Syscall reference

Reserves, commits or both a region of virtual memory in a target process.

Changes the protection on a region of committed virtual memory in a target process.

Writes a buffer from the caller into the virtual address space of a target process.

Reads bytes from the virtual address space of a target process into a caller-supplied buffer.

Opens a handle to an existing process with a requested access mask.

Creates a new thread in a target process, optionally suspended, with rich attribute list support.

Creates a section object backed by a file or the system pagefile for shared memory mapping.

Maps a view of a section object into the virtual address space of a target process.

Queues a user-mode asynchronous procedure call (APC) to a target thread.

Decrements the suspend count of a thread, resuming execution when the count reaches zero.

Opens the access token associated with a process and returns a handle to it.

Opens the access token of a process and lets the caller specify handle attributes such as OBJ_INHERIT.

Enables or disables privileges in a specified access token.

Retrieves a specified class of information about an access token.

Creates a new access token that duplicates an existing token, optionally changing its type and impersonation level.

Assigns the well-known ANONYMOUS LOGON token to the specified thread.

Causes the server thread to impersonate the security context of the client thread.

Sets a property on a thread via the THREADINFOCLASS enum — most famously ThreadHideFromDebugger.

Creates or opens a registry key — the kernel-level primitive behind every persistence beacon written to the registry.

Writes a named value into an open registry key — the workhorse for Run-key and IFEO persistence.

Creates or opens a file, directory, device, or named pipe — every dropper's first call to disk.

Writes data to an open file, pipe, or device — the kernel companion to NtCreateFile for dropping payloads.

Sets file metadata via FILE_INFORMATION_CLASS — rename, dispose (delete), allocate, end-of-file, etc.

Generic kernel setter selected by SYSTEM_INFORMATION_CLASS — gateway to SystemDebugControl, GDI driver loading and more.