<summary> Get process data execution prevention state </summary> <returns>true if DEP is enabled for process</returns>

<summary> Try to load driver if it isn't loaded </summary> <param name="path">Path to the driver file</param> <returns>Status code</returns>

<summary> Create new thread with specified entry point and argument </summary> <param name="pCode">Entry point</param> <param name="arg">Thread functi

<summary> Read virtual memory </summary> <param name="lpBaseAddress">Memory address</param> <param name="lpBuffer">Output buffer</param> <param name="

<summary> Set last NT status </summary> <param name="status">The status.</param> <returns></returns>

<summary> Write process memory </summary> <param name="pid">Target PID</param> <param name="base">Target base</param> <param name="size">Data size</pa

Add register count by `classId`.

<summary> Gets all process threads </summary> <returns>Threads collection</returns>

Get allocable input registers (mask).

Get comment string.

Get instruction group, see \ref kX86InstEncodingId.

<summary> Get main process thread </summary> <returns>Pointer to thread object, nullptr if failed</returns>

Get stack size used by mov sequences in prolog/epilog.

Get operands list.

Get the output register index or `kInvalidReg`.

Get stack size used by push/pop sequences in prolog/epilog.

Get immediate value as 32-bit unsigned integer.

Get hint value.

Get whether the _funcFlags has `flag`

Get whether the node has variable liveness bits.

Get whether the type of the memory operand is either `kMemTypeBaseIndex` or `kMemTypeStackIndex`.

Get whether the register is Gp dword (32-bit) register.

Get whether the register is Gp word (16-bit) register.

Get whether register code is equal to `type`.

Get whether the node has been translated.

\internal Single rotation.

Set comment string to `str`.

Set mandatory input registers (mask).

<summary> Allocate kernel memory and map into User space. Or free previously allocated memory </summary> <param name="pProcess">Target process object<

<summary> Search process entry in list by PID </summary> <param name="pid">PID.</param> <param name="asHost">If set to TRUE, pid is treated as host PI

<summary> Map kernel page into current process address space </summary> <param name="pMDL">Page MDL</param> <param name="pResult">Mapped address</para

<summary> Allocate new Unicode string from Paged pool </summary> <param name="result">Resulting string</param> <param name="size">Buffer size in bytes

<summary> Allocate and copy string </summary> <param name="result">Resulting string</param> <param name="source">Source string</param> <returns>Status

<summary> Get rid of EXECUTABLE flag if DEP isn't enabled </summary> <param name="prot">Memory protection flags</param> <param name="bDEP">DEP flag</p

<summary> Create the thread. </summary> <param name="threadProc">Thread enty point</param> <param name="arg">Thread argument.</param> <param name="fla

<summary> Retrieve data directory address </summary> <param name="index">Directory index</param> <param name="keepRelative">Keep address relative to i

<summary> Create new thread and execute code in it. Wait until execution ends </summary> <param name="pCode">Code to execute</param> <param name="size

<summary> Get page hardware PTE. Address must be valid, otherwise bug check is imminent </summary> <param name="pAddress">Target address</param> <retu

<summary> Gets SSDT base - KiServiceTable </summary> <returns>SSDT base, NULL if not found</returns>

<summary> Hook function </summary> <param name="ptr">Target function address</param> <param name="hkPtr">Hook function address</param> <param name="ty

<summary> Join thread </summary> <param name="timeout">Join timeout</param> <returns>true on success</returns>

<summary> Load image from file </summary> <param name="path">File path</param> <param name="skipActx">If true - do not initialize activation context</

<summary> Manually map PE image into underlying target process </summary> <param name="path">Image path</param> <param name="flags">Image mapping flag

<summary> Remove list entry </summary> <param name="Entry">Entry link</param>

<summary> Setup one of the 4 possible memory hooks: </summary> <param name="hkType"> Type of hook to install MemVirtualAlloc - hook NtAllocateVirtualM

Append `c` of `len`.

Get the input register index or `kInvalidReg`.

Get instruction ID, see `kX86InstId`.

Get type of the operand, see `kOperandType`.

<summary> Gets WOW64 PEB </summary> <param name="ppeb">Retrieved PEB</param> <returns>PEB pointer</returns>

Get function return value.

<summary> Get total size of all stack variables </summary> <returns></returns>

Get whether the memory operand has 32-bit GP base.

<summary> Get image base address </summary> <returns>Image base</returns>

Whether the node is `InstNode` and unconditional jump.

Whether the node is `InstNode` and conditional/unconditional jump.

Get whether the operand is none - `kOperandTypeNone`.

Get whether the stack frame register is preserved. \note Used only when stack is misaligned.

<summary> Get WOW64 PEB </summary> <param name="ppeb">Retrieved PEB32</param> <returns>PEB pointer</returns>

<summary> Get native PEB </summary> <param name="ppeb">Retrieved PEB64</param> <returns>PEB pointer</returns>

<summary> </summary> <returns>Return address</returns>

<summary> Enumerate committed, accessible, non-guarded memory regions </summary> <param name="pList">Region list</param> <param name="start">Region st

<summary> Unmap pages, destroy MDLs, remove entry from list </summary> <param name="attached">TRUE indicates that function is executed in the context

<summary> Create new thread in the target process Must be running in target process context </summary> <param name="pBaseAddress">Thread start address

<summary> Find memory region containing at least one byte from specific region </summary> <param name="pList">Region list to search in</param> <param

<summary> Find memory allocation process entry </summary> <param name="pid">Target PID</param> <returns>Found entry, NULL if not found</returns>

<summary> Queue user-mode APC to the target thread </summary> <param name="pThread">Target thread</param> <param name="pUserFunc">APC function</param>

<summary> Enable/disable process protection flag </summary> <param name="pProtection">Request params</param> <returns>Status code</returns>

<summary> Set stack reservation policy on call generation </summary> <param name="state"> If true - stack space will be reserved during each call gene

<summary> Execute code in context of any existing thread </summary> <param name="pCode">Cde to execute</param> <param name="size">Code size.</param> <