Part I: Introduction
Windows Applications
Windows applications normally perform operations by interacting with the Windows Application Program Interface (WinAPI). The WinAPI then performs some processing of parameters to normalize them or calculate additional parameters that eventually get passed into the Native API (NtAPI). User mode malware can find the address of NtAPI functions at runtime by walking the exports of