The "highlights" from WM_SYSCOMMAND to WM_MOVING:
xxxSysCommand- Calls some hook back in UM xxxIsDragging- GetKeyState(VK_LBUTTON)- Just checks some bits, nothing heavy Sets mouse capture to window- Locks and unlocks the window Checks if the thread's impersonation token or the process token is restricted Checks user has WINSTA_WRITEATTRIBUTES permission on the Window Station xxxInternalGetMessage (..., WM_MOUSEFIRST, WM_XBUTTONDBLCLK..)-if any mouse action Calls mouse hooks -> back to UM Removes WM_LBUTTONUP from Queue Calls mouse hooks again -> back to UM seems it loops around couple of timesotherwise Exits without doing anything of note xxxInternalGetMessage(..., WM_QUEUESYNC, WM_QUEUESYNC) if no message- xxxInternalGetMessage(..., WM_KEYFIRST, WM_KEYLAST) if no message- xxxSleepThread(7, 500, 1) KeClearEvent() KeWaitForSingleObject(ClearedEvent, -500ms) // seems to be for inputend if Releases mouse capture on window- Locks and unlocks the window again Puts WM_MOUSEMOVE in message queue Calls window proc with WM_CAPTURECHANGED (0x0215) returns whether the message x/y pos was within a specified rect (if there was a message)if dragging xxxSetWindowPos(PWND, 0, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE) - BeginDeferWindowPos(1) DeferWindowPos() EndDeferWindowPosEx() Z-Order checking stuff for a few windows Call app WndProc with WM_WINDOWPOSCHANGING Updates the previous top most window if there was one Locks screen and blits the valid bits Unlocks the screen Sends any WM_WINDOWPOSCHANGED messages returns not checked beyond here for this case returnsend if xxxMoveSize- Clips cursor to area Call app WndProc with WM_GETMINMAXINFO Draw the drag rectange- SetWindowPos(PVOID, 0, x, y, width, height, (SWP_NOOWNERZORDER | SWP_NOACTIVATE | SWP_NOZORDER))- Locks screen and blits the valid bits to the new pos Unlocks the screen Updates relevant Windows Fakes a mouse move Call app WndProc with WM_ENTERSIZEMOVE Locks Capture Window Show Cursor GetMessage(wnd, no filter)- Scan's system queue for all messages- GetNextSysMessage- WM_MOUSEMOVE posted (prob due to fake move above) Mouse hooks called WM_MOUSEMOVE consumed (deleted from queue) Hooks called again Updates drag rect- Calls WndProc with WM_MOVING Redraws the rect Wait for messages