Process operations (#16): NtGetNextProcess
, NtTerminateProcess
, NtSuspendProcess
, NtChangeProcessState
.
Process information (#11): NtQueryInformationProcess
, NtSetInformationProcess
, and 100+ PROCESSINFOCLASS
values.
Token operations (#8): Various operations on tokens, capabilities, and AppContainer SIDs. 47 pages, including: NtCreateTokenEx
, NtOpenThreadTokenEx
, NtQueryInformationToken
, NtSetInformationToken
, NtDuplicateToken
.