Introduction to Windows API

API Names

The main point of this paragraph is to explain API calls that have leading or trailing capital letters. Before that, it is worth noting that assuming what a function does based only on the name can be misleading. For example, CreateFile might not create the file at all, but only open it. There are other examples, like GetProcAddress that seems like it might return the address of a process; however, it returns the address of a procedure (function). The documentation is usually the most reliable reference until that specific function becomes familiar.

Also, additional attention to leading and trailing letters is useful, as they might change the function slightly. The most popular ones are:

• suffix Ex → which means Extended. The extended version introduces new functionalities and can change the way you call the function. For example ReadFile and ReadFileEx.

Note how the lpBuffer is not optional in ReadFile but it is in ReadFileEx, lpOverlapped is both input and output in the extended version but not on the standard one, and the last argument is completely different.

1
BOOL ReadFile(
2
  [in]                HANDLE       hFile,
3
  [out]               LPVOID       lpBuffer,
4
  [in]                DWORD        nNumberOfBytesToRead,
5
  [out, optional]     LPDWORD      lpNumberOfBytesRead,
6
  [in, out, optional] LPOVERLAPPED lpOverlapped
7
);
8

9
BOOL ReadFileEx(
10
  [in]            HANDLE                          hFile,
11
  [out, optional] LPVOID                          lpBuffer,
12
  [in]            DWORD                           nNumberOfBytesToRead,
13
  [in, out]       LPOVERLAPPED                    lpOverlapped,
14
  [in]            LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine
15
);

• suffix W → This doesn’t usually bring new features, except that input/output strings are wide-chars to allow for UTF-8/UTF-16 glyphs. An example is MessageBoxW.
• suffix A → This indicates that the strings arguments are ASCII. An example is MessageBoxA.
• prefix Zw and Nt → those are functions that are respectively the kernel-mode and user-mode implementations. They are, in theory, not meant to be used by developers as their implementation might change without notice; however, malware authors often use them to avoid detection. It might happen that the documentation of those functions is not available or redacted; for example, the SYSTEM_PROCESS_INFORMATION returned by the NtQuerySystemInformation has certain arguments redacted, see 4. Seeing these functions in pestudio often raises suspicion.