wcsstr
RtlInitUnicodeString
RtlEqualUnicodeString
KeDelayExecutionThread
ExAllocatePool
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
ObfDereferenceObject
MmGetPhysicalAddress
MmCopyMemory
PsLookupProcessByProcessId
PsGetProcessPeb
ZwQuerySystemInformation
MmMarkPhysicalMemoryAsBad
__C_specific_handler
strstr
RtlInitAnsiString
RtlGetVersion
RtlCompareString
RtlImageNtHeader
MmGetSystemRoutineAddress
RtlDeleteRegistryValue
RtlAppendUnicodeToString
ExQueueWorkItem
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ObReferenceObjectByHandleWithTag
ObCloseHandle
ZwClose
ZwOpenKey
ZwDeleteKey
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
IoRegisterDriverReinitialization
IoCreateFileEx
RtlCaptureContext
MmFlushImageSection
ZwDeleteFile
KeCapturePersistentThreadState
ObReferenceObjectByName
strcmp
IoFileObjectType
IoDriverObjectType
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
KeStackAttachProcess
KeUnstackDetachProcess
ZwAllocateVirtualMemory
MmUserProbeAddress
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
