.text:00000001800030E6 mov [rsp+70h+var_50], r14d .text:00000001800030EB call cs:__imp_NtUserFindWindowEx .text:00000001800030F2 nop dword ptr [rax+rax+00h] .text:00000001800030F7 mov rbx, rax .text:00000001800030FA .text:00000001800030FA loc_1800030FA: ; CODE XREF: InternalFindWindowExA(HWND__ *,HWND__ *,char const *,char const *,ulong)+C7↓j .text:00000001800030FA cmp [rbp+var_28], r14d .text:00000001800030FE jnz loc_180038843 .text:0000000180003104 .text:0000000180003104 loc_180003104: ; CODE XREF: InternalFindWindowExA(HWND__ *,HWND__ *,char const *,char const *,ulong)+357F5↓j .text:0000000180003104 cmp dword ptr [rbp+var_10+8], r14d .text:0000000180003108 jnz loc_180038862 .text:000000018000310E .text:000000018000310E loc_18000310E: ; CODE XREF: InternalFindWindowExA(HWND__ *,HWND__ *,char const *,char const *,ulong)+35814↓j .text:000000018000310E lea r11, [rsp+70h+var_s0] .text:0000000180003113 mov rax, rbx .text:0000000180003116 mov rbx, [r11+10h] .text:000000018000311A mov rsi, [r11+18h] .text:000000018000311E mov rdi, [r11+20h] .text:0000000180003122 mov r14, [r11+28h] .text:0000000180003126 mov rsp, r11 .text:0000000180003129 pop rbp .text:000000018000312A retn .text:0000000180038843 loc_180038843: ; CODE XREF: InternalFindWindowExA(HWND__ *,HWND__ *,char const *,char const *,ulong)+96↑j .text:0000000180038843 mov r8, [rbp+P] ; P .text:0000000180038847 xor edx, edx ; Flags .text:0000000180038849 mov rcx, cs:pUserHeap ; HeapHandle .text:0000000180038850 call cs:__imp_RtlFreeHeap .text:0000000180038857 nop dword ptr [rax+rax+00h] .text:000000018003885C nop .text:000000018003885D jmp loc_180003104 .text:0000000180038862 loc_180038862: ; CODE XREF: InternalFindWindowExA(HWND__ *,HWND__ *,char const *,char const *,ulong)+A0↑j .text:0000000180038862 mov r8, [rbp+var_20+8] ; P .text:0000000180038866 xor edx, edx ; Flags .text:0000000180038868 mov rcx, cs:pUserHeap ; HeapHandle .text:000000018003886F call cs:__imp_RtlFreeHeap .text:0000000180038876 nop dword ptr [rax+rax+00h] .text:000000018003887B nop .text:000000018003887C jmp loc_18000310E NtUserFindWindowEx: .text:00000001404110E7 mov eax, 1 .text:00000001404110EC xor edx, edx .text:00000001404110EE mov ecx, 49h ; 'I' <~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .text:00000001404110F3 wrmsr .text:00000001404110F5 .text:00000001404110F5 loc_1404110F5: ; CODE XREF: KiSystemCall64+6E5↑j .text:00000001404110F5 btr word ptr gs:278h, 5 .text:0000000140411100 jnb loc_14041122B .text:0000000140411106 call loc_140411219 .text:000000014041110B .text:000000014041110B loc_14041110B: ; CODE XREF: KiSystemCall64+718↓p .text:000000014041110B add rsp, 8 .text:000000014041110F call loc_140411222 .text:0000000140411114 .text:0000000140411114 loc_140411114: ; CODE XREF: KiSystemCall64+721↓p .text:0000000140411114 add rsp, 8 .text:0000000140411118 call loc_14041110B .text:000000014041111D .text:000000014041111D loc_14041111D: ; CODE XREF: KiSystemCall64+72A↓p .text:000000014041111D add rsp, 8 .text:0000000140411121 call loc_140411114 .text:0000000140411126 .text:0000000140411126 loc_140411126: ; CODE XREF: KiSystemCall64+733↓p .text:0000000140411126 add rsp, 8 .text:000000014041112A call loc_14041111D .text:000000014041112F .text:000000014041112F loc_14041112F: ; CODE XREF: KiSystemCall64+73C↓p .text:000000014041112F add rsp, 8 .text:0000000140411133 call loc_140411126 .text:0000000140411138 .text:0000000140411138 loc_140411138: ; CODE XREF: KiSystemCall64+745↓p .text:0000000140411138 add rsp, 8 .text:000000014041113C call loc_14041112F .text:0000000140411141 .text:0000000140411141 loc_140411141: ; CODE XREF: KiSystemCall64+74E↓p .text:0000000140411141 add rsp, 8 .text:0000000140411145 call loc_140411138 .text:000000014041114A .text:000000014041114A loc_14041114A: ; CODE XREF: KiSystemCall64+757↓p .text:000000014041114A add rsp, 8 .text:000000014041114E call loc_140411141 .text:0000000140411153 .text:0000000140411153 loc_140411153: ; CODE XREF: KiSystemCall64+760↓p .text:0000000140411153 add rsp, 8 .text:0000000140411157 call loc_14041114A .text:000000014041115C .text:000000014041115C loc_14041115C: ; CODE XREF: KiSystemCall64+769↓p .text:000000014041115C add rsp, 8 .text:0000000140411160 call loc_140411153 .text:0000000140411165 .text:0000000140411165 loc_140411165: ; CODE XREF: KiSystemCall64+772↓p .text:0000000140411165 add rsp, 8 .text:0000000140411169 call loc_14041115C .text:000000014041116E .text:000000014041116E loc_14041116E: ; CODE XREF: KiSystemCall64+77B↓p .text:000000014041116E add rsp, 8 .text:0000000140411172 call loc_140411165 .text:0000000140411177 .text:0000000140411177 loc_140411177: ; CODE XREF: KiSystemCall64+784↓p .text:0000000140411177 add rsp, 8 .text:000000014041117B call loc_14041116E .text:0000000140411180 .text:0000000140411180 loc_140411180: ; CODE XREF: KiSystemCall64+78D↓p .text:0000000140411180 add rsp, 8 .text:0000000140411184 call loc_140411177 .text:0000000140411189 .text:0000000140411189 loc_140411189: ; CODE XREF: KiSystemCall64+796↓p .text:0000000140411189 add rsp, 8 .text:000000014041118D call loc_140411180 .text:0000000140411192 .text:0000000140411192 loc_140411192: ; CODE XREF: KiSystemCall64+79F↓p .text:0000000140411192 add rsp, 8 .text:0000000140411196 call loc_140411189 .text:000000014041119B .text:000000014041119B loc_14041119B: ; CODE XREF: KiSystemCall64+7A8↓p .text:000000014041119B add rsp, 8 .text:000000014041119F call loc_140411192 .text:00000001404111A4 .text:00000001404111A4 loc_1404111A4: ; CODE XREF: KiSystemCall64+7B1↓p .text:00000001404111A4 add rsp, 8 .text:00000001404111A8 call loc_14041119B .text:00000001404111AD .text:00000001404111AD loc_1404111AD: ; CODE XREF: KiSystemCall64+7BA↓p .text:00000001404111AD add rsp, 8 .text:00000001404111B1 call loc_1404111A4 .text:00000001404111B6 .text:00000001404111B6 loc_1404111B6: ; CODE XREF: KiSystemCall64+7C3↓p .text:00000001404111B6 add rsp, 8 .text:00000001404111BA call loc_1404111AD .text:00000001404111BF .text:00000001404111BF loc_1404111BF: ; CODE XREF: KiSystemCall64+7CC↓p .text:00000001404111BF add rsp, 8 .text:00000001404111C3 call loc_1404111B6 .text:00000001404111C8 .text:00000001404111C8 loc_1404111C8: ; CODE XREF: KiSystemCall64+7D5↓p .text:00000001404111C8 add rsp, 8 .text:00000001404111CC call loc_1404111BF .text:00000001404111D1 .text:00000001404111D1 loc_1404111D1: ; CODE XREF: KiSystemCall64+7DE↓p .text:00000001404111D1 add rsp, 8 .text:00000001404111D5 call loc_1404111C8 .text:00000001404111DA .text:00000001404111DA loc_1404111DA: ; CODE XREF: KiSystemCall64+7E7↓p .text:00000001404111DA add rsp, 8 .text:00000001404111DE call loc_1404111D1 .text:00000001404111E3 .text:00000001404111E3 loc_1404111E3: ; CODE XREF: KiSystemCall64+7F0↓p .text:00000001404111E3 add rsp, 8 .text:00000001404111E7 call loc_1404111DA .text:00000001404111EC .text:00000001404111EC loc_1404111EC: ; CODE XREF: KiSystemCall64+7F9↓p .text:00000001404111EC add rsp, 8 .text:00000001404111F0 call loc_1404111E3 .text:00000001404111F5 .text:00000001404111F5 loc_1404111F5: ; CODE XREF: KiSystemCall64+802↓p .text:00000001404111F5 add rsp, 8 .text:00000001404111F9 call loc_1404111EC .text:00000001404111FE .text:00000001404111FE loc_1404111FE: ; CODE XREF: KiSystemCall64+80B↓p .text:00000001404111FE add rsp, 8 .text:0000000140411202 call loc_1404111F5 .text:0000000140411207 .text:0000000140411207 loc_140411207: ; CODE XREF: KiSystemCall64+814↓p .text:0000000140411207 add rsp, 8 .text:000000014041120B call loc_1404111FE .text:0000000140411210 .text:0000000140411210 loc_140411210: ; CODE XREF: KiSystemCall64+81D↓p .text:0000000140411210 add rsp, 8 .text:0000000140411214 call loc_140411207 .text:0000000140411219 .text:0000000140411219 loc_140411219: ; CODE XREF: KiSystemCall64+706↑p .text:0000000140411219 add rsp, 8 .text:000000014041121D call loc_140411210 .text:0000000140411222 .text:0000000140411222 loc_140411222: ; CODE XREF: KiSystemCall64+70F↑p .text:0000000140411222 add rsp, 8 .text:0000000140411226 mov eax, 0DADAh .text:000000014041122B .text:000000014041122B loc_14041122B: ; CODE XREF: KiSystemCall64+700↑j .text:000000014041122B mov rax, [rbp-50h] .text:000000014041122F mov r8, [rbp+100h] .text:0000000140411236 mov r9, [rbp+0D8h] .text:000000014041123D xor edx, edx .text:000000014041123F pxor xmm0, xmm0 .text:0000000140411243 pxor xmm1, xmm1 .text:0000000140411247 pxor xmm2, xmm2 .text:000000014041124B pxor xmm3, xmm3 .text:000000014041124F pxor xmm4, xmm4 .text:0000000140411253 pxor xmm5, xmm5 .text:0000000140411257 mov rcx, [rbp+0E8h] .text:000000014041125E mov r11, [rbp+0F8h] .text:0000000140411265 test cs:KiKvaShadow, 1 .text:000000014041126C jnz KiKernelSysretExit .text:0000000140411272 mov rbp, r9 .text:0000000140411275 mov rsp, r8 .text:0000000140411278 swapgs .text:000000014041127B sysret