ZwDeleteFile
ZwOpenFile
wcsncpy
wcschr
memcmp
memmove
_wcsicmp
IofCallDriver
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
PsGetCurrentProcessId
ObReferenceObjectByHandle
wcsrchr
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ExFreePoolWithTag
RtlVolumeDeviceToDosName
IoFileObjectType
memset
RtlNtStatusToDosError
swprintf
wcsncmp
ZwQueryDirectoryFile
ZwQueryInformationFile
ZwQueryInformationProcess
ZwSetInformationProcess
PsGetCurrentThreadId
ZwOpenProcess
KeInsertQueueApc
KeInitializeApc
PsLookupProcessThreadByCid
PsTerminateSystemThread
rand
ZwWaitForSingleObject
PsCreateSystemThread
ZwReadFile
KeReadStateEvent
wcsncat
ExGetPreviousMode
ZwQueryKey
ZwEnumerateKey
ZwUnloadKey
ZwLoadKey
PsSetCreateProcessNotifyRoutine
_stricmp
ExAllocatePoolWithTag
ZwCreateKey
ZwSetValueKey
ZwTerminateProcess
ZwCreateEvent
ZwOpenEvent
KeLowerIrql
KeRaiseIrqlToDpcLevel
_strlwr
SeSinglePrivilegeCheck
SeExports
IoCreateFile
_strnicmp
strstr
ObOpenObjectByName
_vsnprintf
strrchr
strchr
strncpy
KeQueryTimeIncrement
sprintf
_snprintf
atoi
isspace
isdigit
PsGetVersion
RtlQueryRegistryValues
RtlZeroMemory
ExInterlockedInsertTailList
MmUserProbeAddress
SeSetSecurityDescriptorInfo
ZwSetInformationFile
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ExUuidCreate
IoDeleteDevice
ZwFlushVirtualMemory
MmMapLockedPagesSpecifyCache
ExInterlockedRemoveHeadList
IoCreateDevice
KeInitializeMutex
KeReleaseMutex
ZwQuerySystemInformation
ZwDuplicateObject
ZwQueryValueKey
KeUnstackDetachProcess
MmUnmapLockedPages
KeStackAttachProcess
IoGetCurrentProcess
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
RtlCharToInteger
RtlUnicodeStringToInteger
towlower
PsLookupProcessByProcessId
KeInitializeSemaphore
KeReleaseSemaphore
RtlSetSaclSecurityDescriptor
RtlSubAuthoritySid
RtlInitializeSid
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlLengthRequiredSid
PsThreadType
KeSetPriorityThread
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN
ZwDeviceIoControlFile
ZwPulseEvent
memchr
wcsstr
RtlCopyMemory
RtlCompareUnicodeString
IoGetDriverObjectExtension
MmIsAddressValid
ExQueueWorkItem
KeWaitForMultipleObjects
MmMapLockedPages
IoBuildDeviceIoControlRequest
IoCancelIrp
KeNumberProcessors
KfRaiseIrql
IoGetStackLimits
ZwOpenThread
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
strncmp
mbstowcs
ZwSetInformationThread
ZwRequestWaitReplyPort
ZwQueryObject
KeAddSystemServiceTable
RtlLengthSid
RtlValidSid
ZwQueryInformationToken
ZwOpenProcessToken
IoFreeIrp
MmBuildMdlForNonPagedPool
IoAllocateIrp
srand
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwFsControlFile
ZwOpenKey
ZwDeleteKey
_snwprintf
ZwClose
ProbeForRead
ZwWriteFile
ZwFlushKey
__C_specific_handler
IofCompleteRequest
memcpy
RtlInitUnicodeString
IoGetDeviceObjectPointer
ObfReferenceObject
ObfDereferenceObject
_wcsnicmp
ZwSetEvent
KeDelayExecutionThread
KeGetCurrentThread
KeGetCurrentIrql
IoGetInitialStack
KeInitializeEvent
KeInitializeDpc
KeSetImportanceDpc
KeSetTargetProcessorDpc
KeInsertQueueDpc
KeWaitForSingleObject
RtlCreateSecurityDescriptor
KeSetEvent
