KeInitializeEvent
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
NtBuildNumber
ObCreateObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
DbgPrint
SeCreateAccessState
IoGetFileObjectGenericMapping
ExAllocatePool
_wcsnicmp
ExGetPreviousMode
PsTerminateSystemThread
_wcsicmp
MmGetSystemRoutineAddress
PsCreateSystemThread
__C_specific_handler
MmIsAddressValid
KeDelayExecutionThread
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwUnmapViewOfSection
ZwOpenKey
ZwFlushKey
ZwCreateKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
ZwQueryValueKey
ZwEnumerateValueKey
ZwSaveKey
ZwCreateFile
ZwLoadKey
ZwUnloadKey
ZwWriteFile
ZwReadFile
ZwDeleteFile
ZwSetInformationFile
ZwQueryDirectoryObject
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
wcsrchr
RtlFreeAnsiString
IoGetRelatedDeviceObject
_strupr
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoGetCurrentProcess
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
strstr
PsGetProcessId
RtlCopyUnicodeString
ObQueryNameString
RtlCompareUnicodeString
ObRegisterCallbacks
ObGetFilterVersion
PsProcessType
wcsstr
_wcsupr
CmRegisterCallback
PsSetCreateProcessNotifyRoutineEx
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
swprintf
LdrAccessResource
LdrFindResource_U
ZwQueryInformationFile
sprintf
ZwQueryInformationProcess
ObOpenObjectByPointer
ZwOpenProcess
wcsncmp
ZwQuerySystemInformation
KeDetachProcess
KeAttachProcess
IoRegisterShutdownNotification
InitSafeBootMode
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoIsWdmVersionAvailable
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
IoCreateDevice
atoi
ZwLoadDriver
MmSectionObjectType
PsGetProcessImageFileName
PsLookupProcessByProcessId
wcsncpy
ZwQueryVirtualMemory
ZwQuerySection
PsReferencePrimaryToken
IoThreadToProcess
RtlCompareMemory
IoAllocateIrp
KeWaitForSingleObject
KeClearEvent
IoFreeIrp
ExFreePoolWithTag
KeBugCheckEx
strrchr
KeSetEvent