typedef struct _SECURITY_ATTRIBUTES {
  DWORD  nLength;
  LPVOID lpSecurityDescriptor;
  BOOL   bInheritHandle;
} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;


typedef struct _SYSTEM_VERIFIER_INFORMATION {
    ULONG NextEntryOffset;
    ULONG Level;
    UNICODE_STRING DriverName;

    ULONG RaiseIrqls;
    ULONG AcquireSpinLocks;
    ULONG SynchronizeExecutions;
    ULONG AllocationsAttempted;

    ULONG AllocationsSucceeded;
    ULONG AllocationsSucceededSpecialPool;
    ULONG AllocationsWithNoTag;
    ULONG TrimRequests;

    ULONG Trims;
    ULONG AllocationsFailed;
    ULONG AllocationsFailedDeliberately;
    ULONG Loads;

    ULONG Unloads;
    ULONG UnTrackedPool;
    ULONG CurrentPagedPoolAllocations;
    ULONG CurrentNonPagedPoolAllocations;

    ULONG PeakPagedPoolAllocations;
    ULONG PeakNonPagedPoolAllocations;

    SIZE_T PagedPoolUsageInBytes;
    SIZE_T NonPagedPoolUsageInBytes;
    SIZE_T PeakPagedPoolUsageInBytes;
    SIZE_T PeakNonPagedPoolUsageInBytes;

} SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;

typedef enum _SYSTEM_INFORMATION_CLASS {
   SystemBasicInformation = 0,
   SystemProcessorInformation = 1,
   SystemPerformanceInformation = 2,
   SystemTimeOfDayInformation = 3,
   SystemPathInformation = 4,
   SystemProcessInformation = 5,
   SystemCallCountInformation = 6,
   SystemDeviceInformation = 7,
   SystemProcessorPerformanceInformation = 8,
   SystemFlagsInformation = 9,
   SystemCallTimeInformation = 10,
   SystemModuleInformation = 11,
   SystemLocksInformation = 12,
   SystemStackTraceInformation = 13,
   SystemPagedPoolInformation = 14,
   SystemNonPagedPoolInformation = 15,
   SystemHandleInformation = 16,
   SystemObjectInformation = 17,
   SystemPageFileInformation = 18,
   SystemVdmInstemulInformation = 19,
   SystemVdmBopInformation = 20,
   SystemFileCacheInformation = 21,
   SystemPoolTagInformation = 22,
   SystemInterruptInformation = 23,
   SystemDpcBehaviorInformation = 24,
   SystemFullMemoryInformation = 25,
   SystemLoadGdiDriverInformation = 26,
   SystemUnloadGdiDriverInformation = 27,
   SystemTimeAdjustmentInformation = 28,
   SystemSummaryMemoryInformation = 29,
   SystemMirrorMemoryInformation = 30,
   SystemPerformanceTraceInformation = 31,
   SystemObsolete0 = 32,
   SystemExceptionInformation = 33,
   SystemCrashDumpStateInformation = 34,
   SystemKernelDebuggerInformation = 35,
   SystemContextSwitchInformation = 36,
   SystemRegistryQuotaInformation = 37,
   SystemExtendServiceTableInformation = 38,
   SystemPrioritySeperation = 39,
   SystemVerifierAddDriverInformation = 40,
   SystemVerifierRemoveDriverInformation = 41,
   SystemProcessorIdleInformation = 42,
   SystemLegacyDriverInformation = 43,
   SystemCurrentTimeZoneInformation = 44,
   SystemLookasideInformation = 45,
   SystemTimeSlipNotification = 46,
   SystemSessionCreate = 47,
   SystemSessionDetach = 48,
   SystemSessionInformation = 49,
   SystemRangeStartInformation = 50,
   SystemVerifierInformation = 51,
   SystemVerifierThunkExtend = 52,
   SystemSessionProcessInformation = 53,
   SystemLoadGdiDriverInSystemSpace = 54,
   SystemNumaProcessorMap = 55,
   SystemPrefetcherInformation = 56,
   SystemExtendedProcessInformation = 57,
   SystemRecommendedSharedDataAlignment = 58,
   SystemComPlusPackage = 59,
   SystemNumaAvailableMemory = 60,
   SystemProcessorPowerInformation = 61,
   SystemEmulationBasicInformation = 62,
   SystemEmulationProcessorInformation = 63,
   SystemExtendedHandleInformation = 64,
   SystemLostDelayedWriteInformation = 65,
   SystemBigPoolInformation = 66,
   SystemSessionPoolTagInformation = 67,
   SystemSessionMappedViewInformation = 68,
   SystemHotpatchInformation = 69,
   SystemObjectSecurityMode = 70,
   SystemWatchdogTimerHandler = 71,
   SystemWatchdogTimerInformation = 72,
   SystemLogicalProcessorInformation = 73,
   SystemWow64SharedInformationObsolete = 74,
   SystemRegisterFirmwareTableInformationHandler = 75,
   SystemFirmwareTableInformation = 76,
   SystemModuleInformationEx = 77,
   SystemVerifierTriageInformation = 78,
   SystemSuperfetchInformation = 79,
   SystemMemoryListInformation = 80,
   SystemFileCacheInformationEx = 81,
   SystemThreadPriorityClientIdInformation = 82,
   SystemProcessorIdleCycleTimeInformation = 83,
   SystemVerifierCancellationInformation = 84,
   SystemProcessorPowerInformationEx = 85,
   SystemRefTraceInformation = 86,
   SystemSpecialPoolInformation = 87,
   SystemProcessIdInformation = 88,
   SystemErrorPortInformation = 89,
   SystemBootEnvironmentInformation = 90,
   SystemHypervisorInformation = 91,
   SystemVerifierInformationEx = 92,
   SystemTimeZoneInformation = 93,
   SystemImageFileExecutionOptionsInformation = 94,
   SystemCoverageInformation = 95,
   SystemPrefetchPatchInformation = 96,
   SystemVerifierFaultsInformation = 97,
   SystemSystemPartitionInformation = 98,
   SystemSystemDiskInformation = 99,
   SystemProcessorPerformanceDistribution = 100,
   SystemNumaProximityNodeInformation = 101,
   SystemDynamicTimeZoneInformation = 102,
   SystemCodeIntegrityInformation = 103,
   SystemProcessorMicrocodeUpdateInformation = 104,
   SystemProcessorBrandString = 105,
   SystemVirtualAddressInformation = 106,
   SystemLogicalProcessorAndGroupInformation = 107,
   SystemProcessorCycleTimeInformation = 108,
   SystemStoreInformation = 109,
   SystemRegistryAppendString = 110,
   SystemAitSamplingValue = 111,
   SystemVhdBootInformation = 112,
   SystemCpuQuotaInformation = 113,
   SystemNativeBasicInformation = 114,
   SystemErrorPortTimeouts = 115,
   SystemLowPriorityIoInformation = 116,
   SystemBootEntropyInformation = 117,
   SystemVerifierCountersInformation = 118,
   SystemPagedPoolInformationEx = 119,
   SystemSystemPtesInformationEx = 120,
   SystemNodeDistanceInformation = 121,
   SystemAcpiAuditInformation = 122,
   SystemBasicPerformanceInformation = 123,
   SystemQueryPerformanceCounterInformation = 124,
   SystemSessionBigPoolInformation = 125,
   SystemBootGraphicsInformation = 126,
   SystemScrubPhysicalMemoryInformation = 127,
   SystemBadPageInformation = 128,
   SystemProcessorProfileControlArea = 129,
   SystemCombinePhysicalMemoryInformation = 130,
   SystemEntropyInterruptTimingInformation = 131,
   SystemConsoleInformation = 132,
   SystemPlatformBinaryInformation = 133,
   SystemPolicyInformation = 134,
   SystemHypervisorProcessorCountInformation = 135,
   SystemDeviceDataInformation = 136,
   SystemDeviceDataEnumerationInformation = 137,
   SystemMemoryTopologyInformation = 138,
   SystemMemoryChannelInformation = 139,
   SystemBootLogoInformation = 140,
   SystemProcessorPerformanceInformationEx = 141,
   SystemCriticalProcessErrorLogInformation = 142,
   SystemSecureBootPolicyInformation = 143,
   SystemPageFileInformationEx = 144,
   SystemSecureBootInformation = 145,
   SystemEntropyInterruptTimingRawInformation = 146,
   SystemPortableWorkspaceEfiLauncherInformation = 147,
   SystemFullProcessInformation = 148,
   SystemKernelDebuggerInformationEx = 149,
   SystemBootMetadataInformation = 150,
   SystemSoftRebootInformation = 151,
   SystemElamCertificateInformation = 152,
   SystemOfflineDumpConfigInformation = 153,
   SystemProcessorFeaturesInformation = 154,
   SystemRegistryReconciliationInformation = 155,
   SystemEdidInformation = 156,
   SystemManufacturingInformation = 157,
   SystemEnergyEstimationConfigInformation = 158,
   SystemHypervisorDetailInformation = 159,
   SystemProcessorCycleStatsInformation = 160,
   SystemVmGenerationCountInformation = 161,
   SystemTrustedPlatformModuleInformation = 162,
   SystemKernelDebuggerFlags = 163,
   SystemCodeIntegrityPolicyInformation = 164,
   SystemIsolatedUserModeInformation = 165,
   SystemHardwareSecurityTestInterfaceResultsInformation = 166,
   SystemSingleModuleInformation = 167,
   SystemAllowedCpuSetsInformation = 168,
   SystemVsmProtectionInformation = 169,
   SystemInterruptCpuSetsInformation = 170,
   SystemSecureBootPolicyFullInformation = 171,
   SystemCodeIntegrityPolicyFullInformation = 172,
   SystemAffinitizedInterruptProcessorInformation = 173,
   SystemRootSiloInformation = 174,
   SystemCpuSetInformation = 175,
   SystemCpuSetTagInformation = 176,
   SystemWin32WerStartCallout = 177,
   SystemSecureKernelProfileInformation = 178,
   SystemCodeIntegrityPlatformManifestInformation = 179,
   SystemInterruptSteeringInformation = 180,
   SystemSupportedProcessorArchitectures = 181,
   SystemMemoryUsageInformation = 182,
   SystemCodeIntegrityCertificateInformation = 183,
   SystemPhysicalMemoryInformation = 184,
   SystemControlFlowTransition = 185,
   SystemKernelDebuggingAllowed = 186,
   SystemActivityModerationExeState = 187,
   SystemActivityModerationUserSettings = 188,
   SystemCodeIntegrityPoliciesFullInformation = 189,
   SystemCodeIntegrityUnlockInformation = 190,
   SystemIntegrityQuotaInformation = 191,
   SystemFlushInformation = 192,
   SystemProcessorIdleMaskInformation = 193,
   SystemSecureDumpEncryptionInformation = 194,
   SystemWriteConstraintInformation = 195,
   SystemKernelVaShadowInformation = 196,
   SystemHypervisorSharedPageInformation = 197,
   SystemFirmwareBootPerformanceInformation = 198,
   SystemCodeIntegrityVerificationInformation = 199,
   SystemFirmwarePartitionInformation = 200,
   SystemSpeculationControlInformation = 201,
   SystemDmaGuardPolicyInformation = 202,
   SystemEnclaveLaunchControlInformation = 203,
   SystemWorkloadAllowedCpuSetsInformation = 204,
   SystemCodeIntegrityUnlockModeInformation = 205,
   SystemLeapSecondInformation = 206,
   SystemFlags2Information = 207,
   SystemSecurityModelInformation = 208,
   SystemCodeIntegritySyntheticCacheInformation = 209,
   SystemFeatureConfigurationInformation = 210,
   SystemFeatureConfigurationSectionInformation = 211,
   SystemFeatureUsageSubscriptionInformation = 212,
   SystemSecureSpeculationControlInformation = 213,
   SystemSpacesBootInformation = 214,
   SystemFwRamdiskInformation = 215,
   SystemWheaIpmiHardwareInformation = 216,
   SystemDifSetRuleClassInformation = 217,
   SystemDifClearRuleClassInformation = 218,
   SystemDifApplyPluginVerificationOnDriver = 219,
   SystemDifRemovePluginVerificationOnDriver = 220,
   SystemShadowStackInformation = 221,
   SystemBuildVersionInformation = 222,
   SystemPoolLimitInformation = 223,
   SystemCodeIntegrityAddDynamicStore = 224,
   SystemCodeIntegrityClearDynamicStores = 225,
   SystemPoolZeroingInformation = 227,
   MaxSystemInfoClass = 228,
} SYSTEM_INFORMATION_CLASS;


typedef struct _SYSTEM_PROCESS_ID_INFORMATION {
    HANDLE ProcessId;
    UNICODE_STRING ImageName;
} SYSTEM_PROCESS_ID_INFORMATION, *PSYSTEM_PROCESS_ID_INFORMATION;

typedef enum  _WELL_KNOWN_SID_TYPE{
  WinNullSid                                   = 0,
  WinWorldSid                                  = 1,
  WinLocalSid                                  = 2,
  WinCreatorOwnerSid                           = 3,
  WinCreatorGroupSid                           = 4,
  WinCreatorOwnerServerSid                     = 5,
  WinCreatorGroupServerSid                     = 6,
  WinNtAuthoritySid                            = 7,
  WinDialupSid                                 = 8,
  WinNetworkSid                                = 9,
  WinBatchSid                                  = 10,
  WinInteractiveSid                            = 11,
  WinServiceSid                                = 12,
  WinAnonymousSid                              = 13,
  WinProxySid                                  = 14,
  WinEnterpriseControllersSid                  = 15,
  WinSelfSid                                   = 16,
  WinAuthenticatedUserSid                      = 17,
  WinRestrictedCodeSid                         = 18,
  WinTerminalServerSid                         = 19,
  WinRemoteLogonIdSid                          = 20,
  WinLogonIdsSid                               = 21,
  WinLocalSystemSid                            = 22,
  WinLocalServiceSid                           = 23,
  WinNetworkServiceSid                         = 24,
  WinBuiltinDomainSid                          = 25,
  WinBuiltinAdministratorsSid                  = 26,
  WinBuiltinUsersSid                           = 27,
  WinBuiltinGuestsSid                          = 28,
  WinBuiltinPowerUsersSid                      = 29,
  WinBuiltinAccountOperatorsSid                = 30,
  WinBuiltinSystemOperatorsSid                 = 31,
  WinBuiltinPrintOperatorsSid                  = 32,
  WinBuiltinBackupOperatorsSid                 = 33,
  WinBuiltinReplicatorSid                      = 34,
  WinBuiltinPreWindows2000CompatibleAccessSid  = 35,
  WinBuiltinRemoteDesktopUsersSid              = 36,
  WinBuiltinNetworkConfigurationOperatorsSid   = 37,
  WinAccountAdministratorSid                   = 38,
  WinAccountGuestSid                           = 39,
  WinAccountKrbtgtSid                          = 40,
  WinAccountDomainAdminsSid                    = 41,
  WinAccountDomainUsersSid                     = 42,
  WinAccountDomainGuestsSid                    = 43,
  WinAccountComputersSid                       = 44,
  WinAccountControllersSid                     = 45,
  WinAccountCertAdminsSid                      = 46,
  WinAccountSchemaAdminsSid                    = 47,
  WinAccountEnterpriseAdminsSid                = 48,
  WinAccountPolicyAdminsSid                    = 49,
  WinAccountRasAndIasServersSid                = 50,
  WinNTLMAuthenticationSid                     = 51,
  WinDigestAuthenticationSid                   = 52,
  WinSChannelAuthenticationSid                 = 53,
  WinThisOrganizationSid                       = 54,
  WinOtherOrganizationSid                      = 55,
  WinBuiltinIncomingForestTrustBuildersSid     = 56,
  WinBuiltinPerfMonitoringUsersSid             = 57,
  WinBuiltinPerfLoggingUsersSid                = 58,
  WinBuiltinAuthorizationAccessSid             = 59,
  WinBuiltinTerminalServerLicenseServersSid    = 60,
  WinBuiltinDCOMUsersSid                       = 61,
  WinBuiltinIUsersSid                          = 62,
  WinIUserSid                                  = 63,
  WinBuiltinCryptoOperatorsSid                 = 64,
  WinUntrustedLabelSid                         = 65,
  WinLowLabelSid                               = 66,
  WinMediumLabelSid                            = 67,
  WinHighLabelSid                              = 68,
  WinSystemLabelSid                            = 69,
  WinWriteRestrictedCodeSid                    = 70,
  WinCreatorOwnerRightsSid                     = 71,
  WinCacheablePrincipalsGroupSid               = 72,
  WinNonCacheablePrincipalsGroupSid            = 73,
  WinEnterpriseReadonlyControllersSid          = 74,
  WinAccountReadonlyControllersSid             = 75,
  WinBuiltinEventLogReadersGroup               = 76,
  WinNewEnterpriseReadonlyControllersSid       = 77,
  WinBuiltinCertSvcDComAccessGroup             = 78,
  WinMediumPlusLabelSid                        = 79,
  WinLocalLogonSid                             = 80,
  WinConsoleLogonSid                           = 81,
  WinThisOrganizationCertificateSid            = 82,
  WinApplicationPackageAuthoritySid            = 83,
  WinBuiltinAnyPackageSid                      = 84,
  WinCapabilityInternetClientSid               = 85,
  WinCapabilityInternetClientServerSid         = 86,
  WinCapabilityPrivateNetworkClientServerSid   = 87,
  WinCapabilityPicturesLibrarySid              = 88,
  WinCapabilityVideosLibrarySid                = 89,
  WinCapabilityMusicLibrarySid                 = 90,
  WinCapabilityDocumentsLibrarySid             = 91,
  WinCapabilitySharedUserCertificatesSid       = 92,
  WinCapabilityEnterpriseAuthenticationSid     = 93,
  WinCapabilityRemovableStorageSid             = 94
} WELL_KNOWN_SID_TYPE;

typedef enum _SECTION_INHERIT {
  ViewShare = 1,
  ViewUnmap = 2
} SECTION_INHERIT;





typedef enum _VARENUM{
    VT_EMPTY    = 0,
    VT_NULL = 1,
    VT_I2   = 2,
    VT_I4   = 3,
    VT_R4   = 4,
    VT_R8   = 5,
    VT_CY   = 6,
    VT_DATE = 7,
    VT_BSTR = 8,
    VT_DISPATCH = 9,
    VT_ERROR    = 10,
    VT_BOOL = 11,
    VT_VARIANT  = 12,
    VT_UNKNOWN  = 13,
    VT_DECIMAL  = 14,
    VT_I1   = 16,
    VT_UI1  = 17,
    VT_UI2  = 18,
    VT_UI4  = 19,
    VT_I8   = 20,
    VT_UI8  = 21,
    VT_INT  = 22,
    VT_UINT = 23,
    VT_VOID = 24,
    VT_HRESULT  = 25,
    VT_PTR  = 26,
    VT_SAFEARRAY    = 27,
    VT_CARRAY   = 28,
    VT_USERDEFINED  = 29,
    VT_LPSTR    = 30,
    VT_LPWSTR   = 31,
    VT_RECORD   = 36,
    VT_INT_PTR  = 37,
    VT_UINT_PTR = 38,
    VT_FILETIME = 64,
    VT_BLOB = 65,
    VT_STREAM   = 66,
    VT_STORAGE  = 67,
    VT_STREAMED_OBJECT  = 68,
    VT_STORED_OBJECT    = 69,
    VT_BLOB_OBJECT  = 70,
    VT_CF   = 71,
    VT_CLSID    = 72,
    VT_VERSIONED_STREAM = 73,
    VT_BSTR_BLOB    = 0xfff,
    VT_VECTOR   = 0x1000,
    VT_ARRAY    = 0x2000,
    VT_BYREF    = 0x4000,
    VT_RESERVED = 0x8000,
    VT_ILLEGAL  = 0xffff,
    VT_ILLEGALMASKED    = 0xfff,
    VT_TYPEMASK = 0xfff
} VARENUM;

typedef enum  _UDP_TABLE_CLASS {
    UDP_TABLE_BASIC,
    UDP_TABLE_OWNER_PID,
    UDP_TABLE_OWNER_MODULE
} UDP_TABLE_CLASS;

typedef enum NET_FW_RULE_DIRECTION_ {
    NET_FW_RULE_DIR_IN  = 1,
    NET_FW_RULE_DIR_OUT = 2,
    NET_FW_RULE_DIR_MAX = 3
} NET_FW_RULE_DIRECTION;

typedef enum NET_FW_PROFILE_TYPE2_ {
  NET_FW_PROFILE2_DOMAIN   = 0x0001,
  NET_FW_PROFILE2_PRIVATE  = 0x0002,
  NET_FW_PROFILE2_PUBLIC   = 0x0004,
  NET_FW_PROFILE2_ALL      = 0x7FFFFFFF
} NET_FW_PROFILE_TYPE2;




typedef enum tagTOKEN_TYPE {
  TokenPrimary        = 1,
  TokenImpersonation  = 2
} TOKEN_TYPE, *PTOKEN_TYPE;

typedef enum  _FS_INFORMATION_CLASS {
  FileFsVolumeInformation       = 1,
  FileFsLabelInformation        = 2,
  FileFsSizeInformation         = 3,
  FileFsDeviceInformation       = 4,
  FileFsAttributeInformation    = 5,
  FileFsControlInformation      = 6,
  FileFsFullSizeInformation     = 7,
  FileFsObjectIdInformation     = 8,
  FileFsDriverPathInformation   = 9,
  FileFsVolumeFlagsInformation  = 10,
  FileFsSectorSizeInformation   = 11
} FS_INFORMATION_CLASS;


typedef enum _SECURITY_IMPERSONATION_LEVEL {
    SecurityAnonymous,
    SecurityIdentification,
    SecurityImpersonation,
    SecurityDelegation
    } SECURITY_IMPERSONATION_LEVEL, * PSECURITY_IMPERSONATION_LEVEL;

typedef enum _OBJECT_INFORMATION_CLASS {
   ObjectBasicInformation = 0,
   ObjectNameInformation = 1, /*NOT DOC*/
   ObjectTypeInformation = 2,
   ObjectTypesInformation = 3, /*NOT DOC*/
   ObjectHandleFlagInformation = 4, /*NOT DOC*/
   ObjectSessionInformation = 5, /*NOT DOC*/
   ObjectSessionObjectInformation = 6, /*NOT DOC*/
   MaxObjectInfoClass = 7, /*NOT DOC*/
} OBJECT_INFORMATION_CLASS;

typedef enum _SID_NAME_USE {
  SidTypeUser            = 1,
  SidTypeGroup           = 2,
  SidTypeDomain          = 3,
  SidTypeAlias           = 4,
  SidTypeWellKnownGroup  = 5,
  SidTypeDeletedAccount  = 6,
  SidTypeInvalid         = 7,
  SidTypeUnknown         = 8,
  SidTypeComputer        = 9,
  SidTypeLabel           = 10
} SID_NAME_USE, *PSID_NAME_USE;

typedef enum NET_FW_ACTION_ {
    NET_FW_ACTION_BLOCK = 0,
    NET_FW_ACTION_ALLOW = 1,
    NET_FW_ACTION_MAX   = 2
}   NET_FW_ACTION;

typedef enum NET_FW_MODIFY_STATE_ {
    NET_FW_MODIFY_STATE_OK  = 0,
    NET_FW_MODIFY_STATE_GP_OVERRIDE = 1 ,
    NET_FW_MODIFY_STATE_INBOUND_BLOCKED = 2
}   NET_FW_MODIFY_STATE;





typedef enum tagCLSCTX {
  CLSCTX_INPROC_SERVER           = 0x1,
  CLSCTX_INPROC_HANDLER          = 0x2,
  CLSCTX_LOCAL_SERVER            = 0x4,
  CLSCTX_INPROC_SERVER16         = 0x8,
  CLSCTX_REMOTE_SERVER           = 0x10,
  CLSCTX_INPROC_HANDLER16        = 0x20,
  CLSCTX_RESERVED1               = 0x40,
  CLSCTX_RESERVED2               = 0x80,
  CLSCTX_RESERVED3               = 0x100,
  CLSCTX_RESERVED4               = 0x200,
  CLSCTX_NO_CODE_DOWNLOAD        = 0x400,
  CLSCTX_RESERVED5               = 0x800,
  CLSCTX_NO_CUSTOM_MARSHAL       = 0x1000,
  CLSCTX_ENABLE_CODE_DOWNLOAD    = 0x2000,
  CLSCTX_NO_FAILURE_LOG          = 0x4000,
  CLSCTX_DISABLE_AAA             = 0x8000,
  CLSCTX_ENABLE_AAA              = 0x10000,
  CLSCTX_FROM_DEFAULT_CONTEXT    = 0x20000,
  CLSCTX_ACTIVATE_32_BIT_SERVER  = 0x40000,
  CLSCTX_ACTIVATE_64_BIT_SERVER  = 0x80000,
  CLSCTX_ENABLE_CLOAKING         = 0x100000,
  CLSCTX_APPCONTAINER            = 0x400000,
  CLSCTX_ACTIVATE_AAA_AS_IU      = 0x800000,
  CLSCTX_PS_DLL                  = 0x80000000
} CLSCTX;


typedef enum _SE_OBJECT_TYPE {
  SE_UNKNOWN_OBJECT_TYPE      = 0,
  SE_FILE_OBJECT = 1,
  SE_SERVICE = 2,
  SE_PRINTER = 3,
  SE_REGISTRY_KEY = 4,
  SE_LMSHARE = 5,
  SE_KERNEL_OBJECT = 6,
  SE_WINDOW_OBJECT = 7,
  SE_DS_OBJECT = 8,
  SE_DS_OBJECT_ALL = 9,
  SE_PROVIDER_DEFINED_OBJECT = 10,
  SE_WMIGUID_OBJECT = 11,
  SE_REGISTRY_WOW64_32KEY = 12,
} SE_OBJECT_TYPE;





typedef struct _MEMORY_BASIC_INFORMATION {
  PVOID  BaseAddress;
  PVOID  AllocationBase;
  DWORD  AllocationProtect;
  SIZE_T RegionSize;
  DWORD  State;
  DWORD  Protect;
  DWORD  Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

typedef struct _THREAD_BASIC_INFORMATION {

  NTSTATUS                ExitStatus;
  PVOID                   TebBaseAddress;
  CLIENT_ID               ClientId;
  KAFFINITY               AffinityMask;
  KPRIORITY               Priority;
  KPRIORITY               BasePriority;

} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

typedef struct _MEMORY_BASIC_INFORMATION32 {
    DWORD BaseAddress;
    DWORD AllocationBase;
    DWORD AllocationProtect;
    DWORD RegionSize;
    DWORD State;
    DWORD Protect;
    DWORD Type;
} MEMORY_BASIC_INFORMATION32, *PMEMORY_BASIC_INFORMATION32;

typedef struct _MEMORY_BASIC_INFORMATION64 {
    ULONGLONG BaseAddress;
    ULONGLONG AllocationBase;
    DWORD     AllocationProtect;
    DWORD     __alignment1;
    ULONGLONG RegionSize;
    DWORD     State;
    DWORD     Protect;
    DWORD     Type;
    DWORD     __alignment2;
} MEMORY_BASIC_INFORMATION64, *PMEMORY_BASIC_INFORMATION64;


typedef union _PSAPI_WORKING_SET_BLOCK {
  PVOID Flags;
} PSAPI_WORKING_SET_BLOCK, *PPSAPI_WORKING_SET_BLOCK;

typedef union _PSAPI_WORKING_SET_BLOCK32 {
  DWORD Flags;
} PSAPI_WORKING_SET_BLOCK32, *PPSAPI_WORKING_SET_BLOCK32;

typedef union _PSAPI_WORKING_SET_BLOCK64 {
  ULONG64 Flags;
} PSAPI_WORKING_SET_BLOCK64, *PPSAPI_WORKING_SET_BLOCK64;

typedef struct _PSAPI_WORKING_SET_INFORMATION {
  PVOID               NumberOfEntries;
  PSAPI_WORKING_SET_BLOCK WorkingSetInfo[1];
} PSAPI_WORKING_SET_INFORMATION, *PPSAPI_WORKING_SET_INFORMATION;

typedef struct _PSAPI_WORKING_SET_INFORMATION32 {
  DWORD               NumberOfEntries;
  PSAPI_WORKING_SET_BLOCK32 WorkingSetInfo[1];
} PSAPI_WORKING_SET_INFORMATION32, *PPSAPI_WORKING_SET_INFORMATION32;


typedef struct _PSAPI_WORKING_SET_INFORMATION64 {
  ULONG64               NumberOfEntries;
  PSAPI_WORKING_SET_BLOCK64 WorkingSetInfo[1];
} PSAPI_WORKING_SET_INFORMATION64, *PPSAPI_WORKING_SET_INFORMATION64;

typedef union _PSAPI_WORKING_SET_EX_BLOCK {
  PVOID Flags;
} PSAPI_WORKING_SET_EX_BLOCK, *PPSAPI_WORKING_SET_EX_BLOCK;

typedef union _PSAPI_WORKING_SET_EX_BLOCK32 {
  DWORD Flags;
} PSAPI_WORKING_SET_EX_BLOCK32, *PPSAPI_WORKING_SET_EX_BLOCK32;

typedef union _PSAPI_WORKING_SET_EX_BLOCK64 {
  ULONG64 Flags;
} PSAPI_WORKING_SET_EX_BLOCK64, *PPSAPI_WORKING_SET_EX_BLOCK64;

typedef struct _PSAPI_WORKING_SET_EX_INFORMATION {
  PVOID                      VirtualAddress;
  PSAPI_WORKING_SET_EX_BLOCK VirtualAttributes;
} PSAPI_WORKING_SET_EX_INFORMATION, *PPSAPI_WORKING_SET_EX_INFORMATION;

typedef struct _PSAPI_WORKING_SET_EX_INFORMATION32 {
  DWORD                      VirtualAddress;
  PSAPI_WORKING_SET_EX_BLOCK32 VirtualAttributes;
} PSAPI_WORKING_SET_EX_INFORMATION32, *PPSAPI_WORKING_SET_EX_INFORMATION32;

typedef struct _PSAPI_WORKING_SET_EX_INFORMATION64 {
  ULONG64                      VirtualAddress;
  PSAPI_WORKING_SET_EX_BLOCK64 VirtualAttributes;
} PSAPI_WORKING_SET_EX_INFORMATION64, *PPSAPI_WORKING_SET_EX_INFORMATION64;

typedef struct _STARTUPINFOA {
    DWORD   cb;
    LPSTR   lpReserved;
    LPSTR   lpDesktop;
    LPSTR   lpTitle;
    DWORD   dwX;
    DWORD   dwY;
    DWORD   dwXSize;
    DWORD   dwYSize;
    DWORD   dwXCountChars;
    DWORD   dwYCountChars;
    DWORD   dwFillAttribute;
    DWORD   dwFlags;
    WORD    wShowWindow;
    WORD    cbReserved2;
    LPBYTE  lpReserved2;
    HANDLE  hStdInput;
    HANDLE  hStdOutput;
    HANDLE  hStdError;
} STARTUPINFOA, *LPSTARTUPINFOA;
typedef struct _STARTUPINFOW {
    DWORD   cb;
    LPWSTR  lpReserved;
    LPWSTR  lpDesktop;
    LPWSTR  lpTitle;
    DWORD   dwX;
    DWORD   dwY;
    DWORD   dwXSize;
    DWORD   dwYSize;
    DWORD   dwXCountChars;
    DWORD   dwYCountChars;
    DWORD   dwFillAttribute;
    DWORD   dwFlags;
    WORD    wShowWindow;
    WORD    cbReserved2;
    LPBYTE  lpReserved2;
    HANDLE  hStdInput;
    HANDLE  hStdOutput;
    HANDLE  hStdError;
} STARTUPINFOW, *LPSTARTUPINFOW;


typedef struct _STARTUPINFOEXA {
  STARTUPINFOA                 StartupInfo;
  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList;
} STARTUPINFOEXA, *LPSTARTUPINFOEXA;


typedef struct _STARTUPINFOEXW {
  STARTUPINFOW                 StartupInfo;
  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList;
} STARTUPINFOEXW, *LPSTARTUPINFOEXW;


typedef struct _PROCESS_INFORMATION {
    HANDLE hProcess;
    HANDLE hThread;
    DWORD dwProcessId;
    DWORD dwThreadId;
} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;





typedef struct tagPROCESSENTRY32W
{
    DWORD   dwSize;
    DWORD   cntUsage;
    DWORD   th32ProcessID;
    ULONG_PTR th32DefaultHeapID;
    DWORD   th32ModuleID;
    DWORD   cntThreads;
    DWORD   th32ParentProcessID;
    LONG    pcPriClassBase;
    DWORD   dwFlags;
    WCHAR   szExeFile[MAX_PATH];
} PROCESSENTRY32W, *PPROCESSENTRY32W, *LPPROCESSENTRY32W;


typedef struct tagPROCESSENTRY32
{
    DWORD   dwSize;
    DWORD   cntUsage;
    DWORD   th32ProcessID;
    ULONG_PTR th32DefaultHeapID;
    DWORD   th32ModuleID;
    DWORD   cntThreads;
    DWORD   th32ParentProcessID;
    LONG    pcPriClassBase;
    DWORD   dwFlags;
    CHAR    szExeFile[MAX_PATH];
} PROCESSENTRY32, *PPROCESSENTRY32, *LPPROCESSENTRY32;


typedef struct tagTHREADENTRY32 {
  DWORD dwSize;
  DWORD cntUsage;
  DWORD th32ThreadID;
  DWORD th32OwnerProcessID;
  LONG  tpBasePri;
  LONG  tpDeltaPri;
  DWORD dwFlags;
} THREADENTRY32, *PTHREADENTRY32, *LPTHREADENTRY32;

typedef struct _LUID {
  DWORD LowPart;
  LONG  HighPart;
} LUID, *PLUID;


typedef struct _LUID_AND_ATTRIBUTES {
  LUID  Luid;
  DWORD Attributes;
} LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;




typedef struct _OSVERSIONINFOA {
    DWORD dwOSVersionInfoSize;
    DWORD dwMajorVersion;
    DWORD dwMinorVersion;
    DWORD dwBuildNumber;
    DWORD dwPlatformId;
    CHAR   szCSDVersion[ 128 ];
} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA;

typedef struct _OSVERSIONINFOW {
    DWORD dwOSVersionInfoSize;
    DWORD dwMajorVersion;
    DWORD dwMinorVersion;
    DWORD dwBuildNumber;
    DWORD dwPlatformId;
    WCHAR  szCSDVersion[ 128 ];
} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;

typedef struct _OSVERSIONINFOEXA {
    DWORD dwOSVersionInfoSize;
    DWORD dwMajorVersion;
    DWORD dwMinorVersion;
    DWORD dwBuildNumber;
    DWORD dwPlatformId;
    CHAR   szCSDVersion[ 128 ];
    WORD   wServicePackMajor;
    WORD   wServicePackMinor;
    WORD   wSuiteMask;
    BYTE  wProductType;
    BYTE  wReserved;
} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA;

typedef struct _OSVERSIONINFOEXW {
    DWORD dwOSVersionInfoSize;
    DWORD dwMajorVersion;
    DWORD dwMinorVersion;
    DWORD dwBuildNumber;
    DWORD dwPlatformId;
    WCHAR  szCSDVersion[ 128 ];
    WORD   wServicePackMajor;
    WORD   wServicePackMinor;
    WORD   wSuiteMask;
    BYTE  wProductType;
    BYTE  wReserved;
} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW;



typedef struct _EXCEPTION_RECORD {
  DWORD                    ExceptionCode;
  DWORD                    ExceptionFlags;
  struct _EXCEPTION_RECORD  *ExceptionRecord;
  PVOID                    ExceptionAddress;
  DWORD                    NumberParameters;
  ULONG_PTR                ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
} EXCEPTION_RECORD, *PEXCEPTION_RECORD;

typedef struct _EXCEPTION_RECORD32 {
    DWORD    ExceptionCode;
    DWORD ExceptionFlags;
    DWORD ExceptionRecord;
    DWORD ExceptionAddress;
    DWORD NumberParameters;
    DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
} EXCEPTION_RECORD32, *PEXCEPTION_RECORD32;

typedef struct _EXCEPTION_RECORD64 {
    DWORD    ExceptionCode;
    DWORD ExceptionFlags;
    DWORD64 ExceptionRecord;
    DWORD64 ExceptionAddress;
    DWORD NumberParameters;
    DWORD __unusedAlignment;
    DWORD64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
} EXCEPTION_RECORD64, *PEXCEPTION_RECORD64;


typedef struct _EXCEPTION_POINTERS64 {
  PEXCEPTION_RECORD ExceptionRecord;
  PCONTEXT64          ContextRecord;
} EXCEPTION_POINTERS64, *PEXCEPTION_POINTERS64;


typedef struct _EXCEPTION_POINTERS32 {
  PEXCEPTION_RECORD ExceptionRecord;
  PCONTEXT32          ContextRecord;
} EXCEPTION_POINTERS32, *PEXCEPTION_POINTERS32;


typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_ALPHA
{
    ULONG Type;
    ULONG Revision;
} DEBUG_PROCESSOR_IDENTIFICATION_ALPHA, *PDEBUG_PROCESSOR_IDENTIFICATION_ALPHA;

typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_AMD64
{
    ULONG Family;
    ULONG Model;
    ULONG Stepping;
    CHAR  VendorString[16];
} DEBUG_PROCESSOR_IDENTIFICATION_AMD64, *PDEBUG_PROCESSOR_IDENTIFICATION_AMD64;

typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_IA64
{
    ULONG Model;
    ULONG Revision;
    ULONG Family;
    ULONG ArchRev;
    CHAR  VendorString[16];
} DEBUG_PROCESSOR_IDENTIFICATION_IA64, *PDEBUG_PROCESSOR_IDENTIFICATION_IA64;

typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_X86
{
    ULONG Family;
    ULONG Model;
    ULONG Stepping;
    CHAR  VendorString[16];
} DEBUG_PROCESSOR_IDENTIFICATION_X86, *PDEBUG_PROCESSOR_IDENTIFICATION_X86;

typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_ARM
{
    ULONG Type;
    ULONG Revision;
} DEBUG_PROCESSOR_IDENTIFICATION_ARM, *PDEBUG_PROCESSOR_IDENTIFICATION_ARM;

typedef union _DEBUG_PROCESSOR_IDENTIFICATION_ALL
{
    DEBUG_PROCESSOR_IDENTIFICATION_ALPHA Alpha;
    DEBUG_PROCESSOR_IDENTIFICATION_AMD64 Amd64;
    DEBUG_PROCESSOR_IDENTIFICATION_IA64  Ia64;
    DEBUG_PROCESSOR_IDENTIFICATION_X86   X86;
    DEBUG_PROCESSOR_IDENTIFICATION_ARM   Arm;
} DEBUG_PROCESSOR_IDENTIFICATION_ALL, *PDEBUG_PROCESSOR_IDENTIFICATION_ALL;

typedef struct _MODLOAD_DATA {
  DWORD ssize;
  DWORD ssig;
  PVOID data;
  DWORD size;
  DWORD flags;
} MODLOAD_DATA, *PMODLOAD_DATA;

typedef struct _SYSTEM_MODULE32
{
    ULONG Reserved[2];
    ULONG Base;
    ULONG Size;
    ULONG Flags;
    USHORT Index;
    USHORT Unknown;
    USHORT LoadCount;
    USHORT ModuleNameOffset;
    CHAR   ImageName[256];
} SYSTEM_MODULE32, *PSYSTEM_MODULE32;

typedef struct _SYSTEM_MODULE64
{
    ULONG Reserved[4];
    ULONG64 Base;
    ULONG Size;
    ULONG Flags;
    USHORT Index;
    USHORT Unknown;
    USHORT LoadCount;
    USHORT ModuleNameOffset;
    CHAR   ImageName[256];
} SYSTEM_MODULE64, *PSYSTEM_MODULE64;

typedef struct _SYSTEM_MODULE_INFORMATION32
{
  ULONG                ModulesCount;
  SYSTEM_MODULE32        Modules[0];
} SYSTEM_MODULE_INFORMATION32, *PSYSTEM_MODULE_INFORMATION32;

typedef struct _SYSTEM_MODULE_INFORMATION64
{
  ULONG                ModulesCount;
  SYSTEM_MODULE64        Modules[0];
} SYSTEM_MODULE_INFORMATION64, *PSYSTEM_MODULE_INFORMATION64;




typedef struct _DEBUG_BREAKPOINT_PARAMETERS {
  ULONG64 Offset;
  ULONG   Id;
  ULONG   BreakType;
  ULONG   ProcType;
  ULONG   Flags;
  ULONG   DataSize;
  ULONG   DataAccessType;
  ULONG   PassCount;
  ULONG   CurrentPassCount;
  ULONG   MatchThread;
  ULONG   CommandSize;
  ULONG   OffsetExpressionSize;
} DEBUG_BREAKPOINT_PARAMETERS, *PDEBUG_BREAKPOINT_PARAMETERS;


typedef struct _DEBUG_REGISTER_DESCRIPTION {
  ULONG   Type;
  ULONG   Flags;
  ULONG   SubregMaster;
  ULONG   SubregLength;
  ULONG64 SubregMask;
  ULONG   SubregShift;
  ULONG   Reserved0;
} DEBUG_REGISTER_DESCRIPTION, *PDEBUG_REGISTER_DESCRIPTION;


typedef struct _DEBUG_STACK_FRAME {
  ULONG64 InstructionOffset;
  ULONG64 ReturnOffset;
  ULONG64 FrameOffset;
  ULONG64 StackOffset;
  ULONG64 FuncTableEntry;
  ULONG64 Params[4];
  ULONG64 Reserved[6];
  BOOL    Virtual;
  ULONG   FrameNumber;
} DEBUG_STACK_FRAME, *PDEBUG_STACK_FRAME;


typedef struct _DEBUG_LAST_EVENT_INFO_BREAKPOINT
{
    ULONG Id;
} DEBUG_LAST_EVENT_INFO_BREAKPOINT, *PDEBUG_LAST_EVENT_INFO_BREAKPOINT;

typedef struct _DEBUG_LAST_EVENT_INFO_EXCEPTION
{
    EXCEPTION_RECORD64 ExceptionRecord;
    ULONG FirstChance;
} DEBUG_LAST_EVENT_INFO_EXCEPTION, *PDEBUG_LAST_EVENT_INFO_EXCEPTION;

typedef struct _DEBUG_LAST_EVENT_INFO_EXIT_THREAD
{
    ULONG ExitCode;
} DEBUG_LAST_EVENT_INFO_EXIT_THREAD, *PDEBUG_LAST_EVENT_INFO_EXIT_THREAD;

typedef struct _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS
{
    ULONG ExitCode;
} DEBUG_LAST_EVENT_INFO_EXIT_PROCESS, *PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS;

typedef struct _DEBUG_LAST_EVENT_INFO_LOAD_MODULE
{
    ULONG64 Base;
} DEBUG_LAST_EVENT_INFO_LOAD_MODULE, *PDEBUG_LAST_EVENT_INFO_LOAD_MODULE;

typedef struct _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE
{
    ULONG64 Base;
} DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE, *PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE;

typedef struct _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR
{
    ULONG Error;
    ULONG Level;
} DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR, *PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR;


typedef struct _DEBUG_SPECIFIC_FILTER_PARAMETERS {
  ULONG ExecutionOption;
  ULONG ContinueOption;
  ULONG TextSize;
  ULONG CommandSize;
  ULONG ArgumentSize;
} DEBUG_SPECIFIC_FILTER_PARAMETERS, *PDEBUG_SPECIFIC_FILTER_PARAMETERS;


typedef struct _DEBUG_EXCEPTION_FILTER_PARAMETERS {
  ULONG ExecutionOption;
  ULONG ContinueOption;
  ULONG TextSize;
  ULONG CommandSize;
  ULONG SecondCommandSize;
  ULONG ExceptionCode;
} DEBUG_EXCEPTION_FILTER_PARAMETERS, *PDEBUG_EXCEPTION_FILTER_PARAMETERS;


typedef enum tagCOINIT {
  COINIT_APARTMENTTHREADED  = 0x2,
  COINIT_MULTITHREADED      = 0x0,
  COINIT_DISABLE_OLE1DDE    = 0x4,
  COINIT_SPEED_OVER_MEMORY  = 0x8
} COINIT;


struct _TMP_signscale {
    BYTE scale;
    BYTE sign;
};

struct _TMP_lowmid {
    ULONG Lo32;
    ULONG Mid32;
};

union TMP_signscale_union {
    _TMP_signscale s;
    USHORT signscale;
};

union TMP_lowmid_union {
    _TMP_lowmid s;
    ULONGLONG Lo64;
};

typedef struct tagDEC {
    USHORT wReserved;
    TMP_signscale_union u1;
    ULONG  Hi32;
    TMP_signscale_union u2;
} DECIMAL;


typedef enum tagTYPEKIND {
    TKIND_ENUM  = 0,
    TKIND_RECORD    = 1 ,
    TKIND_MODULE    = 2 ,
    TKIND_INTERFACE = 3 ,
    TKIND_DISPATCH  = 4 ,
    TKIND_COCLASS   = 5 ,
    TKIND_ALIAS = 6 ,
    TKIND_UNION = 7 ,
    TKIND_MAX   = 8
} TYPEKIND;





typedef struct tagDISPPARAMS {
    VARIANTARG *rgvarg;
    DISPID *rgdispidNamedArgs;
    UINT cArgs;
    UINT cNamedArgs;
}   DISPPARAMS;

typedef struct tagEXCEPINFO {
    WORD wCode;
    WORD wReserved;
    BSTR bstrSource;
    BSTR bstrDescription;
    BSTR bstrHelpFile;
    DWORD dwHelpContext;
    ULONG_PTR pvReserved;
    ULONG_PTR pfnDeferredFillIn;
    SCODE scode;
} EXCEPINFO;


typedef struct _PROCESS_BASIC_INFORMATION
{
    NTSTATUS ExitStatus;
    PPEB PebBaseAddress;
    ULONG_PTR AffinityMask;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;

typedef struct _JIT_DEBUG_INFO {
    DWORD dwSize;
    DWORD dwProcessorArchitecture;
    DWORD dwThreadID;
    DWORD dwReserved0;
    ULONG64 lpExceptionAddress;
    ULONG64 lpExceptionRecord;
    ULONG64 lpContextRecord;
} JIT_DEBUG_INFO, *LPJIT_DEBUG_INFO;

typedef struct _SID_IDENTIFIER_AUTHORITY {
    BYTE  Value[6];
} SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;


typedef struct _STRING {
    USHORT Length;
    USHORT MaximumLength;
    LPCSTR Buffer;
} STRING, *PSTRING, *PANSI_STRING, *PCANSI_STRING;

typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;


typedef struct _IO_STATUS_BLOCK {
  union {
    NTSTATUS Status;
    PVOID    Pointer;
  };
  ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;


typedef struct _SECURITY_QUALITY_OF_SERVICE {
    DWORD Length;
    SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
    SECURITY_CONTEXT_TRACKING_MODE ContextTrackingMode;
    BOOLEAN EffectiveOnly;
} SECURITY_QUALITY_OF_SERVICE, * PSECURITY_QUALITY_OF_SERVICE;


typedef struct CATALOG_INFO_
{
    DWORD                       cbStruct;
    WCHAR                       wszCatalogFile[MAX_PATH];
} CATALOG_INFO;

typedef struct _SYSTEM_HANDLE
{
    DWORD    dwProcessId;
    BYTE     bObjectType;
    BYTE     bFlags;
    WORD     wValue;
    PVOID    pAddress;
    DWORD    GrantedAccess;
}
SYSTEM_HANDLE;

typedef struct _SYSTEM_HANDLE64
{
    DWORD    dwProcessId;
    BYTE     bObjectType;
    BYTE     bFlags;
    WORD     wValue;
    ULONG64    pAddress;
    DWORD    GrantedAccess;
} SYSTEM_HANDLE64;


typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG HandleCount;
    SYSTEM_HANDLE Handles[1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef struct _SYSTEM_HANDLE_INFORMATION64
{
    ULONG HandleCount;
    SYSTEM_HANDLE64 Handles[1];
} SYSTEM_HANDLE_INFORMATION64, *PSYSTEM_HANDLE_INFORMATION64;


typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
    UNICODE_STRING TypeName;
    ULONG Reserved [22];
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;

typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
    ULONG Attributes;
    ACCESS_MASK GrantedAccess;
    ULONG HandleCount;
    ULONG PointerCount;
    ULONG Reserved[10];
 } PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;

typedef struct _OBJECT_TYPES_INFORMATION {
    ULONG NumberOfTypes;
    // OBJECT_TYPE_INFORMATION TypeInformation;
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;

typedef struct tagSOLE_AUTHENTICATION_SERVICE {
    DWORD dwAuthnSvc;
    DWORD dwAuthzSvc;
    OLECHAR *pPrincipalName;
    HRESULT hr;
} SOLE_AUTHENTICATION_SERVICE, *PSOLE_AUTHENTICATION_SERVICE;

typedef struct _OBJECT_DIRECTORY_INFORMATION
{
    UNICODE_STRING Name;
    UNICODE_STRING TypeName;
} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;



typedef struct _DEBUG_VALUE_TMP_SUBSTRUCT1
{
    ULONG64 I64;
    BOOL Nat;
} DEBUG_VALUE_TMP_SUBSTRUCT1;

typedef struct _DEBUG_VALUE_TMP_SUBSTRUCT2
{
        ULONG LowPart;
        ULONG HighPart;
} DEBUG_VALUE_TMP_SUBSTRUCT2;

typedef struct _DEBUG_VALUE_TMP_SUBSTRUCT3
{
        ULONG64 LowPart;
        LONG64 HighPart;
} DEBUG_VALUE_TMP_SUBSTRUCT3;

typedef union _DEBUG_VALUE_TMP_UNION
{
    UCHAR I8;
    USHORT I16;
    ULONG I32;
    _DEBUG_VALUE_TMP_SUBSTRUCT1 tmp_sub_struct_1;
    FLOAT F32;
    DOUBLE F64;
    UCHAR F80Bytes[10];
    UCHAR F82Bytes[11];
    UCHAR F128Bytes[16];
    UCHAR VI8[16];
    USHORT VI16[8];
    ULONG VI32[4];
    ULONG64 VI64[2];
    FLOAT VF32[4];
    DOUBLE VF64[2];
    DEBUG_VALUE_TMP_SUBSTRUCT2 I64Parts32;
    DEBUG_VALUE_TMP_SUBSTRUCT3 F128Parts64;
    UCHAR RawBytes[24];
} DEBUG_VALUE_TMP_UNION;


typedef struct _DEBUG_VALUE
{
    _DEBUG_VALUE_TMP_UNION u;
    ULONG TailOfRawBytes;
    ULONG Type;
} DEBUG_VALUE, *PDEBUG_VALUE;

typedef struct _DEBUG_SYMBOL_PARAMETERS
{
    ULONG64 Module;
    ULONG TypeId;
    ULONG ParentSymbol;
    ULONG SubElements;
    ULONG Flags;
    ULONG64 Reserved;
} DEBUG_SYMBOL_PARAMETERS, *PDEBUG_SYMBOL_PARAMETERS;

typedef struct _DEBUG_SYMBOL_ENTRY
{
    ULONG64 ModuleBase;
    ULONG64 Offset;
    ULONG64 Id;
    ULONG64 Arg64;
    ULONG Size;
    ULONG Flags;
    ULONG TypeId;
    ULONG NameSize;
    ULONG Token;
    ULONG Tag;
    ULONG Arg32;
    ULONG Reserved;
} DEBUG_SYMBOL_ENTRY, *PDEBUG_SYMBOL_ENTRY;

typedef struct _DEBUG_MODULE_PARAMETERS
{
    ULONG64 Base;
    ULONG Size;
    ULONG TimeDateStamp;
    ULONG Checksum;
    ULONG Flags;
    ULONG SymbolType;
    ULONG ImageNameSize;
    ULONG ModuleNameSize;
    ULONG LoadedImageNameSize;
    ULONG SymbolFileNameSize;
    ULONG MappedImageNameSize;
    ULONG64 Reserved[2];
} DEBUG_MODULE_PARAMETERS, *PDEBUG_MODULE_PARAMETERS;

typedef struct _DEBUG_MODULE_AND_ID
{
    ULONG64 ModuleBase;
    ULONG64 Id;
} DEBUG_MODULE_AND_ID, *PDEBUG_MODULE_AND_ID;

typedef struct _DEBUG_OFFSET_REGION
{
    ULONG64 Base;
    ULONG64 Size;
} DEBUG_OFFSET_REGION, *PDEBUG_OFFSET_REGION;

typedef struct _DEBUG_SYMBOL_SOURCE_ENTRY
{
    ULONG64 ModuleBase;
    ULONG64 Offset;
    ULONG64 FileNameId;
    ULONG64 EngineInternal;
    ULONG Size;
    ULONG Flags;
    ULONG FileNameSize;
    ULONG StartLine;
    ULONG EndLine;
    ULONG StartColumn;
    ULONG EndColumn;
    ULONG Reserved;
} DEBUG_SYMBOL_SOURCE_ENTRY, *PDEBUG_SYMBOL_SOURCE_ENTRY;


typedef struct _RTL_UNLOAD_EVENT_TRACE {
    PVOID BaseAddress;
    SIZE_T SizeOfImage;
    ULONG Sequence;
    ULONG TimeDateStamp;
    ULONG CheckSum;
    WCHAR ImageName[32];
    ULONG Version[2];
} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;

typedef struct _RTL_UNLOAD_EVENT_TRACE32 {
    DWORD BaseAddress;
    DWORD SizeOfImage;
    ULONG Sequence;
    ULONG TimeDateStamp;
    ULONG CheckSum;
    WCHAR ImageName[32];
    ULONG Version[2];
} RTL_UNLOAD_EVENT_TRACE32, *PRTL_UNLOAD_EVENT_TRACE32;


typedef struct _RTL_UNLOAD_EVENT_TRACE64 {
    ULONGLONG BaseAddress;
    ULONGLONG SizeOfImage;
    ULONG Sequence;
    ULONG TimeDateStamp;
    ULONG CheckSum;
    WCHAR ImageName[32];
    ULONG Version[2];
} RTL_UNLOAD_EVENT_TRACE64, *PRTL_UNLOAD_EVENT_TRACE64;


typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
  ULONG FileSystemAttributes;
  LONG  MaximumComponentNameLength;
  ULONG FileSystemNameLength;
  WCHAR FileSystemName[1];
} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;

typedef struct _FILE_FS_LABEL_INFORMATION {
  ULONG VolumeLabelLength;
  WCHAR VolumeLabel[1];
} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;

typedef struct _FILE_FS_SIZE_INFORMATION {
  LARGE_INTEGER TotalAllocationUnits;
  LARGE_INTEGER AvailableAllocationUnits;
  ULONG         SectorsPerAllocationUnit;
  ULONG         BytesPerSector;
} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;

typedef struct _FILE_FS_DEVICE_INFORMATION {
  DEVICE_TYPE DeviceType;
  ULONG       Characteristics;
} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;

typedef struct _FILE_FS_CONTROL_INFORMATION {
  LARGE_INTEGER FreeSpaceStartFiltering;
  LARGE_INTEGER FreeSpaceThreshold;
  LARGE_INTEGER FreeSpaceStopFiltering;
  LARGE_INTEGER DefaultQuotaThreshold;
  LARGE_INTEGER DefaultQuotaLimit;
  ULONG         FileSystemControlFlags;
} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;

typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
  LARGE_INTEGER TotalAllocationUnits;
  LARGE_INTEGER CallerAvailableAllocationUnits;
  LARGE_INTEGER ActualAvailableAllocationUnits;
  ULONG         SectorsPerAllocationUnit;
  ULONG         BytesPerSector;
} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;

typedef struct _FILE_FS_OBJECTID_INFORMATION {
  UCHAR ObjectId[16];
  UCHAR ExtendedInfo[48];
} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;

typedef struct _FILE_FS_DRIVER_PATH_INFORMATION {
  BOOLEAN DriverInPath;
  ULONG   DriverNameLength;
  WCHAR   DriverName[1];
} FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;

typedef struct _FILE_FS_VOLUME_INFORMATION {
  LARGE_INTEGER VolumeCreationTime;
  ULONG         VolumeSerialNumber;
  ULONG         VolumeLabelLength;
  BOOLEAN       SupportsObjects;
  WCHAR         VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

typedef struct _FILE_FS_SECTOR_SIZE_INFORMATION {
  ULONG LogicalBytesPerSector;
  ULONG PhysicalBytesPerSectorForAtomicity;
  ULONG PhysicalBytesPerSectorForPerformance;
  ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity;
  ULONG Flags;
  ULONG ByteOffsetForSectorAlignment;
  ULONG ByteOffsetForPartitionAlignment;
} FILE_FS_SECTOR_SIZE_INFORMATION, *PFILE_FS_SECTOR_SIZE_INFORMATION;

// THX ReactOS

typedef struct _RTLP_CURDIR_REF
{
     LONG RefCount;
     HANDLE Handle;
} RTLP_CURDIR_REF, *PRTLP_CURDIR_REF;


typedef struct _RTL_RELATIVE_NAME_U
{
    UNICODE_STRING RelativeName;
    HANDLE ContainingDirectory;
    PRTLP_CURDIR_REF CurDirRef;
} RTL_RELATIVE_NAME_U, *PRTL_RELATIVE_NAME_U;

typedef enum _RTL_PATH_TYPE
{
    RtlPathTypeUnknown,
    RtlPathTypeUncAbsolute,
    RtlPathTypeDriveAbsolute,
    RtlPathTypeDriveRelative,
    RtlPathTypeRooted,
    RtlPathTypeRelative,
    RtlPathTypeLocalDevice,
    RtlPathTypeRootLocalDevice
} RTL_PATH_TYPE;



// Based on Alex Ionescu works on HookingNirvana
// https://github.com/ionescu007/HookingNirvana/blob/master/instrument/main.c

typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION
{
    ULONG Version;
    ULONG Reserved;
    PVOID Callback;
} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, *PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;


typedef struct _PROCESS_MEMORY_COUNTERS {
  DWORD  cb;
  DWORD  PageFaultCount;
  SIZE_T PeakWorkingSetSize;
  SIZE_T WorkingSetSize;
  SIZE_T QuotaPeakPagedPoolUsage;
  SIZE_T QuotaPagedPoolUsage;
  SIZE_T QuotaPeakNonPagedPoolUsage;
  SIZE_T QuotaNonPagedPoolUsage;
  SIZE_T PagefileUsage;
  SIZE_T PeakPagefileUsage;
} PROCESS_MEMORY_COUNTERS, *PPROCESS_MEMORY_COUNTERS;


typedef struct _PROCESS_MEMORY_COUNTERS_EX {
  DWORD  cb;
  DWORD  PageFaultCount;
  SIZE_T PeakWorkingSetSize;
  SIZE_T WorkingSetSize;
  SIZE_T QuotaPeakPagedPoolUsage;
  SIZE_T QuotaPagedPoolUsage;
  SIZE_T QuotaPeakNonPagedPoolUsage;
  SIZE_T QuotaNonPagedPoolUsage;
  SIZE_T PagefileUsage;
  SIZE_T PeakPagefileUsage;
  SIZE_T PrivateUsage;
} PROCESS_MEMORY_COUNTERS_EX;


typedef struct _FILETIME {
  DWORD dwLowDateTime;
  DWORD dwHighDateTime;
} FILETIME, *PFILETIME, *LPFILETIME;


typedef enum _NT_PRODUCT_TYPE {
    NtProductWinNt = 1,
    NtProductLanManNt,
    NtProductServer
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;