diff --git a/rtl/win/wininc/base.inc b/rtl/win/wininc/base.inc
index bebcea7b06..d2702c102a 100644
--- a/rtl/win/wininc/base.inc
+++ b/rtl/win/wininc/base.inc
@@ -98,6 +98,7 @@
      PULONG32    = ^ULONG32;
      PULONG_PTR  = ^ULONG_PTR;
      PLONG64     = ^LONG64;
+     PSIZE_T     = ^SIZE_T;
 
      DWORDLONG  = qword;  { was unsigned long  }
      PDWORDLONG = ^DWORDLONG;
diff --git a/rtl/win/wininc/defines.inc b/rtl/win/wininc/defines.inc
index eddaef96a3..6045586fe5 100644
--- a/rtl/win/wininc/defines.inc
+++ b/rtl/win/wininc/defines.inc
@@ -6650,6 +6650,16 @@ const
     ES_AWAYMODE_REQUIRED  = dword($00000040);
     ES_CONTINUOUS         = dword($80000000);
 
+// tlhelp32.h
+    TH32CS_SNAPHEAPLIST = $1;
+    TH32CS_SNAPPROCESS  = $2;
+    TH32CS_SNAPTHREAD   = $4;
+    TH32CS_SNAPMODULE   = $8;
+    TH32CS_SNAPMODULE32 = $10;
+    TH32CS_INHERIT      = $80000000;
+    TH32CS_SNAPALL      = TH32CS_SNAPHEAPLIST or TH32CS_SNAPMODULE or TH32CS_SNAPPROCESS or TH32CS_SNAPTHREAD;
+    MAX_MODULE_NAME32   = 255;
+
 {$endif read_interface}
 
 {$ifdef read_implementation}
diff --git a/rtl/win/wininc/func.inc b/rtl/win/wininc/func.inc
index fb04058372..bc715e463e 100644
--- a/rtl/win/wininc/func.inc
+++ b/rtl/win/wininc/func.inc
@@ -1354,6 +1354,24 @@ function CONSOLE_REAL_OUTPUT_HANDLE : HANDLE;
   function GetNumaAvailableMemoryNodeEx(Node:USHORT; AvailableBytes:PULONGLONG):BOOL;stdcall;external 'kernel32.dll' name 'GetNumaAvailableMemoryNodeEx';
   function GetNumaProximityNode(ProximityId:ULONG; NodeNumber:PUCHAR):BOOL;stdcall;external 'kernel32.dll' name 'GetNumaProximityNode';
 
+  // tlhelp32.h
+  function CreateToolhelp32Snapshot(dwFlags: DWORD; th32ProcessID: DWORD): HANDLE; stdcall; external KernelDLL;
+  function Heap32First(var lphe: HEAPENTRY32; th32ProcessID: DWORD; th32HeapID: ULONG_PTR): BOOL; stdcall; external KernelDLL;
+  function Heap32Next(var lphe: HEAPENTRY32): BOOL; stdcall; external KernelDLL;
+  function Heap32ListFirst(hSnapshot: HANDLE; var lphl: HEAPLIST32): BOOL; stdcall; external KernelDLL;
+  function Heap32ListNext(hSnapshot: HANDLE; var lphl: HEAPLIST32): BOOL; stdcall; external KernelDLL;
+  function Module32First(hSnapshot: HANDLE; var lpme: MODULEENTRY32): BOOL; stdcall; external KernelDLL;
+  function Module32Next(hSnapshot: HANDLE; var lpme: MODULEENTRY32): BOOL; stdcall; external KernelDLL;
+  function Module32FirstW(hSnapshot: HANDLE; var lpme: MODULEENTRY32W): BOOL; stdcall; external KernelDLL;
+  function Module32NextW(hSnapshot: HANDLE; var lpme: MODULEENTRY32W): BOOL; stdcall; external KernelDLL;
+  function Process32First(hSnapshot: HANDLE; var lppe: PROCESSENTRY32): BOOL; stdcall; external KernelDLL;
+  function Process32Next(hSnapshot: HANDLE; var lppe: PROCESSENTRY32): BOOL; stdcall; external KernelDLL;
+  function Process32FirstW(hSnapshot: HANDLE; var lppe: PROCESSENTRY32W): BOOL; stdcall; external KernelDLL;
+  function Process32NextW(hSnapshot: HANDLE; var lppe: PROCESSENTRY32W): BOOL; stdcall; external KernelDLL;
+  function Thread32First(hSnapshot: HANDLE; var lpte: THREADENTRY32): BOOL; stdcall; external KernelDLL;
+  function Thread32Next(hSnapshot: HANDLE; var lpte: THREADENTRY32): BOOL; stdcall; external KernelDLL;
+  function Toolhelp32ReadProcessMemory(th32ProcessID: DWORD; lpBaseAddress: pointer; lpBuffer: pointer; cbRead: SIZE_T; lpNumberOfBytesRead: PSIZE_T): BOOL; stdcall; external KernelDLL;
+
 {$endif read_interface}
 
 {$ifdef read_implementation}
diff --git a/rtl/win/wininc/struct.inc b/rtl/win/wininc/struct.inc
index f8bd62eb9c..d545273258 100644
--- a/rtl/win/wininc/struct.inc
+++ b/rtl/win/wininc/struct.inc
@@ -9527,6 +9527,88 @@ type
       end;
    TPROCESSOR_NUMBER = _PROCESSOR_NUMBER;
 
+// tlhelp32.h
+    HEAPENTRY32 = record
+        dwSize: SIZE_T;
+        hHandle: HANDLE;
+        dwAddress: ULONG_PTR;
+        dwBlockSize: SIZE_T;
+        dwFlags: DWORD;
+        dwLockCount: DWORD;
+        dwResvd: DWORD;
+        th32ProcessID: DWORD;
+        th32HeapID: ULONG_PTR;
+    end;
+
+    HEAPLIST32 = record
+        dwSize: SIZE_T;
+        th32ProcessID: DWORD;
+        th32HeapID: ULONG_PTR;
+        dwFlags: DWORD;
+    end;
+
+    MODULEENTRY32 = record
+        dwSize: DWORD;
+        th32ModuleID: DWORD;
+        th32ProcessID: DWORD;
+        GlblcntUsage: DWORD;
+        ProccntUsage: DWORD;
+        modBaseAddr: pointer;
+        modBaseSize: DWORD;
+        hModule: HMODULE;
+        szModule: array[0 .. MAX_MODULE_NAME32 { not - 1 }] of ansichar;
+        szExePath: array[0 .. MAX_PATH - 1] of ansichar;
+    end;
+
+    MODULEENTRY32W = record
+        dwSize: DWORD;
+        th32ModuleID: DWORD;
+        th32ProcessID: DWORD;
+        GlblcntUsage: DWORD;
+        ProccntUsage: DWORD;
+        modBaseAddr: pointer;
+        modBaseSize: DWORD;
+        hModule: HMODULE;
+        szModule: array[0 .. MAX_MODULE_NAME32 { not - 1 }] of unicodechar;
+        szExePath: array[0 .. MAX_PATH - 1] of unicodechar;
+    end;
+
+    PROCESSENTRY32  = record
+        dwSize: DWORD;
+        cntUsage: DWORD;
+        th32ProcessID: DWORD;
+        th32DefaultHeapID: ULONG_PTR;
+        th32ModuleID: DWORD;
+        cntThreads: DWORD;
+        th32ParentProcessID: DWORD;
+        pcPriClassBase: LONG;
+        dwFlags: DWORD;
+        szExeFile: array[0 .. MAX_PATH - 1] of ansichar;
+    end;
+
+    PROCESSENTRY32W  = record
+        dwSize: DWORD;
+        cntUsage: DWORD;
+        th32ProcessID: DWORD;
+        th32DefaultHeapID: ULONG_PTR;
+        th32ModuleID: DWORD;
+        cntThreads: DWORD;
+        th32ParentProcessID: DWORD;
+        pcPriClassBase: LONG;
+        dwFlags: DWORD;
+        szExeFile: array[0 .. MAX_PATH - 1] of unicodechar;
+    end;
+
+    THREADENTRY32 = record
+        dwSize: DWORD;
+        cntUsage: DWORD;
+        th32ThreadID: DWORD;
+        th32OwnerProcessID: DWORD;
+        tpBasePri: LONG;
+        tpDeltaPri: LONG;
+        dwFlags: DWORD;
+    end;
+
 {$pop}
 {$endif read_interface}