List of critical functions used by Exploit Guard ------------------------- kernel32.dll ------------------------- LoadLibraryA LoadLibraryW LoadLibraryExA LoadLibraryExW VirtualAlloc VirtualAllocEx VirtualProtect VirtualProtectEx HeapCreate CreateProcessA CreateProcessW CreateProcessInternalA CreateProcessInternalW CreateRemoteThread CreateRemoteThreadEx WriteProcessMemory WinExec CreateFileMappingA CreateFileMappingW MapViewOfFile MapViewOfFileEx MapViewOfFileFromApp ------------------------- kernelbase.dll ------------------------- LoadLibraryExA LoadLibraryExW VirtualAlloc VirtualAllocEx VirtualProtect VirtualProtectEx HeapCreate CreateRemoteThreadEx WriteProcessMemory CreateFileMappingW CreateFileMappingNumaW MapViewOfFile MapViewOfFileEx ------------------------- ntdll.dll ------------------------- LdrLoadDll NtAllocateVirtualMemory NtProtectVirtualMemory RtlCreateHeap NtCreateUserProcess NtCreateProcess NtCreateProcessEx NtCreateThreadEx NtWriteVirtualMemory NtCreateSection LdrGetProcedureAddressForCaller