Anti-AV compilation
Based on tons PoC's,so code looks very weird (sorry x_x)
You can read about some used methods:
ShimEngine: http://www.kernelmode.info/forum/viewtopic.php?f=11&t=1878
PageLock: http://www.kernelmode.info/forum/viewtopic.php?f=11&t=1926
And a lot of other shit: http://www.kernelmode.info/forum/viewtopic.php?f=15&t=1485