- hook ZwDeviceIoControl()
- hook ZwTerminateProcess()
- hook ZwDelayExecution()
- app -> multithreading