MAX_PATH                        Equ 260
EXCEPTION_CONTINUE_EXECUTION    Equ 0FFFFFFFFh
EXCEPTION_CONTINUE_SEARCH       Equ 0
DETACHED_PROCESS                Equ 8h
GENERIC_READ                    Equ 80000000h
GENERIC_WRITE                   Equ 40000000h
OBJ_CASE_INSENSITIVE            Equ 00000040h
FILE_OVERWRITE_IF               Equ 00000005h
MEM_COMMIT                      Equ 1000h
MEM_RESERVE                     Equ 2000h
PROCESS_CREATE_THREAD           Equ 00000002h
PROCESS_VM_OPERATION            Equ 00000008h
PROCESS_VM_READ                 Equ 00000010h
PROCESS_VM_WRITE                Equ 00000020h
PROCESS_SET_INFORMATION         Equ 00000200h
GPTR                            Equ 00000040h
PROCESS_QUERY_INFORMATION       Equ 00000400h
KEY_READ                        Equ 00020019h
HKEY_CURRENT_USER               Equ 80000001h
ERROR_ALREADY_EXISTS            Equ 000000B7h
FILE_DIRECTORY_FILE             Equ 00000001h
FILE_SYNCHRONOUS_IO_NONALERT    Equ 00000020h
FILE_OPEN_FOR_BACKUP_INTENT     Equ 00004000h
FILE_SHARE_READ                 Equ 00000001
FILE_SHARE_WRITE                Equ 00000002
FILE_READ_DATA                  Equ 0001h
FILE_LIST_DIRECTORY             Equ 0001h
FILE_WRITE_DATA                 Equ 0002h
FILE_APPEND_DATA                Equ 0004h
FILE_WRITE_ATTRIBUTES           Equ 0100h
SYNCHRONIZE                     Equ 00100000h
FileBothDirectoryInformation    Equ 3
FileBasicInformation            Equ 4
IMAGE_FILE_MACHINE_I386         Equ 14ch    ; 14d/14e do not exist
IMAGE_FILE_32BIT_MACHINE        Equ 0100h
IMAGE_FILE_MACHINE_AMD64        Equ 8664h
IMAGE_FILE_RELOCS_STRIPPED      Equ 0001h
IMAGE_FILE_EXECUTABLE_IMAGE     Equ 0002h
IMAGE_FILE_SYSTEM               Equ 1000h
IMAGE_FILE_DLL                  Equ 2000h
IMAGE_FILE_UP_SYSTEM_ONLY       Equ 4000h
IMAGE_SUBSYSTEM_WINDOWS_GUI     Equ 2
IMAGE_SUBSYSTEM_WINDOWS_CUI     Equ 3
PAGE_READWRITE                  Equ 04
PAGE_EXECUTE_READWRITE	        Equ 00000040h
MEM_RELEASE                     Equ 8000h
STANDARD_RIGHTS_REQUIRED        Equ 000F0000h
SECTION_QUERY                   Equ 0001
SECTION_MAP_WRITE               Equ 0002
SECTION_MAP_READ                Equ 0004
IMAGE_SCN_MEM_EXECUTE           Equ 20000000h
IMAGE_SCN_MEM_WRITE             Equ 80000000h
TH32CS_SNAPPROCESS              Equ 00000002h
INFINITE                        Equ -1
FILE_ATTRIBUTE_READONLY         Equ 00000001h 
FILE_ATTRIBUTE_HIDDEN           Equ 00000002h  
FILE_ATTRIBUTE_SYSTEM           Equ 00000004h  
FILE_ATTRIBUTE_DIRECTORY        Equ 00000010h 
FILE_ATTRIBUTE_ARCHIVE          Equ 00000020h 
FILE_ATTRIBUTE_DEVICE           Equ 00000040h 
FILE_ATTRIBUTE_NORMAL           Equ 00000080h 
CREATE_ALWAYS                   Equ 2
STANDARD_RIGHTS_WRITE           Equ 00020000h
KEY_SET_VALUE                   Equ 2
KEY_CREATE_SUB_KEY              Equ 4
KEY_WRITE                       Equ (STANDARD_RIGHTS_WRITE + KEY_SET_VALUE + KEY_CREATE_SUB_KEY)
REG_SZ                          Equ 1
REG_MULTI_SZ                    Equ 7
ERROR_FILE_NOT_FOUND            Equ 2
OPEN_EXISTING                   Equ 3
KEY_NOTIFY                      Equ 10h
FILE_FLAG_BACKUP_SEMANTICS      Equ 02000000h
FILE_FLAG_OVERLAPPED            Equ 40000000h
FILE_SHARE_DELETE               Equ 4
REG_NOTIFY_CHANGE_NAME          Equ 1
REG_NOTIFY_CHANGE_ATTRIBUTES    Equ 2
REG_NOTIFY_CHANGE_LAST_SET      Equ 4
REG_NOTIFY_CHANGE_SECURITY      Equ 8
FILE_NOTIFY_CHANGE_FILE_NAME    Equ 1
FILE_NOTIFY_CHANGE_DIR_NAME     Equ 2
FILE_NOTIFY_CHANGE_ATTRIBUTES   Equ 4
FILE_NOTIFY_CHANGE_SIZE         Equ 8
FILE_NOTIFY_CHANGE_LAST_WRITE   Equ 16
FILE_NOTIFY_CHANGE_CREATION     Equ 64
WAIT_OBJECT_0                   Equ 0
FILE_ACTION_MODIFIED            Equ 3
FILE_ACTION_REMOVED             Equ 2
FILE_ACTION_RENAMED_OLD_NAME    Equ 4
FILE_ACTION_RENAMED_NEW_NAME    Equ 5
FILE_MAP_WRITE                  Equ 2
FILE_MAP_READ                   Equ 4
MEM_PRIVATE                     Equ 00020000h

Struc IO_STATUS_BLOCK
    .Status                     : Resq 1
    .pInformation               : Resq 1
EndStruc

Struc PROCESSENTRY32W
    .dwSize                     : Resd 1
    .cntUsage                   : Resd 1
    .th32ProcessID              : Resd 1
	.th32DefaultHeapID          : Resd 1
	.th32ModuleID               : Resd 1
	.cntThreads                 : Resd 1
	.th32ParentProcessID        : Resd 1
	.pcPriClassBase             : Resd 1
	.dwFlags                    : Resd 1
    .szExeFile                  : Resw MAX_PATH
EndStruc

Struc LARGE_INTEGER
    .dwordLow                   : Resd 1
    .dwordHigh                  : Resd 1
EndStruc

Struc SYSTEM_PROCESS_INFORMATION64
    .NextEntryOffset            : Resd 1
	.NumberOfThreads            : Resd 1
	.LargeIntegers              : Resq 6
	.ImageName                  : Resb UNICODE_STRING64_size
	.BasePriority               : Resq 1
	.ProcessID                  : Resq 1
EndStruc

Struc IMAGE_FILE_HEADER
    .wMachine                   :  Resw 1
    .wSectionCount              :  Resw 1
    .Unknown1                   :  Resd 1
    .Unknown2                   :  Resd 1
    .Unknown3                   :  Resd 1
    .wOptionalHeaderSize        :  Resw 1
    .wFlags                     :  Resw 1
EndStruc

Struc IMAGE_DATA_DIRECTORY
    .VirtualAddress             : Resd 1
    .Size                       : Resd 1
EndStruc

Struc IMAGE_OPTIONAL_HEADER32
    .wMagic                     : Resw 1
    .MajorLink                  : Resb 1
    .MinorLink                  : Resb 1
    .dwCodeSize                 : Resd 1
    .dwIDataSize                : Resd 1
    .dwUDataSize                : Resd 1
    .AddressOfEntryPoint        : Resd 1
    .BaseOfCode                 : Resd 1
    .BaseOfData                 : Resd 1
    .dwImageBase                : Resd 1
    .SectionAlignment           : Resd 1
    .FileAlignment              : Resd 1
    .wMajorOS                   : Resw 1
    .wMinorOS                   : Resw 1
    .wMajorImage                : Resw 1
    .wMinorImage                : Resw 1
    .MajorSubsystem             : Resw 1
    .MinorSubsystem             : Resw 1
    .Reserved1                  : Resd 1
    .ImageSize                  : Resd 1
    .SizeOfHeaders              : Resd 1
    .CheckSum                   : Resd 1
    .Subsystem                  : Resw 1
    .wDLLFlags                  : Resw 1
    .dwMaximumStackSize         : Resd 1
    .dwSizeOfStack              : Resd 1
    .dwMaximumHeapSize          : Resd 1
    .dwHeapSize                 : Resd 1
    .LDRFlags                   : Resd 1
    .RVACount                   : Resd 1
    .DataDirectory              : Resb IMAGE_DATA_DIRECTORY_size ; Export table is first data directory
EndStruc

Struc IMAGE_OPTIONAL_HEADER64
    .wMagic                     : Resw 1
    .MajorLink                  : Resb 1
    .MinorLink                  : Resb 1
    .dwCodeSize                 : Resd 1
    .dwIDataSize                : Resd 1
    .dwUDataSize                : Resd 1
    .AddressOfEntryPoint        : Resd 1
    .BaseOfCode                 : Resd 1
    .qwImageBase                : Resq 1
    .SectionAlignment           : Resd 1
    .FileAlignment              : Resd 1
    .wMajorOS                   : Resw 1
    .wMinorOS                   : Resw 1
    .wMajorImage                : Resw 1
    .wMinorImage                : Resw 1
    .MajorSubsystem             : Resw 1
    .MinorSubsystem             : Resw 1
    .Reserved1                  : Resd 1
    .dwImageSize                : Resd 1
    .SizeOfOptionalHeaders      : Resd 1
    .CheckSum                   : Resd 1
    .Subsystem                  : Resw 1
    .wDLLFlags                  : Resw 1
    .qwMaximumStackSize         : Resq 1
    .qwStackSize                : Resq 1
    .qwMaximumHeapSize          : Resq 1
    .qwHeapSize                 : Resq 1
    .LDRFlags                   : Resd 1
    .RVACount                   : Resd 1
    .DataDirectory              : Resb IMAGE_DATA_DIRECTORY_size ; Export table is first data directory
EndStruc

Struc IMAGE_EXPORT_DIRECTORY
    .Flags                      : Resd 1
    .Data                       : Resd 1
    .MajorVersion               : Resw 1
    .MinorVersion               : Resw 1
    .DLLRVA                     : Resd 1
    .OrdinalBase                : Resd 1
    .NumberOfAddresses          : Resd 1
    .NumberOfNames              : Resd 1
    .AddressOfFunctions         : Resd 1
    .AddressOfNames             : Resd 1
    .AddressOfNameOrdinals      : Resd 1
EndStruc

Struc TIB32
    .ExceptReg                  : Resd 1
    .StackBase                  : Resd 1
    .StackLimit                 : Resd 1
    .SubSystem                  : Resd 1
    .FiberData                  : Resd 1
    .UserPointer                : Resd 1
    .TibSelf                    : Resd 1
    .TibUnknown                 : Resd 5
    .pPEB                       : Resd 1
	.LastError					: Resd 1
EndStruc

Struc TIB64
    .ExceptReg                  : Resq 1
    .StackBase                  : Resq 1
    .StackLimit                 : Resq 1
    .SubSystem                  : Resq 1
    .FiberData                  : Resq 1
    .UserPointer                : Resq 1
    .TibSelf                    : Resq 1
    .TibUnknown                 : Resq 5
    .pPEB                       : Resq 1
	.LastError					: Resd 1
EndStruc

Struc PEB64
    .Unknown1                   : Resq 2
    .pImageBase                 : Resq 1
    .pLDRData                   : Resq 1
EndStruc

Struc PEB32
    .Unknown                    : Resd 2
    .pImageBase                 : Resd 1
    .pLDRData                   : Resd 1
EndStruc

Struc PEB_LDR_DATA64
    .Unknown                    : Resq 6
    .pInLoadOrderModuleList     : Resq 1
EndStruc

Struc PEB_LDR_DATA32
    .Unknown                    : Resd 5
    .pInMemoryOrderModuleList   : Resd 1
    .pInLoadOrderModuleList     : Resd 1
EndStruc

Struc UNICODE_STRING32
    .wLength                    : Resw 1
    .wMaximumLength             : Resw 1
    .Buffer                     : Resd 1
EndStruc

Struc UNICODE_STRING64
    .wLength                    : Resw 1
    .wMaximumLength             : Resw 1
    .Padding                    : Resd 1
    .Buffer                     : Resq 1
EndStruc

LoadOrderListDelta32   Equ 0 ; Since this LIST_ENTRTY is first in the structure, its start also happens so equal the structure base
MemoryOrderListDelta32 Equ 8h
InitOrderListDelta32   Equ 10h

Struc LDR_MODULE32 ; It is important to note that when we access the head of this list from the PEB LDRData, it will point to the head of this structure. However, Flink and Blink pointers in these module entries point to the next module struct BEFORE their own LIST_ENTRY. This means the Flink/Blink pointers must have a delta subtracted from them so that they point to the authentic structure base offset
	.LoadOrderFlink			    : Resd 1
	.LoadOrderBlink				: Resd 1
	;.MemoryOrderFlink			: Resd 1
	;.MemoryOrderBlink		    : Resd 1
	.InitOrderFlink			    : Resd 1
	.InitOrderBlink				: Resd 1
    .pBase                      : Resd 1
	.pEntryPoint				: Resd 1
	.dwSizeOfImage				: Resd 1
	.usFullDllName				: Resb UNICODE_STRING32_size
	.usBaseDllName				: Resb UNICODE_STRING32_size
EndStruc

Struc LDR_MODULE64 ; This is specific to the load order list.
    ;.Unknown                    : Resq 2 ; This does not represent all 3 LIST_ENTRY structures
	.Flink						: Resq 1
	.Blink						: Resq 1
    .pBase                      : Resq 1
	.pEntryPoint				: Resq 1
	.dwSizeOfImage				: Resd 1
	.Padding					: Resd 1 ; Padding for SizeOfImage
	.usFullDllName				: Resb UNICODE_STRING64_size
	.usBaseDllName				: Resb UNICODE_STRING64_size
EndStruc

Struc OBJECT_ATTRIBUTES64
    .ObjLength                  : Resq 1
    .RootDirectory              : Resq 1
    .ObjectName                 : Resq 1
    .Attributes                 : Resq 1
    .SecurityDescriptor         : Resq 1
    .SecurityQualityOfService   : Resq 1
EndStruc

Struc OBJECT_ATTRIBUTES32
    .ObjLength                  : Resd 1
    .RootDirectory              : Resd 1
    .ObjectName                 : Resd 1
    .Attributes                 : Resd 1
    .SecurityDescriptor         : Resd 1
    .SecurityQualityOfService   : Resd 1
EndStruc

Struc IMAGE_DOS_HEADER
    .e_magic                    : Resw 1
    .e_cblp                     : Resw 1
    .mzpagediv                  : Resw 1
    .mzrelocs                   : Resw 1
    .mzhdrsize                  : Resw 1
    .mzminalloc                 : Resw 1
    .mzmaxalloc                 : Resw 1
    .mzss                       : Resw 1
    .mzsp                       : Resw 1
    .mzchksum                   : Resw 1
    .mzip                       : Resw 1
    .mzcs                       : Resw 1
    .mzreloff                   : Resw 1
    .mzfiller                   : Resb 22h
    .e_lfanew                   : Resd 1
EndStruc

Struc IMAGE_SECTION_HEADER
    .Name                       : Resb 8
    .VirtualSize                : Resd 1
    .VirtualAddress             : Resd 1
    .SizeOfRawData              : Resd 1
    .PointerToRawData           : Resd 1
    .PointerToRelocations       : Resd 1
    .PointerToLinenumbers       : Resd 1
    .NumberOfRelocations        : Resw 1
    .NumberOfLinenumbers        : Resw 1
    .Characteristics            : Resd 1
EndStruc

Struc PROCESS_BASIC_INFORMATION32
    .Reserved1                  : Resd 1
    .pPEBBase                   : Resd 1
    .Reserved2                  : Resd 2
    .UniqueProcessId            : Resd 1
    .Reserved3                  : Resd 1
EndStruc

Struc PROCESS_BASIC_INFORMATION64
    .Reserved1                  : Resq 1
    .pPEBBase                   : Resq 1
    .Reserved2                  : Resq 2
    .UniqueProcessId            : Resq 1
    .Reserved3                  : Resq 1
EndStruc

Struc FILE_NOTIFY_INFORMATION
    .NextEntryOffset            : Resd 1
    .Action                     : Resd 1
    .FileNameLength             : Resd 1
    .FileName                   : Resb 1
EndStruc

Struc SYSTEMTIME
    .wYear                      : Resw 1
    .wMonth                     : Resw 1
    .wDayOfWeek                 : Resw 1
    .wDay                       : Resw 1
    .wHour                      : Resw 1
    .wMinute                    : Resw 1
    .wSecond                    : Resw 1
    .wMilliseconds              : Resw 1
EndStruc

Struc STARTUPINFO32 ; Was originally STARTUPINFOW. No distinction in terms of size is apparent though? Must be to distinguish between STARTUPINFO and STARTUPINFOEX.
    .cb                         : Resd 1
    .lpReserved                 : Resd 1
    .lpDesktop                  : Resd 1
    .lpTitle                    : Resd 1
    .dwX                        : Resd 1
    .dwY                        : Resd 1
    .dwXSize                    : Resd 1
    .dwYSize                    : Resd 1
    .dwXCountChars              : Resd 1
    .dwYCountChars              : Resd 1
    .dwFillAttribute            : Resd 1
    .dwFlags                    : Resd 1
    .wShowWindow                : Resw 1
    .cbReserved2                : Resw 1
    .lpReserved2                : Resd 1
    .hStdInput                  : Resd 1
    .hStdOutput                 : Resd 1
    .hStdError                  : Resd 1
EndStruc
	
Struc PROCESS_INFORMATION32
    .hProcess                   : Resd 1
    .hThread                    : Resd 1
    .dwProcessId                : Resd 1
    .dwThreadId                 : Resd 1
EndStruc

Struc STARTUPINFO64 ; Was originally STARTUPINFOW. No distinction in terms of size is apparent though? Must be to distinguish between STARTUPINFO and STARTUPINFOEX.
    .cb                         : Resd 1 ; 0h
	.Padding                    : Resd 1 ; 4h
    .lpReserved                 : Resq 1 ; 8h
    .lpDesktop                  : Resq 1 ; 10h
    .lpTitle                    : Resq 1 ; 18h
    .dwX                        : Resd 1 ; 20h
    .dwY                        : Resd 1 ; 24h
    .dwXSize                    : Resd 1 ; 28h
    .dwYSize                    : Resd 1 ; 2Ch
    .dwXCountChars              : Resd 1 ; 30h
    .dwYCountChars              : Resd 1 ; 34h
    .dwFillAttribute            : Resd 1 ; 38h
    .dwFlags                    : Resd 1 ; 3Ch
    .wShowWindow                : Resw 1 ; 40h
    .cbReserved2                : Resw 1 ; 42h
	.Padding2                   : Resd 1 ; 44h
    .lpReserved2                : Resq 1 ; 48h
    .hStdInput                  : Resq 1 ; 50h
    .hStdOutput                 : Resq 1 ; 58h
    .hStdError                  : Resq 1 ; 60h
EndStruc
	
Struc PROCESS_INFORMATION64
    .hProcess                   : Resq 1
    .hThread                    : Resq 1
    .dwProcessId                : Resd 1
    .dwThreadId                 : Resd 1
EndStruc

Struc EXCEPTION_POINTERS
    .pExceptionRecord           : Resq 1 ; Points to a EXCEPTION_RECORD structure
	.pContext                   : Resq 1
EndStruc

Struc EXCEPTION_RECORD
    .ExceptionCode              : Resd 1
	.ExceptionFlags             : Resd 1
	.NextRecord                 : Resq 1
	.pExceptionAddress          : Resq 1
	.NumberParameters           : Resd 1
	; There are additional params...
EndStruc

Struc FLOATING_SAVE_AREA
    .ControlWord                : Resd 1
    .StatusWord                 : Resd 1
    .TagWord                    : Resd 1
    .ErrorOffset                : Resd 1
    .ErrorSelector              : Resd 1
    .DataOffset                 : Resd 1
    .DataSelector               : Resd 1
    .RegisterArea               : Resb 80
    .Cr0NpxState                : Resd 1
EndStruc

Struc CONTEXT_X86
    .ContextFlags               : Resd 1
    .Dr0                        : Resd 1
    .Dr1                        : Resd 1
    .Dr2                        : Resd 1
    .Dr3                        : Resd 1
    .Dr6                        : Resd 1
    .Dr7                        : Resd 1
    .FloatSave                  : Resb FLOATING_SAVE_AREA_size
    .SegGs                      : Resd 1
    .SegFs                      : Resd 1
    .SegEs                      : Resd 1
    .SegDs                      : Resd 1
    .Edi                        : Resd 1
    .Esi                        : Resd 1
    .Ebx                        : Resd 1
    .Edx                        : Resd 1
    .Ecx                        : Resd 1
    .Eax                        : Resd 1
    .Ebp                        : Resd 1
    .SegCs                      : Resd 1
    .EFlags                     : Resd 1
    .Esp                        : Resd 1
    .SegSs                      : Resd 1              
EndStruc

Struc CONTEXT_X64
    .P1Home                     : Resq 1
    .P2Home                     : Resq 1
    .P3Home                     : Resq 1
    .P4Home                     : Resq 1
    .P5Home                     : Resq 1
    .P6Home                     : Resq 1
    .ContextFlags               : Resd 1
	.MxCsr                      : Resd 1
	.SegCs						: Resw 1
	.SegDs						: Resw 1
	.SegEs						: Resw 1
	.SegFs						: Resw 1
	.SegGs						: Resw 1
	.SegSs						: Resw 1
	.EFlags                     : Resd 1
	;.Padding                    : Resq 1
    .Dr0                        : Resq 1
    .Dr1                        : Resq 1
    .Dr2                        : Resq 1
    .Dr3                        : Resq 1
    .Dr6                        : Resq 1
    .Dr7                        : Resq 1
    .Rax                        : Resq 1
	.Rcx                        : Resq 1
	.Rdx                        : Resq 1
	.Rbx                        : Resq 1
	.Rsp                        : Resq 1
	.Rbp                        : Resq 1
	.Rsi                        : Resq 1
	.Rdi                        : Resq 1
	.R8                         : Resq 1
	.R9                         : Resq 1
	.R10                        : Resq 1
	.R11                        : Resq 1
	.R12                        : Resq 1
	.R13                        : Resq 1
	.R14                        : Resq 1
	.R15                        : Resq 1
	.Rip                        : Resq 1
EndStruc

Struc MEMORY_BASIC_INFORMATION64
    .BaseAddress                     : Resq 1
    .AllocationBase                     : Resq 1
    .AllocationProtect : Resd 1
    .__alignment1 : Resd 1
    .RegionSize : Resq 1
    .State : Resd 1
    .Protect : Resd 1
    .Type : Resd 1
    .__alignment2 : Resd 1
EndStruc
