Thanks JJ.
Getting better but a long way from something useful.
Seeing assembler instructions but not my code.
I can see the messages I put in messageboxes.
I see a ton of basethreadthunk messages.
No symbols from my program.
Ideal way would be to see my code in the right panel
and the GoAsm interpretation of my code in the left panel.
Possible that I am doing something wrong.......
Here is a snipit of what I see:
000000007720733F | 41 8B 81 A4 00 00 00 | mov eax,dword ptr ds:[r9+A4] |
0000000077207346 | 89 82 A4 00 00 00 | mov dword ptr ds:[rdx+A4],eax |
000000007720734C | 41 8B 81 AC 00 00 00 | mov eax,dword ptr ds:[r9+AC] |
0000000077207353 | 89 82 AC 00 00 00 | mov dword ptr ds:[rdx+AC],eax |
0000000077207359 | 41 8B 81 A8 00 00 00 | mov eax,dword ptr ds:[r9+A8] |
0000000077207360 | 89 82 A8 00 00 00 | mov dword ptr ds:[rdx+A8],eax |
0000000077207366 | 41 8B 81 B0 00 00 00 | mov eax,dword ptr ds:[r9+B0] |
000000007720736D | 89 82 B0 00 00 00 | mov dword ptr ds:[rdx+B0],eax |
0000000077207373 | B9 04 00 01 00 | mov ecx,10004 |
0000000077207378 | 41 8B C0 | mov eax,r8d |
000000007720737B | 23 C1 | and eax,ecx |
000000007720737D | 3B C1 | cmp eax,ecx |
000000007720737F | 75 34 | jnz ntdll.772073B5 |
0000000077207381 | 41 8B 81 8C 00 00 00 | mov eax,dword ptr ds:[r9+8C] |
0000000077207388 | 89 82 8C 00 00 00 | mov dword ptr ds:[rdx+8C],eax |
000000007720738E | 41 8B 81 90 00 00 00 | mov eax,dword ptr ds:[r9+90] |
0000000077207395 | 89 82 90 00 00 00 | mov dword ptr ds:[rdx+90],eax |
000000007720739B | 41 8B 81 94 00 00 00 | mov eax,dword ptr ds:[r9+94] |
00000000772073A2 | 89 82 94 00 00 00 | mov dword ptr ds:[rdx+94],eax |
00000000772073A8 | 41 8B 81 98 00 00 00 | mov eax,dword ptr ds:[r9+98] | ;[r9+98]:RtlAddRefMemoryStream
00000000772073AF | 89 82 98 00 00 00 | mov dword ptr ds:[rdx+98],eax |
00000000772073B5 | B9 08 00 01 00 | mov ecx,10008 |
00000000772073BA | 41 8B C0 | mov eax,r8d |
00000000772073BD | 23 C1 | and eax,ecx |
00000000772073BF | 3B C1 | cmp eax,ecx |
00000000772073C1 | 75 13 | jnz ntdll.772073D6 |
00000000772073C3 | 48 8D 4A 1C | lea rcx,qword ptr ds:[rdx+1C] |
00000000772073C7 | 49 8D 51 1C | lea rdx,qword ptr ds:[r9+1C] | ;r9+1C:L"che"
00000000772073CB | 41 B8 70 00 00 00 | mov r8d,70 |
00000000772073D1 | E8 1A 73 FA FF | call <ntdll.RtlMoveMemory> |
00000000772073D6 | B9 10 00 01 00 | mov ecx,10010 |
00000000772073DB | 8B C6 | mov eax,esi |
00000000772073DD | 23 C1 | and eax,ecx |
00000000772073DF | 3B C1 | cmp eax,ecx |
