DoesProcessHaveOpenHandleTous - returns true if any handle in vector `handles` points to our process Can be used to detect open process handles

EnableProcessMitigations - enforces policies which are actioned by the system & loader to prevent dynamic code generation & execution (unsigned code w

* @brief encrypts `str` and places it into the class object's `encrypted` array. * @details Should not be called directly - use the make_encrypt

* @brief encrypts `str` and places it into the class object's `encrypted` array. * @details Should not be called directly - use the make_encrypt

EnumerateProcesses - return list of running processes ids */

* @brief class object constructor * * @details This constructor should not directly be used, instead use `EventLogger::GetInstance()` to get the s

* @brief TLS callback helper to end unknown threads without patching over their start address or calling ExitThread * * This function is executed

* @brief TLS callback helper to end unknown threads without patching over their start address or calling ExitThread * * This function is executed

* @brief Terminates threads and cleans up resources, used for fast cleanup in case of critical errors or shutdowns * * @return Error::OK on succes

FetchBlacklistedBytePatterns - read file from `url`, add each line of file to our blacklisted byte pattern list Each line of the file located at

FetchBlacklistedDrivers - read internet page at `url`, parse each line of the response to add to our blacklisted driver list returns `false` on f

* @brief Checks if an IAT is hooked for current module (will soon be expanded to all modules) * @details This routine has O(n^2) execution time, and

FillModuleList - fills the `ModuleList` class member with a list of module information returns true on success */

* @brief Finds a writable address in a specific section of a module * * This function searches for a writable address in the specified section of

FlagWithData - send a detected flag to the server (with evidence) returns `true` on success */

GetBytesAtAddress - return bytes from an address given `size`. returns a BYTE array filled with values from `address` for `size` number of bytes

Services::GetCPUVendor - fetches the CPU vendor Additionally, 0x40000001 to 0x400000FF can be queries in the 2nd parameter to __cpuid for more hyperv

* @brief Retrieves the subject name of a certificate context * @param pCertContext Pointer to the certificate context * @return A wide string contai

* @brief Checks the date of the time stamp of a signer info structure * * @param pSignerInfo Structure representing information about the cert sig

GetHandles - Returns a vector of SYSTEM_HANDLE representing all running handles on the system */

GetHardwareDevicesW - returns a list<DeviceW> representing various devices on the machine */

GetHypervisorVendor - check vendor of hypervisor, if present Common results: "Microsoft Hv" Hyper-V "KVMKVMKVM" KVM "VMwareVMware" VMware "XenV

GetIATEntries -Returns a list of ImportFunction* from the program IAT , for later hook checks returns a list of ProcessData::ImportFunction* such

GetLoadedDrivers - Fills the `DriverPaths` class member variable with a list of drivers loaded on the system returns TRUE if the function succeed

GetLoadedModules - returns a vector<MODULE_DATA>* representing a set of loaded modules in the current process returns nullptr on failure */

GetModuleHandle_Ldr - returns base address of a module as HMODULE type returns NULL on failure */

* @brief Collects hashes for a specific section of a module * @param `moduleName` address in memory to start checking from * @param `sectionName`

* @brief Collects vector of hashes for all whitelisted modules' .text sections * @return vector of ModuleHashData* object containing the module name

GetModuleInfo - returns a ProcessData::MODULE_DATA* representing the module given `name`. returns nullptr on failure/no module found */

GetModuleSize - get size of a module at address `hModule` returns the size of hModule, and 0 if hModule is invalid or error occurs */

GetParentProcessId - Get the process ID of the parents process returns the pid of the current process parent process. used to check for illegal launc

GetProcessDirectoryW - return directory of process `pid` */

GetProcessDirectoryW - return directory of process `pid` */

GetProcessIdByName - Get first pid given a process name. You should probably use GetProcessIdsByName instead. returns a DWORD pid if procNam

GetProcessIdsByName - Get all pids given a process name returns a list of DWORD pids of processes running with procName. */

GetProcessName - Returns the string name of a process with id `pid` */

* @brief Grabs the program and publisher information from a signer info structure * * @param pSignerInfo Structure representing the certificate si

GetRemoteModuleBaseAddress - fetch module base address of `moduleName` in `processId` */

* @brief Sends a GET HTTP request to a specified URL * * @param requestInfo Structure containing request data, along with response text * * @r

GetSectionAddress - Get the address of a named section of the module with the named `moduleName` returns a memory address of the section if found

* @brief Reads the .text section of a file from disk and computes its hash * @param `path` path to the file on disk * @param `sectionName` name

GetSections - gathers a list of ProcessData::Section* from the current process returns list<ProcessData::Section*>*, and an empty list if the rou

GetServiceModules - Fills the `DriverPaths` class member variable with a list of drivers loaded on the system returns TRUE if the function succee

* @brief Retrieves the signer information from a signed file * * @param filePath The path to the signed file * * @return A wide string contain

* @brief Collects a value computed from the sum of sha256 hashes * @param `Address` address in memory to start checking from * @param `nBytes` n

* @brief Retrieves the time stamp signer information from a signer info structure * * @param pSignerInfo Structure representing information about

* @brief Returns the current unix timestamp in milliseconds * @return 64-bit unsigned integer representing the unix timestamp in milliseconds * @u

GetWindowsDrive - return drive where windows is installed, such as C:\\ */

GetWindowsDriveW - return drive where windows is installed, such as C:\\ */

WindowsVersions GetWindowsVersion() - returns current machine version */

HasExportedFunction checks a loaded module if it's exported `functionName`. Useful for anti-VEH debuggers, since these generally inject themselves int

* @brief Checks code signature of a file through either embedded signature or catalog signature * * @param filePath The file path to the executabl

HideThreadFromDebugger - hides `hThread` from windows debuggers by calling NtSetInformationThread returns `true` on success */

Initialize - Initializes the network client returns Error::OK on success */

@brief Initializes the anti-cheat system with the provided license key and checks for server availability @param licenseKey The license key to authe

IsAddressInModule - check if `address` falls within a known module (element of `modules`) returns `true` if `address` falls within a known module (e

* @brief Checks if any core functionality threads are suspended, which may indicate abnormal program execution or tampering * * @return true any t

IsDebugModeEnabled - checks registry for system start option to check if debug mode is enabled returns TRUE if debug mode is enabled. */

Services::IsHypervisor - returns true if a hypervisor is detected by using the __cpuid intrinsic function the 31st bit of ECX indicates a hypervi