Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- fffff800`0288319b 0f32 rdmsr
- fffff800`0288319d 83e0fc and eax,0FFFFFFFCh
- fffff800`028831a0 410bc0 or eax,r8d
- fffff800`028831a3 0f30 wrmsr
- fffff800`028831a5 c20000 ret 0
- fffff800`028831a8 cc int 3
- fffff800`028831a9 cc int 3
- fffff800`028831aa cc int 3
- fffff800`028831ab cc int 3
- fffff800`028831ac cc int 3
- fffff800`028831ad cc int 3
- fffff800`028831ae 6690 xchg ax,ax
- nt!KiSaveDebugRegisterState:
- fffff800`028831b0 654c8b0c2518000000 mov r9,qword ptr gs:[18h]
- fffff800`028831b9 0f21c0 mov rax,dr0
- fffff800`028831bc 0f21ca mov rdx,dr1
- fffff800`028831bf 48894558 mov qword ptr [rbp+58h],rax
- fffff800`028831c3 48895560 mov qword ptr [rbp+60h],rdx
- fffff800`028831c7 0f21d0 mov rax,dr2
- fffff800`028831ca 0f21da mov rdx,dr3
- fffff800`028831cd 48894568 mov qword ptr [rbp+68h],rax
- fffff800`028831d1 48895570 mov qword ptr [rbp+70h],rdx
- fffff800`028831d5 0f21f0 mov rax,dr6
- fffff800`028831d8 0f21fa mov rdx,dr7
- fffff800`028831db 48894578 mov qword ptr [rbp+78h],rax
- fffff800`028831df 48899580000000 mov qword ptr [rbp+80h],rdx
- fffff800`028831e6 33c0 xor eax,eax
- fffff800`028831e8 0f23f8 mov dr7,rax
- fffff800`028831eb 65f604254a4d000002 test byte ptr gs:[4D4Ah],2
- fffff800`028831f4 747d je nt!KiSaveDebugRegisterState+0xc3 (fffff800`02883273)
- fffff800`028831f6 66f7c20003 test dx,300h
- fffff800`028831fb 7476 je nt!KiSaveDebugRegisterState+0xc3 (fffff800`02883273)
- fffff800`028831fd 448b057cf52200 mov r8d,dword ptr [nt!KiLastBranchTOSMSR (fffff800`02ab2780)]
- fffff800`02883204 450bc0 or r8d,r8d
- fffff800`02883207 7408 je nt!KiSaveDebugRegisterState+0x61 (fffff800`02883211)
- fffff800`02883209 418bc8 mov ecx,r8d
- fffff800`0288320c 0f32 rdmsr
- fffff800`0288320e 448bc0 mov r8d,eax
- fffff800`02883211 8b0dfdf02200 mov ecx,dword ptr [nt!KiLastBranchFromBaseMSR (fffff800`02ab2314)]
- fffff800`02883217 4103c8 add ecx,r8d
- fffff800`0288321a 0f32 rdmsr
- fffff800`0288321c 898598000000 mov dword ptr [rbp+98h],eax
- fffff800`02883222 8b0db0f12200 mov ecx,dword ptr [nt!KiLastBranchToBaseMSR (fffff800`02ab23d8)]
- fffff800`02883228 89959c000000 mov dword ptr [rbp+9Ch],edx
- fffff800`0288322e 4103c8 add ecx,r8d
- fffff800`02883231 0f32 rdmsr
- fffff800`02883233 898590000000 mov dword ptr [rbp+90h],eax
- fffff800`02883239 899594000000 mov dword ptr [rbp+94h],edx
- fffff800`0288323f 8b0ddbf22200 mov ecx,dword ptr [nt!KiLastExceptionFromBaseMSR (fffff800`02ab2520)]
- fffff800`02883245 0f32 rdmsr
- fffff800`02883247 8985a8000000 mov dword ptr [rbp+0A8h],eax
- fffff800`0288324d 8995ac000000 mov dword ptr [rbp+0ACh],edx
- fffff800`02883253 8b0dc3f22200 mov ecx,dword ptr [nt!KiLastExceptionToBaseMSR (fffff800`02ab251c)]
- fffff800`02883259 0f32 rdmsr
- fffff800`0288325b 8985a0000000 mov dword ptr [rbp+0A0h],eax
- fffff800`02883261 8995a4000000 mov dword ptr [rbp+0A4h],edx
- fffff800`02883267 b9d9010000 mov ecx,1D9h
- fffff800`0288326c 0f32 rdmsr
- fffff800`0288326e 83e0fc and eax,0FFFFFFFCh
- fffff800`02883271 0f30 wrmsr
- fffff800`02883273 6641f781080200005503 test word ptr [r9+208h],355h
- fffff800`0288327d 746c je nt!KiSaveDebugRegisterState+0x13b (fffff800`028832eb)
- fffff800`0288327f 498b81e0010000 mov rax,qword ptr [r9+1E0h]
- fffff800`02883286 498b91e8010000 mov rdx,qword ptr [r9+1E8h]
- fffff800`0288328d 0f23c0 mov dr0,rax
- fffff800`02883290 0f23ca mov dr1,rdx
- fffff800`02883293 498b81f0010000 mov rax,qword ptr [r9+1F0h]
- fffff800`0288329a 498b91f8010000 mov rdx,qword ptr [r9+1F8h]
- fffff800`028832a1 0f23d0 mov dr2,rax
- fffff800`028832a4 0f23da mov dr3,rdx
- fffff800`028832a7 498b9108020000 mov rdx,qword ptr [r9+208h]
- fffff800`028832ae 33c0 xor eax,eax
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
