<summary> Run module initializers(TLS and entry point). </summary> <param name="pImage">Image data</param> <param name="dwReason">one of the following

<summary> Save return value and signal thread return event </summary> <param name="pSetEvent">NtSetEvent address</param> <param name="ResultPtr">Resul

<summary> Search pattern in whole address space of remote process </summary> <param name="remote">Remote process</param> <param name="useWildcard">Tru

<summary> Search pattern in remote process </summary> <param name="remote">Remote process</param> <param name="wildcard">Pattern wildcard</param> <par

<summary> Default pattern matching with wildcards. std::search is approximately 2x faster than naive approach. </summary> <param name="wildcard">Patte

<summary> Call NtSetInformationProcess for underlying process </summary> <param name="infoClass">Information class</param> <param name="lpBuffer">Inpu

<summary> Call NtSetInformationProcess for underlying process </summary> <param name="infoClass">Information class</param> <param name="lpBuffer">Inpu

<summary> Set native thread context </summary> <param name="hThread">Thread handle.</param> <param name="ctx">Thread context</param> <returns>Status c

<summary> Set WOW64 thread context </summary> <param name="hThread">Thread handle.</param> <param name="ctx">Thread context</param> <returns>Status co

Get function size

<summary> Walk stack frames </summary> <param name="ip">Thread instruction pointer</param> <param name="sp">>Thread stack pointer</param> <param name=

<summary> Capture stack frames </summary> <param name="ip">Current instruction pointer</param> <param name="sp">Current stack pointer</param> <param n

<summary> Single step exception handler </summary> <param name="excpt">Exception information</param> <returns>Exception disposition</returns>

<summary> Get filename from full-qualified path </summary> <param name="path">File path</param> <returns>Filename</returns>

<summary> Suspend process </summary> <returns>Status code</returns>

<summary> Check if thread is suspended </summary> <returns>true if suspended</returns>

<summary> Switch processor into x64 mode (long mode) </summary>

<summary> Switch processor into WOW64 emulation mode </summary>

Scan all allocated process memory

<summary> Terminate existing worker thread </summary>

<summary> Cast string characters to lower case </summary> <param name="str">Source string.</param> <returns>Result string</returns>

<summary> Toggle hardware breakpoint for current thread </summary> <param name="index">Breakpoint index ( 0-4 )</param> <param name="enable">true to e

<summary> Convert UTF-8 string to wide char one </summary> <param name="str">UTF-8 string</param> <returns>wide char string</returns>

<summary> Unlink process handle table from HandleListHead </summary> <param name="pid">Target process ID</param> <returns>Status code</returns>

<summary> Unload specific module from target process. Can't be used to unload manually mapped modules </summary> <param name="hMod">Module to unload</

<summary> Unload driver </summary> <returns>Status code</returns>

<summary> Unload arbitrary driver </summary> <param name="svcName">Driver service name</param> <returns>Status</returns>

<summary> Unmap process address space from current process </summary> <returns>Status code</returns>

<summary> Ensure module is a valid PE image </summary> <param name="base">Module base address</param> <returns>true on success</returns>

<summary> Exception handler </summary> <param name="ExceptionInfo">The exception information</param> <returns>Handling status</returns>

<summary> Exception handler </summary> <param name="excpt">Exception information</param> <returns>Exception disposition</returns>