Created
November 25, 2014 13:22
-
-
Save NTMan/770c5d642b5e8b2d39c6 to your computer and use it in GitHub Desktop.
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 0009:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 0009:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0009:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 000b:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 000b:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 000b:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 000b:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7ec5ff40,module=0x7ec20000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7ec5ff40,module=0x7ec20000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Starting process L"C:\\windows\\system32\\wineboot.exe" (entryproc=0x7ec96f50) | |
| 000b:fixme:winediag:start_process Wine-Compholio is a Wine testing version containing experimental patches. | |
| 000b:fixme:winediag:start_process Please don't report bugs at winehq.org and use our issue tracker instead: | |
| 000b:fixme:winediag:start_process https://github.com/compholio/wine-compholio/issues | |
| 000b:Call KERNEL32.GetWindowsDirectoryW(7eca8000,00000104) ret=7ec91dcd | |
| 000b:Ret KERNEL32.GetWindowsDirectoryW() retval=0000000a ret=7ec91dcd | |
| 000b:Call KERNEL32.SetCurrentDirectoryW(7eca8000 L"C:\\windows") ret=7ec91dd9 | |
| 000b:Ret KERNEL32.SetCurrentDirectoryW() retval=00000001 ret=7ec91dd9 | |
| 000b:Call KERNEL32.IsWow64Process(ffffffff,0033eea0) ret=7ec91e04 | |
| 000b:Ret KERNEL32.IsWow64Process() retval=00000001 ret=7ec91e04 | |
| 000b:Call KERNEL32.CreateEventW(0033eeb8,00000001,00000000,7ec98920 L"__wineboot_event") ret=7ec92100 | |
| 000b:Ret KERNEL32.CreateEventW() retval=00000010 ret=7ec92100 | |
| 000b:Call KERNEL32.ResetEvent(00000010) ret=7ec92112 | |
| 000b:Ret KERNEL32.ResetEvent() retval=00000001 ret=7ec92112 | |
| 000b:Call ntdll.NtQuerySystemInformation(00000001,0033eee0,0000000c,00000000) ret=7ec9214c | |
| 000b:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=7ec9214c | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec9216d | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00115680 ret=7ec9216d | |
| 000b:Call ntdll.NtPowerInformation(0000000b,00000000,00000000,00115680,00000030) ret=7ec921a9 | |
| 000b:Ret ntdll.NtPowerInformation() retval=00000000 ret=7ec921a9 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec987a0 L"Hardware\\Description\\System",00000000,00000000,00000001,000f003f,00000000,0033eeb0,00000000) ret=7ec92247 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec92247 | |
| 000b:Call advapi32.RegSetValueExW(00000020,7ec9878a L"Identifier",00000000,00000001,7ec9872e,0000001c) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegCreateKeyExW(00000020,7ec98700 L"FloatingPointProcessor",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec94060 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec94060 | |
| 000b:Call advapi32.RegCreateKeyExW(00000020,7ec986c0 L"CentralProcessor",00000000,00000000,00000001,000f003f,00000000,0033eeb4,00000000) ret=7ec922f7 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec922f7 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,0033f350 L"0",00000000,00000000,00000001,000f003f,00000000,0033eeac,00000000) ret=7ec92413 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec92413 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec98688 L"FeatureSet",00000000,00000004,0033eee8,00000004) ret=7ec92459 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92459 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec9878a L"Identifier",00000000,00000001,0033f558,00000044) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec98660 L"ProcessorNameString",00000000,00000001,7ec98600,00000044) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec985a0 L"VendorIdentifier",00000000,00000001,7ec98570,0000001a) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec98566 L"~MHz",00000000,00000004,00115684,00000004) ret=7ec924e5 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec924e5 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec924f7 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec924f7 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,0033f350 L"0",00000000,00000000,00000001,000f003f,00000000,0033eeac,00000000) ret=7ec9237d | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9237d | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec9878a L"Identifier",00000000,00000001,0033f558,00000044) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec92590 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec92590 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,0033f350 L"1",00000000,00000000,00000001,000f003f,00000000,0033eeac,00000000) ret=7ec92413 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec92413 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec98688 L"FeatureSet",00000000,00000004,0033eee8,00000004) ret=7ec92459 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92459 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec9878a L"Identifier",00000000,00000001,0033f558,00000044) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec98660 L"ProcessorNameString",00000000,00000001,7ec98600,00000044) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec985a0 L"VendorIdentifier",00000000,00000001,7ec98570,0000001a) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec98566 L"~MHz",00000000,00000004,0011569c,00000004) ret=7ec924e5 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec924e5 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec924f7 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec924f7 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,0033f350 L"1",00000000,00000000,00000001,000f003f,00000000,0033eeac,00000000) ret=7ec9237d | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9237d | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec9878a L"Identifier",00000000,00000001,0033f558,00000044) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec92590 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec92590 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec925a4 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec925a4 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec925b6 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec925b6 | |
| 000b:Call advapi32.RegCloseKey(00000020) ret=7ec925c8 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec925c8 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00115680) ret=7ec925ef | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec925ef | |
| 000b:Call advapi32.RegCreateKeyExW(80000006,7ec98540 L"PerfStats\\StatData",00000000,00000000,00000000,00020006,00000000,0033eec4,00000000) ret=7ec92643 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec92643 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec93d9c | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec93d9c | |
| 000b:Call advapi32.RegCreateKeyExW(80000006,7ec98500 L"Config Manager\\Enum",00000000,00000000,00000000,00020006,00000000,0033eec4,00000000) ret=7ec9269f | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9269f | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7eca7c00 L"C29A23D0",00000000,00000000,00000000,00020006,00000000,0033eee0,00000000) ret=7ec9270f | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9270f | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984d8 L"HardWareKey",00000000,00000001,7eca7c12,0000001a) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984c8 L"Problem",00000000,00000003,7eca7c92,00000004) ret=7ec92f5d | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f5d | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984ba L"Status",00000000,00000003,7eca7c96,00000004) ret=7ec92f9b | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f9b | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984a4 L"Allocation",00000000,00000003,7eca7c9a,0000000c) ret=7ec92fd9 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92fd9 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98498 L"Child",00000000,00000003,7eca7ca6,00000004) ret=7ec93017 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93017 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98488 L"Sibling",00000000,00000003,7eca7caa,00000004) ret=7ec93055 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93055 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec9847a L"Parent",00000000,00000003,7eca7cae,00000004) ret=7ec93093 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93093 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec930a5 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec930a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7eca7cb2 L"C29A5A40",00000000,00000000,00000000,00020006,00000000,0033eee0,00000000) ret=7ec9270f | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9270f | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984d8 L"HardWareKey",00000000,00000001,7eca7cc4,00000022) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984c8 L"Problem",00000000,00000003,7eca7d44,00000004) ret=7ec92f5d | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f5d | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984ba L"Status",00000000,00000003,7eca7d48,00000004) ret=7ec92f9b | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f9b | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984a4 L"Allocation",00000000,00000003,7eca7d4c,0000000c) ret=7ec92fd9 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92fd9 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98498 L"Child",00000000,00000003,7eca7d58,00000004) ret=7ec93017 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93017 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98488 L"Sibling",00000000,00000003,7eca7d5c,00000004) ret=7ec93055 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93055 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec9847a L"Parent",00000000,00000003,7eca7d60,00000004) ret=7ec93093 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93093 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec930a5 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec930a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7eca7d64 L"C29A5C60",00000000,00000000,00000000,00020006,00000000,0033eee0,00000000) ret=7ec9270f | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9270f | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984d8 L"HardWareKey",00000000,00000001,7eca7d76,0000001c) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984c8 L"Problem",00000000,00000003,7eca7df6,00000004) ret=7ec92f5d | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f5d | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984ba L"Status",00000000,00000003,7eca7dfa,00000004) ret=7ec92f9b | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f9b | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984a4 L"Allocation",00000000,00000003,7eca7dfe,0000000c) ret=7ec92fd9 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92fd9 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98498 L"Child",00000000,00000003,7eca7e0a,00000004) ret=7ec93017 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93017 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98488 L"Sibling",00000000,00000003,7eca7e0e,00000004) ret=7ec93055 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93055 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec9847a L"Parent",00000000,00000003,7eca7e12,00000004) ret=7ec93093 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93093 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec930a5 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec930a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7eca7e16 L"C29A5DC0",00000000,00000000,00000000,00020006,00000000,0033eee0,00000000) ret=7ec9270f | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9270f | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984d8 L"HardWareKey",00000000,00000001,7eca7e28,00000036) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984c8 L"Problem",00000000,00000003,7eca7ea8,00000004) ret=7ec92f5d | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f5d | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984ba L"Status",00000000,00000003,7eca7eac,00000004) ret=7ec92f9b | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f9b | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984a4 L"Allocation",00000000,00000003,7eca7eb0,0000000c) ret=7ec92fd9 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92fd9 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98498 L"Child",00000000,00000003,7eca7ebc,00000004) ret=7ec93017 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93017 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98488 L"Sibling",00000000,00000003,7eca7ec0,00000004) ret=7ec93055 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93055 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec9847a L"Parent",00000000,00000003,7eca7ec4,00000004) ret=7ec93093 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93093 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec930a5 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec930a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7eca7ec8 L"C29A5F20",00000000,00000000,00000000,00020006,00000000,0033eee0,00000000) ret=7ec9270f | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec9270f | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984d8 L"HardWareKey",00000000,00000001,7eca7eda,00000022) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984c8 L"Problem",00000000,00000003,7eca7f5a,00000004) ret=7ec92f5d | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f5d | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984ba L"Status",00000000,00000003,7eca7f5e,00000004) ret=7ec92f9b | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92f9b | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec984a4 L"Allocation",00000000,00000003,7eca7f62,0000000c) ret=7ec92fd9 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec92fd9 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98498 L"Child",00000000,00000003,7eca7f6e,00000004) ret=7ec93017 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93017 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98488 L"Sibling",00000000,00000003,7eca7f72,00000004) ret=7ec93055 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93055 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec9847a L"Parent",00000000,00000003,7eca7f76,00000004) ret=7ec93093 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec93093 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec930a5 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec930a5 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec92733 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec92733 | |
| 000b:Call ntdll.NtQuerySystemInformation(00000001,0033eee0,0000000c,00000000) ret=7ec9275d | |
| 000b:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=7ec9275d | |
| 000b:Call advapi32.RegCreateKeyW(80000002,7ec98400 L"System\\CurrentControlSet\\Control\\Session Manager\\Environment",0033eec4) ret=7ec92781 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ec92781 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec983c0 L"NUMBER_OF_PROCESSORS",00000000,00000001,0033f558,00000004) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98360 L"PROCESSOR_ARCHITECTURE",00000000,00000001,7ec9838e,00000008) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98220 L"PROCESSOR_IDENTIFIER",00000000,00000001,0033f558,00000060) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec98200 L"PROCESSOR_LEVEL",00000000,00000001,0033f558,00000004) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec981c0 L"PROCESSOR_REVISION",00000000,00000001,0033f558,0000000a) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec93d88 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec93d88 | |
| 000b:Call KERNEL32.GetPrivateProfileSectionW(7ec981b0 L"rename",0033f558,00000400,7ec98198 L"wininit.ini") ret=7ec92831 | |
| 000b:Ret KERNEL32.GetPrivateProfileSectionW() retval=00000000 ret=7ec92831 | |
| 000b:Call advapi32.RegOpenKeyExW(80000002,7ec98100 L"System\\CurrentControlSet\\Control\\Session Manager",00000000,000f003f,0033eee0) ret=7ec9288f | |
| 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec9288f | |
| 000b:Call advapi32.RegQueryValueExW(00000024,7ec980c0 L"PendingFileRenameOperations",00000000,00000000,00000000,0033eec4) ret=7ec93ee7 | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec93ee7 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec93f23 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec93f23 | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec93f3d | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec93f3d | |
| 000b:Call advapi32.RegOpenKeyW(80000002,7ec98040 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",0033eeb4) ret=7ec928c8 | |
| 000b:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ec928c8 | |
| 000b:Call advapi32.RegCloseKey(00000000) ret=7ec928e2 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000006 ret=7ec928e2 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(00000000,00000000) ret=7ec928fa | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000014 ret=7ec928fa | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ec92923 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=001169f8 ret=7ec92923 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(001169f8,00000014) ret=7ec9293b | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ec9293b | |
| 000b:Call KERNEL32.FindFirstFileW(001169f8 L"C:\\windows\\system32\\dllcache\\*",0033f558) ret=7ec92978 | |
| 000b:Ret KERNEL32.FindFirstFileW() retval=ffffffff ret=7ec92978 | |
| 000b:Call KERNEL32.FindClose(ffffffff) ret=7ec92c75 | |
| 000b:Ret KERNEL32.FindClose() retval=00000000 ret=7ec92c75 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,001169f8) ret=7ec92c9c | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec92c9c | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec97cc0 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0033ed90,00000000) ret=7ec96695 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec96695 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,7ec98900 L"RunServicesOnce",00000000,00000000,00000000,000f003f,00000000,0033ed94,0033ed98) ret=7ec966fc | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec966fc | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec96716 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec96716 | |
| 000b:Call advapi32.RegQueryInfoKeyW(00000028,00000000,00000000,00000000,00000000,00000000,00000000,0033ed9c,0033eda4,0033eda0,00000000,00000000) ret=7ec96793 | |
| 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ec96793 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec967f3 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec967f3 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec9681a | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec9681a | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec96830 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec96830 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec97cc0 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0033ed90,00000000) ret=7ec96695 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec96695 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,7ec988dc L"RunServices",00000000,00000000,00000000,00020019,00000000,0033ed94,0033ed98) ret=7ec966fc | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec966fc | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec96716 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec96716 | |
| 000b:Call advapi32.RegQueryInfoKeyW(00000028,00000000,00000000,00000000,00000000,00000000,00000000,0033ed9c,0033eda4,0033eda0,00000000,00000000) ret=7ec96793 | |
| 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ec96793 | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000005c) ret=7ec96983 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=001169f8 ret=7ec96983 | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec969c3 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00116a60 ret=7ec969c3 | |
| 000b:Call advapi32.RegEnumValueW(00000028,00000000,00116a60,0033eda8,00000000,0033edb0,001169f8,0033edac) ret=7ec96a4c | |
| 000b:Ret advapi32.RegEnumValueW() retval=00000000 ret=7ec96a4c | |
| 000b:Call KERNEL32.CreateProcessW(00000000,001169f8 L"C:\\windows\\system32\\winemenubuilder.exe -a -r",00000000,00000000,00000000,00000000,00000000,00000000,0033edc8,0033edb8) ret=7ec96b91 | |
| 000d:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 000d:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 000d:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 000b:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ec96b91 | |
| 000b:Call KERNEL32.CloseHandle(00000034) ret=7ec96c3b | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec96c3b | |
| 000b:Call KERNEL32.CloseHandle(00000030) ret=7ec96c4a | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec96c4a | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00116a60) ret=7ec967f3 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec967f3 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,001169f8) ret=7ec9681a | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec9681a | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec96830 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec96830 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033f558,000000f7) ret=7ec92d31 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ec92d31 | |
| 000b:Call KERNEL32.CreateProcessW(0033f558 L"C:\\windows\\system32\\services.exe",0033f558 L"C:\\windows\\system32\\services.exe",00000000,00000000,00000001,00000008,00000000,00000000,0033eee0,0033eec4) ret=7ec92dcc | |
| 000f:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 000f:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 000f:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 000f:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ec92dcc | |
| 000b:Call KERNEL32.CloseHandle(00000030) ret=7ec942bc | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec942bc | |
| 000b:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7ec97f40 L"__wine_SvcctlStarted") ret=7ec942e6 | |
| 000b:Ret KERNEL32.CreateEventW() retval=00000024 ret=7ec942e6 | |
| 000f:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Call KERNEL32.WaitForMultipleObjects(00000002,0033f350,00000000,ffffffff) ret=7ec94322 | |
| 000f:Call PE DLL (proc=0x7ebfcf40,module=0x7ebb0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7ebfcf40,module=0x7ebb0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7eba2b40,module=0x7eb90000 L"userenv.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Call KERNEL32.DisableThreadLibraryCalls(7eb90000) ret=7eba0488 | |
| 000f:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7eba0488 | |
| 000f:Ret PE DLL (proc=0x7eba2b40,module=0x7eb90000 L"userenv.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Starting process L"C:\\windows\\system32\\services.exe" (entryproc=0x7ecc79f0) | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7ecc8ba0 L"__wine_SvcctlStarted") ret=7ecb7e94 | |
| 000f:Ret KERNEL32.CreateEventW() retval=0000001c ret=7ecb7e94 | |
| 000f:Call advapi32.RegOpenKeyW(80000002,7ecc8b40 L"System\\CurrentControlSet\\Control",0033fd30) ret=7ecb7ec0 | |
| 000f:Ret advapi32.RegOpenKeyW() retval=00000000 ret=7ecb7ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000024,7ecc8ae0 L"ServicesPipeTimeout",00000000,0033fd34,0033fd3c,0033fd38) ret=7ecb8002 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecb8002 | |
| 000f:Call advapi32.RegQueryValueExW(00000024,7ecc8aa0 L"WaitToKillServiceTimeout",00000000,0033fd34,0033fd3c,0033fd38) ret=7ecb8053 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecb8053 | |
| 000f:Call advapi32.RegCloseKey(00000024) ret=7ecb8076 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecb8076 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb7eed | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117ba8 ret=7ecb7eed | |
| 000f:Call KERNEL32.InitializeCriticalSection(00117bb8) ret=7ecb7f1b | |
| 000f:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ecb7f1b | |
| 000f:Call advapi32.RegCreateKeyExW(80000002,7ecc8e40 L"System\\CurrentControlSet\\Services",00000000,00000000,00000000,02000000,00000000,00117ba8,00000000) ret=7ecb7f74 | |
| 000f:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ecb7f74 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000000,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117c00 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001158a8 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"BITS",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117c90 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00117c90,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117cf0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00117cf0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d18 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00117d18,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d40 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00117d40,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d68 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d80 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00117c38,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00117c3c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00117c40,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00117c4c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00117c5c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000001,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d98 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e28 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"Eventlog",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e48 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e60 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00117dd0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00117dd4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00117dd8,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00117de4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00117df4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e28) ret=7ecbd12b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd12b | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd14f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd14f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd173 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd173 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd197 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd197 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1bb | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1bb | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1df | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1df | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd203 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd203 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e48) ret=7ecbd227 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd227 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e60) ret=7ecbd24b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd24b | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd25a | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd25a | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd269 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd269 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbd278 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd278 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd287 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd287 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd296 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd296 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117d98) ret=7ecbd2b7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd2b7 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000002,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d98 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e28 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"FontCache",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e48 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00117e48,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117ea8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00117ea8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117ed0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00117ed0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117f10 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00117f10,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117f50 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117f68 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00117dd0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00117dd4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00117dd8,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00117de4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00117df4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000003,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117f80 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118010 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"FontCache3.0.0.0",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000008e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118040 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118040,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001180d8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,001180d8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000068) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118100 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118100,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000068) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118170 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118170,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001181e0 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001181f8 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00117fb8,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00117fbc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00117fc0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00117fcc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00117fdc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000004,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118210 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001182a0 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"LanmanServer",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001182c8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,001182c8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118328 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00118328,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118350 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118350,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118378 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118378,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001183a0 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001183b8 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118248,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011824c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118250,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,0011825c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,0011826c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000005,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001183d0 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118460 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"MountMgr",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000054) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118480 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118480,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001184e0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,001184e0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118508 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118508,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118530 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118530,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118570 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118588 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118408,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011840c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118410,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,0011841c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,0011842c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000006,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001185a0 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118630 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"MSIServer",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118650 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118650,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001186a0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,001186a0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001186c8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,001186c8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001186e8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,001186e8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118720 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118738 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,001185d8,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,001185dc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,001185e0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,001185ec,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,001185fc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000007,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118750 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001187e0 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"PlugPlay",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118800 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118800,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118850 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00118850,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118878 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118878,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001188b0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,001188b0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118910 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118928 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118788,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011878c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118790,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,0011879c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,001187ac,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000008,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118940 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001189d0 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"Schedule",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001189f0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,001189f0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118a50 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00118a50,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118a78 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118a78,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118aa0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118aa0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ac8 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ae0 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118978,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011897c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118980,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,0011898c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,0011899c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000009,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118af8 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118b88 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"Spooler",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ba0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118ba0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118bf0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00118bf0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118c18 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00118c18,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118c40 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118c40,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000054) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118c68 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118c68,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118cc8 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ce0 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118b30,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00118b34,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118b38,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00118b44,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00118b54,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000a,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118cf8 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118d88 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"StiSvc",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000056) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118da0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118da0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e00 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00118e00,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e28 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118e28,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e50 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118e50,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e78 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e90 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118d30,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00118d34,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118d38,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00118d44,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00118d54,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000b,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ea8 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f38 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"Tcpip",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f50 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f68 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118ee0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00118ee4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118ee8,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00118ef4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00118f04,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00118f38) ret=7ecbd12b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd12b | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd14f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd14f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd173 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd173 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd197 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd197 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1bb | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1bb | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1df | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1df | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd203 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd203 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00118f50) ret=7ecbd227 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd227 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00118f68) ret=7ecbd24b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd24b | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd25a | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd25a | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd269 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd269 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbd278 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd278 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd287 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd287 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd296 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd296 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00118ea8) ret=7ecbd2b7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd2b7 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000c,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ea8 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f38 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"TermService",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f58 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00118f58,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118fa0 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00118fa0,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118fc8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00118fc8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf3a6 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002e) ret=7ecbf448 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ff8 ret=7ecbf448 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00118ff8,0033fa34) ret=7ecbf47a | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf47a | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119030 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119048 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00118ee0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,00118ee4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,00118ee8,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,00118ef4,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,00118f04,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000d,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190f0 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"VxD",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119108 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119120 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00119098,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011909c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,001190a0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,001190ac,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,001190bc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001190f0) ret=7ecbd12b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd12b | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd14f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd14f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd173 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd173 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd197 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd197 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1bb | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1bb | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1df | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1df | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd203 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd203 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119108) ret=7ecbd227 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd227 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119120) ret=7ecbd24b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd24b | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd25a | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd25a | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd269 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd269 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbd278 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd278 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd287 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd287 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd296 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd296 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119060) ret=7ecbd2b7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd2b7 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000e,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190f0 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"Winsock",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119108 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119120 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00119098,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011909c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,001190a0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,001190ac,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,001190bc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001190f0) ret=7ecbd12b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd12b | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd14f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd14f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd173 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd173 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd197 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd197 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1bb | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1bb | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1df | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1df | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd203 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd203 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119108) ret=7ecbd227 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd227 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119120) ret=7ecbd24b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd24b | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd25a | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd25a | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd269 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd269 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbd278 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd278 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd287 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd287 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd296 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd296 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119060) ret=7ecbd2b7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd2b7 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000f,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ecbd928 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ecbd079 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ecbd079 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecbf2a1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190f0 ret=7ecbf2a1 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fab4 L"Winsock2",00000000,00020019,0033fab0) ret=7ecbd9a1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ecbd9a1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dcc L"ImagePath",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dc0 L"Group",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d66 L"ObjectName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e10 L"DisplayName",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d46 L"Description",00000000,0033fa38,00000000,0033fa34) ret=7ecbf3a6 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf3a6 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8da0 L"DependOnService",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119110 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d7c L"DependOnGroup",00000000,0033fa38,00000000,0033fa34) ret=7ecbf626 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf626 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ecbf7b1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119128 ret=7ecbf7b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8e06 L"Type",00000000,0033fa38,00119098,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8dfa L"Start",00000000,0033fa38,0011909c,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8de0 L"ErrorControl",00000000,0033fa38,001190a0,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d5e L"Tag",00000000,0033fa38,001190ac,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ecc8d20 L"PreshutdownTimeout",00000000,0033fa38,001190bc,0033fa34) ret=7ecbf82d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbf82d | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ecbdf3a | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbdf3a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001190f0) ret=7ecbd12b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd12b | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd14f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd14f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd173 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd173 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd197 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd197 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1bb | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1bb | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd1df | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd1df | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecbd203 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd203 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119110) ret=7ecbd227 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd227 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119128) ret=7ecbd24b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd24b | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd25a | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd25a | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd269 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd269 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbd278 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd278 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd287 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd287 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ecbd296 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbd296 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119060) ret=7ecbd2b7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbd2b7 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000010,0033fab4,00000104) ret=7ecbd928 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000103 ret=7ecbd928 | |
| 000f:Call rpcrt4.RpcServerUseProtseqEpW(0033fca0 L"ncacn_np",00000000,0033fcb2 L"\\pipe\\svcctl",00000000) ret=7ecbc995 | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fca0 L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7ec5e6d4 | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ec5e6d4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec5e6fa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ec5e6fa | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fca0 L"ncacn_np",ffffffff,00119060,00000009,00000000,00000000) ret=7ec5e73b | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ec5e73b | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ec6fcb9 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119078 ret=7ec6fcb9 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ec6fce7 | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000028 ret=7ec6fce7 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec5e5cf | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190c0 ret=7ec5e5cf | |
| 000f:Call KERNEL32.InitializeCriticalSection(00119090) ret=7ec6a651 | |
| 000f:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec6a651 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119060) ret=7ec5f028 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec5f028 | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fcb2 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7ec5e6d4 | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ec5e6d4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e6fa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ec5e6fa | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fcb2 L"\\pipe\\svcctl",ffffffff,00119060,0000000d,00000000,00000000) ret=7ec5e73b | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ec5e73b | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ec6f7c8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119100 ret=7ec6f7c8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119190 ret=7ec5e5cf | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec79ba1 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001191a8 ret=7ec79ba1 | |
| 000f:Call KERNEL32.CreateNamedPipeA(001191a8 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ec7143f | |
| 000f:Ret KERNEL32.CreateNamedPipeA() retval=0000002c ret=7ec7143f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001191a8) ret=7ec79be1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119060) ret=7ec5f028 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec5f028 | |
| 000f:Ret rpcrt4.RpcServerUseProtseqEpW() retval=00000000 ret=7ecbc995 | |
| 000f:Call rpcrt4.RpcServerRegisterIf(7eccdd00,00000000,00000000) ret=7ecbca18 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,0000003c) ret=7ec6cda2 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001191a8 ret=7ec6cda2 | |
| 000f:Ret rpcrt4.RpcServerRegisterIf() retval=00000000 ret=7ecbca18 | |
| 000f:Call rpcrt4.RpcServerListen(00000001,000004d2,00000001) ret=7ecbca5e | |
| 000f:Call KERNEL32.CreateMutexW(00000000,00000000,00000000) ret=7ec6a864 | |
| 000f:Ret KERNEL32.CreateMutexW() retval=00000030 ret=7ec6a864 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ec6a83c | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000034 ret=7ec6a83c | |
| 000f:Call KERNEL32.CreateThread(00000000,00000000,7ec6a190,00119078,00000000,00000000) ret=7ec6a7d5 | |
| 000f:Ret KERNEL32.CreateThread() retval=00000038 ret=7ec6a7d5 | |
| 000f:Call KERNEL32.CloseHandle(00000038) ret=7ec6a7f1 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec6a7f1 | |
| 000f:Call KERNEL32.WaitForSingleObject(00000030,ffffffff) ret=7ec6a3ad | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ec6a3ad | |
| 000f:Call KERNEL32.SetEvent(00000028) ret=7ec6fc66 | |
| 000f:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec6fc66 | |
| 0010:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 000f:Call KERNEL32.WaitForSingleObject(00000034,ffffffff) ret=7ec6a3cc | |
| 0010:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0010:Starting thread proc 0x7ec6a190 (arg=0x119078) | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ec71690,00119100,00000000,00000000) ret=7ec6fac3 | |
| 0010:Ret KERNEL32.CreateThread() retval=00000038 ret=7ec6fac3 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec6fbe6 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ec6fbe6 | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,00119060,00000000,ffffffff,00000001) ret=7ec76da4 | |
| 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000000 ret=7ec76da4 | |
| 0010:Call ntdll.RtlReAllocateHeap(00110000,00000000,00119060,00000008) ret=7ec6fb5a | |
| 0010:Ret ntdll.RtlReAllocateHeap() retval=00119060 ret=7ec6fb5a | |
| 0011:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0010:Call KERNEL32.SetEvent(00000034) ret=7ec6a23a | |
| 0011:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ec6a3cc | |
| 0011:Starting thread proc 0x7ec71690 (arg=0x119100) | |
| 000f:Call KERNEL32.ReleaseMutex(00000030) ret=7ec6a3db | |
| 0011:Call KERNEL32.ConnectNamedPipe(0000002c,00000000) ret=7ec716c5 | |
| 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ec6a3db | |
| 0010:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec6a23a | |
| 000f:Ret rpcrt4.RpcServerListen() retval=00000000 ret=7ecbca5e | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,00119060,00000000,ffffffff,00000001) ret=7ec76da4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7ecb81bb | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001191f0 ret=7ecb81bb | |
| 000f:Call KERNEL32.WaitForSingleObject(00000000,00000000) ret=7ecbe9b3 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=ffffffff ret=7ecbe9b3 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbe9cd | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbe9cd | |
| 000f:Call KERNEL32.CreateMutexW(00000000,00000001,00000000) ret=7ecbe9ed | |
| 000f:Ret KERNEL32.CreateMutexW() retval=00000040 ret=7ecbe9ed | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ecbf0ac | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000044 ret=7ecbf0ac | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7ecbf07c | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000048 ret=7ecbf07c | |
| 000f:Call advapi32.RegCreateKeyExW(80000002,7ecc8c80 L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent",00000000,00000000,00000001,00000003,00000000,0033fc98,00000000) ret=7ecbea5e | |
| 000f:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ecbea5e | |
| 000f:Call advapi32.RegQueryValueExW(0000004c,00000000,00000000,0033fca8,0033fc9c,0033fc94) ret=7ecbea9d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ecbea9d | |
| 000f:Call advapi32.RegSetValueExW(0000004c,00000000,00000000,00000004,0033fc9c,00000004) ret=7ecbebec | |
| 000f:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ecbebec | |
| 000f:Call advapi32.RegCloseKey(0000004c) ret=7ecbebfb | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbebfb | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004e) ret=7ecbec27 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7ecbec27 | |
| 000f:Call KERNEL32.CreateNamedPipeW(00119298 L"\\\\.\\pipe\\net\\NtControlPipe0",40000003,00000000,00000001,00000100,00000100,00002710,00000000) ret=7ecbeb0d | |
| 000f:Ret KERNEL32.CreateNamedPipeW() retval=0000004c ret=7ecbeb0d | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7ecbeb31 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbeb31 | |
| 000f:Call advapi32.OpenProcessToken(ffffffff,0000000a,0033f9e0) ret=7ecbe7e6 | |
| 000f:Ret advapi32.OpenProcessToken() retval=00000001 ret=7ecbe7e6 | |
| 000f:Call userenv.CreateEnvironmentBlock(7eccebc4,00000050,00000000) ret=7ecbe858 | |
| 000f:Call advapi32.RegOpenKeyExW(80000002,7eba3580 L"System\\CurrentControlSet\\Control\\Session Manager\\Environment",00000000,00020019,0032f674) ret=7eba056f | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eba056f | |
| 000f:Call ntdll.RtlCreateEnvironment(00000000,0032f66c) ret=7eba05c5 | |
| 000f:Ret ntdll.RtlCreateEnvironment() retval=00000000 ret=7eba05c5 | |
| 000f:Call KERNEL32.GetEnvironmentVariableW(7eba355a L"SystemRoot",0032f92e,00007fff) ret=7eba05fd | |
| 000f:Ret KERNEL32.GetEnvironmentVariableW() retval=0000000a ret=7eba05fd | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f684,7eba355a L"SystemRoot") ret=7eba0621 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba0621 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f68c,0032f92e L"C:\\windows") ret=7eba0643 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba0643 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032f684,0032f68c) ret=7eba0669 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba0669 | |
| 000f:Call KERNEL32.GetEnvironmentVariableW(7eba3542 L"SystemDrive",0032f92e,00007fff) ret=7eba0693 | |
| 000f:Ret KERNEL32.GetEnvironmentVariableW() retval=00000002 ret=7eba0693 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f684,7eba3542 L"SystemDrive") ret=7eba06b7 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000018 ret=7eba06b7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f68c,0032f92e L"c:") ret=7eba06d3 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000006 ret=7eba06d3 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032f684,0032f68c) ret=7eba06f3 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba06f3 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000000,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"ComSpec") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"ComSpec",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"ComSpec",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\system32\\cmd.exe") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\system32\\cmd.exe") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000001,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"NUMBER_OF_PROCESSORS") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"NUMBER_OF_PROCESSORS",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"NUMBER_OF_PROCESSORS",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"2") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000002,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"OS") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000006 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"OS",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"OS",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"Windows_NT") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000003,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PATH") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba0249 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(00540000,0032e5cc,0032e5d4) ret=7eba02b3 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7eba02b3 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATH",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000070) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATH",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000004,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PATHEXT") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eba0249 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(00540000,0032e5cc,0032e5d4) ret=7eba02b3 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7eba02b3 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATHEXT",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATHEXT",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000005,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_ARCHITECTURE") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002e ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_ARCHITECTURE",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_ARCHITECTURE",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"x86") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000006,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_IDENTIFIER") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_IDENTIFIER",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_IDENTIFIER",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"x86 Family 6 Model 15 Stepping 13, GenuineIntel") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000060 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000007,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_LEVEL") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_LEVEL",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_LEVEL",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"6") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000008,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_REVISION") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000026 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_REVISION",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_REVISION",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"0f0d") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000009,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000a,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000b,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TEMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TEMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TEMP",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\temp") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000c,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TMP",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\temp") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000d,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"windir") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000e ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"windir",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"windir",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000e,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"winsysdir") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000014 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"winsysdir",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"winsysdir",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\system32") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000028 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000f,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eba01e5 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000000,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"ComSpec") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"ComSpec",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"ComSpec",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\system32\\cmd.exe") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\system32\\cmd.exe") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000001,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"NUMBER_OF_PROCESSORS") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"NUMBER_OF_PROCESSORS",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"NUMBER_OF_PROCESSORS",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"2") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000002,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"OS") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000006 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"OS",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"OS",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"Windows_NT") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000003,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PATH") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba0249 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(00540000,0032e5cc,0032e5d4) ret=7eba02b3 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7eba02b3 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATH",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000070) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATH",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eba0361 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eba0361 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000004,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PATHEXT") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eba0249 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(00540000,0032e5cc,0032e5d4) ret=7eba02b3 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7eba02b3 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATHEXT",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PATHEXT",00000000,00000000,0032ee3e,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH") ret=7eba0361 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eba0361 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000005,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_ARCHITECTURE") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002e ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_ARCHITECTURE",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_ARCHITECTURE",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"x86") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000006,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_IDENTIFIER") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_IDENTIFIER",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_IDENTIFIER",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"x86 Family 6 Model 15 Stepping 13, GenuineIntel") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000060 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000007,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_LEVEL") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_LEVEL",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_LEVEL",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"6") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000008,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"PROCESSOR_REVISION") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000026 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_REVISION",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"PROCESSOR_REVISION",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"0f0d") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000009,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000a,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000b,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TEMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TEMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TEMP",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\temp") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000c,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"TMP",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows\\temp") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000d,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"windir") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000e ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"windir",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"windir",00000000,00000000,00119298,0032e558) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e55c,00119298 L"C:\\windows") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032e55c,0032e564,0032e588) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000e,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"winsysdir") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000014 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"winsysdir",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e5dc L"winsysdir",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\windows\\system32") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000028 ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000f,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eba01e5 | |
| 000f:Call advapi32.RegOpenKeyExW(00000054,7eba352a L"Environment",00000000,00020019,0032f678) ret=7eba0763 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7eba0763 | |
| 000f:Call advapi32.RegOpenKeyExW(00000054,7eba3500 L"Volatile Environment",00000000,00020019,0032f678) ret=7eba07a7 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7eba07a7 | |
| 000f:Call advapi32.RegCloseKey(00000054) ret=7eba07c1 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eba07c1 | |
| 000f:Call advapi32.RegOpenKeyExW(80000002,7eba3480 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00020019,0032f674) ret=7eba07f5 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eba07f5 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3440 L"ProfilesDirectory",00000000,0032f5d4,00000000,0032f5d8) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3440 L"ProfilesDirectory",00000000,00000000,00119298,0032f5d8) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f5dc,00119298 L"C:\\users") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000012 ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032f5dc,0032f5e4,0032f608) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3420 L"AllUsersProfile",00000000,0032f5d4,00000000,0032f5d8) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7eba0046 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba0046 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3420 L"AllUsersProfile",00000000,00000000,00119298,0032f5d8) ret=7eba007f | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba007f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f5dc,00119298 L"Public") ret=7eba009f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000e ret=7eba009f | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(00540000,0032f5dc,0032f5e4,0032f608) ret=7eba00cc | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eba00cc | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba00f7 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba00f7 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f684,7eba3400 L"ALLUSERSPROFILE") ret=7eba0ca8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba0ca8 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f68c,0032f92e L"C:\\users\\Public") ret=7eba0cc4 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eba0cc4 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032f684,0032f68c) ret=7eba0cde | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba0cde | |
| 000f:Call advapi32.RegCloseKey(00000054) ret=7eba0f9f | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eba0f9f | |
| 000f:Call KERNEL32.GetComputerNameW(0032f92e,0032f670) ret=7eba0823 | |
| 000f:Ret KERNEL32.GetComputerNameW() retval=00000001 ret=7eba0823 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f684,7eba33ce L"COMPUTERNAME") ret=7eba0b58 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000001a ret=7eba0b58 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f68c,0032f92e L"localhost") ret=7eba0b74 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000014 ret=7eba0b74 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032f684,0032f68c) ret=7eba0b94 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba0b94 | |
| 000f:Call KERNEL32.IsWow64Process(ffffffff,0032f680) ret=7eba0845 | |
| 000f:Ret KERNEL32.IsWow64Process() retval=00000001 ret=7eba0845 | |
| 000f:Call advapi32.RegOpenKeyExW(80000002,7eba3340 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00020119,0032f67c) ret=7eba087f | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eba087f | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3300 L"ProgramFilesDir",00000000,0032f5d4,00000000,0032f5d8) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3300 L"ProgramFilesDir",00000000,00000000,0032f6a6,0032f608) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f694,7eba32cc L"ProgramFiles") ret=7eba0fe0 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000001a ret=7eba0fe0 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f69c,0032f6a6 L"C:\\Program Files") ret=7eba0ffc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000022 ret=7eba0ffc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032f694,0032f69c) ret=7eba1022 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba1022 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3266 L"CommonFilesDir",00000000,0032f5d4,00000000,0032f5d8) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7eba3266 L"CommonFilesDir",00000000,00000000,0032f6a6,0032f608) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f694,7eba3200 L"CommonProgramFiles") ret=7eba0ad0 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000026 ret=7eba0ad0 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f69c,0032f6a6 L"C:\\Program Files\\Common Files") ret=7eba0aec | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000003c ret=7eba0aec | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032f694,0032f69c) ret=7eba0b12 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba0b12 | |
| 000f:Call advapi32.RegCloseKey(00000054) ret=7eba0b31 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eba0b31 | |
| 000f:Call advapi32.GetTokenInformation(00000050,00000001,00000000,00000000,0032f670) ret=7eba08cd | |
| 000f:Ret advapi32.GetTokenInformation() retval=00000000 ret=7eba08cd | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eba1053 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7eba1053 | |
| 000f:Call advapi32.GetTokenInformation(00000050,00000001,00119298,00000024,0032f670) ret=7eba108f | |
| 000f:Ret advapi32.GetTokenInformation() retval=00000001 ret=7eba108f | |
| 000f:Call advapi32.ConvertSidToStringSidW(001192a0,0032f680) ret=7eba10b5 | |
| 000f:Ret advapi32.ConvertSidToStringSidW() retval=00000001 ret=7eba10b5 | |
| 000f:Call advapi32.LookupAccountSidW(00000000,001192a0,0032f940,0032f694,00000000,0032f69c,0032f67c) ret=7eba118d | |
| 000f:Ret advapi32.LookupAccountSidW() retval=00000000 ret=7eba118d | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7eba11bc | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eba11bc | |
| 000f:Call KERNEL32.LocalFree(001192c8) ret=7eba11e8 | |
| 000f:Ret KERNEL32.LocalFree() retval=00000000 ret=7eba11e8 | |
| 000f:Call advapi32.RegOpenKeyExW(80000003,0032f92e L"S-1-5-21-0-0-0-1000",00000000,00020019,0032f674) ret=7eba09f7 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eba09f7 | |
| 000f:Call advapi32.RegOpenKeyExW(00000058,7eba352a L"Environment",00000000,00020019,0032f678) ret=7eba134a | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eba134a | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000000,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TEMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TEMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TEMP",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\users\\mikhail\\Temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002c ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000001,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TMP",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\users\\mikhail\\Temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002c ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000002,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eba01e5 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000000,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TEMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TEMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TEMP",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\users\\mikhail\\Temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002c ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000001,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eba01e5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5cc,0032e5dc L"TMP") ret=7eba0249 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eba0249 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TMP",00000000,0032e554,00000000,0032e558) ret=7eb9ffa4 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eb9ffa4 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e5dc L"TMP",00000000,00000000,0032eddc,0032e588) ret=7eba0012 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eba0012 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e5d4,0032eddc L"C:\\users\\mikhail\\Temp") ret=7eba03cc | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002c ret=7eba03cc | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f66c,0032e5cc,0032e5d4) ret=7eba03f2 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eba03f2 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000002,0032e5dc,0032e5c8,00000000,00000000,00000000,00000000) ret=7eba01e5 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eba01e5 | |
| 000f:Call advapi32.RegCloseKey(0000005c) ret=7eba1565 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eba1565 | |
| 000f:Call advapi32.RegOpenKeyExW(00000058,7eba3500 L"Volatile Environment",00000000,00020019,0032f678) ret=7eba1388 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7eba1388 | |
| 000f:Call advapi32.RegCloseKey(00000058) ret=7eba13a2 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eba13a2 | |
| 000f:Ret userenv.CreateEnvironmentBlock() retval=00000001 ret=7ecbe858 | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(00118480 L"C:\\windows\\system32\\drivers\\mountmgr.sys",00000000,00000000) ret=7ecbe497 | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7ecbe497 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000052) ret=7ecbe4bd | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7ecbe4bd | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(00118480 L"C:\\windows\\system32\\drivers\\mountmgr.sys",00119298,00000029) ret=7ecbe4ee | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7ecbe4ee | |
| 000f:Call KERNEL32.GetSystemDirectoryW(0033fa24,00000104) ret=7ecbe666 | |
| 000f:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ecbe666 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7ecbe6e2 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbe6e2 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ecbe705 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119298 ret=7ecbe705 | |
| 000f:Call KERNEL32.CreateProcessW(00000000,00119298 L"C:\\windows\\system32\\winedevice.exe MountMgr",00000000,00000000,00000000,00000400,00540000,00000000,0033f9e0,0033f9d0) ret=7ecbe595 | |
| 0013:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 0013:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0013:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 000f:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ecbe595 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119298) ret=7ecbe5b8 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbe5b8 | |
| 000f:Call KERNEL32.CloseHandle(00000064) ret=7ecbe5f2 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ecbe5f2 | |
| 000f:Call KERNEL32.ConnectNamedPipe(0000004c,0033fca8) ret=7ecbed38 | |
| 000f:Ret KERNEL32.ConnectNamedPipe() retval=00000000 ret=7ecbed38 | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fca0,00000000,00002710) ret=7ecbf19d | |
| 000d:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7ea7af40,module=0x7ea30000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7ea7af40,module=0x7ea30000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e825270,module=0x7e790000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Call PE DLL (proc=0x7ec98f40,module=0x7ec50000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Ret PE DLL (proc=0x7ec98f40,module=0x7ec50000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Call PE DLL (proc=0x7ec1f040,module=0x7ec00000 L"ntoskrnl.exe",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Call KERNEL32.DisableThreadLibraryCalls(7ec00000) ret=7ec1edd8 | |
| 0013:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ec1edd8 | |
| 0013:Call ntdll.RtlAddVectoredExceptionHandler(00000001,7ec198b0) ret=7ec1edf2 | |
| 0013:Ret ntdll.RtlAddVectoredExceptionHandler() retval=001156b8 ret=7ec1edf2 | |
| 0013:Call ntdll.NtGetTickCount() ret=7ec1ce2b | |
| 0013:Ret ntdll.NtGetTickCount() retval=01ab8062 ret=7ec1ce2b | |
| 0013:Ret PE DLL (proc=0x7ec1f040,module=0x7ec00000 L"ntoskrnl.exe",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Starting process L"C:\\windows\\system32\\winedevice.exe" (entryproc=0x7eccbae0) | |
| 0013:Call advapi32.StartServiceCtrlDispatcherW(0033fdcc) ret=7eccba86 | |
| 0013:Call PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0013:Ret PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0013:Call rpcrt4.NdrClientInitializeNew(0033f778,0033f858,7ecb2e80,0000000f) ret=7ec955dd | |
| 0013:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8bc10 ret=7ec955dd | |
| 0013:Call rpcrt4.RpcStringBindingComposeW(00000000,0033f6e0 L"ncacn_np",00000000,0033f6f2 L"\\pipe\\svcctl",00000000,0033f6d8) ret=7ec8bf2f | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ebb3982 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119888 ret=7ebb3982 | |
| 0013:Ret rpcrt4.RpcStringBindingComposeW() retval=00000000 ret=7ec8bf2f | |
| 0013:Call rpcrt4.RpcBindingFromStringBindingW(00119888 L"ncacn_np:[\\\\pipe\\\\svcctl]",0033f6dc) ret=7ec8bfa2 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ebb1ff7 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001199a8 ret=7ebb1ff7 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7ebb1ff7 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001198e8 ret=7ebb1ff7 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ebb1ff7 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119900 ret=7ebb1ff7 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebb1ede | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119928 ret=7ebb1ede | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001199a8 L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7ebb26d4 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ebb26d4 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebb26fa | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab30 ret=7ebb26fa | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001199a8 L"ncacn_np",ffffffff,0011ab30,00000009,00000000,00000000) ret=7ebb273b | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ebb273b | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebb53aa | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb53aa | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001198e8 L"",ffffffff,00000000,00000000,00000000,00000000) ret=7ebb26d4 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7ebb26d4 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebb26fa | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab48 ret=7ebb26fa | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001198e8 L"",ffffffff,0011ab48,00000001,00000000,00000000) ret=7ebb273b | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7ebb273b | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebb53e2 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb53e2 | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00119900 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7ebb26d4 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ebb26d4 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebb26fa | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab60 ret=7ebb26fa | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00119900 L"\\pipe\\svcctl",ffffffff,0011ab60,0000000d,00000000,00000000) ret=7ebb273b | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ebb273b | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebb5414 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb5414 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ebb042b | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab78 ret=7ebb042b | |
| 0013:Call KERNEL32.InitializeCriticalSection(0011aba8) ret=7ebb0461 | |
| 0013:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebb0461 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac00 ret=7ebb25cf | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac18 ret=7ebb25cf | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac30 ret=7ebb25cf | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebcc4f3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcc4f3 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00119900) ret=7ebcc4f3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcc4f3 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,001198e8) ret=7ebcc4f3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcc4f3 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,001199a8) ret=7ebcc4f3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcc4f3 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebcc4f3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcc4f3 | |
| 0013:Ret rpcrt4.RpcBindingFromStringBindingW() retval=00000000 ret=7ec8bfa2 | |
| 0013:Call rpcrt4.RpcStringFreeW(0033f6d8) ret=7ec8bfb0 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00119888) ret=7ebcc4f3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcc4f3 | |
| 0013:Ret rpcrt4.RpcStringFreeW() retval=00000000 ret=7ec8bfb0 | |
| 0013:Call rpcrt4.NdrPointerBufferSize(0033f858,00000000,7eca17da) ret=7ec95616 | |
| 0013:Ret rpcrt4.NdrPointerBufferSize() retval=00000000 ret=7ec95616 | |
| 0013:Call rpcrt4.NdrPointerBufferSize(0033f858,00000000,7eca197e) ret=7ec95649 | |
| 0013:Ret rpcrt4.NdrPointerBufferSize() retval=00000000 ret=7ec95649 | |
| 0013:Call rpcrt4.NdrGetBuffer(0033f858,00000010,00119928) ret=7ec95666 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ebcdba1 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001199a8 ret=7ebcdba1 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ebc37c8 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119888 ret=7ebc37c8 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac48 ret=7ebb25cf | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac60 ret=7ebb25cf | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ebcdba1 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac78 ret=7ebcdba1 | |
| 0013:Call KERNEL32.CreateFileA(0011ac78 "\\\\.\\pipe\\svcctl",c0000000,00000000,00000000,00000003,00000000,00000000) ret=7ebc4a05 | |
| 0013:Ret KERNEL32.CreateFileA() retval=00000020 ret=7ebc4a05 | |
| 0013:Call KERNEL32.SetNamedPipeHandleState(00000020,0033f468,00000000,00000000) ret=7ebc4ae3 | |
| 0011:Ret KERNEL32.ConnectNamedPipe() retval=00000001 ret=7ec716c5 | |
| 0011:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) | |
| 0011:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) retval=1 | |
| 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000001 ret=7ec76da4 | |
| 0010:Call KERNEL32.GetExitCodeThread(00000038,0043e968) ret=7ec76e1b | |
| 0010:Ret KERNEL32.GetExitCodeThread() retval=00000001 ret=7ec76e1b | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ec6f7c8 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=001192b8 ret=7ec6f7c8 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119278 ret=7ec5e5cf | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec79ba1 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec79ba1 | |
| 0010:Call KERNEL32.CreateNamedPipeA(00119348 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ec7143f | |
| 0013:Ret KERNEL32.SetNamedPipeHandleState() retval=00000001 ret=7ebc4ae3 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac78) ret=7ebcdbe1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebba31c | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac78 ret=7ebba31c | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebcc256 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011acc8 ret=7ebcc256 | |
| 0013:Call KERNEL32.InitializeCriticalSection(0011acd0) ret=7ebcc26b | |
| 0013:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebcc26b | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebbb296 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad28 ret=7ebbb296 | |
| 0013:Call KERNEL32.WriteFile(00000020,0011ad28,00000048,0033f418,00000000) ret=7ebc4c45 | |
| 0010:Ret KERNEL32.CreateNamedPipeA() retval=0000003c ret=7ec7143f | |
| 0010:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec79be1 | |
| 0010:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0010:Call KERNEL32.CloseHandle(00000000) ret=7ec76e3c | |
| 0013:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebc4c45 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad28) ret=7ebbb3cf | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbb3cf | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac78) ret=7ebba8e8 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebba8e8 | |
| 0013:Call KERNEL32.ReadFile(00000020,0033f41c,00000010,0033f3c8,00000000) ret=7ebc4cd5 | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec76e3c | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ec6bb70,001192b8,00000000,00000000) ret=7ec6c2ea | |
| 0010:Ret KERNEL32.CreateThread() retval=00000058 ret=7ec6c2ea | |
| 0010:Call KERNEL32.CloseHandle(00000058) ret=7ec6c2fc | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec6c2fc | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ec71690,00119100,00000000,00000000) ret=7ec6fac3 | |
| 0014:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0014:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0014:Starting thread proc 0x7ec6bb70 (arg=0x1192b8) | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec6bc65 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec78256 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119380 ret=7ec78256 | |
| 0014:Call KERNEL32.InitializeCriticalSection(00119388) ret=7ec7826b | |
| 0014:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec7826b | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0010:Ret KERNEL32.CreateThread() retval=00000058 ret=7ec6fac3 | |
| 0010:Call ntdll.RtlReAllocateHeap(00110000,00000000,00119060,00000008) ret=7ec6fb5a | |
| 0010:Ret ntdll.RtlReAllocateHeap() retval=00119060 ret=7ec6fb5a | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,00119060,00000000,ffffffff,00000001) ret=7ec76da4 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec68884 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001193e0 ret=7ec68884 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001193f0,0000000c,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec68963 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119408 ret=7ec68963 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119408,0000002c,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec79ba1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119440 ret=7ec79ba1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119408) ret=7ec68b12 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec6b65f | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119408 ret=7ec6b65f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ec5dede | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119478 ret=7ec5dede | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec5e5cf | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001194c8 ret=7ec5e5cf | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001194e0 ret=7ec5e5cf | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec5c42b | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7ec5c42b | |
| 0014:Call KERNEL32.InitializeCriticalSection(00119528) ret=7ec5c461 | |
| 0014:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec5c461 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec5e5cf | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119580 ret=7ec5e5cf | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119598 ret=7ec5e5cf | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ec664db | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195b0 ret=7ec664db | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119408) ret=7ec6b88a | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6b88a | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ec67296 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119600 ret=7ec67296 | |
| 0014:Call KERNEL32.WriteFile(0000002c,00119600,00000044,0064e878,00000000) ret=7ec70c45 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc884 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac78 ret=7ebbc884 | |
| 0013:Call KERNEL32.ReadFile(00000020,0011ac88,00000008,0033f3c8,00000000) ret=7ebc4cd5 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ebbc963 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad28 ret=7ebbc963 | |
| 0013:Call KERNEL32.ReadFile(00000020,0011ad28,0000002c,0033f3c8,00000000) ret=7ebc4cd5 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ebcdba1 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad60 ret=7ebcdba1 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad28) ret=7ebbcb12 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb12 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad60) ret=7ebcdbe1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac78) ret=7ebba8e8 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebba8e8 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebb10c3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb10c3 | |
| 0013:Ret rpcrt4.NdrGetBuffer() retval=001199a8 ret=7ec95666 | |
| 0013:Call rpcrt4.NdrPointerMarshall(0033f858,00000000,7eca17da) ret=7ec95680 | |
| 0013:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec95680 | |
| 0013:Call rpcrt4.NdrPointerMarshall(0033f858,00000000,7eca197e) ret=7ec956a0 | |
| 0013:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec956a0 | |
| 0013:Call rpcrt4.NdrSendReceive(0033f858,001199b4) ret=7ec956f4 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebbd868 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac78 ret=7ebbd868 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000024) ret=7ebbb296 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac98 ret=7ebbb296 | |
| 0013:Call KERNEL32.WriteFile(00000020,0011ac98,00000024,0033f508,00000000) ret=7ebc4c45 | |
| 0013:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebc4c45 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac98) ret=7ebbb3cf | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbb3cf | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac78) ret=7ebbd933 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbd933 | |
| 0013:Call KERNEL32.ReadFile(00000020,0033f51c,00000010,0033f4c8,00000000) ret=7ebc4cd5 | |
| 0014:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119600) ret=7ec673cf | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001195b0) ret=7ec668e8 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119440) ret=7ec79be1 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001193e0) ret=7ec668e8 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec6bc14 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6bc14 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6bc38 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6bc38 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec6bc65 | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001193e0 ret=7ec68884 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001193f0,00000008,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec68963 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119400 ret=7ec68963 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119400,0000000c,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec79ba1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119418 ret=7ec79ba1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119400) ret=7ec68b12 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119430 ret=7ec6bd0e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119430,00000010) ret=7ec6bd58 | |
| 0015:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0015:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0015:Starting thread proc 0x7ec71690 (arg=0x119100) | |
| 0015:Call KERNEL32.ConnectNamedPipe(0000003c,00000000) ret=7ec716c5 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195b0 ret=7ec6bc65 | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0016:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0016:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0016:Starting thread proc 0x7bc94740 (arg=(nil)) | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec78256 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001195e8 ret=7ec78256 | |
| 0016:Call KERNEL32.InitializeCriticalSection(001195f0) ret=7ec7826b | |
| 0016:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec7826b | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119348,0084e6cc,7eccde80) ret=7ecc468a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc468a | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0084e6cc,0084e7ac,7ecc921a,00000000) ret=7ecc4780 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ecc4780 | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0084e6cc,0084e7b0,7ecc93be,00000000) ret=7ecc47a5 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ecc47a5 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0084e6cc,7ecc9222) ret=7ecc4802 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ec5d5cd | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119648 ret=7ec5d5cd | |
| 0016:Call ntdll.RtlInitializeResource(0011966c) ret=7ec5d5ef | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ec5d5ef | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(0011966c,00000001) ret=7ec5d60d | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d60d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119400 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119648 ret=7ecc4802 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb91a1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001196d8 ret=7ecb91a1 | |
| 0016:Call ntdll.RtlMapGenericMask(001196dc,7ecc85d4) ret=7ecb91e4 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00000001 ret=7ecb91e4 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119348) ret=7ecc484b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc484b | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0084e6cc,00119648,7ecbce80,7ecc9222) ret=7ecc4883 | |
| 0016:Call advapi32.SystemFunction036(0011965c,00000010) ret=7ec78bc1 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec78bc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119400) ret=7ec7a9a9 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7a9a9 | |
| 0016:Call ntdll.RtlReleaseResource(0011966c) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ecc4883 | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00000000,7ecc921a) ret=7ecc45ff | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000008 ret=7ecc45ff | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00000000,7ecc93be) ret=7ecc4621 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000008 ret=7ecc4621 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119718 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119738 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119738,00000030,0084e718,00000000) ret=7ec70c45 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc884 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac78 ret=7ebbc884 | |
| 0013:Call KERNEL32.ReadFile(00000020,0011ac88,00000008,0033f4c8,00000000) ret=7ebc4cd5 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc963 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac98 ret=7ebbc963 | |
| 0013:Call KERNEL32.ReadFile(00000020,0011ac98,00000018,0033f4c8,00000000) ret=7ebc4cd5 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebcdba1 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad28 ret=7ebcdba1 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebbcb94 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb94 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac98) ret=7ebbcb12 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb12 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac78) ret=7ebbdbde | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbdbde | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,001199a8) ret=7ebcdbe1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0013:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec956f4 | |
| 0013:Call rpcrt4.NdrClientContextUnmarshall(0033f858,0033fa88,00119928) ret=7ec9574e | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb92a61 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001199a8 ret=7eb92a61 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebb1ede | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ac78 ret=7ebb1ede | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad48 ret=7ebb25cf | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad60 ret=7ebb25cf | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebb25cf | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ad78 ret=7ebb25cf | |
| 0013:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec9574e | |
| 0013:Call rpcrt4.NdrFreeBuffer(0033f858) ret=7ec928c6 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad28) ret=7ebcdbe1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0013:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec928c6 | |
| 0013:Call rpcrt4.RpcBindingFree(0033f724) ret=7ec8c009 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab60) ret=7ebb2442 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb2442 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab48) ret=7ebb2466 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb2466 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab30) ret=7ebb248a | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb248a | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebb24ae | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb24ae | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebb24d2 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb24d2 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00119928) ret=7ebb251c | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebb251c | |
| 0013:Ret rpcrt4.RpcBindingFree() retval=00000000 ret=7ec8c009 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ecbf19d | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecbee0d | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119770 ret=7ecbee0d | |
| 000f:Call KERNEL32.WriteFile(0000004c,00119770,00000024,0033fc14,0033fc18) ret=7ecbaa9e | |
| 000f:Ret KERNEL32.WriteFile() retval=00000001 ret=7ecbaa9e | |
| 000f:Call KERNEL32.ReadFile(0000004c,0033fc9c,00000004,0033fc14,0033fc18) ret=7ecbabd5 | |
| 000f:Ret KERNEL32.ReadFile() retval=00000000 ret=7ecbabd5 | |
| 000f:Call KERNEL32.WaitForSingleObject(00000048,00002710) ret=7ecbad34 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119738) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119718) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119418) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001193e0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119430) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 0017:Call PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0017:Ret PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0017:Starting thread proc 0x7ec8cda0 (arg=0x119870) | |
| 0017:Call rpcrt4.NdrClientInitializeNew(0043e64c,0043e72c,7ecb2e80,00000010) ret=7ec958ce | |
| 0017:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8bc10 ret=7ec958ce | |
| 0017:Call rpcrt4.NDRCContextBinding(001199a8) ret=7ec958ee | |
| 0017:Ret rpcrt4.NDRCContextBinding() retval=0011ac78 ret=7ec958ee | |
| 0017:Call rpcrt4.NdrConformantStringBufferSize(0043e72c,0011ad28,7eca17f0) ret=7ec9591b | |
| 0017:Ret rpcrt4.NdrConformantStringBufferSize() retval=0043e740 ret=7ec9591b | |
| 0017:Call rpcrt4.NdrGetBuffer(0043e72c,0000003e,0011ac78) ret=7ec95938 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7ebcdba1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ab30 ret=7ebcdba1 | |
| 0017:Ret rpcrt4.NdrGetBuffer() retval=0011ab30 ret=7ec95938 | |
| 0017:Call rpcrt4.NdrClientContextMarshall(0043e72c,001199a8,00000000) ret=7ec95956 | |
| 0017:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec95956 | |
| 0017:Call rpcrt4.NdrConformantStringMarshall(0043e72c,0011ad28,7eca17f0) ret=7ec95970 | |
| 0017:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec95970 | |
| 0017:Call rpcrt4.NdrSendReceive(0043e72c,0011ab68) ret=7ec959c4 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebbd868 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119928 ret=7ebbd868 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebcc256 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ebcc256 | |
| 0017:Call KERNEL32.InitializeCriticalSection(00119950) ret=7ebcc26b | |
| 0017:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebcc26b | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7ebbb296 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011adb8 ret=7ebbb296 | |
| 0017:Call KERNEL32.WriteFile(00000020,0011adb8,00000050,0043e3e8,00000000) ret=7ebc4c45 | |
| 0017:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebc4c45 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011adb8) ret=7ebbb3cf | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbb3cf | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00119928) ret=7ebbd933 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbd933 | |
| 0017:Call KERNEL32.ReadFile(00000020,0043e3fc,00000010,0043e3a8,00000000) ret=7ebc4cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec68884 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119358,00000008,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec68963 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001193e0 ret=7ec68963 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001193e0,00000038,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec79ba1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec79ba1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001193e0) ret=7ec68b12 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119730 ret=7ec6bd0e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119730,00000010) ret=7ec6bd58 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001193e0 ret=7ec6bc65 | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001195b0,0084e6cc,7eccde80) ret=7ecc555a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc555a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6cc,7ecc922a) ret=7ecc5641 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(0011966c,00000001) ret=7ec5d740 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119750 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119648 ret=7ecc5641 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0084e6cc,0084e7b0,7ecc9230,00000000) ret=7ecc5666 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ecc5666 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0084e6cc,7ecc9232) ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ec5d5cd | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001197c8 ret=7ec5d5cd | |
| 0016:Call ntdll.RtlInitializeResource(001197ec) ret=7ec5d5ef | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ec5d5ef | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(001197ec,00000001) ret=7ec5d60d | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d60d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=001197c8 ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb891b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119848 ret=7ecb891b | |
| 0016:Call ntdll.RtlMapGenericMask(0011984c,7ecc85c4) ret=7ecb8946 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00008000 ret=7ecb8946 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001195b0) ret=7ecc570f | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119860 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc570f | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0084e6cc,001197c8,7ecbce80,7ecc9232) ret=7ecc5747 | |
| 0016:Call advapi32.SystemFunction036(001197dc,00000010) ret=7ec78bc1 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec78bc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ec7a9a9 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7a9a9 | |
| 0016:Call ntdll.RtlReleaseResource(001197ec) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ecc5747 | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00119710,7ecc922e) ret=7ecc57b7 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0084e6cc ret=7ecc57b7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119750) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(0011966c) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119750 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119888 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119888,00000030,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119888) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119750) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc884 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec79be1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119928 ret=7ebbc884 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0017:Call KERNEL32.ReadFile(00000020,00119938,00000008,0043e3a8,00000000) ret=7ebc4cd5 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119860) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec668e8 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc963 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011adb8 ret=7ebbc963 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195b0) ret=7ec6c0d7 | |
| 0017:Call KERNEL32.ReadFile(00000020,0011adb8,00000018,0043e3a8,00000000) ret=7ebc4cd5 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119730) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebcdba1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011add8 ret=7ebcdba1 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebbcb94 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb94 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011adb8) ret=7ebbcb12 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb12 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00119928) ret=7ebbdbde | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbdbde | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab30) ret=7ebcdbe1 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0017:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec959c4 | |
| 0017:Call rpcrt4.NdrClientContextUnmarshall(0043e72c,0043e958,0011ac78) ret=7ec95a1e | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb92a61 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ab30 ret=7eb92a61 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebb1ede | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011adf8 ret=7ebb1ede | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebb25cf | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119928 ret=7ebb25cf | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebb25cf | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011adb8 ret=7ebb25cf | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebb25cf | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ae48 ret=7ebb25cf | |
| 0017:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec95a1e | |
| 0017:Call rpcrt4.NdrFreeBuffer(0043e72c) ret=7ec95a6c | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011add8) ret=7ebcdbe1 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0017:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec95a6c | |
| 0017:Call rpcrt4.NdrClientInitializeNew(0043e64c,0043e72c,7ecb2e80,00000010) ret=7ec958ce | |
| 0017:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8bc10 ret=7ec958ce | |
| 0017:Call rpcrt4.NDRCContextBinding(001199a8) ret=7ec958ee | |
| 0017:Ret rpcrt4.NDRCContextBinding() retval=0011ac78 ret=7ec958ee | |
| 0017:Call rpcrt4.NdrConformantStringBufferSize(0043e72c,0011ad28,7eca17f0) ret=7ec9591b | |
| 0017:Ret rpcrt4.NdrConformantStringBufferSize() retval=0043e740 ret=7ec9591b | |
| 0017:Call rpcrt4.NdrGetBuffer(0043e72c,0000003e,0011ac78) ret=7ec95938 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7ebcdba1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ae60 ret=7ebcdba1 | |
| 0017:Ret rpcrt4.NdrGetBuffer() retval=0011ae60 ret=7ec95938 | |
| 0017:Call rpcrt4.NdrClientContextMarshall(0043e72c,001199a8,00000000) ret=7ec95956 | |
| 0017:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec95956 | |
| 0017:Call rpcrt4.NdrConformantStringMarshall(0043e72c,0011ad28,7eca17f0) ret=7ec95970 | |
| 0017:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec95970 | |
| 0017:Call rpcrt4.NdrSendReceive(0043e72c,0011ae98) ret=7ec959c4 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebbd868 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011add8 ret=7ebbd868 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7ebbb296 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aea8 ret=7ebbb296 | |
| 0017:Call KERNEL32.WriteFile(00000020,0011aea8,00000050,0043e3e8,00000000) ret=7ebc4c45 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195b0 ret=7ec68884 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001195c0,00000008,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec68963 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec68963 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001196f0,00000038,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec79ba1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119730 ret=7ec79ba1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec68b12 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec6bd0e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119348,00000010) ret=7ec6bd58 | |
| 0017:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebc4c45 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011aea8) ret=7ebbb3cf | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbb3cf | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011add8) ret=7ebbd933 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbd933 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 0017:Call KERNEL32.ReadFile(00000020,0043e3fc,00000010,0043e3a8,00000000) ret=7ebc4cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec6bc65 | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001193e0,0084e6cc,7eccde80) ret=7ecc555a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc555a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6cc,7ecc922a) ret=7ecc5641 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(0011966c,00000001) ret=7ec5d740 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119648 ret=7ecc5641 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0084e6cc,0084e7b0,7ecc9230,00000000) ret=7ecc5666 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ecc5666 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0084e6cc,7ecc9232) ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ec5d5cd | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119860 ret=7ec5d5cd | |
| 0016:Call ntdll.RtlInitializeResource(00119884) ret=7ec5d5ef | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ec5d5ef | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119884,00000001) ret=7ec5d60d | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d60d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001198f0 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119860 ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb891b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119908 ret=7ecb891b | |
| 0016:Call ntdll.RtlMapGenericMask(0011990c,7ecc85c4) ret=7ecb8946 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=0002008f ret=7ecb8946 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001193e0) ret=7ecc570f | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119920 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc570f | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0084e6cc,00119860,7ecbce80,7ecc9232) ret=7ecc5747 | |
| 0016:Call advapi32.SystemFunction036(00119874,00000010) ret=7ec78bc1 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec78bc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001198f0) ret=7ec7a9a9 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7a9a9 | |
| 0016:Call ntdll.RtlReleaseResource(00119884) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ecc5747 | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00119750,7ecc922e) ret=7ecc57b7 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0084e6cc ret=7ecc57b7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(0011966c) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119968 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119968,00000030,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119968) ret=7ec673cf | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc884 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119948) ret=7ec668e8 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011add8 ret=7ebbc884 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0017:Call KERNEL32.ReadFile(00000020,0011ade8,00000008,0043e3a8,00000000) ret=7ebc4cd5 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119730) ret=7ec79be1 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc963 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119920) ret=7ec79be1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aea8 ret=7ebbc963 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0017:Call KERNEL32.ReadFile(00000020,0011aea8,00000018,0043e3a8,00000000) ret=7ebc4cd5 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195b0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001193e0) ret=7ec6c0d7 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebcdba1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aec8 ret=7ebcdba1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebbcb94 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec6c126 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb94 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011aea8) ret=7ebbcb12 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb12 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011add8) ret=7ebbdbde | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbdbde | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ae60) ret=7ebcdbe1 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0017:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec959c4 | |
| 0017:Call rpcrt4.NdrClientContextUnmarshall(0043e72c,0043e958,0011ac78) ret=7ec95a1e | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb92a61 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ae60 ret=7eb92a61 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebb1ede | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aee8 ret=7ebb1ede | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebb25cf | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011add8 ret=7ebb25cf | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebb25cf | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ae90 ret=7ebb25cf | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebb25cf | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aea8 ret=7ebb25cf | |
| 0017:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec95a1e | |
| 0017:Call rpcrt4.NdrFreeBuffer(0043e72c) ret=7ec95a6c | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011aec8) ret=7ebcdbe1 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0017:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec95a6c | |
| 0018:Call PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0018:Ret PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0018:Starting thread proc 0x7ec8b8b0 (arg=0x119830) | |
| 0018:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7eccb82b | |
| 0018:Ret KERNEL32.CreateEventW() retval=00000040 ret=7eccb82b | |
| 0018:Call advapi32.RegisterServiceCtrlHandlerExW(00115462 L"MountMgr",7ecca870,00000000) ret=7eccb855 | |
| 0018:Ret advapi32.RegisterServiceCtrlHandlerExW() retval=0011ab30 ret=7eccb855 | |
| 0018:Call advapi32.SetServiceStatus(0011ab30,0053e950) ret=7eccb8a6 | |
| 0018:Call rpcrt4.NdrClientInitializeNew(0053e5ec,0053e6cc,7ecb2e80,00000007) ret=7ec93cf0 | |
| 0018:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8bc10 ret=7ec93cf0 | |
| 0018:Call rpcrt4.NDRCContextBinding(0011ab30) ret=7ec93d04 | |
| 0018:Ret rpcrt4.NDRCContextBinding() retval=0011adf8 ret=7ec93d04 | |
| 0018:Call rpcrt4.NdrGetBuffer(0053e6cc,00000038,0011adf8) ret=7ec93d29 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebcdba1 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011af50 ret=7ebcdba1 | |
| 0018:Ret rpcrt4.NdrGetBuffer() retval=0011af50 ret=7ec93d29 | |
| 0018:Call rpcrt4.NdrClientContextMarshall(0053e6cc,0011ab30,00000000) ret=7ec93d41 | |
| 0018:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec93d41 | |
| 0018:Call rpcrt4.NdrSimpleStructMarshall(0053e6cc,0053e950,7eca1734) ret=7ec93d61 | |
| 0018:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ec93d61 | |
| 0018:Call rpcrt4.NdrSendReceive(0053e6cc,0011af80) ret=7ec93d77 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebbd868 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ad28 ret=7ebbd868 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebcc256 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011af90 ret=7ebcc256 | |
| 0018:Call KERNEL32.InitializeCriticalSection(0011af98) ret=7ebcc26b | |
| 0018:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebcc26b | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebbb296 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011aff0 ret=7ebbb296 | |
| 0018:Call KERNEL32.WriteFile(00000020,0011aff0,00000048,0053e388,00000000) ret=7ebc4c45 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec68884 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119358,00000008,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec68963 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001193e0 ret=7ec68963 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001193e0,00000030,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec79ba1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195b0 ret=7ec79ba1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001193e0) ret=7ec68b12 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001193e0 ret=7ec6bd0e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ec6c030,001193e0,00000010) ret=7ec6bd58 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ecbad34 | |
| 000f:Call KERNEL32.GetOverlappedResult(0000004c,0033fc18,0033fc14,00000000) ret=7ecbac56 | |
| 000f:Ret KERNEL32.GetOverlappedResult() retval=00000001 ret=7ecbac56 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119770) ret=7ecbef4d | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbef4d | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fca0,00000000,00002710) ret=7ecbef98 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119730 ret=7ec6bc65 | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0018:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebc4c45 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011aff0) ret=7ebbb3cf | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbb3cf | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad28) ret=7ebbd933 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbd933 | |
| 0018:Call KERNEL32.ReadFile(00000020,0053e39c,00000010,0053e348,00000000) ret=7ebc4cd5 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001196f0,0084e6d4,7eccde80) ret=7ecc3b8a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc3b8a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6d4,7ecc9170) ret=7ecc3c6a | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(001197ec,00000001) ret=7ec5d740 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=001197c8 ret=7ecc3c6a | |
| 0016:Call rpcrt4.NdrSimpleStructUnmarshall(0084e6d4,0084e7b8,7ecc9174,00000000) ret=7ecc3c8f | |
| 0016:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ecc3c8f | |
| 0016:Call KERNEL32.SetEvent(00000044) ret=7ecba315 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ecbef98 | |
| 000f:Call KERNEL32.ReleaseMutex(00000040) ret=7ecbec9d | |
| 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ecbec9d | |
| 000f:Call KERNEL32.WaitForSingleObject(00000000,00000000) ret=7ecbe9b3 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=ffffffff ret=7ecbe9b3 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ecbe9cd | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ecbe9cd | |
| 000f:Call KERNEL32.CreateMutexW(00000000,00000001,00000000) ret=7ecbe9ed | |
| 000f:Ret KERNEL32.CreateMutexW() retval=0000007c ret=7ecbe9ed | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ecbf0ac | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000080 ret=7ecbf0ac | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7ecbf07c | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000084 ret=7ecbf07c | |
| 000f:Call advapi32.RegCreateKeyExW(80000002,7ecc8c80 L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent",00000000,00000000,00000001,00000003,00000000,0033fc98,00000000) ret=7ecbea5e | |
| 000f:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ecbea5e | |
| 000f:Call advapi32.RegQueryValueExW(00000088,00000000,00000000,0033fca8,0033fc9c,0033fc94) ret=7ecbea9d | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ecbea9d | |
| 000f:Call advapi32.RegSetValueExW(00000088,00000000,00000000,00000004,0033fc9c,00000004) ret=7ecbf04f | |
| 000f:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ecbf04f | |
| 000f:Call advapi32.RegCloseKey(00000088) ret=7ecbeabd | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ecbeabd | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004e) ret=7ecbec27 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119920 ret=7ecbec27 | |
| 000f:Call KERNEL32.CreateNamedPipeW(00119920 L"\\\\.\\pipe\\net\\NtControlPipe1",40000003,00000000,00000001,00000100,00000100,00002710,00000000) ret=7ecbeb0d | |
| 000f:Ret KERNEL32.CreateNamedPipeW() retval=00000088 ret=7ecbeb0d | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119920) ret=7ecbeb31 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbeb31 | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(00118800 L"C:\\windows\\system32\\plugplay.exe",00000000,00000000) ret=7ecbe497 | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000021 ret=7ecbe497 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ecbe4bd | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119920 ret=7ecbe4bd | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(00118800 L"C:\\windows\\system32\\plugplay.exe",00119920,00000021) ret=7ecbe4ee | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000021 ret=7ecbe4ee | |
| 000f:Call KERNEL32.CreateProcessW(00000000,00119920 L"C:\\windows\\system32\\plugplay.exe",00000000,00000000,00000000,00000400,00540000,00000000,0033f9e0,0033f9d0) ret=7ecbe595 | |
| 0016:Ret KERNEL32.SetEvent() retval=00000001 ret=7ecba315 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001196f0) ret=7ecc3cf0 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001198f0 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc3cf0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(001197ec) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119768 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ae0 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119ae0,0000001c,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119ae0) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119768) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195b0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001198f0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001193e0) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc884 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ad28 ret=7ebbc884 | |
| 0018:Call KERNEL32.ReadFile(00000020,0011ad38,00000008,0053e348,00000000) ret=7ebc4cd5 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ebbc963 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011aff0 ret=7ebbc963 | |
| 0018:Call KERNEL32.ReadFile(00000020,0011aff0,00000004,0053e348,00000000) ret=7ebc4cd5 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ebcdba1 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b008 ret=7ebcdba1 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebbcb94 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb94 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011aff0) ret=7ebbcb12 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb12 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad28) ret=7ebbdbde | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbdbde | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011af50) ret=7ebcdbe1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0018:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec93d77 | |
| 0018:Call rpcrt4.NdrFreeBuffer(0053e6cc) ret=7ec93dfe | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b008) ret=7ebcdbe1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0018:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec93dfe | |
| 0018:Ret advapi32.SetServiceStatus() retval=00000001 ret=7eccb8a6 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,0000007a) ret=7eccae41 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011aff0 ret=7eccae41 | |
| 0018:Call advapi32.RegOpenKeyW(80000002,0011b014 L"System\\CurrentControlSet\\Services\\MountMgr",7ecce5ac) ret=7eccaec0 | |
| 0018:Ret advapi32.RegOpenKeyW() retval=00000000 ret=7eccaec0 | |
| 0018:Call ntdll.RtlInitUnicodeString(0053e6fc,0011aff0 L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MountMgr") ret=7eccaf90 | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000007a ret=7eccaf90 | |
| 0018:Call advapi32.RegQueryValueExW(00000044,7eccbea2 L"ImagePath",00000000,0053e6f4,00000000,0053e6f8) ret=7eccafe0 | |
| 0018:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eccafe0 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000052) ret=7eccb00f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b078 ret=7eccb00f | |
| 0018:Call advapi32.RegQueryValueExW(00000044,7eccbea2 L"ImagePath",00000000,0053e6f4,0011b078,0053e6f8) ret=7eccb045 | |
| 0018:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eccb045 | |
| 0018:Call KERNEL32.ExpandEnvironmentStringsW(0011b078 L"C:\\windows\\system32\\drivers\\mountmgr.sys",00000000,00000000) ret=7eccb4a1 | |
| 0018:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7eccb4a1 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000052) ret=7eccb4cb | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b0d8 ret=7eccb4cb | |
| 0018:Call KERNEL32.ExpandEnvironmentStringsW(0011b078 L"C:\\windows\\system32\\drivers\\mountmgr.sys",0011b0d8,00000029) ret=7eccb4ed | |
| 0018:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7eccb4ed | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b078) ret=7eccb076 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eccb076 | |
| 0018:Call KERNEL32.LoadLibraryW(0011b0d8 L"C:\\windows\\system32\\drivers\\mountmgr.sys") ret=7eccaa3d | |
| 001a:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 001a:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 001a:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 000f:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ecbe595 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119920) ret=7ecbe5b8 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbe5b8 | |
| 000f:Call KERNEL32.CloseHandle(00000098) ret=7ecbe5f2 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ecbe5f2 | |
| 000f:Call KERNEL32.ConnectNamedPipe(00000088,0033fca8) ret=7ecbed38 | |
| 000f:Ret KERNEL32.ConnectNamedPipe() retval=00000000 ret=7ecbed38 | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fca0,00000000,00002710) ret=7ecbf19d | |
| 001a:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 001a:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 001a:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 001a:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 001a:Call PE DLL (proc=0x7ec9af40,module=0x7ec50000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 001a:Ret PE DLL (proc=0x7ec9af40,module=0x7ec50000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 001a:Starting process L"C:\\windows\\system32\\plugplay.exe" (entryproc=0x7eccca10) | |
| 001a:Call advapi32.StartServiceCtrlDispatcherW(7eccdee0) ret=7eccca01 | |
| 001a:Call PE DLL (proc=0x7ec1c3b0,module=0x7ebd0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 001a:Ret PE DLL (proc=0x7ec1c3b0,module=0x7ebd0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 001a:Call rpcrt4.NdrClientInitializeNew(0033f798,0033f878,7ecb4e80,0000000f) ret=7ec975dd | |
| 001a:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8dc10 ret=7ec975dd | |
| 001a:Call rpcrt4.RpcStringBindingComposeW(00000000,0033f700 L"ncacn_np",00000000,0033f712 L"\\pipe\\svcctl",00000000,0033f6f8) ret=7ec8df2f | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ebff982 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=001168e0 ret=7ebff982 | |
| 001a:Ret rpcrt4.RpcStringBindingComposeW() retval=00000000 ret=7ec8df2f | |
| 001a:Call rpcrt4.RpcBindingFromStringBindingW(001168e0 L"ncacn_np:[\\\\pipe\\\\svcctl]",0033f6fc) ret=7ec8dfa2 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ebfdff7 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116a00 ret=7ebfdff7 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7ebfdff7 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116940 ret=7ebfdff7 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ebfdff7 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116958 ret=7ebfdff7 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebfdede | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116980 ret=7ebfdede | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116a00 L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7ebfe6d4 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ebfe6d4 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebfe6fa | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b88 ret=7ebfe6fa | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116a00 L"ncacn_np",ffffffff,00117b88,00000009,00000000,00000000) ret=7ebfe73b | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ebfe73b | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec013aa | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec013aa | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116940 L"",ffffffff,00000000,00000000,00000000,00000000) ret=7ebfe6d4 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7ebfe6d4 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebfe6fa | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117ba0 ret=7ebfe6fa | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116940 L"",ffffffff,00117ba0,00000001,00000000,00000000) ret=7ebfe73b | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7ebfe73b | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec013e2 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec013e2 | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116958 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7ebfe6d4 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ebfe6d4 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebfe6fa | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117bb8 ret=7ebfe6fa | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116958 L"\\pipe\\svcctl",ffffffff,00117bb8,0000000d,00000000,00000000) ret=7ebfe73b | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ebfe73b | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec01414 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec01414 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ebfc42b | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117bd0 ret=7ebfc42b | |
| 001a:Call KERNEL32.InitializeCriticalSection(00117c00) ret=7ebfc461 | |
| 001a:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebfc461 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117c58 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117c70 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117c88 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec184f3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec184f3 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116958) ret=7ec184f3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec184f3 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116940) ret=7ec184f3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec184f3 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116a00) ret=7ec184f3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec184f3 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec184f3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec184f3 | |
| 001a:Ret rpcrt4.RpcBindingFromStringBindingW() retval=00000000 ret=7ec8dfa2 | |
| 001a:Call rpcrt4.RpcStringFreeW(0033f6f8) ret=7ec8dfb0 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,001168e0) ret=7ec184f3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec184f3 | |
| 001a:Ret rpcrt4.RpcStringFreeW() retval=00000000 ret=7ec8dfb0 | |
| 001a:Call rpcrt4.NdrPointerBufferSize(0033f878,00000000,7eca37da) ret=7ec97616 | |
| 001a:Ret rpcrt4.NdrPointerBufferSize() retval=00000000 ret=7ec97616 | |
| 001a:Call rpcrt4.NdrPointerBufferSize(0033f878,00000000,7eca397e) ret=7ec97649 | |
| 001a:Ret rpcrt4.NdrPointerBufferSize() retval=00000000 ret=7ec97649 | |
| 001a:Call rpcrt4.NdrGetBuffer(0033f878,00000010,00116980) ret=7ec97666 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec19ba1 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116a00 ret=7ec19ba1 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ec0f7c8 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=001168e0 ret=7ec0f7c8 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117ca0 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cb8 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec19ba1 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cd0 ret=7ec19ba1 | |
| 001a:Call KERNEL32.CreateFileA(00117cd0 "\\\\.\\pipe\\svcctl",c0000000,00000000,00000000,00000003,00000000,00000000) ret=7ec10a05 | |
| 0015:Ret KERNEL32.ConnectNamedPipe() retval=00000001 ret=7ec716c5 | |
| 0015:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) | |
| 0015:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) retval=1 | |
| 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000001 ret=7ec76da4 | |
| 0010:Call KERNEL32.GetExitCodeThread(00000058,0043e968) ret=7ec76e1b | |
| 0010:Ret KERNEL32.GetExitCodeThread() retval=00000001 ret=7ec76e1b | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ec6f7c8 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119920 ret=7ec6f7c8 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=001198f0 ret=7ec5e5cf | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec79ba1 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ec79ba1 | |
| 0010:Call KERNEL32.CreateNamedPipeA(00119830 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ec7143f | |
| 0010:Ret KERNEL32.CreateNamedPipeA() retval=0000005c ret=7ec7143f | |
| 0010:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ec79be1 | |
| 0010:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0010:Call KERNEL32.CloseHandle(00000000) ret=7ec76e3c | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec76e3c | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ec6bb70,00119920,00000000,00000000) ret=7ec6c2ea | |
| 0010:Ret KERNEL32.CreateThread() retval=0000008c ret=7ec6c2ea | |
| 0010:Call KERNEL32.CloseHandle(0000008c) ret=7ec6c2fc | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec6c2fc | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ec71690,00119100,00000000,00000000) ret=7ec6fac3 | |
| 0010:Ret KERNEL32.CreateThread() retval=0000008c ret=7ec6fac3 | |
| 0010:Call ntdll.RtlReAllocateHeap(00110000,00000000,00119060,00000008) ret=7ec6fb5a | |
| 0010:Ret ntdll.RtlReAllocateHeap() retval=00119060 ret=7ec6fb5a | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,00119060,00000000,ffffffff,00000001) ret=7ec76da4 | |
| 001a:Ret KERNEL32.CreateFileA() retval=00000020 ret=7ec10a05 | |
| 001a:Call KERNEL32.SetNamedPipeHandleState(00000020,0033f488,00000000,00000000) ret=7ec10ae3 | |
| 001b:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001a:Ret KERNEL32.SetNamedPipeHandleState() retval=00000001 ret=7ec10ae3 | |
| 001b:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cd0) ret=7ec19be1 | |
| 001b:Starting thread proc 0x7ec6bb70 (arg=0x119920) | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ec0631c | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec6bc65 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cd0 ret=7ec0631c | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec78256 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec18256 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001195b0 ret=7ec78256 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117d20 ret=7ec18256 | |
| 001b:Call KERNEL32.InitializeCriticalSection(001195b8) ret=7ec7826b | |
| 001a:Call KERNEL32.InitializeCriticalSection(00117d28) ret=7ec1826b | |
| 001b:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec7826b | |
| 001a:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec1826b | |
| 001b:Call KERNEL32.ReadFile(0000003c,0053e8bc,00000010,0053e868,00000000) ret=7ec70cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ec07296 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117d80 ret=7ec07296 | |
| 001a:Call KERNEL32.WriteFile(00000020,00117d80,00000048,0033f438,00000000) ret=7ec10c45 | |
| 001a:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec10c45 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117d80) ret=7ec073cf | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec073cf | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cd0) ret=7ec068e8 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec068e8 | |
| 001a:Call KERNEL32.ReadFile(00000020,0033f43c,00000010,0033f3e8,00000000) ret=7ec10cd5 | |
| 001c:Call PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001c:Ret PE DLL (proc=0x7ec7c3b0,module=0x7ec30000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001c:Starting thread proc 0x7ec71690 (arg=0x119100) | |
| 001c:Call KERNEL32.ConnectNamedPipe(0000005c,00000000) ret=7ec716c5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec68884 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec68884 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119700,0000000c,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec68963 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec68963 | |
| 001b:Call KERNEL32.ReadFile(0000003c,001199b0,0000002c,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec79ba1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001199e8 ret=7ec79ba1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec68b12 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec6b65f | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec6b65f | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ec5dede | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119a20 ret=7ec5dede | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec5e5cf | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ec5e5cf | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119a70 ret=7ec5e5cf | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec5c42b | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119a88 ret=7ec5c42b | |
| 001b:Call KERNEL32.InitializeCriticalSection(00119ab8) ret=7ec5c461 | |
| 001b:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec5c461 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec5e5cf | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119b10 ret=7ec5e5cf | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec5e5cf | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119b28 ret=7ec5e5cf | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ec664db | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ec664db | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec6b88a | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6b88a | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ec67296 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119b90 ret=7ec67296 | |
| 001b:Call KERNEL32.WriteFile(0000003c,00119b90,00000044,0053e878,00000000) ret=7ec70c45 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08884 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cd0 ret=7ec08884 | |
| 001a:Call KERNEL32.ReadFile(00000020,00117ce0,00000008,0033f3e8,00000000) ret=7ec10cd5 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec08963 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117d80 ret=7ec08963 | |
| 001a:Call KERNEL32.ReadFile(00000020,00117d80,0000002c,0033f3e8,00000000) ret=7ec10cd5 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec19ba1 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117db8 ret=7ec19ba1 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117d80) ret=7ec08b12 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b12 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117db8) ret=7ec19be1 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cd0) ret=7ec068e8 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec068e8 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebfd0c3 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfd0c3 | |
| 001a:Ret rpcrt4.NdrGetBuffer() retval=00116a00 ret=7ec97666 | |
| 001a:Call rpcrt4.NdrPointerMarshall(0033f878,00000000,7eca37da) ret=7ec97680 | |
| 001a:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec97680 | |
| 001a:Call rpcrt4.NdrPointerMarshall(0033f878,00000000,7eca397e) ret=7ec976a0 | |
| 001a:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec976a0 | |
| 001a:Call rpcrt4.NdrSendReceive(0033f878,00116a0c) ret=7ec976f4 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec09868 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cd0 ret=7ec09868 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000024) ret=7ec07296 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cf0 ret=7ec07296 | |
| 001a:Call KERNEL32.WriteFile(00000020,00117cf0,00000024,0033f528,00000000) ret=7ec10c45 | |
| 001a:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec10c45 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cf0) ret=7ec073cf | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec073cf | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cd0) ret=7ec09933 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09933 | |
| 001a:Call KERNEL32.ReadFile(00000020,0033f53c,00000010,0033f4e8,00000000) ret=7ec10cd5 | |
| 001b:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119b90) ret=7ec673cf | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119b40) ret=7ec668e8 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,001199e8) ret=7ec79be1 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec668e8 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec6bc14 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6bc14 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6bc38 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6bc38 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ec6bc65 | |
| 001b:Call KERNEL32.ReadFile(0000003c,0053e8bc,00000010,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec68884 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119700,00000008,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec68963 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119710 ret=7ec68963 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119710,0000000c,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec79ba1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec79ba1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119710) ret=7ec68b12 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119710 ret=7ec6bd0e | |
| 001b:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119710,00000010) ret=7ec6bd58 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119348,0084e6cc,7eccde80) ret=7ecc468a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc468a | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0084e6cc,0084e7ac,7ecc921a,00000000) ret=7ecc4780 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ecc4780 | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0084e6cc,0084e7b0,7ecc93be,00000000) ret=7ecc47a5 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ecc47a5 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0084e6cc,7ecc9222) ret=7ecc4802 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ec5d5cd | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ec5d5cd | |
| 0016:Call ntdll.RtlInitializeResource(00119b64) ret=7ec5d5ef | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ec5d5ef | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119b64,00000001) ret=7ec5d60d | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d60d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199f0 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119b40 ret=7ecc4802 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb91a1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ba8 ret=7ecb91a1 | |
| 0016:Call ntdll.RtlMapGenericMask(00119bac,7ecc85d4) ret=7ecb91e4 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00000001 ret=7ecb91e4 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119348) ret=7ecc484b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc484b | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0084e6cc,00119b40,7ecbce80,7ecc9222) ret=7ecc4883 | |
| 0016:Call advapi32.SystemFunction036(00119b54,00000010) ret=7ec78bc1 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec78bc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199f0) ret=7ec7a9a9 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7a9a9 | |
| 0016:Call ntdll.RtlReleaseResource(00119b64) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ecc4883 | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00000000,7ecc921a) ret=7ecc45ff | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000008 ret=7ecc45ff | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00000000,7ecc93be) ret=7ecc4621 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000008 ret=7ecc4621 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199f0 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119be8 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000003c,00119be8,00000030,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119be8) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199f0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bc0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119348) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119710) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08884 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cd0 ret=7ec08884 | |
| 001a:Call KERNEL32.ReadFile(00000020,00117ce0,00000008,0033f4e8,00000000) ret=7ec10cd5 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08963 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cf0 ret=7ec08963 | |
| 001a:Call KERNEL32.ReadFile(00000020,00117cf0,00000018,0033f4e8,00000000) ret=7ec10cd5 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec19ba1 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117d80 ret=7ec19ba1 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec08b94 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b94 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cf0) ret=7ec08b12 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b12 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117cd0) ret=7ec09bde | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09bde | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116a00) ret=7ec19be1 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001a:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec976f4 | |
| 001a:Call rpcrt4.NdrClientContextUnmarshall(0033f878,0033faa8,00116980) ret=7ec9774e | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ebdea61 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116a00 ret=7ebdea61 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebfdede | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117cd0 ret=7ebfdede | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117da0 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117db8 ret=7ebfe5cf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebfe5cf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117dd0 ret=7ebfe5cf | |
| 001a:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec9774e | |
| 001a:Call rpcrt4.NdrFreeBuffer(0033f878) ret=7ec948c6 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117d80) ret=7ec19be1 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001a:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec948c6 | |
| 001a:Call rpcrt4.RpcBindingFree(0033f744) ret=7ec8e009 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117bb8) ret=7ebfe442 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfe442 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117ba0) ret=7ebfe466 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfe466 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b88) ret=7ebfe48a | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfe48a | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebfe4ae | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfe4ae | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebfe4d2 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfe4d2 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116980) ret=7ebfe51c | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebfe51c | |
| 001a:Ret rpcrt4.RpcBindingFree() retval=00000000 ret=7ec8e009 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ecbf19d | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecbee0d | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001199f0 ret=7ecbee0d | |
| 000f:Call KERNEL32.WriteFile(00000088,001199f0,00000024,0033fc14,0033fc18) ret=7ecbaa9e | |
| 000f:Ret KERNEL32.WriteFile() retval=00000001 ret=7ecbaa9e | |
| 000f:Call KERNEL32.ReadFile(00000088,0033fc9c,00000004,0033fc14,0033fc18) ret=7ecbabd5 | |
| 000f:Ret KERNEL32.ReadFile() retval=00000000 ret=7ecbabd5 | |
| 000f:Call KERNEL32.WaitForSingleObject(00000084,00002710) ret=7ecbad34 | |
| 001b:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec6bc65 | |
| 001b:Call KERNEL32.ReadFile(0000003c,0053e8bc,00000010,0053e868,00000000) ret=7ec70cd5 | |
| 001d:Call PE DLL (proc=0x7ec1c3b0,module=0x7ebd0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001d:Ret PE DLL (proc=0x7ec1c3b0,module=0x7ebd0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001d:Starting thread proc 0x7ec8eda0 (arg=0x1168c8) | |
| 001d:Call rpcrt4.NdrClientInitializeNew(0043e64c,0043e72c,7ecb4e80,00000010) ret=7ec978ce | |
| 001d:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8dc10 ret=7ec978ce | |
| 001d:Call rpcrt4.NDRCContextBinding(00116a00) ret=7ec978ee | |
| 001d:Ret rpcrt4.NDRCContextBinding() retval=00117cd0 ret=7ec978ee | |
| 001d:Call rpcrt4.NdrConformantStringBufferSize(0043e72c,00117d80,7eca37f0) ret=7ec9791b | |
| 001d:Ret rpcrt4.NdrConformantStringBufferSize() retval=0043e740 ret=7ec9791b | |
| 001d:Call rpcrt4.NdrGetBuffer(0043e72c,0000003e,00117cd0) ret=7ec97938 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7ec19ba1 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117b88 ret=7ec19ba1 | |
| 001d:Ret rpcrt4.NdrGetBuffer() retval=00117b88 ret=7ec97938 | |
| 001d:Call rpcrt4.NdrClientContextMarshall(0043e72c,00116a00,00000000) ret=7ec97956 | |
| 001d:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec97956 | |
| 001d:Call rpcrt4.NdrConformantStringMarshall(0043e72c,00117d80,7eca37f0) ret=7ec97970 | |
| 001d:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec97970 | |
| 001d:Call rpcrt4.NdrSendReceive(0043e72c,00117bc0) ret=7ec979c4 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec09868 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00116980 ret=7ec09868 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec18256 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=001169a0 ret=7ec18256 | |
| 001d:Call KERNEL32.InitializeCriticalSection(001169a8) ret=7ec1826b | |
| 001d:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec1826b | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7ec07296 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e10 ret=7ec07296 | |
| 001d:Call KERNEL32.WriteFile(00000020,00117e10,00000050,0043e3e8,00000000) ret=7ec10c45 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ec68884 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119bd0,00000008,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec68963 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119be0 ret=7ec68963 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119be0,00000038,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec79ba1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119c20 ret=7ec79ba1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119be0) ret=7ec68b12 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119be0 ret=7ec6bd0e | |
| 001b:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119be0,00000010) ret=7ec6bd58 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001196f0,0084e6cc,7eccde80) ret=7ecc555a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc555a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6cc,7ecc922a) ret=7ecc5641 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119b64,00000001) ret=7ec5d740 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c00 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119b40 ret=7ecc5641 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0084e6cc,0084e7b0,7ecc9230,00000000) ret=7ecc5666 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ecc5666 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0084e6cc,7ecc9232) ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ec5d5cd | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c60 ret=7ec5d5cd | |
| 0016:Call ntdll.RtlInitializeResource(00119c84) ret=7ec5d5ef | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ec5d5ef | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119c84,00000001) ret=7ec5d60d | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d60d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119c60 ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb891b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119cf0 ret=7ecb891b | |
| 0016:Call ntdll.RtlMapGenericMask(00119cf4,7ecc85c4) ret=7ecb8946 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00008000 ret=7ecb8946 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001196f0) ret=7ecc570f | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119d08 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc570f | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0084e6cc,00119c60,7ecbce80,7ecc9232) ret=7ecc5747 | |
| 0016:Call advapi32.SystemFunction036(00119c74,00000010) ret=7ec78bc1 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec78bc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec7a9a9 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7a9a9 | |
| 0016:Call ntdll.RtlReleaseResource(00119c84) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ecc5747 | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00119c40,7ecc922e) ret=7ecc57b7 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0084e6cc ret=7ecc57b7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c00) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(00119b64) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c00 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119d30 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000003c,00119d30,00000030,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119d30) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c00) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c20) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119d08) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bc0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119be0) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 001b:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec6bc65 | |
| 001b:Call KERNEL32.ReadFile(0000003c,0053e8bc,00000010,0053e868,00000000) ret=7ec70cd5 | |
| 001d:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec10c45 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117e10) ret=7ec073cf | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec073cf | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00116980) ret=7ec09933 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09933 | |
| 001d:Call KERNEL32.ReadFile(00000020,0043e3fc,00000010,0043e3a8,00000000) ret=7ec10cd5 | |
| 001d:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08884 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00116980 ret=7ec08884 | |
| 001d:Call KERNEL32.ReadFile(00000020,00116990,00000008,0043e3a8,00000000) ret=7ec10cd5 | |
| 001d:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08963 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e10 ret=7ec08963 | |
| 001d:Call KERNEL32.ReadFile(00000020,00117e10,00000018,0043e3a8,00000000) ret=7ec10cd5 | |
| 001d:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec19ba1 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e30 ret=7ec19ba1 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec08b94 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b94 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117e10) ret=7ec08b12 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b12 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00116980) ret=7ec09bde | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09bde | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117b88) ret=7ec19be1 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001d:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec979c4 | |
| 001d:Call rpcrt4.NdrClientContextUnmarshall(0043e72c,0043e958,00117cd0) ret=7ec97a1e | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ebdea61 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117b88 ret=7ebdea61 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebfdede | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e50 ret=7ebfdede | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebfe5cf | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00116980 ret=7ebfe5cf | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebfe5cf | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e10 ret=7ebfe5cf | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebfe5cf | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117ea0 ret=7ebfe5cf | |
| 001d:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec97a1e | |
| 001d:Call rpcrt4.NdrFreeBuffer(0043e72c) ret=7ec97a6c | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117e30) ret=7ec19be1 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001d:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec97a6c | |
| 001d:Call rpcrt4.NdrClientInitializeNew(0043e64c,0043e72c,7ecb4e80,00000010) ret=7ec978ce | |
| 001d:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8dc10 ret=7ec978ce | |
| 001d:Call rpcrt4.NDRCContextBinding(00116a00) ret=7ec978ee | |
| 001d:Ret rpcrt4.NDRCContextBinding() retval=00117cd0 ret=7ec978ee | |
| 001d:Call rpcrt4.NdrConformantStringBufferSize(0043e72c,00117d80,7eca37f0) ret=7ec9791b | |
| 001d:Ret rpcrt4.NdrConformantStringBufferSize() retval=0043e740 ret=7ec9791b | |
| 001d:Call rpcrt4.NdrGetBuffer(0043e72c,0000003e,00117cd0) ret=7ec97938 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7ec19ba1 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117eb8 ret=7ec19ba1 | |
| 001d:Ret rpcrt4.NdrGetBuffer() retval=00117eb8 ret=7ec97938 | |
| 001d:Call rpcrt4.NdrClientContextMarshall(0043e72c,00116a00,00000000) ret=7ec97956 | |
| 001d:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec97956 | |
| 001d:Call rpcrt4.NdrConformantStringMarshall(0043e72c,00117d80,7eca37f0) ret=7ec97970 | |
| 001d:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec97970 | |
| 001d:Call rpcrt4.NdrSendReceive(0043e72c,00117ef0) ret=7ec979c4 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec09868 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e30 ret=7ec09868 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7ec07296 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117f00 ret=7ec07296 | |
| 001d:Call KERNEL32.WriteFile(00000020,00117f00,00000050,0043e3e8,00000000) ret=7ec10c45 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ec68884 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119bd0,00000008,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec68963 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119be0 ret=7ec68963 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119be0,00000038,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec79ba1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119c20 ret=7ec79ba1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119be0) ret=7ec68b12 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119be0 ret=7ec6bd0e | |
| 001b:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119be0,00000010) ret=7ec6bd58 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001196f0,0084e6cc,7eccde80) ret=7ecc555a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc555a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6cc,7ecc922a) ret=7ecc5641 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119b64,00000001) ret=7ec5d740 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c00 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119b40 ret=7ecc5641 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0084e6cc,0084e7b0,7ecc9230,00000000) ret=7ecc5666 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ecc5666 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0084e6cc,7ecc9232) ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ec5d5cd | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119d08 ret=7ec5d5cd | |
| 0016:Call ntdll.RtlInitializeResource(00119d2c) ret=7ec5d5ef | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ec5d5ef | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119d2c,00000001) ret=7ec5d60d | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d60d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119d08 ret=7ecc56c3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb891b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119d98 ret=7ecb891b | |
| 0016:Call ntdll.RtlMapGenericMask(00119d9c,7ecc85c4) ret=7ecb8946 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=0002008f ret=7ecb8946 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001196f0) ret=7ecc570f | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119db0 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc570f | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0084e6cc,00119d08,7ecbce80,7ecc9232) ret=7ecc5747 | |
| 0016:Call advapi32.SystemFunction036(00119d1c,00000010) ret=7ec78bc1 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec78bc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec7a9a9 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7a9a9 | |
| 0016:Call ntdll.RtlReleaseResource(00119d2c) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ecc5747 | |
| 0016:Call rpcrt4.NdrPointerFree(0084e6cc,00119c40,7ecc922e) ret=7ecc57b7 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0084e6cc ret=7ecc57b7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c00) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(00119b64) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c00 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119dd8 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000003c,00119dd8,00000030,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119dd8) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c00) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c20) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119db0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bc0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119be0) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 001b:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec6bc65 | |
| 001b:Call KERNEL32.ReadFile(0000003c,0053e8bc,00000010,0053e868,00000000) ret=7ec70cd5 | |
| 001d:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec10c45 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117f00) ret=7ec073cf | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec073cf | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117e30) ret=7ec09933 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09933 | |
| 001d:Call KERNEL32.ReadFile(00000020,0043e3fc,00000010,0043e3a8,00000000) ret=7ec10cd5 | |
| 001d:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08884 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e30 ret=7ec08884 | |
| 001d:Call KERNEL32.ReadFile(00000020,00117e40,00000008,0043e3a8,00000000) ret=7ec10cd5 | |
| 001d:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08963 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117f00 ret=7ec08963 | |
| 001d:Call KERNEL32.ReadFile(00000020,00117f00,00000018,0043e3a8,00000000) ret=7ec10cd5 | |
| 001d:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec19ba1 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117f20 ret=7ec19ba1 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec08b94 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b94 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117f00) ret=7ec08b12 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b12 | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117e30) ret=7ec09bde | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09bde | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117eb8) ret=7ec19be1 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001d:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec979c4 | |
| 001d:Call rpcrt4.NdrClientContextUnmarshall(0043e72c,0043e958,00117cd0) ret=7ec97a1e | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ebdea61 | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117eb8 ret=7ebdea61 | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebfdede | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117f40 ret=7ebfdede | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebfe5cf | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117e30 ret=7ebfe5cf | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7ebfe5cf | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117ee8 ret=7ebfe5cf | |
| 001d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebfe5cf | |
| 001d:Ret ntdll.RtlAllocateHeap() retval=00117f00 ret=7ebfe5cf | |
| 001d:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec97a1e | |
| 001d:Call rpcrt4.NdrFreeBuffer(0043e72c) ret=7ec97a6c | |
| 001d:Call ntdll.RtlFreeHeap(00110000,00000000,00117f20) ret=7ec19be1 | |
| 001d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001d:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec97a6c | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ecbad34 | |
| 000f:Call KERNEL32.GetOverlappedResult(00000088,0033fc18,0033fc14,00000000) ret=7ecbac56 | |
| 000f:Ret KERNEL32.GetOverlappedResult() retval=00000001 ret=7ecbac56 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001199f0) ret=7ecbef4d | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbef4d | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fca0,00000000,00002710) ret=7ecbef98 | |
| 001e:Call PE DLL (proc=0x7ec1c3b0,module=0x7ebd0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001e:Ret PE DLL (proc=0x7ec1c3b0,module=0x7ebd0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001e:Starting thread proc 0x7ec8d8b0 (arg=0x115698) | |
| 001e:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7eccc72b | |
| 001e:Ret KERNEL32.CreateEventW() retval=00000040 ret=7eccc72b | |
| 001e:Call advapi32.RegisterServiceCtrlHandlerExW(7ecce248 L"PlugPlay",7eccc880,00000000) ret=7eccc755 | |
| 001e:Ret advapi32.RegisterServiceCtrlHandlerExW() retval=00117b88 ret=7eccc755 | |
| 001e:Call advapi32.SetServiceStatus(00117b88,0053e950) ret=7eccc7a6 | |
| 001e:Call rpcrt4.NdrClientInitializeNew(0053e5fc,0053e6dc,7ecb4e80,00000007) ret=7ec95cf0 | |
| 001e:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8dc10 ret=7ec95cf0 | |
| 001e:Call rpcrt4.NDRCContextBinding(00117b88) ret=7ec95d04 | |
| 001e:Ret rpcrt4.NDRCContextBinding() retval=00117e50 ret=7ec95d04 | |
| 001e:Call rpcrt4.NdrGetBuffer(0053e6dc,00000038,00117e50) ret=7ec95d29 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec19ba1 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117f90 ret=7ec19ba1 | |
| 001e:Ret rpcrt4.NdrGetBuffer() retval=00117f90 ret=7ec95d29 | |
| 001e:Call rpcrt4.NdrClientContextMarshall(0053e6dc,00117b88,00000000) ret=7ec95d41 | |
| 001e:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec95d41 | |
| 001e:Call rpcrt4.NdrSimpleStructMarshall(0053e6dc,0053e950,7eca3734) ret=7ec95d61 | |
| 001e:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ec95d61 | |
| 001e:Call rpcrt4.NdrSendReceive(0053e6dc,00117fc0) ret=7ec95d77 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec09868 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117fd0 ret=7ec09868 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ec18256 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117ff0 ret=7ec18256 | |
| 001e:Call KERNEL32.InitializeCriticalSection(00117ff8) ret=7ec1826b | |
| 001e:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec1826b | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ec07296 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00118050 ret=7ec07296 | |
| 001e:Call KERNEL32.WriteFile(00000020,00118050,00000048,0053e398,00000000) ret=7ec10c45 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001199f0 ret=7ec68884 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119a00,00000008,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec68963 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ec68963 | |
| 001b:Call KERNEL32.ReadFile(0000003c,00119bc0,00000030,0053e868,00000000) ret=7ec70cd5 | |
| 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec79ba1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ec79ba1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00119bc0) ret=7ec68b12 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=00119c30 ret=7ec6bd0e | |
| 001b:Call KERNEL32.QueueUserWorkItem(7ec6c030,00119c30,00000010) ret=7ec6bd58 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001196f0,0084e6d4,7eccde80) ret=7ecc3b8a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc3b8a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6d4,7ecc9170) ret=7ecc3c6a | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119c84,00000001) ret=7ec5d740 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119c60 ret=7ecc3c6a | |
| 0016:Call rpcrt4.NdrSimpleStructUnmarshall(0084e6d4,0084e7b8,7ecc9174,00000000) ret=7ecc3c8f | |
| 0016:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ecc3c8f | |
| 0016:Call KERNEL32.SetEvent(00000080) ret=7ecba315 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ecbef98 | |
| 000f:Call KERNEL32.ReleaseMutex(0000007c) ret=7ecbec9d | |
| 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ecbec9d | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001191f0) ret=7ecb83b8 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecb83b8 | |
| 000f:Call ntdll.__wine_make_process_system() ret=7ecbcab5 | |
| 000f:Ret ntdll.__wine_make_process_system() retval=000000b0 ret=7ecbcab5 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ecbcadc | |
| 000f:Ret KERNEL32.CreateEventW() retval=000000b4 ret=7ecbcadc | |
| 0016:Ret KERNEL32.SetEvent() retval=00000001 ret=7ecba315 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001196f0) ret=7ecc3cf0 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc3cf0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(00119c84) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119bd8 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001191f0 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000003c,001191f0,0000001c,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001191f0) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bd8) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bc0) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199f0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196f0) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c30) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 000f:Call KERNEL32.SetEvent(0000001c) ret=7ecbcaf8 | |
| 000b:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ec94322 | |
| 000b:Call KERNEL32.CloseHandle(0000002c) ret=7ec9433d | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec9433d | |
| 000b:Call KERNEL32.CloseHandle(00000024) ret=7ec9434f | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec9434f | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec93917 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=001169f8 ret=7ec93917 | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ec939c5 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00116a20 ret=7ec939c5 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00116a20) ret=7ec93a54 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec93a54 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,001169f8) ret=7ec93fff | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec93fff | |
| 000b:Call advapi32.RegCreateKeyExW(80000001,7ec97e20 L"Volatile Environment",00000000,00000000,00000001,000f003f,00000000,0033eee0,00000000) ret=7ec92e47 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec92e47 | |
| 000b:Call KERNEL32.LoadLibraryA(7eca0950 "shell32.dll") ret=7ec96f16 | |
| 000b:Call PE DLL (proc=0x7e74f270,module=0x7e6c0000 L"gdi32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 001b:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 000f:Ret KERNEL32.SetEvent() retval=00000001 ret=7ecbcaf8 | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fcac,00000000,ffffffff) ret=7ecbcb80 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=001196f0 ret=7ec6bc65 | |
| 001b:Call KERNEL32.ReadFile(0000003c,0053e8bc,00000010,0053e868,00000000) ret=7ec70cd5 | |
| 001e:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec10c45 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00118050) ret=7ec073cf | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec073cf | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117fd0) ret=7ec09933 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09933 | |
| 001e:Call KERNEL32.ReadFile(00000020,0053e3ac,00000010,0053e358,00000000) ret=7ec10cd5 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec08884 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117fd0 ret=7ec08884 | |
| 001e:Call KERNEL32.ReadFile(00000020,00117fe0,00000008,0053e358,00000000) ret=7ec10cd5 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec08963 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00118050 ret=7ec08963 | |
| 001e:Call KERNEL32.ReadFile(00000020,00118050,00000004,0053e358,00000000) ret=7ec10cd5 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec10cd5 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec19ba1 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00118068 ret=7ec19ba1 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec08b94 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b94 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00118050) ret=7ec08b12 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec08b12 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117fd0) ret=7ec09bde | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec09bde | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117f90) ret=7ec19be1 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001e:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec95d77 | |
| 001e:Call rpcrt4.NdrFreeBuffer(0053e6dc) ret=7ec95dfe | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00118068) ret=7ec19be1 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec19be1 | |
| 001e:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec95dfe | |
| 001e:Ret advapi32.SetServiceStatus() retval=00000001 ret=7eccc7a6 | |
| 001e:Call KERNEL32.WaitForSingleObject(00000040,ffffffff) ret=7eccc7c0 | |
| 0018:Ret KERNEL32.LoadLibraryW() retval=7eb60000 ret=7eccaa3d | |
| 0018:Call ntdll.RtlImageNtHeader(7eb60000) ret=7eccaa59 | |
| 0018:Ret ntdll.RtlImageNtHeader() retval=7eb60040 ret=7eccaa59 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b0d8) ret=7eccb12d | |
| 000d:Ret PE DLL (proc=0x7e825270,module=0x7e790000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eccb12d | |
| 0018:Call ntdll.RtlImageNtHeader(7eb60000) ret=7eccb141 | |
| 0018:Ret ntdll.RtlImageNtHeader() retval=7eb60040 ret=7eccb141 | |
| 000d:Call PE DLL (proc=0x7e77d540,module=0x7e770000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0018:Call driver init 0x7eb6bce0 (obj=0x7ecce500,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MountMgr") | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e770000) ret=7e77d668 | |
| 0018:Call ntdll.RtlInitUnicodeString(0053e63c,7eb6d120 L"\\Device\\MountPointManager") ret=7eb6b92c | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e77d668 | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000034 ret=7eb6b92c | |
| 000d:Ret PE DLL (proc=0x7e77d540,module=0x7e770000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0018:Call ntdll.RtlInitUnicodeString(0053e644,7eb6d0e0 L"\\??\\MountPointManager") ret=7eb6b948 | |
| 000d:Call PE DLL (proc=0x7e96ce30,module=0x7e8c0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000002c ret=7eb6b948 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(7ecce500,00000000,0053e63c,00000000,00000000,00000000,0053e630) ret=7eb6b97f | |
| 000b:Ret PE DLL (proc=0x7e74f270,module=0x7e6c0000 L"gdi32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e6a7540,module=0x7e6a0000 L"version.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Call KERNEL32.DisableThreadLibraryCalls(7e6a0000) ret=7e6a7668 | |
| 000b:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e6a7668 | |
| 000b:Ret PE DLL (proc=0x7e6a7540,module=0x7e6a0000 L"version.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e896e30,module=0x7e7f0000 L"user32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000b8) ret=7ec1ae7e | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b078 ret=7ec1ae7e | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eb6b97f | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0053e644,0053e63c) ret=7eb6b9f4 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0053e570,000f0001,0053e574,0053e63c) ret=7ec1b1db | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6b9f4 | |
| 0018:Call advapi32.RegCreateKeyExW(80000002,7eb6d0a0 L"System\\MountedDevices",00000000,00000000,00000001,000f003f,00000000,7eb706f8,00000000) ret=7eb6ba4c | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eb6ba4c | |
| 0018:Call advapi32.RegCreateKeyExW(80000002,7eb6d060 L"HARDWARE\\DEVICEMAP",00000000,00000000,00000001,000f003f,00000000,0053e638,00000000) ret=7eb6ba9d | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eb6ba9d | |
| 0018:Call advapi32.RegCreateKeyExW(00000058,7eb6d038 L"PARALLEL PORTS",00000000,00000000,00000001,000f003f,00000000,0053e634,00000000) ret=7eb6bb7c | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eb6bb7c | |
| 0018:Call advapi32.RegCloseKey(0000005c) ret=7eb6bbfb | |
| 0018:Ret advapi32.RegCloseKey() retval=00000000 ret=7eb6bbfb | |
| 0018:Call advapi32.RegCreateKeyExW(00000058,7eb6d022 L"SERIALCOMM",00000000,00000000,00000001,000f003f,00000000,0053e634,00000000) ret=7eb6bbcd | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eb6bbcd | |
| 0018:Call advapi32.RegCloseKey(0000005c) ret=7eb6bc13 | |
| 0018:Ret advapi32.RegCloseKey() retval=00000000 ret=7eb6bc13 | |
| 0018:Call advapi32.RegCloseKey(00000058) ret=7eb6bbe0 | |
| 0018:Ret advapi32.RegCloseKey() retval=00000000 ret=7eb6bbe0 | |
| 0018:Call ntdll.RtlInitUnicodeString(0053e63c,7eb6d000 L"\\Driver\\Harddisk") ret=7eb6babb | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000022 ret=7eb6babb | |
| 0018:Call ntoskrnl.exe.IoCreateDriver(0053e63c,7eb6a300) ret=7eb6bad1 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000bc) ret=7ec1aba9 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b138 ret=7ec1aba9 | |
| 0018:Call ntdll.RtlDuplicateUnicodeString(00000001,0053e63c,0011b154) ret=7ec1abd0 | |
| 0018:Ret ntdll.RtlDuplicateUnicodeString() retval=00000000 ret=7ec1abd0 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eb68180 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b200 ret=7eb68180 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0053e44c,00000000,00000000,00000000,0053e448) ret=7eb681fc | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b340 ret=7ec1ae7e | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eb681fc | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003a) ret=7eb682da | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b240 ret=7eb682da | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0053e454,0053e44c) ret=7eb68338 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0053e380,000f0001,0053e384,0053e44c) ret=7ec1b1db | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb68338 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eb688cb | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b430 ret=7eb688cb | |
| 0018:Call advapi32.RegOpenKeyW(80000002,7eb6cd80 L"Software\\Wine\\Drives",0053e4d8) ret=7eb6a392 | |
| 0018:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7eb6a392 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b458 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b458) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b458 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b458) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b458 ret=7eb68f70 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b4e0 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b4e0) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eb693bb | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b4e0 ret=7eb693bb | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eb692db | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b500 ret=7eb692db | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eb68180 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b530 ret=7eb68180 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0053e3cc,00000000,00000000,00000000,0053e3c8) ret=7eb681fc | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b580 ret=7ec1ae7e | |
| 000b:Ret PE DLL (proc=0x7e896e30,module=0x7e7f0000 L"user32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e99fe30,module=0x7e960000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Call KERNEL32.DisableThreadLibraryCalls(7e960000) ret=7e98ffb2 | |
| 000b:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e98ffb2 | |
| 000b:Call KERNEL32.TlsAlloc() ret=7e98ffc0 | |
| 000b:Ret KERNEL32.TlsAlloc() retval=00000001 ret=7e98ffc0 | |
| 000b:Ret PE DLL (proc=0x7e99fe30,module=0x7e960000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7ea6b250,module=0x7e9e0000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Call KERNEL32.DisableThreadLibraryCalls(7e9e0000) ret=7ea166e8 | |
| 000b:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ea166e8 | |
| 000b:Call KERNEL32.GetModuleFileNameW(7e9e0000,7ec09880,00000104) ret=7ea16706 | |
| 000b:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7ea16706 | |
| 000b:Ret PE DLL (proc=0x7ea6b250,module=0x7e9e0000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Ret KERNEL32.LoadLibraryA() retval=7e9e0000 ret=7ec96f16 | |
| 000b:Call KERNEL32.GetProcAddress(7e9e0000,7eca0992 "SHGetFolderPathW") ret=7ec96ee6 | |
| 000b:Ret KERNEL32.GetProcAddress() retval=7e9e8e00 ret=7ec96ee6 | |
| 000b:Call shell32.SHGetFolderPathW(00000000,0000001a,00000000,00000000,0033f558) ret=7ec936e7 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea78c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e1d0) ret=7ea2d920 | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eb681fc | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb68808 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68808 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6882f | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6882f | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7eb680b4 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b670 ret=7eb680b4 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eb6a6fc | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b688 ret=7eb6a6fc | |
| 0018:Call ntdll.RtlInitUnicodeString(0011b69c,0011b6ac L"\\??\\Volume{00000000-0000-0000-0000-000000000043}") ret=7eb6a736 | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eb6a736 | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b69c,0011b640) ret=7eb6a7f4 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0053e1f0,000f0001,0053e1f4,0011b640) ret=7ec1b1db | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000072) ret=7eb6a6fc | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b748 ret=7eb6a6fc | |
| 0018:Call ntdll.RtlInitUnicodeString(0011b75c,0011b76c L"\\DosDevices\\C:") ret=7eb6a736 | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000001e ret=7eb6a736 | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b75c,0011b640) ret=7eb6a7f4 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0053e2d0,000f0001,0053e2d4,0011b640) ret=7ec1b1db | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2d920 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea78b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e1cc) ret=7ea2da14 | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,0000000b) ret=7eb6b58f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7c8 ret=7eb6b58f | |
| 0018:Call advapi32.RegSetValueExW(00000054,0011b6ac L"\\??\\Volume{00000000-0000-0000-0000-000000000043}",00000000,00000003,0011b7c8,0000000b) ret=7eb6b5e9 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2da14 | |
| 000b:Call advapi32.RegQueryValueExW(00000048,7ea79962 L"AppData",00000000,0033e1c4,0033eb64,0033e1c8) ret=7ea2da63 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,0000000b) ret=7eb6b58f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7e0 ret=7eb6b58f | |
| 0018:Call advapi32.RegSetValueExW(00000054,0011b76c L"\\DosDevices\\C:",00000000,00000003,0011b7e0,0000000b) ret=7eb6b5e9 | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ea2da63 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ea78d40 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033db4c,0033db50) ret=7ea2d33b | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b7f8) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b7f8 ret=7eb68f70 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eb68f70 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b880 ret=7eb68f70 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b880) ret=7eb68fad | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68fad | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eb693bb | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b880 ret=7eb693bb | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eb692db | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b8a0 ret=7eb692db | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eb68180 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b8d0 ret=7eb68180 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0053e3cc,00000000,00000000,00000000,0053e3c8) ret=7eb681fc | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b920 ret=7ec1ae7e | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ea2d33b | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033df64,00000104) ret=7ea2d735 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ea2d735 | |
| 000b:Call advapi32.RegQueryValueExW(0000004c,7ea78d00 L"ProfilesDirectory",00000000,0033dac4,0033dd5c,0033dac8) ret=7ea2cb8c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ea2cb8c | |
| 000b:Call advapi32.GetUserNameW(0033df64,0033db50) ret=7ea2d48e | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7ea2d48e | |
| 000b:Call shlwapi.PathAppendW(0033e5e4 L"C:\\users",0033df64 L"mikhail") ret=7ea2d4a4 | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7ea2d4a4 | |
| 000b:Call shlwapi.PathAppendW(0033e5e4 L"C:\\users\\mikhail",0033db6e L"\\Application Data") ret=7ea2d4d1 | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7ea2d4d1 | |
| 000b:Call advapi32.RegCloseKey(0000004c) ret=7ea2d1fe | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2d1fe | |
| 000b:Call advapi32.RegSetValueExW(00000040,7ea79962 L"AppData",00000000,00000001,0033eb64,00000044) ret=7ea2db8c | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ea2db8c | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ea2da8d | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b920) ret=7ec1af03 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1af03 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da8d | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eb681fc | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7ea2da9f | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0053e3cc,00000000,00000000,00000000,0053e3c8) ret=7eb681fc | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b920 ret=7ec1ae7e | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da9f | |
| 000b:Call shlwapi.PathFileExistsW(0033e95c L"C:\\users\\mikhail\\Application Data") ret=7ea31faa | |
| 000b:Call KERNEL32.SetErrorMode(00000001) ret=7e9805ad | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e9805ad | |
| 000b:Call KERNEL32.GetFileAttributesW(0033e95c L"C:\\users\\mikhail\\Application Data") ret=7e9805bb | |
| 000b:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e9805bb | |
| 000b:Call KERNEL32.SetErrorMode(00000000) ret=7e9805c9 | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e9805c9 | |
| 000b:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7ea31faa | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ea31ba7 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ea31ba7 | |
| 000b:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec936e7 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97e10 L"APPDATA",00000000,00000001,0033f558,00000044) ret=7ec96066 | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eb681fc | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb68808 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68808 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6882f | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97dfa L"CLIENTNAME",00000000,00000001,7ec97dea,00000010) ret=7ec96066 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6882f | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7eb680b4 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ba10 ret=7eb680b4 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eb6a6fc | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ba28 ret=7eb6a6fc | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 0018:Call ntdll.RtlInitUnicodeString(0011ba3c,0011ba4c L"\\??\\Volume{00000000-0000-0000-0000-00000000005a}") ret=7eb6a736 | |
| 000b:Call shell32.SHGetFolderPathW(00000000,00000028,00000000,00000000,0033f558) ret=7ec9374b | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eb6a736 | |
| 000b:Call KERNEL32.LoadLibraryA(7eaae1ec "ole32.dll") ret=7ea6b216 | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011ba3c,0011b9e0) ret=7eb6a7f4 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0053e1f0,000f0001,0053e1f4,0011b9e0) ret=7ec1b1db | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000072) ret=7eb6a6fc | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bae8 ret=7eb6a6fc | |
| 0018:Call ntdll.RtlInitUnicodeString(0011bafc,0011bb0c L"\\DosDevices\\Z:") ret=7eb6a736 | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000001e ret=7eb6a736 | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011bafc,0011b9e0) ret=7eb6a7f4 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0053e2d0,000f0001,0053e2d4,0011b9e0) ret=7ec1b1db | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eb6b58f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bb68 ret=7eb6b58f | |
| 0018:Call advapi32.RegSetValueExW(00000054,0011ba4c L"\\??\\Volume{00000000-0000-0000-0000-00000000005a}",00000000,00000003,0011bb68,00000004) ret=7eb6b5e9 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eb6b58f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bb80 ret=7eb6b58f | |
| 0018:Call advapi32.RegSetValueExW(00000054,0011bb0c L"\\DosDevices\\Z:",00000000,00000003,0011bb80,00000004) ret=7eb6b5e9 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0018:Call advapi32.RegCloseKey(00000000) ret=7eb6a5db | |
| 0018:Ret advapi32.RegCloseKey() retval=00000006 ret=7eb6a5db | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b430) ret=7eb6a602 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6a602 | |
| 0018:Ret ntoskrnl.exe.IoCreateDriver() retval=00000000 ret=7eb6bad1 | |
| 000d:Ret PE DLL (proc=0x7e96ce30,module=0x7e8c0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e73e3b0,module=0x7e6f0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7e73e3b0,module=0x7e6f0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7eb92840,module=0x7eab0000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7eb92840,module=0x7eab0000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e67aa20,module=0x7e5b0000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.GetEnvironmentVariableW(7e67e3b0 L"oanocache",00000000,00000000) ret=7e5bd731 | |
| 000d:Ret KERNEL32.GetEnvironmentVariableW() retval=00000000 ret=7e5bd731 | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e5b0000) ret=7e6259c8 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e6259c8 | |
| 000d:Ret PE DLL (proc=0x7e67aa20,module=0x7e5b0000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e566e30,module=0x7e520000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e520000) ret=7e556fb2 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e556fb2 | |
| 000d:Call KERNEL32.TlsAlloc() ret=7e556fc0 | |
| 000d:Ret KERNEL32.TlsAlloc() retval=00000001 ret=7e556fc0 | |
| 000d:Ret PE DLL (proc=0x7e566e30,module=0x7e520000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7ec73df0,module=0x7ec00000 L"windowscodecs.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7ec00000) ret=7ec227fc | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ec227fc | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7ec00000) ret=7ec3f098 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ec3f098 | |
| 000d:Ret PE DLL (proc=0x7ec73df0,module=0x7ec00000 L"windowscodecs.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e377250,module=0x7e2f0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e2f0000) ret=7e3226e8 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e3226e8 | |
| 000d:Call KERNEL32.GetModuleFileNameW(7e2f0000,7e515880,00000104) ret=7e322706 | |
| 000d:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7e322706 | |
| 000d:Ret PE DLL (proc=0x7e377250,module=0x7e2f0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Starting process L"C:\\windows\\system32\\winemenubuilder.exe" (entryproc=0x7ecc4050) | |
| 000d:Call KERNEL32.GetCommandLineW() ret=7ecc4115 | |
| 000d:Ret KERNEL32.GetCommandLineW() retval=00220608 ret=7ecc4115 | |
| 000d:Call KERNEL32.GetStartupInfoW(0033fd88) ret=7ecc41ad | |
| 000d:Ret KERNEL32.GetStartupInfoW() retval=7b83c630 ret=7ecc41ad | |
| 000d:Call KERNEL32.GetModuleHandleW(00000000) ret=7ecc41cd | |
| 000d:Ret KERNEL32.GetModuleHandleW() retval=7ecb0000 ret=7ecc41cd | |
| 000d:Call shell32.SHGetFolderPathW(00000000,00000000,00000000,00000000,0033f9c4) ret=7ecbc5a1 | |
| 000d:Call advapi32.RegCreateKeyW(80000001,7e384c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033ed40) ret=7e339920 | |
| 000d:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e339920 | |
| 000d:Call advapi32.RegCreateKeyW(80000001,7e384b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033ed3c) ret=7e339a14 | |
| 000d:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e339a14 | |
| 000d:Call advapi32.RegQueryValueExW(00000064,7e385640 L"Desktop",00000000,0033ed34,0033f6d4,0033ed38) ret=7e339a63 | |
| 000d:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e339a63 | |
| 000d:Call advapi32.RegCreateKeyExW(80000002,7e384d40 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033e6bc,0033e6c0) ret=7e33933b | |
| 000b:Call PE DLL (proc=0x7e3733b0,module=0x7e320000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e33933b | |
| 000b:Ret PE DLL (proc=0x7e3733b0,module=0x7e320000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000d:Call KERNEL32.GetSystemDirectoryW(0033ead4,00000104) ret=7e339735 | |
| 000b:Call PE DLL (proc=0x7e493840,module=0x7e3b0000 L"ole32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e339735 | |
| 000d:Call advapi32.RegQueryValueExW(00000068,7e384d00 L"ProfilesDirectory",00000000,0033e634,0033e8cc,0033e638) ret=7e338b8c | |
| 000b:Ret PE DLL (proc=0x7e493840,module=0x7e3b0000 L"ole32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Ret KERNEL32.LoadLibraryA() retval=7e3b0000 ret=7ea6b216 | |
| 000b:Call KERNEL32.GetProcAddress(7e3b0000,7eaae34f "StringFromGUID2") ret=7ea6b1e6 | |
| 000d:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e338b8c | |
| 000b:Ret KERNEL32.GetProcAddress() retval=7e3c0dd0 ret=7ea6b1e6 | |
| 000d:Call advapi32.GetUserNameW(0033ead4,0033e6c0) ret=7e33948e | |
| 000d:Ret advapi32.GetUserNameW() retval=00000001 ret=7e33948e | |
| 000b:Call ole32.StringFromGUID2(7ea83acc,0033e84c,00000027) ret=7ea2e0d2 | |
| 000d:Call shlwapi.PathAppendW(0033f154 L"C:\\users",0033ead4 L"mikhail") ret=7e3394a4 | |
| 000b:Ret ole32.StringFromGUID2() retval=00000027 ret=7ea2e0d2 | |
| 000d:Ret shlwapi.PathAppendW() retval=00000001 ret=7e3394a4 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea78c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e1d0) ret=7ea2d920 | |
| 000d:Call shlwapi.PathAppendW(0033f154 L"C:\\users\\mikhail",0033e6de L"\\Desktop") ret=7e3394d1 | |
| 000d:Ret shlwapi.PathAppendW() retval=00000001 ret=7e3394d1 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2d920 | |
| 000d:Call advapi32.RegCloseKey(00000068) ret=7e3391fe | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea78b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e1cc) ret=7ea2da14 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2da14 | |
| 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7e3391fe | |
| 000b:Call advapi32.RegQueryValueExW(00000048,0033e84c L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}",00000000,0033e1c4,0033eb64,0033e1c8) ret=7ea2da63 | |
| 000d:Call advapi32.RegSetValueExW(00000060,7e385640 L"Desktop",00000000,00000001,0033f6d4,00000032) ret=7e339b8c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ea2da63 | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ea2da8d | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da8d | |
| 000d:Ret advapi32.RegSetValueExW() retval=00000000 ret=7e339b8c | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7ea2da9f | |
| 000d:Call advapi32.RegCloseKey(00000060) ret=7e339a8d | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da9f | |
| 000b:Call advapi32.RegCreateKeyW(80000002,7ea78c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e1d0) ret=7ea2d920 | |
| 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7e339a8d | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2d920 | |
| 000d:Call advapi32.RegCloseKey(00000064) ret=7e339a9f | |
| 000b:Call advapi32.RegCreateKeyW(80000002,7ea78b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e1cc) ret=7ea2da14 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2da14 | |
| 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7e339a9f | |
| 000d:Call shlwapi.PathFileExistsW(0033f4cc L"C:\\users\\mikhail\\Desktop") ret=7e33dfaa | |
| 000d:Call KERNEL32.SetErrorMode(00000001) ret=7e5475ad | |
| 000d:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e5475ad | |
| 000b:Call advapi32.RegQueryValueExW(00000048,0033e84c L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}",00000000,0033e1c4,0033eb64,0033e1c8) ret=7ea2da63 | |
| 000d:Call KERNEL32.GetFileAttributesW(0033f4cc L"C:\\users\\mikhail\\Desktop") ret=7e5475bb | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ea2da63 | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ea2da8d | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da8d | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7ea2da9f | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da9f | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ea78d40 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033e2bc,0033e2c0) ret=7ea2d33b | |
| 000d:Ret KERNEL32.GetFileAttributesW() retval=00000410 ret=7e5475bb | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ea2d33b | |
| 000d:Call KERNEL32.SetErrorMode(00000000) ret=7e5475c9 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033e6d4,00000104) ret=7ea2d735 | |
| 000d:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e5475c9 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ea2d735 | |
| 000d:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7e33dfaa | |
| 000b:Call advapi32.RegQueryValueExW(00000040,7ea78d00 L"ProfilesDirectory",00000000,0033e234,0033e4cc,0033e238) ret=7ea2cb8c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ea2cb8c | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7e33dba7 | |
| 000b:Call advapi32.GetUserNameW(0033e6d4,0033e2c0) ret=7ea2d48e | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e33dba7 | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7ea2d48e | |
| 000d:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ecbc5a1 | |
| 000b:Call shlwapi.PathAppendW(0033e95c L"C:\\users",0033e6d4 L"mikhail") ret=7ea2d4a4 | |
| 000d:Call KERNEL32.wine_get_unix_file_name(0033f9c4 L"C:\\users\\mikhail\\Desktop") ret=7ecbc5b5 | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7ea2d4a4 | |
| 000b:Call shlwapi.PathAppendW(0033e95c L"C:\\users\\mikhail",0033e2de L"") ret=7ea2d4d1 | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7ea2d4d1 | |
| 000d:Ret KERNEL32.wine_get_unix_file_name() retval=00130080 ret=7ecbc5b5 | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ea2d1fe | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2d1fe | |
| 000b:Call shlwapi.PathFileExistsW(0033e95c L"C:\\users\\mikhail") ret=7ea31faa | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001301c0 ret=7ecb95d1 | |
| 000b:Call KERNEL32.SetErrorMode(00000001) ret=7e9805ad | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,001301c0,00000030) ret=7ecb963d | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e9805ad | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=001301c0 ret=7ecb963d | |
| 000b:Call KERNEL32.GetFileAttributesW(0033e95c L"C:\\users\\mikhail") ret=7e9805bb | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001301f8 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,001301f8,0000001b) ret=7ecb963d | |
| 000b:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e9805bb | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=001301f8 ret=7ecb963d | |
| 000b:Call KERNEL32.SetErrorMode(00000000) ret=7e9805c9 | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e9805c9 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000b:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7ea31faa | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00130220 ret=7ecb95d1 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ea31ba7 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00130220,0000002f) ret=7ecb963d | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ea31ba7 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00130220 ret=7ecb963d | |
| 000b:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec9374b | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00130220) ret=7ecbc686 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97dd2 L"USERPROFILE",00000000,00000001,0033f558,00000022) ret=7ec96066 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecbc686 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000d:Call ole32.CoInitialize(00000000) ret=7ecc0e6c | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97dc0 L"HOMEPATH",00000000,00000001,0033f55c,0000001e) ret=7ec96066 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,000000fc) ret=7ead2d80 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00130220 ret=7ead2d80 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7eafd118 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00130030 ret=7eafd118 | |
| 000d:Call KERNEL32.InitializeCriticalSection(00130040) ret=7eafd148 | |
| 000d:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eafd148 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7eacfb75 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00130350 ret=7eacfb75 | |
| 000d:Call KERNEL32.InitializeCriticalSection(00130374) ret=7eacfbd7 | |
| 000d:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eacfbd7 | |
| 000d:Call KERNEL32.InitOnceExecuteOnce(7ebe4080,7eace620,00000000,00000000) ret=7ead25c0 | |
| 000d:Call user32.RegisterClassW(0033f9c4) ret=7eace679 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97dac L"HOMEDRIVE",00000000,00000001,0033f558,00000006) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.GetUserNameW(0033f558,0033eec4) ret=7ec937c0 | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7ec937c0 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97d9a L"USERNAME",00000000,00000001,0033f558,00000010) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97d86 L"HOMESHARE",00000000,00000001,7ec97d84,00000002) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call shell32.SHGetFolderPathW(00000000,0000001c,00000000,00000000,0033f558) ret=7ec93812 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea78c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e1d0) ret=7ea2d920 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2d920 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea78b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e1cc) ret=7ea2da14 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ea2da14 | |
| 000b:Call advapi32.RegQueryValueExW(00000048,7ea795c0 L"Local AppData",00000000,0033e1c4,0033eb64,0033e1c8) ret=7ea2da63 | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ea2da63 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ea78d40 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033db4c,0033db50) ret=7ea2d33b | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ea2d33b | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033df64,00000104) ret=7ea2d735 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ea2d735 | |
| 000b:Call advapi32.RegQueryValueExW(0000004c,7ea78d00 L"ProfilesDirectory",00000000,0033dac4,0033dd5c,0033dac8) ret=7ea2cb8c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ea2cb8c | |
| 000b:Call advapi32.GetUserNameW(0033df64,0033db50) ret=7ea2d48e | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7ea2d48e | |
| 000b:Call shlwapi.PathAppendW(0033e5e4 L"C:\\users",0033df64 L"mikhail") ret=7ea2d4a4 | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7ea2d4a4 | |
| 000b:Call shlwapi.PathAppendW(0033e5e4 L"C:\\users\\mikhail",0033db6e L"\\Local Settings\\Application Data") ret=7ea2d4d1 | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7ea2d4d1 | |
| 000b:Call advapi32.RegCloseKey(0000004c) ret=7ea2d1fe | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2d1fe | |
| 000b:Call advapi32.RegSetValueExW(00000040,7ea795c0 L"Local AppData",00000000,00000001,0033eb64,00000062) ret=7ea2db8c | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ea2db8c | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ea2da8d | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da8d | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7ea2da9f | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ea2da9f | |
| 000b:Call shlwapi.PathFileExistsW(0033e95c L"C:\\users\\mikhail\\Local Settings\\Application Data") ret=7ea31faa | |
| 000b:Call KERNEL32.SetErrorMode(00000001) ret=7e9805ad | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e9805ad | |
| 000b:Call KERNEL32.GetFileAttributesW(0033e95c L"C:\\users\\mikhail\\Local Settings\\Application Data") ret=7e9805bb | |
| 000b:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e9805bb | |
| 000b:Call KERNEL32.SetErrorMode(00000000) ret=7e9805c9 | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e9805c9 | |
| 000b:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7ea31faa | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ea31ba7 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ea31ba7 | |
| 000b:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec93812 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97d6a L"LOCALAPPDATA",00000000,00000001,0033f558,00000062) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call KERNEL32.GetComputerNameW(0033f354,0033eec4) ret=7ec9385c | |
| 000b:Ret KERNEL32.GetComputerNameW() retval=00000001 ret=7ec9385c | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97d54 L"USERDOMAIN",00000000,00000001,0033f354,00000014) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97d3c L"LOGONSERVER",00000000,00000001,0033f350,00000018) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec97d24 L"SESSIONNAME",00000000,00000001,7ec97dea,00000010) ret=7ec96066 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec96066 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec938c6 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec938c6 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec97cc0 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0033ed90,00000000) ret=7ec96695 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec96695 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7ec988cc L"RunOnce",00000000,00000000,00000000,000f003f,00000000,0033ed94,0033ed98) ret=7ec966fc | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec966fc | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec96716 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec96716 | |
| 000b:Call advapi32.RegQueryInfoKeyW(00000040,00000000,00000000,00000000,00000000,00000000,00000000,0033ed9c,0033eda4,0033eda0,00000000,00000000) ret=7ec96793 | |
| 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ec96793 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec967f3 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec967f3 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec9681a | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec9681a | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ec96830 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec96830 | |
| 000b:Call KERNEL32.SetEvent(00000010) ret=7ec92e9f | |
| 000b:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec92e9f | |
| 000b:Call KERNEL32.ExitProcess(00000000) ret=7ec96f9d | |
| 000b:Call PE DLL (proc=0x7e493840,module=0x7e3b0000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e493840,module=0x7e3b0000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e3733b0,module=0x7e320000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e3733b0,module=0x7e320000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7ea6b250,module=0x7e9e0000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7ea6b250,module=0x7e9e0000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e99fe30,module=0x7e960000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e99fe30,module=0x7e960000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e896e30,module=0x7e7f0000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e896e30,module=0x7e7f0000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e6a7540,module=0x7e6a0000 L"version.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e6a7540,module=0x7e6a0000 L"version.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e74f270,module=0x7e6c0000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e74f270,module=0x7e6c0000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7ec5ff40,module=0x7ec20000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7ec5ff40,module=0x7ec20000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call KERNEL32.FreeLibrary(7e9e0000) ret=7ec91d51 | |
| 000b:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7ec91d51 | |
| 000b:Call KERNEL32.FreeLibrary(7e3b0000) ret=7e9e67f1 | |
| 000b:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7e9e67f1 | |
| 0020:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 0020:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0020:Call KERNEL32.__wine_kernel_init() ret=7bc5dbdb | |
| 0020:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Call PE DLL (proc=0x7ebdbf40,module=0x7eb90000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Ret PE DLL (proc=0x7ebdbf40,module=0x7eb90000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Call PE DLL (proc=0x7ec5b3b0,module=0x7ec10000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Ret PE DLL (proc=0x7ec5b3b0,module=0x7ec10000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Call PE DLL (proc=0x7e986270,module=0x7e8f0000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Ret PE DLL (proc=0x7e986270,module=0x7e8f0000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Call PE DLL (proc=0x7e8de540,module=0x7e8d0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Call KERNEL32.DisableThreadLibraryCalls(7e8d0000) ret=7e8de668 | |
| 0020:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e8de668 | |
| 0020:Ret PE DLL (proc=0x7e8de540,module=0x7e8d0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Call PE DLL (proc=0x7eacde30,module=0x7ea20000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0020:Ret PE DLL (proc=0x7eacde30,module=0x7ea20000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0020:Starting process L"C:\\windows\\system32\\explorer.exe" (entryproc=0x7ec9ef50) | |
| 0020:Call KERNEL32.GetCommandLineW() ret=7ec9f015 | |
| 0020:Ret KERNEL32.GetCommandLineW() retval=002205fa ret=7ec9f015 | |
| 0020:Call KERNEL32.GetStartupInfoW(0033fd88) ret=7ec9f0ad | |
| 0020:Ret KERNEL32.GetStartupInfoW() retval=7b83c630 ret=7ec9f0ad | |
| 0020:Call KERNEL32.GetModuleHandleW(00000000) ret=7ec9f0cd | |
| 0020:Ret KERNEL32.GetModuleHandleW() retval=7ec90000 ret=7ec9f0cd | |
| 0020:Call user32.GetThreadDesktop(00000020) ret=7ec99619 | |
| 0020:Ret user32.GetThreadDesktop() retval=00000008 ret=7ec99619 | |
| 0020:Call user32.GetUserObjectInformationW(00000008,00000002,7eca8440,00000104,00000000) ret=7ec9964b | |
| 0020:Ret user32.GetUserObjectInformationW() retval=00000001 ret=7ec9964b | |
| 0020:Call advapi32.RegOpenKeyW(80000001,7ec9fa20 L"Software\\Wine\\Explorer",0033f2a4) ret=7ec99677 | |
| 0020:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ec99677 | |
| 0020:Call rpcrt4.UuidCreate(0033f244) ret=7ec98b8e | |
| 0020:Call advapi32.SystemFunction036(0033f244,00000010) ret=7ec57bc1 | |
| 0020:Ret advapi32.SystemFunction036() retval=00000001 ret=7ec57bc1 | |
| 0020:Ret rpcrt4.UuidCreate() retval=00000000 ret=7ec98b8e | |
| 0020:Call advapi32.RegOpenKeyW(80000001,7ec9f900 L"Software\\Wine\\Drivers",0033f254) ret=7ec997b4 | |
| 0020:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ec997b4 | |
| 0020:Call KERNEL32.LoadLibraryW(0033f264 L"winex11.drv") ret=7ec98c67 | |
| 0020:Call PE DLL (proc=0x7e6ee530,module=0x7e690000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) | |
| 0020:Ret PE DLL (proc=0x7e6ee530,module=0x7e690000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0020:Ret KERNEL32.LoadLibraryW() retval=7e690000 ret=7ec98c67 | |
| 0020:Call KERNEL32.GetModuleFileNameW(7e690000,0033f3f4,00000104) ret=7ec994af | |
| 0020:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7ec994af | |
| 0020:Call advapi32.RegCreateKeyExW(80000002,0033f2e8 L"System\\CurrentControlSet\\Control\\Video\\{fae02ed4-0f16-4f4f-9550-c0b023d309b8}\\0000",00000000,00000000,00000001,00000002,00000000,0033f254,00000000) ret=7ec98ddd | |
| 0020:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec98ddd | |
| 0020:Call advapi32.RegSetValueExW(0000003c,7ec9f7bc L"GraphicsDriver",00000000,00000001,0033f3f4,00000040) ret=7ec98e62 | |
| 0020:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec98e62 | |
| 0020:Call advapi32.RegCloseKey(0000003c) ret=7ec98e80 | |
| 0020:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec98e80 | |
| 0020:Call user32.CreateWindowExW(00000000,00008001,00000000,86000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0033f244) ret=7ec98ef6 | |
| 0020:Call window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_NCCREATE,wp=00000000,lp=0033f11c) | |
| 0020:Ret window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_NCCREATE,wp=00000000,lp=0033f11c) retval=00000001 | |
| 0020:Call window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f000) | |
| 0020:Ret window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f000) retval=00000000 | |
| 0020:Call window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_CREATE,wp=00000000,lp=0033f11c) | |
| 0020:Ret window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_CREATE,wp=00000000,lp=0033f11c) retval=00000000 | |
| 0020:Call winex11.drv.wine_get_gdi_driver(0000002e) ret=7e93bdab | |
| 0020:Ret winex11.drv.wine_get_gdi_driver() retval=7e7129c0 ret=7e93bdab | |
| 0020:Call winex11.drv.CreateWindow(00010020) ret=7ea54bfb | |
| 0020:Call PE DLL (proc=0x7e499af0,module=0x7e480000 L"imm32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0020:Call user32.RegisterWindowMessageA(7e49a5b7 "MSIMEService") ret=7e4974f9 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c010 ret=7e4974f9 | |
| 0020:Call user32.RegisterWindowMessageA(7e49a5c4 "MSIMEReconvertOptions") ret=7e497511 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c011 ret=7e497511 | |
| 0020:Call user32.RegisterWindowMessageA(7e49a5da "MSIMEMouseOperation") ret=7e497529 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c012 ret=7e497529 | |
| 0020:Call user32.RegisterWindowMessageA(7e49a5ee "MSIMEReconvertRequest") ret=7e497541 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c013 ret=7e497541 | |
| 0020:Call user32.RegisterWindowMessageA(7e49a604 "MSIMEReconvert") ret=7e497559 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c014 ret=7e497559 | |
| 0020:Call user32.RegisterWindowMessageA(7e49a613 "MSIMEQueryPosition") ret=7e497571 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c015 ret=7e497571 | |
| 0020:Call user32.RegisterWindowMessageA(7e49a626 "MSIMEDocumentFeed") ret=7e497589 | |
| 0020:Ret user32.RegisterWindowMessageA() retval=0000c016 ret=7e497589 | |
| 0020:Call user32.LoadCursorW(00000000,00007f00) ret=7e4975cb | |
| 0020:Ret user32.LoadCursorW() retval=00010022 ret=7e4975cb | |
| 0020:Call user32.RegisterClassW(0033e824) ret=7e4975e3 | |
| 0020:Ret user32.RegisterClassW() retval=0000c017 ret=7e4975e3 | |
| 0020:Ret PE DLL (proc=0x7e499af0,module=0x7e480000 L"imm32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0020:Call imm32.ImmGetContext(00000000) ret=7e6b991f | |
| 0020:Call user32.IsWindow(00000000) ret=7e498267 | |
| 0020:Ret user32.IsWindow() retval=00000000 ret=7e498267 | |
| 0020:Ret imm32.ImmGetContext() retval=00000000 ret=7e6b991f | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea54bfb | |
| 0020:Call window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea4df40 (hwnd=0x10020,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.CreateWindowExW() retval=00010020 ret=7ec98ef6 | |
| 0020:Call user32.CreateWindowExW(00000000,7ec9fa8c L"Message",00000000,86000000,00000000,00000000,00000064,00000064,00000000,00000000,00000000,00000000) ret=7ec98f6e | |
| 0020:Call winex11.drv.WindowPosChanging(00010026,00000000,00000014,0033efcc,0033efcc,0033ee6c,0033ee68) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010026,00000000,00000034,0033efcc,0033efcc,0033ee6c,00000000,7eb458a0) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_NCCREATE,wp=00000000,lp=0033f11c) | |
| 0020:Ret window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_NCCREATE,wp=00000000,lp=0033f11c) retval=00000001 | |
| 0020:Call window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f000) | |
| 0020:Ret window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f000) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(00010026,00000000,00000010,0033efcc,0033f000,0033ee6c,0033ee68) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010026,00000000,00000010,0033efcc,0033f000,0033ee6c,00000000,7eb458a0) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_CREATE,wp=00000000,lp=0033f11c) | |
| 0020:Ret window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_CREATE,wp=00000000,lp=0033f11c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(00010026) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_SIZE,wp=00000000,lp=00640064) | |
| 0020:Ret window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_SIZE,wp=00000000,lp=00640064) retval=00000000 | |
| 0020:Call window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea865e0 (hwnd=0x10026,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.CreateWindowExW() retval=00010026 ret=7ec98f6e | |
| 0020:Call user32.SetWindowLongW(00010020,fffffffc,7ec97010) ret=7ec98fed | |
| 0020:Ret user32.SetWindowLongW() retval=7ea4df40 ret=7ec98fed | |
| 0020:Call user32.LoadIconW(00000000,00007f05) ret=7ec99005 | |
| 0020:Ret user32.LoadIconW() retval=00010028 ret=7ec99005 | |
| 0020:Call user32.SendMessageW(00010020,00000080,00000001,00010028) ret=7ec99025 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_SETICON,wp=00000001,lp=00010028) | |
| 0018:Call KERNEL32.CreateThread(00000000,00000000,7eb67160,00000000,00000000,00000000) ret=7eb67e07 | |
| 0020:Call user32.DefWindowProcW(00010020,00000080,00000001,00010028) ret=7ec97275 | |
| 0020:Call winex11.drv.SetWindowIcon(00010020,00000001,00010028) ret=7ea4ccac | |
| 0020:Ret winex11.drv.SetWindowIcon() retval=00000000 ret=7ea4ccac | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_SETICON,wp=00000001,lp=00010028) retval=00000000 | |
| 0020:Ret user32.SendMessageW() retval=00000000 ret=7ec99025 | |
| 0020:Call user32.GetSystemMetrics(0000004f) ret=7ec99179 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033ef28) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000438 ret=7ec99179 | |
| 0020:Call user32.GetSystemMetrics(0000004e) ret=7ec9918f | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033ef28) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000780 ret=7ec9918f | |
| 0020:Call user32.GetSystemMetrics(0000004d) ret=7ec991a1 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033ef28) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec991a1 | |
| 0020:Call user32.GetSystemMetrics(0000004c) ret=7ec991b3 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033ef28) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec991b3 | |
| 0020:Call user32.SetWindowPos(00010020,00000000,00000000,00000000,00000780,00000438,00000040) ret=7ec991eb | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f130) | |
| 0020:Call user32.DefWindowProcW(00010020,00000046,00000000,0033f130) ret=7ec97275 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f130) retval=00000000 | |
| 0018:Ret KERNEL32.CreateThread() retval=00000078 ret=7eb67e07 | |
| 0018:Call KERNEL32.CloseHandle(00000078) ret=7eb67e17 | |
| 0021:Call PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0021:Ret PE DLL (proc=0x7ebd03b0,module=0x7eb80000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0021:Starting thread proc 0x7eb67160 (arg=(nil)) | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000001,lp=0033f088) | |
| 0020:Call user32.DefWindowProcW(00010020,00000083,00000001,0033f088) ret=7ec97275 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000001,lp=0033f088) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(00010020,00000000,0000104a,0033f00c,0033f01c,0033eecc,0033eec8) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010020,00000000,0000104a,0033f00c,0033f01c,0033eecc,0033f068,7eb458a0) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_QUERYNEWPALETTE,wp=00000000,lp=00000000) | |
| 0020:Call user32.DefWindowProcW(00010020,0000030f,00000000,00000000) ret=7ec97275 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_QUERYNEWPALETTE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_NCACTIVATE,wp=00000001,lp=00000000) | |
| 0020:Call user32.DefWindowProcW(00010020,00000086,00000001,00000000) ret=7ec97275 | |
| 0020:Call winex11.drv.GetDC(0002002a,00010020,00010020,0033e2bc,0033e2cc,00000053) ret=7ea97ebd | |
| 0020:Ret winex11.drv.GetDC() retval=00000000 ret=7ea97ebd | |
| 0018:Ret KERNEL32.CloseHandle() retval=00000001 ret=7eb67e17 | |
| 0018:Ret driver init 0x7eb6bce0 (obj=0x7ecce500,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MountMgr") retval=00000000 | |
| 0018:Call advapi32.SetServiceStatus(0011ab30,0053e950) ret=7eccb978 | |
| 0018:Call rpcrt4.NdrClientInitializeNew(0053e5ec,0053e6cc,7ecb2e80,00000007) ret=7ec93cf0 | |
| 0018:Ret rpcrt4.NdrClientInitializeNew() retval=7ec8bc10 ret=7ec93cf0 | |
| 0018:Call rpcrt4.NDRCContextBinding(0011ab30) ret=7ec93d04 | |
| 0018:Ret rpcrt4.NDRCContextBinding() retval=0011adf8 ret=7ec93d04 | |
| 0018:Call rpcrt4.NdrGetBuffer(0053e6cc,00000038,0011adf8) ret=7ec93d29 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebcdba1 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bb98 ret=7ebcdba1 | |
| 0018:Ret rpcrt4.NdrGetBuffer() retval=0011bb98 ret=7ec93d29 | |
| 0018:Call rpcrt4.NdrClientContextMarshall(0053e6cc,0011ab30,00000000) ret=7ec93d41 | |
| 0018:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec93d41 | |
| 0018:Call rpcrt4.NdrSimpleStructMarshall(0053e6cc,0053e950,7eca1734) ret=7ec93d61 | |
| 0018:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ec93d61 | |
| 0018:Call rpcrt4.NdrSendReceive(0053e6cc,0011bbc8) ret=7ec93d77 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebbd868 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b430 ret=7ebbd868 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebbb296 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bbd8 ret=7ebbb296 | |
| 0018:Call KERNEL32.WriteFile(00000020,0011bbd8,00000048,0053e388,00000000) ret=7ebc4c45 | |
| 0018:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebc4c45 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011bbd8) ret=7ebbb3cf | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbb3cf | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b430) ret=7ebbd933 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbd933 | |
| 0018:Call KERNEL32.ReadFile(00000020,0053e39c,00000010,0053e348,00000000) ret=7ebc4cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec68884 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001199f0 ret=7ec68884 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119a00,00000008,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec68963 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001191f0 ret=7ec68963 | |
| 0014:Call KERNEL32.ReadFile(0000002c,001191f0,00000030,0064e868,00000000) ret=7ec70cd5 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ec70cd5 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec79ba1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119228 ret=7ec79ba1 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001191f0) ret=7ec68b12 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec68b12 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec6bd0e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001191f0 ret=7ec6bd0e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ec6c030,001191f0,00000010) ret=7ec6bd58 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119730,0084e6d4,7eccde80) ret=7ecc3b8a | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ecc3b8a | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0084e6d4,7ecc9170) ret=7ecc3c6a | |
| 0020:Ret user32.DefWindowProcW() retval=00000001 ret=7ec97275 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(001197ec,00000001) ret=7ec5d740 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_NCACTIVATE,wp=00000001,lp=00000000) retval=00000001 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ec5d740 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_ACTIVATE,wp=00000001,lp=00000000) | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec7a909 | |
| 0020:Call user32.DefWindowProcW(00010020,00000006,00000001,00000000) ret=7ec97275 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199b0 ret=7ec7a909 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=001197c8 ret=7ecc3c6a | |
| 0016:Call rpcrt4.NdrSimpleStructUnmarshall(0084e6d4,0084e7b8,7ecc9174,00000000) ret=7ecc3c8f | |
| 0016:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ecc3c8f | |
| 0016:Call KERNEL32.SetEvent(00000044) ret=7ecba315 | |
| 0020:Call winex11.drv.SetFocus(00010020) ret=7ea62d37 | |
| 0020:Ret winex11.drv.SetFocus() retval=00000000 ret=7ea62d37 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_SETFOCUS,wp=00000000,lp=00000000) | |
| 0020:Call user32.DefWindowProcW(00010020,00000007,00000000,00000000) ret=7ec97275 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_SETFOCUS,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_ACTIVATE,wp=00000001,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f130) | |
| 0020:Call user32.DefWindowProcW(00010020,00000047,00000000,0033f130) ret=7ec97275 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=04380780) | |
| 0020:Call user32.DefWindowProcW(00010020,00000005,00000000,04380780) ret=7ec97275 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=04380780) retval=00000000 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec97275 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f130) retval=00000000 | |
| 0020:Ret user32.SetWindowPos() retval=00000001 ret=7ec991eb | |
| 0020:Call user32.SystemParametersInfoW(00000014,00000000,00000000,00000000) ret=7ec99213 | |
| 0020:Call winex11.drv.SystemParametersInfo(00000014,00000000,00000000,00000000) ret=7eaa892b | |
| 0020:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7eaa892b | |
| 0020:Ret user32.SystemParametersInfoW() retval=00000001 ret=7ec99213 | |
| 0020:Call user32.ClipCursor(00000000) ret=7ec99223 | |
| 0020:Call winex11.drv.ClipCursor(0033f0ec) ret=7ea3d689 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ec6bd58 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ec6bc65 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ec6bc65 | |
| 0014:Call KERNEL32.ReadFile(0000002c,0064e8bc,00000010,0064e868,00000000) ret=7ec70cd5 | |
| 0016:Ret KERNEL32.SetEvent() retval=00000001 ret=7ecba315 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119730) ret=7ecc3cf0 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec79ba1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ec79ba1 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ecc3cf0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199b0) ret=7ec7aa24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec7aa24 | |
| 0016:Call ntdll.RtlReleaseResource(001197ec) ret=7ec5dadd | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ec5dadd | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ec6620c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c10 ret=7ec6620c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7ec67296 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119c30 ret=7ec67296 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119c30,0000001c,0084e718,00000000) ret=7ec70c45 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec70c45 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c30) ret=7ec673cf | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec673cf | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c10) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119228) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ec79be1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec79be1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199f0) ret=7ec668e8 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec668e8 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119730) ret=7ec6c0d7 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0d7 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec6c0fb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c0fb | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001191f0) ret=7ec6c126 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec6c126 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebbc884 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b430 ret=7ebbc884 | |
| 0018:Call KERNEL32.ReadFile(00000020,0011b440,00000008,0053e348,00000000) ret=7ebc4cd5 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ebbc963 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bbd8 ret=7ebbc963 | |
| 0018:Call KERNEL32.ReadFile(00000020,0011bbd8,00000004,0053e348,00000000) ret=7ebc4cd5 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebc4cd5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ebcdba1 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bbf0 ret=7ebcdba1 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebbcb94 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb94 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011bbd8) ret=7ebbcb12 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbcb12 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b430) ret=7ebbdbde | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebbdbde | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011bb98) ret=7ebcdbe1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0018:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec93d77 | |
| 0018:Call rpcrt4.NdrFreeBuffer(0053e6cc) ret=7ec93dfe | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011bbf0) ret=7ebcdbe1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcdbe1 | |
| 0018:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec93dfe | |
| 0018:Ret advapi32.SetServiceStatus() retval=00000001 ret=7eccb978 | |
| 0018:Call ntoskrnl.exe.wine_ntoskrnl_main_loop(00000040) ret=7eccb98a | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1cec8 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011bb98 ret=7ec1cec8 | |
| 0018:Call KERNEL32.WaitForMultipleObjects(00000002,0053e814,00000000,ffffffff) ret=7ec1d30f | |
| 0020:Call winex11.drv.WindowMessage(00010020,80001004,00000000,00000000) ret=7ea84e39 | |
| 0020:Ret winex11.drv.WindowMessage() retval=00000000 ret=7ea84e39 | |
| 0020:Ret winex11.drv.ClipCursor() retval=00000001 ret=7ea3d689 | |
| 0020:Ret user32.ClipCursor() retval=00000001 ret=7ec99223 | |
| 0020:Call user32.EnumDisplaySettingsExW(00000000,ffffffff,0033f3f4,00000000) ret=7ec9924d | |
| 0020:Call winex11.drv.EnumDisplaySettingsEx(00000000,ffffffff,0033f3f4,00000000) ret=7eaacdca | |
| 0020:Ret winex11.drv.EnumDisplaySettingsEx() retval=00000001 ret=7eaacdca | |
| 0020:Ret user32.EnumDisplaySettingsExW() retval=00000001 ret=7ec9924d | |
| 0020:Call user32.ChangeDisplaySettingsExW(00000000,0033f3f4,00000000,10000009,00000000) ret=7ec9929b | |
| 0020:Call winex11.drv.ChangeDisplaySettingsEx(00000000,0033f3f4,00000000,10000009,00000000) ret=7eaacb81 | |
| 0020:Ret winex11.drv.ChangeDisplaySettingsEx() retval=00000000 ret=7eaacb81 | |
| 0020:Ret user32.ChangeDisplaySettingsExW() retval=00000000 ret=7ec9929b | |
| 0020:Call user32.RegisterClassExW(0033f16c) ret=7ec96f1d | |
| 0020:Ret user32.RegisterClassExW() retval=0000c019 ret=7ec96f1d | |
| 0020:Call user32.CreateWindowExW(00000000,7ec9f4ae L"WineAppBar",7ec9f4ae L"WineAppBar",00000000,00000000,00000000,00000000,00000000,fffffffd,00000000,00000000,00000000) ret=7ec96fb4 | |
| 0020:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033e8e4,00000000) ret=7eaa892b | |
| 0020:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7eaa892b | |
| 0021:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7e70661c "c925f0f9-cd3f-43db-b3c1-e6014b9cd8bb",00000024,0063e560,00000024) ret=7eb65f3d | |
| 0021:Ret KERNEL32.MultiByteToWideChar() retval=00000024 ret=7eb65f3d | |
| 0021:Call ntdll.RtlInitUnicodeString(0063e554,0063e55e L"{c925f0f9-cd3f-43db-b3c1-e6014b9cd8bb}") ret=7eb65f7f | |
| 0021:Ret ntdll.RtlInitUnicodeString() retval=0000004e ret=7eb65f7f | |
| 0021:Call ntdll.RtlGUIDFromString(0063e554,0063e66c) ret=7eb65f92 | |
| 0021:Ret ntdll.RtlGUIDFromString() retval=00000000 ret=7eb65f92 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cba0 ret=7eb680b4 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb68808 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68808 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011ba10) ret=7eb6882f | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6882f | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011ba10 ret=7eb680b4 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011b430 ret=7eb680b4 | |
| 0021:Call advapi32.RegDeleteValueW(00000054,0011ba4c L"\\??\\Volume{00000000-0000-0000-0000-00000000005a}") ret=7eb6b865 | |
| 0021:Ret advapi32.RegDeleteValueW() retval=00000000 ret=7eb6b865 | |
| 0021:Call ntoskrnl.exe.IoDeleteSymbolicLink(0011ba3c) ret=7eb6b874 | |
| 0021:Call ntdll.NtOpenSymbolicLinkObject(0063e3e0,00000000,0063e3e4) ret=7ec1b289 | |
| 0021:Ret ntdll.NtOpenSymbolicLinkObject() retval=00000000 ret=7ec1b289 | |
| 0021:Call ntdll.NtClose(00000078) ret=7ec1b2d3 | |
| 0021:Ret ntdll.NtClose() retval=00000000 ret=7ec1b2d3 | |
| 0021:Ret ntoskrnl.exe.IoDeleteSymbolicLink() retval=00000000 ret=7eb6b874 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011bb68) ret=7eb6b898 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b898 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011ba28) ret=7eb6b8b9 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b8b9 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eb6a6fc | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011ba28 ret=7eb6a6fc | |
| 0021:Call ntdll.RtlInitUnicodeString(0011ba3c,0011ba4c L"\\??\\Volume{c925f0f9-cd3f-43db-b3c1-e6014b9cd8bb}") ret=7eb6a736 | |
| 0021:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eb6a736 | |
| 0021:Call ntoskrnl.exe.IoCreateSymbolicLink(0011ba3c,0011b9e0) ret=7eb6a7f4 | |
| 0021:Call ntdll.NtCreateSymbolicLinkObject(0063e2c0,000f0001,0063e2c4,0011b9e0) ret=7ec1b1db | |
| 0020:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033e3a4,00000000) ret=7eaa892b | |
| 0020:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7eaa892b | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033e8a8) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033e8a8) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033ee3c) | |
| 0020:Call user32.DefWindowProcW(0001002a,00000024,00000000,0033ee3c) ret=7ec9678c | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9678c | |
| 0020:Ret window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033ee3c) retval=00000000 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ecb8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033eb34) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ee64) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Call winex11.drv.WindowPosChanging(0001002a,00000000,00000014,0033ef3c,0033ef3c,0033eddc,0033edd8) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0021:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0021:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eb6b58f | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011bb68 ret=7eb6b58f | |
| 0021:Call advapi32.RegSetValueExW(00000054,0011ba4c L"\\??\\Volume{c925f0f9-cd3f-43db-b3c1-e6014b9cd8bb}",00000000,00000003,0011bb68,00000004) ret=7eb6b5e9 | |
| 0021:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0021:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7e707424 "e3ff1dcd-7014-4597-987e-a802e559effe",00000024,0063e560,00000024) ret=7eb65f3d | |
| 0021:Ret KERNEL32.MultiByteToWideChar() retval=00000024 ret=7eb65f3d | |
| 0021:Call ntdll.RtlInitUnicodeString(0063e554,0063e55e L"{e3ff1dcd-7014-4597-987e-a802e559effe}") ret=7eb65f7f | |
| 0021:Ret ntdll.RtlInitUnicodeString() retval=0000004e ret=7eb65f7f | |
| 0021:Call ntdll.RtlGUIDFromString(0063e554,0063e66c) ret=7eb65f92 | |
| 0021:Ret ntdll.RtlGUIDFromString() retval=00000000 ret=7eb65f92 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eb692db | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cbd8 ret=7eb692db | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eb68180 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cc08 ret=7eb68180 | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cc58 ret=7ec1ae7e | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011cc58) ret=7ec1af03 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1af03 | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eb681fc | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cc58 ret=7ec1ae7e | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011cc58) ret=7ec1af03 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1af03 | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eb681fc | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cc58 ret=7ec1ae7e | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cd48 ret=7eb680b4 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb68808 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68808 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6882f | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6882f | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cd80 ret=7eb680b4 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cd98 ret=7eb680b4 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eb6a6fc | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cdb0 ret=7eb6a6fc | |
| 0021:Call ntdll.RtlInitUnicodeString(0011cdc4,0011cdd4 L"\\??\\Volume{e3ff1dcd-7014-4597-987e-a802e559effe}") ret=7eb6a736 | |
| 0021:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eb6a736 | |
| 0021:Call ntoskrnl.exe.IoCreateSymbolicLink(0011cdc4,0011cd18) ret=7eb6a7f4 | |
| 0021:Call ntdll.NtCreateSymbolicLinkObject(0063e2c0,000f0001,0063e2c4,0011cd18) ret=7ec1b1db | |
| 0021:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0021:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,00000006) ret=7eb6b58f | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011ce70 ret=7eb6b58f | |
| 0021:Call advapi32.RegSetValueExW(00000054,0011cdd4 L"\\??\\Volume{e3ff1dcd-7014-4597-987e-a802e559effe}",00000000,00000003,0011ce70,00000006) ret=7eb6b5e9 | |
| 0021:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0021:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7e707a9c "a8fd6955-92f2-47d0-b6f1-a2ac5981d692",00000024,0063e560,00000024) ret=7eb65f3d | |
| 0021:Ret KERNEL32.MultiByteToWideChar() retval=00000024 ret=7eb65f3d | |
| 0021:Call ntdll.RtlInitUnicodeString(0063e554,0063e55e L"{a8fd6955-92f2-47d0-b6f1-a2ac5981d692}") ret=7eb65f7f | |
| 0021:Ret ntdll.RtlInitUnicodeString() retval=0000004e ret=7eb65f7f | |
| 0021:Call ntdll.RtlGUIDFromString(0063e554,0063e66c) ret=7eb65f92 | |
| 0021:Ret ntdll.RtlGUIDFromString() retval=00000000 ret=7eb65f92 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eb692db | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011ce88 ret=7eb692db | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eb68180 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011ceb8 ret=7eb68180 | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cf08 ret=7ec1ae7e | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011cf08) ret=7ec1af03 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1af03 | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eb681fc | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cf08 ret=7ec1ae7e | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011cf08) ret=7ec1af03 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1af03 | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eb681fc | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cf08 ret=7ec1ae7e | |
| 0020:Call winex11.drv.WindowPosChanged(0001002a,00000000,00000014,0033ef3c,0033ef3c,0033eddc,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_NCCREATE,wp=00000000,lp=0033f08c) | |
| 0020:Call user32.DefWindowProcW(0001002a,00000081,00000000,0033f08c) ret=7ec9678c | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,0011cf08) ret=7ec1af03 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1af03 | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eb681fc | |
| 0021:Call ntoskrnl.exe.IoCreateDevice(0011b138,0000002c,0063e4dc,00000000,00000000,00000000,0063e4d8) ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7ec1ae7e | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cf08 ret=7ec1ae7e | |
| 0020:Call winex11.drv.SetWindowText(0001002a,001336c0 L"WineAppBar") ret=7ea4b889 | |
| 0020:Ret winex11.drv.SetWindowText() retval=00000000 ret=7ea4b889 | |
| 0020:Ret user32.DefWindowProcW() retval=00000001 ret=7ec9678c | |
| 0020:Ret window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_NCCREATE,wp=00000000,lp=0033f08c) retval=00000001 | |
| 0020:Call window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_NCCALCSIZE,wp=00000000,lp=0033ef70) | |
| 0020:Call user32.DefWindowProcW(0001002a,00000083,00000000,0033ef70) ret=7ec9678c | |
| 0020:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033e524,00000000) ret=7eaa892b | |
| 0020:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7eaa892b | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9678c | |
| 0020:Ret window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_NCCALCSIZE,wp=00000000,lp=0033ef70) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(0001002a,00000000,00000010,0033ef3c,0033ef70,0033eddc,0033edd8) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0021:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eb681fc | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011cff8 ret=7eb680b4 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb68808 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb68808 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6882f | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6882f | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7eb680b4 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011d030 ret=7eb680b4 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eb6a6fc | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011d048 ret=7eb6a6fc | |
| 0021:Call ntdll.RtlInitUnicodeString(0011d05c,0011d06c L"\\??\\Volume{a8fd6955-92f2-47d0-b6f1-a2ac5981d692}") ret=7eb6a736 | |
| 0021:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eb6a736 | |
| 0021:Call ntoskrnl.exe.IoCreateSymbolicLink(0011d05c,0011cfc8) ret=7eb6a7f4 | |
| 0021:Call ntdll.NtCreateSymbolicLinkObject(0063e2c0,000f0001,0063e2c4,0011cfc8) ret=7ec1b1db | |
| 0021:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7ec1b1db | |
| 0021:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eb6a7f4 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb6b55e | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb6b55e | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eb6b58f | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=0011d108 ret=7eb6b58f | |
| 0021:Call advapi32.RegSetValueExW(00000054,0011d06c L"\\??\\Volume{a8fd6955-92f2-47d0-b6f1-a2ac5981d692}",00000000,00000003,0011d108,00000004) ret=7eb6b5e9 | |
| 0020:Call winex11.drv.WindowPosChanged(0001002a,00000000,00000010,0033ef3c,0033ef70,0033eddc,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_CREATE,wp=00000000,lp=0033f08c) | |
| 0020:Call user32.DefWindowProcW(0001002a,00000001,00000000,0033f08c) ret=7ec9678c | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9678c | |
| 0020:Ret window proc 0x7ec96710 (hwnd=0x1002a,msg=WM_CREATE,wp=00000000,lp=0033f08c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(0001002a) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Ret user32.CreateWindowExW() retval=0001002a ret=7ec96fb4 | |
| 0020:Call KERNEL32.GetProcAddress(7e690000,7eca28f8 "wine_notify_icon") ret=7ec9e9c0 | |
| 0020:Ret KERNEL32.GetProcAddress() retval=7e69cd70 ret=7ec9e9c0 | |
| 0020:Call user32.GetSystemMetrics(00000031) ret=7ec9e9d6 | |
| 0020:Ret user32.GetSystemMetrics() retval=00000010 ret=7ec9e9d6 | |
| 0020:Call user32.GetSystemMetrics(00000032) ret=7ec9e9ef | |
| 0020:Ret user32.GetSystemMetrics() retval=00000010 ret=7ec9e9ef | |
| 0020:Call user32.LoadIconW(00000000,00007f05) ret=7ec9ea4a | |
| 0020:Ret user32.LoadIconW() retval=00010028 ret=7ec9ea4a | |
| 0020:Call user32.LoadCursorW(00000000,00007f00) ret=7ec9ea68 | |
| 0020:Ret user32.LoadCursorW() retval=00010022 ret=7ec9ea68 | |
| 0020:Call user32.RegisterClassExW(0033f108) ret=7ec9ea8f | |
| 0021:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eb6b5e9 | |
| 0020:Ret user32.RegisterClassExW() retval=0000c01a ret=7ec9ea8f | |
| 0020:Call user32.GetSystemMetrics(00000000) ret=7ec9ead4 | |
| 0020:Ret user32.GetSystemMetrics() retval=00000780 ret=7ec9ead4 | |
| 0020:Call user32.GetSystemMetrics(00000001) ret=7ec9eaec | |
| 0020:Ret user32.GetSystemMetrics() retval=00000438 ret=7ec9eaec | |
| 0020:Call user32.CreateWindowExW(08000000,7eca2a72 L"Shell_TrayWnd",00000000,80000000,00000000,00000424,00000780,00000014,00000000,00000000,00000000,00000000) ret=7ec9eb4c | |
| 0020:Call KERNEL32.LZOpenFileW(0033ec14 L"C:\\windows\\system32\\explorer.exe",0033eaf4,00000000) ret=7e8dba82 | |
| 0020:Ret KERNEL32.LZOpenFileW() retval=00000050 ret=7e8dba82 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000000,00000000) ret=7e8dafa2 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000000 ret=7e8dafa2 | |
| 0020:Call KERNEL32.LZRead(00000050,0033ea08,00000040) ret=7e8dafba | |
| 0020:Ret KERNEL32.LZRead() retval=00000040 ret=7e8dafba | |
| 0020:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7e8db047 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000060 ret=7e8db047 | |
| 0020:Call KERNEL32.LZRead(00000050,0033ea89,00000002) ret=7e8db062 | |
| 0020:Ret KERNEL32.LZRead() retval=00000002 ret=7e8db062 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7e8db086 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000060 ret=7e8db086 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000000,00000001) ret=7e8da7e2 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000060 ret=7e8da7e2 | |
| 0020:Call KERNEL32.LZRead(00000050,0033e8a0,00000108) ret=7e8da800 | |
| 0020:Ret KERNEL32.LZRead() retval=00000108 ret=7e8da800 | |
| 0020:Call ntdll.RtlAllocateHeap(00110000,00000000,00000078) ret=7e8da8b9 | |
| 0020:Ret ntdll.RtlAllocateHeap() retval=00134f78 ret=7e8da8b9 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000158,00000000) ret=7e8da8ed | |
| 0020:Ret KERNEL32.LZSeek() retval=00000158 ret=7e8da8ed | |
| 0020:Call KERNEL32.LZRead(00000050,00134f78,00000078) ret=7e8da907 | |
| 0020:Ret KERNEL32.LZRead() retval=00000078 ret=7e8da907 | |
| 0020:Call ntdll.RtlAllocateHeap(00110000,00000000,00002000) ret=7e8daabd | |
| 0020:Ret ntdll.RtlAllocateHeap() retval=001369f0 ret=7e8daabd | |
| 0020:Call KERNEL32.LZSeek(00000050,00000600,00000000) ret=7e8daaf2 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000600 ret=7e8daaf2 | |
| 0020:Call KERNEL32.LZRead(00000050,001369f0,000013cc) ret=7e8dab0c | |
| 0020:Ret KERNEL32.LZRead() retval=000013cc ret=7e8dab0c | |
| 0020:Call KERNEL32.GetUserDefaultLangID() ret=7e8daf25 | |
| 0020:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7e8daf25 | |
| 0020:Call KERNEL32.GetUserDefaultLangID() ret=7e8dac26 | |
| 0020:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7e8dac26 | |
| 0020:Call KERNEL32.GetUserDefaultLangID() ret=7e8dac56 | |
| 0020:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7e8dac56 | |
| 0020:Call KERNEL32.GetSystemDefaultLangID() ret=7e8dac8d | |
| 0020:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7e8dac8d | |
| 0020:Call KERNEL32.GetSystemDefaultLangID() ret=7e8dacad | |
| 0020:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7e8dacad | |
| 0020:Call KERNEL32.GetSystemDefaultLangID() ret=7e8dacdd | |
| 0020:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7e8dacdd | |
| 0020:Call ntdll.RtlFreeHeap(00110000,00000000,001369f0) ret=7e8dab3e | |
| 0020:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e8dab3e | |
| 0020:Call ntdll.RtlFreeHeap(00110000,00000000,00134f78) ret=7e8dab65 | |
| 0020:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e8dab65 | |
| 0020:Call KERNEL32.LZClose(00000050) ret=7e8dbab5 | |
| 0020:Ret KERNEL32.LZClose() retval=00000000 ret=7e8dbab5 | |
| 0020:Call KERNEL32.LZOpenFileW(0033ec14 L"C:\\windows\\system32\\explorer.exe",0033eaf4,00000000) ret=7e8dbdba | |
| 0020:Ret KERNEL32.LZOpenFileW() retval=00000050 ret=7e8dbdba | |
| 0020:Call KERNEL32.LZSeek(00000050,00000000,00000000) ret=7e8dafa2 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000000 ret=7e8dafa2 | |
| 0020:Call KERNEL32.LZRead(00000050,0033ea08,00000040) ret=7e8dafba | |
| 0020:Ret KERNEL32.LZRead() retval=00000040 ret=7e8dafba | |
| 0020:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7e8db047 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000060 ret=7e8db047 | |
| 0020:Call KERNEL32.LZRead(00000050,0033ea89,00000002) ret=7e8db062 | |
| 0020:Ret KERNEL32.LZRead() retval=00000002 ret=7e8db062 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7e8db086 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000060 ret=7e8db086 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000000,00000001) ret=7e8da7e2 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000060 ret=7e8da7e2 | |
| 0020:Call KERNEL32.LZRead(00000050,0033e8a0,00000108) ret=7e8da800 | |
| 0020:Ret KERNEL32.LZRead() retval=00000108 ret=7e8da800 | |
| 0020:Call ntdll.RtlAllocateHeap(00110000,00000000,00000078) ret=7e8da8b9 | |
| 0020:Ret ntdll.RtlAllocateHeap() retval=00135648 ret=7e8da8b9 | |
| 0020:Call KERNEL32.LZSeek(00000050,00000158,00000000) ret=7e8da8ed | |
| 0020:Ret KERNEL32.LZSeek() retval=00000158 ret=7e8da8ed | |
| 0020:Call KERNEL32.LZRead(00000050,00135648,00000078) ret=7e8da907 | |
| 0020:Ret KERNEL32.LZRead() retval=00000078 ret=7e8da907 | |
| 0020:Call ntdll.RtlAllocateHeap(00110000,00000000,00002000) ret=7e8daabd | |
| 0020:Ret ntdll.RtlAllocateHeap() retval=001369f0 ret=7e8daabd | |
| 0020:Call KERNEL32.LZSeek(00000050,00000600,00000000) ret=7e8daaf2 | |
| 0020:Ret KERNEL32.LZSeek() retval=00000600 ret=7e8daaf2 | |
| 0020:Call KERNEL32.LZRead(00000050,001369f0,000013cc) ret=7e8dab0c | |
| 0020:Ret KERNEL32.LZRead() retval=000013cc ret=7e8dab0c | |
| 0020:Call KERNEL32.GetUserDefaultLangID() ret=7e8daf25 | |
| 0020:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7e8daf25 | |
| 0020:Call KERNEL32.GetUserDefaultLangID() ret=7e8dac26 | |
| 0020:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7e8dac26 | |
| 0020:Call KERNEL32.GetUserDefaultLangID() ret=7e8dac56 | |
| 0020:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7e8dac56 | |
| 0020:Call KERNEL32.GetSystemDefaultLangID() ret=7e8dac8d | |
| 0020:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7e8dac8d | |
| 0020:Call KERNEL32.GetSystemDefaultLangID() ret=7e8dacad | |
| 0020:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7e8dacad | |
| 0020:Call KERNEL32.GetSystemDefaultLangID() ret=7e8dacdd | |
| 0020:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7e8dacdd | |
| 0020:Call ntdll.RtlFreeHeap(00110000,00000000,001369f0) ret=7e8dab3e | |
| 0020:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e8dab3e | |
| 0020:Call ntdll.RtlFreeHeap(00110000,00000000,00135648) ret=7e8dab65 | |
| 0020:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e8dab65 | |
| 0020:Call KERNEL32.LZSeek(00000050,0000166c,00000000) ret=7e8dbe08 | |
| 0020:Ret KERNEL32.LZSeek() retval=0000166c ret=7e8dbe08 | |
| 0020:Call KERNEL32.LZRead(00000050,00134f78,00000360) ret=7e8dbe32 | |
| 0020:Ret KERNEL32.LZRead() retval=00000360 ret=7e8dbe32 | |
| 0020:Call KERNEL32.LZClose(00000050) ret=7e8dbe44 | |
| 0020:Ret KERNEL32.LZClose() retval=00000000 ret=7e8dbe44 | |
| 0020:Call winex11.drv.WindowPosChanging(0001002e,00000000,00000014,0033eedc,0033eedc,0033ed7c,0033ed78) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033e1f8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e074) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e314) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033eab8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e934) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebd4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(0001002e,00000000,00000014,0033eedc,0033eedc,0033ed7c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_NCCREATE,wp=00000000,lp=0033f02c) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000081,00000000,0033f02c) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000001 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_NCCREATE,wp=00000000,lp=0033f02c) retval=00000001 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033ef10) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000083,00000000,0033ef10) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000100 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033ef10) retval=00000100 | |
| 0020:Call winex11.drv.WindowPosChanging(0001002e,00000000,00000010,0033eedc,0033ef10,0033ed7c,0033ed78) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033eab8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e934) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebd4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(0001002e,00000000,00000010,0033eedc,0033ef10,0033ed7c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_CREATE,wp=00000000,lp=0033f02c) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000001,00000000,0033f02c) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_CREATE,wp=00000000,lp=0033f02c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(0001002e) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_SIZE,wp=00000000,lp=00140780) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000005,00000000,00140780) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_SIZE,wp=00000000,lp=00140780) retval=00000000 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04240000) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000003,00000000,04240000) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04240000) retval=00000000 | |
| 0020:Ret user32.CreateWindowExW() retval=0001002e ret=7ec9eb4c | |
| 0020:Call user32.LoadStringW(00000000,00000003,0033f138,00000032) ret=7ec9eb81 | |
| 0020:Ret user32.LoadStringW() retval=00000005 ret=7ec9eb81 | |
| 0020:Call user32.GetDC(00000000) ret=7ec9eb91 | |
| 0020:Call winex11.drv.GetDC(0002002a,00010020,00010020,0033ef5c,0033ef6c,00000013) ret=7ea97ebd | |
| 0020:Ret winex11.drv.GetDC() retval=00000000 ret=7ea97ebd | |
| 0020:Ret user32.GetDC() retval=0002002a ret=7ec9eb91 | |
| 0020:Call gdi32.GetTextExtentPointW(0002002a,0033f138 L"Start",00000005,0033f100) ret=7ec9ebd7 | |
| 0020:Ret gdi32.GetTextExtentPointW() retval=00000001 ret=7ec9ebd7 | |
| 0020:Call user32.ReleaseDC(00000000,0002002a) ret=7ec9ebeb | |
| 0020:Ret user32.ReleaseDC() retval=00000001 ret=7ec9ebeb | |
| 0020:Call user32.CreateWindowExW(00000000,7eca2a50 L"Button",0033f138 L"Start",50000000,00000000,00000000,00000026,00000014,0001002e,00000000,00000000,00000000) ret=7ec9ec5a | |
| 0020:Call winex11.drv.WindowPosChanging(00010030,00000000,00000014,0033eedc,0033eedc,0033ed7c,0033ed78) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010030,00000000,00000014,0033eedc,0033eedc,0033ed7c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_NCCREATE,wp=00000000,lp=0033f02c) | |
| 0020:Call winex11.drv.SetWindowText(00010030,00130080 L"Start") ret=7ea4b889 | |
| 0020:Ret winex11.drv.SetWindowText() retval=00000000 ret=7ea4b889 | |
| 0020:Ret window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_NCCREATE,wp=00000000,lp=0033f02c) retval=00000001 | |
| 0020:Call window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_NCCALCSIZE,wp=00000000,lp=0033ef10) | |
| 0020:Ret window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_NCCALCSIZE,wp=00000000,lp=0033ef10) retval=00000300 | |
| 0020:Call winex11.drv.WindowPosChanging(00010030,00000001,00000010,0033eedc,0033ef10,0033ed7c,0033ed78) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010030,00000001,00000010,0033eedc,0033ef10,0033ed7c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_CREATE,wp=00000000,lp=0033f02c) | |
| 0020:Ret window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_CREATE,wp=00000000,lp=0033f02c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(00010030) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_SIZE,wp=00000000,lp=00140026) | |
| 0020:Ret window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_SIZE,wp=00000000,lp=00140026) retval=00000000 | |
| 0020:Call window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_PARENTNOTIFY,wp=00000001,lp=00010030) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000210,00000001,00010030) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_PARENTNOTIFY,wp=00000001,lp=00010030) retval=00000000 | |
| 0020:Call window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_SHOWWINDOW,wp=00000001,lp=00000000) | |
| 0020:Ret window proc 0x7eac74b0 (hwnd=0x10030,msg=WM_SHOWWINDOW,wp=00000001,lp=00000000) retval=00000000 | |
| 0020:Call winex11.drv.ShowWindow(00010030,00000005,0033edcc,00000057) ret=7eac3bbb | |
| 0020:Ret winex11.drv.ShowWindow() retval=00000057 ret=7eac3bbb | |
| 0020:Call winex11.drv.SetWindowStyle(00010030,fffffff0,0033ece4) ret=7eab821b | |
| 0020:Ret winex11.drv.SetWindowStyle() retval=00000000 ret=7eab821b | |
| 0020:Call winex11.drv.WindowPosChanging(00010030,00000000,0000181f,0033ec7c,0033ec8c,0033eb6c,0033eb68) ret=7eac1b50 | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010030,00000000,0000181f,0033ec7c,0033ec8c,0033eb6c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Ret user32.CreateWindowExW() retval=00010030 ret=7ec9ec5a | |
| 0020:Call user32.GetSystemMetrics(0000004d) ret=7ec9cf71 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033edf8) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec9cf71 | |
| 0020:Call user32.GetSystemMetrics(0000004f) ret=7ec9cf83 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033edf8) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000438 ret=7ec9cf83 | |
| 0020:Call user32.GetSystemMetrics(0000004c) ret=7ec9cf95 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033edf8) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec9cf95 | |
| 0020:Call user32.GetSystemMetrics(0000004e) ret=7ec9cfa7 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7eaa5730,0033edf8) ret=7ea906da | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Ret user32.GetSystemMetrics() retval=00000780 ret=7ec9cfa7 | |
| 0020:Call user32.SetWindowPos(0001002e,00000000,00000780,00000438,00000000,00000000,00000015) ret=7ec9cfe3 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f000) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000046,00000000,0033f000) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f000) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(0001002e,00000000,0000081d,0033eedc,0033eeec,0033ed9c,0033ed98) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ead8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e954) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebf4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(0001002e,00000000,0000081d,0033eedc,0033eeec,0033ed9c,0033ef38,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f000) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000047,00000000,0033f000) ret=7ec9e2c8 | |
| 0020:Call window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04380780) | |
| 0020:Call user32.DefWindowProcW(0001002e,00000003,00000000,04380780) ret=7ec9e2c8 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04380780) retval=00000000 | |
| 0020:Ret user32.DefWindowProcW() retval=00000000 ret=7ec9e2c8 | |
| 0020:Ret window proc 0x7ec9dc20 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f000) retval=00000000 | |
| 0020:Ret user32.SetWindowPos() retval=00000001 ret=7ec9cfe3 | |
| 0020:Call KERNEL32.LoadLibraryA(7ec9f58d "shell32.dll") ret=7ec99307 | |
| 0020:Call PE DLL (proc=0x7e408e30,module=0x7e3d0000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0020:Call KERNEL32.DisableThreadLibraryCalls(7e3d0000) ret=7e3f8fb2 | |
| 0020:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e3f8fb2 | |
| 0020:Call KERNEL32.TlsAlloc() ret=7e3f8fc0 | |
| 0020:Ret KERNEL32.TlsAlloc() retval=00000002 ret=7e3f8fc0 | |
| 0020:Ret PE DLL (proc=0x7e408e30,module=0x7e3d0000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0020:Call PE DLL (proc=0x7e00f250,module=0x7df80000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0020:Call KERNEL32.DisableThreadLibraryCalls(7df80000) ret=7dfba6e8 | |
| 0020:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7dfba6e8 | |
| 0020:Call KERNEL32.GetModuleFileNameW(7df80000,7e1ad880,00000104) ret=7dfba706 | |
| 0020:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7dfba706 | |
| 0020:Ret PE DLL (proc=0x7e00f250,module=0x7df80000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0020:Ret KERNEL32.LoadLibraryA() retval=7df80000 ret=7ec99307 | |
| 0020:Call KERNEL32.GetProcAddress(7df80000,000000bc) ret=7ec9931f | |
| 0020:Ret KERNEL32.GetProcAddress() retval=7df8c5c0 ret=7ec9931f | |
| 0020:Call shell32.188(00000001) ret=7ec99330 | |
| 0020:Call user32.DdeInitializeW(7e1ad6d0,7dfa0a50,00014000,00000000) ret=7dfa0fe0 | |
| 0020:Call winex11.drv.WindowPosChanging(00010032,00000000,00000014,0033eeac,0033eeac,0033ed4c,0033ed48) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033e1c8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e044) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e2e4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea88) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e904) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033eba4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010032,00000000,00000014,0033eeac,0033eeac,0033ed4c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_NCCREATE,wp=00000000,lp=0033effc) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_NCCREATE,wp=00000000,lp=0033effc) retval=00000001 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eee0) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eee0) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(00010032,00000000,00000010,0033eeac,0033eee0,0033ed4c,0033ed48) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea88) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e904) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033eba4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010032,00000000,00000010,0033eeac,0033eee0,0033ed4c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_CREATE,wp=00000000,lp=0033effc) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_CREATE,wp=00000000,lp=0033effc) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(00010032) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.DdeInitializeW() retval=00000000 ret=7dfa0fe0 | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e0150b2 L"Progman",000004b0) ret=7dfa1004 | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c000 ret=7dfa1004 | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e0150b2 L"Progman",000004b0) ret=7dfa1028 | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c000 ret=7dfa1028 | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e0150ae L"*",000004b0) ret=7dfa1052 | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c001 ret=7dfa1052 | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e0150a2 L"Shell",000004b0) ret=7dfa107c | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c002 ret=7dfa107c | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e015086 L"AppProperties",000004b0) ret=7dfa10a6 | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c003 ret=7dfa10a6 | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e015076 L"Folders",000004b0) ret=7dfa10d0 | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c004 ret=7dfa10d0 | |
| 0020:Call user32.DdeCreateStringHandleW(00000001,7e015068 L"Groups",000004b0) ret=7dfa10fa | |
| 0020:Ret user32.DdeCreateStringHandleW() retval=0000c005 ret=7dfa10fa | |
| 0020:Call user32.DdeNameService(00000001,0000c004,00000000,00000001) ret=7dfa112c | |
| 0020:Call winex11.drv.WindowPosChanging(00010034,00000000,00000014,0033eebc,0033eebc,0033ed5c,0033ed58) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033e1d8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e054) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e2f4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea98) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e914) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebb4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010034,00000000,00000014,0033eebc,0033eebc,0033ed5c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10034,msg=WM_NCCREATE,wp=00000000,lp=0033f00c) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10034,msg=WM_NCCREATE,wp=00000000,lp=0033f00c) retval=00000001 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10034,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eef0) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10034,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eef0) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(00010034,00000000,00000010,0033eebc,0033eef0,0033ed5c,0033ed58) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea98) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e914) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebb4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010034,00000000,00000010,0033eebc,0033eef0,0033ed5c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10034,msg=WM_CREATE,wp=00000000,lp=0033f00c) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10034,msg=WM_CREATE,wp=00000000,lp=0033f00c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(00010034) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10034,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10034,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10034,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10034,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.DdeNameService() retval=00000001 ret=7dfa112c | |
| 0020:Call user32.DdeNameService(00000001,0000c000,00000000,00000001) ret=7dfa1158 | |
| 0020:Call winex11.drv.WindowPosChanging(00010036,00000000,00000014,0033eebc,0033eebc,0033ed5c,0033ed58) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033e1d8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e054) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e2f4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea98) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e914) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebb4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010036,00000000,00000014,0033eebc,0033eebc,0033ed5c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10036,msg=WM_NCCREATE,wp=00000000,lp=0033f00c) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10036,msg=WM_NCCREATE,wp=00000000,lp=0033f00c) retval=00000001 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10036,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eef0) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10036,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eef0) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(00010036,00000000,00000010,0033eebc,0033eef0,0033ed5c,0033ed58) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea98) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e914) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebb4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010036,00000000,00000010,0033eebc,0033eef0,0033ed5c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10036,msg=WM_CREATE,wp=00000000,lp=0033f00c) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10036,msg=WM_CREATE,wp=00000000,lp=0033f00c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(00010036) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10036,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10036,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10036,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10036,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.DdeNameService() retval=00000001 ret=7dfa1158 | |
| 0020:Call user32.DdeNameService(00000001,0000c002,00000000,00000001) ret=7dfa1184 | |
| 0020:Call winex11.drv.WindowPosChanging(00010038,00000000,00000014,0033eebc,0033eebc,0033ed5c,0033ed58) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033e1d8) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e054) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e2f4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea98) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e914) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebb4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010038,00000000,00000014,0033eebc,0033eebc,0033ed5c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10038,msg=WM_NCCREATE,wp=00000000,lp=0033f00c) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10038,msg=WM_NCCREATE,wp=00000000,lp=0033f00c) retval=00000001 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10038,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eef0) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10038,msg=WM_NCCALCSIZE,wp=00000000,lp=0033eef0) retval=00000000 | |
| 0020:Call winex11.drv.WindowPosChanging(00010038,00000000,00000010,0033eebc,0033eef0,0033ed5c,0033ed58) ret=7eac1b50 | |
| 0020:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea90420,0033ea98) ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033e914) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea906da | |
| 0020:Call winex11.drv.GetMonitorInfo(00000001,0033ebb4) ret=7ea9012b | |
| 0020:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea9012b | |
| 0020:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7eac1b50 | |
| 0020:Call winex11.drv.WindowPosChanged(00010038,00000000,00000010,0033eebc,0033eef0,0033ed5c,00000000,00000000) ret=7eac2145 | |
| 0020:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7eac2145 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10038,msg=WM_CREATE,wp=00000000,lp=0033f00c) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10038,msg=WM_CREATE,wp=00000000,lp=0033f00c) retval=00000000 | |
| 0020:Call winex11.drv.CreateWindow(00010038) ret=7eabd3df | |
| 0020:Ret winex11.drv.CreateWindow() retval=00000001 ret=7eabd3df | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10038,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10038,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Call window proc 0x7ea48370 (hwnd=0x10038,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0020:Ret window proc 0x7ea48370 (hwnd=0x10038,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.DdeNameService() retval=00000001 ret=7dfa1184 | |
| 0020:Ret shell32.188() retval=00000001 ret=7ec99330 | |
| 0020:Call user32.GetMessageW(0033f2a4,00000000,00000000,00000000) ret=7ec9940c | |
| 0020:Call winex11.drv.ClipCursor(00000000) ret=7ea84df8 | |
| 0020:Call winex11.drv.WindowMessage(00010020,80001004,00000000,00000000) ret=7ea84e39 | |
| 0020:Ret winex11.drv.WindowMessage() retval=00000000 ret=7ea84e39 | |
| 0020:Ret winex11.drv.ClipCursor() retval=00000001 ret=7ea84df8 | |
| 0020:Ret user32.GetMessageW() retval=00000001 ret=7ec9940c | |
| 0020:Call user32.DispatchMessageW(0033f2a4) ret=7ec993e8 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_USER+512,wp=0000c01d,lp=0000c01e) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_USER+512,wp=0000c01d,lp=0000c01e) retval=00000000 | |
| 0020:Ret user32.DispatchMessageW() retval=00000000 ret=7ec993e8 | |
| 0020:Call user32.GetMessageW(0033f2a4,00000000,00000000,00000000) ret=7ec9940c | |
| 0020:Ret user32.GetMessageW() retval=00000001 ret=7ec9940c | |
| 0020:Call user32.DispatchMessageW(0033f2a4) ret=7ec993e8 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_USER+512,wp=0000c020,lp=0000c021) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_USER+512,wp=0000c020,lp=0000c021) retval=00000000 | |
| 0020:Ret user32.DispatchMessageW() retval=00000000 ret=7ec993e8 | |
| 0020:Call user32.GetMessageW(0033f2a4,00000000,00000000,00000000) ret=7ec9940c | |
| 0020:Ret user32.GetMessageW() retval=00000001 ret=7ec9940c | |
| 0020:Call user32.DispatchMessageW(0033f2a4) ret=7ec993e8 | |
| 0020:Call window proc 0x7ea45700 (hwnd=0x10032,msg=WM_USER+512,wp=0000c022,lp=0000c023) | |
| 0020:Ret window proc 0x7ea45700 (hwnd=0x10032,msg=WM_USER+512,wp=0000c022,lp=0000c023) retval=00000000 | |
| 0020:Ret user32.DispatchMessageW() retval=00000000 ret=7ec993e8 | |
| 0020:Call user32.GetMessageW(0033f2a4,00000000,00000000,00000000) ret=7ec9940c | |
| 0020:Ret user32.GetMessageW() retval=00000001 ret=7ec9940c | |
| 0020:Call user32.DispatchMessageW(0033f2a4) ret=7ec993e8 | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_PAINT,wp=00000000,lp=00000000) | |
| 0020:Call user32.BeginPaint(00010020,0033eed0) ret=7ec9744e | |
| 0020:Call winex11.drv.GetDC(0002002a,00010020,00010020,0033ec0c,0033ec1c,0000009a) ret=7ea97ebd | |
| 0020:Ret winex11.drv.GetDC() retval=00000000 ret=7ea97ebd | |
| 0020:Call window proc 0x7ec97010 (hwnd=0x10020,msg=WM_ERASEBKGND,wp=0002002a,lp=00000000) | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_ERASEBKGND,wp=0002002a,lp=00000000) retval=00000001 | |
| 0020:Ret user32.BeginPaint() retval=0002002a ret=7ec9744e | |
| 0020:Call user32.EndPaint(00010020,0033eed0) ret=7ec97772 | |
| 0020:Ret user32.EndPaint() retval=00000001 ret=7ec97772 | |
| 0020:Ret window proc 0x7ec97010 (hwnd=0x10020,msg=WM_PAINT,wp=00000000,lp=00000000) retval=00000000 | |
| 0020:Ret user32.DispatchMessageW() retval=00000000 ret=7ec993e8 | |
| 0020:Call user32.GetMessageW(0033f2a4,00000000,00000000,00000000) ret=7ec9940c | |
| 0020:Call winex11.drv.MsgWaitForMultipleObjectsEx(00000001,0033f158,ffffffff,000004ff,00000000) ret=7eac7ef3 | |
| 0020:Ret winex11.drv.MsgWaitForMultipleObjectsEx() retval=00000000 ret=7eac7ef3 | |
| 0020:Call winex11.drv.MsgWaitForMultipleObjectsEx(00000001,0033f158,ffffffff,000004ff,00000000) ret=7eac7ef3 | |
| 000d:Call PE DLL (proc=0x7e0b5530,module=0x7e060000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Ret PE DLL (proc=0x7e0b5530,module=0x7e060000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000d:Call winex11.drv.wine_get_gdi_driver(0000002e) ret=7e7dadab | |
| 000d:Ret winex11.drv.wine_get_gdi_driver() retval=7e0d99c0 ret=7e7dadab | |
| 000d:Call winex11.drv.CreateDesktopWindow(00010020) ret=7e8f3c18 | |
| 000d:Ret winex11.drv.CreateDesktopWindow() retval=00000001 ret=7e8f3c18 | |
| 000d:Ret user32.RegisterClassW() retval=0000c024 ret=7eace679 | |
| 000d:Ret KERNEL32.InitOnceExecuteOnce() retval=00000001 ret=7ead25c0 | |
| 000d:Call user32.CreateWindowExW(00000000,7eb97600 L"OleMainThreadWndClass 0x######## ",00000000,00000000,00000000,00000000,00000000,00000000,fffffffd,00000000,7eab0000,00000000) ret=7ead262c | |
| 000d:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033f294,00000000) ret=7e94792b | |
| 000d:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e94792b | |
| 000d:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033ed54,00000000) ret=7e94792b | |
| 000d:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e94792b | |
| 000d:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e944730,0033f258) ret=7e92f6da | |
| 000d:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e92f6da | |
| 000d:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e944730,0033f258) ret=7e92f6da | |
| 000d:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e92f6da | |
| 000d:Call window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033f7ec) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000024,00000000,0033f7ec) ret=7ead0894 | |
| 000d:Ret user32.DefWindowProcW() retval=00000000 ret=7ead0894 | |
| 000d:Ret window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033f7ec) retval=00000000 | |
| 000d:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e92f420,0033f668) ret=7e92f6da | |
| 000d:Call winex11.drv.GetMonitorInfo(00000001,0033f4e4) ret=7e92f12b | |
| 000d:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7e92f12b | |
| 000d:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e92f6da | |
| 000d:Call winex11.drv.GetMonitorInfo(00000001,0033f814) ret=7e92f12b | |
| 000d:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7e92f12b | |
| 000d:Call winex11.drv.WindowPosChanging(0001003e,00000000,00000014,0033f8ec,0033f8ec,0033f78c,0033f788) ret=7e960b50 | |
| 000d:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7e960b50 | |
| 000d:Call winex11.drv.WindowPosChanged(0001003e,00000000,00000014,0033f8ec,0033f8ec,0033f78c,00000000,00000000) ret=7e961145 | |
| 000d:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7e961145 | |
| 000d:Call window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_NCCREATE,wp=00000000,lp=0033fa3c) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000081,00000000,0033fa3c) ret=7ead0894 | |
| 000d:Ret user32.DefWindowProcW() retval=00000001 ret=7ead0894 | |
| 000d:Ret window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_NCCREATE,wp=00000000,lp=0033fa3c) retval=00000001 | |
| 000d:Call window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f920) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000083,00000000,0033f920) ret=7ead0894 | |
| 000d:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033ef24,00000000) ret=7e94792b | |
| 000d:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e94792b | |
| 000d:Ret user32.DefWindowProcW() retval=00000000 ret=7ead0894 | |
| 000d:Ret window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f920) retval=00000000 | |
| 000d:Call winex11.drv.WindowPosChanging(0001003e,00000000,00000010,0033f8ec,0033f920,0033f78c,0033f788) ret=7e960b50 | |
| 000d:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7e960b50 | |
| 000d:Call winex11.drv.WindowPosChanged(0001003e,00000000,00000010,0033f8ec,0033f920,0033f78c,00000000,00000000) ret=7e961145 | |
| 000d:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7e961145 | |
| 000d:Call window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_CREATE,wp=00000000,lp=0033fa3c) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000001,00000000,0033fa3c) ret=7ead0894 | |
| 000d:Ret user32.DefWindowProcW() retval=00000000 ret=7ead0894 | |
| 000d:Ret window proc 0x7ead0820 (hwnd=0x1003e,msg=WM_CREATE,wp=00000000,lp=0033fa3c) retval=00000000 | |
| 000d:Call winex11.drv.CreateWindow(0001003e) ret=7e95c3df | |
| 000d:Ret winex11.drv.CreateWindow() retval=00000001 ret=7e95c3df | |
| 000d:Ret user32.CreateWindowExW() retval=0001003e ret=7ead262c | |
| 000d:Ret ole32.CoInitialize() retval=00000000 ret=7ecc0e6c | |
| 000d:Call KERNEL32.CreateSemaphoreA(00000000,00000001,00000001,7ecc4a22 "winemenubuilder_semaphore") ret=7ecc10cb | |
| 000d:Ret KERNEL32.CreateSemaphoreA() retval=0000006c ret=7ecc10cb | |
| 000d:Call user32.MsgWaitForMultipleObjects(00000001,0033fcb0,00000000,ffffffff,000004ff) ret=7ecc1103 | |
| 000d:Call winex11.drv.MsgWaitForMultipleObjectsEx(00000002,0033fa4c,ffffffff,000004ff,00000000) ret=7e966ef3 | |
| 000d:Ret winex11.drv.MsgWaitForMultipleObjectsEx() retval=00000000 ret=7e966ef3 | |
| 000d:Ret user32.MsgWaitForMultipleObjects() retval=00000000 ret=7ecc1103 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138a78 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138a78,00000020) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138a78 ret=7ecb963d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138aa0 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138aa0,00000029) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138aa0 ret=7ecb963d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138ad8 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138ad8,00000028) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138ad8 ret=7ecb963d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ecb94e8 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00133b08 ret=7ecb94e8 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138b08 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138b08,0000001e) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138b08 ret=7ecb963d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecc16dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00133b50 ret=7ecc16dc | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138b30 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138b30,00000026) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138b30 ret=7ecb963d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb9853 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138b60 ret=7ecb9853 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00133b68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001388a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001388d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001388e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138900 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139b68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139b90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139ba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139bc0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000027) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139be0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139c10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139c30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139c50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139c70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139ca0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139cb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139cd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139cf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139d20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139d38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139d50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139d70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139d98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139db0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139dc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139de8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139e10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139e28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139e40 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139e60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139e90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139ea8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139ec0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139ee0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139f10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139f28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139f40 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139f60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139f78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139f90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139fa8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139fc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00139ff8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a010 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a028 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a048 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a078 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a090 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a0a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a0c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a0f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a110 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a128 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a148 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a178 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a1a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a1c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a1f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a210 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a228 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a248 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a270 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a288 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a2a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a2c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a2e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a300 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a318 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a368 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a380 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a3a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a3c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a3e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a3f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a418 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a458 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a470 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a490 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a4b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a4d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a4e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a538 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a568 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a5a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a5c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a5d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a5f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a628 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a640 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a658 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a678 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a6a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a6c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a6d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a6f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a728 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a758 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a778 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a7a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a7b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a7d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a7f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a850 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a8a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a8b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a8d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a8f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a918 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a930 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a948 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a968 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a998 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a9b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00138b60) ret=7ecb988d | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecb988d | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ecb97f6 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecb97f6 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00138b30) ret=7ecb9825 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecb9825 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138b30 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138b30,0000001d) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138b30 ret=7ecb963d | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00138b30) ret=7ecb9825 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecb9825 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb95d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138b30 ret=7ecb95d1 | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00138b30,00000017) ret=7ecb963d | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00138b30 ret=7ecb963d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ecb9853 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00138b50 ret=7ecb9853 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a9c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013a9e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aa08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aa20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aa38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aa58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aa78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aa90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aaa8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aac8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aae8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ab00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ab18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ab38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ab58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ab70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ab88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013abc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013abe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013abf8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ac18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ac38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ac50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ac68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ac88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aca8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013acc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013acd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013acf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ad18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ad30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ad48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ad68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ad80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ad98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013adb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013add0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ade8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ae00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ae18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ae38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ae58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ae70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ae88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aea8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aec8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aee0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013aef8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013af18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013af30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013af48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013af60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013af80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013af98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013afb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013afc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013afe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b000 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b018 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b030 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b070 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b0a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b0c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b0d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b0f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b108 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b140 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b170 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b1c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b1e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b1f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b218 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b240 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b258 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b270 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b290 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b2c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b2e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b2f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b318 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b330 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b360 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b380 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b3a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b3c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b3d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b3f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b430 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b448 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b460 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b480 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b4b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b4d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b4e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b558 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b570 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b590 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b5c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b5e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b5f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b618 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b660 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b680 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b6b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b6d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b6e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b708 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b720 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b738 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b750 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b770 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b7a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b7c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b7e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b800 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b818 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b830 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b850 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b8a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b8b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b8d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b910 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b928 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b940 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b980 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b998 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b9b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b9d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013b9f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ba08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ba20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ba40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ba68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ba80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ba98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bab8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013baf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bb08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bb20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bb40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bb78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bb90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bba8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bbc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bc00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bc20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bc40 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bc60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bc98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bcb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bcc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bce8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bd20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bd38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bd50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bd70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bda0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bdb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bdd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bdf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013be20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013be38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013be50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013be70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013be90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bea8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bec0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bee0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bf00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bf18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bf30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bf50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bf70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bf88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bfa0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bfc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bfe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013bff8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c010 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c058 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c070 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c088 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c0a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c0c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c0e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c0f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c138 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c150 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c168 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c1a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c1c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c1d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c1f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c210 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c228 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c240 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c260 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c2b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c2c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c2e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c300 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c368 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c380 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c3a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c3c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c3d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c3f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c410 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c458 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c478 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c4b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c4c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c4e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c518 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c530 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c570 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c5a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c5c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c5e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c5f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c610 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000025) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c678 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c690 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c6b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c6c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c6e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c6f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c718 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c738 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c750 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c768 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c788 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c7b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c7c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c7e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c800 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c850 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c8a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c8b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c8d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c8f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c908 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c920 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c938 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c958 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c970 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c988 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c9a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c9c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c9d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013c9f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ca08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ca28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ca40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ca58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ca70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ca90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cac8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cae0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cb00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cb20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cb38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cb50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cb70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cb90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cbc0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cbe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cc08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cc20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cc38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cc58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cc70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cc88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cca0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ccc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cce0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ccf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cd10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cd30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cd48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cd60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cd78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cd98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cdb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cdc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cde0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ce98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ceb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ced0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cef0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cf08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cf20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cf40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cf60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cf78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cf90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cfb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cfc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cfe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013cff8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d018 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d048 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d060 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d080 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d098 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d0b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d0c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d0e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d100 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d130 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d150 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d170 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d1a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d1c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d1d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d1f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d208 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d228 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d258 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d270 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d288 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d2a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d2c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d2d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d2f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d330 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d360 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d380 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d3a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d3b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d3d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d3f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d418 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d430 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d448 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d468 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d488 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d4a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d4b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d4d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d518 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d530 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d570 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d5a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d5c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d5e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d600 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d618 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d650 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d668 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d680 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d6a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d6c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d6d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d6f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d710 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d730 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d748 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d760 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d780 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d798 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d7b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d7c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d7e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d850 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d898 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d8b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d8c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d8e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d900 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d918 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d930 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d950 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d968 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d980 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d998 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d9b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d9d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013d9f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013da08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013da28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013da48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013da60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013da78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013da98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dac8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dae0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013db00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013db58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013db70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013db88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dc98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dcb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dcd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dce8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dd00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dd20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dd38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dd50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dd68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dd88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dda0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ddb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ddd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ddf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013de08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013de20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013de38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013de58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013de70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013de88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dea0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dec0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ded8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013def8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013df18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013df38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013df50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013df68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013df80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dfa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dfc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dfe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013dff8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e018 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e048 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e060 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e080 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e0a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e0b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e0d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e0f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e130 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e148 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e168 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e180 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e198 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e1b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e1d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e1f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e208 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e220 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e240 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e258 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e270 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e288 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e2a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e2c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e2d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e2f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e330 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e360 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e380 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e3a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e3b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e3d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e3f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e410 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e440 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e460 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e480 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e4b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e4d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e4f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e520 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e560 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e578 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e590 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e5b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e5d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e5f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e608 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e628 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e678 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e698 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e6b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e6c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e6e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e700 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e720 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e738 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e750 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e770 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e788 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e7a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e7b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e7d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e7f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e808 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e820 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e840 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e878 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e890 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e8b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e8d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e8e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e900 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e920 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e940 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e958 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e970 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e9b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e9c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013e9e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ea00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ea20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ea38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ea50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ea70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eaa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eab8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ead0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eaf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eb08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eb20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eb38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eb58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eb78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eb90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eba8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ebc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ebe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ec00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ec18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ec38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ec50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ec68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ec80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eca0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ecb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ecd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ece8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ed08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ed30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ed48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ed60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ed80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eda0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013edb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013edd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013edf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ee08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ee20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ee38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ee58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ee78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ee90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eea8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eec8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eee8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ef00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ef18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ef38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ef50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ef68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ef80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013efa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013efc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013efd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013eff0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f010 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f038 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f068 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f0b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f0c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f0e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f100 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f130 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f148 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f168 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f1a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f1c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f1e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f1f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f210 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f228 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f248 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f280 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f298 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f2b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f2d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f2f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f308 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f328 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f360 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f378 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f398 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f3b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f3d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f3e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f408 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f458 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f478 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f490 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f4a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f4c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f4e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f518 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f530 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f568 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f580 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f598 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f5b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f5e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f5f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f610 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f678 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f698 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f6b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f6d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f6e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f708 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f730 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f748 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f760 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f780 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f7a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f7c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f7d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f7f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f850 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f8a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f8b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f8d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f8f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f910 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f928 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f990 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f9b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f9c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f9e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013f9f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fa18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fa40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fa58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fa70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fa90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fac8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fae0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fb00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fb20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fb38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fb50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fb70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fb98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fbb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fbc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fbe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fc00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fc18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fc30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fc50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fc70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fc88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fca0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fcc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fcd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fcf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fd08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fd28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fd40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fd58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fd70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fd90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fda8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fdc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fdd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fdf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fe18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fe30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fe48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fe68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fe80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fe98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013feb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fed0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fee8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ff00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ff18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ff38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ff58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ff70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ff88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ffa8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ffc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013ffe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0013fff8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140018 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140038 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140068 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001400b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001400c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001400e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140100 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140120 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140138 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140150 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140170 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001401a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001401c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001401e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140208 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140220 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140238 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140258 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140278 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140290 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001402a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001402c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001402e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001402f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140310 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140330 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140368 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140380 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001403a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001403c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001403d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001403f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140410 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140458 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140478 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001404b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001404c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001404e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140518 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140530 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140570 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001405a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001405c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001405e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001405f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140610 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140678 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140698 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001406b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001406c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001406e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140700 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140728 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140758 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140778 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001407a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001407c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001407e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140800 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140818 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140830 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140850 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140868 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140880 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140898 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001408b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001408d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001408f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140908 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140928 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140950 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140968 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140980 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001409a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001409c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001409d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001409f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140a10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140a38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140a50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140a68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140a88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ab8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ad0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ae8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140b08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140b28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140b40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140b58 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140b78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140bc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140bd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140bf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140c18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140c30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140c48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140c68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140c90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ca8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140cc0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ce0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140d00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140d18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140d30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140d50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140d70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140d88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140da0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140dc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140de8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140e00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140e18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140e38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140e58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140e70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140e88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ea8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ec8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ee0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140ef8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140f18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140f30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140f48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140f60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140f80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140f98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140fb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140fc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00140fe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141008 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141020 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141038 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141058 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141070 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001410a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001410c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001410d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001410f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141108 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141140 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141170 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001411a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001411c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001411d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001411f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141218 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141230 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141248 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141280 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141298 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001412b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001412d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001412f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141308 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141320 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141340 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141360 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141378 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141390 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001413b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001413d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001413f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141408 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141448 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141460 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141478 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001414b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001414c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001414e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141518 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141530 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141548 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141568 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141590 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001415a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001415c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001415e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001415f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141610 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141628 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141668 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141680 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141698 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001416b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001416d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001416e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141700 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141720 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141758 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141770 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001417a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001417c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001417d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001417f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141828 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141840 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001418a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001418b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001418d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001418f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141908 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141920 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141940 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141990 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001419b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001419d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001419e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141aa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ab8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ad0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ae8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141b08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141b20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141b38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141b50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141b70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141b88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ba0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141bb8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141bd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141bf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141c08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141c20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141c40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141c60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141c78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141c90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000036) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141cb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141cf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141d08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141d20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000036) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141d40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141d80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141d98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141db0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141dd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141df0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141e08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141e20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141e40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141e58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141e70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141e88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ea8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ec0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ed8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ef0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141f10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141f30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141f48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141f60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141f80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141fa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141fb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141fd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142010 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142028 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142040 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142060 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142078 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142090 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001420a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001420c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142100 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142130 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142150 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001421a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001421b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001421d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001421f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142208 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142220 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142240 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142260 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142278 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142290 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001422b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001422c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001422e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001422f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142318 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142368 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142388 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001423a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001423c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001423d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001423f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142410 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142440 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142460 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142480 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001424b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001424d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001424f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142520 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142560 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142578 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142590 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001425b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001425d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001425e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142600 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142650 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142668 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142688 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001426a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001426b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001426d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001426f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142708 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142720 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142738 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142758 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142778 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001427a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001427c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001427e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001427f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142810 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142830 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142848 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142878 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142898 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001428b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001428d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001428e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142908 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142928 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142940 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142958 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001429a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001429c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001429e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001429f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142a10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142a28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142a48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142a78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142a90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142aa8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142ac8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142af8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142b10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142b28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142b48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142b60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142b78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142b90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000025) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142bb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142be0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142bf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142c10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142c30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142c68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142c80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142ca0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142ce0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142cf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142d10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142d30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142d70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142d88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142da0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142dc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142dd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142df0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142e08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142e28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142e40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142e58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142e70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142e90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142eb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142ec8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142ee0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142f98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142fb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142fd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00142ff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143008 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143020 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000025) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143040 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143070 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001430a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001430c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001430d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001430f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143108 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143140 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143170 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001431b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001431d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001431e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143208 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143238 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143250 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143268 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143288 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001432a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001432b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001432d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001432f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143328 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143340 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143360 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001433b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001433c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001433e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143400 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143450 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143468 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143480 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001434a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001434d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001434e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143500 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143520 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143558 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143570 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143590 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001435b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001435d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001435e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143608 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143650 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143670 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001436a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001436b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001436d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000045) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001436f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143758 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143770 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000045) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001437e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001437f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143810 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143830 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143878 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143890 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001438b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001438e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001438f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143910 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143930 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143978 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143998 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001439b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001439c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001439e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143a00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143a28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143a40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143a58 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143a78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143a98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ac8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ae8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143b08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143b20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143b38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143b58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143b78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143b90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ba8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143bc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143be8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143c00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143c18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143c68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143c80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ca0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143cc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ce0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143cf8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143d18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143d38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143d50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143d68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143d88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143db0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143dc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143de0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143e98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143eb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ed0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ef8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143f10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143f28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143f48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143f68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143f80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143f98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143fb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143fd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00143ff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144008 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144028 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144040 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144058 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144070 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144090 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001440a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001440c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001440d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001440f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144110 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144140 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144160 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001441a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001441b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001441d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001441f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144208 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144220 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144240 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144260 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144278 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144290 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001442b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001442d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001442e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144300 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144320 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144368 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144388 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001443b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001443d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001443e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144408 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144458 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144478 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144490 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001444a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001444c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001444e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144520 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144538 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144558 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144570 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001445a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001445c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001445e0 ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7bca1cd0,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001445f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144610 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144658 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144670 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144688 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000034) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001446a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001446e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144700 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144718 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144738 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144750 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144768 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144780 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001447a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001447c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001447e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001447f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144818 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144840 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144858 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144870 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144890 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001448b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001448c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001448e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144900 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144920 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144938 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144950 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144970 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001449a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001449c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001449e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001449f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144a10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144a28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144a48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144a60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144a78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144a90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ad0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ae8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144b00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144b20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144b50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144b68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144b80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ba0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144bd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144be8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144c00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144c20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144c68 ret=7ecb98f7 | |
| 0009:Ret PE DLL (proc=0x7b88ecb0,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7ebec670,module=0x7ebe0000 L"psapi.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144c88 ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7ebe0000) ret=7ebec798 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ebec798 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ca8 ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7ebec670,module=0x7ebe0000 L"psapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7ec54860,module=0x7ec10000 L"dbghelp.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144cc0 ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7ec10000) ret=7ec54988 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ec54988 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144cd8 ret=7ecb98f7 | |
| 0009:Ret PE DLL (proc=0x7ec54860,module=0x7ec10000 L"dbghelp.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e65bf40,module=0x7e610000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144cf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144d18 ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7e65bf40,module=0x7e610000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e720270,module=0x7e690000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144d30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144d48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144d68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144d88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144da0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144db8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144dd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144df8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144e10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144e28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144e48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144e68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144e80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144e98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144eb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ed0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144ee8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144fb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144fc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144fe0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145000 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145048 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145060 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145080 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145098 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001450b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001450c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001450e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145108 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145120 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145138 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145178 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001451a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001451c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001451e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145218 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145238 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145260 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145278 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145290 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001452b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001452c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001452e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001452f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145318 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145368 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145388 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001453b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001453c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001453e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145400 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145418 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145430 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145448 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145468 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145480 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001454b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001454d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001454e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145518 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145538 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7e720270,module=0x7e690000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145568 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e602540,module=0x7e5f0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7e5f0000) ret=7e602668 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145580 ret=7ecb98f7 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e602668 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7e602540,module=0x7e5f0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001455a0 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e867e30,module=0x7e7c0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001455b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001455d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001455e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145608 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145650 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000035) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145670 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001456b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001456c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001456e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000035) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145700 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145758 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145770 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001457a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001457c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001457d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001457f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145828 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145840 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145878 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145890 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001458a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001458c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001458e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001458f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145910 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000039) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145930 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001459a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000039) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001459c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145a10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145a28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145a40 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145a60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145a88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145aa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ab8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ad8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145b18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145b30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145b48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145b68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145bc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145bd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145bf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145c68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145c88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145cc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ce0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145cf8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145d18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145d38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145d50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145d68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145d88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145da8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145dc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145dd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145df8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145e18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145e30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145e48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145e68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145e88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ea0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145eb8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ed8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145f00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145f18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145f30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145f50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145f70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145f88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145fa0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145fc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145fe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00145ff8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146010 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146068 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146080 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001460a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001460b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001460d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001460e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146108 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146140 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146158 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146178 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146198 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001461b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001461c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001461e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146218 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146230 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146250 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146280 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146298 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001462b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001462e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001462f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146310 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146330 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146358 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146370 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146388 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001463a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001463d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001463e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146400 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146420 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146448 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146460 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146478 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001464b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001464d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001464e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146528 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146558 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146578 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001465a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001465b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001465d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001465f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146608 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146638 ret=7ecb98f7 | |
| 0009:Ret PE DLL (proc=0x7e867e30,module=0x7e7c0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e970e30,module=0x7e930000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146658 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146680 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146698 ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7e930000) ret=7e960fb2 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e960fb2 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001466b0 ret=7ecb98f7 | |
| 0009:Call KERNEL32.TlsAlloc() ret=7e960fc0 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 0009:Ret KERNEL32.TlsAlloc() retval=00000001 ret=7e960fc0 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001466d0 ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7e970e30,module=0x7e930000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7ea3c250,module=0x7e9b0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001466f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7e9b0000) ret=7e9e76e8 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146710 ret=7ecb9534 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e9e76e8 | |
| 0009:Call KERNEL32.GetModuleFileNameW(7e9b0000,7ebda880,00000104) ret=7e9e7706 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7e9e7706 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146728 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7ea3c250,module=0x7e9b0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146748 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e4793b0,module=0x7e430000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7e4793b0,module=0x7e430000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146778 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e599840,module=0x7e4c0000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret PE DLL (proc=0x7e599840,module=0x7e4c0000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001467a8 ret=7ecb98f7 | |
| 0009:Call PE DLL (proc=0x7ec94f60,module=0x7ec80000 L"mscoree.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001467c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.HeapCreate(00040000,00000000,00000000) ret=7ec8b51f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001467e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001467f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146810 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146830 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146850 ret=7ecb9534 | |
| 0009:Ret KERNEL32.HeapCreate() retval=00470000 ret=7ec8b51f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146868 ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7ec80000) ret=7ec9276c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ec9276c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146880 ret=7ecb98f7 | |
| 0009:Ret PE DLL (proc=0x7ec94f60,module=0x7ec80000 L"mscoree.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001468a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001468c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001468e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001468f8 ret=7ecb98f7 | |
| 0009:Starting process L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe" (entryproc=0x45a57e) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146918 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146930 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146960 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146980 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146998 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001469b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001469c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001469e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146a00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146a18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146a30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146a50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146a70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146a88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146aa0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ac0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ae0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146af8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146b10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146b30 ret=7ecb9534 | |
| 0009:Call mscoree._CorExeMain() ret=7b864d6c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.GetCommandLineW() ret=7ec8ae1d | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146b48 ret=7ecb9534 | |
| 0009:Ret KERNEL32.GetCommandLineW() retval=00115560 ret=7ec8ae1d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146b60 ret=7ecb9534 | |
| 0009:Call shell32.CommandLineToArgvW(00115560 L"\"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe\"",0032fbd0) ret=7ec8ae2f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call KERNEL32.LocalAlloc(00000000,000000aa) ret=7e9e4be7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146b78 ret=7ecb98f7 | |
| 0009:Ret KERNEL32.LocalAlloc() retval=0012f8b0 ret=7e9e4be7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 0009:Ret shell32.CommandLineToArgvW() retval=0012f8b0 ret=7ec8ae2f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146b98 ret=7ecb9534 | |
| 0009:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,0012f8b8 L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe",ffffffff,00000000,00000000,00000000,00000000) ret=7ec8ae9f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000004f ret=7ec8ae9f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146bc0 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000057) ret=7ec8aedf | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012f968 ret=7ec8aedf | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146bd8 ret=7ecb9534 | |
| 0009:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,0012f8b8 L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe",ffffffff,0012f970,00000057,00000000,00000000) ret=7ec8af60 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000004f ret=7ec8af60 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146bf0 ret=7ecb98f7 | |
| 0009:Call ntdll.RtlFreeHeap(00110000,00000000,0012f8b0) ret=7ec8afa4 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec8afa4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146c10 ret=7ecb9534 | |
| 0009:Call KERNEL32.GetModuleFileNameW(00000000,0032fbe4,00000104) ret=7ec8afcc | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.GetModuleFileNameW() retval=0000004e ret=7ec8afcc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146c40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,0032fbe4 L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe",ffffffff,00000000,00000000,00000000,00000000) ret=7ec9233c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146c58 ret=7ecb9534 | |
| 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000004f ret=7ec9233c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004f) ret=7ec9235f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146c70 ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012f8b0 ret=7ec9235f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146c90 ret=7ecb9534 | |
| 0009:Call KERNEL32.WideCharToMultiByte(0000fde9,00000000,0032fbe4 L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe",ffffffff,0012f8b0,0000004f,00000000,00000000) ret=7ec923a4 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000004f ret=7ec923a4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ca8 ret=7ecb9534 | |
| 0009:Call KERNEL32.GetModuleHandleW(00000000) ret=7ec8b09e | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.GetModuleHandleW() retval=00400000 ret=7ec8b09e | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146cc0 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000020) ret=7ec855b3 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012f908 ret=7ec855b3 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146cd8 ret=7ecb98f7 | |
| 0009:Call ntdll.RtlImageNtHeader(00400000) ret=7ec85182 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlImageNtHeader() retval=00400080 ret=7ec85182 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146cf8 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec8520e | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012f930 ret=7ec8520e | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146d28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146d40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call ntdll.RtlFreeHeap(00110000,00000000,0012f930) ret=7ec85305 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146d58 ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec85305 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec85329 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146d78 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec85329 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call ntdll.RtlFreeHeap(00110000,00000000,0012f908) ret=7ec8534a | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146d90 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec8534a | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146da8 ret=7ecb9534 | |
| 0009:Call ole32.CoInitializeEx(00000000,00000002) ret=7ec865cf | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146dc0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,000000fc) ret=7e4d9d80 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146de0 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012f9c8 ret=7e4d9d80 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146e08 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7e504118 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012f908 ret=7e504118 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146e20 ret=7ecb9534 | |
| 0009:Call KERNEL32.InitializeCriticalSection(0012f918) ret=7e504148 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7e504148 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146e38 ret=7ecb98f7 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7e4d6b75 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0012fad0 ret=7e4d6b75 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146e58 ret=7ecb9534 | |
| 0009:Call KERNEL32.InitializeCriticalSection(0012faf4) ret=7e4d6bd7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7e4d6bd7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146e78 ret=7ecb9534 | |
| 0009:Call KERNEL32.InitOnceExecuteOnce(7e5eb080,7e4d5620,00000000,00000000) ret=7e4d95c0 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call user32.RegisterClassW(0032f494) ret=7e4d5679 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146e90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ea8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ec8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ee8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146f00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146f18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146f38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146f58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146f70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146f88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146fa8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146fc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146fd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00146ff0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147010 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147048 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147060 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147080 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147098 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001470b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001470c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001470e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147110 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147140 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147160 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147178 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001471a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001471c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001471e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147218 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147238 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147250 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147280 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001472a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001472b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001472d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001472e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147308 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147320 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147350 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147370 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147388 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001473a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001473b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001473d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001473f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147408 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147420 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147460 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147478 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147490 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001474b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001474e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001474f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147510 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147530 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147568 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147580 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001475a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001475c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001475d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001475f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147610 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147660 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147680 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001476a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001476b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001476d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001476f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147718 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147730 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147748 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147768 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001477a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001477c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001477e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147808 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147838 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147858 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001478a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001478c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001478e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001478f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147910 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147930 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147978 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147998 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001479b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001479c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001479e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147a00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147a20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147a38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147a50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147a70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147a98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ac8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ae8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147b18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147b30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147b48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147b68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147b80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147b98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147bb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147bd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147be8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147c00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147c18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147c60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147c78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147c90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147cb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147cd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147cf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147d08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147d28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147d48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147d60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147d78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147d98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147db8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147dd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147de8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147e08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147e28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147e40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147e58 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147e78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ea0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147eb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ed0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ef0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147f08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147f20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147f38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147f58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147f70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147f88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147fa0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147fc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147fe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00147ff8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148010 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148058 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148070 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148088 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001480a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001480c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001480d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001480f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148110 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148130 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148148 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148160 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148180 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001481a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001481b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001481d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001481f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148218 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148230 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148248 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148288 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001482a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001482b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001482d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001482f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148308 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148320 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148340 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148360 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148378 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148390 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001483b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001483d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001483f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148408 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148448 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148460 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148478 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001484b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001484d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001484e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148530 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148548 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148560 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148580 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001485a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001485c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001485d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001485f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148618 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148630 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148648 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148668 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001486a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001486c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001486d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001486f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148738 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148750 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148768 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148788 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001487a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001487c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001487d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001487f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148850 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148868 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001488a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001488c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001488d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001488f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148920 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148938 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148950 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148970 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001489a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001489c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000034) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001489e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148a20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148a38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148a50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148a70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148a90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148aa8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148ac0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000035) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148ae0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148b20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148b38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148b50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000035) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148b70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148bb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148bc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148be0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148c00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148c68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148c88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148cc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148cd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148cf0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148d10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148d40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148d58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148d70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148d90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148db0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148dc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148de0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148e98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148eb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148ed0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148ef0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148f08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148f20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148f40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148f60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148f78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148f90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148fb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148fc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148fe0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00148ff8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000039) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149018 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149060 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149078 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149090 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000039) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001490b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001490f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149110 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7e135530,module=0x7e0e0000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149128 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149148 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149168 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149180 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149198 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001491b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001491e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001491f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149210 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149230 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149270 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149288 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001492a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001492c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149300 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149318 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149330 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149390 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001493a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001493c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001493e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149420 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149438 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149450 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149470 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001494c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001494d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001494f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149510 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149560 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149578 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149590 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001495b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001495d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001495e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149600 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149640 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149658 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149670 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149690 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001496b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001496c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001496e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149700 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149728 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149758 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149778 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149798 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001497b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001497c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001497e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149828 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149840 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149878 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149890 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001498a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001498c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001498e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149900 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149918 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149938 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149950 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149968 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149980 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001499a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001499b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001499d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001499e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149a08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149a28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149a40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149a58 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149a78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149a90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149aa8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149ac0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149ae0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149af8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149b10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149b28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149b48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149b60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149b78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149b90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149bb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149bc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149be0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149bf8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149c18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149c30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149c48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149c60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149c80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149ca8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149cc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149cd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149cf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149da0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149db8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149dd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149df0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149e08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149e20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149e40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149e60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149e78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149e90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149eb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149ee0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149ef8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149fb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149fd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149fe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a000 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a020 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a068 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a080 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a0a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a0c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a0e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a0f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a138 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a150 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a168 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a1a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a1c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a1d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a1f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a210 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a228 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a240 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a260 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a280 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a298 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a2b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a2d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a2f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a308 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a320 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a340 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a360 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a378 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a390 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a3b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a3c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a3e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a3f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a418 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a430 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a448 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a460 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a480 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a498 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a4b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a4c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a4e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a510 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a528 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a540 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a560 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a5a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a5b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a5d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a5f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a610 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a628 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a678 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a690 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a6b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a6c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a6e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a6f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a718 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a748 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a760 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a778 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a798 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a7c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a7d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a7f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a850 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a868 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a8a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a8c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a8d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a8f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a910 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a928 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a940 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a9a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a9c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014a9f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aa08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aa20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aa40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aa60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aa78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aa90 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aad8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aaf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ab08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ab28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ab48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ab60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ab78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ab98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014abb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014abc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014abe0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ac00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ac20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ac38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ac50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ac70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ac98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014acb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014acc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ace8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ad08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ad20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ad38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ad58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ad70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ad88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ada0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014adc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014add8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014adf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ae08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ae28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ae48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ae60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ae78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ae98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aec0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aed8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aef0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014af10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014af30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014af48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014af60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014af80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014afa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014afb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014afd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b008 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b020 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b038 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b058 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b098 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b108 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b120 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b138 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b178 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b1a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b1c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b1e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b218 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b238 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b250 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b280 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b308 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b368 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b388 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b3a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b3c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b3d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b3f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b418 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b430 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b448 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b468 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b488 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b518 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b530 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b570 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b5a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b5c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b5e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b600 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b618 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b668 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b680 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b698 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b708 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b728 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b758 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b770 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b7b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b7c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b7e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b800 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b850 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b890 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b900 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b918 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b930 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b950 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b970 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b988 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014baa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bac8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bae0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014baf8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bbc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bbd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bbf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bcb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bcd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bce8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bda0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bdb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bdd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bde8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bea0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014beb8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bed8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bfb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bfd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c008 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c020 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c040 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c060 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c078 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c090 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c0b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c0d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c0e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c100 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c120 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c140 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c170 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c210 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c228 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c240 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c260 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c278 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c290 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c2a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c2c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c2f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c328 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c368 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c380 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c398 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c3b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c3e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c3f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c410 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c430 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c450 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c468 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c480 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c508 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c528 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c548 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c560 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c578 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c598 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c608 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c650 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c668 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c688 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c710 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c728 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c740 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c760 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c7a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c7c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c7e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c828 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c840 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c910 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c928 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c9a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c9c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c9e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014caa8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cad0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cae8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cbb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cbd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cbe8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cca0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ccb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ccd0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ccf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cda0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cdc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cdd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cdf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cea8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cec0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ced8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cef8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cfa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cfb8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cfd8 ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7e135530,module=0x7e0e0000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d008 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d020 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d040 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d068 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d080 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d098 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d0b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d0d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d0f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d108 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d148 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d160 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d178 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d198 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d218 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d230 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d248 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d280 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d298 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d2b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d2d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d2f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d328 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d368 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d380 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d398 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d3b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d3d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call winex11.drv.wine_get_gdi_driver(0000002e) ret=7e6d5dab | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d3f0 ret=7ecb9534 | |
| 0009:Ret winex11.drv.wine_get_gdi_driver() retval=7e1599c0 ret=7e6d5dab | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d408 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d428 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d440 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d458 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d470 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d490 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000027) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d528 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d558 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d578 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d590 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d610 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d628 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d678 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d690 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d6b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d6d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d6e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d700 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d720 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d740 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d758 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d770 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d828 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d840 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d880 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d898 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d900 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d918 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d938 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d950 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d968 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d980 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014daa8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dac0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dad8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014daf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db50 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dcb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dcd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dce8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dda8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ddc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ddd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ddf0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de58 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014deb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dec8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dee8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dfb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dfd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dfe8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e000 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e020 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e038 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e068 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0d8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e110 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e128 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e140 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e160 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e180 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e198 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e218 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e238 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e250 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e280 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e2a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e2c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e2d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e2f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e328 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e340 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e358 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e378 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e390 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e410 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e428 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e448 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e470 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e488 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4a0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e500 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e518 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e538 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e568 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e580 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e5a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e5b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e5d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e5e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e608 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e638 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e650 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e670 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e690 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e700 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e718 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e730 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e750 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e778 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e808 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e820 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e840 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e878 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e890 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e918 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e930 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e960 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e980 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9d0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000034) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eaa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eab8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ead0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eaf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb40 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ebb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ebd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ebf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eca0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ecc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ece0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ecf8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014edc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014edd8 ret=7ecb9534 | |
| 0009:Call winex11.drv.CreateDesktopWindow(00010020) ret=7e7eec18 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014edf0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret winex11.drv.CreateDesktopWindow() retval=00000001 ret=7e7eec18 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee68 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 0009:Ret user32.RegisterClassW() retval=0000c024 ret=7e4d5679 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee88 ret=7ecb9534 | |
| 0009:Ret KERNEL32.InitOnceExecuteOnce() retval=00000001 ret=7e4d95c0 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eea0 ret=7ecb9534 | |
| 0009:Call user32.CreateWindowExW(00000000,7e59e600 L"OleMainThreadWndClass 0x######## ",00000000,00000000,00000000,00000000,00000000,00000000,fffffffd,00000000,7e4c0000,00000000) ret=7e4d962c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eeb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eed0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000043) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eef0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef70 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef90 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014efa8 ret=7ecb9534 | |
| 0009:Call winex11.drv.SystemParametersInfo(00000029,00000000,0032ed64,00000000) ret=7e84292b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e84292b | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014efc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014efd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eff8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f018 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f030 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f048 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f068 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f108 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f120 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f138 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f208 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f220 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f238 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f258 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f288 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f310 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f328 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f348 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f378 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f390 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f3a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f3c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f400 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f418 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f430 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f450 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f488 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4f0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f508 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f520 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f540 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f560 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f578 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f590 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f5b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f5d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f5e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f600 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f620 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f640 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f658 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f670 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f690 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f708 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f720 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f738 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f750 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f770 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f790 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7c0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f810 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f828 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f848 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f868 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f880 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f898 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f8b8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f8d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f8e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f900 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f920 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f940 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f958 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f970 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f9b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f9c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f9e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa58 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa78 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fab0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fac8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fae8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fba0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fbb8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fbd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc08 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc38 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fca0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fcc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fcd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fcf0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd08 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd28 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd60 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd78 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fdb0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fdc8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fde0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe50 ret=7ecb98f7 | |
| 0009:Call winex11.drv.SystemParametersInfo(00000029,00000000,0032e824,00000000) ret=7e84292b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 0009:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e84292b | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fea0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014feb8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fed0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fef0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 0009:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e83f730,0032ed28) ret=7e82a6da | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff10 ret=7ecb9534 | |
| 0009:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e82a6da | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 0009:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e83f730,0032ed28) ret=7e82a6da | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff28 ret=7ecb9534 | |
| 0009:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e82a6da | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff40 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff60 ret=7ecb9534 | |
| 0009:Call window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_GETMINMAXINFO,wp=00000000,lp=0032f2bc) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 0009:Call user32.DefWindowProcW(00010044,00000024,00000000,0032f2bc) ret=7e4d7894 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff88 ret=7ecb9534 | |
| 0009:Ret user32.DefWindowProcW() retval=00000000 ret=7e4d7894 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 0009:Ret window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_GETMINMAXINFO,wp=00000000,lp=0032f2bc) retval=00000000 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ffa0 ret=7ecb9534 | |
| 0009:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e82a420,0032f138) ret=7e82a6da | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call winex11.drv.GetMonitorInfo(00000001,0032efb4) ret=7e82a12b | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ffb8 ret=7ecb98f7 | |
| 0009:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7e82a12b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 0009:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e82a6da | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ffd8 ret=7ecb9534 | |
| 0009:Call winex11.drv.GetMonitorInfo(00000001,0032f2e4) ret=7e82a12b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7e82a12b | |
| 0009:Call winex11.drv.WindowPosChanging(00010044,00000000,00000014,0032f3bc,0032f3bc,0032f25c,0032f258) ret=7e85bb50 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fff0 ret=7ecb9534 | |
| 0009:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7e85bb50 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150008 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150020 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150040 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150058 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150070 ret=7ecb9534 | |
| 0009:Call winex11.drv.WindowPosChanged(00010044,00000000,00000014,0032f3bc,0032f3bc,0032f25c,00000000,00000000) ret=7e85c145 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7e85c145 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150088 ret=7ecb98f7 | |
| 0009:Call window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_NCCREATE,wp=00000000,lp=0032f50c) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 0009:Call user32.DefWindowProcW(00010044,00000081,00000000,0032f50c) ret=7e4d7894 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500a8 ret=7ecb9534 | |
| 0009:Ret user32.DefWindowProcW() retval=00000001 ret=7e4d7894 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_NCCREATE,wp=00000000,lp=0032f50c) retval=00000001 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500c8 ret=7ecb9534 | |
| 0009:Call window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_NCCALCSIZE,wp=00000000,lp=0032f3f0) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call user32.DefWindowProcW(00010044,00000083,00000000,0032f3f0) ret=7e4d7894 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500e0 ret=7ecb9534 | |
| 0009:Call winex11.drv.SystemParametersInfo(00000029,00000000,0032e9f4,00000000) ret=7e84292b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e84292b | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret user32.DefWindowProcW() retval=00000000 ret=7e4d7894 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150138 ret=7ecb9534 | |
| 0009:Ret window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_NCCALCSIZE,wp=00000000,lp=0032f3f0) retval=00000000 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150150 ret=7ecb9534 | |
| 0009:Call winex11.drv.WindowPosChanging(00010044,00000000,00000010,0032f3bc,0032f3f0,0032f25c,0032f258) ret=7e85bb50 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7e85bb50 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150168 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150188 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501c0 ret=7ecb9534 | |
| 0009:Call winex11.drv.WindowPosChanged(00010044,00000000,00000010,0032f3bc,0032f3f0,0032f25c,00000000,00000000) ret=7e85c145 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7e85c145 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501d8 ret=7ecb98f7 | |
| 0009:Call window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_CREATE,wp=00000000,lp=0032f50c) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 0009:Call user32.DefWindowProcW(00010044,00000001,00000000,0032f50c) ret=7e4d7894 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501f8 ret=7ecb9534 | |
| 0009:Ret user32.DefWindowProcW() retval=00000000 ret=7e4d7894 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret window proc 0x7e4d7820 (hwnd=0x10044,msg=WM_CREATE,wp=00000000,lp=0032f50c) retval=00000000 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150218 ret=7ecb9534 | |
| 0009:Call winex11.drv.CreateWindow(00010044) ret=7e8573df | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret winex11.drv.CreateWindow() retval=00000001 ret=7e8573df | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150230 ret=7ecb9534 | |
| 0009:Ret user32.CreateWindowExW() retval=00010044 ret=7e4d962c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret ole32.CoInitializeEx() retval=00000000 ret=7ec865cf | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150248 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 0009:Call shlwapi.SHCreateStreamOnFileW(0032f974 L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe.config",00000020,0032f6c0) ret=7ec865ed | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150268 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150280 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call KERNEL32.CreateFileW(0032f974 L"Z:\\home\\mikhail\\Downloads\\Virtual Infrastructure Client\\Launcher\\VpxClient.exe.config",80000000,00000001,00000000,00000003,00000000,00000000) ret=7e9416e4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150298 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150300 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150318 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150338 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.CreateFileW() retval=0000004c ret=7e9416e4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150368 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7e941715 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=001332a0 ret=7e941715 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150380 ret=7ecb98f7 | |
| 0009:Call KERNEL32.LocalAlloc(00000000,000000ac) ret=7e964054 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 0009:Ret KERNEL32.LocalAlloc() retval=00138210 ret=7e964054 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503a0 ret=7ecb9534 | |
| 0009:Ret shlwapi.SHCreateStreamOnFileW() retval=00000000 ret=7ec865ed | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000054) ret=7ec86627 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503b8 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=00138040 ret=7ec86627 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call ole32.CoCreateInstance(7ec9925c,00000000,00000001,7ec9949c,0032f6c4) ret=7ec8668c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call ntdll.RtlInitUnicodeString(0032f3ac,7e59e660 L"Machine\\Software\\Classes") ret=7e4d54dd | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503e8 ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlInitUnicodeString() retval=00000032 ret=7e4d54dd | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 0009:Call ntdll.NtCreateKey(0032f3a8,02000000,0032f3b4,00000000,00000000,00000000,00000000) ret=7e4d5281 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150408 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150420 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret ntdll.NtCreateKey() retval=00000000 ret=7e4d5281 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150438 ret=7ecb9534 | |
| 0009:Call ntdll.RtlInitUnicodeString(0032f40c,0032f482 L"CLSID\\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}") ret=7e4d80db | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlInitUnicodeString() retval=0000005a ret=7e4d80db | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150450 ret=7ecb98f7 | |
| 0009:Call ntdll.NtOpenKey(0032f47c,00020019,0032f414) ret=7e4d80f5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150470 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150490 ret=7ecb9534 | |
| 0009:Ret ntdll.NtOpenKey() retval=00000000 ret=7e4d80f5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call ntdll.RtlNtStatusToDosError(00000000) ret=7e4d8101 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504a8 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7e4d8101 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call ntdll.RtlInitUnicodeString(0032f40c,7e59de6e L"TreatAs") ret=7e4d80db | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504c0 ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7e4d80db | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 0009:Call ntdll.NtOpenKey(0032f534,00020019,0032f414) ret=7e4d80f5 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504f8 ret=7ecb9534 | |
| 0009:Ret ntdll.NtOpenKey() retval=c0000034 ret=7e4d80f5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7e4d8101 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150510 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7e4d8101 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegCloseKey(00000054) ret=7e4dab46 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150528 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150548 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e4dab46 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150568 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call KERNEL32.FindActCtxSectionGuid(00000001,00000000,00000004,0032f60c,0032f54c) ret=7e4dbc64 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150580 ret=7ecb9534 | |
| 0009:Ret KERNEL32.FindActCtxSectionGuid() retval=00000000 ret=7e4dbc64 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150598 ret=7ecb98f7 | |
| 0009:Call ntdll.RtlInitUnicodeString(0032f3ec,0032f462 L"CLSID\\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}") ret=7e4d80db | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlInitUnicodeString() retval=0000005a ret=7e4d80db | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001505b8 ret=7ecb9534 | |
| 0009:Call ntdll.NtOpenKey(0032f45c,00020019,0032f3f4) ret=7e4d80f5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret ntdll.NtOpenKey() retval=00000000 ret=7e4d80f5 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001505d8 ret=7ecb9534 | |
| 0009:Call ntdll.RtlNtStatusToDosError(00000000) ret=7e4d8101 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7e4d8101 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001505f0 ret=7ecb9534 | |
| 0009:Call ntdll.RtlInitUnicodeString(0032f3ec,7e59e100 L"InprocServer32") ret=7e4d80db | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlInitUnicodeString() retval=0000001e ret=7e4d80db | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150608 ret=7ecb98f7 | |
| 0009:Call ntdll.NtOpenKey(0032f54c,00020019,0032f3f4) ret=7e4d80f5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150628 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150648 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150660 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150678 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150698 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001506b8 ret=7ecb9534 | |
| 0009:Ret ntdll.NtOpenKey() retval=00000000 ret=7e4d80f5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call ntdll.RtlNtStatusToDosError(00000000) ret=7e4d8101 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001506d0 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7e4d8101 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegCloseKey(00000054) ret=7e4dab46 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001506e8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150708 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e4dab46 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150730 ret=7ecb9534 | |
| 0009:Call advapi32.RegQueryValueExW(00000058,7e59e0a8 L"ThreadingModel",00000000,0032f2ac,0032f2b2,0032f2a8) ret=7e4d91e0 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150748 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150760 ret=7ecb98f7 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e4d91e0 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150780 ret=7ecb9534 | |
| 0009:Call advapi32.RegQueryValueExW(00000058,00000000,00000000,0032efec,0032eff4,0032eff0) ret=7e4d67d8 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001507b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001507c8 ret=7ecb9534 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e4d67d8 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7e4d5909 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001507e0 ret=7ecb98f7 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=001380a0 ret=7e4d5909 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 0009:Call KERNEL32.LoadLibraryExW(0032f2b2 L"C:\\windows\\system32\\msxml3.dll",00000000,00000008) ret=7e4d5a15 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150800 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150838 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150850 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150870 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508f8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150910 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150928 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150948 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150960 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150990 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150aa0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ab8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ad0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150af0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150bb0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150bd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150be8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c18 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c80 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ca0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150cc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150cd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150cf0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d60 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d98 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150db0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150dc8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150de8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e18 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e48 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ea0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150eb8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ed8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ef8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f10 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f28 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f48 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f70 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150fa0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150fc0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150fd8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ff0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151008 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151028 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151068 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151080 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151140 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151170 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151200 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151228 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151240 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151258 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151278 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151298 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151318 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151330 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151348 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151368 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151380 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151398 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001513b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001513d0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001513e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151400 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151418 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151438 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151458 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151470 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151488 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514a8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514c0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514f0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151510 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151538 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151550 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151568 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151588 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001515b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001515c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001515e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151600 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151628 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151640 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151658 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151678 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151698 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516c8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151718 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151730 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151748 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151768 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151788 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151800 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151820 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151840 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151860 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151888 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518a0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518b8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518d8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151900 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151918 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151930 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151950 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7dae3a20,module=0x7da10000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151978 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.GetEnvironmentVariableW(7dae73b0 L"oanocache",00000000,00000000) ret=7da26731 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151990 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.GetEnvironmentVariableW() retval=00000000 ret=7da26731 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001519a8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7da10000) ret=7da8e9c8 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001519c8 ret=7ecb9534 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7da8e9c8 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7dae3a20,module=0x7da10000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001519f0 ret=7ecb9534 | |
| 0009:Call PE DLL (proc=0x7d96c5e0,module=0x7d960000 L"mpr.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7d960000) ret=7d965bfc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a08 ret=7ecb9534 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7d965bfc | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegOpenKeyExW(80000002,7d96da80 L"System\\CurrentControlSet\\Control\\NetworkProvider\\Order",00000000,00020019,0032ecec) ret=7d968f90 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a20 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a40 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7d968f90 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a80 ret=7ecb9534 | |
| 0009:Ret PE DLL (proc=0x7d96c5e0,module=0x7d960000 L"mpr.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call PE DLL (proc=0x7d9d02c0,module=0x7d980000 L"wininet.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ab8 ret=7ecb9534 | |
| 0009:Call KERNEL32.TlsAlloc() ret=7d9b59ba | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.TlsAlloc() retval=00000003 ret=7d9b59ba | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ae0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151af8 ret=7ecb9534 | |
| 0009:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7d9cf16a | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b10 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b30 ret=7ecb9534 | |
| 0009:Ret KERNEL32.CreateEventW() retval=00000054 ret=7d9cf16a | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call KERNEL32.CreateSemaphoreW(00000000,00000001,00000001,00000000) ret=7d9cf19c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b58 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b70 ret=7ecb9534 | |
| 0009:Ret KERNEL32.CreateSemaphoreW() retval=0000005c ret=7d9cf19c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call shell32.SHGetSpecialFolderPathW(00000000,0032e6f4,00000020,00000001) ret=7d9c6d1b | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b88 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ba8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151bd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call advapi32.RegCreateKeyW(80000001,7ea49c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0032d9f0) ret=7e9fe920 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151be8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c20 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9fe920 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 0009:Call advapi32.RegCreateKeyW(80000001,7ea49b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0032d9ec) ret=7e9fea14 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c50 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9fea14 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c68 ret=7ecb98f7 | |
| 0009:Call advapi32.RegQueryValueExW(00000064,7ea4a8ee L"Cache",00000000,0032d9e4,0032e384,0032d9e8) ret=7e9fea63 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c88 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ca8 ret=7ecb9534 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9fea63 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151cc0 ret=7ecb9534 | |
| 0009:Call advapi32.RegCreateKeyExW(80000002,7ea49d40 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0032d36c,0032d370) ret=7e9fe33b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151cd8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151cf8 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e9fe33b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 0009:Call KERNEL32.GetSystemDirectoryW(0032d784,00000104) ret=7e9fe735 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d18 ret=7ecb9534 | |
| 0009:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e9fe735 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 0009:Call advapi32.RegQueryValueExW(00000068,7ea49d00 L"ProfilesDirectory",00000000,0032d2e4,0032d57c,0032d2e8) ret=7e9fdb8c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d30 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d48 ret=7ecb98f7 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9fdb8c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ecb9534 | |
| 0009:Call advapi32.GetUserNameW(0032d784,0032d370) ret=7e9fe48e | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d68 ret=7ecb9534 | |
| 0009:Ret advapi32.GetUserNameW() retval=00000001 ret=7e9fe48e | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call shlwapi.PathAppendW(0032de04 L"C:\\users",0032d784 L"mikhail") ret=7e9fe4a4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d80 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d98 ret=7ecb9534 | |
| 0009:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9fe4a4 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call shlwapi.PathAppendW(0032de04 L"C:\\users\\mikhail",0032d38e L"\\Local Settings\\Temporary Internet Files") ret=7e9fe4d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151db0 ret=7ecb98f7 | |
| 0009:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9fe4d1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ecb9534 | |
| 0009:Call advapi32.RegCloseKey(00000068) ret=7e9fe1fe | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151dd0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e00 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9fe1fe | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e18 ret=7ecb9534 | |
| 0009:Call advapi32.RegSetValueExW(00000060,7ea4a8ee L"Cache",00000000,00000001,0032e384,00000072) ret=7e9feb8c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e30 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e50 ret=7ecb9534 | |
| 0009:Ret advapi32.RegSetValueExW() retval=00000000 ret=7e9feb8c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 0009:Call advapi32.RegCloseKey(00000060) ret=7e9fea8d | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e68 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e80 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9fea8d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegCloseKey(00000064) ret=7e9fea9f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e98 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151eb8 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9fea9f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call shlwapi.PathFileExistsW(0032e17c L"C:\\users\\mikhail\\Local Settings\\Temporary Internet Files") ret=7ea02faa | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ed0 ret=7ecb9534 | |
| 0009:Call KERNEL32.SetErrorMode(00000001) ret=7e9515ad | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e9515ad | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ee8 ret=7ecb9534 | |
| 0009:Call KERNEL32.GetFileAttributesW(0032e17c L"C:\\users\\mikhail\\Local Settings\\Temporary Internet Files") ret=7e9515bb | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f00 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f20 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f38 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f50 ret=7ecb9534 | |
| 0009:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e9515bb | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call KERNEL32.SetErrorMode(00000000) ret=7e9515c9 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f68 ret=7ecb98f7 | |
| 0009:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e9515c9 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ecb9534 | |
| 0009:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7ea02faa | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f88 ret=7ecb9534 | |
| 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ea02ba7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ea02ba7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151fa8 ret=7ecb9534 | |
| 0009:Ret shell32.SHGetSpecialFolderPathW() retval=00000001 ret=7d9c6d1b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151fc0 ret=7ecb9534 | |
| 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000400,0032e6f4 L"C:\\users\\mikhail\\Local Settings\\Temporary Internet Files\\Content.IE5\\",00000038,00000000,00000000,00000000,0032e6f0) ret=7d9c6ef8 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000038 ret=7d9c6ef8 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151fd8 ret=7ecb98f7 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7d9c6f45 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000037) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=00138580 ret=7d9c6f45 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,0000008c) ret=7d9c6fd5 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ff8 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0013b060 ret=7d9c6fd5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7d9c7042 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152038 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0013b0f8 ret=7d9c7042 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call user32.CharLowerW(0032e8fc L"C:\\users\\mikhail\\Local Settings\\Temporary Internet Files\\") ret=7d9c708f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152050 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret user32.CharLowerW() retval=0032e8fc ret=7d9c708f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152068 ret=7ecb98f7 | |
| 0009:Call KERNEL32.CreateMutexW(00000000,00000000,0032e8fc L"c:!users!mikhail!local settings!temporary internet files!") ret=7d9c70e7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000037) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152088 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001520c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret KERNEL32.CreateMutexW() retval=00000060 ret=7d9c70e7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001520e0 ret=7ecb9534 | |
| 0009:Call shell32.SHGetSpecialFolderPathW(00000000,0032e6f4,00000022,00000001) ret=7d9c6d1b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegCreateKeyW(80000001,7ea49c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0032d9f0) ret=7e9fe920 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001520f8 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152118 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 0009:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9fe920 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152140 ret=7ecb9534 | |
| 0009:Call advapi32.RegCreateKeyW(80000001,7ea49b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0032d9ec) ret=7e9fea14 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152158 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152170 ret=7ecb98f7 | |
| 0009:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9fea14 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ecb9534 | |
| 0009:Call advapi32.RegQueryValueExW(00000068,7ea4a5e8 L"History",00000000,0032d9e4,0032e384,0032d9e8) ret=7e9fea63 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152190 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521b0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9fea63 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521c8 ret=7ecb9534 | |
| 0009:Call advapi32.RegCreateKeyExW(80000002,7ea49d40 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0032d36c,0032d370) ret=7e9fe33b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521e0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152200 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e9fe33b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call KERNEL32.GetSystemDirectoryW(0032d784,00000104) ret=7e9fe735 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152218 ret=7ecb9534 | |
| 0009:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e9fe735 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Call advapi32.RegQueryValueExW(0000006c,7ea49d00 L"ProfilesDirectory",00000000,0032d2e4,0032d57c,0032d2e8) ret=7e9fdb8c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152230 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152248 ret=7ecb98f7 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9fdb8c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 0009:Call advapi32.GetUserNameW(0032d784,0032d370) ret=7e9fe48e | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152268 ret=7ecb9534 | |
| 0009:Ret advapi32.GetUserNameW() retval=00000001 ret=7e9fe48e | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 0009:Call shlwapi.PathAppendW(0032de04 L"C:\\users",0032d784 L"mikhail") ret=7e9fe4a4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152280 ret=7ecb9534 | |
| 0009:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9fe4a4 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ecb9534 | |
| 0009:Call shlwapi.PathAppendW(0032de04 L"C:\\users\\mikhail",0032d38e L"\\Local Settings\\History") ret=7e9fe4d1 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152298 ret=7ecb9534 | |
| 0009:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9fe4d1 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegCloseKey(0000006c) ret=7e9fe1fe | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001522b0 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001522d0 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9fe1fe | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call advapi32.RegSetValueExW(00000064,7ea4a5e8 L"History",00000000,00000001,0032e384,00000050) ret=7e9feb8c | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001522e8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152300 ret=7ecb9534 | |
| 0009:Ret advapi32.RegSetValueExW() retval=00000000 ret=7e9feb8c | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call advapi32.RegCloseKey(00000064) ret=7e9fea8d | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152318 ret=7ecb98f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152338 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9fea8d | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call advapi32.RegCloseKey(00000068) ret=7e9fea9f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152350 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152368 ret=7ecb9534 | |
| 0009:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9fea9f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Call shlwapi.PathFileExistsW(0032e17c L"C:\\users\\mikhail\\Local Settings\\History") ret=7ea02faa | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152380 ret=7ecb98f7 | |
| 0009:Call KERNEL32.SetErrorMode(00000001) ret=7e9515ad | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ecb9534 | |
| 0009:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e9515ad | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523a0 ret=7ecb9534 | |
| 0009:Call KERNEL32.GetFileAttributesW(0032e17c L"C:\\users\\mikhail\\Local Settings\\History") ret=7e9515bb | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523c8 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523e0 ret=7ecb9534 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e9515bb | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523f8 ret=7ecb98f7 | |
| 0009:Call KERNEL32.SetErrorMode(00000000) ret=7e9515c9 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ecb9534 | |
| 0009:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e9515c9 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152418 ret=7ecb9534 | |
| 0009:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7ea02faa | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ea02ba7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152430 ret=7ecb9534 | |
| 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ea02ba7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ecb9534 | |
| 0009:Ret shell32.SHGetSpecialFolderPathW() retval=00000001 ret=7d9c6d1b | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152448 ret=7ecb9534 | |
| 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000400,0032e6f4 L"C:\\users\\mikhail\\Local Settings\\History\\History.IE5\\",00000027,00000000,00000000,00000000,0032e6f0) ret=7d9c6ef8 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000027 ret=7d9c6ef8 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152460 ret=7ecb98f7 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7d9c6f45 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0013b110 ret=7d9c6f45 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152480 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,0000006a) ret=7d9c6fd5 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0013b138 ret=7d9c6fd5 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524a0 ret=7ecb9534 | |
| 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7d9c7042 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ecb9534 | |
| 0009:Ret ntdll.RtlAllocateHeap() retval=0013b1b0 ret=7d9c7042 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524b8 ret=7ecb9534 | |
| 0009:Call user32.CharLowerW(0032e8fc L"C:\\users\\mikhail\\Local Settings\\History\\") ret=7d9c708f | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ecb98f7 | |
| 0009:Ret user32.CharLowerW() retval=0032e8fc ret=7d9c708f | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524d0 ret=7ecb98f7 | |
| 0009:Call KERNEL32.CreateMutexW(00000000,00000000,0032e8fc L"c:!users!mikhail!local settings!history!") ret=7d9c70e7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ecb9534 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524f0 ret=7ecb9534 | |
| 0009:Ret KERNEL32.CreateMutexW() retval=00000064 ret=7d9c70e7 | |
| 0009:Call shell32.SHGetSpecialFolderPathW(00000000,0032e6f4,00000021,00000001) ret=7d9c6d1b | |
| 0009:Call advapi32.RegCreateKeyW(80000001,7ea49c40 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0032d9f0) ret=7e9fe920 | |
| 0009:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9fe920 | |
| 0009:Call advapi32.RegCreateKeyW(80000001,7ea49b80 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0032d9ec) ret=7e9fea14 | |
| 0009:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9fea14 | |
| 0009:Call advapi32.RegQueryValueExW(0000006c,7ea4a650 L"Cookies",00000000,0032d9e4,0032e384,0032d9e8) ret=7e9fea63 | |
| 0009:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9fea63 | |
| 0009 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment