What I’m missing is at some point there should be an instruction like
lea r10, [rsp]to connect the nested procedure to the context
That’s on the line:
mov WORD PTR [rsp+18], -17847
Where -17847 = 0x49 0xBA = mov r10, imm64.
1 Like