Windows API via a CallBack Function

api where process.executable != null and
 (
  (process.Ext.api.behaviors == "proxy_call" and
   process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx",
                            "MapViewOfFile", "MapViewOfFile2", "SuspendThread", "ReadProcessMemory") and
   process.thread.Ext.call_stack_summary in ("ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll", "ntdll.dll
| kernel32.dll
| ntdll.dll") and
   process.thread.Ext.call_stack_final_user_module.name in ("ntdll.dll", "Undetermined") and
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("*TpReleaseCleanupGroupMembers*", "*ntdll.dll!RtlDeregisterWaitEx*"))) or

  (process.Ext.api.name == "SetThreadContext" and process.thread.Ext.call_stack_summary in ("ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll", "ntdll.dll
| kernel32.dll
| ntdll.dll") and
   process.thread.Ext.call_stack_final_user_module.name in ("ntdll.dll", "Undetermined")) or

  (process.Ext.api.behaviors == "proxy_call" and
   process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx", "SuspendThread") and
   process.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll" and
   process.thread.Ext.call_stack_final_user_module.name == "Undetermined") and
   not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info : ("c:\\windows\\system32\\ntdll.dll!KiUserApcDispatcher*",
                                          "c:\\windows\\system32\\ntdll.dll!LdrShutdownThread*",
                                          "c:\\windows\\system32\\kernelbase.dll!GetFinalPathNameByHandleW*",
                                          "c:\\windows\\system32\\kernelbase.dll!LoadLibrary*"))
 ) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("*\\jhooksatellite.dll!*",
                                        "*ntdll.dll!qsort*",
                                        "*kernelbase.dll!AppXLookupMoniker*",
                                        "*ntdll.dll!RtlCaptureStackContext*",
                                        "*ntdll.dll!LdrSystemDllInitBlock*",
                                        "*kernelbase.dll!CheckIsMSIXPackage*",
                                        "*rpcrt4.dll!NdrSendReceive*",
                                        "*ntdll.dll!RtlSetThreadWorkOnBehalfTicket*",
                                        "*ntdll.dll!RtlPcToFileHeader*",
                                        "?:\\program files*\\remote desktop\\rdclientax.dll!DllDeleteSavedCreds*",
                                        "c:\\windows\\system32\\ntdll.dll!NtUpdateWnfStateData+*",
                                        "*ntdll.dll!*RtlUnlockHeap*", "*ntdll.dll+0x*", "*kernelbase.dll!AppXUpdatePackageCapabilities*"))