Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- nt!KeBugCheckEx:
- fffff800`028c3700 48894c2408 mov qword ptr [rsp+8],rcx ss:fffff880`06838210=000000000000001e
- fffff800`028c3705 4889542410 mov qword ptr [rsp+10h],rdx
- fffff800`028c370a 4c89442418 mov qword ptr [rsp+18h],r8
- fffff800`028c370f 4c894c2420 mov qword ptr [rsp+20h],r9
- fffff800`028c3714 9c pushfq
- fffff800`028c3715 4883ec30 sub rsp,30h
- fffff800`028c3719 fa cli
- fffff800`028c371a 65488b0c2520000000 mov rcx,qword ptr gs:[20h]
- fffff800`028c3723 4881c120010000 add rcx,120h
- fffff800`028c372a e841060000 call nt!RtlCaptureContext (fffff800`028c3d70)
- fffff800`028c372f 65488b0c2520000000 mov rcx,qword ptr gs:[20h]
- fffff800`028c3738 4883c140 add rcx,40h
- fffff800`028c373c e8ef020000 call nt!KiSaveProcessorControlState (fffff800`028c3a30)
- fffff800`028c3741 654c8b142520000000 mov r10,qword ptr gs:[20h]
- fffff800`028c374a 4981c220010000 add r10,120h
- fffff800`028c3751 488b442440 mov rax,qword ptr [rsp+40h]
- fffff800`028c3756 49898280000000 mov qword ptr [r10+80h],rax
- fffff800`028c375d 488b442430 mov rax,qword ptr [rsp+30h]
- fffff800`028c3762 49894244 mov qword ptr [r10+44h],rax
- fffff800`028c3766 488d056cffffff lea rax,[nt!KiBugCheckReturn+0x5 (fffff800`028c36d9)]
- fffff800`028c376d 483b442438 cmp rax,qword ptr [rsp+38h]
- fffff800`028c3772 750e jne nt!KeBugCheckEx+0x82 (fffff800`028c3782)
- fffff800`028c3774 4c8d442468 lea r8,[rsp+68h]
- fffff800`028c3779 4c8d0d50ffffff lea r9,[nt!KeBugCheck (fffff800`028c36d0)]
- fffff800`028c3780 eb0c jmp nt!KeBugCheckEx+0x8e (fffff800`028c378e)
- fffff800`028c3782 4c8d442438 lea r8,[rsp+38h]
- fffff800`028c3787 4c8d0d72ffffff lea r9,[nt!KeBugCheckEx (fffff800`028c3700)]
- fffff800`028c378e 4d898298000000 mov qword ptr [r10+98h],r8
- fffff800`028c3795 4d898af8000000 mov qword ptr [r10+0F8h],r9
- fffff800`028c379c 440f20c0 mov rax,cr8
- fffff800`028c37a0 6588042598480000 mov byte ptr gs:[4898h],al
- fffff800`028c37a8 3c02 cmp al,2
- fffff800`028c37aa 7d09 jge nt!KeBugCheckEx+0xb5 (fffff800`028c37b5)
- fffff800`028c37ac b902000000 mov ecx,2
- fffff800`028c37b1 440f22c1 mov cr8,rcx
- fffff800`028c37b5 488b442430 mov rax,qword ptr [rsp+30h]
- fffff800`028c37ba 482500020000 and rax,200h
- fffff800`028c37c0 7401 je nt!KeBugCheckEx+0xc3 (fffff800`028c37c3)
- fffff800`028c37c2 fb sti
- fffff800`028c37c3 f0ff05ce0d1a00 lock inc dword ptr [nt!KiHardwareTrigger (fffff800`02a64598)]
- fffff800`028c37ca 488b4c2440 mov rcx,qword ptr [rsp+40h]
- fffff800`028c37cf 48c744242800000000 mov qword ptr [rsp+28h],0
- fffff800`028c37d8 488d05fafeffff lea rax,[nt!KiBugCheckReturn+0x5 (fffff800`028c36d9)]
- fffff800`028c37df 483b442438 cmp rax,qword ptr [rsp+38h]
- fffff800`028c37e4 741f je nt!KeBugCheckEx+0x105 (fffff800`028c3805)
- fffff800`028c37e6 488b442460 mov rax,qword ptr [rsp+60h]
- fffff800`028c37eb 4889442420 mov qword ptr [rsp+20h],rax
- fffff800`028c37f0 4c8b4c2458 mov r9,qword ptr [rsp+58h]
- fffff800`028c37f5 4c8b442450 mov r8,qword ptr [rsp+50h]
- fffff800`028c37fa 488b542448 mov rdx,qword ptr [rsp+48h]
- fffff800`028c37ff e88c740f00 call nt!KeBugCheck2 (fffff800`029bac90)
- fffff800`028c3804 90 nop
- fffff800`028c3805 48c744242000000000 mov qword ptr [rsp+20h],0
- fffff800`028c380e 4533c9 xor r9d,r9d
- fffff800`028c3811 4533c0 xor r8d,r8d
- fffff800`028c3814 33d2 xor edx,edx
- fffff800`028c3816 e875740f00 call nt!KeBugCheck2 (fffff800`029bac90)
- fffff800`028c381b 90 nop
- fffff800`028c381c cc int 3
- fffff800`028c381d cc int 3
- fffff800`028c381e cc int 3
- fffff800`028c381f cc int 3
- fffff800`028c3820 cc int 3
- fffff800`028c3821 cc int 3
- fffff800`028c3822 6666666666660f1f840000000000 nop word ptr [rax+rax]
- nt!KeContextToKframes:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement