2 hooks: ZwAllocateVirtualMemory, DeviceIoControl