nt!KiFastCallEntry:

8053dad0 b923000000      mov     ecx,23h

8053dad5 6a30            push    30h

8053dad7 0fa1            pop     fs

8053dad9 8ed9            mov     ds,cx

8053dadb 8ec1            mov     es,cx

8053dadd 8b0d40f0dfff    mov     ecx,dword ptr ds:[0FFDFF040h]

8053dae3 8b6104          mov     esp,dword ptr [ecx+4]

8053dae6 6a23            push    23h

8053dae8 52              push    edx

8053dae9 9c              pushfd

8053daea 6a02            push    2

8053daec 83c208          add     edx,8

8053daef 9d              popfd

8053daf0 804c240102      or      byte ptr [esp+1],2

8053daf5 6a1b            push    1Bh

8053daf7 ff350403dfff    push    dword ptr ds:[0FFDF0304h]

8053dafd 6a00            push    0

8053daff 55              push    ebp

8053db00 53              push    ebx

8053db01 56              push    esi

8053db02 57              push    edi

8053db03 8b1d1cf0dfff    mov     ebx,dword ptr ds:[0FFDFF01Ch]

8053db09 6a3b            push    3Bh

8053db0b 8bb324010000    mov     esi,dword ptr [ebx+124h]

8053db11 ff33            push    dword ptr [ebx]

8053db13 c703ffffffff    mov     dword ptr [ebx],0FFFFFFFFh

8053db19 8b6e18          mov     ebp,dword ptr [esi+18h]

8053db1c 6a01            push    1

8053db1e 83ec48          sub     esp,48h

8053db21 81ed9c020000    sub     ebp,29Ch

8053db27 c6864001000001  mov     byte ptr [esi+140h],1

8053db2e 3bec            cmp     ebp,esp

8053db30 759a            jne     nt!KiFastCallEntry2+0x47 (8053dacc)

8053db32 83652c00        and     dword ptr [ebp+2Ch],0

8053db36 f6462cff        test    byte ptr [esi+2Ch],0FFh

8053db3a 89ae34010000    mov     dword ptr [esi+134h],ebp

8053db40 0f854afeffff    jne     nt!Dr_FastCallDrSave (8053d990)

8053db46 8b5d60          mov     ebx,dword ptr [ebp+60h]

8053db49 8b7d68          mov     edi,dword ptr [ebp+68h]

8053db4c 89550c          mov     dword ptr [ebp+0Ch],edx

8053db4f c74508000ddbba  mov     dword ptr [ebp+8],0BADB0D00h

8053db56 895d00          mov     dword ptr [ebp],ebx

8053db59 897d04          mov     dword ptr [ebp+4],edi

8053db5c fb              sti

8053db5d 8bf8            mov     edi,eax

8053db5f c1ef08          shr     edi,8

8053db62 83e730          and     edi,30h

8053db65 8bcf            mov     ecx,edi

8053db67 03bee0000000    add     edi,dword ptr [esi+0E0h]

8053db6d 8bd8            mov     ebx,eax

8053db6f 25ff0f0000      and     eax,0FFFh

8053db74 3b4708          cmp     eax,dword ptr [edi+8]

8053db77 0f8345fdffff    jae     nt!KiBBTUnexpectedRange (8053d8c2)

8053db7d 83f910          cmp     ecx,10h

8053db80 751a            jne     nt!KiFastCallEntry+0xcc (8053db9c)

8053db82 8b0d18f0dfff    mov     ecx,dword ptr ds:[0FFDFF018h]

8053db88 33db            xor     ebx,ebx

8053db8a 0b99700f0000    or      ebx,dword ptr [ecx+0F70h]

8053db90 740a            je      nt!KiFastCallEntry+0xcc (8053db9c)

8053db92 52              push    edx

8053db93 50              push    eax

8053db94 ff15c4355580    call    dword ptr [nt!KeGdiFlushUserBatch (805535c4)]

8053db9a 58              pop     eax

8053db9b 5a              pop     edx

8053db9c ff0538f6dfff    inc     dword ptr ds:[0FFDFF638h]

8053dba2 8bf2            mov     esi,edx

8053dba4 8b5f0c          mov     ebx,dword ptr [edi+0Ch]

8053dba7 33c9            xor     ecx,ecx

8053dba9 8a0c18          mov     cl,byte ptr [eax+ebx]

8053dbac 8b3f            mov     edi,dword ptr [edi]

8053dbae 8b1c87          mov     ebx,dword ptr [edi+eax*4]

8053dbb1 2be1            sub     esp,ecx

8053dbb3 c1e902          shr     ecx,2

8053dbb6 8bfc            mov     edi,esp

8053dbb8 3b35b48f5580    cmp     esi,dword ptr [nt!MmUserProbeAddress (80558fb4)]

8053dbbe 0f83a8010000    jae     nt!KiSystemCallExit2+0x9f (8053dd6c)

8053dbc4 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

8053dbc6 ffd3            call    ebx

8053dbc8 8be5            mov     esp,ebp

8053dbca 8b0d24f1dfff    mov     ecx,dword ptr ds:[0FFDFF124h]

8053dbd0 8b553c          mov     edx,dword ptr [ebp+3Ch]

8053dbd3 899134010000    mov     dword ptr [ecx+134h],edx

daniel@daniel-mint ~/bap/bap-0.7/libasmir/apps $ hexdump -C kifastcallentry.dump | cut -b 10-60 | sed -re 's/[0-9a-f]{2}/\\x&/g' | sed -re 's/ //g' | sed -e 's/^/"/g' | sed -e 's/$/"/g'

"\xb9\x23\x00\x00\x00\x6a\x30\x0f\xa1\x8e\xd9\x8e\xc1\x8b\x0d\x40"

"\xf0\xdf\xff\x8b\x61\x04\x6a\x23\x52\x9c\x6a\x02\x83\xc2\x08\x9d"

"\x80\x4c\x24\x01\x02\x6a\x1b\xff\x35\x04\x03\xdf\xff\x6a\x00\x55"

"\x53\x56\x57\x8b\x1d\x1c\xf0\xdf\xff\x6a\x3b\x8b\xb3\x24\x01\x00"

"\x00\xff\x33\xc7\x03\xff\xff\xff\xff\x8b\x6e\x18\x6a\x01\x83\xec"

"\x48\x81\xed\x9c\x02\x00\x00\xc6\x86\x40\x01\x00\x00\x01\x3b\xec"

"\x75\x9a\x83\x65\x2c\x00\xf6\x46\x2c\xff\x89\xae\x34\x01\x00\x00"

"\x0f\x85\x4a\xfe\xff\xff\x8b\x5d\x60\x8b\x7d\x68\x89\x55\x0c\xc7"

"\x45\x08\x00\x0d\xdb\xba\x89\x5d\x00\x89\x7d\x04\xfb\x8b\xf8\xc1"

"\xef\x08\x83\xe7\x30\x8b\xcf\x03\xbe\xe0\x00\x00\x00\x8b\xd8\x25"

"\xff\x0f\x00\x00\x3b\x47\x08\x0f\x83\x45\xfd\xff\xff\x83\xf9\x10"

"\x75\x1a\x8b\x0d\x18\xf0\xdf\xff\x33\xdb\x0b\x99\x70\x0f\x00\x00"

"\x74\x0a\x52\x50\xff\x15\xc4\x35\x55\x80\x58\x5a\xff\x05\x38\xf6"

"\xdf\xff\x8b\xf2\x8b\x5f\x0c\x33\xc9\x8a\x0c\x18\x8b\x3f\x8b\x1c"

"\x87\x2b\xe1\xc1\xe9\x02\x8b\xfc\x3b\x35\xb4\x8f\x55\x80\x0f\x83"

"\xa8\x01\x00\x00\xf3\xa5\xff\xd3\x8b\xe5\x8b\x0d\x24\xf1\xdf\xff"

"\x8b\x55\x3c\x89\x91\x34\x01\x00\x00"

""