apihook("GetProcessAffinityMask", argc=3)

apihook("GetProcessHandleCount", argc=1)

apihook("GetProcessHeap", argc=0)

apihook("GetProcessVersion", argc=1)

apihook("GetProcessWindowStation", argc=0)

apihook("GetProfileInt", argc=3)

apihook("GetRawInputDeviceList", argc=3)

apihook("GetShortPathName", argc=3)

apihook("GetSidIdentifierAuthority", argc=1)

apihook("GetSidSubAuthority", argc=2)

apihook("GetSidSubAuthorityCount", argc=1)

apihook("GetStartupInfo", argc=1)

apihook("GetStdHandle", argc=1)

apihook("GetStockObject", argc=1)

apihook("GetStringTypeA", argc=5)

apihook("GetStringTypeW", argc=4)

apihook("GetSysColor", argc=1)

apihook("GetSysColorBrush", argc=1)

apihook("GetSystemDefaultLCID", argc=0)

apihook("GetSystemDefaultLangID", argc=0)

apihook("GetSystemDefaultUILanguage", argc=0)

apihook("GetSystemDirectory", argc=2)

apihook("GetSystemFirmwareTable", argc=4)

apihook("GetSystemInfo", argc=1)

apihook("GetSystemMetrics", argc=1)

apihook("GetSystemTime", argc=1)

apihook("GetSystemTimeAsFileTime", argc=1)

apihook("GetSystemTimePreciseAsFileTime", argc=1)

apihook("GetSystemTimes", argc=3)

apihook("GetTempFileName", argc=4)

apihook("GetTempPath", argc=2)

apihook("GetTextCharacterExtra", argc=1)

apihook("GetThreadContext", argc=2)

apihook("GetThreadDesktop", argc=1)

apihook("GetThreadId", argc=1)

apihook("GetThreadLocale", argc=0)

apihook("GetThreadPriority", argc=1)

apihook("GetThreadTimes", argc=5)

apihook("GetThreadUILanguage", argc=0)

apihook("GetTickCount", argc=0)

apihook("GetTickCount64", argc=0)

apihook("GetTimeFormat", argc=6)

apihook("GetTimeZoneInformation", argc=1)

apihook("GetTokenInformation", argc=5)

apihook("GetUpdateRect", argc=3)

apihook("GetUpdateRgn", argc=3)

apihook("GetUserDefaultLCID", argc=0)

apihook("GetUserDefaultLangID", argc=0)

apihook("GetUserDefaultUILanguage", argc=0)

apihook("GetUserName", argc=2)

apihook("GetUserNameEx", argc=3, conv=_arch.CALL_CONV_STDCALL)

apihook("GetUserObjectInformation", argc=5)

apihook("GetVersion", argc=0)

apihook("GetVersionEx", argc=1)

apihook("GetVolumeInformation", argc=8)

apihook("GetVolumePathNamesForVolumeName", argc=4)

apihook("GetWindowLong", argc=2)

apihook("GetWindowText", argc=3)

apihook("GetWindowsDirectory", argc=2)

apihook("InternetGetConnectedState", argc=2, conv=_arch.CALL_CONV_STDCALL)

apihook("IoDeleteDevice", argc=1)

apihook("IoDeleteDriver", argc=1)

apihook("IoDeleteSymbolicLink", argc=1)

apihook("IoGetCurrentProcess", argc=0)

apihook("IoGetDeviceObjectPointer", argc=4)

apihook("KeGetCurrentIrql", argc=0)

apihook("LdrGetProcedureAddress", argc=4)

apihook("MmGetSystemRoutineAddress", argc=1)

apihook("NCryptDeleteKey", argc=2)

apihook("NdisGetRoutineAddress", argc=1)

apihook("NdisGetVersion", argc=0)

apihook("NetGetJoinInformation", argc=3)

apihook("NetGetJoinInformation", argc=3)

apihook("NetWkstaGetInfo", argc=3)

apihook("ObGetFilterVersion", argc=0)

apihook("OutputDebugString", argc=1)

apihook("PoDeletePowerRequest", argc=1)

apihook("PostMessage", argc=4)

apihook("PostQuitMessage", argc=1)

apihook("PsGetProcessPeb", argc=1)

apihook("PsGetVersion", argc=4)

apihook("RegDeleteValue", argc=2, conv=_arch.CALL_CONV_STDCALL)

apihook("RegGetValue", argc=7, conv=_arch.CALL_CONV_STDCALL)

apihook("RtlComputeCrc32", argc=3)

apihook("RtlGetCompressionWorkSpaceSize", argc=3)

apihook("RtlGetCurrentPeb", argc=0)

apihook("RtlGetLastWin32Error", argc=0)

apihook("RtlGetNtVersionNumbers", argc=3)

apihook("RtlGetVersion", argc=1)

apihook("RtlGetVersion", argc=1)

apihook("SHGetFolderPath", argc=5)

apihook("SHGetMalloc", argc=1)

apihook("StartServiceCtrlDispatcher", argc=1)

apihook("TlsGetValue", argc=1)

apihook("WNetGetConnection", argc=3, conv=_arch.CALL_CONV_STDCALL)

apihook("WTSGetActiveConsoleSessionId", argc=0)

apihook("WdfDeviceWdmGetAttachedDevice", argc=2)

apihook("WdfDeviceWdmGetDeviceObject", argc=2)

apihook("WdfObjectGetTypedContextWorker", argc=3, conv=e_arch.CALL_CONV_FASTCALL)

apihook("WdfUsbInterfaceGetConfiguredPipe", argc=4)