Spotting a Hook in x64dbg

• Disassemble the start of the API (e.g. type MessageBoxW in the go-to / expression box).
• A hooked function shows an immediate jmp to an address outside the owning module (often RWX private memory).
• Contrast with a clean prologue — and follow the jump to find the detour / injected DLL.

Analyst tell

Genuine user32 code sits in user32's address range.

A first-instruction jmp into unnamed memory = inline hook.