Brother, I don't quite understand why I can't get the address of the NtCreateUserProcess function from the RCX register. Every time I execute the next code, the value in the RCX register will change. If I change its address to R8, R9 registers, it will not change.
Brother, I don't quite understand why I can't get the address of the NtCreateUserProcess function from the RCX register. Every time I execute the next code, the value in the RCX register will change. If I change its address to R8, R9 registers, it will not change.