ObfDereferenceObject
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsGetCurrentProcessId
PsGetCurrentThreadId
PsGetThreadProcessId
RtlRandomEx
PsLookupThreadByThreadId
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ZwClose
ZwCreateKey
ZwOpenKey
ZwDeleteValueKey
ZwSetValueKey
RtlCompareMemory
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExDeleteResourceLite
ZwEnumerateValueKey
RtlInitUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
IoCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwDeleteKey
ZwEnumerateKey
ZwQueryValueKey
RtlPrefixUnicodeString
KeStackAttachProcess
KeUnstackDetachProcess
__chkstk
PsInitialSystemProcess
RtlCompareUnicodeString
KeInitializeEvent
KeWaitForSingleObject
IoBuildSynchronousFsdRequest
ExFreePoolWithTag
MmIsAddressValid
__C_specific_handler
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
ProbeForRead
ProbeForWrite
MmGetSystemRoutineAddress
IofCompleteRequest
IoGetDeviceObjectPointer
IoEnumerateDeviceObjectList
IoGetLowerDeviceObject
ZwSetSystemInformation
IoDriverObjectType
DbgPrint
ExQueueWorkItem
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoRegisterLastChanceShutdownNotification
IoUnregisterShutdownNotification
IoRegisterBootDriverReinitialization
IoRegisterDriverReinitialization
RtlEqualUnicodeString
KeSetEvent
ExSystemTimeToLocalTime
ExInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
ExRundownCompleted
ExWaitForRundownProtectionRelease
IoGetCurrentProcess
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
KeBugCheckEx
IofCallDriver
ExAllocatePoolWithTag
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
RtlTimeToTimeFields
KeDelayExecutionThread
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ZwCreateFile
wcsrchr
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlAppendUnicodeStringToString
RtlxUnicodeStringToAnsiSize
RtlxAnsiStringToUnicodeSize
FsRtlIsNameInExpression
NlsMbOemCodePageTag
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
NtFsControlFile
NtQueryInformationFile
ObOpenObjectByPointer
ZwSetSecurityObject
IoFileObjectType
KeClearEvent
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
MmProbeAndLockPages
MmIsDriverVerifying
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
ObfReferenceObject
RtlRandom
RtlInitAnsiString
RtlFreeUnicodeString
RtlCompareString
ZwQuerySystemInformation
MmSystemRangeStart
strchr
_stricmp
ZwOpenFile
ObQueryNameString
IoBuildDeviceIoControlRequest
RtlUpcaseUnicodeString
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlIsGenericTableEmpty
MmUnlockPages
MmMapIoSpace
MmUnmapIoSpace
MmGetPhysicalMemoryRanges
PsLookupProcessByProcessId
RtlVolumeDeviceToDosName
IoQueryFileDosDeviceName
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
ZwNotifyChangeKey
atoi
NtBuildNumber
PsGetVersion
RtlGetVersion
RtlUnicodeStringToInteger
ZwOpenDirectoryObject
isdigit
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
CmUnRegisterCallback
IoAttachDeviceToDeviceStack
IoDetachDevice
IoDeviceObjectType
KeInitializeDpc
KeInsertQueueDpc
KeSetImportanceDpc
KeSetTargetProcessorDpc
KeNumberProcessors
ZwQueryInformationProcess
PsGetProcessImageFileName
PsGetProcessInheritedFromUniqueProcessId
ExReInitializeRundownProtection
