3 hooks: ZwAllocateVirtualMemory, DeviceIoControl, GetSystemTimeAsFileTime