                ProcessInformation,
  _In_ ULONG                ProcessInformationLength
);

NTSTATUS WINAPI NtQueryVirtualMemory(
  _In_      HANDLE                   ProcessHandle,
  _In_opt_  PVOID                    BaseAddress,
  _In_      MEMORY_INFORMATION_CLASS MemoryInformationClass,
  _Out_     PVOID                    MemoryInformation,
  _In_      SIZE_T                   MemoryInformationLength,
  _Out_opt_ PSIZE_T                  ReturnLength
);

NTSTATUS WINAPI NtQueryVolumeInformationFile(
  _In_  HANDLE               FileHandle,
  _Out_ PIO_STATUS_BLOCK     IoStatusBlock,
  _Out_ PVOID                FsInformation,
  _In_  ULONG                Length,
  _In_  FS_INFORMATION_CLASS FsInformationClass
);

NTSTATUS NtCreateThreadEx(
        PHANDLE                 ThreadHandle,
        ACCESS_MASK             DesiredAccess,
        LPVOID                  ObjectAttributes,
        HANDLE                  ProcessHandle,
        LPTHREAD_START_ROUTINE  lpStartAddress,
        LPVOID                  lpParameter,
        BOOL                    CreateSuspended,
        DWORD                   dwStackSize,
        DWORD                   Unknown1,
        DWORD                   Unknown2,
        LPVOID                  Unknown3
);


NTSTATUS WINAPI NtGetContextThread(
    __in    HANDLE hThread,
    __inout LPCONTEXT lpContext
);

NTSTATUS WINAPI NtSetContextThread(
    __in HANDLE hThread,
    __in CONST LPCONTEXT lpContext
);

NTSTATUS WINAPI NtQueryInformationThread (
    _In_ HANDLE ThreadHandle,
    _In_ THREAD_INFORMATION_CLASS ThreadInformationClass,
    _Out_ PVOID ThreadInformation,
    _In_ ULONG ThreadInformationLength,
    _Out_ PULONG ReturnLength
);


NTSTATUS WINAPI NtAllocateVirtualMemory(
  _In_    HANDLE    ProcessHandle,
  _Inout_ PVOID     *BaseAddress,
  _In_    ULONG_PTR ZeroBits,
  _Inout_ PSIZE_T   RegionSize,
  _In_    ULONG     AllocationType,
  _In_    ULONG     Protect
);


NTSTATUS WINAPI NtProtectVirtualMemory(
  _In_ HANDLE               ProcessHandle,
  _Inout_ PVOID            *BaseAddress,
  _Inout_ PULONG           NumberOfBytesToProtect,
  _In_ ULONG                NewAccessProtection,
  _Out_ PULONG              OldAccessProtection
);

NTSTATUS WINAPI NtQuerySystemInformation(
  _In_       SYSTEM_INFORMATION_CLASS SystemInformationClass,
  _Inout_    PVOID SystemInformation,
  _In_       ULONG SystemInformationLength,
  _Out_opt_  PULONG ReturnLength
);


NTSTATUS WINAPI NtQueryInformationProcess(
  _In_      HANDLE           ProcessHandle,
  _In_      PROCESSINFOCLASS ProcessInformationClass,
  _Out_     PVOID            ProcessInformation,
  _In_      ULONG            ProcessInformationLength,
  _Out_opt_ PULONG           ReturnLength
);



NTSTATUS WINAPI NtReadVirtualMemory(
  _In_   HANDLE     hProcess,
  _In_   PVOID      lpBaseAddress,
  _Out_  LPVOID     lpBuffer,
  _In_   ULONG      nSize,
  _Out_  PULONG     lpNumberOfBytesRead
);


NTSTATUS WINAPI NtWriteVirtualMemory(
  _In_ HANDLE               ProcessHandle,
  _In_ PVOID                BaseAddress,
  _In_ PVOID                Buffer,
  _In_ ULONG                NumberOfBytesToWrite,
  _Out_ PULONG              NumberOfBytesWritten
);


NTSTATUS WINAPI NtOpenEvent(
    __out PHANDLE EventHandle,
    __in ACCESS_MASK DesiredAccess,
    __in POBJECT_ATTRIBUTES ObjectAttributes
);


NTSTATUS WINAPI NtQueryObject(
  _In_opt_  HANDLE                   Handle,
  _In_      OBJECT_INFORMATION_CLASS ObjectInformationClass,
  _Out_opt_ PVOID                    ObjectInformation,
  _In_      ULONG                    ObjectInformationLength,
  _Out_opt_ PULONG                   ReturnLength
);


NTSTATUS WINAPI NtOpenDirectoryObject(
    __out PHANDLE DirectoryHandle,
    __in ACCESS_MASK DesiredAccess,
    __in POBJECT_ATTRIBUTES ObjectAttributes
);


NTSTATUS WINAPI NtQueryDirectoryObject(
    __in HANDLE DirectoryHandle,
    __out PVOID Buffer,
    __in ULONG Length,
    __in BOOLEAN ReturnSingleEntry,
    __in BOOLEAN RestartScan,
    __inout PULONG Context,
    _Out_opt_ PULONG ReturnLength
    );

NTSTATUS WINAPI NtQuerySymbolicLinkObject(
  _In_      HANDLE          LinkHandle,
  _Inout_   PUNICODE_STRING LinkTarget,
  _Out_opt_ PULONG          ReturnedLength
);

NTSTATUS WINAPI NtOpenSymbolicLinkObject(
  _Out_ PHANDLE            LinkHandle,
  _In_  ACCESS_MASK        DesiredAccess,
  _In_  POBJECT_ATTRIBUTES ObjectAttributes
);


NTSTATUS WINAPI NtQueryInformationFile(
  _In_  HANDLE                 FileHandle,
  _Out_ PIO_STATUS_BLOCK       IoStatusBlock,
  _Out_ PVOID                  FileInformation,
  _In_  ULONG                  Length,
  _In_  FILE_INFORMATION_CLASS FileInformationClass
);

NTSTATUS WINAPI NtQueryDirectoryFile(
  _In_     HANDLE                 FileHandle,
  _In_opt_ HANDLE                 Event,
  _In_opt_ PIO_APC_ROUTINE        ApcRoutine,
  _In_opt_ PVOID                  ApcContext,
  _Out_    PIO_STATUS_BLOCK       IoStatusBlock,
  _Out_    PVOID                  FileInformation,
  _In_     ULONG                  Length,
  _In_     FILE_INFORMATION_CLASS FileInformationClass,
  _In_     BOOLEAN                ReturnSingleEntry,
  _In_opt_ PUNICODE_STRING        FileName,
  _In_     BOOLEAN                RestartScan
);


NTSTATUS NtSetInformationFile(
  HANDLE                 FileHandle,
  PIO_STATUS_BLOCK       IoStatusBlock,
  PVOID                  FileInformation,
  ULONG                  Length,
  FILE_INFORMATION_CLASS FileInformationClass
);


NTSTATUS WINAPI NtEnumerateSystemEnvironmentValuesEx(
    _In_ ULONG InformationClass,
    _In_ PVOID Buffer,
    _In_ ULONG BufferLength
);



NTSTATUS WINAPI NtFreeVirtualMemory(
  _In_    HANDLE  ProcessHandle,
  _Inout_ PVOID   *BaseAddress,
  _Inout_ PSIZE_T RegionSize,
  _In_    ULONG   FreeType
);



NTSTATUS WINAPI NtGetContextThread(
    __in    HANDLE hThread,
    __inout LPCONTEXT lpContext
);


NTSTATUS WINAPI NtSetContextThread(
    __in HANDLE hThread,
    __in CONST LPCONTEXT lpContext
);


NTSTATUS NtCreateSection(
    PHANDLE            SectionHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PLARGE_INTEGER     MaximumSize,
    ULONG              SectionPageProtection,
    ULONG              AllocationAttributes,
    HANDLE             FileHandle
);

NTSTATUS NtOpenSection(
    PHANDLE            SectionHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes
);

NTSTATUS NtMapViewOfSection(
    HANDLE          SectionHandle,
    HANDLE          ProcessHandle,
    PVOID           *BaseAddress,
    ULONG_PTR       ZeroBits,
    SIZE_T          CommitSize,
    PLARGE_INTEGER  SectionOffset,
    PSIZE_T         ViewSize,
    SECTION_INHERIT InheritDisposition,
    ULONG           AllocationType,
    ULONG           Win32Protect
);

NTSTATUS NtUnmapViewOfSection(
    HANDLE ProcessHandle,
    PVOID  BaseAddress
);

