Virtualization/Sandbox Evasion

Tests whether a process is running inside a specific (or any) job object.

Sets a property on a thread via the THREADINFOCLASS enum — most famously ThreadHideFromDebugger.

Returns the current value of the high-resolution performance counter and optionally its frequency.

Returns the zero-based logical-processor index the calling thread is currently executing on.

Opens a handle to an existing named event object.

Waits until a dispatcher object becomes signaled or the optional timeout expires.

Waits on up to MAXIMUM_WAIT_OBJECTS dispatcher objects with either WaitAny or WaitAll semantics.

Creates or opens a named or unnamed mutant (mutex) object and optionally takes initial ownership.

Suspends the calling thread for a specified interval, optionally in an alertable state.

Returns the current system time as a 64-bit count of 100-ns intervals since 1601-01-01 UTC.

Retrieves accounting, limits or UI-restriction information about a job object.

Returns metadata about an open registry key — name, class, subkey/value counts, last-write time.

Acquires a byte-range lock on an open file, optionally exclusive and optionally asynchronous.

Releases a previously-acquired byte-range lock on an open file.

Registers an asynchronous notification request for filesystem changes within an opened directory handle.

Looks up an existing global atom by name and returns its 16-bit ID without incrementing the refcount.

Reads the system's BCD boot options blob — debug flags, OS load options, hypervisor settings, test signing.

Requests the power manager to perform a system-wide power action (sleep, hibernate, shutdown, reboot).