LdrInitializeThunk
LdrpInitialize
_LdrpInitialize
_LdrpInitializeProcess
_LdrpInitializeNlsInfo(RtlInitNlsTables\RtlResetRtlTranslations)
_LdrpInitializeExecutionOptions
_RtlpInitDeferredCriticalSection
RtlInitializeBitMap(Fls)
RtlInitializeBitMap(Tls)
RtlInitializeBitMap(TlsExpansion)
RtlInitializeCriticalSectionEx(for RtlAcquirePebLock)
_RtlInitializeHeapManager(use NtGlobalFlags)
RtlCreateHeap
RtlAllocateActivationContextStack
RtlInitializeSListHead(for Etw)
_TpInitializePackage
RtlReleaseMemoryStream
RtlpInitEnvironmentBlock
RtlpInitParameterBlock
ZwOpenDirectoryObject(use _LdrpKnownDllDirectoryHandle)
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject(use _LdrpKnownDllPath)
ZwClose
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
FaEry 下断点，然后看堆栈，windbg，用k命令
FaEry
