ntdll.ZwReadVirtualMemory - 4C 8B D1 - mov r10,rcx
ntdll.ZwReadVirtualMemory+3- B8 3C000000 - mov eax,0000003C { 60 }
ntdll.ZwReadVirtualMemory+8- 0F05 - syscall //call FS[0XC0]
ntdll.ZwReadVirtualMemory+A- C3 - ret
ntdll.ZwReadVirtualMemory+B- 0F1F 44 00 00 - nop [rax+rax+00]
wow64cpu._CpuSuspendLocalThread+8A8 - EA 1E274A75 3300 - jmp 0033:wow64cpu._CpuSimulate+16E
wow64cpu._CpuSuspendLocalThread+8AF - 00 00 - add [rax],al
wow64cpu._CpuSuspendLocalThread+8B1 - CC - int 3
wow64cpu._CpuSuspendLocalThread+8B2 - CC - int 3
wow64cpu._CpuSimulate+16E - 67 44 8B 04 - mov r8d,44
wow64cpu._CpuSimulate+172 - 24 45 - and al,45 { 69 }
wow64cpu._CpuSimulate+174 - 89 85 BC000000 - mov [rbp+000000BC],eax//这里下条件断点还是没断到
wow64cpu._CpuSimulate+17A - 41 89 A5 C8000000 - mov [r13+000000C8],esp
wow64cpu._CpuSimulate+181 - 49 8B A4 24 80140000 - mov rsp,[r12+00001480]
wow64cpu._CpuSimulate+189 - 49 83 A4 24 80140000 00 - and qword ptr [r12+00001480],00 { 0 }
wow64cpu._CpuSimulate+192 - 44 8B DA - mov r11d,edx
wow64cpu._CpuSiwow64cpu._TurboDispatchJumpAddressStart - 41 FF 24 CF - jmp qword ptr [r15+rcx*8]
wow64cpu._TurboDispatchJumpAddressEnd - 41 89 B5 A4000000 - mov [r13+000000A4],esi
754A2750 - 41 89 BD A0000000 - mov [r13+000000A0],edi
754A2757 - 41 89 9D A8000000 - mov [r13+000000A8],ebx
754A275E - 41 89 AD B8000000 - mov [r13+000000B8],ebp
754A2765 - 9C - pushfq
754A2766 - 5B - pop rbx
754A2767 - 41 89 9D C4000000 - mov [r13+000000C4],ebx
754A276E - 8B C8 - mov ecx,eax
754A2770 - FF 15 0AE9FFFF - call qword ptr [754A1080] { ->wow64._Wow64SystemServiceEx }
754A2776 - 41 89 85 B4000000 - mov [r13+000000B4],eax
754A277D - E9 8FFEFFFF - jmp wow64cpu._CpuSimulate+61
754A2782 - CC - int 3
mulate+192 - 44 8B DA - mov r11d,edx
