Pack attributes into a compound bitfield

Remove a NOP from the shellcode, adjust jump and labels

Add a breakpoint, bp can be: * a :class:`Breakpoint` (addr and type must be ``None``) * any callable (addr and type must NOT

Adjust the token privileges according to ``privileges``. This API is the `complex one` to adjust multiple privileges at once. To simp

Return a list with all the query results :rtype: [:class:`EvtEvent`] -- A list of Event

Bind to the ``IID_str`` with the given ``version`` :returns: :class:`windows.generated_def.IID`

Return 32 or 64

Return 32 or 64

Call method number ``method_offset`` of interface ``IID`` with mashalled ``params`` :param IID IID: An IID previously returned by :func:`

Close the handle of the pipe

Connect to ``namespace`` using ``user`` and ``password`` for authentification if given :return: :class:`WmiNamespace` - The connected :class:

Connect to the ALPC port ``port_name``. Most of the parameters have defauls value is ``None`` is passed. :param AlpcMessage connect_messa

Check whether the section contains the file offset provided.

Enumerate the classes in the ``namespace`` that match ``superclass``. if ``superclass`` is None will enumerate all top-level class. ``deep`` a

Create a new console displaying STDOUT. Useful in injection of GUI process

Enumerate the instances of ``clsname``. Deep allows to enumerate the instance of subclasses as well :returns: :class:`WmiEnumeration`

Create the ALPC port ``port_name``. Most of the parameters have defauls value is ``None`` is passed. :param str port_name: The port's nam

Create a process and debug it. :rtype: :class:`Debugger`

Disable the IAT hook

Duplicate the certificate by incrementing the internal refcount. (see `CertDuplicateCertificateContext <https://msdn.microsoft.com/en-us/library/windo

Enable the IAT hook: you MUST keep a reference to the IATHook while the hook is enabled

Calculate the entropy of a chunk of data.