[API Referenc] Win32 matched Native API

 

Process	Win32	Native API
	OpenProcess	NtOpenProcess
	TerminateProcess	NtTerminateProcess
	CreateProcess	NtCreateProcess(Ex)/NtCreateUserProcess,
		RtlCreateUserProcess
	GetProcessId	NtQueryInformationProcess (ProcessBasicInformation)
	ExitProcess	RtlExitUserProcess (Windows Vista and later)
	GetPriorityClass	NtQueryInformationProcess (ProcessPriorityClass)
	SetPriorityClass	NtSetInformationProcess (ProcessPriorityClass)
	N/A (suspend process)	NtSuspendProcess
	N/A (resume process)	NtResumeProcess
Thread	Win32	Native API
	OpenThread	NtOpenThread
	TerminateThread	NtTerminateThread
	CreateRemoteThread(Ex)	RtlCreateUserThread/NtCreateThread(Ex)
	ExitThread	RtlExitUserThread
	GetThreadContext	NtGetContextThread
	SetThreadContext	NtSetContextThread
	SuspendThread	NtSuspendThread
	ResumeThread	NtResumeThread
	Sleep(Ex)	NtDelayExecution
Virtual memory	Win32	Native API
	VirtualAlloc(Ex)	NtAllocateVirtualMemory
	VirtualFree(Ex)	NtFreeVirtualMemory
	VirtualProtect(Ex)	NtProtectVirtualMemory
	VirtualLock	NtLockVirtualMemory
	ReadProcessMemory	NtReadVirtualMemory
	WriteProcessMemory	NtWriteVirtualMemory
	VirtualQuery(Ex)	NtQueryVirtualMemory
Heaps	Win32	Native API
	HeapCreate	RtlCreateHeap
	HeapAlloc	RtlAllocateHeap
	HeapFree	RtlFreeHeap
	HeapDestroy	RtlDestroyHeap
Objects	Win32	Native API
	CloseHandle	NtClose
	DuplicateHandle	NtDuplicateObject
	GetKernelObjectSecurity	NtQuerySecurityObject
	SetKernelObjectSecurity	NtSetSecurityObject
File system	Win32	Native API
	CreateFile	NtCreateFile
	ReadFile(Ex)	NtReadFile
	WriteFile(Ex)	NtWriteFile
	DeleteFile	NtDeleteFile/
		NtSetInformationFile (FileDispositionInformation)
	DeviceIoControl	NtDeviceIoControlFile /NtFsControlFile
System information	Win32	Native API
	GetSystemInfo	NtQuerySystemInformation (SystemBasicInformation)
	CreateToolhelp32Snapshot /EnumProcesses	NtQuerySystemInformation
		- SystemProcessInformation
		- SystemExtendedProcessInformation
Power	Win32	Native API
	SetSystemPowerState	NtInitiatePowerAction
	N/A (force shutdown)	NtShutdownSystem
	SetThreadExecutionState	NtSetThreadExecutionState
Other	Win32	Native API
	EncodePointer	RtlEncodePointer
	DecodePointer	RtlDecodePointer
	EncodeSystemPointer	RtlEncodeSystemPointer
	DecodeSystemPointer	RtlDecodeSystemPointer