Introduction to Windows API

Calling a First and a Next function

Sometimes functions like Process32First are followed by Process32Next. This is due to the fact that Microsoft sometimes uses a stateful enumeration pattern approach where the first call takes a snapshot of the processes, and the second call inside a loop returns each process. There are a few functions that behave this way:

• Process32First / Process32Next
• Thread32First / Thread32Next
• Module32First / Module32Next
• FindFirstFile / FindNextFile

An example usage of Process32First is shown in the learn section Process Enumeration.