Secrets

Every WindowsNT box has a NSA trojan called _Total.exe which is loaded by kernel itself, it can override any user functions and start spying on command.

Every Windows library has some nops at the beginning of the functions so the NSA can redirect them somewhere else.