1. #include <windows.h>
2.  
3. int main()
4. {
5.       PDWORD functionAddress = (PDWORD)0;
6.  
7.     HMODULE libraryBase = LoadLibraryA(OBFUSCATE("ntdll"));
8.  
9.     PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)libraryBase;
10.     PIMAGE_NT_HEADERS imageNTHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)libraryBase + dosHeader->e_lfanew);
11.  
12.     DWORD_PTR exportDirectoryRVA = imageNTHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
13.     PIMAGE_EXPORT_DIRECTORY imageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)libraryBase + exportDirectoryRVA);
14.  
15.     PDWORD addresOfFunctionsRVA = (PDWORD)((DWORD_PTR)libraryBase + imageExportDirectory->AddressOfFunctions);
16.     PDWORD addressOfNamesRVA = (PDWORD)((DWORD_PTR)libraryBase + imageExportDirectory->AddressOfNames);
17.     PWORD addressOfNameOrdinalsRVA = (PWORD)((DWORD_PTR)libraryBase + imageExportDirectory->AddressOfNameOrdinals);
18.  
19.     for (DWORD i = 0; i < imageExportDirectory->NumberOfNames; i++)
20.     {
21.         DWORD functionNameRVA = addressOfNamesRVA[i];
22.         DWORD_PTR functionNameVA = (DWORD_PTR)libraryBase + functionNameRVA;
23.         char *functionName = (char *)functionNameVA;
24.  
25.         DWORD_PTR functionAddressRVA = 0;
26.         functionAddressRVA = addresOfFunctionsRVA[addressOfNameOrdinalsRVA[i]];
27.         functionAddress = (PDWORD)((DWORD_PTR)libraryBase + functionAddressRVA);
28.  
29.         unsigned char syscallPrologue[4] = {0x4c, 0x8b, 0xd1, 0xb8};
30.  
31.         if (strncmp(functionName, (char *)OBFUSCATE("Nt"), 2) == 0 || strncmp(functionName, (char *)OBFUSCATE("Zw"), 2) == 0)
32.         {
33.             if (memcmp(functionAddress, syscallPrologue, 4) != 0)
34.             {
35.  
36.                 if (*((unsigned char *)functionAddress) == 0xE9)
37.                 {
38.                     DWORD jumpTargetRelative = *((PDWORD)((char *)functionAddress + 1));
39.                     PDWORD jumpTarget = functionAddress + 5 + jumpTargetRelative;
40.                     char moduleNameBuffer[512];
41.                     GetMappedFileNameA(GetCurrentProcess(), jumpTarget, moduleNameBuffer, 512);
42.  
43.                     ExitProcess(-1);
44.                 }
45.             }
46.         }
47.     }
48. }