• Win32
    • ApiSetSchema
      • Versions
        • 6.1
        • 6.2
        • 6.3
        • 10.0
      • API Sets
        • API-MS-Win-Core-Console-L1-1-0
        • API-MS-Win-Core-DateTime-L1-1-0
        • API-MS-Win-Core-Debug-L1-1-0
        • API-MS-Win-Core-DelayLoad-L1-1-0
        • API-MS-Win-Core-ErrorHandling-L1-1-0
        • API-MS-Win-Core-Fibers-L1-1-0
        • API-MS-Win-Core-File-L1-1-0
        • API-MS-Win-Core-Handle-L1-1-0
        • API-MS-Win-Core-Heap-L1-1-0
        • API-MS-Win-Core-Interlocked-L1-1-0
        • API-MS-Win-Core-IO-L1-1-0
        • API-MS-Win-Core-LibraryLoader-L1-1-0
        • API-MS-Win-Core-Localization-L1-1-0
        • API-MS-Win-Core-LocalRegistry-L1-1-0
        • API-MS-Win-Core-Memory-L1-1-0
        • API-MS-Win-Core-Misc-L1-1-0
        • API-MS-Win-Core-NamedPipe-L1-1-0
        • API-MS-Win-Core-ProcessEnvironment-L1-1-0
        • API-MS-Win-Core-ProcessThreads-L1-1-0
        • API-MS-Win-Core-Profile-L1-1-0
        • API-MS-Win-Core-RtlSupport-L1-1-0
        • API-MS-Win-Core-String-L1-1-0
        • API-MS-Win-Core-Synch-L1-1-0
        • API-MS-Win-Core-SysInfo-L1-1-0
        • API-MS-Win-Core-ThreadPool-L1-1-0
        • API-MS-Win-Core-UMS-L1-1-0
        • API-MS-Win-Core-Util-L1-1-0
        • API-MS-Win-Core-XState-L1-1-0
        • API-MS-Win-Security-Base-L1-1-0
        • API-MS-Win-Security-LSALookup-L1-1-0
        • API-MS-Win-Security-SDDL-L1-1-0
        • API-MS-Win-Service-Core-L1-1-0
        • API-MS-Win-Service-Management-L1-1-0
        • API-MS-Win-Service-Management-L2-1-0
        • API-MS-Win-Service-winsvc-L1-1-0
    • NTDLL
      • Versions
        • Exports History
          • Version Credibility
          • 3.10
          • 3.50
          • 3.51
          • 4.0
          • 5.0
          • 5.1
          • 5.2
          • 6.0
          • 6.1
            • Named Exports
            • Ordinal-Only Exports
          • 6.2
          • 6.3
          • 10.0
      • API
        • The Native API
        • CSR Utilities
          • CsrAllocateCaptureBuffer
          • CsrAllocateCapturePointer
          • CsrAllocateMessagePointer
          • CsrCaptureMessageBuffer
          • CsrClientCallServer
        • Event Tracing
          • Event API
            • Functions
              • EtwNotificationRegister
              • EtwEventWrite
              • EtwEventWriteEx
              • EtwEventWriteFull
              • EtwEventWriteNoRegistration
              • EtwEventWriteTransfer
          • Event Support
            • Structures
              • ETW_REGISTRATION_ENTRY
            • The User-Mode REGHANDLE
          • GUID Registration
            • Functions
              • EtwCreateTraceInstanceId
              • EtwGetTraceEnableFlags
              • EtwGetTraceEnableLevel
              • EtwGetTraceLoggerHandle
              • EtwRegisterTraceGuids
          • Notifications
            • Functions
              • EtwSendNotification
          • User-Mode Logger
            • Structures
              • ETW_UM_LOGGER_CONTEXT
          • EtwEventWriteEndScenario
          • EtwEventWriteStartScenario
          • EtwRegisterSecurityProvider
          • EtwWriteUMSecurityEvent
        • Loader Functions
          • LdrLockLoaderLock
          • LdrUnlockLoaderLock
        • Loader Initialisation
          • Functions
            • LdrQueryImageFileExecutionOptions
            • RtlGetNtVersionNumbers
        • Run-Time Library
          • Execution
            • LdrOpenImageFileOptionsKey
            • LdrQueryImageFileExecutionOptionsEx
            • LdrQueryImageFileKeyOption
          • Process Environment
            • RtlSetProcessIsCritical
          • Registry Utilities
            • RtlGetNtGlobalFlags
    • CSRSRV
      • API
        • API Requests
          • Functions
            • CsrCallServerFromServer
          • Structures
            • CSR_API_CONNECTINFO
            • CSR_API_MSG
            • CSR_CAPTURE_HEADER
          • Enumerations
            • CSR_REPLY_STATUS
        • Process
          • Structures
            • CSR_PROCESS
            • CSR_THREAD
        • Server Initialisation
          • API Routines
        • Server DLLs
          • Structures
            • CSR_SERVER_DLL
    • BASESRV
      • API
        • Server Initialisation
          • API Routines
    • WINSRV
      • API
        • Console Server
          • Server Initialisation
            • API Routines
        • User Server
          • Server
            • API Routines
    • KERNELBASE
      • Versions
        • 6.1
        • 6.2
        • 6.3
        • 10.0
      • Functions
    • KERNEL32
      • Versions
        • 3.51
        • 4.0
          • Named Exports
          • Ordinal-Only Exports
        • 4.10
          • Named Exports
          • Ordinal-Only Exports
        • 4.90
          • Named Exports
          • Ordinal-Only Exports
        • 5.0
        • 5.1
        • 5.2
        • 6.0
        • 6.1
        • 6.2
        • 6.3
        • 10.0
      • Functions
    • USER32
      • Structures
        • CLS
        • HANDLEENTRY
        • HEAD
        • PROCDESKHEAD
        • PROCMARKHEAD
        • PROCOBJHEAD
        • SBDATA
        • SBINFO
        • SHROBJHEAD
        • THRDESKHEAD
        • THROBJHEAD
        • WND
          • ExStyle
          • ExStyle2
          • state
          • state2
          • style
    • ADVAPI32
      • Versions
        • 3.51
        • 4.0
        • 4.70
        • 4.80
        • 4.90
        • 5.0
        • 5.1
        • 5.2
        • 6.0
        • 6.1
          • Named Exports
          • Ordinal-Only Exports
        • 6.2
        • 6.3
        • 10.0
      • Functions
        • Event Tracing
          • Logging API
            • Functions
              • StartTrace
              • TraceEvent
              • TraceEventInstance
              • TraceMessage
              • TraceMessageVa
              • TraceQueryInformation
              • TraceSetInformation
            • Structures
              • EVENT_TRACE_PROPERTIES
    • Services
      • The Service Control Manager
        • Versions
        • Events
          • System Log
          • Diagnostic Log
          • WPP Software Tracing
        • The Original Service Host
          • Service DLL Functions
            • ServiceEntry
          • Host Structures
            • SVCS_GLOBAL_DATA
      • The Service Host
        • Versions
        • Per-Process Initialisation
          • SVCHOST Structures
            • SVCHOST_GLOBAL_DATA
          • SVCHOST Functions
            • NetBiosClose
            • NetBiosOpen
            • NetBiosReset
            • RegisterStopCallback
            • StartRpcServer
            • StopRpcServer
            • StopRpcServerEx
        • Service DLL Functions
          • ServiceMain
          • SvchostPushServiceGlobals
    • FVEAPI (BitLocker)
      • Policy Settings
    • COM
      • Interfaces
        • IGlobalOptions
        • ISecurityOptions
    • APPHELP
      • Versions
        • 5.1
        • 5.2
        • 6.0
        • 6.1
        • 6.2
          • Named Exports
          • Ordinal-Only Exports
        • 6.3
        • 10.0
          • Named Exports
          • Ordinal-Only Exports
      • Functions
        • Attributes
          • SdbTagToString
        • Matching Information
          • Functions
            • SdbGrabMatchingInfo
            • SdbGrabMatchingInfoEx
          • Constants
            • Filter
      • Shim Database (SDB) Files
        • TAG
        • Where is ShimDBC.exe?
        • A Shim Database De-Compiler
    • Desktop Window Manager
      • DWMAPI
        • Versions
        • Functions
      • DWMCORE
        • Versions
        • Functions
      • DWMREDIR
        • Versions
        • Functions
      • MILCORE
        • Versions
        • Functions
      • UDWM
        • Versions
        • Functions
  • Other TOCs (and approximate page counts)
    • Geoff Chappell, Software Analyst (155)
      • Notes (115)
      • Studies
        • Windows
          • Kernel (739)
          • The Windows Shell (424)
          • Internet Explorer (396)
        • Visual C++ (779)