nt!KiFastCallEntry+0xb8:
8053e618 33db xor ebx,ebx
8053e61a 0b99700f0000 or ebx,dword ptr [ecx+0F70h]
8053e620 740a je nt!KiFastCallEntry+0xcc (8053e62c)
8053e622 52 push edx
8053e623 50 push eax
8053e624 ff1564405580 call dword ptr [nt!KeGdiFlushUserBatch (80554064)]
8053e62a 58 pop eax
//
> service number
8053e62b 5a pop edx
//
> argument address
8053e62c e857acd605 call 862a9288
//
> 2345hook point
8053e631 e88bf28b5f call dfdfd8c1
8053e636 cd0e int 0Eh
8053e638 c9 leave
8053e639 8a0c18 mov cl,byte ptr [eax+ebx]
8053e63c 8b3f mov edi,dword ptr [edi]
8053e63e 8b1c87 mov ebx,dword ptr [edi+eax*4]
8053e641 e9524fe705 jmp 863b3598
//
>360 hook point
8053e646 8bfc mov edi,esp
8053e648 3b35549a5580
cmp
esi,dword ptr [nt!MmUserProbeAddress (80559a54)]
8053e64e 0f83a8010000 jae nt!KiSystemCallExit2+0x9f (8053e7fc)
8053e654 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
8053e656 ffd3 call ebx
8053e658 8be5 mov esp,ebp
8053e65a 8b0d24f1dfff mov ecx,dword ptr ds:[0FFDFF124h]
8053e660 8b553c mov edx,dword ptr [ebp+3Ch]
8053e663 899134010000 mov dword ptr [ecx+134h],edx
!chkimg nt -d
8053e62c-8053e631 6 bytes - nt!KiFastCallEntry+cc (+0x3b634)
[ ff 05 38 f6
df
ff:e8 57 ac d6 05 e8 ]
8053e636-8053e637 2 bytes - nt!KiFastCallEntry+d6 (+0x0a)
[ 0c 33:
cd
0e ]