For controlling process creation in windows I can hook few function
in the "kernel32.dll"\"advapi32.dll"
I want to hook the "root" - I mean the function responsible of
creating process's in the "ntdll.dll"
I hooked the function "NtCreateProcess" - but windows uses a different
function
Which function\s I need to hook?

Thanks in advance