Top level window with the window class named “Transparent Windows Client” is registered as class window. style member in WNDCLASS has a logical OR for each class style, which are CS_DBLCLKS | CS_NOCLOSE | CS_OWNDC.
then it was created by calling user32!CreateWindowEx(). that window loads system menu, which is “MENU 0010 0411” on Japanese platform, from .resrc section in user32.dll. that system menu has 7 menu items, which are “Restore” / “Move” / “Resize” / “Minimize” / “Maximize” / “Separeter” / “Close”.In the kernel space, win32k.sys check the stlye registered class window structure whether it has CS_NOCLOSE bits or not. If class window has this bits, win32k.sys destroys “Close” menu from system menu once it loaded system menu from user32.dll.
Global Escalation Manager Tokyo