#pragma once

#ifndef NT_FUNCS_H
#define NT_FUNCS_H

#include <Windows.h>

enum _THREADINFOCLASS
{
    ThreadBasicInformation,
    ThreadTimes,
    ThreadPriority,
    ThreadBasePriority,
    ThreadAffinityMask,
    ThreadImpersonationToken,
    ThreadDescriptorTableEntry,
    ThreadEnableAlignmentFaultFixup,
    ThreadEventPair,
    ThreadQuerySetWin32StartAddress,
    ThreadZeroTlsCell,
    ThreadPerformanceCount,
    ThreadAmILastThread,
    ThreadIdealProcessor,
    ThreadPriorityBoost,
    ThreadSetTlsArrayAddress,
    ThreadIsIoPending,
    ThreadHideFromDebugger,
    ThreadBreakOnTermination,
    ThreadSwitchLegacyState,
    ThreadIsTerminated,
    ThreadLastSystemCall,
    ThreadIoPriority,
    ThreadPagePriority,
    ThreadActualBasePriority,
    ThreadTebInformation,
    ThreadCSwitchMon,
    ThreadCSwitchPmu,
    ThreadWow64Context,
    ThreadGroupInformation,
    ThreadUmsInformation,
    ThreadCounterProfiling,
    ThreadIdealProcessorEx,
    ThreadCpuAccountingInformation,
    ThreadSuspendCount,
    ThreadHeterogeneousCpuPolicy,
    ThreadContainerId,
    ThreadNameInformation,
    ThreadProperty,
    ThreadSelectedCpuSets,
    ThreadSystemThreadInformation,
    MaxThreadInfoClass
};
typedef _THREADINFOCLASS THREADINFOCLASS;
//  NtQueryInformationThread
//  NtSetInformationThread

enum _MEMORY_INFORMATION_CLASS
{
    MemoryBasicInformation,
    MemoryWorkingSetInformation,
    MemoryMappedFilenameInformation,
    MemoryRegionInformation,
    MemoryWorkingSetExInformation,
    MemorySharedCommitInformation
};
typedef _MEMORY_INFORMATION_CLASS MEMORY_INFORMATION_CLASS;
typedef _MEMORY_INFORMATION_CLASS MEMORYINFOCLASS;
//  NtQueryVirtualMemory


enum _PROCESSINFOCLASS
{
    ProcessBasicInformation,
    ProcessQuotaLimits,
    ProcessIoCounters,
    ProcessVmCounters,
    ProcessTimes,
    ProcessBasePriority,
    ProcessRaisePriority,
    ProcessDebugPort,
    ProcessExceptionPort,
    ProcessAccessToken,
    ProcessLdtInformation,
    ProcessLdtSize,
    ProcessDefaultHardErrorMode,
    ProcessIoPortHandlers,
    ProcessPooledUsageAndLimits,
    ProcessWorkingSetWatch,
    ProcessUserModeIOPL,
    ProcessEnableAlignmentFaultFixup,
    ProcessPriorityClass,
    ProcessWx86Information,
    ProcessHandleCount,
    ProcessAffinityMask,
    ProcessPriorityBoost,
    ProcessDeviceMap,
    ProcessSessionInformation,
    ProcessForegroundInformation,
    ProcessWow64Information,
    ProcessImageFileName,
    ProcessLUIDDeviceMapsEnabled,
    ProcessBreakOnTermination,
    ProcessDebugObjectHandle,
    ProcessDebugFlags,
    ProcessHandleTracing,
    ProcessIoPriority,
    ProcessExecuteFlags,
    ProcessResourceManagement,
    ProcessCookie,
    ProcessImageInformation,
    ProcessCycleTime,
    ProcessPagePriority,
    ProcessInstrumentationCallback,
    ProcessThreadStackAllocation,
    ProcessWorkingSetWatchEx,
    ProcessImageFileNameWin32,
    ProcessImageFileMapping,
    ProcessAffinityUpdateMode,
    ProcessMemoryAllocationMode,
    ProcessGroupInformation,
    ProcessTokenVirtualizationEnabled,
    ProcessConsoleHostProcess,
    ProcessWindowInformation,
    ProcessHandleInformation,
    ProcessMitigationPolicy,
    ProcessDynamicFunctionTableInformation,
    ProcessHandleCheckingMode,
    ProcessKeepAliveCount,
    ProcessRevokeFileHandles,
    ProcessWorkingSetControl,
    ProcessHandleTable,
    ProcessCheckStackExtentsMode,
    ProcessCommandLineInformation,
    ProcessProtectionInformation,
    ProcessMemoryExhaustion,
    ProcessFaultInformation,
    ProcessTelemetryIdInformation,
    ProcessCommitReleaseInformation,
    ProcessDefaultCpuSetsInformation,
    ProcessAllowedCpuSetsInformation,
    ProcessReserved1Information,
    ProcessReserved2Information,
    ProcessSubsystemProcess,
    ProcessJobMemoryInformation,
    MaxProcessInfoClass
};
typedef _PROCESSINFOCLASS PROCESSINFOCLASS;
//  NtQueryInformationProcess
//  NtSetInformationProcess

struct SECTION_INFO
{
    WORD Len;
    WORD MaxLen;
    wchar_t * szData;
    BYTE pData[MAX_PATH * 2];
};
// NtQueryVirtualMemory: MemoryMappedFilenameInformation

struct UNICODE_STRING
{
    WORD        Length;
    WORD        MaxLength;
    wchar_t *   szBuffer;
};

struct LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY      InLoadOrder;
    LIST_ENTRY      InMemoryOrder;
    LIST_ENTRY      InInitOrder;
    void *          DllBase;
    void *          EntryPoint;
    ULONG           SizeOfImage;
    UNICODE_STRING  FullDllName;
    UNICODE_STRING  BaseDllName;
};

struct PEB_LDR_DATA
{
    BYTE        Res[12];
    LIST_ENTRY  InLoadOrderModuleListHead;
    LIST_ENTRY  InMemoryOrderModuleListHead;
    LIST_ENTRY  InInitializationOrderModuleListHead;
};

struct PEB
{
    void * Reserved[3];
    PEB_LDR_DATA * pLdrData;
};

struct PROCESS_BASIC_INFORMATION
{
    void *      Res1;
    PEB *       pPEB;
    void *      Res2[2];
    ULONG_PTR   Res3;
    void *      Res4;
}; //NtQueryInformationProcess: ProcessBasicInformation

typedef struct _PS_ATTRIBUTE
{
    ULONG       Attribute;
    SIZE_T      Size;
    union
    {
        ULONG   Value;
        void *  ValuePtr;
    };
    SIZE_T *    ReturnLength;
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;
// NtCreateThreadEx

typedef struct _PS_ATTRIBUTE_LIST
{
    SIZE_T Size;
    PS_ATTRIBUTE Attributes[1];
} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;
// NtCreateThreadEx

typedef struct _OBJECT_ATTRIBUTES
{
    ULONG           Length;
    HANDLE          hRootDirectory;
    UNICODE_STRING *pObjectName;
    ULONG           Attributes;
    void *          SecurityDescriptor;
    void *          SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
// NtCreateThreadEx


typedef NTSTATUS(__stdcall * f_NtQueryInformationThread)(HANDLE hThread, THREADINFOCLASS TIC, void * pBuffer, ULONG BufferSize, ULONG * SizeOut);
typedef NTSTATUS(__stdcall * f_NtSetInformationThread)(HANDLE hThread, THREADINFOCLASS TIC, void * pBuffer, ULONG BufferSize);

typedef NTSTATUS(__stdcall * f_NtQueryVirtualMemory)(HANDLE hProc, void * pBase, MEMORYINFOCLASS MIC, void * pBuffer, SIZE_T BufferSize, SIZE_T * SizeOut);

typedef NTSTATUS(__stdcall * f_NtQueryInformationProcess)(HANDLE hProc, PROCESSINFOCLASS PIC, void * pBuffer, ULONG BufferSize, ULONG * SizeOut);
typedef NTSTATUS(__stdcall * f_NtSetInformationProcess)(HANDLE hProc, PROCESSINFOCLASS PIC, void * pBuffer, ULONG BufferSize);

typedef NTSTATUS(__stdcall * f_NtReadVirtualMemory)(HANDLE hProc, void * pAddress, void * pBuffer, ULONG BufferSize, ULONG * SizeOut);
typedef NTSTATUS(__stdcall * f_NtWriteVirtualMemory)(HANDLE hProc, void * pAddress, void * pBuffer, ULONG BufferSize, ULONG * SizeOut);

typedef NTSTATUS(__stdcall * f_LdrLoadDll)(wchar_t * szOptPath, ULONG ulFlags, UNICODE_STRING * pModuleFileName, HANDLE * pOut);

typedef NTSTATUS(__stdcall * f_NtCreateThreadEx)(HANDLE * pHandle, ACCESS_MASK DesiredAccess, void * pAttr, HANDLE hProc, void * pFunc, void * pArg,
    ULONG Flags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaxStackSize, void * pAttrListOut);
#endif