﻿========================================================================
    STATIC LIBRARY : LoadRemoteDLL Project Overview
========================================================================

AppWizard has created this LoadRemoteDLL library project for you. 

This file contains a summary of what you will find in each of the files that
make up your LoadRemoteDLL application.


LoadRemoteDLL.vcproj
    This is the main project file for VC++ projects generated using an Application Wizard. 
    It contains information about the version of Visual C++ that generated the file, and 
    information about the platforms, configurations, and project features selected with the
    Application Wizard.


/////////////////////////////////////////////////////////////////////////////

StdAfx.h, StdAfx.cpp
    These files are used to build a precompiled header (PCH) file
    named LoadRemoteDLL.pch and a precompiled types file named StdAfx.obj.

/////////////////////////////////////////////////////////////////////////////
Other notes:

AppWizard uses "TODO:" comments to indicate parts of the source code you
should add to or customize.

/////////////////////////////////////////////////////////////////////////////

-- -------------------------------------------------------------------------------------
CreateFileMappingW:
00007FFF464373A0 48 83 EC 48          sub         rsp,48h  
00007FFF464373A4 48 8B 44 24 78       mov         rax,qword ptr [rsp+78h]  
00007FFF464373A9 83 4C 24 30 FF       or          dword ptr [rsp+30h],0FFFFFFFFh  
00007FFF464373AE 48 89 44 24 28       mov         qword ptr [rsp+28h],rax  
00007FFF464373B3 8B 44 24 70          mov         eax,dword ptr [rsp+70h]  
00007FFF464373B7 89 44 24 20          mov         dword ptr [rsp+20h],eax  
00007FFF464373BB E8 AC FE FF FF       call        CreateFileMappingNumaW (7FFF4643726Ch)  
-- -------------------------------------------------------------------------------------
CreateFileMappingNumaW:
00007FFF4643726C 48 8B C4             mov         rax,rsp  
00007FFF4643726F 48 89 58 08          mov         qword ptr [rax+8],rbx  
00007FFF46437273 48 89 70 10          mov         qword ptr [rax+10h],rsi  
00007FFF46437277 48 89 78 18          mov         qword ptr [rax+18h],rdi  
00007FFF4643727B 55                   push        rbp  
00007FFF4643727C 41 54                push        r12  
00007FFF4643727E 41 55                push        r13  
00007FFF46437280 41 56                push        r14  
00007FFF46437282 41 57                push        r15  
00007FFF46437284 48 8D 68 B9          lea         rbp,[rax-47h]  
00007FFF46437288 48 81 EC A0 00 00 00 sub         rsp,0A0h  
00007FFF4643728F 44 8B 75 7F          mov         r14d,dword ptr [rbp+7Fh]  
00007FFF46437293 45 8B E1             mov         r12d,r9d  
00007FFF46437296 41 8B D8             mov         ebx,r8d  
00007FFF46437299 41 8D 46 C0          lea         eax,[r14-40h]  
00007FFF4643729D 4C 8B EA             mov         r13,rdx  
00007FFF464372A0 4C 8B F9             mov         r15,rcx  
00007FFF464372A3 83 F8 BE             cmp         eax,0FFFFFFBEh  
00007FFF464372A6 0F 86 DC 78 08 00    jbe         CreateFileMappingNumaW+13Eh (7FFF464BEB88h)  
00007FFF464372AC 8B FB                mov         edi,ebx  
00007FFF464372AE B8 00 00 00 08       mov         eax,8000000h  
00007FFF464372B3 BE 05 00 0F 00       mov         esi,0F0005h  
00007FFF464372B8 81 E7 00 00 80 9D    and         edi,9D800000h  
00007FFF464372BE 33 DF                xor         ebx,edi  
00007FFF464372C0 85 FF                test        edi,edi  
00007FFF464372C2 0F 44 F8             cmove       edi,eax  
00007FFF464372C5 83 FB 04             cmp         ebx,4  
00007FFF464372C8 0F 85 F7 00 00 00    jne         CreateFileMappingNumaW+62h (7FFF464373C5h)  -->+
00007FFF464372CE BE 07 00 0F 00       mov         esi,0F0007h                                    |
00007FFF464372D3 EB 01                jmp         CreateFileMappingNumaW+89h (7FFF464372D6h)     |
...                                                                                              v
00007FFF464373C5 83 FB 40             cmp         ebx,40h                                   <----+
00007FFF464373C8 0F 84 ED 12 08 00    je          CreateFileMappingNumaW+1A1h (7FFF464B86BBh)  
00007FFF464373CE 83 FB 20             cmp         ebx,20h  
00007FFF464373D1 0F 84 C5 77 08 00    je          CreateFileMappingNumaW+1ABh (7FFF464BEB9Ch)  
00007FFF464373D7 81 FB 80 00 00 00    cmp         ebx,80h  
00007FFF464373DD 0F 84 B9 77 08 00    je          CreateFileMappingNumaW+1ABh (7FFF464BEB9Ch)  --+
00007FFF464373E3 83 FB 02             cmp         ebx,2                                          |
00007FFF464373E6 0F 84 EA FE FF FF    je          CreateFileMappingNumaW+89h (7FFF464372D6h)     |
00007FFF464373EC 83 FB 08             cmp         ebx,8                                          |
00007FFF464373EF 0F 84 E1 FE FF FF    je          CreateFileMappingNumaW+89h (7FFF464372D6h)     |
00007FFF464373F5 E9 9F 77 08 00       jmp         CreateFileMappingNumaW+19Fh (7FFF464BEB99h)    |
...                                                                                              v
00007FFF464BEB9C BE 0D 00 0F 00       mov         esi,0F000Dh                                <---+
00007FFF464BEBA1 E9 30 87 F7 FF       jmp         CreateFileMappingNumaW+89h (7FFF464372D6h)  
...
00007FFF464372D6 48 8B 55 77          mov         rdx,qword ptr [rbp+77h]  
00007FFF464372DA 48 85 D2             test        rdx,rdx  
00007FFF464372DD 0F 85 32 19 00 00    jne         CreateFileMappingNumaW+15Ch (7FFF46438C15h)  
00007FFF464372E3 45 33 C0             xor         r8d,r8d  
00007FFF464372E6 4C 8D 4D C7          lea         r9,[rbp-39h]  
00007FFF464372EA 48 8D 4D E7          lea         rcx,[rbp-19h]  
00007FFF464372EE 49 8B D5             mov         rdx,r13  
00007FFF464372F1 E8 02 A7 FF FF       call        BaseFormatObjectAttributes (7FFF464319F8h)  
-- -------------------------------------------------------------------------------------
BaseFormatObjectAttributes:
00007FFF464319F8 48 89 5C 24 08       mov         qword ptr [rsp+8],rbx  
00007FFF464319FD 48 89 6C 24 18       mov         qword ptr [rsp+18h],rbp  
00007FFF46431A02 56                   push        rsi  
00007FFF46431A03 57                   push        rdi  
00007FFF46431A04 41 56                push        r14  
00007FFF46431A06 48 83 EC 20          sub         rsp,20h  
00007FFF46431A0A 4D 8B F1             mov         r14,r9  
00007FFF46431A0D 49 8B F0             mov         rsi,r8  
00007FFF46431A10 48 8B D9             mov         rbx,rcx  
00007FFF46431A13 48 85 D2             test        rdx,rdx  
00007FFF46431A16 0F 85 7D 71 00 00    jne         BaseFormatObjectAttributes+8Dh (7FFF46438B99h)  
00007FFF46431A1C 4D 85 C0             test        r8,r8  
00007FFF46431A1F 74 6A                je          BaseFormatObjectAttributes+25h (7FFF46431A8Bh)  -->+
00007FFF46431A21 33 FF                xor         edi,edi                                            |
00007FFF46431A23 33 ED                xor         ebp,ebp                                            |
00007FFF46431A25 4D 85 C0             test        r8,r8                                              |
00007FFF46431A28 0F 84 68 1E 00 00    je          BaseFormatObjectAttributes+9Dh (7FFF46433896h)     |
00007FFF46431A2E 48 8D 4C 24 48       lea         rcx,[rsp+48h]                                      |
00007FFF46431A33 E8 98 42 00 00       call        BaseGetNamedObjectDirectory (7FFF46435CD0h)        |
-- -------------------------------------------------------------------------------------             |
...                                                                                                  |
-- -------------------------------------------------------------------------------------             |
00007FFF46431A38 85 C0                test        eax,eax                                            |
00007FFF46431A3A 78 3C                js          BaseFormatObjectAttributes+2Ah (7FFF46431A78h)     |
00007FFF46431A3C 48 8B 44 24 48       mov         rax,qword ptr [rsp+48h]                            |
00007FFF46431A41 0F BA EF 07          bts         edi,7                                              |
00007FFF46431A45 48 83 63 28 00       and         qword ptr [rbx+28h],0                              |
00007FFF46431A4A 48 89 43 08          mov         qword ptr [rbx+8],rax                              |
00007FFF46431A4E 48 8B 05 83 D3 0E 00 mov         rax,qword ptr [pfnAdjustObjectAttributesForPrivateNamespace (7FFF4651EDD8h)]  
00007FFF46431A55 C7 03 30 00 00 00    mov         dword ptr [rbx],30h                                |
00007FFF46431A5B 89 7B 18             mov         dword ptr [rbx+18h],edi                            |
00007FFF46431A5E 48 89 73 10          mov         qword ptr [rbx+10h],rsi                            |
00007FFF46431A62 48 89 6B 20          mov         qword ptr [rbx+20h],rbp                            |
00007FFF46431A66 48 85 C0             test        rax,rax                                            |
00007FFF46431A69 74 05                je          BaseFormatObjectAttributes+88h (7FFF46431A70h)     |
00007FFF46431A6B 48 8B CB             mov         rcx,rbx                                            |
00007FFF46431A6E FF D0                call        rax                                                |
00007FFF46431A70 49 89 1E             mov         qword ptr [r14],rbx                                |
00007FFF46431A73 EB 01                jmp         BaseFormatObjectAttributes+28h (7FFF46431A76h)     |
...                                                                                                  |
00007FFF46431A76 33 C0                xor         eax,eax                               <------------|---+
00007FFF46431A78 48 8B 5C 24 40       mov         rbx,qword ptr [rsp+40h]                            |   ^
00007FFF46431A7D 48 8B 6C 24 50       mov         rbp,qword ptr [rsp+50h]                            |   |
00007FFF46431A82 48 83 C4 20          add         rsp,20h                                            |   |
00007FFF46431A86 41 5E                pop         r14                                                |   |
00007FFF46431A88 5F                   pop         rdi                                                |   |
00007FFF46431A89 5E                   pop         rsi                                                |   |
00007FFF46431A8A C3                   ret                                                            v   |
00007FFF46431A8B 49 21 11             and         qword ptr [r9],rdx                     <-----------+   |
00007FFF46431A8E EB E6                jmp         BaseFormatObjectAttributes+28h (7FFF46431A76h)  ------>+
-- -------------------------------------------------------------------------------------
00007FFF464372F6 85 C0                test        eax,eax  
00007FFF464372F8 0F 88 62 92 04 00    js          CreateFileMappingNumaW+188h (7FFF46480560h)  
00007FFF464372FE 8B 45 6F             mov         eax,dword ptr [rbp+6Fh]  
00007FFF46437301 85 C0                test        eax,eax  
00007FFF46437303 0F 84 F2 00 00 00    je          CreateFileMappingNumaW+14Bh (7FFF464373FBh)  --->+
00007FFF46437309 4C 8D 4D BF          lea         r9,[rbp-41h]                                     |
00007FFF4643730D 89 45 BF             mov         dword ptr [rbp-41h],eax                          |
00007FFF46437310 44 89 65 C3          mov         dword ptr [rbp-3Dh],r12d                         |
00007FFF46437314 49 83 FF FF          cmp         r15,0FFFFFFFFFFFFFFFFh     <---------------------|----+
00007FFF46437318 75 0C                jne         CreateFileMappingNumaW+0CDh (7FFF46437326h) -----|->+ ^
00007FFF4643731A 45 33 FF             xor         r15d,r15d                                        |  | |
00007FFF4643731D 4D 85 C9             test        r9,r9                                            |  | |
00007FFF46437320 0F 84 62 78 08 00    je          CreateFileMappingNumaW+13Eh (7FFF464BEB88h)      |  v |
00007FFF46437326 41 83 FE FF          cmp         r14d,0FFFFFFFFh              <-------------------|--+ |
00007FFF4643732A 0F 85 AB F7 09 00    jne         00007FFF464D6ADB                                 |    |
00007FFF46437330 4C 8B 45 C7          mov         r8,qword ptr [rbp-39h]                           |    |
00007FFF46437334 4C 89 7C 24 30       mov         qword ptr [rsp+30h],r15                          |    |
00007FFF46437339 48 8D 4D CF          lea         rcx,[rbp-31h]                                    |    |
00007FFF4643733D 8B D6                mov         edx,esi                                          |    |
00007FFF4643733F 89 7C 24 28          mov         dword ptr [rsp+28h],edi                          |    |
00007FFF46437343 89 5C 24 20          mov         dword ptr [rsp+20h],ebx                          |    |
00007FFF46437347 FF 15 4B D1 0F 00    call        qword ptr [__imp_NtCreateSection (7FFF46534498h)]|    |
00007FFF4643734D 85 C0                test        eax,eax                                          |    |
00007FFF4643734F 0F 88 F1 91 04 00    js          CreateFileMappingNumaW+176h (7FFF46480546h)      |    |
00007FFF46437355 3D 00 00 00 40       cmp         eax,40000000h                                    |    |
00007FFF4643735A 0F 84 E3 6B 04 00    je          CreateFileMappingNumaW+16Fh (7FFF4647DF43h)      |    |
00007FFF46437360 33 C9                xor         ecx,ecx                                          |    |
00007FFF46437362 FF 15 C0 CD 0F 00    call        qword ptr [__imp_RtlSetLastWin32Error (7FFF46534128h)]|  
00007FFF46437368 48 8B 45 CF          mov         rax,qword ptr [rbp-31h]                          |    |
00007FFF4643736C 4C 8D 9C 24 A0 00 00 00 lea         r11,[rsp+0A0h]                                |    |
00007FFF46437374 49 8B 5B 30          mov         rbx,qword ptr [r11+30h]                          |    |
00007FFF46437378 49 8B 73 38          mov         rsi,qword ptr [r11+38h]                          |    |
00007FFF4643737C 49 8B 7B 40          mov         rdi,qword ptr [r11+40h]                          |    |
00007FFF46437380 49 8B E3             mov         rsp,r11                                          |    |
00007FFF46437383 41 5F                pop         r15                                              |    |
00007FFF46437385 41 5E                pop         r14                                              |    |
00007FFF46437387 41 5D                pop         r13                                              |    |
00007FFF46437389 41 5C                pop         r12                                              |    |
00007FFF4643738B 5D                   pop         rbp                                              |    |
00007FFF4643738C C3                   ret                                                          |    |
...                                                                                                v    |
00007FFF464373FB 45 85 E4             test        r12d,r12d                             <----------+    |
00007FFF464373FE 0F 85 05 FF FF FF    jne         CreateFileMappingNumaW+0BCh (7FFF46437309h)           |
00007FFF46437404 45 33 C9             xor         r9d,r9d                                               |
00007FFF46437407 E9 08 FF FF FF       jmp         CreateFileMappingNumaW+0C7h (7FFF46437314h)  -------->+
...
-- -------------------------------------------------------------------------------------
00007FFF464373C0 48 83 C4 48          add         rsp,48h  
00007FFF464373C4 C3                   ret  
-- -------------------------------------------------------------------------------------
MapViewOfFile:
00007FFF46433740 48 83 EC 48          sub         rsp,48h  
00007FFF46433744 83 4C 24 30 FF       or          dword ptr [rsp+30h],0FFFFFFFFh ; DWORD nndPreferred := 0FFFFFFFFh
00007FFF46433749 48 8B 44 24 70       mov         rax,qword ptr [rsp+70h]  
00007FFF4643374E 48 83 64 24 28 00    and         qword ptr [rsp+28h],0          ; LPVOID lpBaseAddress := NULL
00007FFF46433754 48 89 44 24 20       mov         qword ptr [rsp+20h],rax        ; SIZE_T dwNumberOfBytesToMap := 0
00007FFF46433759 E8 2A E6 FF FF       call        MapViewOfFileExNuma (7FFF46431D88h)  
-- -------------------------------------------------------------------------------------
MapViewOfFileExNuma:
00007FFF46431D88 48 83 EC 78          sub         rsp,78h  
00007FFF46431D8C 44 8B 94 24 B0 00 00 00 mov         r10d,dword ptr [rsp+0B0h]  ; DWORD nndPreferred = 0FFFFFFFFh
00007FFF46431D94 45 33 DB             xor         r11d,r11d  
00007FFF46431D97 41 8D 42 C0          lea         eax,[r10-40h]  
00007FFF46431D9B 83 F8 BE             cmp         eax,0FFFFFFBEh  
00007FFF46431D9E 0F 86 10 6B 0A 00    jbe         00007FFF464D88B4  
00007FFF46431DA4 48 8B 84 24 A0 00 00 00 mov         rax,qword ptr [rsp+0A0h]   ; SIZE_T dwNumberOfBytesToMap = 0
00007FFF46431DAC 44 89 4C 24 50       mov         dword ptr [rsp+50h],r9d       ; DWORD dwFileOffsetLow := 0
00007FFF46431DB1 44 89 44 24 54       mov         dword ptr [rsp+54h],r8d       ; DWORD dwFileOffsetHigh := 0
00007FFF46431DB6 48 89 44 24 60       mov         qword ptr [rsp+60h],rax       ; SIZE_T dwNumberOfBytesToMap := 0
00007FFF46431DBB 48 8B 84 24 A8 00 00 00 mov         rax,qword ptr [rsp+0A8h]   ; LPVOID lpBaseAddress = NULL
00007FFF46431DC3 48 89 44 24 58       mov         qword ptr [rsp+58h],rax       ; LPVOID lpBaseAddress := NULL
00007FFF46431DC8 85 D2                test        edx,edx                       ; DWORD dwDesiredAccess = 0x0x00000021 (FILE_MAP_COPY | FILE_MAP_EXECUTE)
00007FFF46431DCA 0F 88 F5 6A 0A 00    js          00007FFF464D88C5  
00007FFF46431DD0 41 B8 01 00 00 00    mov         r8d,1  
00007FFF46431DD6 83 FA 21             cmp         edx,21h  
00007FFF46431DD9 0F 84 8D 00 09 00    je          MapViewOfFileExNuma+0F8h (7FFF464C1E6Ch)  --->+
00007FFF46431DDF 41 3B D0             cmp         edx,r8d                                       |
00007FFF46431DE2 0F 84 F1 6D 08 00    je          MapViewOfFileExNuma+0EEh (7FFF464B8BD9h)      |
00007FFF46431DE8 F6 C2 02             test        dl,2                                          |
00007FFF46431DEB 0F 84 72 19 00 00    je          MapViewOfFileExNuma+0CAh (7FFF46433763h)      |
00007FFF46431DF1 80 E2 20             and         dl,20h                                        |
00007FFF46431DF4 F6 DA                neg         dl                                            |
00007FFF46431DF6 1B C0                sbb         eax,eax                                       |
00007FFF46431DF8 83 E0 3C             and         eax,3Ch                                       |
00007FFF46431DFB 83 C0 04             add         eax,4                                         |
00007FFF46431DFE 41 83 FA FF          cmp         r10d,0FFFFFFFFh             <-----------------|---+ ; DWORD nndPreferred = 0FFFFFFFFh
00007FFF46431E02 0F 85 6E 00 09 00    jne         MapViewOfFileExNuma+102h (7FFF464C1E76h)      |   ^
00007FFF46431E08 45 33 D2             xor         r10d,r10d                                     |   |
00007FFF46431E0B 89 44 24 48          mov         dword ptr [rsp+48h],eax                       |   | ; ULONG Win32Protect := 0x00000080 (PAGE_EXECUTE_WRITECOPY)
00007FFF46431E0F 45 0B DA             or          r11d,r10d                                     |   |
00007FFF46431E12 48 8D 44 24 60       lea         rax,[rsp+60h]                                 |   |
00007FFF46431E17 44 89 5C 24 40       mov         dword ptr [rsp+40h],r11d                      |   | ; ULONG AllocationType := 0 (-)
00007FFF46431E1C 44 89 44 24 38       mov         dword ptr [rsp+38h],r8d                       |   | ; SECTION_INHERIT InheritDisposition := 1 (ViewShare)
00007FFF46431E21 48 89 44 24 30       mov         qword ptr [rsp+30h],rax                       |   | ; PSIZE_T ViewSize := rsp+60h
00007FFF46431E26 48 8D 44 24 50       lea         rax,[rsp+50h]                                 |   |
00007FFF46431E2B 4C 8D 44 24 58       lea         r8,[rsp+58h]                                  |   | ; PVOID *BaseAddress := rsp+58h == NULL
00007FFF46431E30 45 33 C9             xor         r9d,r9d                                       |   | ; ULONG_PTR ZeroBits := 0
00007FFF46431E33 48 89 44 24 28       mov         qword ptr [rsp+28h],rax                       |   | ; PLARGE_INTEGER SectionOffset := rsp+50h == 0
00007FFF46431E38 48 83 64 24 20 00    and         qword ptr [rsp+20h],0                         |   | ; SIZE_T CommitSize := 0
00007FFF46431E3E 48 83 CA FF          or          rdx,0FFFFFFFFFFFFFFFFh                        |   | ; HANDLE ProcessHandle := NtCurrentProcess
; HANDLE SectionHandle = RCX == 0x0000000000000110
00007FFF46431E42 FF 15 48 26 10 00    call        qword ptr [__imp_NtMapViewOfSection (7FFF46534490h)]  
00007FFF46431E48 85 C0                test        eax,eax                                       |   |
00007FFF46431E4A 0F 88 3B AC 01 00    js          MapViewOfFileExNuma+0E3h (7FFF4644CA8Bh)      |   |
00007FFF46431E50 48 8B 44 24 58       mov         rax,qword ptr [rsp+58h]                       |   | ; return 0x00007fff44230000
00007FFF46431E55 48 83 C4 78          add         rsp,78h                                       |   |
00007FFF46431E59 C3                   ret                                                       |   |
...                                                                                             v   |
00007FFF464C1E6C B8 80 00 00 00       mov         eax,80h                  <--------------------+   |
00007FFF464C1E71 E9 88 FF F6 FF       jmp         MapViewOfFileExNuma+72h (7FFF46431DFEh)  -------->+
...  
-- -------------------------------------------------------------------------------------
00007FFF4643375E 48 83 C4 48          add         rsp,48h  
00007FFF46433762 C3                   ret  
-- -------------------------------------------------------------------------------------


empty:
head      <--+
    Flink -->+
    Blink -->+

+entry1:
VOID
    InsertTailList(
    _Inout_ PLIST_ENTRY ListHead,
    _Inout_ __drv_aliasesMem PLIST_ENTRY Entry
    )
{

    PLIST_ENTRY Blink;

    Blink = ListHead->Blink;
    Entry->Flink = ListHead;
    Entry->Blink = Blink;
    Blink->Flink = Entry;
    ListHead->Blink = Entry;
    return;
}
InsertTailList(
    &head,
    &entry1
    )
{

    PLIST_ENTRY Blink;

    Blink := head.Blink = &head;
    entry1.Flink := &head;
    entry1.Blink := Blink = &head;
    Blink->Flink = head.Flink := &entry1;
    head.Blink := &entry1;
    return;
}
head   <-----+
    Flink ---^->+
    Blink ---|->+
entry1 <-----|--+
    Flink -->+
    Blink -->+

+entry2:
VOID
    InsertTailList(
    _Inout_ PLIST_ENTRY ListHead,
    _Inout_ __drv_aliasesMem PLIST_ENTRY Entry
    )
{

    PLIST_ENTRY Blink;

    Blink = ListHead->Blink;
    Entry->Flink = ListHead;
    Entry->Blink = Blink;
    Blink->Flink = Entry;
    ListHead->Blink = Entry;
    return;
}
InsertTailList(
    &head,
    &entry2
    )
{

    PLIST_ENTRY Blink;

    Blink := head.Blink = &entry1;
    entry2.Flink := &head;
    entry2.Blink := Blink = &entry1;
    Blink->Flink = entry1.Flink := &entry2;
    head.Blink := &entry2;
    return;
}
head   <-----+
    Flink ---^-->+
    Blink ---|---v---+
entry1 <-----|---+   v
    Flink ---|---^-->+
    Blink -->+   |   v
entry2 <-----|---|---+
    Flink -->+   |
    Blink ------>+

+entry3:
VOID
    InsertTailList(
    _Inout_ PLIST_ENTRY ListHead,
    _Inout_ __drv_aliasesMem PLIST_ENTRY Entry
    )
{

    PLIST_ENTRY Blink;

    Blink = ListHead->Blink;
    Entry->Flink = ListHead;
    Entry->Blink = Blink;
    Blink->Flink = Entry;
    ListHead->Blink = Entry;
    return;
}
InsertTailList(
    &head,
    &entry3
    )
{

    PLIST_ENTRY Blink;

    Blink := head.Blink = &entry2;
    entry3.Flink := &head;
    entry3.Blink := Blink = &entry2;
    Blink->Flink = entry2.Flink := &entry3;
    head.Blink := &entry3;
    return;
}
head   <-----+
    Flink ---^---------->+
    Blink ---|------>+   v
entry1 <-----|-------|---+
    Flink ---|-->+   |   ^
    Blink -->+   v   |   |
entry2 <-----|---+   v   |
    Flink ---|---^-->+   |
    Blink ---|---|---v-->+
entry3 <-----|---|---+
    Flink -->+   |
    Blink ------>+


...
        }
        pRemoteTarget = PBYTE(&pThunkArray[j]) - dwImportUpdateAddr; // pRemoteTarget	0x0000000000002000 <Bad Ptr>	unsigned char *

        dwNTStatus = NTWriteProcessMemory(
            m_hProcessHandle,
            pRemoteTarget,
            PVOID(&pFunctionAddr),
            sizeof(pFunctionAddr),
            NULL
            );
        if (!NT_SUCCESS(dwNTStatus))
        {
            delete pCopyOf_edata;
            return false;
        }
...

-- ------------------------------------------------------------------------------------------------
...
    dwNTStatus = RtlCreateProcessParameters(
        &pProcessParameters,
        &usNtPathName,
        NULL,
        NULL,
        NULL,
        NULL,
        NULL,
        NULL,
        NULL,
        NULL
        );
    RtlZeroMemory(
        &stProcessInfo,
        sizeof(stProcessInfo)
        );
    dwNTStatus = RtlCreateUserProcess(
        &usNtPathName,
        OBJ_CASE_INSENSITIVE,
        pProcessParameters,
        NULL,
        NULL,
        NULL,
        FALSE,
        NULL,
        NULL,
        &stProcessInfo
        );
-- ------------------------------------------------------------------------------------------------
		dwNTStatus	0xc0000034	long
//
// MessageId: STATUS_OBJECT_NAME_NOT_FOUND
//
// MessageText:
//
// Object Name not found.
//
#define STATUS_OBJECT_NAME_NOT_FOUND     ((NTSTATUS)0xC0000034L)
-- ------------------------------------------------------------------------------------------------
...
-- ------------------------------------------------------------------------------------------------
_RtlCreateUserProcess@40:
7758C722 8B FF                mov         edi,edi  
7758C724 55                   push        ebp  
7758C725 8B EC                mov         ebp,esp  
0x003DEEF0  003def88 00000040 00592008 00000000 00000000
0x003DEF04  ffffffff 00000000 00000000 00000000 003df06c
0x003DEF18  d5429d58 00000186 01f62320 0000007f 01f60290
7758C727 83 7D 08 00          cmp         dword ptr [ebp+8],0                      ; IN PUNICODE_STRING FileName = 003def88
7758C72B 74 63                je          _RtlCreateUserProcess@40+6Eh (7758C790h)  
7758C72D 83 7D 10 00          cmp         dword ptr [ebp+10h],0                    ; IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters = 00592008
7758C731 74 5D                je          _RtlCreateUserProcess@40+6Eh (7758C790h)  
7758C733 FF 75 10             push        dword ptr [ebp+10h]                      ; IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters = 00592008
7758C736 E8 DA 85 F9 FF       call        _RtlNormalizeProcessParams@4 (77524D15h)  
- ===========================================================================================================
;		EAX	00592008	
0x00592008  000005bc 000005bc 00000001 00000000 00000000  ј...ј...............
0x0059201C  00000000 00000000 00000000 00000000 02080058  ................X...
0x00592030  005922a8 00000000 00000000 00000000 00820080  Ё"Y.............Ђ...
0x00592044  005924b0 00820080 00592534 005925c4 00000000  °$Y.Ђ...4%Y.Д%Y.....
0x00592058  00000000 00000000 00000000 00000000 00000000  ....................
0x0059206C  00000000 00000000 00000000 00020000 005925b8  ................ё%Y.
0x00592080  00020000 005925bc 00020000 005925c0 00000000  ....ј%Y.....А%Y.....
0x00592094  00000000 00000000 00000000 00000000 00000000  ....................
0x005920A8  00000000 00000000 00000000 00000000 00000000  ....................
0x005920BC  00000000 00000000 00000000 00000000 00000000  ....................
0x005920D0  00000000 00000000 00000000 00000000 00000000  ....................
0x005920E4  00000000 00000000 00000000 00000000 00000000  ....................
0x005920F8  00000000 00000000 00000000 00000000 00000000  ....................
0x0059210C  00000000 00000000 00000000 00000000 00000000  ....................
0x00592120  00000000 00000000 00000000 00000000 00000000  ....................
0x00592134  00000000 00000000 00000000 00000000 00000000  ....................
0x00592148  00000000 00000000 00000000 00000000 00000000  ....................
0x0059215C  00000000 00000000 00000000 00000000 00000000  ....................
0x00592170  00000000 00000000 00000000 00000000 00000000  ....................
0x00592184  00000000 00000000 00000000 00000000 00000000  ....................
0x00592198  00000000 00000000 00000000 00000000 00000000  ....................
0x005921AC  00000000 00000000 00000000 00000000 00000000  ....................
0x005921C0  00000000 00000000 00000000 00000000 00000000  ....................
0x005921D4  00000000 00000000 00000000 00000000 00000000  ....................
0x005921E8  00000000 00000000 00000000 00000000 00000000  ....................
0x005921FC  00000000 00000000 00000000 00000000 00000000  ....................
0x00592210  00000000 00000000 00000000 00000000 00000000  ....................
0x00592224  00000000 00000000 00000000 00000000 00000000  ....................
0x00592238  00000000 00000000 00000000 00000000 00000000  ....................
0x0059224C  00000000 00000000 00000000 00000000 00000000  ....................
0x00592260  00000000 00000000 00000000 00000000 00000000  ....................
0x00592274  00000000 00000000 00000000 00000000 00000000  ....................
0x00592288  00000000 00000000 00000000 00000000 000018e8  ................и...
0x0059229C  00000000 00000000 00000000 003a0043 0076005c  ............C.:.\.v.
0x005922B0  00310073 00700032 006f0072 0065006a 00740063  s.1.2.p.r.o.j.e.c.t.
0x005922C4  005c0073 00650052 006c0070 00630061 00410065  s.\.R.e.p.l.a.c.e.A.
0x005922D8  00490050 0054005c 00730065 004c0074 00730069  P.I.\.T.e.s.t.L.i.s.
0x005922EC  00450074 0074006e 00790072 00500041 005c0049  t.E.n.t.r.y.A.P.I.\.
0x00592300  00000000 00000000 00000000 00000000 00000000  ....................
0x00592314  00000000 00000000 00000000 00000000 00000000  ....................
0x00592328  00000000 00000000 00000000 00000000 00000000  ....................
0x0059233C  00000000 00000000 00000000 00000000 00000000  ....................
0x00592350  00000000 00000000 00000000 00000000 00000000  ....................
0x00592364  00000000 00000000 00000000 00000000 00000000  ....................
0x00592378  00000000 00000000 00000000 00000000 00000000  ....................
0x0059238C  00000000 00000000 00000000 00000000 00000000  ....................
0x005923A0  00000000 00000000 00000000 00000000 00000000  ....................
0x005923B4  00000000 00000000 00000000 00000000 00000000  ....................
0x005923C8  00000000 00000000 00000000 00000000 00000000  ....................
0x005923DC  00000000 00000000 00000000 00000000 00000000  ....................
0x005923F0  00000000 00000000 00000000 00000000 00000000  ....................
0x00592404  00000000 00000000 00000000 00000000 00000000  ....................
0x00592418  00000000 00000000 00000000 00000000 00000000  ....................
0x0059242C  00000000 00000000 00000000 00000000 00000000  ....................
0x00592440  00000000 00000000 00000000 00000000 00000000  ....................
0x00592454  00000000 00000000 00000000 00000000 00000000  ....................
0x00592468  00000000 00000000 00000000 00000000 00000000  ....................
0x0059247C  00000000 00000000 00000000 00000000 00000000  ....................
0x00592490  00000000 00000000 00000000 00000000 00000000  ....................
0x005924A4  00000000 00000000 00000000 003f005c 005c003f  ............\.?.?.\.
0x005924B8  003a0043 0076005c 00310073 00700032 006f0072  C.:.\.v.s.1.2.p.r.o.
0x005924CC  0065006a 00740063 005c0073 00650052 006c0070  j.e.c.t.s.\.R.e.p.l.
0x005924E0  00630061 00410065 00490050 0054005c 00730065  a.c.e.A.P.I.\.T.e.s.
0x005924F4  004c0074 00730069 00450074 0074006e 00790072  t.L.i.s.t.E.n.t.r.y.
0x00592508  00500041 005c0049 004e0044 00510053 00650075  A.P.I.\.D.N.S.Q.u.e.
0x0059251C  00790072 00650054 00740073 0065002e 00650078  r.y.T.e.s.t...e.x.e.
0x00592530  baad0000 003f005c 005c003f 003a0043 0076005c  ...є\.?.?.\.C.:.\.v.
0x00592544  00310073 00700032 006f0072 0065006a 00740063  s.1.2.p.r.o.j.e.c.t.
0x00592558  005c0073 00650052 006c0070 00630061 00410065  s.\.R.e.p.l.a.c.e.A.
0x0059256C  00490050 0054005c 00730065 004c0074 00730069  P.I.\.T.e.s.t.L.i.s.
0x00592580  00450074 0074006e 00790072 00500041 005c0049  t.E.n.t.r.y.A.P.I.\.
0x00592594  004e0044 00510053 00650075 00790072 00650054  D.N.S.Q.u.e.r.y.T.e.
0x005925A8  00740073 0065002e 00650078 baad0000 baad0000  s.t...e.x.e....є...є
0x005925BC  baad0000 baad0000
typedef struct __RTL_USER_PROCESS_PARAMETERS_
{
    ULONG AllocationSize;               // 0000          
    ULONG ActualSize;                   // 0004          
    ULONG Flags; // PPFLAG_xxx          // 0008            
    ULONG dwDebug;                      // 000C          
    PVOID Reserved2[2];                 // 0010
    HANDLE InputHandle;                 // 0018          
    HANDLE OutputHandle;                // 001C          
    HANDLE ErrorHandle;                 // 0020
    UNICODE_STRING CurrentDirectory;    // 0024  
    HANDLE CurrentDir;                  // 002C <== edx + 2Ch
    UNICODE_STRING SearchPaths;         // 0030 
    UNICODE_STRING ImagePathName;
    UNICODE_STRING CommandLine;
    PVOID EnvironmentBlock;               
    ULONG dwX;                            
    ULONG dwY;                            
    ULONG dwXSize;                        
    ULONG dwYSize;                        
    ULONG dwXCountChars;                  
    ULONG dwYCountChars;                  
    ULONG dwFillAttribute;                
    ULONG dwFlags;                        
    ULONG dwShowWindow;                   
    //ULONG Reserved3;
    UNICODE_STRING usConsoleTitle;        
    UNICODE_STRING usDesktop;             
    UNICODE_STRING usReserved;            
    UNICODE_STRING usReserved2;           
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
- ===========================================================================================================
7758C73B 8B D0                mov         edx,eax                   ; IN PRTL_USER_PROCESS_PARAMETERS ProcessParameters = 00592008
7758C73D 85 D2                test        edx,edx  
7758C73F 74 4F                je          _RtlCreateUserProcess@40+6Eh (7758C790h)  
7758C741 33 C0                xor         eax,eax  
7758C743 38 45 20             cmp         byte ptr [ebp+20h],al                    ; IN BOOLEAN InheritHandles = FALSE
7758C746 75 05                jne         _RtlCreateUserProcess@40+2Bh (7758C74Dh)  
7758C748 89 42 2C             mov         dword ptr [edx+2Ch],eax                  ; pp.CurrentDir := NULL
7758C74B EB 03                jmp         _RtlCreateUserProcess@40+2Eh (7758C750h) ------>+ 
...                                                                                       v
7758C750 F7 42 08 00 00 04 00 test        dword ptr [edx+8],40000h       <----------------+ ; pp.Flags = 00000001 (PPFLAG_NORMALIZED)
7758C757 74 05                je          _RtlCreateUserProcess@40+3Ch (7758C75Eh) ------>+ 
7758C759 0D 80 00 00 00       or          eax,80h                                         v
7758C75E F7 42 08 00 00 40 00 test        dword ptr [edx+8], 400000h     <----------------+
7758C765 74 03                je          _RtlCreateUserProcess@40+48h (7758C76Ah) ------>+ 
7758C767 83 C8 40             or          eax,40h                                         v
7758C76A FF 75 2C             push        dword ptr [ebp+2Ch]            <----------------+ ; OUT PRTL_PROCESS_INFORMATION ProcessInfo = 003df06c
7758C76D 8B 4D 08             mov         ecx,dword ptr [ebp+8]     ; IN PUNICODE_STRING FileName = 003DEEF0
7758C770 FF 75 28             push        dword ptr [ebp+28h]       ; IN HANDLE ExceptionPort OPTIONAL = NULL
7758C773 FF 75 24             push        dword ptr [ebp+24h]       ; IN HANDLE DebugPort OPTIONAL = NULL
7758C776 6A 01                push        1                         ; DWORD dwParam06 = 1
7758C778 50                   push        eax                       ; DWORD dwProcessFlg05 = 0
7758C779 8B 45 0C             mov         eax,dword ptr [ebp+0Ch]   ; IN ULONG FileObjectAttributes = OBJ_CASE_INSENSITIVE
7758C77C C1 E8 10             shr         eax,10h  
7758C77F 50                   push        eax                       ; WORD wFileAttribHigh = 0
7758C780 FF 75 1C             push        dword ptr [ebp+1Ch]       ; IN HANDLE ParentProcess OPTIONAL = FFFFFFFF
7758C783 FF 75 18             push        dword ptr [ebp+18h]       ; IN PVOID ThreadSecurityDescriptor OPTIONAL = NULL
7758C786 FF 75 14             push        dword ptr [ebp+14h]       ; IN PVOID ProcessSecurityDescriptor OPTIONAL = NULL
- ===========================================================================================================
- ===========================================================================================================
7758C789 E8 D0 01 00 00       call        _RtlpCreateUserProcess@44 (7758C95Eh)  
-- ------------------------------------------------------------------------------------------------
_RtlpCreateUserProcess@44:
7758C95E 8B FF                mov         edi,edi  
7758C960 55                   push        ebp  
7758C961 8B EC                mov         ebp,esp  
7758C963 83 E4 F8             and         esp,0FFFFFFF8h  
7758C966 81 EC 24 01 00 00    sub         esp,124h  
7758C96C A1 40 F2 5C 77       mov         eax,dword ptr [___security_cookie (775CF240h)]  
7758C971 33 C4                xor         eax,esp  
7758C973 89 84 24 20 01 00 00 mov         dword ptr [esp+120h],eax  
7758C97A 8B 45 28             mov         eax,dword ptr [ebp+28h]   ; OUT PRTL_PROCESS_INFORMATION ProcessInfo = 003DF06C
7758C97D 53                   push        ebx                       ; esp := esp - 4
7758C97E 56                   push        esi                       ; esp := esp - 4 (-8h)
7758C97F 8B 75 08             mov         esi,dword ptr [ebp+8]     ; IN PVOID ProcessSecurityDescriptor OPTIONAL = NULL
7758C982 8B D9                mov         ebx,ecx                   ; IN PUNICODE_STRING FileName = 003DEF88
7758C984 57                   push        edi                       ; esp := esp - 4 (-0Ch)
7758C985 8B 7D 0C             mov         edi,dword ptr [ebp+0Ch]   ; IN PVOID ThreadSecurityDescriptor OPTIONAL = NULL
7758C988 6A 44                push        44h                       ; esp := esp - 4 (-10h)
7758C98A 6A 00                push        0                         ; esp := esp - 4 (-14h)
7758C98C 50                   push        eax                       ; OUT PRTL_PROCESS_INFORMATION ProcessInfo = 003DF06C
                                                                    ; esp := esp - 4 (-18h)
7758C98D 89 54 24 20          mov         dword ptr [esp+20h],edx   ; PRTL_USER_PROCESS_PARAMETERS ProcessParameters08 := 00592008
7758C991 89 44 24 18          mov         dword ptr [esp+18h],eax   ; PRTL_PROCESS_INFORMATION ProcessInfo00 = 003DF06C
7758C995 E8 26 E2 F6 FF       call        _memset (774FABC0h)  
7758C99A 8B 44 24 18          mov         eax,dword ptr [esp+18h]   ; PRTL_PROCESS_INFORMATION ProcessInfo00 = 003DF06C
- ===========================================================================================================
typedef struct __RTL_PROCESS_INFORMATION_
{
	ULONG Size;                                 // 0000
	//
	// PROCESS_INFORMATION
	//
	HANDLE ProcessHandle;                       // 0004
	HANDLE ThreadHandle;                        // 0008
	CLIENT_ID ClientId;                         // 000C
	//
	SECTION_IMAGE_INFORMATION SectionImageInfo; //
} RTL_PROCESS_INFORMATION, *PRTL_PROCESS_INFORMATION;
- ===========================================================================================================
7758C99E 33 D2                xor         edx,edx  
7758C9A0 6A 18                push        18h  
7758C9A2 59                   pop         ecx  
7758C9A3 6A 48                push        48h                       ; esp := esp - 4 (-1Ch)
7758C9A5 C7 00 44 00 00 00    mov         dword ptr [eax],44h       ; ProcessInfo00->Size := 44h
7758C9AB B8 00 02 00 00       mov         eax,200h  
7758C9B0 89 74 24 50          mov         dword ptr [esp+50h],esi   ; PVOID ProcessSecurityDescriptor34 OPTIONAL = NULL
7758C9B4 5E                   pop         esi                       ; esp := esp + 4 (-18h)
7758C9B5 89 7C 24 34          mov         dword ptr [esp+34h],edi   ; PVOID ThreadSecurityDescriptor1C OPTIONAL = NULL
7758C9B9 33 FF                xor         edi,edi  
7758C9BB 56                   push        esi                       ; esi = 48h
                                                                    ; esp := esp - 4 (-1Ch)
7758C9BC 89 44 24 4C          mov         dword ptr [esp+4Ch],eax   ; DWORD dwValue30 := 200h
7758C9C0 89 44 24 34          mov         dword ptr [esp+34h],eax   ; DWORD dwValue18 := 200h
7758C9C4 8D 44 24 58          lea         eax,[esp+58h]             ; &stStruct3C = 003DEDD0
7758C9C8 57                   push        edi                       ; esp := esp - 4 (-20h)
7758C9C9 50                   push        eax                       ; esp := esp - 4 (-24h)
7758C9CA 89 4C 24 48          mov         dword ptr [esp+48h],ecx   ; DWORD dwValue24 := 18h
7758C9CE 89 54 24 4C          mov         dword ptr [esp+4Ch],edx   ; DWORD dwValue28 := 0
7758C9D2 89 54 24 50          mov         dword ptr [esp+50h],edx   ; DWORD dwValue2C := 0
7758C9D6 89 54 24 5C          mov         dword ptr [esp+5Ch],edx   ; DWORD dwValue38 := 0
7758C9DA 89 4C 24 30          mov         dword ptr [esp+30h],ecx   ; DWORD dwValue0C := 18h
7758C9DE 89 54 24 34          mov         dword ptr [esp+34h],edx   ; DWORD dwValue10 := 0
7758C9E2 89 54 24 38          mov         dword ptr [esp+38h],edx   ; DWORD dwValue14 := 0
7758C9E6 89 7C 24 44          mov         dword ptr [esp+44h],edi   ; DWORD dwValue20 := 0
7758C9EA E8 D1 E1 F6 FF       call        _memset (774FABC0h)  
7758C9EF 80 4C 24 68 04       or          byte ptr [esp+68h],4      ; BYTE stStruct3C.bValue08 := 4
7758C9F4 83 C4 18             add         esp,18h                   ; esp := esp + 18 (-0C)
7758C9F7 89 74 24 48          mov         dword ptr [esp+48h],esi   ; DWORD stStruct3C.dw00 := 48h
7758C9FB 8B 74 24 0C          mov         esi,dword ptr [esp+0Ch]   ; esi := ProcessInfo00 = 00592008
7758C9FF C7 84 24 94 00 00 00 03 00 01 00 mov dword ptr [esp+94h],10003h ; DWORD dwValue88 := 10003h
7758CA0A 89 BC 24 A0 00 00 00 mov         dword ptr [esp+0A0h],edi  ; DWORD dwValue94 := 0
7758CA11 C7 84 24 A4 00 00 00 06 00 00 00 mov         dword ptr [esp+0A4h],6   ; DWORD dwValue98 := 6
7758CA1C C7 84 24 A8 00 00 00 30 00 00 00 mov         dword ptr [esp+0A8h],30h ; DWORD dwValue9C := 30h 
7758CA27 8D 46 0C             lea         eax,[esi+0Ch]             ; eax := &ProcessInfo00->ClientId = 003DF078
7758CA2A 89 84 24 9C 00 00 00 mov         dword ptr [esp+9Ch],eax   ; CLIENT_ID* pClientId90 := 003DF078
7758CA31 8D 46 14             lea         eax,[esi+14h]             ; eax := &ProcessInfo00->SectionImageInfo = 003DF080
7758CA34 89 BC 24 B0 00 00 00 mov         dword ptr [esp+0B0h],edi  ; DWORD dwValueA4 := 0
7758CA3B 89 84 24 AC 00 00 00 mov         dword ptr [esp+0ACh],eax  ; PSECTION_IMAGE_INFORMATION pSectionImageInfo := 003DF080
7758CA42 6A 08                push        8  
7758CA44 5A                   pop         edx  
7758CA45 89 94 24 98 00 00 00 mov         dword ptr [esp+98h],edx   ; DWORD dwValue8C := 8
7758CA4C 6A 02                push        2  
7758CA4E 59                   pop         ecx                       ; ecx := 2
7758CA4F 6A 04                push        4                         ; esp := esp - 4 (-10h)
7758CA51 85 DB                test        ebx,ebx                   ; ebx = 003DEF88 = IN PUNICODE_STRING FileName
7758CA53 74 5C                je          _RtlpCreateUserProcess@44+153h (7758CAB1h)  
7758CA55 0F B7 03             movzx       eax,word ptr [ebx]        ; eax := FileName->Length = 80h
7758CA58 89 84 24 BC 00 00 00 mov         dword ptr [esp+0BCh],eax  ; DWORD dwFileNameLengthCC := 80h
7758CA5F 8B 43 04             mov         eax,dword ptr [ebx+4]     ; eax := FileName->Buffer := 0058E9E0 = L"\??\C:\vs12projects\ReplaceAPI\TestListEntryAPI\DNSQueryTest.exe"
7758CA62 89 84 24 C0 00 00 00 mov         dword ptr [esp+0C0h],eax  ; PWSTR pwsFileNameB0 := 0058E9E0
7758CA69 8B 44 24 10          mov         eax,dword ptr [esp+10h]   ; eax := ProcessInfo00 = 003DF06C
7758CA6D 83 E0 E2             and         eax,0FFFFFFE2h            ; eax := 003DF060
7758CA70 C7 84 24 B8 00 00 00 05 00 02 00 mov dword ptr [esp+0B8h],20005h ; DWORD dwValueA8 := 20005h
7758CA7B 0B C1                or          eax,ecx                   ; eax := 003DF062
7758CA7D 89 BC 24 C4 00 00 00 mov         dword ptr [esp+0C4h],edi  ; DWORD dwValueB4 := 0
7758CA84 89 44 24 10          mov         dword ptr [esp+10h],eax   ; DWORD dwValue00 := 003DF062
7758CA88 8D 44 24 10          lea         eax,[esp+10h]             ; eax := &dwValue00 = 003DED94
7758CA8C 5B                   pop         ebx                       ; ebx := 4
                                                                    ; esp := esp + 4 (-0Ch)
7758CA8D C7 84 24 C4 00 00 00 0A 00 02 00 mov dword ptr [esp+0C4h],2000Ah ; DWORD dwValueB8 := 2000Ah
7758CA98 8B CB                mov         ecx,ebx                   ; ecx := 4
7758CA9A 89 94 24 C8 00 00 00 mov         dword ptr [esp+0C8h],edx  ; DWORD dwValueBC := 0
7758CAA1 89 BC 24 D0 00 00 00 mov         dword ptr [esp+0D0h],edi  ; DWORD dwValueC4 := 0
7758CAA8 89 84 24 CC 00 00 00 mov         dword ptr [esp+0CCh],eax  ; DWORD dwValueC0 := &dwValue00 = 003DED94
7758CAAF EB 01                jmp         _RtlpCreateUserProcess@44+154h (7758CAB2h)  
7758CAB1 5B                   pop         ebx  
7758CAB2 8B 55 10             mov         edx,dword ptr [ebp+10h]   ; edx := ; IN HANDLE ParentProcess OPTIONAL = FFFFFFFF
7758CAB5 85 D2                test        edx,edx  
7758CAB7 74 26                je          _RtlpCreateUserProcess@44+181h (7758CADFh)  
7758CAB9 8B C1                mov         eax,ecx                   ; eax := 4
7758CABB C1 E0 04             shl         eax,4                     ; eax := 40h
7758CABE 41                   inc         ecx                       ; ecx := 5
7758CABF C7 84 04 94 00 00 00 00 00 06 00 mov dword ptr [esp+eax+94h],60000h ; aStructArray88[4].dw00 := 60000h
7758CACA 89 9C 04 98 00 00 00 mov         dword ptr [esp+eax+98h],ebx        ; aStructArray88[4].dw04 := 4
7758CAD1 89 BC 04 A0 00 00 00 mov         dword ptr [esp+eax+0A0h],edi       ; aStructArray88[4].dw0C := 0
7758CAD8 89 94 04 9C 00 00 00 mov         dword ptr [esp+eax+9Ch],edx        ; aStructArray88[4].hParentProcess08 := FFFFFFFF
7758CADF 8B 55 20             mov         edx,dword ptr [ebp+20h]            ; edx := IN HANDLE DebugPort OPTIONAL = NULL
7758CAE2 85 D2                test        edx,edx  
7758CAE4 74 26                je          _RtlpCreateUserProcess@44+1AEh (7758CB0Ch)  
7758CAE6 8B C1                mov         eax,ecx  
7758CAE8 C1 E0 04             shl         eax,4  
7758CAEB 41                   inc         ecx  
7758CAEC C7 84 04 94 00 00 00 01 00 06 00 mov         dword ptr [esp+eax+94h],60001h  
7758CAF7 89 9C 04 98 00 00 00 mov         dword ptr [esp+eax+98h],ebx  
7758CAFE 89 BC 04 A0 00 00 00 mov         dword ptr [esp+eax+0A0h],edi  
7758CB05 89 94 04 9C 00 00 00 mov         dword ptr [esp+eax+9Ch],edx  
7758CB0C 8B 55 24             mov         edx,dword ptr [ebp+24h]            ; edx := IN HANDLE ExceptionPort OPTIONAL = NULL
7758CB0F 85 D2                test        edx,edx  
7758CB11 74 26                je          _RtlpCreateUserProcess@44+1DBh (7758CB39h)  
7758CB13 8B C1                mov         eax,ecx  
7758CB15 C1 E0 04             shl         eax,4  
7758CB18 41                   inc         ecx  
7758CB19 C7 84 04 94 00 00 00 02 00 06 00 mov         dword ptr [esp+eax+94h],60002h  
7758CB24 89 9C 04 98 00 00 00 mov         dword ptr [esp+eax+98h],ebx  
7758CB2B 89 BC 04 A0 00 00 00 mov         dword ptr [esp+eax+0A0h],edi  
7758CB32 89 94 04 9C 00 00 00 mov         dword ptr [esp+eax+9Ch],edx  
7758CB39 66 8B 45 14          mov         ax,word ptr [ebp+14h]              ; ax := WORD wFileAttribHigh = 0
7758CB3D 66 85 C0             test        ax,ax  
7758CB40 74 3D                je          _RtlpCreateUserProcess@44+221h (7758CB7Fh)  
7758CB42 BA FF FF 00 00       mov         edx,0FFFFh  
7758CB47 66 03 C2             add         ax,dx  
7758CB4A 8D 55 14             lea         edx,[ebp+14h]  
7758CB4D 66 89 45 14          mov         word ptr [ebp+14h],ax  
7758CB51 8B C1                mov         eax,ecx  
7758CB53 03 C0                add         eax,eax  
7758CB55 41                   inc         ecx  
7758CB56 89 94 C4 9C 00 00 00 mov         dword ptr [esp+eax*8+9Ch],edx  
7758CB5D 8B 55 18             mov         edx,dword ptr [ebp+18h]  
7758CB60 C7 84 C4 94 00 00 00 0D 00 02 00 mov         dword ptr [esp+eax*8+94h],2000Dh  
7758CB6B C7 84 C4 98 00 00 00 02 00 00 00 mov         dword ptr [esp+eax*8+98h],2  
7758CB76 89 BC C4 A0 00 00 00 mov         dword ptr [esp+eax*8+0A0h],edi  
7758CB7D EB 09                jmp         _RtlpCreateUserProcess@44+22Ah (7758CB88h)  
7758CB7F 8B 55 18             mov         edx,dword ptr [ebp+18h]            ; edx := DWORD dwProcessFlg05 = 0
7758CB82 81 CA 00 01 00 00    or          edx,100h                           ; edx := 100h
7758CB88 F6 C2 40             test        dl,40h  
7758CB8B 74 2D                je          _RtlpCreateUserProcess@44+25Ch (7758CBBAh)  
7758CB8D 8B C1                mov         eax,ecx  
7758CB8F 03 C0                add         eax,eax  
7758CB91 41                   inc         ecx  
7758CB92 C7 84 C4 94 00 00 00 11 00 06 00 mov         dword ptr [esp+eax*8+94h],60011h  
7758CB9D C7 84 C4 98 00 00 00 01 00 00 00 mov         dword ptr [esp+eax*8+98h],1  
7758CBA8 89 BC C4 A0 00 00 00 mov         dword ptr [esp+eax*8+0A0h],edi  
7758CBAF C7 84 C4 9C 00 00 00 61 00 00 00 mov         dword ptr [esp+eax*8+9Ch],61h  
7758CBBA 8D 84 24 90 00 00 00 lea         eax,[esp+90h]                      ; eax := &dwValue84 = 003DEE18
7758CBC1 C1 E1 04             shl         ecx,4                              ; ecx := 50h
7758CBC4 50                   push        eax                                ; esp := esp - 4 (-10h)
7758CBC5 8D 44 24 4C          lea         eax,[esp+4Ch]                      ; eax := &stStruct3C = 003DEDD0
7758CBC9 03 CB                add         ecx,ebx                            ; ecx := 54h
7758CBCB 50                   push        eax                                ; esp := esp - 4 (-14h)
7758CBCC FF 74 24 1C          push        dword ptr [esp+1Ch]                ; PRTL_USER_PROCESS_PARAMETERS ProcessParameters08 = 00592008
                                                                             ; esp := esp - 4 (-18h)
7758CBD0 8D 44 24 24          lea         eax,[esp+24h]                      ; eax := &dwValue0C = 003DEDA0 (18h)
7758CBD4 89 8C 24 9C 00 00 00 mov         dword ptr [esp+9Ch],ecx            ; DWORD dwValue84 := 54h
7758CBDB FF 75 1C             push        dword ptr [ebp+1Ch]                ; DWORD dwParam06 = 1
                                                                             ; esp := esp - 4 (-18h)
7758CBDE 52                   push        edx                                ; edx = 100h
                                                                             ; esp := esp - 4 (-1Ch)
7758CBDF 50                   push        eax                                ; eax = &dwValue0C = 003DEDA0 (18h)
                                                                             ; esp := esp - 4 (-20h)
7758CBE0 8D 44 24 48          lea         eax,[esp+48h]                      ; eax := &dwValue28 = 003DEDB8 (0)
7758CBE4 50                   push        eax                                ; esp := esp - 4 (-24h)
7758CBE5 B8 00 00 00 02       mov         eax,2000000h  
7758CBEA 50                   push        eax                                ; esp := esp - 4 (-28h)
7758CBEB 50                   push        eax                                ; esp := esp - 4 (-2Ch)
7758CBEC 8D 46 08             lea         eax,[esi+8]                        ; eax := &ProcessInfo00->ThreadHandle = 003DF074
7758CBEF 50                   push        eax                                ; esp := esp - 4 (-30h)
7758CBF0 8D 46 04             lea         eax,[esi+4]                        ; eax := &ProcessInfo00->ProcessHandle = 003DF070
7758CBF3 50                   push        eax                                ; esp := esp - 4 (-34h)
- ===========================================================================================================
NTSTATUS
NTAPI
NtCreateUserProcess (
    PHANDLE hProcess,
    PHANDLE hThread,
    DWORD dwArg3,
    DWORD dwArg4, 
    POBJECT_ATTRIBUTES lpProcObjAttr,
    POBJECT_ATTRIBUTES lpThreadObjAttr,
    DWORD dwCreateProcessFlags,
    DWORD dwArg8, 
    PRTL_USER_PROCESS_PARAMETERS lpProcessParameters,
    PVOID lpArg10,
    PPROC_THREAD_NATIVE_ATTRIBUTE_LIST lpAttributeList
    ); 
- ===========================================================================================================
7758CBF4 E8 B7 0C F8 FF       call        _NtCreateUserProcess@44 (7750D8B0h)  
-- ------------------------------------------------------------------------------------------------
_NtCreateUserProcess@44:
7750D8B0 B8 B7 00 00 00       mov         eax,0B7h  
7750D8B5 64 FF 15 C0 00 00 00 call        dword ptr fs:[0C0h]  
7750D8BC C2 2C 00             ret         2Ch  
-- ------------------------------------------------------------------------------------------------
7758CBF9 8B 8C 24 2C 01 00 00 mov         ecx,dword ptr [esp+12Ch]  
7758CC00 5F                   pop         edi  
7758CC01 5E                   pop         esi  
7758CC02 5B                   pop         ebx  
7758CC03 33 CC                xor         ecx,esp  
7758CC05 E8 D6 5E F8 FF       call        @__security_check_cookie@4 (77512AE0h)  
7758CC0A 8B E5                mov         esp,ebp  
7758CC0C 5D                   pop         ebp  
7758CC0D C2 24 00             ret         24h  
-- ------------------------------------------------------------------------------------------------
7758C78E EB 05                jmp         _RtlCreateUserProcess@40+73h (7758C795h) -->+
7758C790 B8 0D 00 00 C0       mov         eax,0C000000Dh                              v
7758C795 5D                   pop         ebp                   <---------------------+
7758C796 C2 28 00             ret         28h  
-- ------------------------------------------------------------------------------------------------

-- ------------------------------------------------------------------------------------------------
_CreateProcessWStub@40:
76C4D01A 8B FF                mov         edi,edi  
76C4D01C 55                   push        ebp  
76C4D01D 8B EC                mov         ebp,esp  
76C4D01F 5D                   pop         ebp  
76C4D020 FF 25 44 08 CB 76    jmp         dword ptr [__imp__CreateProcessW@40 (76CB0844h)]  
...
_CreateProcessW@40:
770FD44F 8B FF                mov         edi,edi  
770FD451 55                   push        ebp  
770FD452 8B EC                mov         ebp,esp  
770FD454 6A 00                push        0  
770FD456 FF 75 2C             push        dword ptr [ebp+2Ch]  
770FD459 FF 75 28             push        dword ptr [ebp+28h]  
770FD45C FF 75 24             push        dword ptr [ebp+24h]  
770FD45F FF 75 20             push        dword ptr [ebp+20h]  
770FD462 FF 75 1C             push        dword ptr [ebp+1Ch]  
770FD465 FF 75 18             push        dword ptr [ebp+18h]  
770FD468 FF 75 14             push        dword ptr [ebp+14h]  
770FD46B FF 75 10             push        dword ptr [ebp+10h]  
770FD46E FF 75 0C             push        dword ptr [ebp+0Ch]  
770FD471 FF 75 08             push        dword ptr [ebp+8]  
770FD474 6A 00                push        0  
770FD476 E8 09 00 00 00       call        _CreateProcessInternalW@48 (770FD484h)  
-- ------------------------------------------------------------------------------------------------
_CreateProcessInternalW@48:
770FD484 68 74 05 00 00       push        574h  
770FD489 68 D8 D6 0F 77       push        770FD6D8h  
770FD48E E8 CE 53 FD FF       call        __SEH_prolog4_GS (770D2861h)  
770FD493 8B 45 08             mov         eax,dword ptr [ebp+8]  
770FD496 89 85 94 FD FF FF    mov         dword ptr [ebp-26Ch],eax  
770FD49C 8B 4D 0C             mov         ecx,dword ptr [ebp+0Ch]  
770FD49F 89 8D B0 FD FF FF    mov         dword ptr [ebp-250h],ecx  
770FD4A5 8B 55 10             mov         edx,dword ptr [ebp+10h]  
770FD4A8 89 95 98 FD FF FF    mov         dword ptr [ebp-268h],edx  
770FD4AE 8B 45 14             mov         eax,dword ptr [ebp+14h]  
770FD4B1 89 85 F0 FC FF FF    mov         dword ptr [ebp-310h],eax  
770FD4B7 8B 45 18             mov         eax,dword ptr [ebp+18h]  
770FD4BA 89 85 48 FC FF FF    mov         dword ptr [ebp-3B8h],eax  
770FD4C0 8B 45 20             mov         eax,dword ptr [ebp+20h]  
770FD4C3 89 85 B8 FD FF FF    mov         dword ptr [ebp-248h],eax  
770FD4C9 8B 45 24             mov         eax,dword ptr [ebp+24h]  
770FD4CC 89 85 90 FD FF FF    mov         dword ptr [ebp-270h],eax  
770FD4D2 8B 45 28             mov         eax,dword ptr [ebp+28h]  
770FD4D5 89 85 84 FD FF FF    mov         dword ptr [ebp-27Ch],eax  
770FD4DB 8B 45 2C             mov         eax,dword ptr [ebp+2Ch]  
770FD4DE 89 85 58 FC FF FF    mov         dword ptr [ebp-3A8h],eax  
770FD4E4 8B 7D 30             mov         edi,dword ptr [ebp+30h]  
770FD4E7 89 BD CC FC FF FF    mov         dword ptr [ebp-334h],edi  
770FD4ED 33 DB                xor         ebx,ebx  
770FD4EF 89 9D C8 FD FF FF    mov         dword ptr [ebp-238h],ebx  
770FD4F5 89 9D 70 FD FF FF    mov         dword ptr [ebp-290h],ebx  
770FD4FB 89 9D 24 FD FF FF    mov         dword ptr [ebp-2DCh],ebx  
770FD501 89 9D 08 FD FF FF    mov         dword ptr [ebp-2F8h],ebx  
770FD507 89 9D 6C FD FF FF    mov         dword ptr [ebp-294h],ebx  
770FD50D 89 9D 64 FD FF FF    mov         dword ptr [ebp-29Ch],ebx  
770FD513 89 9D F4 FC FF FF    mov         dword ptr [ebp-30Ch],ebx  
770FD519 89 9D E4 FC FF FF    mov         dword ptr [ebp-31Ch],ebx  
770FD51F 89 9D 48 FD FF FF    mov         dword ptr [ebp-2B8h],ebx  
770FD525 33 F6                xor         esi,esi  
770FD527 66 89 B5 58 FD FF FF mov         word ptr [ebp-2A8h],si  
770FD52E 89 9D 5A FD FF FF    mov         dword ptr [ebp-2A6h],ebx  
770FD534 66 89 9D 5E FD FF FF mov         word ptr [ebp-2A2h],bx  
770FD53B 89 9D 8C FC FF FF    mov         dword ptr [ebp-374h],ebx  
770FD541 85 C9                test        ecx,ecx  
770FD543 0F 84 3E BE 00 00    je          _CreateProcessInternalW@48+0C1h (77109387h)  
770FD549 85 FF                test        edi,edi  
770FD54B 0F 84 5A F8 FF FF    je          770FCDAB  
770FD551 85 C0                test        eax,eax  
770FD553 0F 84 52 F8 FF FF    je          770FCDAB  
770FD559 89 9D 68 FD FF FF    mov         dword ptr [ebp-298h],ebx  
770FD55F 89 9D 88 FD FF FF    mov         dword ptr [ebp-278h],ebx  
770FD565 89 9D 18 FD FF FF    mov         dword ptr [ebp-2E8h],ebx  
770FD56B 89 9D BC FD FF FF    mov         dword ptr [ebp-244h],ebx  
770FD571 89 9D 74 FD FF FF    mov         dword ptr [ebp-28Ch],ebx  
770FD577 89 9D A8 FC FF FF    mov         dword ptr [ebp-358h],ebx  
770FD57D 89 9D 44 FD FF FF    mov         dword ptr [ebp-2BCh],ebx  
770FD583 89 9D 2C FD FF FF    mov         dword ptr [ebp-2D4h],ebx  
770FD589 89 9D 9C FC FF FF    mov         dword ptr [ebp-364h],ebx  
770FD58F 89 9D C8 FC FF FF    mov         dword ptr [ebp-338h],ebx  
770FD595 89 9D 34 FD FF FF    mov         dword ptr [ebp-2CCh],ebx  
770FD59B 89 9D DC FB FF FF    mov         dword ptr [ebp-424h],ebx  
770FD5A1 89 9D 10 FD FF FF    mov         dword ptr [ebp-2F0h],ebx  
770FD5A7 89 9D 74 FC FF FF    mov         dword ptr [ebp-38Ch],ebx  
770FD5AD 88 9D 9E FD FF FF    mov         byte ptr [ebp-262h],bl  
770FD5B3 88 9D 9D FD FF FF    mov         byte ptr [ebp-263h],bl  
770FD5B9 88 9D B7 FD FF FF    mov         byte ptr [ebp-249h],bl  
770FD5BF 88 9D 9F FD FF FF    mov         byte ptr [ebp-261h],bl  
770FD5C5 89 9D 04 FD FF FF    mov         dword ptr [ebp-2FCh],ebx  
770FD5CB 89 9D 30 FD FF FF    mov         dword ptr [ebp-2D0h],ebx  
770FD5D1 89 9D DC FC FF FF    mov         dword ptr [ebp-324h],ebx  
770FD5D7 89 9D B0 FC FF FF    mov         dword ptr [ebp-350h],ebx  
770FD5DD 89 9D EC FC FF FF    mov         dword ptr [ebp-314h],ebx  
770FD5E3 89 9D A4 FC FF FF    mov         dword ptr [ebp-35Ch],ebx  
770FD5E9 89 9D D0 FC FF FF    mov         dword ptr [ebp-330h],ebx  
770FD5EF 89 9D B8 FC FF FF    mov         dword ptr [ebp-348h],ebx  
770FD5F5 89 9D 20 FD FF FF    mov         dword ptr [ebp-2E0h],ebx  
770FD5FB 89 9D C0 FC FF FF    mov         dword ptr [ebp-340h],ebx  
770FD601 89 9D 90 FC FF FF    mov         dword ptr [ebp-370h],ebx  
770FD607 89 9D 94 FC FF FF    mov         dword ptr [ebp-36Ch],ebx  
770FD60D 89 9D E0 FC FF FF    mov         dword ptr [ebp-320h],ebx  
770FD613 89 9D 50 FC FF FF    mov         dword ptr [ebp-3B0h],ebx  
770FD619 89 9D 54 FC FF FF    mov         dword ptr [ebp-3ACh],ebx  
770FD61F 89 9D 3C FD FF FF    mov         dword ptr [ebp-2C4h],ebx  
770FD625 89 9D 0C FD FF FF    mov         dword ptr [ebp-2F4h],ebx  
770FD62B 89 9D E8 FC FF FF    mov         dword ptr [ebp-318h],ebx  
770FD631 89 9D 5C FC FF FF    mov         dword ptr [ebp-3A4h],ebx  
770FD637 89 9D 60 FC FF FF    mov         dword ptr [ebp-3A0h],ebx  
770FD63D 89 9D 4C FC FF FF    mov         dword ptr [ebp-3B4h],ebx  
770FD643 89 9D BC FB FF FF    mov         dword ptr [ebp-444h],ebx  
770FD649 89 9D C8 FB FF FF    mov         dword ptr [ebp-438h],ebx  
770FD64F 89 9D 64 FC FF FF    mov         dword ptr [ebp-39Ch],ebx  
770FD655 6A 40                push        40h  
770FD657 5E                   pop         esi  
770FD658 89 B5 A0 FD FF FF    mov         dword ptr [ebp-260h],esi  
770FD65E 56                   push        esi  
770FD65F 53                   push        ebx  
770FD660 8D 85 AC FA FF FF    lea         eax,[ebp-554h]  
770FD666 50                   push        eax  
770FD667 E8 1A FF FC FF       call        _memset (770CD586h)  
770FD66C 83 C4 0C             add         esp,0Ch  
770FD66F 64 A1 30 00 00 00    mov         eax,dword ptr fs:[00000030h]  
770FD675 89 85 00 FD FF FF    mov         dword ptr [ebp-300h],eax  
770FD67B 8B 40 18             mov         eax,dword ptr [eax+18h]  
770FD67E 89 85 CC FD FF FF    mov         dword ptr [ebp-234h],eax  
770FD684 89 85 A0 FC FF FF    mov         dword ptr [ebp-360h],eax  
770FD68A 33 C0                xor         eax,eax  
770FD68C 89 85 4C FD FF FF    mov         dword ptr [ebp-2B4h],eax  
770FD692 89 9D 50 FD FF FF    mov         dword ptr [ebp-2B0h],ebx  
770FD698 89 9D 7C FD FF FF    mov         dword ptr [ebp-284h],ebx  
770FD69E 89 9D 54 FD FF FF    mov         dword ptr [ebp-2ACh],ebx  
770FD6A4 89 9D 40 FD FF FF    mov         dword ptr [ebp-2C0h],ebx  
770FD6AA 89 9D A4 FD FF FF    mov         dword ptr [ebp-25Ch],ebx  
770FD6B0 88 9D 79 FD FF FF    mov         byte ptr [ebp-287h],bl  
770FD6B6 88 9D 83 FD FF FF    mov         byte ptr [ebp-27Dh],bl  
770FD6BC 8B 95 B8 FD FF FF    mov         edx,dword ptr [ebp-248h]  
770FD6C2 8B C2                mov         eax,edx  
770FD6C4 83 E0 18             and         eax,18h  
770FD6C7 3C 18                cmp         al,18h  
770FD6C9 0F 85 DF F5 FF FF    jne         _CreateProcessInternalW@48+25Eh (770FCCAEh)  
770FD6CF E9 C6 76 01 00       jmp         _CreateProcessInternalW@48+251h (77114D9Ah)  
...
770FCCAE B9 00 08 00 00       mov         ecx,800h  
770FCCB3 85 D1                test        ecx,edx  
770FCCB5 0F 84 9D 01 00 00    je          _CreateProcessInternalW@48+271h (770FCE58h)  
770FCCBB E9 E7 80 01 00       jmp         _CreateProcessInternalW@48+267h (77114DA7h)  
...
770FCE58 F7 C2 00 10 00 00    test        edx,1000h  
770FCE5E 75 11                jne         _CreateProcessInternalW@48+28Eh (770FCE71h)  
770FCE60 A1 98 D3 17 77       mov         eax,dword ptr [_BaseStaticServerData (7717D398h)]  
770FCE65 38 98 44 07 00 00    cmp         byte ptr [eax+744h],bl  
770FCE6B 0F 85 43 7F 01 00    jne         _CreateProcessInternalW@48+286h (77114DB4h)  
770FCE71 F6 C2 40             test        dl,40h  
770FCE74 0F 85 47 7F 01 00    jne         _CreateProcessInternalW@48+293h (77114DC1h)  
770FCE7A F7 C2 00 40 00 00    test        edx,4000h  
770FCE80 0F 85 47 7F 01 00    jne         _CreateProcessInternalW@48+2A4h (77114DCDh)  
770FCE86 F6 C2 20             test        dl,20h  
770FCE89 0F 85 4A 7F 01 00    jne         _CreateProcessInternalW@48+2B2h (77114DD9h)  
770FCE8F F7 C2 00 80 00 00    test        edx,8000h  
770FCE95 0F 85 4C 7F 01 00    jne         _CreateProcessInternalW@48+2C5h (77114DE7h)  
770FCE9B 84 D2                test        dl,dl  
770FCE9D 0F 88 50 7F 01 00    js          _CreateProcessInternalW@48+2D2h (77114DF3h)  
770FCEA3 F7 C2 00 01 00 00    test        edx,100h  
770FCEA9 0F 85 50 7F 01 00    jne         _CreateProcessInternalW@48+2E3h (77114DFFh)  
770FCEAF 88 9D C7 FD FF FF    mov         byte ptr [ebp-239h],bl  
770FCEB5 81 E2 1F 3E FF FF    and         edx,0FFFF3E1Fh  
770FCEBB 89 95 B8 FD FF FF    mov         dword ptr [ebp-248h],edx  
770FCEC1 F7 C2 00 00 04 00    test        edx,40000h  
770FCEC7 75 0C                jne         _CreateProcessInternalW@48+330h (770FCED5h)  
770FCEC9 8B B5 0C FD FF FF    mov         esi,dword ptr [ebp-2F4h]  
770FCECF 89 B5 A0 FD FF FF    mov         dword ptr [ebp-260h],esi  
770FCED5 F7 C2 00 00 00 01    test        edx,1000000h  
770FCEDB 0F 84 DF FD FF FF    je          _CreateProcessInternalW@48+341h (770FCCC0h)  
770FCEE1 E9 43 7F 01 00       jmp         _CreateProcessInternalW@48+338h (77114E29h)  
...
770FCCC0 F7 C2 00 00 01 00    test        edx,10000h  
770FCCC6 0F 84 EE 04 00 00    je          _CreateProcessInternalW@48+355h (770FD1BAh)  
770FCCCC E9 66 81 01 00       jmp         _CreateProcessInternalW@48+349h (77114E37h)  
...
770FD1BA F6 C2 04             test        dl,4  
770FD1BD 75 05                jne         _CreateProcessInternalW@48+366h (770FD1C4h)  
770FD1BF E9 D2 09 00 00       jmp         _CreateProcessInternalW@48+35Ah (770FDB96h)  
770FD1C4 F6 C2 03             test        dl,3  
770FD1C7 0F 84 AD 7C 01 00    je          _CreateProcessInternalW@48+39Dh (77114E7Ah)  -->...
770FD1CD E9 76 7C 01 00       jmp         _CreateProcessInternalW@48+36Bh (77114E48h)  
...
77114E7A C7 85 C4 FE FF FF 05 00 02 00 mov         dword ptr [ebp-13Ch],20005h      ; aPsAttributes[0].Attribute := 20005h
77114E84 89 9D D0 FE FF FF    mov         dword ptr [ebp-130h],ebx                  ; aPsAttributes[1].Attribute := 0
77114E8A C7 85 D4 FE FF FF 03 00 01 00 mov         dword ptr [ebp-12Ch],10003h      ; aPsAttributes[2].Attribute := 10003h
77114E94 6A 08                push        8  
77114E96 58                   pop         eax  
77114E97 89 85 D8 FE FF FF    mov         dword ptr [ebp-128h],eax                  ; aPsAttributes[2].Size := 8
77114E9D 89 9D E0 FE FF FF    mov         dword ptr [ebp-120h],ebx                  ; aPsAttributes[3].Attribute := 0
77114EA3 8D 85 68 FC FF FF    lea         eax,[ebp-398h]                            ; eax := &[ebp-398h] = 0x0065e5b0
77114EA9 89 85 DC FE FF FF    mov         dword ptr [ebp-124h],eax                  ; aPsAttributes[2].ValuePtr := 0x0065e5b0
77114EAF C7 85 E4 FE FF FF 06 00 00 00 mov         dword ptr [ebp-11Ch],6           ; aPsAttributes[4].Attribute := 6
77114EB9 C7 85 E8 FE FF FF 30 00 00 00 mov         dword ptr [ebp-118h],30h         ; aPsAttributes[4].Size := 30h
77114EC3 89 9D F0 FE FF FF    mov         dword ptr [ebp-110h],ebx                  ; aPsAttributes[5].Attribute := 0
77114EC9 8D 85 38 FB FF FF    lea         eax,[ebp-4C8h]                            ; eax := &[ebp-4C8h] = 0x0065e480
77114ECF 89 85 EC FE FF FF    mov         dword ptr [ebp-114h],eax                  ; aPsAttributes[2].ValuePtr := 0x0065e480
77114ED5 C7 85 8C FD FF FF 03 00 00 00 mov         dword ptr [ebp-274h],3  
77114EDF 8B 85 A8 FC FF FF    mov         eax,dword ptr [ebp-358h]  
77114EE5 85 C0                test        eax,eax  
77114EE7 0F 84 6A 82 FE FF    je          770FD157  -->...
77114EED C7 85 F4 FE FF FF 01 00 06 00 mov         dword ptr [ebp-10Ch],60001h  
77114EF7 C7 85 F8 FE FF FF 04 00 00 00 mov         dword ptr [ebp-108h],4  
77114F01 89 9D 00 FF FF FF    mov         dword ptr [ebp-100h],ebx  
77114F07 89 85 FC FE FF FF    mov         dword ptr [ebp-104h],eax  
77114F0D C7 85 8C FD FF FF 04 00 00 00 mov         dword ptr [ebp-274h],4  
77114F17 E9 3B 82 FE FF       jmp         770FD157  
...
770FD157 33 C9                xor         ecx,ecx  
770FD159 41                   inc         ecx  
770FD15A 38 9D C7 FD FF FF    cmp         byte ptr [ebp-239h],bl  
770FD160 0F 85 B6 7D 01 00    jne         77114F1C  
770FD166 F7 C2 00 00 00 04    test        edx,4000000h  
770FD16C 74 05                je          770FD173  
770FD16E E9 86 C0 00 00       jmp         771091F9  
770FD173 89 5D FC             mov         dword ptr [ebp-4],ebx  
770FD176 33 C0                xor         eax,eax  
770FD178 AB                   stos        dword ptr es:[edi]  
770FD179 AB                   stos        dword ptr es:[edi]  
770FD17A AB                   stos        dword ptr es:[edi]  
770FD17B AB                   stos        dword ptr es:[edi]  
770FD17C 83 BD 90 FD FF FF 00 cmp         dword ptr [ebp-270h],0  
770FD183 0F 85 10 C7 00 00    jne         77109899  
770FD189 6A 11                push        11h  
770FD18B 59                   pop         ecx  
770FD18C 8B 85 58 FC FF FF    mov         eax,dword ptr [ebp-3A8h]  
770FD192 8B F0                mov         esi,eax  
770FD194 8D BD F4 FA FF FF    lea         edi,[ebp-50Ch]  
770FD19A F3 A5                rep movs    dword ptr es:[edi],dword ptr [esi]  
770FD19C F7 C2 00 00 08 00    test        edx,80000h  
770FD1A2 0F 84 01 56 01 00    je          771127A9 -------->... 
770FD1A8 83 BD F4 FA FF FF 48 cmp         dword ptr [ebp-50Ch],48h  
770FD1AF 0F 84 17 7E 01 00    je          77114FCC  
770FD1B5 E9 FD 7D 01 00       jmp         77114FB7  
...
771127A9 8B BD A0 FD FF FF    mov         edi,dword ptr [ebp-260h]  
771127AF E9 AB A7 FE FF       jmp         770FCF5F  
...
770FCF5F BE 00 08 00 00       mov         esi,800h  
770FCF64 85 D6                test        esi,edx  
770FCF66 75 3B                jne         770FCFA3  
770FCF68 8B 85 04 FD FF FF    mov         eax,dword ptr [ebp-2FCh]  
770FCF6E 85 C0                test        eax,eax  
770FCF70 75 03                jne         770FCF75  
770FCF72 83 C8 FF             or          eax,0FFFFFFFFh ; NtCurrentProcess() 
770FCF75 8D 8D A4 FB FF FF    lea         ecx,[ebp-45Ch]  
770FCF7B 51                   push        ecx  
770FCF7C 53                   push        ebx  
770FCF7D 50                   push        eax  
-- ====================================================================================================
BOOL WINAPI IsProcessInJob(
  _In_      HANDLE ProcessHandle,
  _In_opt_  HANDLE JobHandle,
  _Out_     PBOOL Result
);
0x0055E4AC  ffffffff 00000000 0055e5f0
-- ====================================================================================================
770FCF7E E8 40 F7 FF FF       call        _IsProcessInJob@12 (770FC6C3h)  
770FCF83 85 C0                test        eax,eax  
770FCF85 74 1C                je          770FCFA3  
770FCF87 83 BD A4 FB FF FF 00 cmp         dword ptr [ebp-45Ch],0  
770FCF8E 74 13                je          770FCFA3  --->...
770FCF90 8B 85 B8 FD FF FF    mov         eax,dword ptr [ebp-248h]  
770FCF96 25 FF EF FF FF       and         eax,0FFFFEFFFh  
770FCF9B 0B C6                or          eax,esi  
770FCF9D 89 85 B8 FD FF FF    mov         dword ptr [ebp-248h],eax
...  
770FCFA3 8B 85 20 FB FF FF    mov         eax,dword ptr [ebp-4E0h]  
770FCFA9 A9 00 01 00 00       test        eax,100h  
770FCFAE 0F 84 62 80 01 00    je          77115016 --->...  
770FCFB4 A9 00 06 00 00       test        eax,600h  
770FCFB9 0F 85 4C 80 01 00    jne         7711500B  
770FCFBF E9 52 80 01 00       jmp         77115016  
...
77115016 8B B5 84 FD FF FF    mov         esi,dword ptr [ebp-27Ch]  
7711501C 85 F6                test        esi,esi  
7711501E 0F 85 1E 42 FF FF    jne         77109242  
77115024 E9 9B 7F FE FF       jmp         770FCFC4  --->
...
770FCFC4 8D 85 A8 FB FF FF    lea         eax,[ebp-458h]  
770FCFCA 50                   push        eax  
770FCFCB 53                   push        ebx  
770FCFCC FF B5 F0 FC FF FF    push        dword ptr [ebp-310h]  
770FCFD2 8D 85 94 FA FF FF    lea         eax,[ebp-56Ch]  
770FCFD8 50                   push        eax  
-- ====================================================================================================
        //
        // Create the process object
        //
        pObja = BaseFormatObjectAttributes(&Obja,lpProcessAttributes,NULL);
        ...
        Status = NtCreateProcess(
                    &ProcessHandle,
                    PROCESS_ALL_ACCESS,
                    pObja,
                    NtCurrentProcess(),
                    (BOOLEAN)bInheritHandles,
                    SectionHandle,
                    NULL,
                    NULL
                    );
0x0055E4A8  0055e4e0 00000000 00000000 0055e5f4
NTSTATUS BaseFormatObjectAttributes(
    POBJECT_ATTRIBUTES pObjAttrib,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    PVOID pParam03,
    PDWORD pParam04
    );
-- ====================================================================================================
770FCFD9 E8 CB 34 00 00       call        _BaseFormatObjectAttributes@16 (771004A9h)  
-- ------------------------------------------------------------------------------------------------
_BaseFormatObjectAttributes@16:
771004A9 8B FF                mov         edi,edi  
771004AB 55                   push        ebp  
771004AC 8B EC                mov         ebp,esp  
771004AE 8B 45 0C             mov         eax,dword ptr [ebp+0Ch]           ; eax := POBJECT_ATTRIBUTES pObjAttrib = NULL
771004B1 53                   push        ebx  
771004B2 8B 5D 10             mov         ebx,dword ptr [ebp+10h]           ; ebx := PVOID pParam03 = NULL
771004B5 56                   push        esi  
771004B6 57                   push        edi  
771004B7 85 C0                test        eax,eax  
771004B9 75 64                jne         _BaseFormatObjectAttributes@16+72h (7710051Fh)  
771004BB 85 DB                test        ebx,ebx  
771004BD 74 58                je          _BaseFormatObjectAttributes@16+6Ah (77100517h)  --->+
771004BF 33 F6                xor         esi,esi                                             |
771004C1 21 75 0C             and         dword ptr [ebp+0Ch],esi                             |
771004C4 85 DB                test        ebx,ebx                                             |
771004C6 0F 84 DB FF FD FF    je          _BaseFormatObjectAttributes@16+84h (770E04A7h)      |
771004CC 8D 4D 10             lea         ecx,[ebp+10h]                                       |
771004CF E8 63 FA FF FF       call        _BaseGetNamedObjectDirectory@4 (770FFF37h)          |
771004D4 85 C0                test        eax,eax                                             |
771004D6 78 38                js          _BaseFormatObjectAttributes@16+63h (77100510h)      |
771004D8 8B 45 10             mov         eax,dword ptr [ebp+10h]                             |
771004DB 81 CE 80 00 00 00    or          esi,80h                                             |
771004E1 8B 7D 08             mov         edi,dword ptr [ebp+8]                               |
771004E4 83 67 14 00          and         dword ptr [edi+14h],0                               |
771004E8 89 47 04             mov         dword ptr [edi+4],eax                               |
771004EB 8B 45 0C             mov         eax,dword ptr [ebp+0Ch]                             |
771004EE 89 47 10             mov         dword ptr [edi+10h],eax                             |
771004F1 A1 CC D3 17 77       mov         eax,dword ptr [_pfnAdjustObjectAttributesForPrivateNamespace (7717D3CCh)]  
771004F6 C7 07 18 00 00 00    mov         dword ptr [edi],18h                                 |
771004FC 89 77 0C             mov         dword ptr [edi+0Ch],esi                             |
771004FF 89 5F 08             mov         dword ptr [edi+8],ebx                               |
77100502 85 C0                test        eax,eax                                             |
77100504 74 03                je          _BaseFormatObjectAttributes@16+5Ch (77100509h)      |
77100506 57                   push        edi                                                 |
77100507 FF D0                call        eax                                                 |
77100509 8B 45 14             mov         eax,dword ptr [ebp+14h]                             |
7710050C 89 38                mov         dword ptr [eax],edi                                 |
7710050E 33 C0                xor         eax,eax   <-----------------------------------------|---+
77100510 5F                   pop         edi                                                 |   ^
77100511 5E                   pop         esi                                                 |   |
77100512 5B                   pop         ebx                                                 |   |
77100513 5D                   pop         ebp                                                 |   |
77100514 C2 10 00             ret         10h                                                 v   |
77100517 8B 45 14             mov         eax,dword ptr [ebp+14h]  <--------------------------+   |
                                                                            ; eax := PVOID pParam04 = 0055E5F4
7710051A 83 20 00             and         dword ptr [eax],0                 ; *pParam04 := 0      |
7710051D EB EF                jmp         _BaseFormatObjectAttributes@16+61h (7710050Eh)  ------->+
-- ------------------------------------------------------------------------------------------------
770FCFDE 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FCFE4 85 C0                test        eax,eax  
770FCFE6 0F 88 E5 FC FF FF    js          770FCCD1  
770FCFEC 8D 85 CC FB FF FF    lea         eax,[ebp-434h]  
770FCFF2 50                   push        eax  
770FCFF3 53                   push        ebx  
770FCFF4 FF B5 48 FC FF FF    push        dword ptr [ebp-3B8h]  
770FCFFA 8D 85 7C FA FF FF    lea         eax,[ebp-584h]  
770FD000 50                   push        eax  
-- ====================================================================================================
NTSTATUS BaseFormatObjectAttributes(
    POBJECT_ATTRIBUTES pObjAttrib,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    PVOID pParam03,
    PDWORD pParam04
    );
0x0055E4A8  0055e4c8 00000000 00000000 0055e618
-- ====================================================================================================
770FD001 E8 A3 34 00 00       call        _BaseFormatObjectAttributes@16 (771004A9h)  
-- ------------------------------------------------------------------------------------------------
_BaseFormatObjectAttributes@16:
771004A9 8B FF                mov         edi,edi  
771004AB 55                   push        ebp  
771004AC 8B EC                mov         ebp,esp  
771004AE 8B 45 0C             mov         eax,dword ptr [ebp+0Ch]           ; eax := POBJECT_ATTRIBUTES pObjAttrib = NULL
771004B1 53                   push        ebx  
771004B2 8B 5D 10             mov         ebx,dword ptr [ebp+10h]           ; ebx := PVOID pParam03 = NULL
771004B5 56                   push        esi  
771004B6 57                   push        edi  
771004B7 85 C0                test        eax,eax  
771004B9 75 64                jne         _BaseFormatObjectAttributes@16+72h (7710051Fh)  
771004BB 85 DB                test        ebx,ebx  
771004BD 74 58                je          _BaseFormatObjectAttributes@16+6Ah (77100517h)  --->+
771004BF 33 F6                xor         esi,esi                                             |
771004C1 21 75 0C             and         dword ptr [ebp+0Ch],esi                             |
771004C4 85 DB                test        ebx,ebx                                             |
771004C6 0F 84 DB FF FD FF    je          _BaseFormatObjectAttributes@16+84h (770E04A7h)      |
771004CC 8D 4D 10             lea         ecx,[ebp+10h]                                       |
771004CF E8 63 FA FF FF       call        _BaseGetNamedObjectDirectory@4 (770FFF37h)          |
771004D4 85 C0                test        eax,eax                                             |
771004D6 78 38                js          _BaseFormatObjectAttributes@16+63h (77100510h)      |
771004D8 8B 45 10             mov         eax,dword ptr [ebp+10h]                             |
771004DB 81 CE 80 00 00 00    or          esi,80h                                             |
771004E1 8B 7D 08             mov         edi,dword ptr [ebp+8]                               |
771004E4 83 67 14 00          and         dword ptr [edi+14h],0                               |
771004E8 89 47 04             mov         dword ptr [edi+4],eax                               |
771004EB 8B 45 0C             mov         eax,dword ptr [ebp+0Ch]                             |
771004EE 89 47 10             mov         dword ptr [edi+10h],eax                             |
771004F1 A1 CC D3 17 77       mov         eax,dword ptr [_pfnAdjustObjectAttributesForPrivateNamespace (7717D3CCh)]  
771004F6 C7 07 18 00 00 00    mov         dword ptr [edi],18h                                 |
771004FC 89 77 0C             mov         dword ptr [edi+0Ch],esi                             |
771004FF 89 5F 08             mov         dword ptr [edi+8],ebx                               |
77100502 85 C0                test        eax,eax                                             |
77100504 74 03                je          _BaseFormatObjectAttributes@16+5Ch (77100509h)      |
77100506 57                   push        edi                                                 |
77100507 FF D0                call        eax                                                 |
77100509 8B 45 14             mov         eax,dword ptr [ebp+14h]                             |
7710050C 89 38                mov         dword ptr [eax],edi                                 |
7710050E 33 C0                xor         eax,eax   <-----------------------------------------|---+
77100510 5F                   pop         edi                                                 |   ^
77100511 5E                   pop         esi                                                 |   |
77100512 5B                   pop         ebx                                                 |   |
77100513 5D                   pop         ebp                                                 |   |
77100514 C2 10 00             ret         10h                                                 v   |
77100517 8B 45 14             mov         eax,dword ptr [ebp+14h]  <--------------------------+   |
                                                                            ; eax := PVOID pParam04 = 0055E618
7710051A 83 20 00             and         dword ptr [eax],0                 ; *pParam04 := 0      |
7710051D EB EF                jmp         _BaseFormatObjectAttributes@16+61h (7710050Eh)  ------->+
-- ------------------------------------------------------------------------------------------------
770FD006 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FD00C 85 C0                test        eax,eax  
770FD00E 0F 88 BD FC FF FF    js          770FCCD1  
770FD014 8B 85 8C FD FF FF    mov         eax,dword ptr [ebp-274h]  
770FD01A 89 85 F4 FB FF FF    mov         dword ptr [ebp-40Ch],eax  
770FD020 8B 8D 94 FD FF FF    mov         ecx,dword ptr [ebp-26Ch]  
770FD026 89 8D D0 FB FF FF    mov         dword ptr [ebp-430h],ecx  
770FD02C 8B 95 90 FD FF FF    mov         edx,dword ptr [ebp-270h]  
770FD032 89 95 A0 FB FF FF    mov         dword ptr [ebp-460h],edx  
770FD038 E9 FB 7F 01 00       jmp         77115038  
...
77115038 8B B5 CC FD FF FF    mov         esi,dword ptr [ebp-234h]  
7711503E 89 95 F8 FC FF FF    mov         dword ptr [ebp-308h],edx  
77115044 89 8D 38 FD FF FF    mov         dword ptr [ebp-2C8h],ecx  
7711504A 89 85 28 FD FF FF    mov         dword ptr [ebp-2D8h],eax  
77115050 E9 E8 7F FE FF       jmp         770FD03D  
...
770FD03D 89 85 14 FD FF FF    mov         dword ptr [ebp-2ECh],eax  
770FD043 89 85 8C FD FF FF    mov         dword ptr [ebp-274h],eax  
770FD049 83 7D 1C 00          cmp         dword ptr [ebp+1Ch],0  
770FD04D 0F 84 51 C2 00 00    je          771092A4 ---> 
770FD053 80 BD 83 FD FF FF 00 cmp         byte ptr [ebp-27Dh],0  
770FD05A C7 85 1C FD FF FF 01 00 00 00 mov         dword ptr [ebp-2E4h],1  
770FD064 0F 85 3A C2 00 00    jne         771092A4  
770FD06A 89 8D 94 FD FF FF    mov         dword ptr [ebp-26Ch],ecx  
770FD070 89 95 90 FD FF FF    mov         dword ptr [ebp-270h],edx  
770FD076 8B 85 44 FD FF FF    mov         eax,dword ptr [ebp-2BCh]  
770FD07C 85 C0                test        eax,eax  
770FD07E 0F 84 E0 7F 01 00    je          77115064  
770FD084 E9 CC 7F 01 00       jmp         77115055  
...
771092A4 89 9D 1C FD FF FF    mov         dword ptr [ebp-2E4h],ebx  
771092AA E9 BB 3D FF FF       jmp         770FD06A  
...
770FD06A 89 8D 94 FD FF FF    mov         dword ptr [ebp-26Ch],ecx  
770FD070 89 95 90 FD FF FF    mov         dword ptr [ebp-270h],edx  
770FD076 8B 85 44 FD FF FF    mov         eax,dword ptr [ebp-2BCh]  
770FD07C 85 C0                test        eax,eax  
770FD07E 0F 84 E0 7F 01 00    je          77115064  --->
770FD084 E9 CC 7F 01 00       jmp         77115055  
...
77115064 8B 85 E4 FC FF FF    mov         eax,dword ptr [ebp-31Ch]  
7711506A 85 C0                test        eax,eax  
7711506C 0F 84 74 7E FE FF    je          770FCEE6  --->
77115072 50                   push        eax  
77115073 53                   push        ebx  
77115074 56                   push        esi  
77115075 FF 15 00 00 18 77    call        dword ptr [__imp__RtlFreeHeap@12 (77180000h)]  
7711507B 89 9D E4 FC FF FF    mov         dword ptr [ebp-31Ch],ebx  
77115081 E9 60 7E FE FF       jmp         770FCEE6  
...
770FCEE6 8D 85 58 FD FF FF    lea         eax,[ebp-2A8h]  
770FCEEC 50                   push        eax  
770FCEED FF 15 58 00 18 77    call        dword ptr [__imp__RtlFreeUnicodeString@4 (77180058h)]  
770FCEF3 8B B5 30 FD FF FF    mov         esi,dword ptr [ebp-2D0h]  
770FCEF9 85 F6                test        esi,esi  
770FCEFB 0F 84 F2 FD FF FF    je          770FCCF3  --->...
770FCF01 E9 80 81 01 00       jmp         77115086  
...
770FCCF3 8B B5 CC FD FF FF    mov         esi,dword ptr [ebp-234h]  
770FCCF9 E9 F7 F9 FF FF       jmp         770FC6F5  
...
770FC6F5 8B 85 88 FD FF FF    mov         eax,dword ptr [ebp-278h]  
770FC6FB 85 C0                test        eax,eax  
770FC6FD 0F 85 9D 89 01 00    jne         771150A0  
770FC703 8B 85 54 FD FF FF    mov         eax,dword ptr [ebp-2ACh]  
770FC709 85 C0                test        eax,eax  
770FC70B 0F 84 BA 89 01 00    je          771150CB  --->...
770FC711 E9 A2 89 01 00       jmp         771150B8  
...
771150CB 83 BD 7C FD FF FF 00 cmp         dword ptr [ebp-284h],0  
771150D2 74 18                je          771150EC  --->
771150D4 FF B5 7C FD FF FF    push        dword ptr [ebp-284h]  
771150DA FF 15 48 07 18 77    call        dword ptr [__imp__RtlDestroyEnvironment@4 (77180748h)]  
771150E0 89 85 A8 FD FF FF    mov         dword ptr [ebp-258h],eax  
771150E6 89 9D 7C FD FF FF    mov         dword ptr [ebp-284h],ebx  
771150EC 80 BD 79 FD FF FF 00 cmp         byte ptr [ebp-287h],0  <---
771150F3 0F 84 1D 76 FE FF    je          770FC716  --->...
771150F9 E9 3F 76 FE FF       jmp         770FC73D  
...
770FC716 83 BD 04 FD FF FF 00 cmp         dword ptr [ebp-2FCh],0  
770FC71D 75 1E                jne         770FC73D  
770FC71F 66 83 BD 4C FD FF FF 00 cmp         word ptr [ebp-2B4h],0  
770FC727 0F 85 D1 89 01 00    jne         771150FE  
770FC72D 8B 85 00 FD FF FF    mov         eax,dword ptr [ebp-300h]  
770FC733 F6 40 03 10          test        byte ptr [eax+3],10h  
770FC737 0F 85 C1 89 01 00    jne         771150FE  
770FC73D 8B B5 84 FD FF FF    mov         esi,dword ptr [ebp-27Ch]  
770FC743 8B 95 40 FD FF FF    mov         edx,dword ptr [ebp-2C0h]  
770FC749 85 D2                test        edx,edx  
770FC74B 0F 85 91 3E FF FF    jne         770F05E2  
770FC751 85 F6                test        esi,esi  
770FC753 0F 84 C4 8A 01 00    je          7711521D  --->...
770FC759 56                   push        esi  
770FC75A E8 E9 6B FD FF       call        _GetFileAttributesW@4 (770D3348h)  
770FC75F 89 85 B4 FB FF FF    mov         dword ptr [ebp-44Ch],eax  
770FC765 83 F8 FF             cmp         eax,0FFFFFFFFh  
770FC768 0F 84 7B 05 00 00    je          770FCCE9  
770FC76E A8 10                test        al,10h  
770FC770 0F 85 A7 8A 01 00    jne         7711521D  
770FC776 E9 6E 05 00 00       jmp         770FCCE9  
...
7711521D 8B 8D 94 FD FF FF    mov         ecx,dword ptr [ebp-26Ch]  
77115223 85 C9                test        ecx,ecx  
77115225 0F 84 6C D5 FF FF    je          77112797  --->...
7711522B E9 16 B3 FD FF       jmp         770F0546  
...
77112797 8B B5 14 FD FF FF    mov         esi,dword ptr [ebp-2ECh]  
7711279D E9 D9 9F FE FF       jmp         770FC77B  
...
770FC77B 89 9D BC FC FF FF    mov         dword ptr [ebp-344h],ebx  
770FC781 89 9D C4 FC FF FF    mov         dword ptr [ebp-33Ch],ebx  
770FC787 83 7D 1C 00          cmp         dword ptr [ebp+1Ch],0  
770FC78B 0F 84 1E CB 00 00    je          771092AF  --->...
770FC791 83 CF 04             or          edi,4  
770FC794 89 BD 0C FD FF FF    mov         dword ptr [ebp-2F4h],edi  
770FC79A 89 BD A0 FD FF FF    mov         dword ptr [ebp-260h],edi  
770FC7A0 6A 48                push        48h  
770FC7A2 53                   push        ebx  
770FC7A3 8D 85 00 FC FF FF    lea         eax,[ebp-400h]                    ; eax := &[ebp-400h] = 0x0065e548
770FC7A9 50                   push        eax                               ; PPS_CREATE_INFO CreateInfo = 0x0065e548
770FC7AA E8 D7 0D FD FF       call        _memset (770CD586h)  
770FC7AF 83 C4 0C             add         esp,0Ch  
770FC7B2 C7 85 00 FC FF FF 48 00 00 00 mov         dword ptr [ebp-400h],48h  
770FC7BC 8B 85 A4 FD FF FF    mov         eax,dword ptr [ebp-25Ch]  
770FC7C2 85 C0                test        eax,eax  
770FC7C4 0F 84 3B 05 00 00    je          770FCD05  
770FC7CA E9 61 8A 01 00       jmp         77115230  
...
771092AF 83 E7 FB             and         edi,0FFFFFFFBh  
771092B2 E9 DD 34 FF FF       jmp         770FC794  
...
770FC794 89 BD 0C FD FF FF    mov         dword ptr [ebp-2F4h],edi  
770FC79A 89 BD A0 FD FF FF    mov         dword ptr [ebp-260h],edi  
770FC7A0 6A 48                push        48h  
770FC7A2 53                   push        ebx  
770FC7A3 8D 85 00 FC FF FF    lea         eax,[ebp-400h]  
770FC7A9 50                   push        eax  
770FC7AA E8 D7 0D FD FF       call        _memset (770CD586h)  
770FC7AF 83 C4 0C             add         esp,0Ch  
770FC7B2 C7 85 00 FC FF FF 48 00 00 00 mov         dword ptr [ebp-400h],48h     
770FC7BC 8B 85 A4 FD FF FF    mov         eax,dword ptr [ebp-25Ch]  
770FC7C2 85 C0                test        eax,eax  
770FC7C4 0F 84 3B 05 00 00    je          770FCD05  --->...
770FC7CA E9 61 8A 01 00       jmp         77115230  
...
770FCD05 80 8D 08 FC FF FF 02 or          byte ptr [ebp-3F8h],2                 ; stCreateInfo.InitState.DetectManifest := 1
770FCD0C E9 BE FA FF FF       jmp         770FC7CF  
...
770FC7CF 83 BD 64 FD FF FF 00 cmp         dword ptr [ebp-29Ch],0  
770FC7D6 0F 84 DB CA 00 00    je          771092B7  --->...
770FC7DC 6A 08                push        8  
770FC7DE 8D BD C0 FE FF FF    lea         edi,[ebp-140h]  
770FC7E4 5A                   pop         edx  
770FC7E5 83 BD C8 FC FF FF 00 cmp         dword ptr [ebp-338h],0  
770FC7EC 0F 84 EB 8A 01 00    je          771152DD  
770FC7F2 E9 A7 8A 01 00       jmp         7711529E  
...
771092B7 83 BD 1C FD FF FF 00 cmp         dword ptr [ebp-2E4h],0  
771092BE 0F 85 18 35 FF FF    jne         770FC7DC  
771092C4 F7 85 20 FB FF FF 00 01 00 00 test        dword ptr [ebp-4E0h],100h  
771092CE 0F 85 08 35 FF FF    jne         770FC7DC  
771092D4 83 BD 04 FD FF FF 00 cmp         dword ptr [ebp-2FCh],0  
771092DB 0F 85 FB 34 FF FF    jne         770FC7DC  
771092E1 8D BD C0 FE FF FF    lea         edi,[ebp-140h]                          ; edi := &stAttributeList140 = 0x0065e808
771092E7 6A 08                push        8  
771092E9 5A                   pop         edx  
771092EA F7 85 B8 FD FF FF 18 00 00 08 test        dword ptr [ebp-248h],8000018h  
771092F4 0F 85 EB 34 FF FF    jne         770FC7E5  
771092FA E9 4A BF 00 00       jmp         77115249  --->...
...
77115249 8B 85 F8 FB FF FF    mov         eax,dword ptr [ebp-408h]  
7711524F 83 E0 FD             and         eax,0FFFFFFFDh  
77115252 83 C8 01             or          eax,1  
77115255 89 85 F8 FB FF FF    mov         dword ptr [ebp-408h],eax  
7711525B C7 85 FC FB FF FF 03 00 00 00 mov         dword ptr [ebp-404h],3  
77115265 83 E0 E3             and         eax,0FFFFFFE3h  
77115268 89 85 F8 FB FF FF    mov         dword ptr [ebp-408h],eax  
7711526E 8B C6                mov         eax,esi  
77115270 03 C0                add         eax,eax  
77115272 C7 44 C7 04 0A 00 02 00 mov         dword ptr [edi+eax*8+4],2000Ah  
7711527A 89 54 C7 08          mov         dword ptr [edi+eax*8+8],edx  
7711527E 89 5C C7 10          mov         dword ptr [edi+eax*8+10h],ebx  
77115282 8D 8D F8 FB FF FF    lea         ecx,[ebp-408h]  
77115288 89 4C C7 0C          mov         dword ptr [edi+eax*8+0Ch],ecx  
7711528C 46                   inc         esi  
7711528D 89 B5 14 FD FF FF    mov         dword ptr [ebp-2ECh],esi  
77115293 89 B5 8C FD FF FF    mov         dword ptr [ebp-274h],esi  
77115299 E9 47 75 FE FF       jmp         770FC7E5  
...
770FC7E5 83 BD C8 FC FF FF 00 cmp         dword ptr [ebp-338h],0  
770FC7EC 0F 84 EB 8A 01 00    je          771152DD  --->
770FC7F2 E9 A7 8A 01 00       jmp         7711529E  
...
771152DD 8B 85 00 FD FF FF    mov         eax,dword ptr [ebp-300h]  
771152E3 F6 85 B8 FD FF FF 03 test        byte ptr [ebp-248h],3  
771152EA 0F 84 AC 79 FE FF    je          770FCC9C  --->
771152F0 80 78 01 00          cmp         byte ptr [eax+1],0  
771152F4 0F 85 A2 79 FE FF    jne         770FCC9C  
771152FA 80 8D 08 FC FF FF 0C or          byte ptr [ebp-3F8h],0Ch  
77115301 EB 0D                jmp         77115310  
...
770FCC9C 80 BD 9F FD FF FF 00 cmp         byte ptr [ebp-261h],0  
770FCCA3 0F 84 67 86 01 00    je          77115310  --->...
770FCCA9 E9 55 86 01 00       jmp         77115303  
...
77115310 80 8D 08 FC FF FF 01 or          byte ptr [ebp-3F8h],1                 ; stCreateInfo.InitState.WriteOutputOnExit := 1
77115317 B9 00 20 00 00       mov         ecx,2000h  
7711531C 66 89 8D 0A FC FF FF mov         word ptr [ebp-3F6h],cx                ; stCreateInfo.InitState.ProhibitedImageCharacteristics := 2000h
77115323 C7 85 0C FC FF FF 81 00 00 00 mov         dword ptr [ebp-3F4h],81h     ; stCreateInfo.InitState.AdditionalFileAccess := 81h
7711532D 83 BD FC FA FF FF 00 cmp         dword ptr [ebp-504h],0  
77115334 0F 84 BD 74 FE FF    je          770FC7F7  --->
7711533A E9 C4 74 FE FF       jmp         770FC803  
...
770FC7F7 8B 40 10             mov         eax,dword ptr [eax+10h]  
770FC7FA 8B 40 7C             mov         eax,dword ptr [eax+7Ch]  
770FC7FD 89 85 FC FA FF FF    mov         dword ptr [ebp-504h],eax  
770FC803 8A C3                mov         al,bl  
770FC805 88 85 AF FD FF FF    mov         byte ptr [ebp-251h],al  
770FC80B 8A D3                mov         dl,bl  
770FC80D 88 95 7A FD FF FF    mov         byte ptr [ebp-286h],dl  
770FC813 C7 85 98 FC FF FF 01 00 00 00 mov         dword ptr [ebp-368h],1  
770FC81D 83 BD B0 FD FF FF 00 cmp         dword ptr [ebp-250h],0  
770FC824 0F 84 6A CB 00 00    je          77109394  
770FC82A 8B 8D 98 FD FF FF    mov         ecx,dword ptr [ebp-268h]  
770FC830 85 C9                test        ecx,ecx  
770FC832 0F 84 D9 8B 01 00    je          77115411  --->...
770FC838 66 39 19             cmp         word ptr [ecx],bx  
770FC83B 0F 84 D0 8B 01 00    je          77115411  
770FC841 E9 E4 04 00 00       jmp         770FCD2A  
...
77115411 B2 01                mov         dl,1  
77115413 88 95 7A FD FF FF    mov         byte ptr [ebp-286h],dl  
77115419 8B 8D B0 FD FF FF    mov         ecx,dword ptr [ebp-250h]  
7711541F 89 8D 98 FD FF FF    mov         dword ptr [ebp-268h],ecx  
77115425 E9 00 79 FE FF       jmp         770FCD2A  
...
770FCD2A 84 C0                test        al,al  
770FCD2C 0F 84 F8 86 01 00    je          7711542A  --->...
770FCD32 E9 FB 86 01 00       jmp         77115432  
...
7711542A 84 D2                test        dl,dl  
7711542C 0F 84 14 74 FE FF    je          770FC846  
77115432 8D 51 02             lea         edx,[ecx+2]  
77115435 66 8B 01             mov         ax,word ptr [ecx]  
77115438 83 C1 02             add         ecx,2  
7711543B 66 3B C3             cmp         ax,bx  
7711543E 75 F5                jne         77115435  
77115440 2B CA                sub         ecx,edx  
77115442 D1 F9                sar         ecx,1  
77115444 8D 3C 4D 06 00 00 00 lea         edi,[ecx*2+6]  
7711544B 89 BD 6C FB FF FF    mov         dword ptr [ebp-494h],edi  
77115451 57                   push        edi  
77115452 53                   push        ebx  
77115453 FF B5 CC FD FF FF    push        dword ptr [ebp-234h]  
77115459 FF 15 04 00 18 77    call        dword ptr [__imp__RtlAllocateHeap@12 (77180004h)]  
7711545F 8B F0                mov         esi,eax  
77115461 89 B5 30 FD FF FF    mov         dword ptr [ebp-2D0h],esi                           ; pwsCommandLine2D0 := 0x00a5ebe8
77115467 85 F6                test        esi,esi  
77115469 0F 84 D7 73 FE FF    je          770FC846  
7711546F 68 9C 80 11 77       push        offset string L""" (7711809Ch)  
77115474 8B D7                mov         edx,edi  
77115476 8B CE                mov         ecx,esi  
77115478 E8 76 21 06 00       call        _StringCbCopyW@12 (771775F3h)  
7711547D 80 BD AF FD FF FF 00 cmp         byte ptr [ebp-251h],0  
77115484 74 14                je          7711549A  --->
77115486 8B 85 70 FD FF FF    mov         eax,dword ptr [ebp-290h]  
7711548C 0F B7 08             movzx       ecx,word ptr [eax]  
7711548F 89 8D 24 FD FF FF    mov         dword ptr [ebp-2DCh],ecx  
77115495 33 C9                xor         ecx,ecx  
77115497 66 89 08             mov         word ptr [eax],cx  
7711549A FF B5 98 FD FF FF    push        dword ptr [ebp-268h]  <---
771154A0 8B D7                mov         edx,edi  
771154A2 8B B5 30 FD FF FF    mov         esi,dword ptr [ebp-2D0h]  
771154A8 8B CE                mov         ecx,esi                           ; esi = wsCommandLine
771154AA E8 F8 20 06 00       call        _StringCbCatW@12 (771775A7h)  
771154AF 68 9C 80 11 77       push        offset string L""" (7711809Ch)  
771154B4 8B D7                mov         edx,edi  
771154B6 8B CE                mov         ecx,esi                           ; esi = wsCommandLine
771154B8 E8 EA 20 06 00       call        _StringCbCatW@12 (771775A7h)  
771154BD 80 BD AF FD FF FF 00 cmp         byte ptr [ebp-251h],0  
771154C4 74 19                je          771154DF  --->
771154C6 8B 85 70 FD FF FF    mov         eax,dword ptr [ebp-290h]  
771154CC 8B 8D 24 FD FF FF    mov         ecx,dword ptr [ebp-2DCh]  
771154D2 66 89 08             mov         word ptr [eax],cx  
771154D5 50                   push        eax  
771154D6 8B D7                mov         edx,edi  
771154D8 8B CE                mov         ecx,esi  
771154DA E8 C8 20 06 00       call        _StringCbCatW@12 (771775A7h)  
771154DF 8B 85 30 FD FF FF    mov         eax,dword ptr [ebp-2D0h] <--- 
771154E5 89 85 98 FD FF FF    mov         dword ptr [ebp-268h],eax          ; pwsCommandLine268 := 0x00a5ebe8 = ""C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe""
771154EB E9 56 73 FE FF       jmp         770FC846  
...
770FC846 53                   push        ebx  
770FC847 53                   push        ebx  
770FC848 8D 85 58 FD FF FF    lea         eax,[ebp-2A8h]                    ; eax := &usNtModuleName2A8 = 0x0065e6a0
770FC84E 50                   push        eax  
770FC84F FF B5 B0 FD FF FF    push        dword ptr [ebp-250h]      ; PCWSTR DosPathName = L"C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe"
-- ====================================================================================================
NTSYSAPI
BOOLEAN 
NTAPI
RtlDosPathNameToNtPathName_U(
	IN PCWSTR DosPathName,
	OUT PUNICODE_STRING NtPathName,
	OUT PWSTR* FilePartInNtPathName OPTIONAL,
	OUT PRELATIVE_NAME RelativeName OPTIONAL
	);
0x0065E3A4  00a5e950 0065e6a0 00000000 00000000
-- ====================================================================================================
770FC855 FF 15 0C 01 18 77    call        dword ptr [__imp__RtlDosPathNameToNtPathName_U@16 (7718010Ch)]  
-- ====================================================================================================
0x0065E6A0  00780076 00a5ec78
0x00A5EC78  \??\C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe
-- ====================================================================================================
770FC85B 84 C0                test        al,al  
770FC85D 0F 85 94 8C 01 00    jne         771154F7  --->...
770FC863 E9 88 8C 01 00       jmp         771154F0  
...
771154F7 FF B5 B0 FD FF FF    push        dword ptr [ebp-250h] = 00a5e950 = L"C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe"
771154FD 8D 85 D4 FC FF FF    lea         eax,[ebp-32Ch]    ; eax := &usApplicationPath = 0x0065e61c
77115503 50                   push        eax
77115504 FF 15 3C 00 18 77    call        dword ptr [__imp__RtlInitUnicodeStringEx@8 (7718003Ch)]  
7711550A E9 59 73 FE FF       jmp         770FC868  
...
770FC868 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FC86E 85 C0                test        eax,eax  
770FC870 0F 88 5B 04 00 00    js          770FCCD1  
770FC876 FF B5 B0 FD FF FF    push        dword ptr [ebp-250h]  
-- ====================================================================================================
NTSYSAPI                                            
DOS_PATHNAME_TYPE
NTAPI                                               
RtlDetermineDosPathNameType_U(
	IN PCWSTR PathName
	);
-- ====================================================================================================
770FC87C FF 15 1C 01 18 77    call        dword ptr [__imp__RtlDetermineDosPathNameType_U@4 (7718011Ch)]  
770FC882 89 85 B0 FB FF FF    mov         dword ptr [ebp-450h],eax  
770FC888 83 F8 02             cmp         eax,2 ; = Path_DeviceRootDir,// "x:\"
770FC88B 0F 84 8D 8C 01 00    je          7711551E  --->...
770FC891 E9 79 8C 01 00       jmp         7711550F  
...
7711551E 8D 8D D4 FC FF FF    lea         ecx,[ebp-32Ch]    ; ecx := &usApplicationPath = 0055E720
77115524 E8 84 74 FE FF       call        _BasepAdjustApplicationPath@4 (770FC9ADh)  
77115529 E9 60 82 FE FF       jmp         770FD78E  
...
770FD78E 85 C0                test        eax,eax  = 1
770FD790 0F 84 98 7D 01 00    je          7711552E  
770FD796 66 83 BD 4C FD FF FF 00 cmp         word ptr [ebp-2B4h],0  
770FD79E 0F 95 C1             setne       cl  
770FD7A1 8B 85 A4 FD FF FF    mov         eax,dword ptr [ebp-25Ch]  
770FD7A7 85 C0                test        eax,eax  
770FD7A9 0F 85 E4 7D 01 00    jne         77115593  
770FD7AF 8B C3                mov         eax,ebx  
770FD7B1 FF B5 64 FC FF FF    push        dword ptr [ebp-39Ch]  
770FD7B7 8B B5 A0 FD FF FF    mov         esi,dword ptr [ebp-260h]  
770FD7BD 56                   push        esi  
770FD7BE FF B5 1C FD FF FF    push        dword ptr [ebp-2E4h]  
770FD7C4 FF B5 B8 FD FF FF    push        dword ptr [ebp-248h]  
770FD7CA 8D 95 F4 FA FF FF    lea         edx,[ebp-50Ch]  
770FD7D0 52                   push        edx  
770FD7D1 FF B5 90 FD FF FF    push        dword ptr [ebp-270h]  
770FD7D7 51                   push        ecx  
770FD7D8 50                   push        eax  
770FD7D9 FF B5 98 FD FF FF    push        dword ptr [ebp-268h]  
770FD7DF FF B5 84 FD FF FF    push        dword ptr [ebp-27Ch]  
770FD7E5 8D 95 D4 FC FF FF    lea         edx,[ebp-32Ch]  
770FD7EB 8B 8D B0 FD FF FF    mov         ecx,dword ptr [ebp-250h]  
-- ====================================================================================================
		ECX	00A5E950	
		EDX	0065E61C	
0x0065E38C  00000000 00a5ebe8 00000000 0065e600 00000000
0x0065E3A0  0065e43c 00000404 00000000 00000000 00000000
0x0065E3B4  c24eed04 00000000 00000000 7f338000 0000004a
-- ====================================================================================================
770FD7F1 E8 8B 00 00 00       call        _BasepCreateProcessParameters@48 (770FD881h)  
-- ====================================================================================================
typedef struct __RTL_USER_PROCESS_PARAMETERS_
{
    ULONG AllocationSize;                // 0000 = 620h
    ULONG ActualSize;                    // 0004 = 620h
    ULONG Flags; // PPFLAG_xxx           // 0008 = 00000001 (PPFLAG_NORMALIZED)
    ULONG dwDebug;                       // 000C = 00000000
    PVOID ConsoleHandle;                 // 0010 = 00000028
    ULONG ConsoleFlags;                  // 0014 = 00000000
    HANDLE InputHandle;                  // 0018 = 00000000
    HANDLE OutputHandle;                 // 001C = 00000000
    HANDLE ErrorHandle;                  // 0020 = 00000000
    UNICODE_STRING CurrentDirectory;     // 0024 = "C:\vs12projects\ReplaceAPI\TestListEntryAPI\"
    HANDLE CurrentDir;                   // 002C = 00000000
    UNICODE_STRING SearchPaths;          // 0030 = {00000000,00000000}
    UNICODE_STRING ImagePathName;        // 0038 = "C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe"
    UNICODE_STRING CommandLine;          // 0040 = ""C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe""
    PVOID EnvironmentBlock;              // 0048 = 00a65df0
    ULONG dwX;                           // 004C = 00000000
    ULONG dwY;                           // 0050 = 00000000
    ULONG dwXSize;                       // 0054 = 00000000
    ULONG dwYSize;                       // 0058 = 00000000
    ULONG dwXCountChars;                 // 005C = 00000000
    ULONG dwYCountChars;                 // 0060 = 00000000
    ULONG dwFillAttribute;               // 0064 = 00000000
    ULONG dwFlags;                       // 0068 = 00000000
    ULONG dwShowWindow;                  // 006C = 00000000
    UNICODE_STRING usConsoleTitle;       // 0070 = "C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe"
    UNICODE_STRING usDesktop;            // 0078 = "WinSta0\Default"
    UNICODE_STRING usShellInfo;          // 0080 = ""
    UNICODE_STRING usRuntimeData;        // 0088 = {00000000,00000000}
    RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory [0x20]; // 0090 = {0}
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
0x00A657D0  00000620 00000620 00000001 00000000 00000028  ........(.
0x00A657E4  00000000 00000000 00000000 00000000 02080058  ........XȈ
0x00A657F8  00a65a70 00000000 00000000 00000000 0070006e  婰¦......np
0x00A6580C  00a65c78 00740072 00a65ce8 00a65df0 00000000  屸¦rt峨¦巰¦..
0x00A65820  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65834  00000000 00000000 00000000 0070006e 00a65d5c  ......np嵜¦
0x00A65848  0020001e 00a65dcc 00020000 00a65dec>00000000  . 巌¦..巬¦..
0x00A6585C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65870  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65884  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65898  00000000 00000000 00000000 00000000 00000000  ..........
0x00A658AC  00000000 00000000 00000000 00000000 00000000  ..........
0x00A658C0  00000000 00000000 00000000 00000000 00000000  ..........
0x00A658D4  00000000 00000000 00000000 00000000 00000000  ..........
0x00A658E8  00000000 00000000 00000000 00000000 00000000  ..........
0x00A658FC  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65910  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65924  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65938  00000000 00000000 00000000 00000000 00000000  ..........
0x00A6594C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65960  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65974  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65988  00000000 00000000 00000000 00000000 00000000  ..........
0x00A6599C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A659B0  00000000 00000000 00000000 00000000 00000000  ..........
0x00A659C4  00000000 00000000 00000000 00000000 00000000  ..........
0x00A659D8  00000000 00000000 00000000 00000000 00000000  ..........
0x00A659EC  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65A00  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65A14  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65A28  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65A3C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65A50  00000000 00000000 00000000 00000000 000018e8  ..........
0x00A65A64  00000000 00000000 00000238 003a0043 0076005c  ....ȸ.C:\v
0x00A65A78  00310073 00700032 006f0072 0065006a 00740063  s12project
0x00A65A8C  005c0073 00650052 006c0070 00630061 00410065  s\ReplaceA
0x00A65AA0  00490050 0054005c 00730065 004c0074 00730069  PI\TestLis
0x00A65AB4  00450074 0074006e 00790072 00500041 005c0049  tEntryAPI\
0x00A65AC8  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65ADC  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65AF0  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B04  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B18  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B2C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B40  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B54  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B68  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B7C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65B90  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65BA4  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65BB8  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65BCC  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65BE0  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65BF4  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65C08  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65C1C  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65C30  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65C44  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65C58  00000000 00000000 00000000 00000000 00000000  ..........
0x00A65C6C  00000000 00000000 00000000 003a0043 0076005c  ......C:\v
0x00A65C80  00310073 00700032 006f0072 0065006a 00740063  s12project
0x00A65C94  005c0073 00650052 006c0070 00630061 00410065  s\ReplaceA
0x00A65CA8  00490050 0057005c 006e0069 002e0038 00440031  PI\Win8.1D
0x00A65CBC  00620065 00670075 0044005c 0053004e 00750051  ebug\DNSQu
0x00A65CD0  00720065 00540079 00730065 002e0074 00780065  eryTest.ex
0x00A65CE4  00000065 00430022 005c003a 00730076 00320031  e."C:\vs12
0x00A65CF8  00720070 006a006f 00630065 00730074 0052005c  projects\R
0x00A65D0C  00700065 0061006c 00650063 00500041 005c0049  eplaceAPI\
0x00A65D20  00690057 0038006e 0031002e 00650044 00750062  Win8.1Debu
0x00A65D34  005c0067 004e0044 00510053 00650075 00790072  g\DNSQuery
0x00A65D48  00650054 00740073 0065002e 00650078 00000022  Test.exe".
0x00A65D5C  003a0043 0076005c 00310073 00700032 006f0072  C:\vs12pro
0x00A65D70  0065006a 00740063 005c0073 00650052 006c0070  jects\Repl
0x00A65D84  00630061 00410065 00490050 0057005c 006e0069  aceAPI\Win
0x00A65D98  002e0038 00440031 00620065 00670075 0044005c  8.1Debug\D
0x00A65DAC  0053004e 00750051 00720065 00540079 00730065  NSQueryTes
0x00A65DC0  002e0074 00780065 00000065 00690057 0053006e  t.exe.WinS
0x00A65DD4  00610074 005c0030 00650044 00610066 006c0075  ta0\Defaul
0x00A65DE8  00000074 baad0000                             t..몭
-- ====================================================================================================
770FD7F6 8B F8                mov         edi,eax                       ; edi := pPP = 0x00A657D0
770FD7F8 89 BD 70 FB FF FF    mov         dword ptr [ebp-490h],edi      ; pProcParams490 := 0x00A657D0
770FD7FE 85 FF                test        edi,edi  
770FD800 0F 84 BB 77 01 00    je          77114FC1  
770FD806 8B 85 5C FD FF FF    mov         eax,dword ptr [ebp-2A4h]      ; eax := usNtModuleName2A8.Buffer 0x00a5ec78
770FD80C 8D 8D C0 FE FF FF    lea         ecx,[ebp-140h]                ; ecx := &stAttributeList140 = 0x0065e808
770FD812 89 41 0C             mov         dword ptr [ecx+0Ch],eax       ; stAttributeList140.Attributes[0].ValuePtr := 0x00a5ec78
770FD815 0F B7 85 58 FD FF FF movzx       eax,word ptr [ebp-2A8h]       ; eax := usNtModuleName2A8.Length = 0x00000076
770FD81C 89 41 08             mov         dword ptr [ecx+8],eax         ; stAttributeList140.Attributes[0].Size = 0x00000076
770FD81F 8B 85 14 FD FF FF    mov         eax,dword ptr [ebp-2ECh]      ; eax := nAttributes2EC = 4
770FD825 C1 E0 04             shl         eax,4  
770FD828 83 C0 04             add         eax,4                         ; eax := 0x00000044
770FD82B 89 01                mov         dword ptr [ecx],eax           ; stAttributeList140.TotalLength = 0x00000044
770FD82D 51                   push        ecx  
770FD82E 8D 85 00 FC FF FF    lea         eax,[ebp-400h]  
770FD834 50                   push        eax  
770FD835 57                   push        edi  
770FD836 6A 01                push        1  
770FD838 56                   push        esi  
770FD839 FF B5 CC FB FF FF    push        dword ptr [ebp-434h]  
770FD83F FF B5 A8 FB FF FF    push        dword ptr [ebp-458h]  
770FD845 B8 00 00 00 02       mov         eax,2000000h  
770FD84A 50                   push        eax  
770FD84B 50                   push        eax  
770FD84C 8D 85 74 FD FF FF    lea         eax,[ebp-28Ch]  
770FD852 50                   push        eax  
770FD853 8D 85 BC FD FF FF    lea         eax,[ebp-244h]  
770FD859 50                   push        eax  
-- ====================================================================================================
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateUserProcess(
    __out PHANDLE ProcessHandle,                                // = 0065e704
    __out PHANDLE ThreadHandle,                                 // = 0065e6bc
    __in ACCESS_MASK ProcessDesiredAccess,                      // = 02000000
    __in ACCESS_MASK ThreadDesiredAccess,                       // = 02000000
    __in_opt POBJECT_ATTRIBUTES ProcessObjectAttributes,        // = 00000000
    __in_opt POBJECT_ATTRIBUTES ThreadObjectAttributes,         // = 00000000
    __in ULONG ProcessFlags, // PROCESS_CREATE_FLAGS_*          // = 00000000
    __in ULONG ThreadFlags,  // THREAD_CREATE_FLAGS_*           // = 00000001
    __in_opt PRTL_USER_PROCESS_PARAMETERS ProcessParameters,    // = 00a657d0
    __inout PPS_CREATE_INFO CreateInfo,                         // = 0065e548
    __in_opt PPS_ATTRIBUTE_LIST AttributeList                   // = 0065e808
    );
0x0065E388  0065e704 0065e6bc 02000000 02000000 00000000
0x0065E39C  00000000 00000000 00000001 00a657d0 0065e548
0x0065E3B0  0065e808

0x0065E808  00000044 00020005 00000076 00a5ec78 00000000
0x0065E81C  00010003 00000008 0065e5b0 00000000 00000006
0x0065E830  00000030 0065e480 00000000 0002000a 00000008
0x0065E844  0065e540 00000000

; stAttributeList140.Attributes[0] = {00020005,00000076,00a5ec78,00000000}
0x00A5EC78  "\??\C:\vs12projects\ReplaceAPI\Win8.1Debug\DNSQueryTest.exe"

; stAttributeList140.Attributes[1] = {00010003,00000008,0065e5b0,00000000}
0x0065E5B0  00a50000 00000000

; stAttributeList140.Attributes[2] = {00000006,00000030,0065e480,00000000}
0x0065E480  000016d0 00a5ebe0 000006dc 00a5ebe0 86040082
0x0065E494  00000303 00a50260 00a50000 000001fc 000006dc
0x0065E4A8  00a5ebe8 000006dc

; stAttributeList140.Attributes[3] = {0002000a,00000008,0065e540,00000000}
0x0065E540  00a50001 00000003
-- ====================================================================================================
770FD85A FF 15 B8 07 18 77    call        dword ptr [__imp__NtCreateUserProcess@44 (771807B8h)]  
-- ------------------------------------------------------------------------------------------------
_NtCreateUserProcess@44:
7750D8B0 B8 B7 00 00 00       mov         eax,0B7h  
7750D8B5 64 FF 15 C0 00 00 00 call        dword ptr fs:[0C0h]  
7750D8BC C2 2C 00             ret         2Ch  
-- ------------------------------------------------------------------------------------------------
770FD860 8B F0                mov         esi,eax  
770FD862 89 B5 C0 FD FF FF    mov         dword ptr [ebp-240h],esi  
770FD868 57                   push        edi  
770FD869 FF 15 A0 07 18 77    call        dword ptr [__imp__RtlDestroyProcessParameters@4 (771807A0h)]  
770FD86F 85 F6                test        esi,esi  
770FD871 0F 89 73 83 01 00    jns         77115BEA  --->...
770FD877 E9 1F 7D 01 00       jmp         7711559B  
...
77115BEA 8B 85 0C FC FF FF    mov         eax,dword ptr [ebp-3F4h]  
77115BF0 89 85 88 FD FF FF    mov         dword ptr [ebp-278h],eax  
77115BF6 8B 85 10 FC FF FF    mov         eax,dword ptr [ebp-3F0h]  
77115BFC 89 85 18 FD FF FF    mov         dword ptr [ebp-2E8h],eax  
77115C02 83 BD 48 FB FF FF 02 cmp         dword ptr [ebp-4B8h],2  
77115C09 0F 84 FD 7A FE FF    je          770FD70C  --->...
77115C0F E9 D5 37 FF FF       jmp         771093E9  
...
770FD70C 0F B7 95 4C FB FF FF movzx       edx,word ptr [ebp-4B4h]  
770FD713 0F B7 8D 4E FB FF FF movzx       ecx,word ptr [ebp-4B2h]  
770FD71A E8 49 00 00 00       call        _BasepCheckImageVersion@8 (770FD768h)  
770FD71F 85 C0                test        eax,eax  
770FD721 0F 84 1F 80 01 00    je          77115746  
770FD727 F6 85 08 FC FF FF 08 test        byte ptr [ebp-3F8h],8  
770FD72E 0F 85 ED BC FF FF    jne         770F9421  --->...
770FD734 E8 F6 FC FF FF       call        770FD42F  <-------
770FD739 84 C0                test        al,al  
770FD73B 0F 84 F6 F5 FF FF    je          770FCD37  
770FD741 FF B5 88 FD FF FF    push        dword ptr [ebp-278h]  
770FD747 FF 15 78 D2 17 77    call        dword ptr [__imp__BasepCheckWebBladeHashes@4 (7717D278h)]  
770FD74D 89 85 A8 FD FF FF    mov         dword ptr [ebp-258h],eax  
770FD753 3D 22 00 00 C0       cmp         eax,0C0000022h    ; #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
770FD758 0F 85 E0 F5 FF FF    jne         770FCD3E  --->...
770FD75E E9 BB 84 01 00       jmp         77115C1E  
...
770F9421 8B 85 38 FC FF FF    mov         eax,dword ptr [ebp-3C8h]  
770F9427 89 85 5C FC FF FF    mov         dword ptr [ebp-3A4h],eax  
770F942D 8B 85 3C FC FF FF    mov         eax,dword ptr [ebp-3C4h]  
770F9433 89 85 60 FC FF FF    mov         dword ptr [ebp-3A0h],eax  
770F9439 8B 85 40 FC FF FF    mov         eax,dword ptr [ebp-3C0h]  
770F943F 89 85 4C FC FF FF    mov         dword ptr [ebp-3B4h],eax  
770F9445 E9 EA 42 00 00       jmp         770FD734  -------->
...
770FCD3E 85 C0                test        eax,eax  
770FCD40 0F 89 C0 01 00 00    jns         770FCF06  --->...
770FCD46 E9 DD 8E 01 00       jmp         77115C28  
...
770FCF06 E8 24 05 00 00       call        770FD42F  
770FCF0B 84 C0                test        al,al  
770FCF0D 0F 84 38 FE FF FF    je          770FCD4B  
770FCF13 FF B5 B0 FD FF FF    push        dword ptr [ebp-250h]  
770FCF19 FF 15 C8 D2 17 77    call        dword ptr [__imp__BasepIsProcessAllowed@4 (7717D2C8h)]  
770FCF1F 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FCF25 85 C0                test        eax,eax  
770FCF27 0F 88 A4 FD FF FF    js          770FCCD1  
770FCF2D 80 BD 9E FD FF FF 00 cmp         byte ptr [ebp-262h],0  
770FCF34 75 17                jne         770FCF4D  
770FCF36 BE 00 08 00 00       mov         esi,800h  
770FCF3B 85 B5 B8 FD FF FF    test        dword ptr [ebp-248h],esi  
770FCF41 74 0A                je          770FCF4D  --->
770FCF43 81 A5 B8 FD FF FF FF F7 FF FF and         dword ptr [ebp-248h],0FFFFF7FFh  
770FCF4D 83 BD 64 FD FF FF 00 cmp         dword ptr [ebp-29Ch],0  <---
770FCF54 0F 84 31 8D 01 00    je          77115C8B  --->...
770FCF5A E9 D3 8C 01 00       jmp         77115C32  
...
77115C8B 8B 85 30 FC FF FF    mov         eax,dword ptr [ebp-3D0h]  
77115C91 89 85 F0 FC FF FF    mov         dword ptr [ebp-310h],eax  
77115C97 89 85 7C FB FF FF    mov         dword ptr [ebp-484h],eax  
77115C9D 80 BD B7 FD FF FF 00 cmp         byte ptr [ebp-249h],0  
77115CA4 0F 84 EC 6B FE FF    je          770FC896  --->
77115CAA E9 2E 6C FE FF       jmp         770FC8DD  
770FC896 F7 85 B8 FD FF FF 00 00 00 02 test dword ptr [ebp-248h],2000000h  <---
770FC8A0 75 3B                jne         770FC8DD  
770FC8A2 E8 88 0B 00 00       call        770FD42F  
770FC8A7 84 C0                test        al,al  
770FC8A9 0F 84 A3 04 00 00    je          770FCD52  
770FC8AF 8D 85 4C FD FF FF    lea         eax,[ebp-2B4h]  
770FC8B5 50                   push        eax  
770FC8B6 FF B5 88 FD FF FF    push        dword ptr [ebp-278h]  
770FC8BC FF B5 B0 FD FF FF    push        dword ptr [ebp-250h]  
770FC8C2 8B BD 94 FD FF FF    mov         edi,dword ptr [ebp-26Ch]  
770FC8C8 57                   push        edi  
770FC8C9 FF 15 A0 D2 17 77    call        dword ptr [__imp__BasepCheckWinSaferRestrictions@16 (7717D2A0h)]  
770FC8CF 89 85 B4 FC FF FF    mov         dword ptr [ebp-34Ch],eax  
770FC8D5 85 C0                test        eax,eax  
770FC8D7 0F 88 F4 03 00 00    js          770FCCD1  
770FC8DD 8D BD 08 FE FF FF    lea         edi,[ebp-1F8h]  
770FC8E3 83 C7 20             add         edi,20h  
770FC8E6 68 88 00 00 00       push        88h  
770FC8EB 53                   push        ebx  
770FC8EC 57                   push        edi  
770FC8ED E8 94 0C FD FF       call        _memset (770CD586h)  
770FC8F2 83 C4 0C             add         esp,0Ch  
770FC8F5 0F B7 8D 58 FB FF FF movzx       ecx,word ptr [ebp-4A8h]  
770FC8FC 8B C1                mov         eax,ecx  
770FC8FE 2D 4C 01 00 00       sub         eax,14Ch  
770FC903 0F 85 AB 5E 01 00    jne         771127B4  
770FC909 F6 85 08 FC FF FF 02 test        byte ptr [ebp-3F8h],2  
770FC910 0F 84 D1 93 01 00    je          77115CE7  --->...
770FC916 E9 C0 93 01 00       jmp         77115CDB  
...
77115CE7 C7 85 60 FD FF FF 0A 00 00 00 mov dword ptr [ebp-2A0h],0Ah  
77115CF1 E9 13 6D FE FF       jmp         770FCA09  
...
770FCA09 BE FF FF 00 00       mov         esi,0FFFFh  
770FCA0E F6 85 08 FC FF FF 01 test        byte ptr [ebp-3F8h],1  
770FCA15 0F 85 B4 00 00 00    jne         770FCACF  
770FCA1B 80 BD B7 FD FF FF 00 cmp         byte ptr [ebp-249h],0  
770FCA22 0F 85 CE 92 01 00    jne         77115CF6  
770FCA28 E8 02 0A 00 00       call        770FD42F  
770FCA2D 84 C0                test        al,al  
770FCA2F 0F 84 9A 00 00 00    je          770FCACF  
770FCA35 8D 85 50 FC FF FF    lea         eax,[ebp-3B0h]  
770FCA3B 50                   push        eax  
770FCA3C 8D 85 8C FC FF FF    lea         eax,[ebp-374h]  
770FCA42 50                   push        eax  
770FCA43 8D 85 C4 FC FF FF    lea         eax,[ebp-33Ch]  
770FCA49 50                   push        eax  
770FCA4A 8D 85 BC FC FF FF    lea         eax,[ebp-344h]  
770FCA50 50                   push        eax  
770FCA51 8D 85 E0 FC FF FF    lea         eax,[ebp-320h]  
770FCA57 50                   push        eax  
770FCA58 8D 85 90 FC FF FF    lea         eax,[ebp-370h]  
770FCA5E 50                   push        eax  
770FCA5F 8D 85 C0 FC FF FF    lea         eax,[ebp-340h]  
770FCA65 50                   push        eax  
770FCA66 8D 85 A4 FC FF FF    lea         eax,[ebp-35Ch]  
770FCA6C 50                   push        eax  
770FCA6D 8D 85 EC FC FF FF    lea         eax,[ebp-314h]  
770FCA73 50                   push        eax  
770FCA74 8D 85 B8 FC FF FF    lea         eax,[ebp-348h]  
770FCA7A 50                   push        eax  
770FCA7B 8D 85 D0 FC FF FF    lea         eax,[ebp-330h]  
770FCA81 50                   push        eax  
770FCA82 8D 85 4C FD FF FF    lea         eax,[ebp-2B4h]  
770FCA88 50                   push        eax  
770FCA89 FF B5 90 FD FF FF    push        dword ptr [ebp-270h]  
770FCA8F FF B5 5C FD FF FF    push        dword ptr [ebp-2A4h]  
770FCA95 FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FCA9B FF B5 88 FD FF FF    push        dword ptr [ebp-278h]  
770FCAA1 FF B5 60 FD FF FF    push        dword ptr [ebp-2A0h]  
770FCAA7 0F B6 85 08 FC FF FF movzx       eax,byte ptr [ebp-3F8h]  
770FCAAE D1 E8                shr         eax,1  
770FCAB0 83 E0 01             and         eax,1  
770FCAB3 50                   push        eax  
770FCAB4 8D 85 38 FB FF FF    lea         eax,[ebp-4C8h]  
770FCABA 50                   push        eax  
770FCABB FF B5 18 FD FF FF    push        dword ptr [ebp-2E8h]  
770FCAC1 FF 15 C4 D2 17 77    call        dword ptr [__imp__BasepQueryAppCompat@80 (7717D2C4h)]  
770FCAC7 85 C0                test        eax,eax  
770FCAC9 0F 84 F2 84 01 00    je          77114FC1  
770FCACF 8A 85 08 FC FF FF    mov         al,byte ptr [ebp-3F8h]  
770FCAD5 A8 01                test        al,1  
770FCAD7 0F 85 84 02 00 00    jne         770FCD61  
770FCADD 8B 85 24 FC FF FF    mov         eax,dword ptr [ebp-3DCh]  
770FCAE3 89 85 88 FC FF FF    mov         dword ptr [ebp-378h],eax  
770FCAE9 8D 8D 08 FE FF FF    lea         ecx,[ebp-1F8h]  
770FCAEF 89 41 24             mov         dword ptr [ecx+24h],eax  
770FCAF2 66 89 B1 94 00 00 00 mov         word ptr [ecx+94h],si  
770FCAF9 E8 31 09 00 00       call        770FD42F  
770FCAFE 84 C0                test        al,al  
770FCB00 0F 84 68 02 00 00    je          770FCD6E  
770FCB06 8B 85 A4 FD FF FF    mov         eax,dword ptr [ebp-25Ch]  
770FCB0C 85 C0                test        eax,eax  
770FCB0E 0F 85 F4 91 01 00    jne         77115D08  
770FCB14 8B D3                mov         edx,ebx  
770FCB16 0F B7 85 56 FB FF FF movzx       eax,word ptr [ebp-4AAh]  
770FCB1D C1 E8 09             shr         eax,9  
770FCB20 83 E0 01             and         eax,1  
770FCB23 0F B6 8D 08 FC FF FF movzx       ecx,byte ptr [ebp-3F8h]  
770FCB2A C1 E9 02             shr         ecx,2  
770FCB2D 83 E1 01             and         ecx,1  
770FCB30 8D B5 AC FA FF FF    lea         esi,[ebp-554h]  
770FCB36 56                   push        esi  
770FCB37 57                   push        edi  
770FCB38 8D B5 88 FC FF FF    lea         esi,[ebp-378h]  
770FCB3E 56                   push        esi  
770FCB3F FF B5 4C FC FF FF    push        dword ptr [ebp-3B4h]  
770FCB45 FF B5 60 FC FF FF    push        dword ptr [ebp-3A0h]  
770FCB4B FF B5 5C FC FF FF    push        dword ptr [ebp-3A4h]  
770FCB51 FF B5 F0 FC FF FF    push        dword ptr [ebp-310h]  
770FCB57 52                   push        edx  
770FCB58 50                   push        eax  
770FCB59 FF B5 A4 FC FF FF    push        dword ptr [ebp-35Ch]  
770FCB5F FF B5 EC FC FF FF    push        dword ptr [ebp-314h]  
770FCB65 FF B5 C0 FC FF FF    push        dword ptr [ebp-340h]  
770FCB6B 51                   push        ecx  
770FCB6C FF B5 C4 FC FF FF    push        dword ptr [ebp-33Ch]  
770FCB72 FF B5 BC FC FF FF    push        dword ptr [ebp-344h]  
770FCB78 FF B5 94 FD FF FF    push        dword ptr [ebp-26Ch]  
770FCB7E FF B5 18 FD FF FF    push        dword ptr [ebp-2E8h]  
770FCB84 FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FCB8A FF B5 88 FD FF FF    push        dword ptr [ebp-278h]  
770FCB90 8D 85 D4 FC FF FF    lea         eax,[ebp-32Ch]  
770FCB96 50                   push        eax  
770FCB97 8D 85 58 FD FF FF    lea         eax,[ebp-2A8h]  
770FCB9D 50                   push        eax  
770FCB9E FF 15 90 D2 17 77    call        dword ptr [__imp__BasepConstructSxsCreateProcessMessage@84 (7717D290h)]  
770FCBA4 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FCBAA 85 C0                test        eax,eax  
770FCBAC 0F 88 1F 01 00 00    js          770FCCD1  
770FCBB2 8B 85 30 FC FF FF    mov         eax,dword ptr [ebp-3D0h]  
770FCBB8 8D BD 08 FE FF FF    lea         edi,[ebp-1F8h]  
770FCBBE 89 87 B0 00 00 00    mov         dword ptr [edi+0B0h],eax  
770FCBC4 8B 85 28 FC FF FF    mov         eax,dword ptr [ebp-3D8h]  
770FCBCA 89 87 A8 00 00 00    mov         dword ptr [edi+0A8h],eax  
770FCBD0 8B 85 2C FC FF FF    mov         eax,dword ptr [ebp-3D4h]  
770FCBD6 89 87 AC 00 00 00    mov         dword ptr [edi+0ACh],eax  
770FCBDC 8B 8D BC FD FF FF    mov         ecx,dword ptr [ebp-244h]  
770FCBE2 89 0F                mov         dword ptr [edi],ecx  
770FCBE4 8B 85 74 FD FF FF    mov         eax,dword ptr [ebp-28Ch]  
770FCBEA 89 47 04             mov         dword ptr [edi+4],eax  
770FCBED 8B 85 68 FC FF FF    mov         eax,dword ptr [ebp-398h]  
770FCBF3 89 47 08             mov         dword ptr [edi+8],eax  
770FCBF6 8B 85 6C FC FF FF    mov         eax,dword ptr [ebp-394h]  
770FCBFC 89 47 0C             mov         dword ptr [edi+0Ch],eax  
770FCBFF 66 8B 85 60 FD FF FF mov         ax,word ptr [ebp-2A0h]  
770FCC06 66 89 87 B4 00 00 00 mov         word ptr [edi+0B4h],ax  
770FCC0D 8B 85 B8 FD FF FF    mov         eax,dword ptr [ebp-248h]  
770FCC13 83 E0 FC             and         eax,0FFFFFFFCh  
770FCC16 89 47 10             mov         dword ptr [edi+10h],eax  
770FCC19 6A 02                push        2  
770FCC1B 58                   pop         eax  
770FCC1C 39 85 48 FB FF FF    cmp         dword ptr [ebp-4B8h],eax  
770FCC22 0F 85 D3 C7 00 00    jne         771093FB  
770FCC28 0B C8                or          ecx,eax  
770FCC2A 89 0F                mov         dword ptr [edi],ecx  
770FCC2C 53                   push        ebx  
770FCC2D E8 C1 57 FD FF       call        _GetModuleHandleA@4 (770D23F3h)  
770FCC32 50                   push        eax  
770FCC33 FF 15 08 03 18 77    call        dword ptr [__imp__RtlImageNtHeader@4 (77180308h)]  
770FCC39 89 85 68 FB FF FF    mov         dword ptr [ebp-498h],eax  
770FCC3F 85 C0                test        eax,eax  
770FCC41 74 0D                je          770FCC50  
770FCC43 6A 02                push        2  
770FCC45 59                   pop         ecx  
770FCC46 66 39 48 5C          cmp         word ptr [eax+5Ch],cx  
770FCC4A 0F 84 A8 35 01 00    je          771101F8  
770FCC50 8B B5 94 FD FF FF    mov         esi,dword ptr [ebp-26Ch]  
770FCC56 85 F6                test        esi,esi  
770FCC58 0F 85 22 39 FF FF    jne         770F0580  
770FCC5E F6 85 20 FB FF FF 40 test        byte ptr [ebp-4E0h],40h  
770FCC65 0F 85 AE 90 01 00    jne         77115D19  
770FCC6B F6 85 20 FB FF FF 80 test        byte ptr [ebp-4E0h],80h  
770FCC72 0F 85 A9 90 01 00    jne         77115D21  
770FCC78 8B 85 64 FD FF FF    mov         eax,dword ptr [ebp-29Ch]  
770FCC7E 89 47 14             mov         dword ptr [edi+14h],eax  
770FCC81 85 C0                test        eax,eax  
770FCC83 0F 85 A0 90 01 00    jne         77115D29  
770FCC89 8A 85 08 FC FF FF    mov         al,byte ptr [ebp-3F8h]  
770FCC8F A8 01                test        al,1  
770FCC91 0F 84 DE 00 00 00    je          770FCD75  --->...
770FCC97 E9 B3 90 01 00       jmp         77115D4F  
...
770FCD75 57                   push        edi  
770FCD76 E8 1E FC FF FF       call        _NtWow64CsrBasepCreateProcess@4 (770FC999h)  
770FCD7B E9 9B FB FF FF       jmp         770FC91B  
...
770FC91B 89 85 00 FE FF FF    mov         dword ptr [ebp-200h],eax  
770FC921 85 C0                test        eax,eax  
770FC923 0F 89 57 04 00 00    jns         770FCD80  --->...
770FC929 E9 32 94 01 00       jmp         77115D60  
...
770FCD80 F6 85 08 FC FF FF 01 test        byte ptr [ebp-3F8h],1  
770FCD87 74 2C                je          770FCDB5  --->...
770FCD89 EB 3F                jmp         770FCDCA  
...
770FCDB5 8B 47 24             mov         eax,dword ptr [edi+24h]  
770FCDB8 89 85 88 FC FF FF    mov         dword ptr [ebp-378h],eax  
770FCDBE 3B 85 24 FC FF FF    cmp         eax,dword ptr [ebp-3DCh]  
770FCDC4 0F 85 CC CB 00 00    jne         77109996  
770FCDCA 80 BD 9D FD FF FF 00 cmp         byte ptr [ebp-263h],0  
770FCDD1 0F 85 D3 8F 01 00    jne         77115DAA  
770FCDD7 F6 85 E8 FC FF FF 02 test        byte ptr [ebp-318h],2  
770FCDDE 0F 85 C6 8F 01 00    jne         77115DAA  
770FCDE4 83 BD 40 FD FF FF 00 cmp         dword ptr [ebp-2C0h],0  
770FCDEB 0F 85 B9 8F 01 00    jne         77115DAA  
770FCDF1 83 8D 20 FD FF FF 01 or          dword ptr [ebp-2E0h],1  
770FCDF8 E8 32 06 00 00       call        770FD42F  
770FCDFD 84 C0                test        al,al  
770FCDFF 74 8A                je          770FCD8B  
770FCE01 53                   push        ebx  
770FCE02 53                   push        ebx  
770FCE03 56                   push        esi  
770FCE04 FF B5 E0 FC FF FF    push        dword ptr [ebp-320h]  
770FCE0A 8D 87 A0 00 00 00    lea         eax,[edi+0A0h]  
770FCE10 50                   push        eax  
770FCE11 8D 87 88 00 00 00    lea         eax,[edi+88h]  
770FCE17 50                   push        eax  
770FCE18 FF B5 94 FC FF FF    push        dword ptr [ebp-36Ch]  
770FCE1E FF B5 90 FC FF FF    push        dword ptr [ebp-370h]  
770FCE24 8D 85 20 FD FF FF    lea         eax,[ebp-2E0h]  
770FCE2A 50                   push        eax  
770FCE2B FF B5 D8 FC FF FF    push        dword ptr [ebp-328h]  
770FCE31 FF B5 88 FD FF FF    push        dword ptr [ebp-278h]  
770FCE37 FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FCE3D FF 15 98 D2 17 77    call        dword ptr [__imp__BaseCheckElevation@48 (7717D298h)]  
770FCE43 8B F0                mov         esi,eax  
770FCE45 89 B5 C0 FD FF FF    mov         dword ptr [ebp-240h],esi  
770FCE4B 85 F6                test        esi,esi  
770FCE4D 0F 89 57 8F 01 00    jns         77115DAA  --->...
770FCE53 E9 20 8F 01 00       jmp         77115D78  
...
77115DAA F6 85 08 FC FF FF 01 test        byte ptr [ebp-3F8h],1  
77115DB1 0F 84 1B 74 FE FF    je          770FD1D2  --->...
77115DB7 E9 D6 6F FE FF       jmp         770FCD92  
...
770FD1D2 E8 58 02 00 00       call        770FD42F  
770FD1D7 84 C0                test        al,al  
770FD1D9 0F 84 8E 00 00 00    je          770FD26D  
770FD1DF 8D 85 B0 FC FF FF    lea         eax,[ebp-350h]  
770FD1E5 50                   push        eax  
770FD1E6 8D 85 DC FC FF FF    lea         eax,[ebp-324h]  
770FD1EC 50                   push        eax  
770FD1ED 8D 85 B8 FC FF FF    lea         eax,[ebp-348h]  
770FD1F3 50                   push        eax  
770FD1F4 8D 85 D0 FC FF FF    lea         eax,[ebp-330h]  
770FD1FA 50                   push        eax  
770FD1FB FF B5 54 FC FF FF    push        dword ptr [ebp-3ACh]  
770FD201 FF B5 50 FC FF FF    push        dword ptr [ebp-3B0h]  
770FD207 FF B5 8C FC FF FF    push        dword ptr [ebp-374h]  
770FD20D FF B5 60 FD FF FF    push        dword ptr [ebp-2A0h]  
770FD213 0F B6 85 08 FC FF FF movzx       eax,byte ptr [ebp-3F8h]  
770FD21A D1 E8                shr         eax,1  
770FD21C 83 E0 01             and         eax,1  
770FD21F 50                   push        eax  
770FD220 8D 85 38 FB FF FF    lea         eax,[ebp-4C8h]  
770FD226 50                   push        eax  
770FD227 FF B5 E0 FC FF FF    push        dword ptr [ebp-320h]  
770FD22D 8D 87 A0 00 00 00    lea         eax,[edi+0A0h]  
770FD233 50                   push        eax  
770FD234 8D 87 94 00 00 00    lea         eax,[edi+94h]  
770FD23A 50                   push        eax  
770FD23B 8D 87 88 00 00 00    lea         eax,[edi+88h]  
770FD241 50                   push        eax  
770FD242 FF B5 94 FC FF FF    push        dword ptr [ebp-36Ch]  
770FD248 FF B5 90 FC FF FF    push        dword ptr [ebp-370h]  
770FD24E 8D 85 20 FD FF FF    lea         eax,[ebp-2E0h]  
770FD254 50                   push        eax  
770FD255 FF B5 50 FD FF FF    push        dword ptr [ebp-2B0h]  
770FD25B FF B5 D8 FC FF FF    push        dword ptr [ebp-328h]  
770FD261 FF B5 88 FD FF FF    push        dword ptr [ebp-278h]  
770FD267 FF 15 A8 D2 17 77    call        dword ptr [__imp__BasepGetAppCompatData@80 (7717D2A8h)]  
770FD26D 83 BD DC FC FF FF 00 cmp         dword ptr [ebp-324h],0  
770FD274 0F 84 18 FB FF FF    je          770FCD92  
770FD27A 89 9D 78 FC FF FF    mov         dword ptr [ebp-388h],ebx  
770FD280 89 9D 7C FC FF FF    mov         dword ptr [ebp-384h],ebx  
770FD286 8B 85 B0 FC FF FF    mov         eax,dword ptr [ebp-350h]  
770FD28C 89 85 90 FB FF FF    mov         dword ptr [ebp-470h],eax  
770FD292 89 9D 94 FB FF FF    mov         dword ptr [ebp-46Ch],ebx  
770FD298 6A 04                push        4  
770FD29A 68 00 10 00 00       push        1000h  
770FD29F 8D 85 90 FB FF FF    lea         eax,[ebp-470h]  
770FD2A5 50                   push        eax  
770FD2A6 53                   push        ebx  
770FD2A7 53                   push        ebx  
770FD2A8 8D 85 78 FC FF FF    lea         eax,[ebp-388h]  
770FD2AE 50                   push        eax  
770FD2AF FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FD2B5 FF 15 C0 07 18 77    call        dword ptr [__imp__NtWow64AllocateVirtualMemory64@28 (771807C0h)]  
770FD2BB 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FD2C1 85 C0                test        eax,eax  
770FD2C3 0F 88 08 FA FF FF    js          770FCCD1  
770FD2C9 53                   push        ebx  
770FD2CA 53                   push        ebx  
770FD2CB FF B5 B0 FC FF FF    push        dword ptr [ebp-350h]  
770FD2D1 FF B5 DC FC FF FF    push        dword ptr [ebp-324h]  
770FD2D7 FF B5 7C FC FF FF    push        dword ptr [ebp-384h]  
770FD2DD FF B5 78 FC FF FF    push        dword ptr [ebp-388h]  
770FD2E3 FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FD2E9 8B 35 A4 07 18 77    mov         esi,dword ptr [__imp__NtWow64WriteVirtualMemory64@28 (771807A4h)]  
770FD2EF FF D6                call        esi  
770FD2F1 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FD2F7 85 C0                test        eax,eax  
770FD2F9 0F 88 D2 F9 FF FF    js          770FCCD1  
770FD2FF 53                   push        ebx  
770FD300 53                   push        ebx  
770FD301 6A 08                push        8  
770FD303 5F                   pop         edi  
770FD304 57                   push        edi  
770FD305 8D 85 78 FC FF FF    lea         eax,[ebp-388h]  
770FD30B 50                   push        eax  
770FD30C 8B 8D 28 FC FF FF    mov         ecx,dword ptr [ebp-3D8h]  
770FD312 81 C1 D8 02 00 00    add         ecx,2D8h  
770FD318 8B 85 2C FC FF FF    mov         eax,dword ptr [ebp-3D4h]  
770FD31E 13 C3                adc         eax,ebx  
770FD320 50                   push        eax  
770FD321 51                   push        ecx  
770FD322 FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FD328 FF D6                call        esi  
770FD32A 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FD330 85 C0                test        eax,eax  
770FD332 0F 88 99 F9 FF FF    js          770FCCD1  
770FD338 8B 8D 30 FC FF FF    mov         ecx,dword ptr [ebp-3D0h]  
770FD33E 85 C9                test        ecx,ecx  
770FD340 74 2F                je          770FD371  
770FD342 8B 85 78 FC FF FF    mov         eax,dword ptr [ebp-388h]  
770FD348 89 85 C0 FB FF FF    mov         dword ptr [ebp-440h],eax  
770FD34E 53                   push        ebx  
770FD34F 6A 04                push        4  
770FD351 8D 85 C0 FB FF FF    lea         eax,[ebp-440h]  
770FD357 50                   push        eax  
770FD358 8D 81 E8 01 00 00    lea         eax,[ecx+1E8h]  
770FD35E 50                   push        eax  
770FD35F FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FD365 FF 15 08 06 18 77    call        dword ptr [__imp__NtWriteVirtualMemory@20 (77180608h)]  
770FD36B 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FD371 85 C0                test        eax,eax  
770FD373 0F 88 58 F9 FF FF    js          770FCCD1  
770FD379 80 BD 9D FD FF FF 00 cmp         byte ptr [ebp-263h],0  
770FD380 75 3C                jne         770FD3BE  
770FD382 F6 85 08 FC FF FF 01 test        byte ptr [ebp-3F8h],1  
770FD389 75 33                jne         770FD3BE  
770FD38B E8 9F 00 00 00       call        770FD42F  
770FD390 84 C0                test        al,al  
770FD392 0F 84 02 FA FF FF    je          770FCD9A  
770FD398 FF B5 BC FD FF FF    push        dword ptr [ebp-244h]  
770FD39E FF B5 60 FD FF FF    push        dword ptr [ebp-2A0h]  
770FD3A4 FF B5 20 FD FF FF    push        dword ptr [ebp-2E0h]  
770FD3AA FF 15 AC D2 17 77    call        dword ptr [__imp__BaseElevationPostProcessing@12 (7717D2ACh)]  
770FD3B0 89 85 C0 FD FF FF    mov         dword ptr [ebp-240h],eax  
770FD3B6 85 C0                test        eax,eax  
770FD3B8 0F 88 FE 89 01 00    js          77115DBC  
770FD3BE 83 BD A4 FD FF FF 00 cmp         dword ptr [ebp-25Ch],0  
770FD3C5 0F 85 FC 89 01 00    jne         77115DC7  
770FD3CB F6 85 B8 FD FF FF 04 test        byte ptr [ebp-248h],4  
770FD3D2 75 1D                jne         770FD3F1  --->
770FD3D4 53                   push        ebx  
770FD3D5 FF B5 74 FD FF FF    push        dword ptr [ebp-28Ch]  
770FD3DB FF 15 C4 07 18 77    call        dword ptr [__imp__NtResumeThread@8 (771807C4h)]  
770FD3E1 8B F0                mov         esi,eax  
770FD3E3 89 B5 C0 FD FF FF    mov         dword ptr [ebp-240h],esi  
770FD3E9 85 F6                test        esi,esi  
770FD3EB 0F 88 A7 89 01 00    js          77115D98  
770FD3F1 33 C9                xor         ecx,ecx  <---
770FD3F3 41                   inc         ecx  
770FD3F4 89 8D C8 FD FF FF    mov         dword ptr [ebp-238h],ecx  
770FD3FA 8B 85 6C FD FF FF    mov         eax,dword ptr [ebp-294h]  
770FD400 85 C0                test        eax,eax  
770FD402 0F 85 16 8A 01 00    jne         77115E1E  
770FD408 89 4D FC             mov         dword ptr [ebp-4],ecx  
770FD40B 6A 02                push        2  
770FD40D 5E                   pop         esi  
770FD40E 89 75 FC             mov         dword ptr [ebp-4],esi  
770FD411 89 8D E4 FB FF FF    mov         dword ptr [ebp-41Ch],ecx  
770FD417 8B 95 68 FD FF FF    mov         edx,dword ptr [ebp-298h]  
770FD41D 85 D2                test        edx,edx  
770FD41F 0F 84 63 8A 01 00    je          77115E88  --->...
770FD425 E9 02 8A 01 00       jmp         77115E2C  
...
77115E88 8B 85 BC FD FF FF    mov         eax,dword ptr [ebp-244h]  
77115E8E 8B B5 CC FC FF FF    mov         esi,dword ptr [ebp-334h]  
77115E94 89 06                mov         dword ptr [esi],eax  
77115E96 E9 85 7C FE FF       jmp         770FDB20  
...
770FDB20 8B 85 74 FD FF FF    mov         eax,dword ptr [ebp-28Ch]  
770FDB26 89 46 04             mov         dword ptr [esi+4],eax  
770FDB29 8B 85 68 FC FF FF    mov         eax,dword ptr [ebp-398h]  
770FDB2F 89 46 08             mov         dword ptr [esi+8],eax  
770FDB32 8B 85 6C FC FF FF    mov         eax,dword ptr [ebp-394h]  
770FDB38 89 46 0C             mov         dword ptr [esi+0Ch],eax  
770FDB3B 8B C3                mov         eax,ebx  
770FDB3D 89 85 BC FD FF FF    mov         dword ptr [ebp-244h],eax  
770FDB43 89 9D 74 FD FF FF    mov         dword ptr [ebp-28Ch],ebx  
770FDB49 89 4D FC             mov         dword ptr [ebp-4],ecx  
770FDB4C C7 85 E4 FB FF FF 00 00 00 00 mov         dword ptr [ebp-41Ch],0  
770FDB56 E8 54 83 01 00       call        77115EAF  
770FDB5B 89 5D FC             mov         dword ptr [ebp-4],ebx  
770FDB5E 8B 8D CC FD FF FF    mov         ecx,dword ptr [ebp-234h]  
770FDB64 C7 45 FC FE FF FF FF mov         dword ptr [ebp-4],0FFFFFFFEh  
770FDB6B E8 13 00 00 00       call        770FDB83  
770FDB70 8B 85 C8 FD FF FF    mov         eax,dword ptr [ebp-238h]  
770FDB76 E8 2E 4D FD FF       call        __SEH_epilog4_GS (770D28A9h)  
770FDB7B C2 30 00             ret         30h  
-- ------------------------------------------------------------------------------------------------
770FD47B 5D                   pop         ebp  
770FD47C C2 28 00             ret         28h  
-- ------------------------------------------------------------------------------------------------

        pRemoteTarget = m_pRemoteModuleBase + DWORD_PTR(&pThunkArray[j]) - dwImportUpdateAddr;
        dwNTStatus = NTWriteProcessMemory(
            m_hProcessHandle,
            pRemoteTarget,
            PVOID(&pFunctionAddr),
            sizeof(pFunctionAddr),
            NULL
            );
-- =================================================================================================
		dwNTStatus	0xc00000f1	long
//
// MessageId: STATUS_INVALID_PARAMETER_3
//
// MessageText:
//
// An invalid parameter was passed to a service or function as the third argument.
//
#define STATUS_INVALID_PARAMETER_3       ((NTSTATUS)0xC00000F1L)
+		pFunctionAddr	0x00007ff85eb74430 "@SHѓм0ѓd$H"	unsigned char *
+		this	0x000000b0802c7f90 {m_pCopyOf_idata=0x000000b0802d2f40 "H#" m_pRemote_idata=0x00007ff85a2d2000 <Bad Ptr> m_dw_idataSize=0x00000384 ...}	CLoadRemoteDLL * const
-- =================================================================================================
        if (!NT_SUCCESS(dwNTStatus))
        {
-- ------------------------------------------------------------------------------------------------
        bRet = WriteProcessMemory(
            m_hProcessHandle,
            pRemoteTarget,
            PVOID(&pFunctionAddr),
            sizeof(pFunctionAddr),
            NULL
            );
WriteProcessMemory:
00007FF85C274AC0 48 89 5C 24 08       mov         qword ptr [rsp+8],rbx  
00007FF85C274AC5 48 89 74 24 18       mov         qword ptr [rsp+18h],rsi  
00007FF85C274ACA 55                   push        rbp  
00007FF85C274ACB 57                   push        rdi  
00007FF85C274ACC 41 56                push        r14  
00007FF85C274ACE 48 8B EC             mov         rbp,rsp  
00007FF85C274AD1 48 83 EC 40          sub         rsp,40h  
00007FF85C274AD5 4D 8B F0             mov         r14,r8                    ; PVOID(&pFunctionAddr) = 0x000000963a0ed400
00007FF85C274AD8 48 8B F2             mov         rsi,rdx                   ; pRemoteTarget = 0x00007ff859d42000
00007FF85C274ADB 48 89 55 F0          mov         qword ptr [rbp-10h],rdx   ; pRegionAddress := pRemoteTarget 
00007FF85C274ADF 48 8D 45 28          lea         rax,[rbp+28h]             ; rax := &dwOldProtection = 0x000000963a0ed3a8
00007FF85C274AE3 49 8B F9             mov         rdi,r9                    ; sizeof(pFunctionAddr) = 0x0000000000000008
00007FF85C274AE6 4C 89 4D 38          mov         qword ptr [rbp+38h],r9    ; qwRegionSize := 0x0000000000000008
00007FF85C274AEA 4C 8D 45 38          lea         r8,[rbp+38h]              ; RegionSize := &qwRegionSize
00007FF85C274AEE 48 8D 55 F0          lea         rdx,[rbp-10h]             ; RegionAddress = &pRegionAddress
00007FF85C274AF2 41 B9 40 00 00 00    mov         r9d,40h                   ; DesiredProtection := PAGE_EXECUTE_READWRITE (0x40)
00007FF85C274AF8 48 89 44 24 20       mov         qword ptr [rsp+20h],rax   ; OldProtection = &dwOldProtection
00007FF85C274AFD 48 8B D9             mov         rbx,rcx  
-- =================================================================================================
NTSYSAPI
NTSTATUS 
NTAPI
NtProtectVirtualMemory(
	IN HANDLE ProcessHandle,
	IN OUT PVOID *RegionAddress,
	IN OUT PULONG RegionSize,
	IN ULONG DesiredProtection,
	OUT PULONG OldProtection
	);
-- =================================================================================================
00007FF85C274B00 FF 15 1A 01 0E 00    call        qword ptr [__imp_NtProtectVirtualMemory (7FF85C354C20h)]  
00007FF85C274B06 85 C0                test        eax,eax                   ; eax = 0
00007FF85C274B08 0F 88 DA 48 07 00    js          00007FF85C2E93E8  
00007FF85C274B0E 44 8B 4D 28          mov         r9d,dword ptr [rbp+28h]  
00007FF85C274B12 41 F6 C1 04          test        r9b,4  
00007FF85C274B16 0F 84 F9 48 07 00    je          00007FF85C2E9415  
-- ------------------------------------------------------------------------------------------------
int
_tmainCRTStartup(
        void
        )
{
00007FF6F902A4A0 FF 25 32 91 1C 61    jmp         qword ptr [7FF75A1F35D8h]  
00007FF6F902A4A6 ??                   db          17h  
00007FF6F902A4A7 02 00                add         al,byte ptr [rax]  

        return __tmainCRTStartup();
00007FF6F902A4A9 E8 C2 FD FF FF       call        __tmainCRTStartup (7FF6F902A270h)  
}

int
_tmainCRTStartup(
        void
        )
{
        /*
         * The /GS security cookie must be initialized before any exception
         * handling targetting the current image is registered.  No function
         * using exception handling can be called in the current image until
         * after __security_init_cookie has been called.
         */
        __security_init_cookie();

        return __tmainCRTStartup();
}
-- ------------------------------------------------------------------------------------------------
