NTSTATUS __fastcall DbgkpPostModuleMessages(PEPROCESS TargetProcess, PETHREAD thread, PDEBUG_OBJECT debug_Object)
00000001408879B0 DbgkpPostModuleMessages proc near ; CODE XREF: DbgkCreateThread_0+1B5B59↑p
00000001408879B0 ; DbgkpPostFakeProcessCreateMessages+77↑p
00000001408879B0 ; DATA XREF: ...
00000001408879B0 var_78 = dword ptr -78h
00000001408879B0 var_70 = qword ptr -70h
00000001408879B0 var_68 = dword ptr -68h
00000001408879B0 var_60 = qword ptr -60h
00000001408879B0 var_58 = qword ptr -58h
00000001408879B0 var_50 = qword ptr -50h
00000001408879B0 var_48 = qword ptr -48h
00000001408879B0 P = qword ptr -40h
00000001408879B0 var_38 = qword ptr -38h
00000001408879B0 arg_TargetProcess= qword ptr 8
00000001408879B0 arg_thread = qword ptr 10h
00000001408879B0 arg_debug_Object= qword ptr 18h
00000001408879B0 arg_18 = dword ptr 20h
00000001408879B0 ; __unwind { // __C_specific_handler
00000001408879B0 mov rax, rsp ; 保存寄存器,分配栈空间
00000001408879B3 mov [rax+18h], r8 ; 保存r8 第三个参数,可能是debug_Object
00000001408879B7 mov [rax+10h], rdx ; 保存rdx(第二个参数)到栈上
00000001408879BB mov [rax+8], rcx ; 保存rcx(第一个参数,PPROCESS_OBJECT)到栈上
00000001408879BF push rbx
00000001408879C0 push rsi
00000001408879C1 push rdi
00000001408879C2 push r14
00000001408879C4 push r15
00000001408879C6 sub rsp, 70h ; 分配栈空间(0x70字节)
00000001408879CA mov rdi, r8 ; 将参数保存到非易失寄存器
00000001408879CD mov rsi, rdx
00000001408879D0 mov rbx, rcx
00000001408879D3 and qword ptr [rax-40h], 0 ; Logical AND
00000001408879D8 and dword ptr [rax+20h], 0 ; Logical AND
00000001408879DC test byte ptr [rcx+3E0h], 1 ; Logical Compare
00000001408879E3 jz short loc_1408879EF ; Jump if Zero (ZF=1)
00000001408879E5 call VslSendDebugAttachNotifications ; Call Procedure
00000001408879EA jmp loc_140887C14 ; Jump
00000001408879EF ; ---------------------------------------------------------------------------
00000001408879EF loc_1408879EF: ; CODE XREF: DbgkpPostModuleMessages+33↑j
00000001408879EF mov rax, [rcx+550h]
00000001408879F6 loc_1408879F6: ; DATA XREF: .rdata:00000001400B53F0↑o
00000001408879F6 ; __try { // __except at loc_140887AC5
00000001408879F6 mov rax, [rax+18h]
00000001408879FA add rax, 10h ; Add
00000001408879FE mov [rsp+98h+var_48], rax
0000000140887A03 mov r14, 7FFFFFFF0000h
0000000140887A0D cmp rax, r14 ; Compare Two Operands
0000000140887A10 cmovnb rax, r14 ; Move if Not Below (CF=0)
0000000140887A14 mov al, [rax]
0000000140887A16 mov rdx, [rsp+98h+var_48]
0000000140887A1B mov rax, [rdx]
0000000140887A1E xor ecx, ecx ; Logical Exclusive OR
0000000140887A20 mov [rsp+98h+var_68], ecx
0000000140887A24 loc_140887A24: ; CODE XREF: DbgkpPostModuleMessages+10E↓j
0000000140887A24 mov [rsp+98h+var_58], rax
0000000140887A29 cmp rax, rdx ; Compare Two Operands
0000000140887A2C jz loc_140887AC3 ; Jump if Zero (ZF=1)
0000000140887A32 cmp ecx, cs:DbgkpMaxModuleMsgs ; Compare Two Operands
0000000140887A38 jnb loc_140887AC3 ; Jump if Not Below (CF=0)
0000000140887A3E cmp ecx, 1 ; Compare Two Operands
0000000140887A41 jbe short loc_140887A9E ; Jump if Below or Equal (CF=1 | ZF=1)
0000000140887A43 cmp rax, r14 ; Compare Two Operands
0000000140887A46 cmovnb rax, r14 ; Move if Not Below (CF=0)
0000000140887A4A mov al, [rax]
0000000140887A4C mov rax, [rsp+98h+var_58]
0000000140887A51 mov rcx, [rax+30h]
0000000140887A55 mov [rsp+98h+var_60], rcx
0000000140887A5A cmp rcx, r14 ; Compare Two Operands
0000000140887A5D cmovnb rcx, r14 ; Move if Not Below (CF=0)
0000000140887A61 mov al, [rcx]
0000000140887A63 mov rcx, [rsp+98h+var_60]
0000000140887A68 call RtlImageNtHeader ; Call Procedure
0000000140887A6D test rax, rax ; Logical Compare
0000000140887A70 jz short loc_140887A7B ; Jump if Zero (ZF=1)
0000000140887A72 mov r9d, [rax+0Ch]
0000000140887A76 mov eax, [rax+10h]
0000000140887A79 jmp short loc_140887A80 ; Jump
0000000140887A7B ; ---------------------------------------------------------------------------
0000000140887A7B loc_140887A7B: ; CODE XREF: DbgkpPostModuleMessages+C0↑j
0000000140887A7B xor r9d, r9d ; Logical Exclusive OR
0000000140887A7E xor eax, eax ; Logical Exclusive OR
0000000140887A80 loc_140887A80: ; CODE XREF: DbgkpPostModuleMessages+C9↑j
0000000140887A80 mov [rsp+98h+var_70], rdi ; PRKEVENT
0000000140887A85 mov [rsp+98h+var_78], eax ; int
0000000140887A89 mov r8, [rsp+98h+var_60]
0000000140887A8E mov rdx, rsi ; PVOID
0000000140887A91 mov rcx, rbx ; Object
0000000140887A94 call DbgkPostModuleMessage ; Call Procedure
0000000140887A99 mov rax, [rsp+98h+var_58]
0000000140887A9E loc_140887A9E: ; CODE XREF: DbgkpPostModuleMessages+91↑j
0000000140887A9E cmp rax, r14 ; Compare Two Operands
0000000140887AA1 cmovnb rax, r14 ; Move if Not Below (CF=0)
0000000140887AA5 mov al, [rax]
0000000140887AA7 mov rax, [rsp+98h+var_58]
0000000140887AAC mov rax, [rax]
0000000140887AAF mov ecx, [rsp+98h+var_68]
0000000140887AB3 inc ecx ; Increment by 1
0000000140887AB5 mov [rsp+98h+var_68], ecx
0000000140887AB9 mov rdx, [rsp+98h+var_48]
0000000140887ABE jmp loc_140887A24 ; Jump
0000000140887AC3 ; ---------------------------------------------------------------------------
0000000140887AC3 loc_140887AC3: ; CODE XREF: DbgkpPostModuleMessages+7C↑j
0000000140887AC3 ; DbgkpPostModuleMessages+88↑j
0000000140887AC3 jmp short loc_140887ADD ; Jump
0000000140887AC3 ; } // starts at 1408879F6
0000000140887AC5 ; ---------------------------------------------------------------------------
0000000140887AC5 loc_140887AC5: ; DATA XREF: .rdata:00000001400B53F0↑o
0000000140887AC5 ; __except(1) // owned by 1408879F6
0000000140887AC5 mov rdi, [rsp+98h+arg_debug_Object]
0000000140887ACD mov rsi, [rsp+98h+arg_thread]
0000000140887AD5 mov rbx, [rsp+98h+arg_TargetProcess]
0000000140887ADD loc_140887ADD: ; CODE XREF: DbgkpPostModuleMessages:loc_140887AC3↑j
0000000140887ADD lea r8, [rsp+98h+arg_18] ; Load Effective Address
0000000140887AE5 lea rdx, [rsp+98h+P] ; Load Effective Address
0000000140887AEA mov rcx, rbx
0000000140887AED call PsGetProcessEnclaveModuleInfo_0 ; Call Procedure
0000000140887AF2 test eax, eax ; Logical Compare
0000000140887AF4 js short loc_140887B3D ; Jump if Sign (SF=1)
0000000140887AF6 xor r14d, r14d ; Logical Exclusive OR
0000000140887AF9 mov r15, [rsp+98h+P]
0000000140887AFE loc_140887AFE: ; CODE XREF: DbgkpPostModuleMessages+17C↓j
0000000140887AFE cmp r14d, [rsp+98h+arg_18] ; Compare Two Operands
0000000140887B06 jnb short loc_140887B2E ; Jump if Not Below (CF=0)
0000000140887B08 mov r9d, r14d
0000000140887B0B add r9, r9 ; Add
0000000140887B0E mov eax, [r15+r9*8+8]
0000000140887B13 mov [rsp+98h+var_78], eax
0000000140887B17 mov r9, [r15+r9*8]
0000000140887B1B mov r8, rdi
0000000140887B1E mov rdx, rsi
0000000140887B21 mov rcx, rbx
0000000140887B24 call DbgkPostEnclaveModuleMessages ; Call Procedure
0000000140887B29 inc r14d ; Increment by 1
0000000140887B2C jmp short loc_140887AFE ; Jump
0000000140887B2E ; ---------------------------------------------------------------------------
0000000140887B2E loc_140887B2E: ; CODE XREF: DbgkpPostModuleMessages+156↑j
0000000140887B2E mov edx, [rsp+98h+arg_18]
0000000140887B35 mov rcx, r15 ; P
0000000140887B38 call PsFreeEnclaveModuleInfo ; Call Procedure
0000000140887B3D loc_140887B3D: ; CODE XREF: DbgkpPostModuleMessages+144↑j
0000000140887B3D mov r8, rdi
0000000140887B40 DbgkUserReportWorkRoutine_0:
0000000140887B40 mov rdx, rsi
0000000140887B43 mov rcx, rbx
0000000140887B46 call MmPostHotPatchDbgModuleMessages ; Call Procedure
0000000140887B4B mov rax, [rbx+580h]
0000000140887B52 test rax, rax ; Logical Compare
0000000140887B55 jz loc_140887C14 ; Jump if Zero (ZF=1)
0000000140887B5B movzx ecx, word ptr [rax+8] ; Move with Zero-Extend
0000000140887B5F mov edx, 14Ch
0000000140887B64 cmp cx, dx ; Compare Two Operands
0000000140887B67 jz short loc_140887B77 ; Jump if Zero (ZF=1)
0000000140887B69 mov edx, 1C4h
0000000140887B6E cmp cx, dx ; Compare Two Operands
0000000140887B71 jnz loc_140887C14 ; Jump if Not Zero (ZF=0)
0000000140887B77 loc_140887B77: ; CODE XREF: DbgkpPostModuleMessages+1B7↑j
0000000140887B77 mov rcx, [rax]
0000000140887B7A loc_140887B7A: ; DATA XREF: .rdata:00000001400B5400↑o
0000000140887B7A ; __try { // __except at loc_140887C14
0000000140887B7A mov eax, [rcx+0Ch]
0000000140887B7D add rax, 0Ch ; Add
0000000140887B81 mov [rsp+98h+var_38], rax
0000000140887B86 mov al, [rax]
0000000140887B88 mov rdx, [rsp+98h+var_38]
0000000140887B8D mov ecx, [rdx]
0000000140887B8F xor eax, eax ; Logical Exclusive OR
0000000140887B91 mov [rsp+98h+var_68], eax
0000000140887B95 loc_140887B95: ; CODE XREF: DbgkpPostModuleMessages+260↓j
0000000140887B95 mov [rsp+98h+var_50], rcx
0000000140887B9A cmp rcx, rdx ; Compare Two Operands
0000000140887B9D jz short loc_140887C12 ; Jump if Zero (ZF=1)
0000000140887B9F cmp eax, cs:DbgkpMaxModuleMsgs ; Compare Two Operands
0000000140887BA5 jnb short loc_140887C12 ; Jump if Not Below (CF=0)
0000000140887BA7 cmp eax, 1 ; Compare Two Operands
0000000140887BAA jbe short loc_140887BF8 ; Jump if Below or Equal (CF=1 | ZF=1)
0000000140887BAC mov al, [rcx]
0000000140887BAE mov rax, [rsp+98h+var_50]
0000000140887BB3 mov ecx, [rax+18h]
0000000140887BB6 mov [rsp+98h+var_60], rcx
0000000140887BBB mov al, [rcx]
0000000140887BBD mov rcx, [rsp+98h+var_60]
0000000140887BC2 call RtlImageNtHeader ; Call Procedure
0000000140887BC7 test rax, rax ; Logical Compare
0000000140887BCA jz short loc_140887BD5 ; Jump if Zero (ZF=1)
0000000140887BCC mov r9d, [rax+0Ch]
0000000140887BD0 mov ecx, [rax+10h]
0000000140887BD3 jmp short loc_140887BDA ; Jump
0000000140887BD5 ; ---------------------------------------------------------------------------
0000000140887BD5 loc_140887BD5: ; CODE XREF: DbgkpPostModuleMessages+21A↑j
0000000140887BD5 xor r9d, r9d ; Logical Exclusive OR
0000000140887BD8 xor ecx, ecx ; Logical Exclusive OR
0000000140887BDA loc_140887BDA: ; CODE XREF: DbgkpPostModuleMessages+223↑j
0000000140887BDA mov [rsp+98h+var_70], rdi ; PRKEVENT
0000000140887BDF mov [rsp+98h+var_78], ecx ; int
0000000140887BE3 mov r8, [rsp+98h+var_60]
0000000140887BE8 mov rdx, rsi ; PVOID
0000000140887BEB mov rcx, rbx ; Object
0000000140887BEE call DbgkPostModuleMessage ; Call Procedure
0000000140887BF3 mov rcx, [rsp+98h+var_50]
0000000140887BF8 loc_140887BF8: ; CODE XREF: DbgkpPostModuleMessages+1FA↑j
0000000140887BF8 mov al, [rcx]
0000000140887BFA mov rax, [rsp+98h+var_50]
0000000140887BFF mov ecx, [rax]
0000000140887C01 mov eax, [rsp+98h+var_68]
0000000140887C05 inc eax ; Increment by 1
0000000140887C07 mov [rsp+98h+var_68], eax
0000000140887C0B mov rdx, [rsp+98h+var_38]
0000000140887C10 jmp short loc_140887B95 ; Jump
0000000140887C12 ; ---------------------------------------------------------------------------
0000000140887C12 loc_140887C12: ; CODE XREF: DbgkpPostModuleMessages+1ED↑j
0000000140887C12 ; DbgkpPostModuleMessages+1F5↑j
0000000140887C12 jmp short $+2 ; Jump
0000000140887C12 ; } // starts at 140887B7A
0000000140887C14 ; ---------------------------------------------------------------------------
0000000140887C14 loc_140887C14: ; CODE XREF: DbgkpPostModuleMessages+3A↑j
0000000140887C14 ; DbgkpPostModuleMessages+1A5↑j ...
0000000140887C14 ; __except(1) // owned by 140887B7A
0000000140887C14 add rsp, 70h ; Add
0000000140887C18 pop r15
0000000140887C1A pop r14
0000000140887C1C pop rdi
0000000140887C1D pop rsi
0000000140887C1E pop rbx
0000000140887C1F retn ; Return Near from Procedure
0000000140887C1F ; ---------------------------------------------------------------------------
0000000140887C20 db 0CCh
0000000140887C20 ; } // starts at 1408879B0
0000000140887C20 DbgkpPostModuleMessages endp 注释每一行汇编函数
最新发布