;      {
                PVOID pvDebugBuffer = pfnRtlCreateQueryDebugBuffer(0, 0);
                if(pfnRtlQueryProcessDebugInformation
                        (QuerySystemInformationP->PID, 1, pvDebugBuffer) == 0)
                {
                    PPROCESS_INFO_HEADER pihProcessInfoHeader =
                        (PPROCESS_INFO_HEADER)((DWORD)pvDebugBuffer + 0x60);
                    DWORD dwCount = pihProcessInfoHeader->Count;
                    PPROCESS_INFO piProcessInfo = (PPROCESS_INFO)
                        ((DWORD)pihProcessInfoHeader + sizeof (PROCESS_INFO_HEADER));
                    // Form1->Memo1->Lines->Add(piProcessInfo->Name);
                    AnsiString strName = piProcessInfo->Name;
                    // if(strstr((char *)UpCase(*piProcessInfo->Name), "WINLOGON") != 0)
                    if(strName.UpperCase().Pos("WINLOGON") != 0)
                    {
                        DWORD dwTemp = (DWORD)piProcessInfo;
                        for (DWORD j=0; j<dwCount; j++)