wcsstr
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExAllocatePool
ExFreePoolWithTag
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetRelatedDeviceObject
IoSetCompletionRoutineEx
ObReferenceObjectByHandle
ObfDereferenceObject
ZwOpenFile
ZwClose
ZwOpenKey
ZwQueryValueKey
MmIsAddressValid
KeStackAttachProcess
KeUnstackDetachProcess
__C_specific_handler
IoFileObjectType
RtlEqualUnicodeString
PsLookupProcessByProcessId
PsGetProcessPeb
PsGetProcessWow64Process
ZwAllocateVirtualMemory
RtlInitString
DbgPrintEx
ExAllocatePoolWithTag
ProbeForRead
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPages
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmMapIoSpace
MmUnmapIoSpace
IoAllocateMdl
ZwFreeVirtualMemory
RtlCompareUnicodeString
ObReferenceObjectByName
IoDriverObjectType
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
_stricmp
strstr
ExGetPreviousMode
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetProcessId
PsGetThreadProcess
IoThreadToProcess
ObOpenObjectByPointer
PsGetProcessDebugPort
PsIsSystemProcess
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
ObFindHandleForObject
PsProcessType
PsThreadType
MmUserProbeAddress
PsInitialSystemProcess
IoCreateFile
ZwQueryInformationFile
ZwReadFile
sprintf
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
_strlwr
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlTimeToTimeFields
RtlGetVersion
KeDelayExecutionThread
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
MmAllocateContiguousMemory
MmFreeContiguousMemory
ObCloseHandle
ZwCreateFile
ZwWriteFile
PsGetProcessExitStatus
NtQuerySystemInformation
ZwQuerySystemInformation
PsGetProcessImageFileName
PsReferenceProcessFilePointer
ExEnumHandleTable
ExfUnblockPushLock
KeBugCheckEx
