ObOpenObjectByPointer
PsProcessType
PsThreadType
_strlwr
strstr
RtlInitUnicodeString
RtlGetVersion
KeQueryTimeIncrement
ExAllocatePool
MmGetSystemRoutineAddress
MmMapIoSpace
MmUnmapIoSpace
ObfDereferenceObject
MmGetPhysicalAddress
RtlImageDirectoryEntryToData
ObReferenceObjectByName
_vsnwprintf
srand
rand
ZwQuerySystemInformation
IoDriverObjectType
ObReferenceObjectByHandle
ZwWaitForSingleObject
ZwQueryInformationThread
ZwQueryVirtualMemory
ObSetHandleAttributes
IoFileObjectType
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoAllocateIrp
IofCallDriver
IoCreateFile
IoFreeIrp
IoGetRelatedDeviceObject
ZwOpenFile
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
IoVolumeDeviceToDosName
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlCompareMemory
KeDelayExecutionThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
IoDeleteDevice
IoGetCurrentProcess
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwFlushKey
ZwQueryValueKey
ZwSetValueKey
KeBugCheck
MmSecureVirtualMemory
PsSetLoadImageNotifyRoutine
PsGetCurrentProcessId
PsGetCurrentThreadId
PsGetProcessExitStatus
PsGetProcessId
PsGetThreadId
ZwSetInformationThread
KeAttachProcess
KeDetachProcess
IoThreadToProcess
RtlImageNtHeader
RtlPcToFileHeader
PsGetProcessDebugPort
RtlComputeCrc32
PsGetProcessImageFileName
PsReferenceProcessFilePointer
IoDeviceObjectType
MmProtectMdlSystemAddress
MmAllocateMappingAddress
MmFreeMappingAddress
MmMapLockedPagesWithReservedMapping
MmUnmapReservedMapping
MmAllocatePagesForMdlEx
MmFreePagesFromMdl
ZwCreateSection
KeStackAttachProcess
ObReferenceObjectByHandleWithTag
ObfDereferenceObjectWithTag
PsGetThreadProcessId
PsGetThreadProcess
PsLookupThreadByThreadId
ZwQueryObject
ZwQueryInformationProcess
NtQueryInformationThread
RtlCompareUnicodeString
IoAllocateMdl
ZwOpenProcess
MmCopyVirtualMemory
KeInsertQueueApc
KeInitializeApc
ZwOpenThread
ObOpenObjectByPointerWithTag
ObGetObjectType
KeResetEvent
IoAllocateWorkItem
IoQueueWorkItem
SeLocateProcessImageName
PsGetProcessPeb
ObReferenceObjectByPointerWithTag
ObCreateObjectType
strncmp
RtlEqualUnicodeString
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsGetProcessWow64Process
ZwOpenSection
MmMapViewOfSection
PsGetProcessSectionBaseAddress
IoBuildDeviceIoControlRequest
MmProbeAndLockPages
MmUnlockPages
IoFreeMdl
__C_specific_handler
MmIsAddressValid
ZwClose
ExFreePoolWithTag
ExAllocatePoolWithTag
PsLookupProcessByProcessId
KeSetKernelStackSwapEnable
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
PsCreateSystemThread
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
