Used to spy IOCTL sent to themida driver, oreans.sys and 
oreans32.sys, used to locate weird IOCTL 0x1A00h, and
make SoftICE invisible for new themida.