I'm trying to understand what calling convention the following function uses: I realize it says fastcall, but that is not actually the case, since the ECX register contains an integer (the first parameter) like 0x2190. However, the weird issue is the following instruction: lea rcx, [rsp + 48h] The instruction references an address outside of the current stack frame. The current stack frame uses only 8 bytes (RIP stored on stack on account to call), 8 bytes (for push RBX), 30 bytes (for sub rsp, 30h) - however 0x48 is out of these bounds. Basically I would like to hook this callback function, since the function is called when an event occurs, but easyhook (and I guess a lot of other libraries) have a hard time dealing with this , which is not under control of the current function. Any ideas how the [rsp + 48h] is actually passed to the function, since the fastcall calling convention is used by the function, where only an integer is passed in rcx parameter?