#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Thread execution
//
/**
 * The NtDelayExecution routine suspends the current thread until the specified condition is met.
 *
 * \param Alertable The function returns when either the time-out period has elapsed or when the APC function is called.
 * \param DelayInterval The time interval for which execution is to be suspended, in milliseconds.
 * - A value of zero causes the thread to relinquish the remainder of its time slice to any other thread that is ready to run.
 * - If there are no other threads ready to run, the function returns immediately, and the thread continues execution.
 * - A value of INFINITE indicates that the suspension should not time out.
 * \return NTSTATUS Successful or errant status. The return value is STATUS_USER_APC when Alertable is TRUE, and the function returned due to one or more I/O completion callback functions.
 * \remarks Note that a ready thread is not guaranteed to run immediately. Consequently, the thread will not run until some arbitrary time after the sleep interval elapses,
 * based upon the system "tick" frequency and the load factor from other processes.
 * \see https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-sleepex
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDelayExecution(
    _In_ BOOLEAN Alertable,
    _In_ PLARGE_INTEGER DelayInterval
    );
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDelayExecution(
    _In_ BOOLEAN Alertable,
    _In_ PLARGE_INTEGER DelayInterval
    );
View code on GitHubInitiates a sleep on the current thread.
Alertable - determines whether the sleep should be altertable. This allows external triggers (such as APCs or calls to NtAlertThread) to interrupt sleep prematurely.DelayInterval - a pointer to a variable that stores the wait internal. A negative value indicates relative timeout for the specified number of 100-nanosecond intervals. To sleep for a specific number of milliseconds, multiply them by -10,000. Positive values indicate an absolute time.STATUS_SUCCESS - the thread woke due to the timeout.STATUS_USER_APC - the sleep was interrupted by an APC.STATUS_ALERTED - the sleep was interrupted by a call to NtAlertThread.STATUS_NO_YIELD_PERFORMED - a zero-timeout sleep did not cause switching to other threads.Despite the name, NtAlertThreadByThreadId is unrelated to alertable sleeps and cannot interrupt them.
If set, execution can break in a result of NtAlertThread call.
Delay in 100-ns units. Negative value means delay relative to current.