-
-
Save alfonsojon/cb441bbd055b9ca53056 to your computer and use it in GitHub Desktop.
WINEDEBUG=+relay wine RobloxPlayerBeta.exe
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0009:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 000b:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| 000b:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7ebecec0,module=0x7ebb0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7ebecec0,module=0x7ebb0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000b:Starting process L"C:\\windows\\system32\\wineboot.exe" (entryproc=0x7ec23b20) | |
| 000b:Call KERNEL32.GetWindowsDirectoryW(7ec34c00,00000104) ret=7ec1edbc | |
| 000b:Ret KERNEL32.GetWindowsDirectoryW() retval=0000000a ret=7ec1edbc | |
| 000b:Call KERNEL32.SetCurrentDirectoryW(7ec34c00 L"C:\\windows") ret=7ec1edc7 | |
| 000b:Ret KERNEL32.SetCurrentDirectoryW() retval=00000001 ret=7ec1edc7 | |
| 000b:Call KERNEL32.IsWow64Process(ffffffff,0033eebc) ret=7ec1edf1 | |
| 000b:Ret KERNEL32.IsWow64Process() retval=00000001 ret=7ec1edf1 | |
| 000b:Call KERNEL32.CreateEventW(0033eed0,00000001,00000000,7ec253a0 L"__wineboot_event") ret=7ec1f0f6 | |
| 000b:Ret KERNEL32.CreateEventW() retval=00000014 ret=7ec1f0f6 | |
| 000b:Call KERNEL32.ResetEvent(00000014) ret=7ec1f107 | |
| 000b:Ret KERNEL32.ResetEvent() retval=00000001 ret=7ec1f107 | |
| 000b:Call ntdll.NtQuerySystemInformation(00000001,0033f0e4,0000000c,00000000) ret=7ec1f141 | |
| 000b:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=7ec1f141 | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000060) ret=7ec1f161 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=001154c8 ret=7ec1f161 | |
| 000b:Call ntdll.NtPowerInformation(0000000b,00000000,00000000,001154c8,00000060) ret=7ec1f19c | |
| 000b:Ret ntdll.NtPowerInformation() retval=00000000 ret=7ec1f19c | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec25260 L"Hardware\\Description\\System",00000000,00000000,00000001,000f003f,00000000,0033eec8,00000000) ret=7ec1f239 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f239 | |
| 000b:Call advapi32.RegSetValueExW(00000020,7ec2524a L"Identifier",00000000,00000001,7ec251ee,0000001c) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCreateKeyExW(00000020,7ec251c0 L"FloatingPointProcessor",00000000,00000000,00000001,000f003f,00000000,0033eedc,00000000) ret=7ec1f2c8 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f2c8 | |
| 000b:Call advapi32.RegCreateKeyExW(00000020,7ec25180 L"CentralProcessor",00000000,00000000,00000001,000f003f,00000000,0033eecc,00000000) ret=7ec1f32b | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f32b | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,0033f2ec L"0",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f454 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f454 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25148 L"FeatureSet",00000000,00000004,0033f0ec,00000004) ret=7ec1f499 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f499 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25120 L"ProcessorNameString",00000000,00000001,7ec250c0,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25080 L"VendorIdentifier",00000000,00000001,7ec25050,0000001a) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25046 L"~MHz",00000000,00000004,001154cc,00000004) ret=7ec1f524 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f524 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f535 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f535 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,0033f2ec L"0",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f3cb | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f3cb | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f5ce | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f5ce | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,0033f2ec L"1",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f454 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f454 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25148 L"FeatureSet",00000000,00000004,0033f0ec,00000004) ret=7ec1f499 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f499 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25120 L"ProcessorNameString",00000000,00000001,7ec250c0,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25080 L"VendorIdentifier",00000000,00000001,7ec25050,0000001a) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25046 L"~MHz",00000000,00000004,001154e4,00000004) ret=7ec1f524 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f524 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f535 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f535 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,0033f2ec L"1",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f3cb | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f3cb | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f5ce | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f5ce | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,0033f2ec L"2",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f454 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f454 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25148 L"FeatureSet",00000000,00000004,0033f0ec,00000004) ret=7ec1f499 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f499 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25120 L"ProcessorNameString",00000000,00000001,7ec250c0,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25080 L"VendorIdentifier",00000000,00000001,7ec25050,0000001a) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25046 L"~MHz",00000000,00000004,001154fc,00000004) ret=7ec1f524 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f524 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f535 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f535 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,0033f2ec L"2",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f3cb | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f3cb | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f5ce | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f5ce | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,0033f2ec L"3",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f454 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f454 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25148 L"FeatureSet",00000000,00000004,0033f0ec,00000004) ret=7ec1f499 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f499 | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25120 L"ProcessorNameString",00000000,00000001,7ec250c0,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25080 L"VendorIdentifier",00000000,00000001,7ec25050,0000001a) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec25046 L"~MHz",00000000,00000004,00115514,00000004) ret=7ec1f524 | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec1f524 | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f535 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f535 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,0033f2ec L"3",00000000,00000000,00000001,000f003f,00000000,0033eec4,00000000) ret=7ec1f3cb | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f3cb | |
| 000b:Call advapi32.RegSetValueExW(0000002c,7ec2524a L"Identifier",00000000,00000001,0033f4f4,00000044) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCloseKey(0000002c) ret=7ec1f5ce | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f5ce | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec1f5e2 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f5e2 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec1f5f1 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f5f1 | |
| 000b:Call advapi32.RegCloseKey(00000020) ret=7ec1f600 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f600 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,001154c8) ret=7ec1f624 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f624 | |
| 000b:Call advapi32.RegCreateKeyExW(80000006,7ec25020 L"PerfStats\\StatData",00000000,00000000,00000000,00020006,00000000,0033f4f4,00000000) ret=7ec1f677 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f677 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec2010e | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec2010e | |
| 000b:Call advapi32.RegCreateKeyExW(80000006,7ec24fe0 L"Config Manager\\Enum",00000000,00000000,00000000,00020006,00000000,0033f4f4,00000000) ret=7ec1f6d2 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1f6d2 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec1f6e7 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f6e7 | |
| 000b:Call ntdll.NtQuerySystemInformation(00000001,0033f2ec,0000000c,00000000) ret=7ec1f70e | |
| 000b:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=7ec1f70e | |
| 000b:Call advapi32.RegCreateKeyW(80000002,7ec24f60 L"System\\CurrentControlSet\\Control\\Session Manager\\Environment",0033f0e4) ret=7ec1f731 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7ec1f731 | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec24f20 L"NUMBER_OF_PROCESSORS",00000000,00000001,0033f4f4,00000004) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec24ec0 L"PROCESSOR_ARCHITECTURE",00000000,00000001,7ec24eee,00000008) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec24dc0 L"PROCESSOR_IDENTIFIER",00000000,00000001,0033f4f4,00000060) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec24da0 L"PROCESSOR_LEVEL",00000000,00000001,0033f4f4,00000004) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000024,7ec24d60 L"PROCESSOR_REVISION",00000000,00000001,0033f4f4,0000000a) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec2033b | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec2033b | |
| 000b:Call KERNEL32.GetPrivateProfileSectionW(7ec24d50 L"rename",0033f4f4,00000400,7ec24d38 L"wininit.ini") ret=7ec1f7df | |
| 000b:Ret KERNEL32.GetPrivateProfileSectionW() retval=00000000 ret=7ec1f7df | |
| 000b:Call advapi32.RegOpenKeyExW(80000002,7ec24ca0 L"System\\CurrentControlSet\\Control\\Session Manager",00000000,000f003f,0033f4f4) ret=7ec1f83d | |
| 000b:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec1f83d | |
| 000b:Call advapi32.RegQueryValueExW(00000024,7ec24c60 L"PendingFileRenameOperations",00000000,00000000,00000000,0033f2ec) ret=7ec2014e | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec2014e | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec2018a | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec2018a | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec201a3 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec201a3 | |
| 000b:Call advapi32.RegOpenKeyW(80000002,7ec24be0 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",0033eec4) ret=7ec1f875 | |
| 000b:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ec1f875 | |
| 000b:Call advapi32.RegCloseKey(00000000) ret=7ec1f88e | |
| 000b:Ret advapi32.RegCloseKey() retval=00000006 ret=7ec1f88e | |
| 000b:Call KERNEL32.GetSystemDirectoryW(00000000,00000000) ret=7ec1f8a3 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000014 ret=7ec1f8a3 | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ec1f8c8 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00116840 ret=7ec1f8c8 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(00116840,00000014) ret=7ec1f8df | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ec1f8df | |
| 000b:Call KERNEL32.FindFirstFileW(00116840 L"C:\\windows\\system32\\dllcache\\*",0033f4f4) ret=7ec1f92a | |
| 000b:Ret KERNEL32.FindFirstFileW() retval=ffffffff ret=7ec1f92a | |
| 000b:Call KERNEL32.FindClose(ffffffff) ret=7ec1fc25 | |
| 000b:Ret KERNEL32.FindClose() retval=00000000 ret=7ec1fc25 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00116840) ret=7ec1fc49 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1fc49 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec24880 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0033edb4,00000000) ret=7ec232a5 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec232a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,7ec25380 L"RunServicesOnce",00000000,00000000,00000000,000f003f,00000000,0033edb8,0033edbc) ret=7ec2330c | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec2330c | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec23325 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec23325 | |
| 000b:Call advapi32.RegQueryInfoKeyW(00000028,00000000,00000000,00000000,00000000,00000000,00000000,0033edc0,0033edc8,0033edc4,00000000,00000000) ret=7ec2339c | |
| 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ec2339c | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec233fc | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec233fc | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23422 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23422 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec23437 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec23437 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec24880 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0033edb4,00000000) ret=7ec232a5 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec232a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000024,7ec2535c L"RunServices",00000000,00000000,00000000,00020019,00000000,0033edb8,0033edbc) ret=7ec2330c | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec2330c | |
| 000b:Call advapi32.RegCloseKey(00000024) ret=7ec23325 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec23325 | |
| 000b:Call advapi32.RegQueryInfoKeyW(00000028,00000000,00000000,00000000,00000000,00000000,00000000,0033edc0,0033edc8,0033edc4,00000000,00000000) ret=7ec2339c | |
| 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ec2339c | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000005c) ret=7ec2357a | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00116840 ret=7ec2357a | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec235b4 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=001168a8 ret=7ec235b4 | |
| 000b:Call advapi32.RegEnumValueW(00000028,00000000,001168a8,0033edcc,00000000,0033edd4,00116840,0033edd0) ret=7ec2363a | |
| 000b:Ret advapi32.RegEnumValueW() retval=00000000 ret=7ec2363a | |
| 000b:Call KERNEL32.CreateProcessW(00000000,00116840 L"C:\\windows\\system32\\winemenubuilder.exe -a -r",00000000,00000000,00000000,00000000,00000000,00000000,0033edec,0033eddc) ret=7ec237c3 | |
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 000d:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| 000b:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ec237c3 | |
| 000b:Call KERNEL32.CloseHandle(00000034) ret=7ec2386d | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec2386d | |
| 000b:Call KERNEL32.CloseHandle(00000030) ret=7ec23879 | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec23879 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,001168a8) ret=7ec233fc | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec233fc | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00116840) ret=7ec23422 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23422 | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec23437 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec23437 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033f4f4,000000f7) ret=7ec1fcdd | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ec1fcdd | |
| 000b:Call KERNEL32.CreateProcessW(0033f4f4 L"C:\\windows\\system32\\services.exe",0033f4f4 L"C:\\windows\\system32\\services.exe",00000000,00000000,00000001,00000008,00000000,00000000,0033f2ec,0033f0e4) ret=7ec1fd87 | |
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 000f:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| 000b:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ec1fd87 | |
| 000b:Call KERNEL32.CloseHandle(00000030) ret=7ec21026 | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec21026 | |
| 000b:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7ec24b00 L"__wine_SvcctlStarted") ret=7ec2104d | |
| 000b:Ret KERNEL32.CreateEventW() retval=00000024 ret=7ec2104d | |
| 000b:Call KERNEL32.WaitForMultipleObjects(00000002,0033eedc,00000000,ffffffff) ret=7ec21082 | |
| 000d:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e9ecec0,module=0x7e9b0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7e9ecec0,module=0x7e9b0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e7ba6e0,module=0x7e730000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7eb68ec0,module=0x7eb20000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7eb68ec0,module=0x7eb20000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Call PE DLL (proc=0x7effb9b0,module=0x7eff0000 L"userenv.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000f:Call KERNEL32.DisableThreadLibraryCalls(7eff0000) ret=7eff9428 | |
| 000f:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7eff9428 | |
| 000f:Ret PE DLL (proc=0x7effb9b0,module=0x7eff0000 L"userenv.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000f:Starting process L"C:\\windows\\system32\\services.exe" (entryproc=0x7ec2d9c0) | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7ec2eb00 L"__wine_SvcctlStarted") ret=7ec1ee78 | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000018 ret=7ec1ee78 | |
| 000f:Call advapi32.RegOpenKeyW(80000002,7ec2eaa0 L"System\\CurrentControlSet\\Control",0033fd74) ret=7ec1eea3 | |
| 000f:Ret advapi32.RegOpenKeyW() retval=00000000 ret=7ec1eea3 | |
| 000f:Call advapi32.RegQueryValueExW(00000024,7ec2ea60 L"ServicesPipeTimeout",00000000,0033fd78,0033fd80,0033fd7c) ret=7ec1efd3 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec1efd3 | |
| 000f:Call advapi32.RegQueryValueExW(00000024,7ec2ea20 L"WaitToKillServiceTimeout",00000000,0033fd78,0033fd80,0033fd7c) ret=7ec1f023 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec1f023 | |
| 000f:Call advapi32.RegCloseKey(00000024) ret=7ec1f045 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec1f045 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ec1eecf | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001179f0 ret=7ec1eecf | |
| 000f:Call KERNEL32.InitializeCriticalSection(00117a00) ret=7ec1eefd | |
| 000f:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ec1eefd | |
| 000f:Call advapi32.RegCreateKeyExW(80000002,7ec2eda0 L"System\\CurrentControlSet\\Services",00000000,00000000,00000000,02000000,00000000,001179f0,00000000) ret=7ec1ef56 | |
| 000f:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1ef56 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000000,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117a48 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001156f0 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"BITS",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117ad8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00117ad8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117b38 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00117b38,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117b60 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00117b60,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117b88 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00117b88,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117bb0 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117bc8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00117a80,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00117a84,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00117a88,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00117a94,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00117aa4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000001,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117be0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117c70 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"Eventlog",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117c90 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117ca8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00117c18,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00117c1c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00117c20,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00117c2c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00117c3c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117c70) ret=7ec2399a | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec2399a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239bd | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239bd | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239e0 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239e0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a03 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a03 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a26 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a26 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a49 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a49 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a6c | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a6c | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117c90) ret=7ec23a8f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a8f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117ca8) ret=7ec23ab2 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23ab2 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ac0 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ac0 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ace | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ace | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec23adc | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23adc | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23aea | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23aea | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23af8 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23af8 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117be0) ret=7ec23b18 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23b18 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000002,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117be0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117c70 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"FontCache",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117c90 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00117c90,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117cf0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00117cf0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d18 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00117d18,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d58 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00117d58,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117d98 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117db0 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00117c18,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00117c1c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00117c20,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00117c2c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00117c3c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000003,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117dc8 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e58 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"FontCache3.0.0.0",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000008e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117e88 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00117e88,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117f20 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00117f20,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000068) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117f48 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00117f48,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000068) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00117fb8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00117fb8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118028 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118040 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00117e00,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00117e04,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00117e08,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00117e14,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00117e24,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000004,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118058 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001180e8 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"LanmanServer",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118110 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00118110,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118170 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118170,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118198 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118198,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001181c0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,001181c0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001181e8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118200 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118090,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00118094,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118098,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,001180a4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,001180b4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000005,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118218 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001182a8 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"MountMgr",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000054) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001182c8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,001182c8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118328 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118328,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118350 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118350,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118378 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00118378,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001183b8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001183d0 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118250,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00118254,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118258,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00118264,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00118274,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000006,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001183e8 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118478 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"MozillaMaintenance",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000008e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001184a8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,001184a8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118540 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118540,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118568 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118568,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000214) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001185b0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,001185b0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001187d0 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001187e8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118420,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00118424,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118428,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00118434,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00118444,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000007,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118800 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118890 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"MSIServer",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001188b0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,001188b0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118900 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118900,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118928 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118928,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118948 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00118948,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118980 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118998 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118838,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,0011883c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118840,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,0011884c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,0011885c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000008,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001189b0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118a40 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"PlugPlay",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118a60 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00118a60,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ab0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118ab0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ad8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118ad8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118b10 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00118b10,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118b70 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118b88 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,001189e8,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,001189ec,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,001189f0,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,001189fc,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00118a0c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000009,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ba0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118c30 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"Schedule",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118c50 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00118c50,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118cb0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118cb0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118cd8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118cd8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118d00 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00118d00,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118d28 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118d40 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118bd8,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00118bdc,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118be0,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00118bec,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00118bfc,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000a,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118d58 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118de8 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"Spooler",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e00 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00118e00,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e50 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00118e50,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118e78 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00118e78,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ea0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00118ea0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000054) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118ec8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00118ec8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f28 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f40 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118d90,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00118d94,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118d98,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00118da4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00118db4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000b,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118f58 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00118fe8 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"StiSvc",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000056) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119000 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00119000,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119060 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00119060,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119088 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00119088,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190b0 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,001190b0,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190d8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001190f0 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00118f90,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00118f94,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00118f98,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00118fa4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00118fb4,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000c,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119108 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119198 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"Tcpip",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001191b0 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001191c8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00119140,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00119144,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00119148,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00119154,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00119164,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119198) ret=7ec2399a | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec2399a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239bd | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239bd | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239e0 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239e0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a03 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a03 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a26 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a26 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a49 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a49 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a6c | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a6c | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001191b0) ret=7ec23a8f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a8f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001191c8) ret=7ec23ab2 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23ab2 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ac0 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ac0 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ace | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ace | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec23adc | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23adc | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23aea | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23aea | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23af8 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23af8 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119108) ret=7ec23b18 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23b18 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000d,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119108 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119198 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"TermService",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001191b8 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,001191b8,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119200 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00119200,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119228 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00119228,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ac0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002e) ret=7ec25baa | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119258 ret=7ec25baa | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00119258,0033faa8) ret=7ec25bd9 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25bd9 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119290 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192a8 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,00119140,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,00119144,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00119148,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,00119154,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,00119164,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000e,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192c0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119350 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"VxD",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119368 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119380 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,001192f8,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,001192fc,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00119300,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,0011930c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,0011931c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119350) ret=7ec2399a | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec2399a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239bd | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239bd | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239e0 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239e0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a03 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a03 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a26 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a26 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a49 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a49 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a6c | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a6c | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119368) ret=7ec23a8f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a8f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119380) ret=7ec23ab2 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23ab2 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ac0 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ac0 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ace | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ace | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec23adc | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23adc | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23aea | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23aea | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23af8 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23af8 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001192c0) ret=7ec23b18 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23b18 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,0000000f,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192c0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119350 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"Winsock",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119368 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119380 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,001192f8,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,001192fc,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00119300,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,0011930c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,0011931c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119350) ret=7ec2399a | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec2399a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239bd | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239bd | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239e0 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239e0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a03 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a03 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a26 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a26 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a49 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a49 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a6c | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a6c | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119368) ret=7ec23a8f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a8f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119380) ret=7ec23ab2 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23ab2 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ac0 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ac0 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ace | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ace | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec23adc | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23adc | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23aea | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23aea | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23af8 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23af8 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001192c0) ret=7ec23b18 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23b18 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000010,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000000 ret=7ec24138 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000084) ret=7ec238e8 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192c0 ret=7ec238e8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec259e6 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119350 ret=7ec259e6 | |
| 000f:Call advapi32.RegOpenKeyExW(00000024,0033fb08 L"Winsock2",00000000,00020019,0033fb04) ret=7ec241b1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7ec241b1 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed2c L"ImagePath",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed20 L"Group",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecc6 L"ObjectName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed70 L"DisplayName",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2eca6 L"Description",00000000,0033faac,00000000,0033faa8) ret=7ec25ac0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ac0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed00 L"DependOnService",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119370 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecdc L"DependOnGroup",00000000,0033faac,00000000,0033faa8) ret=7ec25d00 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25d00 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000002) ret=7ec25e61 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119388 ret=7ec25e61 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed66 L"Type",00000000,0033faac,001192f8,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed5a L"Start",00000000,0033faac,001192fc,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ed40 L"ErrorControl",00000000,0033faac,00119300,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ecbe L"Tag",00000000,0033faac,0011930c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegQueryValueExW(00000028,7ec2ec80 L"PreshutdownTimeout",00000000,0033faac,0011931c,0033faa8) ret=7ec25ec0 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec25ec0 | |
| 000f:Call advapi32.RegCloseKey(00000028) ret=7ec246e9 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec246e9 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119350) ret=7ec2399a | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec2399a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239bd | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239bd | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec239e0 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec239e0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a03 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a03 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a26 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a26 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a49 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a49 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23a6c | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a6c | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119370) ret=7ec23a8f | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23a8f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119388) ret=7ec23ab2 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23ab2 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ac0 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ac0 | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23ace | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23ace | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec23adc | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23adc | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23aea | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23aea | |
| 000f:Call KERNEL32.CloseHandle(00000000) ret=7ec23af8 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec23af8 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001192c0) ret=7ec23b18 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23b18 | |
| 000f:Call advapi32.RegEnumKeyW(00000024,00000011,0033fb08,00000104) ret=7ec24138 | |
| 000f:Ret advapi32.RegEnumKeyW() retval=00000103 ret=7ec24138 | |
| 000f:Call rpcrt4.RpcServerUseProtseqEpW(0033fcf4 L"ncacn_np",00000000,0033fd06 L"\\pipe\\svcctl",00000000) ret=7ec23255 | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fcf4 L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7ebc7ee3 | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ebc7ee3 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebc7f08 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192c0 ret=7ebc7f08 | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fcf4 L"ncacn_np",ffffffff,001192c0,00000009,00000000,00000000) ret=7ebc7f48 | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7ebc7f48 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ebd8978 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192d8 ret=7ebd8978 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ebd89a5 | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000028 ret=7ebd89a5 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebc7e43 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119320 ret=7ebc7e43 | |
| 000f:Call KERNEL32.InitializeCriticalSection(001192f0) ret=7ebd3601 | |
| 000f:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebd3601 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001192c0) ret=7ebc8756 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebc8756 | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fd06 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7ebc7ee3 | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ebc7ee3 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7f08 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001192c0 ret=7ebc7f08 | |
| 000f:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0033fd06 L"\\pipe\\svcctl",ffffffff,001192c0,0000000d,00000000,00000000) ret=7ebc7f48 | |
| 000f:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7ebc7f48 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ebd84e7 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119360 ret=7ebd84e7 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001193f0 ret=7ebc7e43 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ebe2160 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119408 ret=7ebe2160 | |
| 000f:Call KERNEL32.CreateNamedPipeA(00119408 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ebd9e2e | |
| 000f:Ret KERNEL32.CreateNamedPipeA() retval=0000002c ret=7ebd9e2e | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119408) ret=7ebe21a0 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001192c0) ret=7ebc8756 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebc8756 | |
| 000f:Ret rpcrt4.RpcServerUseProtseqEpW() retval=00000000 ret=7ec23255 | |
| 000f:Call rpcrt4.RpcServerRegisterIf(7ec33d20,00000000,00000000) ret=7ec232c8 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000008,0000003c) ret=7ebd5b99 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119408 ret=7ebd5b99 | |
| 000f:Ret rpcrt4.RpcServerRegisterIf() retval=00000000 ret=7ec232c8 | |
| 000f:Call rpcrt4.RpcServerListen(00000001,000004d2,00000001) ret=7ec23306 | |
| 000f:Call KERNEL32.CreateMutexW(00000000,00000000,00000000) ret=7ebd381c | |
| 000f:Ret KERNEL32.CreateMutexW() retval=00000030 ret=7ebd381c | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ebd37f4 | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000034 ret=7ebd37f4 | |
| 000f:Call KERNEL32.CreateThread(00000000,00000000,7ebd3200,001192d8,00000000,00000000) ret=7ebd3794 | |
| 000f:Ret KERNEL32.CreateThread() retval=00000038 ret=7ebd3794 | |
| 000f:Call KERNEL32.CloseHandle(00000038) ret=7ebd37af | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ebd37af | |
| 000f:Call KERNEL32.WaitForSingleObject(00000030,ffffffff) ret=7ebd33ac | |
| 0010:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0010:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ebd33ac | |
| 0010:Starting thread proc 0x7ebd3200 (arg=0x1192d8) | |
| 000f:Call KERNEL32.SetEvent(00000028) ret=7ebd8924 | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ebda080,00119360,00000000,00000000) ret=7ebd8783 | |
| 000f:Ret KERNEL32.SetEvent() retval=00000001 ret=7ebd8924 | |
| 000f:Call KERNEL32.WaitForSingleObject(00000034,ffffffff) ret=7ebd33ca | |
| 0010:Ret KERNEL32.CreateThread() retval=00000038 ret=7ebd8783 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebd88a6 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=001192c0 ret=7ebd88a6 | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,001192c0,00000000,ffffffff,00000001) ret=7ebdf35c | |
| 0011:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0011:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0011:Starting thread proc 0x7ebda080 (arg=0x119360) | |
| 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000000 ret=7ebdf35c | |
| 0011:Call KERNEL32.ConnectNamedPipe(0000002c,00000000) ret=7ebda0b3 | |
| 0010:Call ntdll.RtlReAllocateHeap(00110000,00000000,001192c0,00000008) ret=7ebd881a | |
| 0010:Ret ntdll.RtlReAllocateHeap() retval=001192c0 ret=7ebd881a | |
| 0010:Call KERNEL32.SetEvent(00000034) ret=7ebd3298 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ebd33ca | |
| 000f:Call KERNEL32.ReleaseMutex(00000030) ret=7ebd33d8 | |
| 0010:Ret KERNEL32.SetEvent() retval=00000001 ret=7ebd3298 | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,001192c0,00000000,ffffffff,00000001) ret=7ebdf35c | |
| 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ebd33d8 | |
| 000f:Ret rpcrt4.RpcServerListen() retval=00000000 ret=7ec23306 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7ec1f1b5 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119470 ret=7ec1f1b5 | |
| 000f:Call KERNEL32.WaitForSingleObject(00000000,00000000) ret=7ec25133 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=ffffffff ret=7ec25133 | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec2514c | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec2514c | |
| 000f:Call KERNEL32.CreateMutexW(00000000,00000001,00000000) ret=7ec2516b | |
| 000f:Ret KERNEL32.CreateMutexW() retval=00000040 ret=7ec2516b | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ec2580e | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000044 ret=7ec2580e | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7ec2583d | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000048 ret=7ec2583d | |
| 000f:Call advapi32.RegCreateKeyExW(80000002,7ec2ebe0 L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent",00000000,00000000,00000001,00000003,00000000,0033fcf0,00000000) ret=7ec251db | |
| 000f:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec251db | |
| 000f:Call advapi32.RegQueryValueExW(0000004c,00000000,00000000,0033fcfc,0033fcf4,0033fcec) ret=7ec2521c | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7ec2521c | |
| 000f:Call advapi32.RegSetValueExW(0000004c,00000000,00000000,00000004,0033fcf4,00000004) ret=7ec25367 | |
| 000f:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec25367 | |
| 000f:Call advapi32.RegCloseKey(0000004c) ret=7ec25375 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec25375 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004e) ret=7ec253a0 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7ec253a0 | |
| 000f:Call KERNEL32.CreateNamedPipeW(001194f8 L"\\\\.\\pipe\\net\\NtControlPipe0",40000003,00000000,00000001,00000100,00000100,00002710,00000000) ret=7ec2528b | |
| 000f:Ret KERNEL32.CreateNamedPipeW() retval=0000004c ret=7ec2528b | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7ec252ae | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec252ae | |
| 000f:Call advapi32.OpenProcessToken(ffffffff,0000000a,0033fa78) ret=7ec24f8e | |
| 000f:Ret advapi32.OpenProcessToken() retval=00000001 ret=7ec24f8e | |
| 000f:Call userenv.CreateEnvironmentBlock(7ec34ba4,00000050,00000000) ret=7ec24fff | |
| 000f:Call advapi32.RegOpenKeyExW(80000002,7effc3a0 L"System\\CurrentControlSet\\Control\\Session Manager\\Environment",00000000,00020019,0032f708) ret=7eff94f7 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eff94f7 | |
| 000f:Call ntdll.RtlCreateEnvironment(00000000,0032f700) ret=7eff952d | |
| 000f:Ret ntdll.RtlCreateEnvironment() retval=00000000 ret=7eff952d | |
| 000f:Call KERNEL32.GetEnvironmentVariableW(7effc37a L"SystemRoot",0032f9c2,00007fff) ret=7eff9564 | |
| 000f:Ret KERNEL32.GetEnvironmentVariableW() retval=0000000a ret=7eff9564 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f718,7effc37a L"SystemRoot") ret=7eff958d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff958d | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f720,0032f9c2 L"C:\\windows") ret=7eff95ae | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff95ae | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032f718,0032f720) ret=7eff95d3 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff95d3 | |
| 000f:Call KERNEL32.GetEnvironmentVariableW(7effc362 L"SystemDrive",0032f9c2,00007fff) ret=7eff95fc | |
| 000f:Ret KERNEL32.GetEnvironmentVariableW() retval=00000002 ret=7eff95fc | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f718,7effc362 L"SystemDrive") ret=7eff961f | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000018 ret=7eff961f | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f720,0032f9c2 L"c:") ret=7eff963a | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000006 ret=7eff963a | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032f718,0032f720) ret=7eff965f | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff965f | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000000,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"ComSpec") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"ComSpec",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"ComSpec",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\system32\\cmd.exe") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\system32\\cmd.exe") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000001,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"NUMBER_OF_PROCESSORS") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"NUMBER_OF_PROCESSORS",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"NUMBER_OF_PROCESSORS",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"4") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000002,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"OS") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000006 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"OS",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"OS",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"Windows_NT") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000003,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PATH") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff91f8 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(01340000,0032e670,0032e678) ret=7eff9265 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7eff9265 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATH",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000070) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATH",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000004,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PATHEXT") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eff91f8 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(01340000,0032e670,0032e678) ret=7eff9265 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7eff9265 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATHEXT",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATHEXT",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000005,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_ARCHITECTURE") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002e ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_ARCHITECTURE",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_ARCHITECTURE",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"x86") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000006,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_IDENTIFIER") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_IDENTIFIER",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_IDENTIFIER",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"x86 Family 6 Model 23 Stepping 10, GenuineIntel") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000060 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000007,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_LEVEL") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_LEVEL",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_LEVEL",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"6") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000008,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_REVISION") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000026 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_REVISION",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_REVISION",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"170a") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000009,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000a,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000b,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TEMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TEMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TEMP",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\temp") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000c,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TMP",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\temp") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000d,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"windir") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000e ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"windir",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"windir",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000e,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"winsysdir") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000014 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"winsysdir",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"winsysdir",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\system32") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000028 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000f,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eff9195 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000000,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"ComSpec") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"ComSpec",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"ComSpec",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\system32\\cmd.exe") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\system32\\cmd.exe") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000038 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000001,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"NUMBER_OF_PROCESSORS") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"NUMBER_OF_PROCESSORS",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"NUMBER_OF_PROCESSORS",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"4") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000002,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"OS") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000006 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"OS",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"OS",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"Windows_NT") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000003,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PATH") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff91f8 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(01340000,0032e670,0032e678) ret=7eff9265 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7eff9265 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATH",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000070) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATH",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") ret=7eff9311 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000070 ret=7eff9311 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000004,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PATHEXT") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000010 ret=7eff91f8 | |
| 000f:Call ntdll.RtlQueryEnvironmentVariable_U(01340000,0032e670,0032e678) ret=7eff9265 | |
| 000f:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7eff9265 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATHEXT",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PATHEXT",00000000,00000000,0032eee2,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH") ret=7eff9311 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eff9311 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000005,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_ARCHITECTURE") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002e ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_ARCHITECTURE",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_ARCHITECTURE",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"x86") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000006,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_IDENTIFIER") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000002a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_IDENTIFIER",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_IDENTIFIER",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"x86 Family 6 Model 23 Stepping 10, GenuineIntel") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000060 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000007,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_LEVEL") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_LEVEL",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_LEVEL",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"6") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000004 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000008,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"PROCESSOR_REVISION") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000026 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_REVISION",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"PROCESSOR_REVISION",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"170a") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,00000009,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000a,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000b,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TEMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TEMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TEMP",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\temp") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000c,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"TMP",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows\\temp") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000d,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"windir") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000e ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"windir",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"windir",00000000,00000000,001194f8,0032e5fc) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e600,001194f8 L"C:\\windows") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032e600,0032e608,0032e628) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000e,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"winsysdir") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000014 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"winsysdir",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,0032e680 L"winsysdir",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\windows\\system32") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000028 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(00000054,0000000f,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eff9195 | |
| 000f:Call advapi32.RegOpenKeyExW(00000054,7effc34a L"Environment",00000000,00020019,0032f70c) ret=7eff96db | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7eff96db | |
| 000f:Call advapi32.RegOpenKeyExW(00000054,7effc320 L"Volatile Environment",00000000,00020019,0032f70c) ret=7eff971e | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7eff971e | |
| 000f:Call advapi32.RegCloseKey(00000054) ret=7eff9737 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eff9737 | |
| 000f:Call advapi32.RegOpenKeyExW(80000002,7effc2a0 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00020019,0032f708) ret=7eff976a | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eff976a | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc260 L"ProfilesDirectory",00000000,0032f678,00000000,0032f67c) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc260 L"ProfilesDirectory",00000000,00000000,001194f8,0032f67c) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f680,001194f8 L"C:\\users") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000012 ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032f680,0032f688,0032f6a8) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc240 L"AllUsersProfile",00000000,0032f678,00000000,0032f67c) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7eff9018 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9018 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc240 L"AllUsersProfile",00000000,00000000,001194f8,0032f67c) ret=7eff9051 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff9051 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f680,001194f8 L"Public") ret=7eff906d | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000e ret=7eff906d | |
| 000f:Call ntdll.RtlExpandEnvironmentStrings_U(01340000,0032f680,0032f688,0032f6a8) ret=7eff909a | |
| 000f:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7eff909a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7eff90c1 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff90c1 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f718,7effc220 L"ALLUSERSPROFILE") ret=7eff9c17 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff9c17 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f720,0032f9c2 L"C:\\users\\Public") ret=7eff9c32 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000020 ret=7eff9c32 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032f718,0032f720) ret=7eff9c51 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff9c51 | |
| 000f:Call advapi32.RegCloseKey(00000054) ret=7eff9f17 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eff9f17 | |
| 000f:Call KERNEL32.GetComputerNameW(0032f9c2,0032f704) ret=7eff9797 | |
| 000f:Ret KERNEL32.GetComputerNameW() retval=00000001 ret=7eff9797 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f718,7effc1ee L"COMPUTERNAME") ret=7eff9ac8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000001a ret=7eff9ac8 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f720,0032f9c2 L"alfonsojon-pc") ret=7eff9ae3 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000001c ret=7eff9ae3 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032f718,0032f720) ret=7eff9b08 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff9b08 | |
| 000f:Call KERNEL32.IsWow64Process(ffffffff,0032f714) ret=7eff97be | |
| 000f:Ret KERNEL32.IsWow64Process() retval=00000001 ret=7eff97be | |
| 000f:Call advapi32.RegOpenKeyExW(80000002,7effc160 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00020119,0032f710) ret=7eff97f1 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eff97f1 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc140 L"ProgramFilesDir",00000000,0032f678,00000000,0032f67c) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc140 L"ProgramFilesDir",00000000,00000000,0032f738,0032f6a8) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f728,7effc10c L"ProgramFiles") ret=7eff9f58 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000001a ret=7eff9f58 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f730,0032f738 L"C:\\Program Files") ret=7eff9f73 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000022 ret=7eff9f73 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032f728,0032f730) ret=7eff9f98 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff9f98 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc0a6 L"CommonFilesDir",00000000,0032f678,00000000,0032f67c) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(00000054,7effc0a6 L"CommonFilesDir",00000000,00000000,0032f738,0032f6a8) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f728,7effc040 L"CommonProgramFiles") ret=7eff9a48 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000026 ret=7eff9a48 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032f730,0032f738 L"C:\\Program Files\\Common Files") ret=7eff9a63 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000003c ret=7eff9a63 | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032f728,0032f730) ret=7eff9a88 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff9a88 | |
| 000f:Call advapi32.RegCloseKey(00000054) ret=7eff9aa7 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7eff9aa7 | |
| 000f:Call advapi32.GetTokenInformation(00000050,00000001,00000000,00000000,0032f704) ret=7eff983e | |
| 000f:Ret advapi32.GetTokenInformation() retval=00000000 ret=7eff983e | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eff9fc3 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7eff9fc3 | |
| 000f:Call advapi32.GetTokenInformation(00000050,00000001,001194f8,00000024,0032f704) ret=7eff9ffe | |
| 000f:Ret advapi32.GetTokenInformation() retval=00000001 ret=7eff9ffe | |
| 000f:Call advapi32.ConvertSidToStringSidW(00119500,0032f728) ret=7effa029 | |
| 000f:Ret advapi32.ConvertSidToStringSidW() retval=00000001 ret=7effa029 | |
| 000f:Call advapi32.LookupAccountSidW(00000000,00119500,0032f9d4,0032f730,00000000,0032f738,0032f714) ret=7effa0e9 | |
| 000f:Ret advapi32.LookupAccountSidW() retval=00000000 ret=7effa0e9 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7effa117 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7effa117 | |
| 000f:Call KERNEL32.LocalFree(00119528) ret=7effa140 | |
| 000f:Ret KERNEL32.LocalFree() retval=00000000 ret=7effa140 | |
| 000f:Call advapi32.RegOpenKeyExW(80000003,0032f9c2 L"S-1-5-21-0-0-0-1000",00000000,00020019,0032f708) ret=7eff9976 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7eff9976 | |
| 000f:Call advapi32.RegOpenKeyExW(00000058,7effc34a L"Environment",00000000,00020019,0032f70c) ret=7effa29a | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=7effa29a | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000000,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TEMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TEMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TEMP",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\users\\alfonsojon\\Temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000032 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000001,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TMP",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\users\\alfonsojon\\Temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000032 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000002,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eff9195 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000000,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TEMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=0000000a ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TEMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TEMP",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\users\\alfonsojon\\Temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000032 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000001,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000000 ret=7eff9195 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e670,0032e680 L"TMP") ret=7eff91f8 | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000008 ret=7eff91f8 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TMP",00000000,0032e5f8,00000000,0032e5fc) ret=7eff8f81 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8f81 | |
| 000f:Call advapi32.RegQueryValueExW(0000005c,0032e680 L"TMP",00000000,00000000,0032ee80,0032e628) ret=7eff8fe5 | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7eff8fe5 | |
| 000f:Call ntdll.RtlInitUnicodeString(0032e678,0032ee80 L"C:\\users\\alfonsojon\\Temp") ret=7eff937c | |
| 000f:Ret ntdll.RtlInitUnicodeString() retval=00000032 ret=7eff937c | |
| 000f:Call ntdll.RtlSetEnvironmentVariable(0032f700,0032e670,0032e678) ret=7eff93a1 | |
| 000f:Ret ntdll.RtlSetEnvironmentVariable() retval=00000000 ret=7eff93a1 | |
| 000f:Call advapi32.RegEnumValueW(0000005c,00000002,0032e680,0032e66c,00000000,00000000,00000000,00000000) ret=7eff9195 | |
| 000f:Ret advapi32.RegEnumValueW() retval=00000103 ret=7eff9195 | |
| 000f:Call advapi32.RegCloseKey(0000005c) ret=7effa493 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7effa493 | |
| 000f:Call advapi32.RegOpenKeyExW(00000058,7effc320 L"Volatile Environment",00000000,00020019,0032f70c) ret=7effa2d7 | |
| 000f:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=7effa2d7 | |
| 000f:Call advapi32.RegCloseKey(00000058) ret=7effa2f0 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7effa2f0 | |
| 000f:Ret userenv.CreateEnvironmentBlock() retval=00000001 ret=7ec24fff | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(001182c8 L"C:\\windows\\system32\\drivers\\mountmgr.sys",00000000,00000000) ret=7ec24c70 | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7ec24c70 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000052) ret=7ec24c95 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7ec24c95 | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(001182c8 L"C:\\windows\\system32\\drivers\\mountmgr.sys",001194f8,00000029) ret=7ec24cbf | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7ec24cbf | |
| 000f:Call KERNEL32.GetSystemDirectoryW(0033fa78,00000104) ret=7ec24e2a | |
| 000f:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7ec24e2a | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7ec24e9b | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec24e9b | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ec24ebe | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001194f8 ret=7ec24ebe | |
| 000f:Call KERNEL32.CreateProcessW(00000000,001194f8 L"C:\\windows\\system32\\winedevice.exe MountMgr",00000000,00000000,00000000,00000400,01340000,00000000,0033fa78,0033fa68) ret=7ec24d6f | |
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0013:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| 000f:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ec24d6f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001194f8) ret=7ec24d97 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec24d97 | |
| 000f:Call KERNEL32.CloseHandle(00000064) ret=7ec24dca | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec24dca | |
| 000f:Call KERNEL32.ConnectNamedPipe(0000004c,0033fcfc) ret=7ec254bb | |
| 000f:Ret KERNEL32.ConnectNamedPipe() retval=00000000 ret=7ec254bb | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fcf4,00000000,00002710) ret=7ec258fe | |
| 0013:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Call PE DLL (proc=0x7ec14ec0,module=0x7ebd0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Ret PE DLL (proc=0x7ec14ec0,module=0x7ebd0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Call PE DLL (proc=0x7eb9dba0,module=0x7eb80000 L"ntoskrnl.exe",reason=PROCESS_ATTACH,res=0x1) | |
| 0013:Call KERNEL32.DisableThreadLibraryCalls(7eb80000) ret=7eb9d9a7 | |
| 0013:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7eb9d9a7 | |
| 0013:Call ntdll.RtlAddVectoredExceptionHandler(00000001,7eb988c0) ret=7eb9d9c0 | |
| 0013:Ret ntdll.RtlAddVectoredExceptionHandler() retval=00115500 ret=7eb9d9c0 | |
| 0013:Call ntdll.NtGetTickCount() ret=7eb9bc5b | |
| 0013:Ret ntdll.NtGetTickCount() retval=008a8a71 ret=7eb9bc5b | |
| 0013:Ret PE DLL (proc=0x7eb9dba0,module=0x7eb80000 L"ntoskrnl.exe",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0013:Starting process L"C:\\windows\\system32\\winedevice.exe" (entryproc=0x7effc990) | |
| 0013:Call advapi32.StartServiceCtrlDispatcherW(0033fe10) ret=7effc93a | |
| 0013:Call PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0013:Ret PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0013:Call rpcrt4.NdrClientInitializeNew(0033f7fc,0033f8dc,7ec2eea0,0000000f) ret=7ec118af | |
| 0013:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec118af | |
| 0013:Call rpcrt4.RpcStringBindingComposeW(00000000,0033f764 L"ncacn_np",00000000,0033f776 L"\\pipe\\svcctl",00000000,0033f75c) ret=7ec08c1e | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7eb35049 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001196d0 ret=7eb35049 | |
| 0013:Ret rpcrt4.RpcStringBindingComposeW() retval=00000000 ret=7ec08c1e | |
| 0013:Call rpcrt4.RpcBindingFromStringBindingW(001196d0 L"ncacn_np:[\\\\pipe\\\\svcctl]",0033f760) ret=7ec08c82 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7eb33892 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001197f0 ret=7eb33892 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7eb33892 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119730 ret=7eb33892 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7eb33892 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119748 ret=7eb33892 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3377d | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=00119770 ret=7eb3377d | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001197f0 L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7eb33ee3 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7eb33ee3 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb33f08 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011a978 ret=7eb33f08 | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001197f0 L"ncacn_np",ffffffff,0011a978,00000009,00000000,00000000) ret=7eb33f48 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7eb33f48 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb36942 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb36942 | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00119730 L"",ffffffff,00000000,00000000,00000000,00000000) ret=7eb33ee3 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7eb33ee3 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb33f08 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011a990 ret=7eb33f08 | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00119730 L"",ffffffff,0011a990,00000001,00000000,00000000) ret=7eb33f48 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7eb33f48 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb36979 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb36979 | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00119748 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7eb33ee3 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7eb33ee3 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb33f08 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011a9a8 ret=7eb33f08 | |
| 0013:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00119748 L"\\pipe\\svcctl",ffffffff,0011a9a8,0000000d,00000000,00000000) ret=7eb33f48 | |
| 0013:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7eb33f48 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb369ad | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb369ad | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7eb31dea | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011a9c0 ret=7eb31dea | |
| 0013:Call KERNEL32.InitializeCriticalSection(0011a9f0) ret=7eb31e20 | |
| 0013:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb31e20 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aa48 ret=7eb33e43 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aa60 ret=7eb33e43 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aa78 ret=7eb33e43 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb4ca52 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4ca52 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00119748) ret=7eb4ca52 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4ca52 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00119730) ret=7eb4ca52 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4ca52 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,001197f0) ret=7eb4ca52 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4ca52 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb4ca52 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4ca52 | |
| 0013:Ret rpcrt4.RpcBindingFromStringBindingW() retval=00000000 ret=7ec08c82 | |
| 0013:Call rpcrt4.RpcStringFreeW(0033f75c) ret=7ec08c8f | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,001196d0) ret=7eb4ca52 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4ca52 | |
| 0013:Ret rpcrt4.RpcStringFreeW() retval=00000000 ret=7ec08c8f | |
| 0013:Call rpcrt4.NdrPointerBufferSize(0033f8dc,00000000,7ec1d55a) ret=7ec118e6 | |
| 0013:Ret rpcrt4.NdrPointerBufferSize() retval=00000012 ret=7ec118e6 | |
| 0013:Call rpcrt4.NdrPointerBufferSize(0033f8dc,00000000,7ec1d6fe) ret=7ec11911 | |
| 0013:Ret rpcrt4.NdrPointerBufferSize() retval=00000012 ret=7ec11911 | |
| 0013:Call rpcrt4.NdrGetBuffer(0033f8dc,00000010,00119770) ret=7ec1192d | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7eb4e160 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001197f0 ret=7eb4e160 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7eb444e7 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001196d0 ret=7eb444e7 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aa90 ret=7eb33e43 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aaa8 ret=7eb33e43 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7eb4e160 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aac0 ret=7eb4e160 | |
| 0013:Call KERNEL32.CreateFileA(0011aac0 "\\\\.\\pipe\\svcctl",c0000000,00000000,00000000,00000003,00000000,00000000) ret=7eb4549d | |
| 0013:Ret KERNEL32.CreateFileA() retval=00000010 ret=7eb4549d | |
| 0013:Call KERNEL32.SetNamedPipeHandleState(00000010,0033f53c,00000000,00000000) ret=7eb4556d | |
| 0013:Ret KERNEL32.SetNamedPipeHandleState() retval=00000001 ret=7eb4556d | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aac0) ret=7eb4e1a0 | |
| 0011:Ret KERNEL32.ConnectNamedPipe() retval=00000001 ret=7ebda0b3 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3b88b | |
| 0011:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aac0 ret=7eb3b88b | |
| 0011:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) retval=1 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7eb4c7b5 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab10 ret=7eb4c7b5 | |
| 0013:Call KERNEL32.InitializeCriticalSection(0011ab18) ret=7eb4c7c9 | |
| 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000001 ret=7ebdf35c | |
| 0010:Call KERNEL32.GetExitCodeThread(00000038,00b3e95c) ret=7ebdf42e | |
| 0013:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb4c7c9 | |
| 0010:Ret KERNEL32.GetExitCodeThread() retval=00000001 ret=7ebdf42e | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ebd84e7 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119518 ret=7ebd84e7 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119450 ret=7ebc7e43 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ebe2160 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=001195a8 ret=7ebe2160 | |
| 0010:Call KERNEL32.CreateNamedPipeA(001195a8 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ebd9e2e | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3c737 | |
| 0010:Ret KERNEL32.CreateNamedPipeA() retval=0000003c ret=7ebd9e2e | |
| 0010:Call ntdll.RtlFreeHeap(00110000,00000000,001195a8) ret=7ebe21a0 | |
| 0010:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0010:Call KERNEL32.CloseHandle(00000000) ret=7ebdf44a | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab70 ret=7eb3c737 | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ebdf44a | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ebd4480,00119518,00000000,00000000) ret=7ebd51a9 | |
| 0013:Call KERNEL32.WriteFile(00000010,0011ab70,00000048,0033f50c,00000000) ret=7eb456c2 | |
| 0013:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb456c2 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab70) ret=7eb3c824 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3c824 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aac0) ret=7eb3bda6 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3bda6 | |
| 0013:Call KERNEL32.ReadFile(00000010,0033f50c,00000010,0033f4bc,00000000) ret=7eb45735 | |
| 0010:Ret KERNEL32.CreateThread() retval=00000058 ret=7ebd51a9 | |
| 0010:Call KERNEL32.CloseHandle(00000058) ret=7ebd51ba | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ebd51ba | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ebda080,00119360,00000000,00000000) ret=7ebd8783 | |
| 0010:Ret KERNEL32.CreateThread() retval=00000058 ret=7ebd8783 | |
| 0010:Call ntdll.RtlReAllocateHeap(00110000,00000000,001192c0,00000008) ret=7ebd881a | |
| 0010:Ret ntdll.RtlReAllocateHeap() retval=001192c0 ret=7ebd881a | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,001192c0,00000000,ffffffff,00000001) ret=7ebdf35c | |
| 0015:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0015:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0015:Starting thread proc 0x7ebda080 (arg=0x119360) | |
| 0015:Call KERNEL32.ConnectNamedPipe(0000003c,00000000) ret=7ebda0b3 | |
| 0014:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0014:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0014:Starting thread proc 0x7ebd4480 (arg=0x119518) | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195c8 ret=7ebd4562 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebe07b5 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119600 ret=7ebe07b5 | |
| 0014:Call KERNEL32.InitializeCriticalSection(00119608) ret=7ebe07c9 | |
| 0014:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebe07c9 | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ebd1b24 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119660 ret=7ebd1b24 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119670,0000000c,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ebd1bff | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd1bff | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119688,0000002c,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ebe2160 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196c0 ret=7ebe2160 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebd1d8f | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd3f87 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd3f87 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebc777d | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196f8 ret=7ebc777d | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebc7e43 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119748 ret=7ebc7e43 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119760 ret=7ebc7e43 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ebc5dea | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119778 ret=7ebc5dea | |
| 0014:Call KERNEL32.InitializeCriticalSection(001197a8) ret=7ebc5e20 | |
| 0014:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebc5e20 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebc7e43 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119800 ret=7ebc7e43 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119818 ret=7ebc7e43 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ebcfa4b | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ebcfa4b | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebd41db | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd41db | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ebd0737 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119880 ret=7ebd0737 | |
| 0014:Call KERNEL32.WriteFile(0000002c,00119880,00000044,01b4e87c,00000000) ret=7ebd96c2 | |
| 0014:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119880) ret=7ebd0824 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ebcfda6 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001196c0) ret=7ebe21a0 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119660) ret=7ebcfda6 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001195c8) ret=7ebd4513 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4513 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4536 | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4536 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195c8 ret=7ebd4562 | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3db24 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aac0 ret=7eb3db24 | |
| 0013:Call KERNEL32.ReadFile(00000010,0011aad0,00000008,0033f4bc,00000000) ret=7eb45735 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb3dbff | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab70 ret=7eb3dbff | |
| 0013:Call KERNEL32.ReadFile(00000010,0011ab70,0000002c,0033f4bc,00000000) ret=7eb45735 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb4e160 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aba8 ret=7eb4e160 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab70) ret=7eb3dd8f | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3dd8f | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aba8) ret=7eb4e1a0 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aac0) ret=7eb3bda6 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3bda6 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb32949 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb32949 | |
| 0013:Ret rpcrt4.NdrGetBuffer() retval=001197f0 ret=7ec1192d | |
| 0013:Call rpcrt4.NdrPointerMarshall(0033f8dc,00000000,7ec1d55a) ret=7ec11946 | |
| 0013:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec11946 | |
| 0013:Call rpcrt4.NdrPointerMarshall(0033f8dc,00000000,7ec1d6fe) ret=7ec11965 | |
| 0013:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec11965 | |
| 0013:Call rpcrt4.NdrSendReceive(0033f8dc,001197fc) ret=7ec119be | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb3e92f | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aac0 ret=7eb3e92f | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000024) ret=7eb3c737 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aae0 ret=7eb3c737 | |
| 0013:Call KERNEL32.WriteFile(00000010,0011aae0,00000024,0033f5cc,00000000) ret=7eb456c2 | |
| 0013:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb456c2 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aae0) ret=7eb3c824 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3c824 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aac0) ret=7eb3e9f1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3e9f1 | |
| 0013:Call KERNEL32.ReadFile(00000010,0033f5dc,00000010,0033f58c,00000000) ret=7eb45735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119660 ret=7ebd1b24 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119670,00000008,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ebd1bff | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119680 ret=7ebd1bff | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119680,0000000c,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ebe2160 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119698 ret=7ebe2160 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119680) ret=7ebd1d8f | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196b0 ret=7ebd460e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ebd4f00,001196b0,00000010) ret=7ebd4657 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ebd4562 | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0016:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0016:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0016:Starting thread proc 0x7bc8d170 (arg=(nil)) | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebe07b5 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119868 ret=7ebe07b5 | |
| 0016:Call KERNEL32.InitializeCriticalSection(00119870) ret=7ebe07c9 | |
| 0016:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebe07c9 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(001195c8,0234e6c0,7ec33e80) ret=7ec2a90e | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec2a90e | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0234e6c0,0234e7a0,7ec2f13a,00000000) ret=7ec2aa03 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ec2aa03 | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0234e6c0,0234e7a4,7ec2f2de,00000000) ret=7ec2aa27 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ec2aa27 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0234e6c0,7ec2f142) ret=7ec2aa82 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ebc6e7c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001198a0 ret=7ebc6e7c | |
| 0016:Call ntdll.RtlInitializeResource(001198c4) ret=7ebc6e9e | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ebc6e9e | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(001198c4,00000001) ret=7ebc6ebb | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6ebb | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119680 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=001198a0 ret=7ec2aa82 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec201c1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119930 ret=7ec201c1 | |
| 0016:Call ntdll.RtlMapGenericMask(00119934,7ec2e574) ret=7ec20204 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00000001 ret=7ec20204 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(001195c8) ret=7ec2aaca | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec2aaca | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0234e6c0,001198a0,7ec236f0,7ec2f142) ret=7ec2ab01 | |
| 0016:Call advapi32.SystemFunction036(001198b4,00000010) ret=7ebe1110 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe1110 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119680) ret=7ebe2f32 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f32 | |
| 0016:Call ntdll.RtlReleaseResource(001198c4) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ec2ab01 | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,00000000,7ec2f13a) ret=7ec2a88c | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000000 ret=7ec2a88c | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,00000000,7ec2f2de) ret=7ec2a8ad | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000000 ret=7ec2a8ad | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119970 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119990 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119990,00000030,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119990) ret=7ebd0824 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3db24 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119970) ret=7ebcfda6 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aac0 ret=7eb3db24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0013:Call KERNEL32.ReadFile(00000010,0011aad0,00000008,0033f58c,00000000) ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119698) ret=7ebe21a0 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3dbff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119948) ret=7ebe21a0 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aae0 ret=7eb3dbff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0013:Call KERNEL32.ReadFile(00000010,0011aae0,00000018,0033f58c,00000000) ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119660) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195c8) ret=7ebd4f9e | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb4e160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab70 ret=7eb4e160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb3ddfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ddfd | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196b0) ret=7ebd4feb | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aae0) ret=7eb3dd8f | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3dd8f | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011aac0) ret=7eb3ec89 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ec89 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,001197f0) ret=7eb4e1a0 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0013:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec119be | |
| 0013:Call rpcrt4.NdrClientContextUnmarshall(0033f8dc,0033faec,00119770) ret=7ec11a23 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb166d1 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=001197f0 ret=7eb166d1 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3377d | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aac0 ret=7eb3377d | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011ab90 ret=7eb33e43 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011aba8 ret=7eb33e43 | |
| 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb33e43 | |
| 0013:Ret ntdll.RtlAllocateHeap() retval=0011abc0 ret=7eb33e43 | |
| 0013:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec11a23 | |
| 0013:Call rpcrt4.NdrFreeBuffer(0033f8dc) ret=7ec0ed44 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011ab70) ret=7eb4e1a0 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0013:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec0ed44 | |
| 0013:Call rpcrt4.RpcBindingFree(0033f7a4) ret=7ec08cf8 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011a9a8) ret=7eb33cc1 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb33cc1 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011a990) ret=7eb33ce4 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb33ce4 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011a978) ret=7eb33d07 | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb33d07 | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb33d2a | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb33d2a | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb33d4d | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb33d4d | |
| 0013:Call ntdll.RtlFreeHeap(00110000,00000000,00119770) ret=7eb33d9b | |
| 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb33d9b | |
| 0013:Ret rpcrt4.RpcBindingFree() retval=00000000 ret=7ec08cf8 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ec258fe | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec2558d | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=001195c8 ret=7ec2558d | |
| 000f:Call KERNEL32.WriteFile(0000004c,001195c8,00000024,0033fc68,0033fc6c) ret=7ec21714 | |
| 000f:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec21714 | |
| 000f:Call KERNEL32.ReadFile(0000004c,0033fcf4,00000004,0033fc68,0033fc6c) ret=7ec217de | |
| 000f:Ret KERNEL32.ReadFile() retval=00000000 ret=7ec217de | |
| 000f:Call KERNEL32.WaitForSingleObject(00000048,00002710) ret=7ec21922 | |
| 0017:Call PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0017:Ret PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0017:Starting thread proc 0x7ec098b0 (arg=0x1196b8) | |
| 0017:Call rpcrt4.NdrClientInitializeNew(00b3e660,00b3e740,7ec2eea0,00000010) ret=7ec11b82 | |
| 0017:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec11b82 | |
| 0017:Call rpcrt4.NDRCContextBinding(001197f0) ret=7ec11ba1 | |
| 0017:Ret rpcrt4.NDRCContextBinding() retval=0011aac0 ret=7ec11ba1 | |
| 0017:Call rpcrt4.NdrConformantStringBufferSize(00b3e740,0011ab70,7ec1d570) ret=7ec11bcd | |
| 0017:Ret rpcrt4.NdrConformantStringBufferSize() retval=00b3e754 ret=7ec11bcd | |
| 0017:Call rpcrt4.NdrGetBuffer(00b3e740,0000003e,0011aac0) ret=7ec11be9 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7eb4e160 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011a978 ret=7eb4e160 | |
| 0017:Ret rpcrt4.NdrGetBuffer() retval=0011a978 ret=7ec11be9 | |
| 0017:Call rpcrt4.NdrClientContextMarshall(00b3e740,001197f0,00000000) ret=7ec11c06 | |
| 0017:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec11c06 | |
| 0017:Call rpcrt4.NdrConformantStringMarshall(00b3e740,0011ab70,7ec1d570) ret=7ec11c1f | |
| 0017:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec11c1f | |
| 0017:Call rpcrt4.NdrSendReceive(00b3e740,0011a9b0) ret=7ec11c78 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb3e92f | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119770 ret=7eb3e92f | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7eb4c7b5 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119790 ret=7eb4c7b5 | |
| 0017:Call KERNEL32.InitializeCriticalSection(00119798) ret=7eb4c7c9 | |
| 0017:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb4c7c9 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7eb3c737 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac00 ret=7eb3c737 | |
| 0017:Call KERNEL32.WriteFile(00000010,0011ac00,00000050,00b3e44c,00000000) ret=7eb456c2 | |
| 0017:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb456c2 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac00) ret=7eb3c824 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3c824 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00119770) ret=7eb3e9f1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd1b24 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3e9f1 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119698,00000008,01b4e87c,00000000) ret=7ebd9735 | |
| 0017:Call KERNEL32.ReadFile(00000010,00b3e45c,00000010,00b3e40c,00000000) ret=7eb45735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebd1bff | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ebd1bff | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119948,00000038,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebe2160 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119988 ret=7ebe2160 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119948) ret=7ebd1d8f | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001196a8 ret=7ebd460e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ebd4f00,001196a8,00000010) ret=7ebd4657 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119830,0234e6c0,7ec33e80) ret=7ec2b73e | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec2b73e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c0,7ec2f14a) ret=7ec2b824 | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(001198c4,00000001) ret=7ebc6fd7 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199c8 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=001198a0 ret=7ec2b824 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0234e6c0,0234e7a4,7ec2f150,00000000) ret=7ec2b848 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ec2b848 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0234e6c0,7ec2f152) ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ebc6e7c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199e0 ret=7ebc6e7c | |
| 0016:Call ntdll.RtlInitializeResource(00119a04) ret=7ebc6e9e | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ebc6e9e | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119a04,00000001) ret=7ebc6ebb | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6ebb | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119a70 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=001199e0 ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f8da | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119a88 ret=7ec1f8da | |
| 0016:Call ntdll.RtlMapGenericMask(00119a8c,7ec2e564) ret=7ec1f904 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00008000 ret=7ec1f904 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119830) ret=7ec2b8ee | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119aa0 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec2b8ee | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0234e6c0,001199e0,7ec236f0,7ec2f152) ret=7ec2b925 | |
| 0016:Call advapi32.SystemFunction036(001199f4,00000010) ret=7ebe1110 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe1110 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119a70) ret=7ebe2f32 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f32 | |
| 0016:Call ntdll.RtlReleaseResource(00119a04) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ec2b925 | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,001199a8,7ec2f14e) ret=7ec2b9a2 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0234e6c0 ret=7ec2b9a2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199c8) ret=7ebe2f93 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(001198c4) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ac8 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ae8 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119ae8,00000030,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119ae8) ret=7ebd0824 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3db24 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119ac8) ret=7ebcfda6 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119770 ret=7eb3db24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0017:Call KERNEL32.ReadFile(00000010,00119780,00000008,00b3e40c,00000000) ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119988) ret=7ebe21a0 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119aa0) ret=7ebe21a0 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3dbff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac00 ret=7eb3dbff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebcfda6 | |
| 0017:Call KERNEL32.ReadFile(00000010,0011ac00,00000018,00b3e40c,00000000) ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ebd4f9e | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb4e160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac20 ret=7eb4e160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb3ddfd | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001196a8) ret=7ebd4feb | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ddfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac00) ret=7eb3dd8f | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3dd8f | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00119770) ret=7eb3ec89 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ec89 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011a978) ret=7eb4e1a0 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0017:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec11c78 | |
| 0017:Call rpcrt4.NdrClientContextUnmarshall(00b3e740,00b3e94c,0011aac0) ret=7ec11cd1 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb166d1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011a978 ret=7eb166d1 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3377d | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac40 ret=7eb3377d | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb33e43 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=00119770 ret=7eb33e43 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb33e43 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac00 ret=7eb33e43 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb33e43 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac90 ret=7eb33e43 | |
| 0017:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec11cd1 | |
| 0017:Call rpcrt4.NdrFreeBuffer(00b3e740) ret=7ec11d1d | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac20) ret=7eb4e1a0 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0017:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec11d1d | |
| 0017:Call rpcrt4.NdrClientInitializeNew(00b3e660,00b3e740,7ec2eea0,00000010) ret=7ec11b82 | |
| 0017:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec11b82 | |
| 0017:Call rpcrt4.NDRCContextBinding(001197f0) ret=7ec11ba1 | |
| 0017:Ret rpcrt4.NDRCContextBinding() retval=0011aac0 ret=7ec11ba1 | |
| 0017:Call rpcrt4.NdrConformantStringBufferSize(00b3e740,0011ab70,7ec1d570) ret=7ec11bcd | |
| 0017:Ret rpcrt4.NdrConformantStringBufferSize() retval=00b3e754 ret=7ec11bcd | |
| 0017:Call rpcrt4.NdrGetBuffer(00b3e740,0000003e,0011aac0) ret=7ec11be9 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7eb4e160 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aca8 ret=7eb4e160 | |
| 0017:Ret rpcrt4.NdrGetBuffer() retval=0011aca8 ret=7ec11be9 | |
| 0017:Call rpcrt4.NdrClientContextMarshall(00b3e740,001197f0,00000000) ret=7ec11c06 | |
| 0017:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec11c06 | |
| 0017:Call rpcrt4.NdrConformantStringMarshall(00b3e740,0011ab70,7ec1d570) ret=7ec11c1f | |
| 0017:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec11c1f | |
| 0017:Call rpcrt4.NdrSendReceive(00b3e740,0011ace0) ret=7ec11c78 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb3e92f | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac20 ret=7eb3e92f | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7eb3c737 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011acf0 ret=7eb3c737 | |
| 0017:Call KERNEL32.WriteFile(00000010,0011acf0,00000050,00b3e44c,00000000) ret=7eb456c2 | |
| 0017:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb456c2 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011acf0) ret=7eb3c824 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3c824 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ebd1b24 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac20) ret=7eb3e9f1 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119840,00000008,01b4e87c,00000000) ret=7ebd9735 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3e9f1 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0017:Call KERNEL32.ReadFile(00000010,00b3e45c,00000010,00b3e40c,00000000) ret=7eb45735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebd1bff | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd1bff | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119688,00000038,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebe2160 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119988 ret=7ebe2160 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebd1d8f | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd460e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ebd4f00,00119688,00000010) ret=7ebd4657 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119948,0234e6c0,7ec33e80) ret=7ec2b73e | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec2b73e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119aa0 ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c0,7ec2f14a) ret=7ec2b824 | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(001198c4,00000001) ret=7ebc6fd7 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119a70 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=001198a0 ret=7ec2b824 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0234e6c0,0234e7a4,7ec2f150,00000000) ret=7ec2b848 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ec2b848 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0234e6c0,7ec2f152) ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ebc6e7c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ad8 ret=7ebc6e7c | |
| 0016:Call ntdll.RtlInitializeResource(00119afc) ret=7ebc6e9e | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ebc6e9e | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119afc,00000001) ret=7ebc6ebb | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6ebb | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119ad8 ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f8da | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b58 ret=7ec1f8da | |
| 0016:Call ntdll.RtlMapGenericMask(00119b5c,7ec2e564) ret=7ec1f904 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=0002008f ret=7ec1f904 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119948) ret=7ec2b8ee | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b70 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec2b8ee | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0234e6c0,00119ad8,7ec236f0,7ec2f152) ret=7ec2b925 | |
| 0016:Call advapi32.SystemFunction036(00119aec,00000010) ret=7ebe1110 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe1110 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119b40) ret=7ebe2f32 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f32 | |
| 0016:Call ntdll.RtlReleaseResource(00119afc) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ec2b925 | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,001199a8,7ec2f14e) ret=7ec2b9a2 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0234e6c0 ret=7ec2b9a2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119a70) ret=7ebe2f93 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(001198c4) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b98 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119bb8 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119bb8,00000030,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bb8) ret=7ebd0824 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3db24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac20 ret=7eb3db24 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119b98) ret=7ebcfda6 | |
| 0017:Call KERNEL32.ReadFile(00000010,0011ac30,00000008,00b3e40c,00000000) ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119988) ret=7ebe21a0 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3dbff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119b70) ret=7ebe21a0 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011acf0 ret=7eb3dbff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0017:Call KERNEL32.ReadFile(00000010,0011acf0,00000018,00b3e40c,00000000) ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0017:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119948) ret=7ebd4f9e | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb4e160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ad10 ret=7eb4e160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb3ddfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ddfd | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebd4feb | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011acf0) ret=7eb3dd8f | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3dd8f | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ac20) ret=7eb3ec89 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ec89 | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011aca8) ret=7eb4e1a0 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0017:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec11c78 | |
| 0017:Call rpcrt4.NdrClientContextUnmarshall(00b3e740,00b3e94c,0011aac0) ret=7ec11cd1 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb166d1 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011aca8 ret=7eb166d1 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3377d | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ad30 ret=7eb3377d | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb33e43 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011ac20 ret=7eb33e43 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb33e43 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011acd8 ret=7eb33e43 | |
| 0017:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb33e43 | |
| 0017:Ret ntdll.RtlAllocateHeap() retval=0011acf0 ret=7eb33e43 | |
| 0017:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec11cd1 | |
| 0017:Call rpcrt4.NdrFreeBuffer(00b3e740) ret=7ec11d1d | |
| 0017:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad10) ret=7eb4e1a0 | |
| 0017:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0017:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec11d1d | |
| 0018:Call PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0018:Ret PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0018:Starting thread proc 0x7ec08640 (arg=0x119678) | |
| 0018:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7effc6ff | |
| 0018:Ret KERNEL32.CreateEventW() retval=0000003c ret=7effc6ff | |
| 0018:Call advapi32.RegisterServiceCtrlHandlerExW(001152aa L"MountMgr",7effb800,00000000) ret=7effc728 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ec21922 | |
| 0018:Ret advapi32.RegisterServiceCtrlHandlerExW() retval=0011a978 ret=7effc728 | |
| 000f:Call KERNEL32.GetOverlappedResult(0000004c,0033fc6c,0033fc68,00000000) ret=7ec21896 | |
| 0018:Call advapi32.SetServiceStatus(0011a978,0133e934) ret=7effc779 | |
| 000f:Ret KERNEL32.GetOverlappedResult() retval=00000001 ret=7ec21896 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001195c8) ret=7ec256b4 | |
| 0018:Call rpcrt4.NdrClientInitializeNew(0133e5d0,0133e6b0,7ec2eea0,00000007) ret=7ec10084 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec256b4 | |
| 0018:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec10084 | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fcfc,00000000,00002710) ret=7ec25729 | |
| 0018:Call rpcrt4.NDRCContextBinding(0011a978) ret=7ec10097 | |
| 0018:Ret rpcrt4.NDRCContextBinding() retval=0011ac40 ret=7ec10097 | |
| 0018:Call rpcrt4.NdrGetBuffer(0133e6b0,00000038,0011ac40) ret=7ec100bb | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eb4e160 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ad80 ret=7eb4e160 | |
| 0018:Ret rpcrt4.NdrGetBuffer() retval=0011ad80 ret=7ec100bb | |
| 0018:Call rpcrt4.NdrClientContextMarshall(0133e6b0,0011a978,00000000) ret=7ec100d2 | |
| 0018:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec100d2 | |
| 0018:Call rpcrt4.NdrSimpleStructMarshall(0133e6b0,0133e934,7ec1d4b4) ret=7ec100f1 | |
| 0018:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ec100f1 | |
| 0018:Call rpcrt4.NdrSendReceive(0133e6b0,0011adb0) ret=7ec10106 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb3e92f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011adc0 ret=7eb3e92f | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7eb4c7b5 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ade0 ret=7eb4c7b5 | |
| 0018:Call KERNEL32.InitializeCriticalSection(0011ade8) ret=7eb4c7c9 | |
| 0018:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb4c7c9 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3c737 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ae40 ret=7eb3c737 | |
| 0018:Call KERNEL32.WriteFile(00000010,0011ae40,00000048,0133e3bc,00000000) ret=7eb456c2 | |
| 0018:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb456c2 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ae40) ret=7eb3c824 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3c824 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011adc0) ret=7eb3e9f1 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd1b24 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3e9f1 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119698,00000008,01b4e87c,00000000) ret=7ebd9735 | |
| 0018:Call KERNEL32.ReadFile(00000010,0133e3cc,00000010,0133e37c,00000000) ret=7eb45735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ebd1bff | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195c8 ret=7ebd1bff | |
| 0014:Call KERNEL32.ReadFile(0000002c,001195c8,00000030,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ebe2160 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ebe2160 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,001195c8) ret=7ebd1d8f | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195c8 ret=7ebd460e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ebd4f00,001195c8,00000010) ret=7ebd4657 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119aa0,0234e6c8,7ec33e80) ret=7ec29e8e | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec29e8e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c8,7ec2f090) ret=7ec29f6d | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119a04,00000001) ret=7ebc6fd7 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119a70 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=001199e0 ret=7ec29f6d | |
| 0016:Call rpcrt4.NdrSimpleStructUnmarshall(0234e6c8,0234e7ac,7ec2f094,00000000) ret=7ec29f91 | |
| 0016:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ec29f91 | |
| 0016:Call KERNEL32.SetEvent(00000044) ret=7ec21039 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ec25729 | |
| 0016:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec21039 | |
| 000f:Call KERNEL32.ReleaseMutex(00000040) ret=7ec2541d | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119aa0) ret=7ec29ff1 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec29ff1 | |
| 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ec2541d | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119a70) ret=7ebe2f93 | |
| 000f:Call KERNEL32.WaitForSingleObject(00000000,00000000) ret=7ec25133 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(00119a04) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=ffffffff ret=7ec25133 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119980 ret=7ebcf77b | |
| 000f:Call KERNEL32.CloseHandle(ffffffff) ret=7ec2514c | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=001199a0 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000002c,001199a0,0000001c,0234e72c,00000000) ret=7ebd96c2 | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ec2514c | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 000f:Call KERNEL32.CreateMutexW(00000000,00000001,00000000) ret=7ec2516b | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001199a0) ret=7ebd0824 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119980) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 000f:Ret KERNEL32.CreateMutexW() retval=0000007c ret=7ec2516b | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119830) ret=7ebe21a0 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ec2580e | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119b40) ret=7ebe21a0 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000080 ret=7ec2580e | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebcfda6 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7ec2583d | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119aa0) ret=7ebd4f9e | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195c8) ret=7ebd4feb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3db24 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011adc0 ret=7eb3db24 | |
| 0018:Call KERNEL32.ReadFile(00000010,0011add0,00000008,0133e37c,00000000) ret=7eb45735 | |
| 000f:Ret KERNEL32.CreateEventW() retval=00000084 ret=7ec2583d | |
| 000f:Call advapi32.RegCreateKeyExW(80000002,7ec2ebe0 L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent",00000000,00000000,00000001,00000003,00000000,0033fcf0,00000000) ret=7ec251db | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eb3dbff | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ae40 ret=7eb3dbff | |
| 0018:Call KERNEL32.ReadFile(00000010,0011ae40,00000004,0133e37c,00000000) ret=7eb45735 | |
| 000f:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec251db | |
| 000f:Call advapi32.RegQueryValueExW(00000088,00000000,00000000,0033fcfc,0033fcf4,0033fcec) ret=7ec2521c | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eb4e160 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ae58 ret=7eb4e160 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb3ddfd | |
| 000f:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7ec2521c | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ddfd | |
| 000f:Call advapi32.RegSetValueExW(00000088,00000000,00000000,00000004,0033fcf4,00000004) ret=7ec257e2 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ae40) ret=7eb3dd8f | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3dd8f | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011adc0) ret=7eb3ec89 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ec89 | |
| 000f:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec257e2 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad80) ret=7eb4e1a0 | |
| 000f:Call advapi32.RegCloseKey(00000088) ret=7ec2523c | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0018:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec10106 | |
| 0018:Call rpcrt4.NdrFreeBuffer(0133e6b0) ret=7ec1018b | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ae58) ret=7eb4e1a0 | |
| 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec2523c | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004e) ret=7ec253a0 | |
| 0018:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec1018b | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119980 ret=7ec253a0 | |
| 0018:Ret advapi32.SetServiceStatus() retval=00000001 ret=7effc779 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,0000007a) ret=7effbd5e | |
| 000f:Call KERNEL32.CreateNamedPipeW(00119980 L"\\\\.\\pipe\\net\\NtControlPipe1",40000003,00000000,00000001,00000100,00000100,00002710,00000000) ret=7ec2528b | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ae40 ret=7effbd5e | |
| 0018:Call advapi32.RegOpenKeyW(80000002,0011ae64 L"System\\CurrentControlSet\\Services\\MountMgr",7efff56c) ret=7effbdd0 | |
| 000f:Ret KERNEL32.CreateNamedPipeW() retval=00000088 ret=7ec2528b | |
| 0018:Ret advapi32.RegOpenKeyW() retval=00000000 ret=7effbdd0 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119980) ret=7ec252ae | |
| 0018:Call ntdll.RtlInitUnicodeString(0133e6e0,0011ae40 L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MountMgr") ret=7effbe84 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec252ae | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000007a ret=7effbe84 | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(00118a60 L"C:\\windows\\system32\\plugplay.exe",00000000,00000000) ret=7ec24c70 | |
| 0018:Call advapi32.RegQueryValueExW(00000040,7effcd42 L"ImagePath",00000000,0133e6d8,00000000,0133e6dc) ret=7effbec7 | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000021 ret=7ec24c70 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ec24c95 | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119980 ret=7ec24c95 | |
| 000f:Call KERNEL32.ExpandEnvironmentStringsW(00118a60 L"C:\\windows\\system32\\plugplay.exe",00119980,00000021) ret=7ec24cbf | |
| 0018:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7effbec7 | |
| 000f:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000021 ret=7ec24cbf | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000052) ret=7effbef5 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ad80 ret=7effbef5 | |
| 000f:Call KERNEL32.CreateProcessW(00000000,00119980 L"C:\\windows\\system32\\plugplay.exe",00000000,00000000,00000000,00000400,01340000,00000000,0033fa78,0033fa68) ret=7ec24d6f | |
| 0018:Call advapi32.RegQueryValueExW(00000040,7effcd42 L"ImagePath",00000000,0133e6d8,0011ad80,0133e6dc) ret=7effbf2c | |
| 0018:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7effbf2c | |
| 0018:Call KERNEL32.ExpandEnvironmentStringsW(0011ad80 L"C:\\windows\\system32\\drivers\\mountmgr.sys",00000000,00000000) ret=7effc382 | |
| 0018:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7effc382 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000052) ret=7effc3ab | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011aec8 ret=7effc3ab | |
| 0018:Call KERNEL32.ExpandEnvironmentStringsW(0011ad80 L"C:\\windows\\system32\\drivers\\mountmgr.sys",0011aec8,00000029) ret=7effc3cc | |
| 0018:Ret KERNEL32.ExpandEnvironmentStringsW() retval=00000029 ret=7effc3cc | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ad80) ret=7effbf5a | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7effbf5a | |
| 0018:Call KERNEL32.LoadLibraryW(0011aec8 L"C:\\windows\\system32\\drivers\\mountmgr.sys") ret=7effb9a1 | |
| 0018:Ret KERNEL32.LoadLibraryW() retval=7eae0000 ret=7effb9a1 | |
| 0018:Call ntdll.RtlImageNtHeader(7eae0000) ret=7effb9bc | |
| 0018:Ret ntdll.RtlImageNtHeader() retval=7eae0040 ret=7effb9bc | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011aec8) ret=7effc010 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7effc010 | |
| 0018:Call ntdll.RtlImageNtHeader(7eae0000) ret=7effc023 | |
| 0018:Ret ntdll.RtlImageNtHeader() retval=7eae0040 ret=7effc023 | |
| 0018:Call driver init 0x7eaf0450 (obj=0x7efff4c0,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MountMgr") | |
| 0018:Call ntdll.RtlInitUnicodeString(0133e620,7eaf1800 L"\\Device\\MountPointManager") ret=7eaf00bf | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000034 ret=7eaf00bf | |
| 0018:Call ntdll.RtlInitUnicodeString(0133e628,7eaf17c0 L"\\??\\MountPointManager") ret=7eaf00da | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000002c ret=7eaf00da | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(7efff4c0,00000000,0133e620,00000000,00000000,00000000,0133e614) ret=7eaf0110 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000b8) ret=7eb99d85 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011aec8 ret=7eb99d85 | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eaf0110 | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0133e628,0133e620) ret=7eaf0184 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0133e564,000f0001,0133e568,0133e620) ret=7eb9a0df | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaf0184 | |
| 0018:Call advapi32.RegCreateKeyExW(80000002,7eaf1780 L"System\\MountedDevices",00000000,00000000,00000001,000f003f,00000000,7eaf4718,00000000) ret=7eaf01db | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eaf01db | |
| 0018:Call advapi32.RegCreateKeyExW(80000002,7eaf1740 L"HARDWARE\\DEVICEMAP",00000000,00000000,00000001,000f003f,00000000,0133e61c,00000000) ret=7eaf022b | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eaf022b | |
| 0018:Call advapi32.RegCreateKeyExW(00000054,7eaf1718 L"PARALLEL PORTS",00000000,00000000,00000001,000f003f,00000000,0133e618,00000000) ret=7eaf0314 | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eaf0314 | |
| 0018:Call advapi32.RegCloseKey(00000058) ret=7eaf038b | |
| 0018:Ret advapi32.RegCloseKey() retval=00000000 ret=7eaf038b | |
| 0018:Call advapi32.RegCreateKeyExW(00000054,7eaf1702 L"SERIALCOMM",00000000,00000000,00000001,000f003f,00000000,0133e618,00000000) ret=7eaf0364 | |
| 0018:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7eaf0364 | |
| 0018:Call advapi32.RegCloseKey(00000058) ret=7eaf039b | |
| 0018:Ret advapi32.RegCloseKey() retval=00000000 ret=7eaf039b | |
| 0018:Call advapi32.RegCloseKey(00000054) ret=7eaf0376 | |
| 0018:Ret advapi32.RegCloseKey() retval=00000000 ret=7eaf0376 | |
| 0018:Call ntdll.RtlInitUnicodeString(0133e620,7eaf16e0 L"\\Driver\\Harddisk") ret=7eaf0248 | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000022 ret=7eaf0248 | |
| 0018:Call ntoskrnl.exe.IoCreateDriver(0133e620,7eaeef00) ret=7eaf025d | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000bc) ret=7eb99ab8 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b130 ret=7eb99ab8 | |
| 0018:Call ntdll.RtlDuplicateUnicodeString(00000001,0133e620,0011b14c) ret=7eb99adf | |
| 0018:Ret ntdll.RtlDuplicateUnicodeString() retval=00000000 ret=7eb99adf | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eaed025 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ad80 ret=7eaed025 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,0133e460,00000000,00000000,00000000,0133e45c) ret=7eaed0a7 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b1f8 ret=7eb99d85 | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eaed0a7 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003a) ret=7eaed1d9 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011af88 ret=7eaed1d9 | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0133e468,0133e460) ret=7eaed230 | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0133e3a4,000f0001,0133e3a8,0133e460) ret=7eb9a0df | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaed230 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000041) ret=7eaed738 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011afd0 ret=7eaed738 | |
| 0018:Call advapi32.RegOpenKeyW(80000002,7eaf1480 L"Software\\Wine\\Drives",0133e4dc) ret=7eaeef8b | |
| 0018:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7eaeef8b | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b2e8 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b2e8) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b2e8 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b2e8) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b2e8 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b370 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b370) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eaedffa | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011adc0 ret=7eaedffa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eaedf1a | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b370 ret=7eaedf1a | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eaed025 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b3a0 ret=7eaed025 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,0133e400,00000000,00000000,00000000,0133e3fc) ret=7eaed0a7 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b3f0 ret=7eb99d85 | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eaed0a7 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed680 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed680 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed6a6 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed6a6 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7eaecf73 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b4e0 ret=7eaecf73 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eaef2c0 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b4f8 ret=7eaef2c0 | |
| 0018:Call ntdll.RtlInitUnicodeString(0011b50c,0011b51c L"\\??\\Volume{00000000-0000-0000-0000-000000000043}") ret=7eaef2fe | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eaef2fe | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b50c,0011b4b0) ret=7eaef3aa | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0133e224,000f0001,0133e228,0011b4b0) ret=7eb9a0df | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaef3aa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000072) ret=7eaef2c0 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b5b8 ret=7eaef2c0 | |
| 0018:Call ntdll.RtlInitUnicodeString(0011b5cc,0011b5dc L"\\DosDevices\\C:") ret=7eaef2fe | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000001e ret=7eaef2fe | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b5cc,0011b4b0) ret=7eaef3aa | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0133e314,000f0001,0133e318,0011b4b0) ret=7eb9a0df | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaef3aa | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaefdfa | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaefdfa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,0000000b) ret=7eaefe29 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b638 ret=7eaefe29 | |
| 0018:Call advapi32.RegSetValueExW(00000050,0011b51c L"\\??\\Volume{00000000-0000-0000-0000-000000000043}",00000000,00000003,0011b638,0000000b) ret=7eaefe79 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eaefe79 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaefdfa | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaefdfa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,0000000b) ret=7eaefe29 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b650 ret=7eaefe29 | |
| 0018:Call advapi32.RegSetValueExW(00000050,0011b5dc L"\\DosDevices\\C:",00000000,00000003,0011b650,0000000b) ret=7eaefe79 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eaefe79 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b668) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b668 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000080) ret=7eaedbb6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b6f0 ret=7eaedbb6 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b6f0) ret=7eaedbf5 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaedbf5 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eaedffa | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b6f0 ret=7eaedffa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eaedf1a | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b710 ret=7eaedf1a | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eaed025 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b740 ret=7eaed025 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,0133e400,00000000,00000000,00000000,0133e3fc) ret=7eaed0a7 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b790 ret=7eb99d85 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b790) ret=7eb99e0a | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb99e0a | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eaed0a7 | |
| 0018:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,0133e400,00000000,00000000,00000000,0133e3fc) ret=7eaed0a7 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b790 ret=7eb99d85 | |
| 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eaed0a7 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed680 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed680 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed6a6 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed6a6 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7eaecf73 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b880 ret=7eaecf73 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eaef2c0 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b898 ret=7eaef2c0 | |
| 0018:Call ntdll.RtlInitUnicodeString(0011b8ac,0011b8bc L"\\??\\Volume{00000000-0000-0000-0000-00000000005a}") ret=7eaef2fe | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eaef2fe | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b8ac,0011b850) ret=7eaef3aa | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0133e224,000f0001,0133e228,0011b850) ret=7eb9a0df | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaef3aa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000072) ret=7eaef2c0 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b958 ret=7eaef2c0 | |
| 0018:Call ntdll.RtlInitUnicodeString(0011b96c,0011b97c L"\\DosDevices\\Z:") ret=7eaef2fe | |
| 0018:Ret ntdll.RtlInitUnicodeString() retval=0000001e ret=7eaef2fe | |
| 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b96c,0011b850) ret=7eaef3aa | |
| 0018:Call ntdll.NtCreateSymbolicLinkObject(0133e314,000f0001,0133e318,0011b850) ret=7eb9a0df | |
| 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaef3aa | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaefdfa | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaefdfa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eaefe29 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b9d8 ret=7eaefe29 | |
| 0018:Call advapi32.RegSetValueExW(00000050,0011b8bc L"\\??\\Volume{00000000-0000-0000-0000-00000000005a}",00000000,00000003,0011b9d8,00000004) ret=7eaefe79 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eaefe79 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaefdfa | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaefdfa | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eaefe29 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b9f0 ret=7eaefe29 | |
| 0018:Call advapi32.RegSetValueExW(00000050,0011b97c L"\\DosDevices\\Z:",00000000,00000003,0011b9f0,00000004) ret=7eaefe79 | |
| 0018:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eaefe79 | |
| 0018:Call advapi32.RegCloseKey(00000000) ret=7eaef1bb | |
| 0018:Ret advapi32.RegCloseKey() retval=00000006 ret=7eaef1bb | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011afd0) ret=7eaef1e1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaef1e1 | |
| 0018:Ret ntoskrnl.exe.IoCreateDriver() retval=00000000 ret=7eaf025d | |
| 0018:Call KERNEL32.CreateThread(00000000,00000000,7eaec080,00000000,00000000,00000000) ret=7eaeccc6 | |
| 0018:Ret KERNEL32.CreateThread() retval=00000074 ret=7eaeccc6 | |
| 0018:Call KERNEL32.CloseHandle(00000074) ret=7eaeccd5 | |
| 0018:Ret KERNEL32.CloseHandle() retval=00000001 ret=7eaeccd5 | |
| 0018:Ret driver init 0x7eaf0450 (obj=0x7efff4c0,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MountMgr") retval=00000000 | |
| 0018:Call advapi32.SetServiceStatus(0011a978,0133e934) ret=7effc838 | |
| 0018:Call rpcrt4.NdrClientInitializeNew(0133e5d0,0133e6b0,7ec2eea0,00000007) ret=7ec10084 | |
| 0018:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec10084 | |
| 0018:Call rpcrt4.NDRCContextBinding(0011a978) ret=7ec10097 | |
| 0018:Ret rpcrt4.NDRCContextBinding() retval=0011ac40 ret=7ec10097 | |
| 0018:Call rpcrt4.NdrGetBuffer(0133e6b0,00000038,0011ac40) ret=7ec100bb | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eb4e160 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011afd0 ret=7eb4e160 | |
| 0018:Ret rpcrt4.NdrGetBuffer() retval=0011afd0 ret=7ec100bb | |
| 0018:Call rpcrt4.NdrClientContextMarshall(0133e6b0,0011a978,00000000) ret=7ec100d2 | |
| 001b:Call PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 0018:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec100d2 | |
| 0018:Call rpcrt4.NdrSimpleStructMarshall(0133e6b0,0133e934,7ec1d4b4) ret=7ec100f1 | |
| 0018:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ec100f1 | |
| 0018:Call rpcrt4.NdrSendReceive(0133e6b0,0011b000) ret=7ec10106 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb3e92f | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b010 ret=7eb3e92f | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb3c737 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ba08 ret=7eb3c737 | |
| 0018:Call KERNEL32.WriteFile(00000010,0011ba08,00000048,0133e3bc,00000000) ret=7eb456c2 | |
| 0018:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb456c2 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ba08) ret=7eb3c824 | |
| 001b:Ret PE DLL (proc=0x7eb50850,module=0x7eb00000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3c824 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b010) ret=7eb3e9f1 | |
| 001b:Starting thread proc 0x7eaec080 (arg=(nil)) | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3e9f1 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 0018:Call KERNEL32.ReadFile(00000010,0133e3cc,00000010,0133e37c,00000000) ret=7eb45735 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119688 ret=7ebd1b24 | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119698,00000008,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ebd1bff | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119aa0 ret=7ebd1bff | |
| 0014:Call KERNEL32.ReadFile(0000002c,00119aa0,00000030,01b4e87c,00000000) ret=7ebd9735 | |
| 0014:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ebe2160 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=001195c8 ret=7ebe2160 | |
| 0014:Call ntdll.RtlFreeHeap(00110000,00000000,00119aa0) ret=7ebd1d8f | |
| 0014:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119aa0 ret=7ebd460e | |
| 0014:Call KERNEL32.QueueUserWorkItem(7ebd4f00,00119aa0,00000010) ret=7ebd4657 | |
| 0014:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0014:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0014:Ret ntdll.RtlAllocateHeap() retval=00119830 ret=7ebd4562 | |
| 0014:Call KERNEL32.ReadFile(0000002c,01b4e8cc,00000010,01b4e87c,00000000) ret=7ebd9735 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119948,0234e6c8,7ec33e80) ret=7ec29e8e | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec29e8e | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c8,7ec2f090) ret=7ec29f6d | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119a04,00000001) ret=7ebc6fd7 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=001199e0 ret=7ec29f6d | |
| 0016:Call rpcrt4.NdrSimpleStructUnmarshall(0234e6c8,0234e7ac,7ec2f094,00000000) ret=7ec29f91 | |
| 0016:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ec29f91 | |
| 0016:Call KERNEL32.SetEvent(00000044) ret=7ec21039 | |
| 0016:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec21039 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119948) ret=7ec29ff1 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119a70 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec29ff1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119b40) ret=7ebe2f93 | |
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(00119a04) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119cc8 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ce8 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000002c,00119ce8,0000001c,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119ce8) ret=7ebd0824 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb3db24 | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119cc8) ret=7ebcfda6 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011b010 ret=7eb3db24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0018:Call KERNEL32.ReadFile(00000010,0011b020,00000008,0133e37c,00000000) ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195c8) ret=7ebe21a0 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119a70) ret=7ebe21a0 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eb3dbff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ba08 ret=7eb3dbff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119688) ret=7ebcfda6 | |
| 0018:Call KERNEL32.ReadFile(00000010,0011ba08,00000004,0133e37c,00000000) ret=7eb45735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119948) ret=7ebd4f9e | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 0018:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb45735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eb4e160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ba20 ret=7eb4e160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119aa0) ret=7ebd4feb | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb3ddfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ddfd | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ba08) ret=7eb3dd8f | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3dd8f | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011b010) ret=7eb3ec89 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb3ec89 | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011afd0) ret=7eb4e1a0 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0018:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec10106 | |
| 0018:Call rpcrt4.NdrFreeBuffer(0133e6b0) ret=7ec1018b | |
| 0018:Call ntdll.RtlFreeHeap(00110000,00000000,0011ba20) ret=7eb4e1a0 | |
| 0018:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb4e1a0 | |
| 0018:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec1018b | |
| 0018:Ret advapi32.SetServiceStatus() retval=00000001 ret=7effc838 | |
| 0018:Call ntoskrnl.exe.wine_ntoskrnl_main_loop(0000003c) ret=7effc849 | |
| 0018:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7eb9bcf7 | |
| 0018:Ret ntdll.RtlAllocateHeap() retval=0011ba08 ret=7eb9bcf7 | |
| 0018:Call KERNEL32.WaitForMultipleObjects(00000002,0133e784,00000000,ffffffff) ret=7eb9c0ef | |
| 001a:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| 000f:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ec24d6f | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119980) ret=7ec24d97 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec24d97 | |
| 000f:Call KERNEL32.CloseHandle(00000098) ret=7ec24dca | |
| 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec24dca | |
| 000f:Call KERNEL32.ConnectNamedPipe(00000088,0033fcfc) ret=7ec254bb | |
| 000f:Ret KERNEL32.ConnectNamedPipe() retval=00000000 ret=7ec254bb | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fcf4,00000000,00002710) ret=7ec258fe | |
| 001a:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 001a:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 001a:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 001a:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 001a:Call PE DLL (proc=0x7ec14ec0,module=0x7ebd0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 001a:Ret PE DLL (proc=0x7ec14ec0,module=0x7ebd0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 001a:Starting process L"C:\\windows\\system32\\plugplay.exe" (entryproc=0x7effd980) | |
| 001a:Call advapi32.StartServiceCtrlDispatcherW(7effeef0) ret=7effd970 | |
| 001a:Call PE DLL (proc=0x7eb9a850,module=0x7eb50000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 001a:Ret PE DLL (proc=0x7eb9a850,module=0x7eb50000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 001a:Call rpcrt4.NdrClientInitializeNew(0033f80c,0033f8ec,7ec2eea0,0000000f) ret=7ec118af | |
| 001a:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec118af | |
| 001a:Call rpcrt4.RpcStringBindingComposeW(00000000,0033f774 L"ncacn_np",00000000,0033f786 L"\\pipe\\svcctl",00000000,0033f76c) ret=7ec08c1e | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7eb7f049 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116728 ret=7eb7f049 | |
| 001a:Ret rpcrt4.RpcStringBindingComposeW() retval=00000000 ret=7ec08c1e | |
| 001a:Call rpcrt4.RpcBindingFromStringBindingW(00116728 L"ncacn_np:[\\\\pipe\\\\svcctl]",0033f770) ret=7ec08c82 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7eb7d892 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116848 ret=7eb7d892 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7eb7d892 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116788 ret=7eb7d892 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7eb7d892 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=001167a0 ret=7eb7d892 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb7d77d | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=001167c8 ret=7eb7d77d | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116848 L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7eb7dee3 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7eb7dee3 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb7df08 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=001179d0 ret=7eb7df08 | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116848 L"ncacn_np",ffffffff,001179d0,00000009,00000000,00000000) ret=7eb7df48 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000009 ret=7eb7df48 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb80942 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb80942 | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116788 L"",ffffffff,00000000,00000000,00000000,00000000) ret=7eb7dee3 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7eb7dee3 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb7df08 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=001179e8 ret=7eb7df08 | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,00116788 L"",ffffffff,001179e8,00000001,00000000,00000000) ret=7eb7df48 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=00000001 ret=7eb7df48 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb80979 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb80979 | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001167a0 L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7eb7dee3 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7eb7dee3 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb7df08 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117a00 ret=7eb7df08 | |
| 001a:Call KERNEL32.WideCharToMultiByte(00000000,00000000,001167a0 L"\\pipe\\svcctl",ffffffff,00117a00,0000000d,00000000,00000000) ret=7eb7df48 | |
| 001a:Ret KERNEL32.WideCharToMultiByte() retval=0000000d ret=7eb7df48 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb809ad | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb809ad | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7eb7bdea | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117a18 ret=7eb7bdea | |
| 001a:Call KERNEL32.InitializeCriticalSection(00117a48) ret=7eb7be20 | |
| 001a:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb7be20 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117aa0 ret=7eb7de43 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117ab8 ret=7eb7de43 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117ad0 ret=7eb7de43 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb96a52 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb96a52 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,001167a0) ret=7eb96a52 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb96a52 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116788) ret=7eb96a52 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb96a52 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116848) ret=7eb96a52 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb96a52 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb96a52 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb96a52 | |
| 001a:Ret rpcrt4.RpcBindingFromStringBindingW() retval=00000000 ret=7ec08c82 | |
| 001a:Call rpcrt4.RpcStringFreeW(0033f76c) ret=7ec08c8f | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116728) ret=7eb96a52 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb96a52 | |
| 001a:Ret rpcrt4.RpcStringFreeW() retval=00000000 ret=7ec08c8f | |
| 001a:Call rpcrt4.NdrPointerBufferSize(0033f8ec,00000000,7ec1d55a) ret=7ec118e6 | |
| 001a:Ret rpcrt4.NdrPointerBufferSize() retval=00000012 ret=7ec118e6 | |
| 001a:Call rpcrt4.NdrPointerBufferSize(0033f8ec,00000000,7ec1d6fe) ret=7ec11911 | |
| 001a:Ret rpcrt4.NdrPointerBufferSize() retval=00000012 ret=7ec11911 | |
| 001a:Call rpcrt4.NdrGetBuffer(0033f8ec,00000010,001167c8) ret=7ec1192d | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7eb98160 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116848 ret=7eb98160 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7eb8e4e7 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116728 ret=7eb8e4e7 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117ae8 ret=7eb7de43 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b00 ret=7eb7de43 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7eb98160 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b18 ret=7eb98160 | |
| 001a:Call KERNEL32.CreateFileA(00117b18 "\\\\.\\pipe\\svcctl",c0000000,00000000,00000000,00000003,00000000,00000000) ret=7eb8f49d | |
| 001a:Ret KERNEL32.CreateFileA() retval=00000010 ret=7eb8f49d | |
| 001a:Call KERNEL32.SetNamedPipeHandleState(00000010,0033f54c,00000000,00000000) ret=7eb8f56d | |
| 0015:Ret KERNEL32.ConnectNamedPipe() retval=00000001 ret=7ebda0b3 | |
| 0015:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) | |
| 0015:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) retval=1 | |
| 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000001 ret=7ebdf35c | |
| 0010:Call KERNEL32.GetExitCodeThread(00000058,00b3e95c) ret=7ebdf42e | |
| 0010:Ret KERNEL32.GetExitCodeThread() retval=00000001 ret=7ebdf42e | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ebd84e7 | |
| 001a:Ret KERNEL32.SetNamedPipeHandleState() retval=00000001 ret=7eb8f56d | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119948 ret=7ebd84e7 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b18) ret=7eb981a0 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119a70 ret=7ebc7e43 | |
| 0010:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ebe2160 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb8588b | |
| 0010:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ebe2160 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b18 ret=7eb8588b | |
| 0010:Call KERNEL32.CreateNamedPipeA(00119b40 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7ebd9e2e | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7eb967b5 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b68 ret=7eb967b5 | |
| 001a:Call KERNEL32.InitializeCriticalSection(00117b70) ret=7eb967c9 | |
| 001a:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb967c9 | |
| 0010:Ret KERNEL32.CreateNamedPipeA() retval=0000005c ret=7ebd9e2e | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb86737 | |
| 0010:Call ntdll.RtlFreeHeap(00110000,00000000,00119b40) ret=7ebe21a0 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117bc8 ret=7eb86737 | |
| 0010:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001a:Call KERNEL32.WriteFile(00000010,00117bc8,00000048,0033f51c,00000000) ret=7eb8f6c2 | |
| 0010:Call KERNEL32.CloseHandle(00000000) ret=7ebdf44a | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ebdf44a | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ebd4480,00119948,00000000,00000000) ret=7ebd51a9 | |
| 001a:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb8f6c2 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117bc8) ret=7eb86824 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb86824 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b18) ret=7eb85da6 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb85da6 | |
| 001a:Call KERNEL32.ReadFile(00000010,0033f51c,00000010,0033f4cc,00000000) ret=7eb8f735 | |
| 0010:Ret KERNEL32.CreateThread() retval=0000008c ret=7ebd51a9 | |
| 0010:Call KERNEL32.CloseHandle(0000008c) ret=7ebd51ba | |
| 0010:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ebd51ba | |
| 0010:Call KERNEL32.CreateThread(00000000,00000000,7ebda080,00119360,00000000,00000000) ret=7ebd8783 | |
| 001c:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001c:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001c:Starting thread proc 0x7ebd4480 (arg=0x119948) | |
| 0010:Ret KERNEL32.CreateThread() retval=0000008c ret=7ebd8783 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0010:Call ntdll.RtlReAllocateHeap(00110000,00000000,001192c0,00000008) ret=7ebd881a | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119aa0 ret=7ebd4562 | |
| 0010:Ret ntdll.RtlReAllocateHeap() retval=001192c0 ret=7ebd881a | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebe07b5 | |
| 0010:Call KERNEL32.WaitForMultipleObjectsEx(00000002,001192c0,00000000,ffffffff,00000001) ret=7ebdf35c | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=001195a8 ret=7ebe07b5 | |
| 001c:Call KERNEL32.InitializeCriticalSection(001195b0) ret=7ebe07c9 | |
| 001c:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebe07c9 | |
| 001c:Call KERNEL32.ReadFile(0000003c,02b4e8cc,00000010,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ebd1b24 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119b98 ret=7ebd1b24 | |
| 001c:Call KERNEL32.ReadFile(0000003c,00119ba8,0000000c,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ebd1bff | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ebd1bff | |
| 001c:Call KERNEL32.ReadFile(0000003c,00119bc0,0000002c,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ebe2160 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ebe2160 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119bc0) ret=7ebd1d8f | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd3f87 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=001195e0 ret=7ebd3f87 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ebc777d | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119c30 ret=7ebc777d | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebc7e43 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119b40 ret=7ebc7e43 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bc0 ret=7ebc7e43 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000058) ret=7ebc5dea | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119c80 ret=7ebc5dea | |
| 001c:Call KERNEL32.InitializeCriticalSection(00119cb0) ret=7ebc5e20 | |
| 001c:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ebc5e20 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ebc7e43 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bd8 ret=7ebc7e43 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ebc7e43 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119d08 ret=7ebc7e43 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ebcfa4b | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119d20 ret=7ebcfa4b | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,001195e0) ret=7ebd41db | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd41db | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,00000044) ret=7ebd0737 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119d70 ret=7ebd0737 | |
| 001c:Call KERNEL32.WriteFile(0000003c,00119d70,00000044,02b4e87c,00000000) ret=7ebd96c2 | |
| 001c:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119d70) ret=7ebd0824 | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119d20) ret=7ebcfda6 | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ebe21a0 | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119b98) ret=7ebcfda6 | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119aa0) ret=7ebd4513 | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4513 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4536 | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4536 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119aa0 ret=7ebd4562 | |
| 001c:Call KERNEL32.ReadFile(0000003c,02b4e8cc,00000010,02b4e87c,00000000) ret=7ebd9735 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87b24 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b18 ret=7eb87b24 | |
| 001a:Call KERNEL32.ReadFile(00000010,00117b28,00000008,0033f4cc,00000000) ret=7eb8f735 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb87bff | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117bc8 ret=7eb87bff | |
| 001a:Call KERNEL32.ReadFile(00000010,00117bc8,0000002c,0033f4cc,00000000) ret=7eb8f735 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eb98160 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117c00 ret=7eb98160 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117bc8) ret=7eb87d8f | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87d8f | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117c00) ret=7eb981a0 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b18) ret=7eb85da6 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb85da6 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb7c949 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7c949 | |
| 001a:Ret rpcrt4.NdrGetBuffer() retval=00116848 ret=7ec1192d | |
| 001a:Call rpcrt4.NdrPointerMarshall(0033f8ec,00000000,7ec1d55a) ret=7ec11946 | |
| 001b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7e8185cc "3e74224f-358c-4a88-965c-f0cc01ea2e12",00000024,01b3e554,00000024) ret=7eaeaf65 | |
| 001a:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec11946 | |
| 001b:Ret KERNEL32.MultiByteToWideChar() retval=00000024 ret=7eaeaf65 | |
| 001a:Call rpcrt4.NdrPointerMarshall(0033f8ec,00000000,7ec1d6fe) ret=7ec11965 | |
| 001a:Ret rpcrt4.NdrPointerMarshall() retval=00000000 ret=7ec11965 | |
| 001b:Call ntdll.RtlInitUnicodeString(01b3e548,01b3e552 L"{3e74224f-358c-4a88-965c-f0cc01ea2e12}") ret=7eaeafad | |
| 001a:Call rpcrt4.NdrSendReceive(0033f8ec,00116854) ret=7ec119be | |
| 001b:Ret ntdll.RtlInitUnicodeString() retval=0000004e ret=7eaeafad | |
| 001b:Call ntdll.RtlGUIDFromString(01b3e548,01b3e88c) ret=7eaeafbf | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb8892f | |
| 001b:Ret ntdll.RtlGUIDFromString() retval=00000000 ret=7eaeafbf | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b18 ret=7eb8892f | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000024) ret=7eb86737 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eaecf73 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b38 ret=7eb86737 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011afd0 ret=7eaecf73 | |
| 001a:Call KERNEL32.WriteFile(00000010,00117b38,00000024,0033f5dc,00000000) ret=7eb8f6c2 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed680 | |
| 001a:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb8f6c2 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed680 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b38) ret=7eb86824 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,0011b880) ret=7eaed6a6 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb86824 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed6a6 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b18) ret=7eb889f1 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7eaecf73 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb889f1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011b880 ret=7eaecf73 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000002) ret=7eaecf73 | |
| 001a:Call KERNEL32.ReadFile(00000010,0033f5ec,00000010,0033f59c,00000000) ret=7eb8f735 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011b008 ret=7eaecf73 | |
| 001b:Call advapi32.RegDeleteValueW(00000050,0011b8bc L"\\??\\Volume{00000000-0000-0000-0000-00000000005a}") ret=7eaf0014 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=001195e0 ret=7ebd1b24 | |
| 001c:Call KERNEL32.ReadFile(0000003c,001195f0,00000008,02b4e87c,00000000) ret=7ebd9735 | |
| 001b:Ret advapi32.RegDeleteValueW() retval=00000000 ret=7eaf0014 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001b:Call ntoskrnl.exe.IoDeleteSymbolicLink(0011b8ac) ret=7eaf0022 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ebd1bff | |
| 001b:Call ntdll.NtOpenSymbolicLinkObject(01b3e3e0,00000000,01b3e3e4) ret=7eb9a178 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119b98 ret=7ebd1bff | |
| 001c:Call KERNEL32.ReadFile(0000003c,00119b98,0000000c,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ebe2160 | |
| 001b:Ret ntdll.NtOpenSymbolicLinkObject() retval=00000000 ret=7eb9a178 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ebe2160 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119b98) ret=7ebd1d8f | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 001b:Call ntdll.NtClose(00000074) ret=7eb9a1c2 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119c10 ret=7ebd460e | |
| 001c:Call KERNEL32.QueueUserWorkItem(7ebd4f00,00119c10,00000010) ret=7ebd4657 | |
| 001b:Ret ntdll.NtClose() retval=00000000 ret=7eb9a1c2 | |
| 001b:Ret ntoskrnl.exe.IoDeleteSymbolicLink() retval=00000000 ret=7eaf0022 | |
| 001c:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119aa0,0234e6c0,7ec33e80) ret=7ec2a90e | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec2a90e | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119d20 ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0234e6c0,0234e7a0,7ec2f13a,00000000) ret=7ec2aa03 | |
| 001c:Call KERNEL32.ReadFile(0000003c,02b4e8cc,00000010,02b4e87c,00000000) ret=7ebd9735 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ec2aa03 | |
| 0016:Call rpcrt4.NdrPointerUnmarshall(0234e6c0,0234e7a4,7ec2f2de,00000000) ret=7ec2aa27 | |
| 0016:Ret rpcrt4.NdrPointerUnmarshall() retval=00000000 ret=7ec2aa27 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0234e6c0,7ec2f142) ret=7ec2aa82 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ebc6e7c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119d58 ret=7ebc6e7c | |
| 0016:Call ntdll.RtlInitializeResource(00119d7c) ret=7ebc6e9e | |
| 001d:Call PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001d:Ret PE DLL (proc=0x7ebe4850,module=0x7eb90000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,0011b9d8) ret=7eaf0045 | |
| 001d:Starting thread proc 0x7ebda080 (arg=0x119360) | |
| 001d:Call KERNEL32.ConnectNamedPipe(0000005c,00000000) ret=7ebda0b3 | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ebc6e9e | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119d7c,00000001) ret=7ebc6ebb | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6ebb | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119de0 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119d58 ret=7ec2aa82 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec201c1 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119df8 ret=7ec201c1 | |
| 0016:Call ntdll.RtlMapGenericMask(00119dfc,7ec2e574) ret=7ec20204 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00000001 ret=7ec20204 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119aa0) ret=7ec2aaca | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e10 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec2aaca | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0234e6c0,00119d58,7ec236f0,7ec2f142) ret=7ec2ab01 | |
| 0016:Call advapi32.SystemFunction036(00119d6c,00000010) ret=7ebe1110 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe1110 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119de0) ret=7ebe2f32 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f32 | |
| 0016:Call ntdll.RtlReleaseResource(00119d7c) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ec2ab01 | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,00000000,7ec2f13a) ret=7ec2a88c | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000000 ret=7ec2a88c | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,00000000,7ec2f2de) ret=7ec2a8ad | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=00000000 ret=7ec2a8ad | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e38 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e58 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000003c,00119e58,00000030,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e58) ret=7ebd0824 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87b24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b18 ret=7eb87b24 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e38) ret=7ebcfda6 | |
| 001a:Call KERNEL32.ReadFile(00000010,00117b28,00000008,0033f59c,00000000) ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ebe21a0 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87bff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e10) ret=7ebe21a0 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b38 ret=7eb87bff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001a:Call KERNEL32.ReadFile(00000010,00117b38,00000018,0033f59c,00000000) ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195e0) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 001a:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119aa0) ret=7ebd4f9e | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb98160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117bc8 ret=7eb98160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb87dfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87dfd | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119c10) ret=7ebd4feb | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b38) ret=7eb87d8f | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87d8f | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117b18) ret=7eb88c89 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb88c89 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00116848) ret=7eb981a0 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaf0045 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,0011b898) ret=7eaf0065 | |
| 001a:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec119be | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaf0065 | |
| 001a:Call rpcrt4.NdrClientContextUnmarshall(0033f8ec,0033fafc,001167c8) ret=7ec11a23 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eaef2c0 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb606d1 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011b898 ret=7eaef2c0 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00116848 ret=7eb606d1 | |
| 001b:Call ntdll.RtlInitUnicodeString(0011b8ac,0011b8bc L"\\??\\Volume{3e74224f-358c-4a88-965c-f0cc01ea2e12}") ret=7eaef2fe | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb7d77d | |
| 001b:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eaef2fe | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117b18 ret=7eb7d77d | |
| 001b:Call ntoskrnl.exe.IoCreateSymbolicLink(0011b8ac,0011b850) ret=7eaef3aa | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb7de43 | |
| 001b:Call ntdll.NtCreateSymbolicLinkObject(01b3e2e4,000f0001,01b3e2e8,0011b850) ret=7eb9a0df | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117be8 ret=7eb7de43 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117c00 ret=7eb7de43 | |
| 001a:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb7de43 | |
| 001a:Ret ntdll.RtlAllocateHeap() retval=00117c18 ret=7eb7de43 | |
| 001b:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 001a:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec11a23 | |
| 001b:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaef3aa | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaefdfa | |
| 001a:Call rpcrt4.NdrFreeBuffer(0033f8ec) ret=7ec0ed44 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaefdfa | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117bc8) ret=7eb981a0 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eaefe29 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011b9d8 ret=7eaefe29 | |
| 001a:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec0ed44 | |
| 001b:Call advapi32.RegSetValueExW(00000050,0011b8bc L"\\??\\Volume{3e74224f-358c-4a88-965c-f0cc01ea2e12}",00000000,00000003,0011b9d8,00000004) ret=7eaefe79 | |
| 001a:Call rpcrt4.RpcBindingFree(0033f7b4) ret=7ec08cf8 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00117a00) ret=7eb7dcc1 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7dcc1 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,001179e8) ret=7eb7dce4 | |
| 001b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eaefe79 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7dce4 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,001179d0) ret=7eb7dd07 | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7dd07 | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb7dd2a | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7dd2a | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb7dd4d | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7dd4d | |
| 001a:Call ntdll.RtlFreeHeap(00110000,00000000,001167c8) ret=7eb7dd9b | |
| 001a:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb7dd9b | |
| 001a:Ret rpcrt4.RpcBindingFree() retval=00000000 ret=7ec08cf8 | |
| 001b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7e81912c "1ecfd9e9-2bb1-4773-92e1-f4881019d066",00000024,01b3e554,00000024) ret=7eaeaf65 | |
| 001b:Ret KERNEL32.MultiByteToWideChar() retval=00000024 ret=7eaeaf65 | |
| 001b:Call ntdll.RtlInitUnicodeString(01b3e548,01b3e552 L"{1ecfd9e9-2bb1-4773-92e1-f4881019d066}") ret=7eaeafad | |
| 001b:Ret ntdll.RtlInitUnicodeString() retval=0000004e ret=7eaeafad | |
| 001b:Call ntdll.RtlGUIDFromString(01b3e548,01b3e88c) ret=7eaeafbf | |
| 001b:Ret ntdll.RtlGUIDFromString() retval=00000000 ret=7eaeafbf | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000028) ret=7eaedf1a | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011ca10 ret=7eaedf1a | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7eaed025 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011ca40 ret=7eaed025 | |
| 001b:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,01b3e4f0,00000000,00000000,00000000,01b3e4ec) ret=7eaed0a7 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011ca90 ret=7eb99d85 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,0011ca90) ret=7eb99e0a | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb99e0a | |
| 001b:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eaed0a7 | |
| 001b:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,01b3e4f0,00000000,00000000,00000000,01b3e4ec) ret=7eaed0a7 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ec258fe | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011ca90 ret=7eb99d85 | |
| 000f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec2558d | |
| 000f:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ec2558d | |
| 000f:Call KERNEL32.WriteFile(00000088,00119bf8,00000024,0033fc68,0033fc6c) ret=7ec21714 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,0011ca90) ret=7eb99e0a | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb99e0a | |
| 001b:Ret ntoskrnl.exe.IoCreateDevice() retval=c0000035 ret=7eaed0a7 | |
| 001b:Call ntoskrnl.exe.IoCreateDevice(0011b130,0000002c,01b3e4f0,00000000,00000000,00000000,01b3e4ec) ret=7eaed0a7 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,000000e4) ret=7eb99d85 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011ca90 ret=7eb99d85 | |
| 001b:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=7eaed0a7 | |
| 000f:Ret KERNEL32.WriteFile() retval=00000001 ret=7ec21714 | |
| 000f:Call KERNEL32.ReadFile(00000088,0033fcf4,00000004,0033fc68,0033fc6c) ret=7ec217de | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7eaecf73 | |
| 000f:Ret KERNEL32.ReadFile() retval=00000000 ret=7ec217de | |
| 000f:Call KERNEL32.WaitForSingleObject(00000084,00002710) ret=7ec21922 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011cb80 ret=7eaecf73 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed680 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed680 | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaed6a6 | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaed6a6 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7eaecf73 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011cbb8 ret=7eaecf73 | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,000000b6) ret=7eaef2c0 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011cbd0 ret=7eaef2c0 | |
| 001b:Call ntdll.RtlInitUnicodeString(0011cbe4,0011cbf4 L"\\??\\Volume{1ecfd9e9-2bb1-4773-92e1-f4881019d066}") ret=7eaef2fe | |
| 001b:Ret ntdll.RtlInitUnicodeString() retval=00000062 ret=7eaef2fe | |
| 001b:Call ntoskrnl.exe.IoCreateSymbolicLink(0011cbe4,0011cb50) ret=7eaef3aa | |
| 001e:Call PE DLL (proc=0x7eb9a850,module=0x7eb50000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001b:Call ntdll.NtCreateSymbolicLinkObject(01b3e2e4,000f0001,01b3e2e8,0011cb50) ret=7eb9a0df | |
| 001e:Ret PE DLL (proc=0x7eb9a850,module=0x7eb50000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001e:Starting thread proc 0x7ec098b0 (arg=0x116710) | |
| 001b:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eb9a0df | |
| 001b:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=7eaef3aa | |
| 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eaefdfa | |
| 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eaefdfa | |
| 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000004) ret=7eaefe29 | |
| 001b:Ret ntdll.RtlAllocateHeap() retval=0011cc90 ret=7eaefe29 | |
| 001e:Call rpcrt4.NdrClientInitializeNew(00b3e660,00b3e740,7ec2eea0,00000010) ret=7ec11b82 | |
| 001b:Call advapi32.RegSetValueExW(00000050,0011cbf4 L"\\??\\Volume{1ecfd9e9-2bb1-4773-92e1-f4881019d066}",00000000,00000003,0011cc90,00000004) ret=7eaefe79 | |
| 001e:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec11b82 | |
| 001e:Call rpcrt4.NDRCContextBinding(00116848) ret=7ec11ba1 | |
| 001e:Ret rpcrt4.NDRCContextBinding() retval=00117b18 ret=7ec11ba1 | |
| 001e:Call rpcrt4.NdrConformantStringBufferSize(00b3e740,00117bc8,7ec1d570) ret=7ec11bcd | |
| 001b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7eaefe79 | |
| 001e:Ret rpcrt4.NdrConformantStringBufferSize() retval=00b3e754 ret=7ec11bcd | |
| 001e:Call rpcrt4.NdrGetBuffer(00b3e740,0000003e,00117b18) ret=7ec11be9 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7eb98160 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=001179d0 ret=7eb98160 | |
| 001e:Ret rpcrt4.NdrGetBuffer() retval=001179d0 ret=7ec11be9 | |
| 001e:Call rpcrt4.NdrClientContextMarshall(00b3e740,00116848,00000000) ret=7ec11c06 | |
| 001e:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec11c06 | |
| 001e:Call rpcrt4.NdrConformantStringMarshall(00b3e740,00117bc8,7ec1d570) ret=7ec11c1f | |
| 001e:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec11c1f | |
| 001e:Call rpcrt4.NdrSendReceive(00b3e740,00117a08) ret=7ec11c78 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb8892f | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=001167c8 ret=7eb8892f | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7eb967b5 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=001167e8 ret=7eb967b5 | |
| 001e:Call KERNEL32.InitializeCriticalSection(001167f0) ret=7eb967c9 | |
| 001e:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb967c9 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7eb86737 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c58 ret=7eb86737 | |
| 001e:Call KERNEL32.WriteFile(00000010,00117c58,00000050,00b3e44c,00000000) ret=7eb8f6c2 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=001195e0 ret=7ebd1b24 | |
| 001c:Call KERNEL32.ReadFile(0000003c,001195f0,00000008,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebd1bff | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e10 ret=7ebd1bff | |
| 001c:Call KERNEL32.ReadFile(0000003c,00119e10,00000038,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebe2160 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e50 ret=7ebe2160 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119e10) ret=7ebd1d8f | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e10 ret=7ebd460e | |
| 001c:Call KERNEL32.QueueUserWorkItem(7ebd4f00,00119e10,00000010) ret=7ebd4657 | |
| 001e:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb8f6c2 | |
| 001c:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119d20,0234e6c0,7ec33e80) ret=7ec2b73e | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec2b73e | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e90 ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c0,7ec2f14a) ret=7ec2b824 | |
| 001c:Call KERNEL32.ReadFile(0000003c,02b4e8cc,00000010,02b4e87c,00000000) ret=7ebd9735 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119d7c,00000001) ret=7ebc6fd7 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117c58) ret=7eb86824 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb86824 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,001167c8) ret=7eb889f1 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb889f1 | |
| 001e:Call KERNEL32.ReadFile(00000010,00b3e45c,00000010,00b3e40c,00000000) ret=7eb8f735 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e30 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119d58 ret=7ec2b824 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0234e6c0,0234e7a4,7ec2f150,00000000) ret=7ec2b848 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ec2b848 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0234e6c0,7ec2f152) ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ebc6e7c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119ec8 ret=7ebc6e7c | |
| 0016:Call ntdll.RtlInitializeResource(00119eec) ret=7ebc6e9e | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ebc6e9e | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119eec,00000001) ret=7ebc6ebb | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6ebb | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119de0 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119ec8 ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f8da | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119f58 ret=7ec1f8da | |
| 0016:Call ntdll.RtlMapGenericMask(00119f5c,7ec2e564) ret=7ec1f904 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=00008000 ret=7ec1f904 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119d20) ret=7ec2b8ee | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119f70 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec2b8ee | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0234e6c0,00119ec8,7ec236f0,7ec2f152) ret=7ec2b925 | |
| 0016:Call advapi32.SystemFunction036(00119edc,00000010) ret=7ebe1110 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe1110 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119de0) ret=7ebe2f32 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f32 | |
| 0016:Call ntdll.RtlReleaseResource(00119eec) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ec2b925 | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,00119e70,7ec2f14e) ret=7ec2b9a2 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0234e6c0 ret=7ec2b9a2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e30) ret=7ebe2f93 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(00119d7c) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e30 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119f98 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000003c,00119f98,00000030,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119f98) ret=7ebd0824 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87b24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=001167c8 ret=7eb87b24 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e30) ret=7ebcfda6 | |
| 001e:Call KERNEL32.ReadFile(00000010,001167d8,00000008,00b3e40c,00000000) ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e50) ret=7ebe21a0 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87bff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119f70) ret=7ebe21a0 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c58 ret=7eb87bff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001e:Call KERNEL32.ReadFile(00000010,00117c58,00000018,00b3e40c,00000000) ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195e0) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119d20) ret=7ebd4f9e | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb98160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c78 ret=7eb98160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb87dfd | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e10) ret=7ebd4feb | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87dfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117c58) ret=7eb87d8f | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87d8f | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,001167c8) ret=7eb88c89 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb88c89 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,001179d0) ret=7eb981a0 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001e:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec11c78 | |
| 001e:Call rpcrt4.NdrClientContextUnmarshall(00b3e740,00b3e94c,00117b18) ret=7ec11cd1 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb606d1 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=001179d0 ret=7eb606d1 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb7d77d | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c98 ret=7eb7d77d | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb7de43 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=001167c8 ret=7eb7de43 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb7de43 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c58 ret=7eb7de43 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb7de43 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117ce8 ret=7eb7de43 | |
| 001e:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec11cd1 | |
| 001e:Call rpcrt4.NdrFreeBuffer(00b3e740) ret=7ec11d1d | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117c78) ret=7eb981a0 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001e:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec11d1d | |
| 001e:Call rpcrt4.NdrClientInitializeNew(00b3e660,00b3e740,7ec2eea0,00000010) ret=7ec11b82 | |
| 001e:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec11b82 | |
| 001e:Call rpcrt4.NDRCContextBinding(00116848) ret=7ec11ba1 | |
| 001e:Ret rpcrt4.NDRCContextBinding() retval=00117b18 ret=7ec11ba1 | |
| 001e:Call rpcrt4.NdrConformantStringBufferSize(00b3e740,00117bc8,7ec1d570) ret=7ec11bcd | |
| 001e:Ret rpcrt4.NdrConformantStringBufferSize() retval=00b3e754 ret=7ec11bcd | |
| 001e:Call rpcrt4.NdrGetBuffer(00b3e740,0000003e,00117b18) ret=7ec11be9 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003e) ret=7eb98160 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d00 ret=7eb98160 | |
| 001e:Ret rpcrt4.NdrGetBuffer() retval=00117d00 ret=7ec11be9 | |
| 001e:Call rpcrt4.NdrClientContextMarshall(00b3e740,00116848,00000000) ret=7ec11c06 | |
| 001e:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec11c06 | |
| 001e:Call rpcrt4.NdrConformantStringMarshall(00b3e740,00117bc8,7ec1d570) ret=7ec11c1f | |
| 001e:Ret rpcrt4.NdrConformantStringMarshall() retval=00000000 ret=7ec11c1f | |
| 001e:Call rpcrt4.NdrSendReceive(00b3e740,00117d38) ret=7ec11c78 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb8892f | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c78 ret=7eb8892f | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000050) ret=7eb86737 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d48 ret=7eb86737 | |
| 001e:Call KERNEL32.WriteFile(00000010,00117d48,00000050,00b3e44c,00000000) ret=7eb8f6c2 | |
| 001e:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb8f6c2 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117d48) ret=7eb86824 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb86824 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=001195e0 ret=7ebd1b24 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117c78) ret=7eb889f1 | |
| 001c:Call KERNEL32.ReadFile(0000003c,001195f0,00000008,02b4e87c,00000000) ret=7ebd9735 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb889f1 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001e:Call KERNEL32.ReadFile(00000010,00b3e45c,00000010,00b3e40c,00000000) ret=7eb8f735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebd1bff | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e10 ret=7ebd1bff | |
| 001c:Call KERNEL32.ReadFile(0000003c,00119e10,00000038,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ebe2160 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e50 ret=7ebe2160 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119e10) ret=7ebd1d8f | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e10 ret=7ebd460e | |
| 001c:Call KERNEL32.QueueUserWorkItem(7ebd4f00,00119e10,00000010) ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119e90,0234e6c0,7ec33e80) ret=7ec2b73e | |
| 001c:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec2b73e | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c0,7ec2f14a) ret=7ec2b824 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119d20 ret=7ebd4562 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119d7c,00000001) ret=7ebc6fd7 | |
| 001c:Call KERNEL32.ReadFile(0000003c,02b4e8cc,00000010,02b4e87c,00000000) ret=7ebd9735 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e30 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119d58 ret=7ec2b824 | |
| 0016:Call rpcrt4.NdrConformantStringUnmarshall(0234e6c0,0234e7a4,7ec2f150,00000000) ret=7ec2b848 | |
| 0016:Ret rpcrt4.NdrConformantStringUnmarshall() retval=00000000 ret=7ec2b848 | |
| 0016:Call rpcrt4.NdrContextHandleInitialize(0234e6c0,7ec2f152) ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000060) ret=7ebc6e7c | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119f70 ret=7ebc6e7c | |
| 0016:Call ntdll.RtlInitializeResource(00119f94) ret=7ebc6e9e | |
| 0016:Ret ntdll.RtlInitializeResource() retval=00000000 ret=7ebc6e9e | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119f94,00000001) ret=7ebc6ebb | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6ebb | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119de0 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrContextHandleInitialize() retval=00119f70 ret=7ec2b8a3 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f8da | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=0011a000 ret=7ec1f8da | |
| 0016:Call ntdll.RtlMapGenericMask(0011a004,7ec2e564) ret=7ec1f904 | |
| 0016:Ret ntdll.RtlMapGenericMask() retval=0002008f ret=7ec1f904 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119e90) ret=7ec2b8ee | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ebe2160 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=0011a018 ret=7ebe2160 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec2b8ee | |
| 0016:Call rpcrt4.NdrServerContextNewMarshall(0234e6c0,00119f70,7ec236f0,7ec2f152) ret=7ec2b925 | |
| 0016:Call advapi32.SystemFunction036(00119f84,00000010) ret=7ebe1110 | |
| 0016:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe1110 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119de0) ret=7ebe2f32 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f32 | |
| 0016:Call ntdll.RtlReleaseResource(00119f94) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Ret rpcrt4.NdrServerContextNewMarshall() retval=00000001 ret=7ec2b925 | |
| 0016:Call rpcrt4.NdrPointerFree(0234e6c0,00119e70,7ec2f14e) ret=7ec2b9a2 | |
| 0016:Ret rpcrt4.NdrPointerFree() retval=0234e6c0 ret=7ec2b9a2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e30) ret=7ebe2f93 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(00119d7c) ret=7ebc7383 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e30 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=0011a040 ret=7ebd0737 | |
| 0016:Call KERNEL32.WriteFile(0000003c,0011a040,00000030,0234e72c,00000000) ret=7ebd96c2 | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,0011a040) ret=7ebd0824 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87b24 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c78 ret=7eb87b24 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e30) ret=7ebcfda6 | |
| 001e:Call KERNEL32.ReadFile(00000010,00117c88,00000008,00b3e40c,00000000) ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e50) ret=7ebe21a0 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87bff | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d48 ret=7eb87bff | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,0011a018) ret=7ebe21a0 | |
| 001e:Call KERNEL32.ReadFile(00000010,00117d48,00000018,00b3e40c,00000000) ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195e0) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e90) ret=7ebd4f9e | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb98160 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d68 ret=7eb98160 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb87dfd | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87dfd | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e10) ret=7ebd4feb | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117d48) ret=7eb87d8f | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87d8f | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117c78) ret=7eb88c89 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb88c89 | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117d00) ret=7eb981a0 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001e:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec11c78 | |
| 001e:Call rpcrt4.NdrClientContextUnmarshall(00b3e740,00b3e94c,00117b18) ret=7ec11cd1 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7eb606d1 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d00 ret=7eb606d1 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb7d77d | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d88 ret=7eb7d77d | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7eb7de43 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117c78 ret=7eb7de43 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000001) ret=7eb7de43 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d30 ret=7eb7de43 | |
| 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7eb7de43 | |
| 001e:Ret ntdll.RtlAllocateHeap() retval=00117d48 ret=7eb7de43 | |
| 001e:Ret rpcrt4.NdrClientContextUnmarshall() retval=00000000 ret=7ec11cd1 | |
| 001e:Call rpcrt4.NdrFreeBuffer(00b3e740) ret=7ec11d1d | |
| 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00117d68) ret=7eb981a0 | |
| 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001e:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec11d1d | |
| 001f:Call PE DLL (proc=0x7eb9a850,module=0x7eb50000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) | |
| 001f:Ret PE DLL (proc=0x7eb9a850,module=0x7eb50000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 | |
| 001f:Starting thread proc 0x7ec08640 (arg=0x1154e0) | |
| 001f:Call KERNEL32.CreateEventW(00000000,00000001,00000000,00000000) ret=7effd6bf | |
| 001f:Ret KERNEL32.CreateEventW() retval=0000003c ret=7effd6bf | |
| 001f:Call advapi32.RegisterServiceCtrlHandlerExW(7efff248 L"PlugPlay",7effd800,00000000) ret=7effd6e8 | |
| 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ec21922 | |
| 001f:Ret advapi32.RegisterServiceCtrlHandlerExW() retval=001179d0 ret=7effd6e8 | |
| 000f:Call KERNEL32.GetOverlappedResult(00000088,0033fc6c,0033fc68,00000000) ret=7ec21896 | |
| 001f:Call advapi32.SetServiceStatus(001179d0,0133e934) ret=7effd739 | |
| 000f:Ret KERNEL32.GetOverlappedResult() retval=00000001 ret=7ec21896 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ec256b4 | |
| 001f:Call rpcrt4.NdrClientInitializeNew(0133e5e0,0133e6c0,7ec2eea0,00000007) ret=7ec10084 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec256b4 | |
| 001f:Ret rpcrt4.NdrClientInitializeNew() retval=7ec08980 ret=7ec10084 | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fcfc,00000000,00002710) ret=7ec25729 | |
| 001f:Call rpcrt4.NDRCContextBinding(001179d0) ret=7ec10097 | |
| 001f:Ret rpcrt4.NDRCContextBinding() retval=00117c98 ret=7ec10097 | |
| 001f:Call rpcrt4.NdrGetBuffer(0133e6c0,00000038,00117c98) ret=7ec100bb | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eb98160 | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117dd8 ret=7eb98160 | |
| 001f:Ret rpcrt4.NdrGetBuffer() retval=00117dd8 ret=7ec100bb | |
| 001f:Call rpcrt4.NdrClientContextMarshall(0133e6c0,001179d0,00000000) ret=7ec100d2 | |
| 001f:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ec100d2 | |
| 001f:Call rpcrt4.NdrSimpleStructMarshall(0133e6c0,0133e934,7ec1d4b4) ret=7ec100f1 | |
| 001f:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ec100f1 | |
| 001f:Call rpcrt4.NdrSendReceive(0133e6c0,00117e08) ret=7ec10106 | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7eb8892f | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117e18 ret=7eb8892f | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7eb967b5 | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117e38 ret=7eb967b5 | |
| 001f:Call KERNEL32.InitializeCriticalSection(00117e40) ret=7eb967c9 | |
| 001f:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7eb967c9 | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7eb86737 | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117e98 ret=7eb86737 | |
| 001f:Call KERNEL32.WriteFile(00000010,00117e98,00000048,0133e3cc,00000000) ret=7eb8f6c2 | |
| 001f:Ret KERNEL32.WriteFile() retval=00000001 ret=7eb8f6c2 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e98) ret=7eb86824 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ebd1b24 | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb86824 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=001195e0 ret=7ebd1b24 | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e18) ret=7eb889f1 | |
| 001c:Call KERNEL32.ReadFile(0000003c,001195f0,00000008,02b4e87c,00000000) ret=7ebd9735 | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb889f1 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001f:Call KERNEL32.ReadFile(00000010,0133e3dc,00000010,0133e38c,00000000) ret=7eb8f735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ebd1bff | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ebd1bff | |
| 001c:Call KERNEL32.ReadFile(0000003c,00119bf8,00000030,02b4e87c,00000000) ret=7ebd9735 | |
| 001c:Ret KERNEL32.ReadFile() retval=00000001 ret=7ebd9735 | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ebe2160 | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e10 ret=7ebe2160 | |
| 001c:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ebd1d8f | |
| 001c:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd1d8f | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ebd460e | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119bf8 ret=7ebd460e | |
| 001c:Call KERNEL32.QueueUserWorkItem(7ebd4f00,00119bf8,00000010) ret=7ebd4657 | |
| 0016:Call rpcrt4.NdrServerInitializeNew(00119d20,0234e6c8,7ec33e80) ret=7ec29e8e | |
| 001c:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7ebd4657 | |
| 0016:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ec29e8e | |
| 001c:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7ebd4562 | |
| 0016:Call rpcrt4.NdrServerContextNewUnmarshall(0234e6c8,7ec2f090) ret=7ec29f6d | |
| 001c:Ret ntdll.RtlAllocateHeap() retval=00119e48 ret=7ebd4562 | |
| 0016:Call ntdll.RtlAcquireResourceExclusive(00119eec,00000001) ret=7ebc6fd7 | |
| 001c:Call KERNEL32.ReadFile(0000003c,02b4e8cc,00000010,02b4e87c,00000000) ret=7ebd9735 | |
| 0016:Ret ntdll.RtlAcquireResourceExclusive() retval=00000001 ret=7ebc6fd7 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2e98 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119de0 ret=7ebe2e98 | |
| 0016:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119ec8 ret=7ec29f6d | |
| 0016:Call rpcrt4.NdrSimpleStructUnmarshall(0234e6c8,0234e7ac,7ec2f094,00000000) ret=7ec29f91 | |
| 0016:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ec29f91 | |
| 0016:Call KERNEL32.SetEvent(00000080) ret=7ec21039 | |
| 000f:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ec25729 | |
| 000f:Call KERNEL32.ReleaseMutex(0000007c) ret=7ec2541d | |
| 0016:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec21039 | |
| 0016:Call rpcrt4.I_RpcGetBuffer(00119d20) ret=7ec29ff1 | |
| 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7ec2541d | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ebe2160 | |
| 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00119470) ret=7ec1f378 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e80 ret=7ebe2160 | |
| 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f378 | |
| 0016:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ec29ff1 | |
| 000f:Call ntdll.__wine_make_process_system() ret=7ec23349 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119de0) ret=7ebe2f93 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe2f93 | |
| 0016:Call ntdll.RtlReleaseResource(00119eec) ret=7ebc7383 | |
| 000f:Ret ntdll.__wine_make_process_system() retval=000000b0 ret=7ec23349 | |
| 0016:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7ebc7383 | |
| 000f:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7ec23370 | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ebcf77b | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119e98 ret=7ebcf77b | |
| 0016:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7ebd0737 | |
| 0016:Ret ntdll.RtlAllocateHeap() retval=00119470 ret=7ebd0737 | |
| 000f:Ret KERNEL32.CreateEventW() retval=000000b4 ret=7ec23370 | |
| 0016:Call KERNEL32.WriteFile(0000003c,00119470,0000001c,0234e72c,00000000) ret=7ebd96c2 | |
| 000f:Call KERNEL32.SetEvent(00000018) ret=7ec2338c | |
| 0016:Ret KERNEL32.WriteFile() retval=00000001 ret=7ebd96c2 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119470) ret=7ebd0824 | |
| 001f:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 000f:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec2338c | |
| 000b:Ret KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7ec21082 | |
| 000f:Call KERNEL32.WaitForMultipleObjects(00000002,0033fd00,00000000,ffffffff) ret=7ec2340c | |
| 000b:Call KERNEL32.CloseHandle(0000002c) ret=7ec2109c | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7eb87b24 | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec2109c | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117e18 ret=7eb87b24 | |
| 000b:Call KERNEL32.CloseHandle(00000024) ret=7ec210ab | |
| 001f:Call KERNEL32.ReadFile(00000010,00117e28,00000008,0133e38c,00000000) ret=7eb8f735 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd0824 | |
| 001f:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eb87bff | |
| 000b:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ec210ab | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117e98 ret=7eb87bff | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec20a37 | |
| 001f:Call KERNEL32.ReadFile(00000010,00117e98,00000004,0133e38c,00000000) ret=7eb8f735 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00116840 ret=7ec20a37 | |
| 001f:Ret KERNEL32.ReadFile() retval=00000001 ret=7eb8f735 | |
| 001f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eb98160 | |
| 000b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000044) ret=7ec20ae4 | |
| 001f:Ret ntdll.RtlAllocateHeap() retval=00117eb0 ret=7eb98160 | |
| 000b:Ret ntdll.RtlAllocateHeap() retval=00116868 ret=7ec20ae4 | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eb87dfd | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87dfd | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e98) ret=7eb87d8f | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00116868) ret=7ec20b72 | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb87d8f | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec20b72 | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00117e18) ret=7eb88c89 | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00116840) ret=7ec20dbb | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb88c89 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec20dbb | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00117dd8) ret=7eb981a0 | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 000b:Call advapi32.RegCreateKeyExW(80000001,7ec249e0 L"Volatile Environment",00000000,00000000,00000001,000f003f,00000000,0033f0e4,00000000) ret=7ec1fe01 | |
| 001f:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ec10106 | |
| 001f:Call rpcrt4.NdrFreeBuffer(0133e6c0) ret=7ec1018b | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e98) ret=7ebcfda6 | |
| 001f:Call ntdll.RtlFreeHeap(00110000,00000000,00117eb0) ret=7eb981a0 | |
| 001f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eb981a0 | |
| 001f:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ec1018b | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 001f:Ret advapi32.SetServiceStatus() retval=00000001 ret=7effd739 | |
| 001f:Call KERNEL32.WaitForSingleObject(0000003c,ffffffff) ret=7effd752 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e10) ret=7ebe21a0 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119e80) ret=7ebe21a0 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebe21a0 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,001195e0) ret=7ebcfda6 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebcfda6 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119d20) ret=7ebd4f9e | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec1fe01 | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4f9e | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ebd4fc1 | |
| 000b:Call KERNEL32.LoadLibraryA(7ec2d94c "shell32.dll") ret=7ec23aee | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4fc1 | |
| 0016:Call ntdll.RtlFreeHeap(00110000,00000000,00119bf8) ret=7ebd4feb | |
| 0016:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ebd4feb | |
| 000b:Call PE DLL (proc=0x7e70a6e0,module=0x7e680000 L"gdi32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Ret PE DLL (proc=0x7e7ba6e0,module=0x7e730000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7eff0000) ret=7effc400 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7effc400 | |
| 000d:Ret PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e8f9fb0,module=0x7e850000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7e8f9fb0,module=0x7e850000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e6f8850,module=0x7e6b0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7e6f8850,module=0x7e6b0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7eafbd40,module=0x7ea20000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Ret PE DLL (proc=0x7eafbd40,module=0x7ea20000 L"ole32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e6367f0,module=0x7e570000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.GetEnvironmentVariableW(7e639ff0 L"oanocache",00000000,00000000) ret=7e57d4d1 | |
| 000d:Ret KERNEL32.GetEnvironmentVariableW() retval=00000000 ret=7e57d4d1 | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e570000) ret=7e5e4d40 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e5e4d40 | |
| 000d:Ret PE DLL (proc=0x7e6367f0,module=0x7e570000 L"oleaut32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e5272a0,module=0x7e4f0000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e4f0000) ret=7e5189e1 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e5189e1 | |
| 000d:Call KERNEL32.TlsAlloc() ret=7e5189ef | |
| 000d:Ret KERNEL32.TlsAlloc() retval=00000001 ret=7e5189ef | |
| 000d:Ret PE DLL (proc=0x7e5272a0,module=0x7e4f0000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7ebd8700,module=0x7eb60000 L"windowscodecs.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7eb60000) ret=7eb8a74b | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7eb8a74b | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7eb60000) ret=7eba59b0 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7eba59b0 | |
| 000d:Ret PE DLL (proc=0x7ebd8700,module=0x7eb60000 L"windowscodecs.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Call PE DLL (proc=0x7e33c4f0,module=0x7e2b0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000d:Call KERNEL32.DisableThreadLibraryCalls(7e2b0000) ret=7e2eb227 | |
| 000d:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e2eb227 | |
| 000d:Call KERNEL32.GetModuleFileNameW(7e2b0000,7e4d9600,00000104) ret=7e2eb244 | |
| 000d:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7e2eb244 | |
| 000d:Ret PE DLL (proc=0x7e33c4f0,module=0x7e2b0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 000d:Starting process L"C:\\windows\\system32\\winemenubuilder.exe" (entryproc=0x7ec299b0) | |
| 000d:Call KERNEL32.GetCommandLineW() ret=7ec29a69 | |
| 000d:Ret KERNEL32.GetCommandLineW() retval=00220608 ret=7ec29a69 | |
| 000d:Call KERNEL32.GetStartupInfoW(0033fdcc) ret=7ec29ac6 | |
| 000d:Ret KERNEL32.GetStartupInfoW() retval=7b83abd0 ret=7ec29ac6 | |
| 000d:Call KERNEL32.GetModuleHandleW(00000000) ret=7ec29ae9 | |
| 000d:Ret KERNEL32.GetModuleHandleW() retval=7ec10000 ret=7ec29ae9 | |
| 000d:Call shell32.SHGetFolderPathW(00000000,00000000,00000000,00000000,0033fa48) ret=7ec22264 | |
| 000d:Call advapi32.RegCreateKeyW(80000001,7e349bc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033edd4) ret=7e301878 | |
| 000d:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e301878 | |
| 000d:Call advapi32.RegCreateKeyW(80000001,7e349b20 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033edd0) ret=7e301954 | |
| 000d:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e301954 | |
| 000d:Call advapi32.RegQueryValueExW(00000064,7e34a580 L"Desktop",00000000,0033edc8,0033f758,0033edcc) ret=7e30199c | |
| 000d:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e30199c | |
| 000d:Call advapi32.RegCreateKeyExW(80000002,7e349cc0 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033e750,0033eb68) ret=7e3012f0 | |
| 000d:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e3012f0 | |
| 000d:Call KERNEL32.GetSystemDirectoryW(0033eb68,00000104) ret=7e3016b8 | |
| 000d:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e3016b8 | |
| 000d:Call advapi32.RegQueryValueExW(00000068,7e349c80 L"ProfilesDirectory",00000000,0033e6d8,0033e960,0033e6dc) ret=7e300c10 | |
| 000d:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e300c10 | |
| 000d:Call advapi32.GetUserNameW(0033eb68,0033e754) ret=7e3014e0 | |
| 000d:Ret advapi32.GetUserNameW() retval=00000001 ret=7e3014e0 | |
| 000d:Call shlwapi.PathAppendW(0033f1e8 L"C:\\users",0033eb68 L"alfonsojon") ret=7e3014ef | |
| 000d:Ret shlwapi.PathAppendW() retval=00000001 ret=7e3014ef | |
| 000d:Call shlwapi.PathAppendW(0033f1e8 L"C:\\users\\alfonsojon",0033e772 L"\\Desktop") ret=7e30151c | |
| 000d:Ret shlwapi.PathAppendW() retval=00000001 ret=7e30151c | |
| 000d:Call advapi32.RegCloseKey(00000068) ret=7e3011c6 | |
| 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7e3011c6 | |
| 000d:Call advapi32.RegSetValueExW(00000060,7e34a580 L"Desktop",00000000,00000001,0033f758,00000038) ret=7e301aaa | |
| 000d:Ret advapi32.RegSetValueExW() retval=00000000 ret=7e301aaa | |
| 000d:Call advapi32.RegCloseKey(00000060) ret=7e3019c3 | |
| 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7e3019c3 | |
| 000d:Call advapi32.RegCloseKey(00000064) ret=7e3019d4 | |
| 000d:Ret advapi32.RegCloseKey() retval=00000000 ret=7e3019d4 | |
| 000d:Call shlwapi.PathFileExistsW(0033f550 L"C:\\users\\alfonsojon\\Desktop") ret=7e305d4d | |
| 000d:Call KERNEL32.SetErrorMode(00000001) ret=7e509eec | |
| 000d:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e509eec | |
| 000d:Call KERNEL32.GetFileAttributesW(0033f550 L"C:\\users\\alfonsojon\\Desktop") ret=7e509ef9 | |
| 000d:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e509ef9 | |
| 000d:Call KERNEL32.SetErrorMode(00000000) ret=7e509f06 | |
| 000d:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e509f06 | |
| 000d:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7e305d4d | |
| 000d:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec22264 | |
| 000d:Call KERNEL32.wine_get_unix_file_name(0033fa48 L"C:\\users\\alfonsojon\\Desktop") ret=7ec22277 | |
| 000d:Ret KERNEL32.wine_get_unix_file_name() retval=001418a8 ret=7ec22277 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a10 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00141a10,00000033) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00141a10 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a50 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00141a50,0000001e) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00141a50 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a78 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00141a78,00000032) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00141a78 ret=7ec1f645 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00141a78) ret=7ec22348 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec22348 | |
| 000d:Call ole32.CoInitialize(00000000) ret=7ec26804 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,000000fc) ret=7ea43f49 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141a78 ret=7ea43f49 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ea6c9c7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141858 ret=7ea6c9c7 | |
| 000d:Call KERNEL32.InitializeCriticalSection(00141868) ret=7ea6c9f7 | |
| 000d:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ea6c9f7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000008,00000088) ret=7ea40de4 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00141ba8 ret=7ea40de4 | |
| 000d:Call KERNEL32.InitializeCriticalSection(00141bcc) ret=7ea40e44 | |
| 000d:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ea40e44 | |
| 000d:Call KERNEL32.InitOnceExecuteOnce(7eb4d060,7ea3fa40,00000000,00000000) ret=7ea437a8 | |
| 000d:Call user32.RegisterClassW(0033fa48) ret=7ea3fa8f | |
| trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError" | |
| trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32" | |
| 0021:Call KERNEL32.__wine_kernel_init() ret=7bc5ae03 | |
| 0021:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Call PE DLL (proc=0x7eb6cec0,module=0x7eb30000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Ret PE DLL (proc=0x7eb6cec0,module=0x7eb30000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Call PE DLL (proc=0x7ebe8850,module=0x7eba0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Ret PE DLL (proc=0x7ebe8850,module=0x7eba0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Call PE DLL (proc=0x7e93a6e0,module=0x7e8b0000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e70a6e0,module=0x7e680000 L"gdi32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Call KERNEL32.DisableThreadLibraryCalls(7eff0000) ret=7effc400 | |
| 000b:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7effc400 | |
| 000b:Ret PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e849fb0,module=0x7e7a0000 L"user32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Ret PE DLL (proc=0x7e849fb0,module=0x7e7a0000 L"user32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e9372a0,module=0x7e900000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Call KERNEL32.DisableThreadLibraryCalls(7e900000) ret=7e9289e1 | |
| 000b:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e9289e1 | |
| 000b:Call KERNEL32.TlsAlloc() ret=7e9289ef | |
| 000b:Ret KERNEL32.TlsAlloc() retval=00000001 ret=7e9289ef | |
| 000b:Ret PE DLL (proc=0x7e9372a0,module=0x7e900000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e9fc4f0,module=0x7e970000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Call KERNEL32.DisableThreadLibraryCalls(7e970000) ret=7e9ab227 | |
| 000b:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e9ab227 | |
| 000b:Call KERNEL32.GetModuleFileNameW(7e970000,7eb99600,00000104) ret=7e9ab244 | |
| 000b:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7e9ab244 | |
| 000b:Ret PE DLL (proc=0x7e9fc4f0,module=0x7e970000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Ret KERNEL32.LoadLibraryA() retval=7e970000 ret=7ec23aee | |
| 000b:Call KERNEL32.GetProcAddress(7e970000,7ec2d98e "SHGetFolderPathW") ret=7ec23ac4 | |
| 000b:Ret KERNEL32.GetProcAddress() retval=7e97fd90 ret=7ec23ac4 | |
| 000b:Call shell32.SHGetFolderPathW(00000000,0000001a,00000000,00000000,0033f4f4) ret=7ec2081b | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea09bc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e204) ret=7e9c1878 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1878 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea09b20 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e200) ret=7e9c1954 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1954 | |
| 000b:Call advapi32.RegQueryValueExW(00000048,7ea0a8a2 L"AppData",00000000,0033e1f8,0033eb88,0033e1fc) ret=7e9c199c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9c199c | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ea09cc0 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033db80,0033df98) ret=7e9c12f0 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e9c12f0 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033df98,00000104) ret=7e9c16b8 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e9c16b8 | |
| 000b:Call advapi32.RegQueryValueExW(0000004c,7ea09c80 L"ProfilesDirectory",00000000,0033db08,0033dd90,0033db0c) ret=7e9c0c10 | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9c0c10 | |
| 000b:Call advapi32.GetUserNameW(0033df98,0033db84) ret=7e9c14e0 | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7e9c14e0 | |
| 000b:Call shlwapi.PathAppendW(0033e618 L"C:\\users",0033df98 L"alfonsojon") ret=7e9c14ef | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9c14ef | |
| 000b:Call shlwapi.PathAppendW(0033e618 L"C:\\users\\alfonsojon",0033dba2 L"\\Application Data") ret=7e9c151c | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9c151c | |
| 000b:Call advapi32.RegCloseKey(0000004c) ret=7e9c11c6 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c11c6 | |
| 000b:Call advapi32.RegSetValueExW(00000040,7ea0a8a2 L"AppData",00000000,00000001,0033eb88,0000004a) ret=7e9c1aaa | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7e9c1aaa | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7e9c19c3 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19c3 | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7e9c19d4 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19d4 | |
| 000b:Call shlwapi.PathFileExistsW(0033e980 L"C:\\users\\alfonsojon\\Application Data") ret=7e9c5d4d | |
| 000b:Call KERNEL32.SetErrorMode(00000001) ret=7e919eec | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e919eec | |
| 000b:Call KERNEL32.GetFileAttributesW(0033e980 L"C:\\users\\alfonsojon\\Application Data") ret=7e919ef9 | |
| 000b:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e919ef9 | |
| 000b:Call KERNEL32.SetErrorMode(00000000) ret=7e919f06 | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e919f06 | |
| 000b:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7e9c5d4d | |
| 000b:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec2081b | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec249d0 L"APPDATA",00000000,00000001,0033f4f4,0000004a) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec249ba L"CLIENTNAME",00000000,00000001,7ec249aa,00000010) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call shell32.SHGetFolderPathW(00000000,00000028,00000000,00000000,0033f4f4) ret=7ec2087e | |
| 000b:Call KERNEL32.LoadLibraryA(7ea3e0d8 "ole32.dll") ret=7e9fc4be | |
| 000b:Call PE DLL (proc=0x7e323850,module=0x7e2d0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Ret PE DLL (proc=0x7e323850,module=0x7e2d0000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Call PE DLL (proc=0x7e439d40,module=0x7e360000 L"ole32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 000b:Ret PE DLL (proc=0x7e439d40,module=0x7e360000 L"ole32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000b:Ret KERNEL32.LoadLibraryA() retval=7e360000 ret=7e9fc4be | |
| 000b:Call KERNEL32.GetProcAddress(7e360000,7ea3e23b "StringFromGUID2") ret=7e9fc494 | |
| 000b:Ret KERNEL32.GetProcAddress() retval=7e36fe08 ret=7e9fc494 | |
| 000b:Call ole32.StringFromGUID2(7ea1466c,0033e87c,00000027) ret=7e9c1fc2 | |
| 000b:Ret ole32.StringFromGUID2() retval=00000027 ret=7e9c1fc2 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea09bc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e204) ret=7e9c1878 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1878 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea09b20 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e200) ret=7e9c1954 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1954 | |
| 000b:Call advapi32.RegQueryValueExW(00000048,0033e87c L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}",00000000,0033e1f8,0033eb88,0033e1fc) ret=7e9c199c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7e9c199c | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7e9c19c3 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19c3 | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7e9c19d4 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19d4 | |
| 000b:Call advapi32.RegCreateKeyW(80000002,7ea09bc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e204) ret=7e9c1878 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1878 | |
| 000b:Call advapi32.RegCreateKeyW(80000002,7ea09b20 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e200) ret=7e9c1954 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1954 | |
| 000b:Call advapi32.RegQueryValueExW(00000048,0033e87c L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}",00000000,0033e1f8,0033eb88,0033e1fc) ret=7e9c199c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000002 ret=7e9c199c | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7e9c19c3 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19c3 | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7e9c19d4 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19d4 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ea09cc0 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033e2f0,0033e708) ret=7e9c12f0 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e9c12f0 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033e708,00000104) ret=7e9c16b8 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e9c16b8 | |
| 000b:Call advapi32.RegQueryValueExW(00000040,7ea09c80 L"ProfilesDirectory",00000000,0033e278,0033e500,0033e27c) ret=7e9c0c10 | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9c0c10 | |
| 000b:Call advapi32.GetUserNameW(0033e708,0033e2f4) ret=7e9c14e0 | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7e9c14e0 | |
| 000b:Call shlwapi.PathAppendW(0033e980 L"C:\\users",0033e708 L"alfonsojon") ret=7e9c14ef | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9c14ef | |
| 000b:Call shlwapi.PathAppendW(0033e980 L"C:\\users\\alfonsojon",0033e312 L"") ret=7e9c151c | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9c151c | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7e9c11c6 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c11c6 | |
| 000b:Call shlwapi.PathFileExistsW(0033e980 L"C:\\users\\alfonsojon") ret=7e9c5d4d | |
| 000b:Call KERNEL32.SetErrorMode(00000001) ret=7e919eec | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e919eec | |
| 000b:Call KERNEL32.GetFileAttributesW(0033e980 L"C:\\users\\alfonsojon") ret=7e919ef9 | |
| 000b:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e919ef9 | |
| 000b:Call KERNEL32.SetErrorMode(00000000) ret=7e919f06 | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e919f06 | |
| 000b:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7e9c5d4d | |
| 000b:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec2087e | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec24992 L"USERPROFILE",00000000,00000001,0033f4f4,00000028) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec24980 L"HOMEPATH",00000000,00000001,0033f4f8,00000024) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec2496c L"HOMEDRIVE",00000000,00000001,0033f4f4,00000006) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.GetUserNameW(0033f4f4,0033eedc) ret=7ec208f2 | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7ec208f2 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec2495a L"USERNAME",00000000,00000001,0033f4f4,00000016) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec24946 L"HOMESHARE",00000000,00000001,7ec24944,00000002) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call shell32.SHGetFolderPathW(00000000,0000001c,00000000,00000000,0033f4f4) ret=7ec20944 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea09bc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0033e204) ret=7e9c1878 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1878 | |
| 000b:Call advapi32.RegCreateKeyW(80000001,7ea09b20 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0033e200) ret=7e9c1954 | |
| 000b:Ret advapi32.RegCreateKeyW() retval=00000000 ret=7e9c1954 | |
| 000b:Call advapi32.RegQueryValueExW(00000048,7ea0a500 L"Local AppData",00000000,0033e1f8,0033eb88,0033e1fc) ret=7e9c199c | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9c199c | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ea09cc0 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0033db80,0033df98) ret=7e9c12f0 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7e9c12f0 | |
| 000b:Call KERNEL32.GetSystemDirectoryW(0033df98,00000104) ret=7e9c16b8 | |
| 000b:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7e9c16b8 | |
| 000b:Call advapi32.RegQueryValueExW(0000004c,7ea09c80 L"ProfilesDirectory",00000000,0033db08,0033dd90,0033db0c) ret=7e9c0c10 | |
| 000b:Ret advapi32.RegQueryValueExW() retval=00000000 ret=7e9c0c10 | |
| 000b:Call advapi32.GetUserNameW(0033df98,0033db84) ret=7e9c14e0 | |
| 000b:Ret advapi32.GetUserNameW() retval=00000001 ret=7e9c14e0 | |
| 000b:Call shlwapi.PathAppendW(0033e618 L"C:\\users",0033df98 L"alfonsojon") ret=7e9c14ef | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9c14ef | |
| 000b:Call shlwapi.PathAppendW(0033e618 L"C:\\users\\alfonsojon",0033dba2 L"\\Local Settings\\Application Data") ret=7e9c151c | |
| 000b:Ret shlwapi.PathAppendW() retval=00000001 ret=7e9c151c | |
| 000b:Call advapi32.RegCloseKey(0000004c) ret=7e9c11c6 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c11c6 | |
| 000b:Call advapi32.RegSetValueExW(00000040,7ea0a500 L"Local AppData",00000000,00000001,0033eb88,00000068) ret=7e9c1aaa | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7e9c1aaa | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7e9c19c3 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19c3 | |
| 000b:Call advapi32.RegCloseKey(00000048) ret=7e9c19d4 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7e9c19d4 | |
| 000b:Call shlwapi.PathFileExistsW(0033e980 L"C:\\users\\alfonsojon\\Local Settings\\Application Data") ret=7e9c5d4d | |
| 000b:Call KERNEL32.SetErrorMode(00000001) ret=7e919eec | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000000 ret=7e919eec | |
| 000b:Call KERNEL32.GetFileAttributesW(0033e980 L"C:\\users\\alfonsojon\\Local Settings\\Application Data") ret=7e919ef9 | |
| 000b:Ret KERNEL32.GetFileAttributesW() retval=00000010 ret=7e919ef9 | |
| 000b:Call KERNEL32.SetErrorMode(00000000) ret=7e919f06 | |
| 000b:Ret KERNEL32.SetErrorMode() retval=00000001 ret=7e919f06 | |
| 000b:Ret shlwapi.PathFileExistsW() retval=00000001 ret=7e9c5d4d | |
| 000b:Ret shell32.SHGetFolderPathW() retval=00000000 ret=7ec20944 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec2492a L"LOCALAPPDATA",00000000,00000001,0033f4f4,00000068) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call KERNEL32.GetComputerNameW(0033f2f0,0033eedc) ret=7ec20981 | |
| 000b:Ret KERNEL32.GetComputerNameW() retval=00000001 ret=7ec20981 | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec24914 L"USERDOMAIN",00000000,00000001,0033f2f0,0000001c) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec248fc L"LOGONSERVER",00000000,00000001,0033f2ec,00000020) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegSetValueExW(00000028,7ec248e4 L"SESSIONNAME",00000000,00000001,7ec249aa,00000010) ret=7ec22cad | |
| 000b:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec22cad | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec209e9 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec209e9 | |
| 000b:Call advapi32.RegCreateKeyExW(80000002,7ec24880 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0033edb4,00000000) ret=7ec232a5 | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec232a5 | |
| 000b:Call advapi32.RegCreateKeyExW(00000028,7ec2534c L"RunOnce",00000000,00000000,00000000,000f003f,00000000,0033edb8,0033edbc) ret=7ec2330c | |
| 000b:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec2330c | |
| 000b:Call advapi32.RegCloseKey(00000028) ret=7ec23325 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec23325 | |
| 000b:Call advapi32.RegQueryInfoKeyW(00000040,00000000,00000000,00000000,00000000,00000000,00000000,0033edc0,0033edc8,0033edc4,00000000,00000000) ret=7ec2339c | |
| 000b:Ret advapi32.RegQueryInfoKeyW() retval=00000000 ret=7ec2339c | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec233fc | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec233fc | |
| 000b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec23422 | |
| 000b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec23422 | |
| 000b:Call advapi32.RegCloseKey(00000040) ret=7ec23437 | |
| 000b:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec23437 | |
| 000b:Call KERNEL32.SetEvent(00000014) ret=7ec1fe58 | |
| 000b:Ret KERNEL32.SetEvent() retval=00000001 ret=7ec1fe58 | |
| 000b:Call KERNEL32.ExitProcess(00000000) ret=7ec23b6c | |
| 000b:Call PE DLL (proc=0x7e439d40,module=0x7e360000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e439d40,module=0x7e360000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e323850,module=0x7e2d0000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e323850,module=0x7e2d0000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e9fc4f0,module=0x7e970000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e9fc4f0,module=0x7e970000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e9372a0,module=0x7e900000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e9372a0,module=0x7e900000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e849fb0,module=0x7e7a0000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e849fb0,module=0x7e7a0000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7e70a6e0,module=0x7e680000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7e70a6e0,module=0x7e680000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7ebecec0,module=0x7ebb0000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7ebecec0,module=0x7ebb0000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) | |
| 000b:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) retval=1 | |
| 000b:Call KERNEL32.FreeLibrary(7e970000) ret=7ec1ed41 | |
| 000b:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7ec1ed41 | |
| 000b:Call KERNEL32.FreeLibrary(7e360000) ret=7e97d7a1 | |
| 000b:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7e97d7a1 | |
| 0009:Call PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0009:Ret PE DLL (proc=0x7bc98640,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0009:Call PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0009:Ret PE DLL (proc=0x7b884f90,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0009:Call PE DLL (proc=0x7effd860,module=0x7eff0000 L"sensapi.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7eff0000) ret=7effd980 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7effd980 | |
| 0009:Ret PE DLL (proc=0x7effd860,module=0x7eff0000 L"sensapi.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0009:Call PE DLL (proc=0x7ec30d60,module=0x7ec20000 L"wmvcore.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0009:Call KERNEL32.DisableThreadLibraryCalls(7ec20000) ret=7ec30a38 | |
| 0009:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7ec30a38 | |
| 0009:Ret PE DLL (proc=0x7ec30d60,module=0x7ec20000 L"wmvcore.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0009:Call PE DLL (proc=0x7ea19ec0,module=0x7e9d0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0009:Ret PE DLL (proc=0x7ea19ec0,module=0x7e9d0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0009:Call PE DLL (proc=0x7e7e76e0,module=0x7e760000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Ret PE DLL (proc=0x7e93a6e0,module=0x7e8b0000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Call PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Call KERNEL32.DisableThreadLibraryCalls(7eff0000) ret=7effc400 | |
| 0021:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7effc400 | |
| 0021:Ret PE DLL (proc=0x7effc2e0,module=0x7eff0000 L"version.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Call PE DLL (proc=0x7ea79fb0,module=0x7e9d0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) | |
| 0021:Ret PE DLL (proc=0x7ea79fb0,module=0x7e9d0000 L"user32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1 | |
| 0021:Starting process L"C:\\windows\\system32\\explorer.exe" (entryproc=0x7ec2aa20) | |
| 0021:Call KERNEL32.GetCommandLineW() ret=7ec2aad9 | |
| 0021:Ret KERNEL32.GetCommandLineW() retval=002205fa ret=7ec2aad9 | |
| 0021:Call KERNEL32.GetStartupInfoW(0033fdcc) ret=7ec2ab36 | |
| 0021:Ret KERNEL32.GetStartupInfoW() retval=7b83abd0 ret=7ec2ab36 | |
| 0021:Call KERNEL32.GetModuleHandleW(00000000) ret=7ec2ab59 | |
| 0021:Ret KERNEL32.GetModuleHandleW() retval=7ec20000 ret=7ec2ab59 | |
| 0021:Call user32.GetThreadDesktop(00000021) ret=7ec2529e | |
| 0021:Ret user32.GetThreadDesktop() retval=00000008 ret=7ec2529e | |
| 0021:Call user32.GetUserObjectInformationW(00000008,00000002,7ec34420,00000104,00000000) ret=7ec252cf | |
| 0021:Ret user32.GetUserObjectInformationW() retval=00000001 ret=7ec252cf | |
| 0021:Call advapi32.RegOpenKeyW(80000001,7ec2b440 L"Software\\Wine\\Explorer",0033f444) ret=7ec25300 | |
| 0021:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ec25300 | |
| 0021:Call rpcrt4.UuidCreate(0033f64c) ret=7ec2487c | |
| 0021:Call advapi32.SystemFunction036(0033f64c,00000010) ret=7ebe5110 | |
| 0021:Ret advapi32.SystemFunction036() retval=00000001 ret=7ebe5110 | |
| 0021:Ret rpcrt4.UuidCreate() retval=00000000 ret=7ec2487c | |
| 0021:Call advapi32.RegOpenKeyW(80000001,7ec2b340 L"Software\\Wine\\Drivers",0033f2f4) ret=7ec2542a | |
| 0021:Ret advapi32.RegOpenKeyW() retval=00000002 ret=7ec2542a | |
| 0021:Call KERNEL32.LoadLibraryW(0033f2f8 L"winex11.drv") ret=7ec2494f | |
| 0021:Call PE DLL (proc=0x7e684ef0,module=0x7e630000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) | |
| 0021:Ret PE DLL (proc=0x7e684ef0,module=0x7e630000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0021:Ret KERNEL32.LoadLibraryW() retval=7e630000 ret=7ec2494f | |
| 0021:Call KERNEL32.GetModuleFileNameW(7e630000,0033f444,00000104) ret=7ec25162 | |
| 0021:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7ec25162 | |
| 0021:Call advapi32.RegCreateKeyExW(80000002,0033f338 L"System\\CurrentControlSet\\Control\\Video\\{0f17ca6a-3103-402d-8605-e4e0528dfb7a}\\0000",00000000,00000000,00000001,00000002,00000000,0033f2f4,00000000) ret=7ec24a55 | |
| 0021:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=7ec24a55 | |
| 0021:Call advapi32.RegSetValueExW(0000003c,7ec2b21c L"GraphicsDriver",00000000,00000001,0033f444,00000040) ret=7ec24ad9 | |
| 0021:Ret advapi32.RegSetValueExW() retval=00000000 ret=7ec24ad9 | |
| 0021:Call advapi32.RegCloseKey(0000003c) ret=7ec24af6 | |
| 0021:Ret advapi32.RegCloseKey() retval=00000000 ret=7ec24af6 | |
| 0021:Call user32.CreateWindowExW(00000000,00008001,00000000,86000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0033f64c) ret=7ec24b6b | |
| 0021:Call window proc 0x7ea01390 (hwnd=0x10020,msg=WM_NCCREATE,wp=00000000,lp=0033f1d0) | |
| 0021:Ret window proc 0x7ea01390 (hwnd=0x10020,msg=WM_NCCREATE,wp=00000000,lp=0033f1d0) retval=00000001 | |
| 0021:Call window proc 0x7ea01390 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f0c0) | |
| 0021:Ret window proc 0x7ea01390 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f0c0) retval=00000000 | |
| 0021:Call window proc 0x7ea01390 (hwnd=0x10020,msg=WM_CREATE,wp=00000000,lp=0033f1d0) | |
| 0021:Ret window proc 0x7ea01390 (hwnd=0x10020,msg=WM_CREATE,wp=00000000,lp=0033f1d0) retval=00000000 | |
| 0021:Call winex11.drv.wine_get_gdi_driver(0000002e) ret=7e8f5a19 | |
| 0021:Ret winex11.drv.wine_get_gdi_driver() retval=7e6a9ce0 ret=7e8f5a19 | |
| 0021:Call winex11.drv.CreateWindow(00010020) ret=7ea07a5a | |
| 0021:Call PE DLL (proc=0x7e43d120,module=0x7e430000 L"imm32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0021:Call user32.RegisterWindowMessageA(7e43dbe1 "MSIMEService") ret=7e43ae59 | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c010 ret=7e43ae59 | |
| 0021:Call user32.RegisterWindowMessageA(7e43dbee "MSIMEReconvertOptions") ret=7e43ae70 | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c011 ret=7e43ae70 | |
| 0021:Call user32.RegisterWindowMessageA(7e43dc04 "MSIMEMouseOperation") ret=7e43ae87 | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c012 ret=7e43ae87 | |
| 0021:Call user32.RegisterWindowMessageA(7e43dc18 "MSIMEReconvertRequest") ret=7e43ae9e | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c013 ret=7e43ae9e | |
| 0021:Call user32.RegisterWindowMessageA(7e43dc2e "MSIMEReconvert") ret=7e43aeb5 | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c014 ret=7e43aeb5 | |
| 0021:Call user32.RegisterWindowMessageA(7e43dc3d "MSIMEQueryPosition") ret=7e43aecc | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c015 ret=7e43aecc | |
| 0021:Call user32.RegisterWindowMessageA(7e43dc50 "MSIMEDocumentFeed") ret=7e43aee3 | |
| 0021:Ret user32.RegisterWindowMessageA() retval=0000c016 ret=7e43aee3 | |
| 0021:Call KERNEL32.TlsAlloc() ret=7e43aef1 | |
| 0021:Ret KERNEL32.TlsAlloc() retval=00000002 ret=7e43aef1 | |
| 0021:Call user32.LoadCursorW(00000000,00007f00) ret=7e43af3b | |
| 0021:Ret user32.LoadCursorW() retval=00010022 ret=7e43af3b | |
| 0021:Call user32.RegisterClassW(0033e948) ret=7e43af52 | |
| 0021:Ret user32.RegisterClassW() retval=0000c017 ret=7e43af52 | |
| 0021:Ret PE DLL (proc=0x7e43d120,module=0x7e430000 L"imm32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0021:Call imm32.ImmGetContext(00000000) ret=7e652cfe | |
| 0021:Call user32.IsWindow(00000000) ret=7e43ba02 | |
| 0021:Ret user32.IsWindow() retval=00000000 ret=7e43ba02 | |
| 0021:Ret imm32.ImmGetContext() retval=00000000 ret=7e652cfe | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea07a5a | |
| 0021:Call window proc 0x7ea01390 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7ea01390 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7ea01390 (hwnd=0x10020,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7ea01390 (hwnd=0x10020,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.CreateWindowExW() retval=00010020 ret=7ec24b6b | |
| 0021:Call user32.CreateWindowExW(00000000,7ec2b4ac L"Message",00000000,86000000,00000000,00000000,00000064,00000064,00000000,00000000,00000000,00000000) ret=7ec24be2 | |
| 0021:Call winex11.drv.WindowPosChanging(00010026,00000000,00000014,0033f08c,0033f08c,0033ef2c,0033ef28) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010026,00000000,00000034,0033f08c,0033f08c,0033ef2c,00000000,7eaf17a0) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_NCCREATE,wp=00000000,lp=0033f1d0) | |
| 0021:Ret window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_NCCREATE,wp=00000000,lp=0033f1d0) retval=00000001 | |
| 0021:Call window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f0c0) | |
| 0021:Ret window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f0c0) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(00010026,00000000,00000010,0033f08c,0033f0c0,0033ef2c,0033ef28) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010026,00000000,00000010,0033f08c,0033f0c0,0033ef2c,00000000,7eaf17a0) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_CREATE,wp=00000000,lp=0033f1d0) | |
| 0021:Ret window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_CREATE,wp=00000000,lp=0033f1d0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(00010026) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_SIZE,wp=00000000,lp=00640064) | |
| 0021:Ret window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_SIZE,wp=00000000,lp=00640064) retval=00000000 | |
| 0021:Call window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7ea36b50 (hwnd=0x10026,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.CreateWindowExW() retval=00010026 ret=7ec24be2 | |
| 0021:Call user32.SetWindowLongW(00010020,fffffffc,7ec22f80) ret=7ec24c61 | |
| 0021:Ret user32.SetWindowLongW() retval=7ea01390 ret=7ec24c61 | |
| 0021:Call user32.LoadIconW(00000000,00007f05) ret=7ec24c78 | |
| 0021:Ret user32.LoadIconW() retval=00010028 ret=7ec24c78 | |
| 0021:Call user32.SendMessageW(00010020,00000080,00000001,00010028) ret=7ec24c97 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_SETICON,wp=00000001,lp=00010028) | |
| 0021:Call user32.DefWindowProcW(00010020,00000080,00000001,00010028) ret=7ec231ed | |
| 0021:Call winex11.drv.SetWindowIcon(00010020,00000001,00010028) ret=7e9ffd84 | |
| 0021:Ret winex11.drv.SetWindowIcon() retval=00000000 ret=7e9ffd84 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_SETICON,wp=00000001,lp=00010028) retval=00000000 | |
| 0021:Ret user32.SendMessageW() retval=00000000 ret=7ec24c97 | |
| 0021:Call user32.GetSystemMetrics(0000004f) ret=7ec24def | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033f000) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000438 ret=7ec24def | |
| 0021:Call user32.GetSystemMetrics(0000004e) ret=7ec24e04 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033f000) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000cf8 ret=7ec24e04 | |
| 0021:Call user32.GetSystemMetrics(0000004d) ret=7ec24e15 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033f000) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec24e15 | |
| 0021:Call user32.GetSystemMetrics(0000004c) ret=7ec24e26 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033f000) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec24e26 | |
| 0021:Call user32.SetWindowPos(00010020,00000000,00000000,00000000,00000cf8,00000438,00000040) ret=7ec24e5d | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f1e4) | |
| 0021:Call user32.DefWindowProcW(00010020,00000046,00000000,0033f1e4) ret=7ec231ed | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f1e4) retval=00000000 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000001,lp=0033f13c) | |
| 0021:Call user32.DefWindowProcW(00010020,00000083,00000001,0033f13c) ret=7ec231ed | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_NCCALCSIZE,wp=00000001,lp=0033f13c) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(00010020,00000000,0000104a,0033f0c0,0033f0d0,0033ef8c,0033ef88) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010020,00000000,0000104a,0033f0c0,0033f0d0,0033ef8c,0033f11c,7eaf17a0) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_QUERYNEWPALETTE,wp=00000000,lp=00000000) | |
| 0021:Call user32.DefWindowProcW(00010020,0000030f,00000000,00000000) ret=7ec231ed | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_QUERYNEWPALETTE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_NCACTIVATE,wp=00000001,lp=00000000) | |
| 0021:Call user32.DefWindowProcW(00010020,00000086,00000001,00000000) ret=7ec231ed | |
| 0021:Call winex11.drv.GetDC(0002002a,00010020,00010020,0033e39c,0033e3ac,00000053) ret=7ea4779d | |
| 0021:Ret winex11.drv.GetDC() retval=00000001 ret=7ea4779d | |
| 0021:Ret user32.DefWindowProcW() retval=00000001 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_NCACTIVATE,wp=00000001,lp=00000000) retval=00000001 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_ACTIVATE,wp=00000001,lp=00000000) | |
| 0021:Call user32.DefWindowProcW(00010020,00000006,00000001,00000000) ret=7ec231ed | |
| 0021:Call winex11.drv.SetFocus(00010020) ret=7ea14ce7 | |
| 0021:Ret winex11.drv.SetFocus() retval=00000000 ret=7ea14ce7 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_SETFOCUS,wp=00000000,lp=00000000) | |
| 0021:Call user32.DefWindowProcW(00010020,00000007,00000000,00000000) ret=7ec231ed | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_SETFOCUS,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_ACTIVATE,wp=00000001,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f1e4) | |
| 0021:Call user32.DefWindowProcW(00010020,00000047,00000000,0033f1e4) ret=7ec231ed | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=04380cf8) | |
| 0021:Call user32.DefWindowProcW(00010020,00000005,00000000,04380cf8) ret=7ec231ed | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_SIZE,wp=00000000,lp=04380cf8) retval=00000000 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec231ed | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f1e4) retval=00000000 | |
| 0021:Ret user32.SetWindowPos() retval=00000001 ret=7ec24e5d | |
| 0021:Call user32.SystemParametersInfoW(00000014,00000000,00000000,00000000) ret=7ec24e84 | |
| 0021:Call winex11.drv.SystemParametersInfo(00000014,00000000,00000000,00000000) ret=7ea56c2e | |
| 0021:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7ea56c2e | |
| 0021:Ret user32.SystemParametersInfoW() retval=00000001 ret=7ec24e84 | |
| 0021:Call user32.ClipCursor(00000000) ret=7ec24e93 | |
| 0021:Call winex11.drv.ClipCursor(0033f19c) ret=7e9f1715 | |
| 0021:Call winex11.drv.WindowMessage(00010020,80001004,00000000,00000000) ret=7ea35489 | |
| 0021:Ret winex11.drv.WindowMessage() retval=00000000 ret=7ea35489 | |
| 0021:Ret winex11.drv.ClipCursor() retval=00000001 ret=7e9f1715 | |
| 0021:Ret user32.ClipCursor() retval=00000001 ret=7ec24e93 | |
| 0021:Call user32.EnumDisplaySettingsExW(00000000,ffffffff,0033f444,00000000) ret=7ec24ebc | |
| 0021:Call winex11.drv.EnumDisplaySettingsEx(00000000,ffffffff,0033f444,00000000) ret=7ea5b029 | |
| 0021:Ret winex11.drv.EnumDisplaySettingsEx() retval=00000001 ret=7ea5b029 | |
| 0021:Ret user32.EnumDisplaySettingsExW() retval=00000001 ret=7ec24ebc | |
| 0021:Call user32.ChangeDisplaySettingsExW(00000000,0033f444,00000000,10000009,00000000) ret=7ec24f0a | |
| 0021:Call winex11.drv.ChangeDisplaySettingsEx(00000000,0033f444,00000000,10000009,00000000) ret=7ea5ae00 | |
| 0021:Ret winex11.drv.ChangeDisplaySettingsEx() retval=00000000 ret=7ea5ae00 | |
| 0021:Ret user32.ChangeDisplaySettingsExW() retval=00000000 ret=7ec24f0a | |
| 0021:Call user32.RegisterClassExW(0033f220) ret=7ec22eb3 | |
| 0021:Ret user32.RegisterClassExW() retval=0000c019 ret=7ec22eb3 | |
| 0021:Call user32.CreateWindowExW(00000000,7ec2af2e L"WineAppBar",7ec2af2e L"WineAppBar",00000000,00000000,00000000,00000000,00000000,fffffffd,00000000,00000000,00000000) ret=7ec22f34 | |
| 0021:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033e9d0,00000000) ret=7ea56c2e | |
| 0021:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7ea56c2e | |
| 0021:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033e490,00000000) ret=7ea56c2e | |
| 0021:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7ea56c2e | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033e9d0) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033e9d0) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033ef10) | |
| 0021:Call user32.DefWindowProcW(0001002a,00000024,00000000,0033ef10) ret=7ec2274c | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec2274c | |
| 0021:Ret window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033ef10) retval=00000000 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033edcc) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec48) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ef38) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Call winex11.drv.WindowPosChanging(0001002a,00000000,00000014,0033f00c,0033f00c,0033eeac,0033eea8) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(0001002a,00000000,00000014,0033f00c,0033f00c,0033eeac,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_NCCREATE,wp=00000000,lp=0033f150) | |
| 0021:Call user32.DefWindowProcW(0001002a,00000081,00000000,0033f150) ret=7ec2274c | |
| 0021:Call winex11.drv.SetWindowText(0001002a,001412e0 L"WineAppBar") ret=7e9fee48 | |
| 0021:Ret winex11.drv.SetWindowText() retval=00000000 ret=7e9fee48 | |
| 0021:Ret user32.DefWindowProcW() retval=00000001 ret=7ec2274c | |
| 0021:Ret window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_NCCREATE,wp=00000000,lp=0033f150) retval=00000001 | |
| 0021:Call window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f040) | |
| 0021:Call user32.DefWindowProcW(0001002a,00000083,00000000,0033f040) ret=7ec2274c | |
| 0021:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033e610,00000000) ret=7ea56c2e | |
| 0021:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7ea56c2e | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec2274c | |
| 0021:Ret window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f040) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(0001002a,00000000,00000010,0033f00c,0033f040,0033eeac,0033eea8) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(0001002a,00000000,00000010,0033f00c,0033f040,0033eeac,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_CREATE,wp=00000000,lp=0033f150) | |
| 0021:Call user32.DefWindowProcW(0001002a,00000001,00000000,0033f150) ret=7ec2274c | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec2274c | |
| 0021:Ret window proc 0x7ec226f0 (hwnd=0x1002a,msg=WM_CREATE,wp=00000000,lp=0033f150) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(0001002a) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Ret user32.CreateWindowExW() retval=0001002a ret=7ec22f34 | |
| 0021:Call KERNEL32.GetProcAddress(7e630000,7ec2e318 "wine_notify_icon") ret=7ec2a4f4 | |
| 0021:Ret KERNEL32.GetProcAddress() retval=7e638c70 ret=7ec2a4f4 | |
| 0021:Call user32.GetSystemMetrics(00000031) ret=7ec2a509 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000010 ret=7ec2a509 | |
| 0021:Call user32.GetSystemMetrics(00000032) ret=7ec2a521 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000010 ret=7ec2a521 | |
| 0021:Call user32.LoadIconW(00000000,00007f05) ret=7ec2a582 | |
| 0021:Ret user32.LoadIconW() retval=00010028 ret=7ec2a582 | |
| 0021:Call user32.LoadCursorW(00000000,00007f00) ret=7ec2a59f | |
| 0021:Ret user32.LoadCursorW() retval=00010022 ret=7ec2a59f | |
| 0021:Call user32.RegisterClassExW(0033f1bc) ret=7ec2a5c0 | |
| 0021:Ret user32.RegisterClassExW() retval=0000c01a ret=7ec2a5c0 | |
| 0021:Call user32.GetSystemMetrics(00000000) ret=7ec2a5f4 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000780 ret=7ec2a5f4 | |
| 0021:Call user32.GetSystemMetrics(00000001) ret=7ec2a60b | |
| 0021:Ret user32.GetSystemMetrics() retval=00000438 ret=7ec2a60b | |
| 0021:Call user32.CreateWindowExW(08000000,7ec2e492 L"Shell_TrayWnd",00000000,80000000,00000000,00000424,00000780,00000014,00000000,00000000,00000000,00000000) ret=7ec2a66c | |
| 0021:Call KERNEL32.LZOpenFileW(0033ecd8 L"C:\\windows\\system32\\explorer.exe",0033ebc4,00000000) ret=7eff9a62 | |
| 0021:Ret KERNEL32.LZOpenFileW() retval=00000050 ret=7eff9a62 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000000,00000000) ret=7eff8f94 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000000 ret=7eff8f94 | |
| 0021:Call KERNEL32.LZRead(00000050,0033eb30,00000040) ret=7eff8fab | |
| 0021:Ret KERNEL32.LZRead() retval=00000040 ret=7eff8fab | |
| 0021:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7eff9027 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000060 ret=7eff9027 | |
| 0021:Call KERNEL32.LZRead(00000050,0033eb2d,00000002) ret=7eff9044 | |
| 0021:Ret KERNEL32.LZRead() retval=00000002 ret=7eff9044 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7eff9067 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000060 ret=7eff9067 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000000,00000001) ret=7eff884d | |
| 0021:Ret KERNEL32.LZSeek() retval=00000060 ret=7eff884d | |
| 0021:Call KERNEL32.LZRead(00000050,0033e9d8,00000108) ret=7eff886a | |
| 0021:Ret KERNEL32.LZRead() retval=00000108 ret=7eff886a | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00000078) ret=7eff8919 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=00146328 ret=7eff8919 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000158,00000000) ret=7eff894d | |
| 0021:Ret KERNEL32.LZSeek() retval=00000158 ret=7eff894d | |
| 0021:Call KERNEL32.LZRead(00000050,00146328,00000078) ret=7eff8966 | |
| 0021:Ret KERNEL32.LZRead() retval=00000078 ret=7eff8966 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00002000) ret=7eff8a0d | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=00147d88 ret=7eff8a0d | |
| 0021:Call KERNEL32.LZSeek(00000050,00000600,00000000) ret=7eff8a41 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000600 ret=7eff8a41 | |
| 0021:Call KERNEL32.LZRead(00000050,00147d88,000013cc) ret=7eff8a5a | |
| 0021:Ret KERNEL32.LZRead() retval=000013cc ret=7eff8a5a | |
| 0021:Call KERNEL32.GetUserDefaultLangID() ret=7eff8bfa | |
| 0021:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7eff8bfa | |
| 0021:Call KERNEL32.GetUserDefaultLangID() ret=7eff8c2b | |
| 0021:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7eff8c2b | |
| 0021:Call KERNEL32.GetUserDefaultLangID() ret=7eff8c5b | |
| 0021:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7eff8c5b | |
| 0021:Call KERNEL32.GetSystemDefaultLangID() ret=7eff8c93 | |
| 0021:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7eff8c93 | |
| 0021:Call KERNEL32.GetSystemDefaultLangID() ret=7eff8cc3 | |
| 0021:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7eff8cc3 | |
| 0021:Call KERNEL32.GetSystemDefaultLangID() ret=7eff8cf3 | |
| 0021:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7eff8cf3 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00147d88) ret=7eff8a90 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff8a90 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00146328) ret=7eff8ab6 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff8ab6 | |
| 0021:Call KERNEL32.LZClose(00000050) ret=7eff9a94 | |
| 0021:Ret KERNEL32.LZClose() retval=00000000 ret=7eff9a94 | |
| 0021:Call KERNEL32.LZOpenFileW(0033ecd8 L"C:\\windows\\system32\\explorer.exe",0033ebc4,00000000) ret=7eff9d3d | |
| 0021:Ret KERNEL32.LZOpenFileW() retval=00000050 ret=7eff9d3d | |
| 0021:Call KERNEL32.LZSeek(00000050,00000000,00000000) ret=7eff8f94 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000000 ret=7eff8f94 | |
| 0021:Call KERNEL32.LZRead(00000050,0033eb20,00000040) ret=7eff8fab | |
| 0021:Ret KERNEL32.LZRead() retval=00000040 ret=7eff8fab | |
| 0021:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7eff9027 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000060 ret=7eff9027 | |
| 0021:Call KERNEL32.LZRead(00000050,0033eb1d,00000002) ret=7eff9044 | |
| 0021:Ret KERNEL32.LZRead() retval=00000002 ret=7eff9044 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000060,00000000) ret=7eff9067 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000060 ret=7eff9067 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000000,00000001) ret=7eff884d | |
| 0021:Ret KERNEL32.LZSeek() retval=00000060 ret=7eff884d | |
| 0021:Call KERNEL32.LZRead(00000050,0033e9c8,00000108) ret=7eff886a | |
| 0021:Ret KERNEL32.LZRead() retval=00000108 ret=7eff886a | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00000078) ret=7eff8919 | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=001469f8 ret=7eff8919 | |
| 0021:Call KERNEL32.LZSeek(00000050,00000158,00000000) ret=7eff894d | |
| 0021:Ret KERNEL32.LZSeek() retval=00000158 ret=7eff894d | |
| 0021:Call KERNEL32.LZRead(00000050,001469f8,00000078) ret=7eff8966 | |
| 0021:Ret KERNEL32.LZRead() retval=00000078 ret=7eff8966 | |
| 0021:Call ntdll.RtlAllocateHeap(00110000,00000000,00002000) ret=7eff8a0d | |
| 0021:Ret ntdll.RtlAllocateHeap() retval=00147d88 ret=7eff8a0d | |
| 0021:Call KERNEL32.LZSeek(00000050,00000600,00000000) ret=7eff8a41 | |
| 0021:Ret KERNEL32.LZSeek() retval=00000600 ret=7eff8a41 | |
| 0021:Call KERNEL32.LZRead(00000050,00147d88,000013cc) ret=7eff8a5a | |
| 0021:Ret KERNEL32.LZRead() retval=000013cc ret=7eff8a5a | |
| 0021:Call KERNEL32.GetUserDefaultLangID() ret=7eff8bfa | |
| 0021:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7eff8bfa | |
| 0021:Call KERNEL32.GetUserDefaultLangID() ret=7eff8c2b | |
| 0021:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7eff8c2b | |
| 0021:Call KERNEL32.GetUserDefaultLangID() ret=7eff8c5b | |
| 0021:Ret KERNEL32.GetUserDefaultLangID() retval=00000409 ret=7eff8c5b | |
| 0021:Call KERNEL32.GetSystemDefaultLangID() ret=7eff8c93 | |
| 0021:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7eff8c93 | |
| 0021:Call KERNEL32.GetSystemDefaultLangID() ret=7eff8cc3 | |
| 0021:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7eff8cc3 | |
| 0021:Call KERNEL32.GetSystemDefaultLangID() ret=7eff8cf3 | |
| 0021:Ret KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7eff8cf3 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,00147d88) ret=7eff8a90 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff8a90 | |
| 0021:Call ntdll.RtlFreeHeap(00110000,00000000,001469f8) ret=7eff8ab6 | |
| 0021:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eff8ab6 | |
| 0021:Call KERNEL32.LZSeek(00000050,0000166c,00000000) ret=7eff9d98 | |
| 0021:Ret KERNEL32.LZSeek() retval=0000166c ret=7eff9d98 | |
| 0021:Call KERNEL32.LZRead(00000050,00146328,00000360) ret=7eff9dbc | |
| 0021:Ret KERNEL32.LZRead() retval=00000360 ret=7eff9dbc | |
| 0021:Call KERNEL32.LZClose(00000050) ret=7eff9dcd | |
| 0021:Ret KERNEL32.LZClose() retval=00000000 ret=7eff9dcd | |
| 0021:Call winex11.drv.WindowPosChanging(0001002e,00000000,00000014,0033ef9c,0033ef9c,0033ee3c,0033ee38) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033e2ec) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e168) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e3e8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033ebac) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea28) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033eca8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(0001002e,00000000,00000014,0033ef9c,0033ef9c,0033ee3c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_NCCREATE,wp=00000000,lp=0033f0e0) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000081,00000000,0033f0e0) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000001 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_NCCREATE,wp=00000000,lp=0033f0e0) retval=00000001 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efd0) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000083,00000000,0033efd0) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000100 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efd0) retval=00000100 | |
| 0021:Call winex11.drv.WindowPosChanging(0001002e,00000000,00000010,0033ef9c,0033efd0,0033ee3c,0033ee38) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033ebac) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea28) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033eca8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(0001002e,00000000,00000010,0033ef9c,0033efd0,0033ee3c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_CREATE,wp=00000000,lp=0033f0e0) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000001,00000000,0033f0e0) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_CREATE,wp=00000000,lp=0033f0e0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(0001002e) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_SIZE,wp=00000000,lp=00140780) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000005,00000000,00140780) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_SIZE,wp=00000000,lp=00140780) retval=00000000 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04240000) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000003,00000000,04240000) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04240000) retval=00000000 | |
| 0021:Ret user32.CreateWindowExW() retval=0001002e ret=7ec2a66c | |
| 0021:Call user32.LoadStringW(00000000,00000003,0033f1ec,00000032) ret=7ec2a6a0 | |
| 0021:Ret user32.LoadStringW() retval=00000005 ret=7ec2a6a0 | |
| 0021:Call user32.GetDC(00000000) ret=7ec2a6af | |
| 0021:Call winex11.drv.GetDC(0002002a,00010020,00010020,0033f00c,0033f01c,00000013) ret=7ea4779d | |
| 0021:Ret winex11.drv.GetDC() retval=00000001 ret=7ea4779d | |
| 0021:Ret user32.GetDC() retval=0002002a ret=7ec2a6af | |
| 0021:Call gdi32.GetTextExtentPointW(0002002a,0033f1ec L"Start",00000005,0033f1b4) ret=7ec2a6ef | |
| 0021:Ret gdi32.GetTextExtentPointW() retval=00000001 ret=7ec2a6ef | |
| 0021:Call user32.ReleaseDC(00000000,0002002a) ret=7ec2a702 | |
| 0021:Ret user32.ReleaseDC() retval=00000001 ret=7ec2a702 | |
| 0021:Call user32.CreateWindowExW(00000000,7ec2e470 L"Button",0033f1ec L"Start",50000000,00000000,00000000,00000026,00000014,0001002e,00000000,00000000,00000000) ret=7ec2a770 | |
| 0021:Call winex11.drv.WindowPosChanging(00010030,00000000,00000014,0033ef9c,0033ef9c,0033ee3c,0033ee38) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010030,00000000,00000014,0033ef9c,0033ef9c,0033ee3c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_NCCREATE,wp=00000000,lp=0033f0e0) | |
| 0021:Call winex11.drv.SetWindowText(00010030,00145f80 L"Start") ret=7e9fee48 | |
| 0021:Ret winex11.drv.SetWindowText() retval=00000000 ret=7e9fee48 | |
| 0021:Ret window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_NCCREATE,wp=00000000,lp=0033f0e0) retval=00000001 | |
| 0021:Call window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efd0) | |
| 0021:Ret window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efd0) retval=00000300 | |
| 0021:Call winex11.drv.WindowPosChanging(00010030,00000001,00000010,0033ef9c,0033efd0,0033ee3c,0033ee38) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010030,00000001,00000010,0033ef9c,0033efd0,0033ee3c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_CREATE,wp=00000000,lp=0033f0e0) | |
| 0021:Ret window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_CREATE,wp=00000000,lp=0033f0e0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(00010030) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_SIZE,wp=00000000,lp=00140026) | |
| 0021:Ret window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_SIZE,wp=00000000,lp=00140026) retval=00000000 | |
| 0021:Call window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_PARENTNOTIFY,wp=00000001,lp=00010030) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000210,00000001,00010030) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_PARENTNOTIFY,wp=00000001,lp=00010030) retval=00000000 | |
| 0021:Call window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_SHOWWINDOW,wp=00000001,lp=00000000) | |
| 0021:Ret window proc 0x7ea73f60 (hwnd=0x10030,msg=WM_SHOWWINDOW,wp=00000001,lp=00000000) retval=00000000 | |
| 0021:Call winex11.drv.ShowWindow(00010030,00000005,0033ee90,00000057) ret=7ea706e7 | |
| 0021:Ret winex11.drv.ShowWindow() retval=00000057 ret=7ea706e7 | |
| 0021:Call winex11.drv.SetWindowStyle(00010030,fffffff0,0033edc4) ret=7ea65b1b | |
| 0021:Ret winex11.drv.SetWindowStyle() retval=00000000 ret=7ea65b1b | |
| 0021:Call winex11.drv.WindowPosChanging(00010030,00000000,0000181f,0033ed60,0033ed70,0033ec6c,0033ec68) ret=7ea6ea6f | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010030,00000000,0000181f,0033ed60,0033ed70,0033ec6c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Ret user32.CreateWindowExW() retval=00010030 ret=7ec2a770 | |
| 0021:Call user32.GetSystemMetrics(0000004d) ret=7ec28a60 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033eed0) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec28a60 | |
| 0021:Call user32.GetSystemMetrics(0000004f) ret=7ec28a71 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033eed0) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000438 ret=7ec28a71 | |
| 0021:Call user32.GetSystemMetrics(0000004c) ret=7ec28a83 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033eed0) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000000 ret=7ec28a83 | |
| 0021:Call user32.GetSystemMetrics(0000004e) ret=7ec28a94 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea54410,0033eed0) ret=7ea409f9 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Ret user32.GetSystemMetrics() retval=00000cf8 ret=7ec28a94 | |
| 0021:Call user32.SetWindowPos(0001002e,00000000,00000cf8,00000438,00000000,00000000,00000015) ret=7ec28acf | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f0b4) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000046,00000000,0033f0b4) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGING,wp=00000000,lp=0033f0b4) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(0001002e,00000000,0000081d,0033ef90,0033efa0,0033ee5c,0033ee58) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033ebcc) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea48) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ecc8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(0001002e,00000000,0000081d,0033ef90,0033efa0,0033ee5c,0033efec,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f0b4) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000047,00000000,0033f0b4) ret=7ec29d70 | |
| 0021:Call window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04380cf8) | |
| 0021:Call user32.DefWindowProcW(0001002e,00000003,00000000,04380cf8) ret=7ec29d70 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_MOVE,wp=00000000,lp=04380cf8) retval=00000000 | |
| 0021:Ret user32.DefWindowProcW() retval=00000000 ret=7ec29d70 | |
| 0021:Ret window proc 0x7ec296e0 (hwnd=0x1002e,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=0033f0b4) retval=00000000 | |
| 0021:Ret user32.SetWindowPos() retval=00000001 ret=7ec28acf | |
| 0021:Call KERNEL32.LoadLibraryA(7ec2b00d "shell32.dll") ret=7ec24f68 | |
| 0021:Call PE DLL (proc=0x7e1772a0,module=0x7e140000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0021:Call KERNEL32.DisableThreadLibraryCalls(7e140000) ret=7e1689e1 | |
| 0021:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e1689e1 | |
| 0021:Call KERNEL32.TlsAlloc() ret=7e1689ef | |
| 0021:Ret KERNEL32.TlsAlloc() retval=00000003 ret=7e1689ef | |
| 0021:Ret PE DLL (proc=0x7e1772a0,module=0x7e140000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0021:Call PE DLL (proc=0x7e23c4f0,module=0x7e1b0000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) | |
| 0021:Call KERNEL32.DisableThreadLibraryCalls(7e1b0000) ret=7e1eb227 | |
| 0021:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7e1eb227 | |
| 0021:Call KERNEL32.GetModuleFileNameW(7e1b0000,7e3d9600,00000104) ret=7e1eb244 | |
| 0021:Ret KERNEL32.GetModuleFileNameW() retval=0000001f ret=7e1eb244 | |
| 0021:Ret PE DLL (proc=0x7e23c4f0,module=0x7e1b0000 L"shell32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 0021:Ret KERNEL32.LoadLibraryA() retval=7e1b0000 ret=7ec24f68 | |
| 0021:Call KERNEL32.GetProcAddress(7e1b0000,000000bc) ret=7ec24f7f | |
| 0021:Ret KERNEL32.GetProcAddress() retval=7e1bf550 ret=7ec24f7f | |
| 0021:Call shell32.188(00000001) ret=7ec24f8f | |
| 0021:Call user32.DdeInitializeW(7e3d9548,7e1d2a70,00014000,00000000) ret=7e1d300e | |
| 0021:Call winex11.drv.WindowPosChanging(00010032,00000000,00000014,0033ef7c,0033ef7c,0033ee1c,0033ee18) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033e2cc) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e148) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e3c8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb8c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea08) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec88) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010032,00000000,00000014,0033ef7c,0033ef7c,0033ee1c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_NCCREATE,wp=00000000,lp=0033f0c0) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_NCCREATE,wp=00000000,lp=0033f0c0) retval=00000001 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efb0) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efb0) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(00010032,00000000,00000010,0033ef7c,0033efb0,0033ee1c,0033ee18) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb8c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea08) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec88) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010032,00000000,00000010,0033ef7c,0033efb0,0033ee1c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_CREATE,wp=00000000,lp=0033f0c0) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_CREATE,wp=00000000,lp=0033f0c0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(00010032) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.DdeInitializeW() retval=00000000 ret=7e1d300e | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e2421d2 L"Progman",000004b0) ret=7e1d302b | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c000 ret=7e1d302b | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e2421d2 L"Progman",000004b0) ret=7e1d304e | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c000 ret=7e1d304e | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e2421ce L"*",000004b0) ret=7e1d3077 | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c001 ret=7e1d3077 | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e2421c2 L"Shell",000004b0) ret=7e1d30a0 | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c002 ret=7e1d30a0 | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e2421a6 L"AppProperties",000004b0) ret=7e1d30c9 | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c003 ret=7e1d30c9 | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e242196 L"Folders",000004b0) ret=7e1d30f2 | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c004 ret=7e1d30f2 | |
| 0021:Call user32.DdeCreateStringHandleW(00000001,7e242188 L"Groups",000004b0) ret=7e1d311b | |
| 0021:Ret user32.DdeCreateStringHandleW() retval=0000c005 ret=7e1d311b | |
| 0021:Call user32.DdeNameService(00000001,0000c004,00000000,00000001) ret=7e1d314c | |
| 0021:Call winex11.drv.WindowPosChanging(00010034,00000000,00000014,0033ef8c,0033ef8c,0033ee2c,0033ee28) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033e2dc) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e158) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e3d8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb9c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea18) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec98) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010034,00000000,00000014,0033ef8c,0033ef8c,0033ee2c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_NCCREATE,wp=00000000,lp=0033f0d0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_NCCREATE,wp=00000000,lp=0033f0d0) retval=00000001 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efc0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efc0) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(00010034,00000000,00000010,0033ef8c,0033efc0,0033ee2c,0033ee28) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb9c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea18) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec98) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010034,00000000,00000010,0033ef8c,0033efc0,0033ee2c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_CREATE,wp=00000000,lp=0033f0d0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_CREATE,wp=00000000,lp=0033f0d0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(00010034) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10034,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.DdeNameService() retval=00000001 ret=7e1d314c | |
| 0021:Call user32.DdeNameService(00000001,0000c000,00000000,00000001) ret=7e1d3177 | |
| 0021:Call winex11.drv.WindowPosChanging(00010036,00000000,00000014,0033ef8c,0033ef8c,0033ee2c,0033ee28) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033e2dc) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e158) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e3d8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb9c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea18) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec98) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010036,00000000,00000014,0033ef8c,0033ef8c,0033ee2c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_NCCREATE,wp=00000000,lp=0033f0d0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_NCCREATE,wp=00000000,lp=0033f0d0) retval=00000001 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efc0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efc0) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(00010036,00000000,00000010,0033ef8c,0033efc0,0033ee2c,0033ee28) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb9c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea18) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec98) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010036,00000000,00000010,0033ef8c,0033efc0,0033ee2c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_CREATE,wp=00000000,lp=0033f0d0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_CREATE,wp=00000000,lp=0033f0d0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(00010036) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10036,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.DdeNameService() retval=00000001 ret=7e1d3177 | |
| 0021:Call user32.DdeNameService(00000001,0000c002,00000000,00000001) ret=7e1d31a2 | |
| 0021:Call winex11.drv.WindowPosChanging(00010038,00000000,00000014,0033ef8c,0033ef8c,0033ee2c,0033ee28) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033e2dc) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e158) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033e3d8) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb9c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea18) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec98) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010038,00000000,00000014,0033ef8c,0033ef8c,0033ee2c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_NCCREATE,wp=00000000,lp=0033f0d0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_NCCREATE,wp=00000000,lp=0033f0d0) retval=00000001 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efc0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_NCCALCSIZE,wp=00000000,lp=0033efc0) retval=00000000 | |
| 0021:Call winex11.drv.WindowPosChanging(00010038,00000000,00000010,0033ef8c,0033efc0,0033ee2c,0033ee28) ret=7ea6ea6f | |
| 0021:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7ea40780,0033eb9c) ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ea18) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7ea409f9 | |
| 0021:Call winex11.drv.GetMonitorInfo(00000001,0033ec98) ret=7ea406b3 | |
| 0021:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7ea406b3 | |
| 0021:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7ea6ea6f | |
| 0021:Call winex11.drv.WindowPosChanged(00010038,00000000,00000010,0033ef8c,0033efc0,0033ee2c,00000000,00000000) ret=7ea6f058 | |
| 0021:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7ea6f058 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_CREATE,wp=00000000,lp=0033f0d0) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_CREATE,wp=00000000,lp=0033f0d0) retval=00000000 | |
| 0021:Call winex11.drv.CreateWindow(00010038) ret=7ea6a6ba | |
| 0021:Ret winex11.drv.CreateWindow() retval=00000001 ret=7ea6a6ba | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_SIZE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_SIZE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Call window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_MOVE,wp=00000000,lp=00000000) | |
| 0021:Ret window proc 0x7e9fb9d0 (hwnd=0x10038,msg=WM_MOVE,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.DdeNameService() retval=00000001 ret=7e1d31a2 | |
| 0021:Ret shell32.188() retval=00000001 ret=7ec24f8f | |
| 0021:Call user32.GetMessageW(0033f444,00000000,00000000,00000000) ret=7ec2507b | |
| 0021:Call winex11.drv.ClipCursor(00000000) ret=7ea35448 | |
| 0021:Call winex11.drv.WindowMessage(00010020,80001004,00000000,00000000) ret=7ea35489 | |
| 0021:Ret winex11.drv.WindowMessage() retval=00000000 ret=7ea35489 | |
| 0021:Ret winex11.drv.ClipCursor() retval=00000001 ret=7ea35448 | |
| 0021:Ret user32.GetMessageW() retval=00000001 ret=7ec2507b | |
| 0021:Call user32.DispatchMessageW(0033f444) ret=7ec25058 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_USER+512,wp=0000c01d,lp=0000c01e) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_USER+512,wp=0000c01d,lp=0000c01e) retval=00000000 | |
| 0021:Ret user32.DispatchMessageW() retval=00000000 ret=7ec25058 | |
| 0021:Call user32.GetMessageW(0033f444,00000000,00000000,00000000) ret=7ec2507b | |
| 0021:Ret user32.GetMessageW() retval=00000001 ret=7ec2507b | |
| 0021:Call user32.DispatchMessageW(0033f444) ret=7ec25058 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_USER+512,wp=0000c020,lp=0000c021) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_USER+512,wp=0000c020,lp=0000c021) retval=00000000 | |
| 0021:Ret user32.DispatchMessageW() retval=00000000 ret=7ec25058 | |
| 0021:Call user32.GetMessageW(0033f444,00000000,00000000,00000000) ret=7ec2507b | |
| 0021:Ret user32.GetMessageW() retval=00000001 ret=7ec2507b | |
| 0021:Call user32.DispatchMessageW(0033f444) ret=7ec25058 | |
| 0021:Call window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_USER+512,wp=0000c022,lp=0000c023) | |
| 0021:Ret window proc 0x7e9f9180 (hwnd=0x10032,msg=WM_USER+512,wp=0000c022,lp=0000c023) retval=00000000 | |
| 0021:Ret user32.DispatchMessageW() retval=00000000 ret=7ec25058 | |
| 0021:Call user32.GetMessageW(0033f444,00000000,00000000,00000000) ret=7ec2507b | |
| 0021:Ret user32.GetMessageW() retval=00000001 ret=7ec2507b | |
| 0021:Call user32.DispatchMessageW(0033f444) ret=7ec25058 | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_PAINT,wp=00000000,lp=00000000) | |
| 0021:Call user32.BeginPaint(00010020,0033efec) ret=7ec233db | |
| 0021:Call winex11.drv.GetDC(0002002a,00010020,00010020,0033ecec,0033ecfc,0000009a) ret=7ea4779d | |
| 0021:Ret winex11.drv.GetDC() retval=00000001 ret=7ea4779d | |
| 0021:Call window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_ERASEBKGND,wp=0002002a,lp=00000000) | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_ERASEBKGND,wp=0002002a,lp=00000000) retval=00000001 | |
| 0021:Ret user32.BeginPaint() retval=0002002a ret=7ec233db | |
| 0021:Call user32.EndPaint(00010020,0033efec) ret=7ec236f7 | |
| 0021:Ret user32.EndPaint() retval=00000001 ret=7ec236f7 | |
| 0021:Ret window proc 0x7ec22f80 (hwnd=0x10020,msg=WM_PAINT,wp=00000000,lp=00000000) retval=00000000 | |
| 0021:Ret user32.DispatchMessageW() retval=00000000 ret=7ec25058 | |
| 0021:Call user32.GetMessageW(0033f444,00000000,00000000,00000000) ret=7ec2507b | |
| 0021:Call winex11.drv.MsgWaitForMultipleObjectsEx(00000001,0033f20c,ffffffff,000004ff,00000000) ret=7ea74962 | |
| 0021:Ret winex11.drv.MsgWaitForMultipleObjectsEx() retval=00000000 ret=7ea74962 | |
| 0021:Call winex11.drv.MsgWaitForMultipleObjectsEx(00000001,0033f20c,ffffffff,000004ff,00000000) ret=7ea74962 | |
| 000d:Call PE DLL (proc=0x7e085ef0,module=0x7e030000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) | |
| 000d:Ret PE DLL (proc=0x7e085ef0,module=0x7e030000 L"winex11.drv",reason=PROCESS_ATTACH,res=(nil)) retval=1 | |
| 000d:Call winex11.drv.wine_get_gdi_driver(0000002e) ret=7e775a19 | |
| 000d:Ret winex11.drv.wine_get_gdi_driver() retval=7e0aace0 ret=7e775a19 | |
| 000d:Call winex11.drv.CreateDesktopWindow(00010020) ret=7e887a77 | |
| 000d:Ret winex11.drv.CreateDesktopWindow() retval=00000001 ret=7e887a77 | |
| 000d:Ret user32.RegisterClassW() retval=0000c024 ret=7ea3fa8f | |
| 000d:Ret KERNEL32.InitOnceExecuteOnce() retval=00000001 ret=7ea437a8 | |
| 000d:Call user32.CreateWindowExW(00000000,7eb009e0 L"OleMainThreadWndClass 0x######## ",00000000,00000000,00000000,00000000,00000000,00000000,fffffffd,00000000,7ea20000,00000000) ret=7ea43813 | |
| 000d:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033f340,00000000) ret=7e8d6c2e | |
| 000d:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e8d6c2e | |
| 000d:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033ee00,00000000) ret=7e8d6c2e | |
| 000d:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e8d6c2e | |
| 000d:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e8d4410,0033f340) ret=7e8c09f9 | |
| 000d:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e8c09f9 | |
| 000d:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e8d4410,0033f340) ret=7e8c09f9 | |
| 000d:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e8c09f9 | |
| 000d:Call window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033f880) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000024,00000000,0033f880) ret=7ea41af4 | |
| 000d:Ret user32.DefWindowProcW() retval=00000000 ret=7ea41af4 | |
| 000d:Ret window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_GETMINMAXINFO,wp=00000000,lp=0033f880) retval=00000000 | |
| 000d:Call winex11.drv.EnumDisplayMonitors(00000000,00000000,7e8c0780,0033f73c) ret=7e8c09f9 | |
| 000d:Call winex11.drv.GetMonitorInfo(00000001,0033f5b8) ret=7e8c06b3 | |
| 000d:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7e8c06b3 | |
| 000d:Ret winex11.drv.EnumDisplayMonitors() retval=00000001 ret=7e8c09f9 | |
| 000d:Call winex11.drv.GetMonitorInfo(00000001,0033f8a8) ret=7e8c06b3 | |
| 000d:Ret winex11.drv.GetMonitorInfo() retval=00000001 ret=7e8c06b3 | |
| 000d:Call winex11.drv.WindowPosChanging(0001003e,00000000,00000014,0033f97c,0033f97c,0033f81c,0033f818) ret=7e8eea6f | |
| 000d:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7e8eea6f | |
| 000d:Call winex11.drv.WindowPosChanged(0001003e,00000000,00000014,0033f97c,0033f97c,0033f81c,00000000,00000000) ret=7e8ef058 | |
| 000d:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7e8ef058 | |
| 000d:Call window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_NCCREATE,wp=00000000,lp=0033fac0) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000081,00000000,0033fac0) ret=7ea41af4 | |
| 000d:Ret user32.DefWindowProcW() retval=00000001 ret=7ea41af4 | |
| 000d:Ret window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_NCCREATE,wp=00000000,lp=0033fac0) retval=00000001 | |
| 000d:Call window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f9b0) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000083,00000000,0033f9b0) ret=7ea41af4 | |
| 000d:Call winex11.drv.SystemParametersInfo(00000029,00000000,0033efc0,00000000) ret=7e8d6c2e | |
| 000d:Ret winex11.drv.SystemParametersInfo() retval=00000000 ret=7e8d6c2e | |
| 000d:Ret user32.DefWindowProcW() retval=00000000 ret=7ea41af4 | |
| 000d:Ret window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_NCCALCSIZE,wp=00000000,lp=0033f9b0) retval=00000000 | |
| 000d:Call winex11.drv.WindowPosChanging(0001003e,00000000,00000010,0033f97c,0033f9b0,0033f81c,0033f818) ret=7e8eea6f | |
| 000d:Ret winex11.drv.WindowPosChanging() retval=00000000 ret=7e8eea6f | |
| 000d:Call winex11.drv.WindowPosChanged(0001003e,00000000,00000010,0033f97c,0033f9b0,0033f81c,00000000,00000000) ret=7e8ef058 | |
| 000d:Ret winex11.drv.WindowPosChanged() retval=00000000 ret=7e8ef058 | |
| 000d:Call window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_CREATE,wp=00000000,lp=0033fac0) | |
| 000d:Call user32.DefWindowProcW(0001003e,00000001,00000000,0033fac0) ret=7ea41af4 | |
| 000d:Ret user32.DefWindowProcW() retval=00000000 ret=7ea41af4 | |
| 000d:Ret window proc 0x7ea41a80 (hwnd=0x1003e,msg=WM_CREATE,wp=00000000,lp=0033fac0) retval=00000000 | |
| 000d:Call winex11.drv.CreateWindow(0001003e) ret=7e8ea6ba | |
| 000d:Ret winex11.drv.CreateWindow() retval=00000001 ret=7e8ea6ba | |
| 000d:Ret user32.CreateWindowExW() retval=0001003e ret=7ea43813 | |
| 000d:Ret ole32.CoInitialize() retval=00000000 ret=7ec26804 | |
| 000d:Call KERNEL32.CreateSemaphoreA(00000000,00000001,00000001,7ec2a302 "winemenubuilder_semaphore") ret=7ec26ca8 | |
| 000d:Ret KERNEL32.CreateSemaphoreA() retval=0000006c ret=7ec26ca8 | |
| 000d:Call user32.MsgWaitForMultipleObjects(00000001,0033fd10,00000000,ffffffff,000004ff) ret=7ec26cdf | |
| 000d:Call winex11.drv.MsgWaitForMultipleObjectsEx(00000002,0033fac0,ffffffff,000004ff,00000000) ret=7e8f4962 | |
| 000d:Ret winex11.drv.MsgWaitForMultipleObjectsEx() retval=00000000 ret=7e8f4962 | |
| 000d:Ret user32.MsgWaitForMultipleObjects() retval=00000000 ret=7ec26cdf | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149ef8 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149ef8,00000023) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149ef8 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f28 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149f28,0000002c) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149f28 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f60 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149f60,0000002b) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149f60 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7ec1f4f6 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f28 ret=7ec1f4f6 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec26ec7 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f70 ret=7ec26ec7 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f98 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149f98,00000029) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149f98 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f859 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149fd0 ret=7ec1f859 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00144f88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149d98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014afd8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014aff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b028 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b040 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b058 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b078 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b0f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b148 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b198 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b1b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b1c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b1e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b218 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b230 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b248 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b290 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b2e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b308 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b320 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b338 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b358 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b3b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b3d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b400 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b418 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b430 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b450 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b490 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b4f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b510 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b558 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b588 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b5a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b5d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b5f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b608 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b628 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b668 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b680 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b6f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b718 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b748 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b760 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b778 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b798 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b7b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b7d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b7e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b838 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b850 ret=7ec1f543 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149fd0) ret=7ec1f895 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f895 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec1f7fd | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f7fd | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149f98) ret=7ec1f82b | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f82b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f98 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149f98,0000001f) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149f98 ret=7ec1f645 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149f98) ret=7ec1f82b | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f82b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f98 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149f98,0000001d) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149f98 ret=7ec1f645 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149f98) ret=7ec1f82b | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f82b | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f5dc | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149f98 ret=7ec1f5dc | |
| 000d:Call ntdll.RtlReAllocateHeap(00110000,00000000,00149f98,00000017) ret=7ec1f645 | |
| 000d:Ret ntdll.RtlReAllocateHeap() retval=00149f98 ret=7ec1f645 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00001000) ret=7ec1f859 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00149fb8 ret=7ec1f859 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b868 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b888 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b8f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b918 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b930 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b948 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b968 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b988 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014b9f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ba98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bab8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bad8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014baf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bb98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bbb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bbd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bbe8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bc88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bcb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bcd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bcf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bd98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bdb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bdd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bde8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014be88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bea0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014beb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bed0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bef0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bf90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bfa8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bfc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bfe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014bff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c068 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c098 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c0b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c0f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c108 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c120 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c140 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c158 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c170 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c188 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c1e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c200 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c220 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c258 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c270 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c288 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c2a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c2e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c2f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c310 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c330 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c360 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c378 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c3d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c3e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c400 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c420 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c438 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c450 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c468 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c488 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c4f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c518 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c548 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c568 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c5f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c610 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c628 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c640 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c660 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c6f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c710 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c728 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c748 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c780 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c798 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c7b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c7d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c828 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c848 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c8f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c950 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c970 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c9a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c9c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014c9e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ca88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014caa0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cac0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cae0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014caf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cb88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cba8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cbc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cbe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cbf8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cc88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ccc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ccd8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ccf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cd60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cdb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cdc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cde0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ce88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cec8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cee8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cf88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cfa0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cfc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cfe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014cff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d068 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d080 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000025) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d0a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d0d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d0e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d100 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d120 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d138 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d168 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d1f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d228 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d240 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d298 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d2b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d2d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d300 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d318 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d330 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d350 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d398 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d3b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d3d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d3e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d400 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d420 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d438 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d450 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d468 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d488 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d4f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d540 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d560 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d580 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d598 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d5e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d618 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d688 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d6a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d6d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d6e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d700 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d750 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d768 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d788 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d7f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d828 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d840 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d860 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d878 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d890 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d8f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d910 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d930 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d948 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d978 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014d9e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014da90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014daa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dac0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dae0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014daf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014db90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dbf8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dc88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dcb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dcd0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dcf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dd88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dda0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ddb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ddd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ddf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014de98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014deb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014def8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014df80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dfa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dfc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dfe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014dff8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e068 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e088 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e0e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e148 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e1f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e228 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e278 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e290 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e2b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e2e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e300 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e318 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e338 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e360 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e378 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e390 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e3f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e418 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e460 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e4f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e540 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e560 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e578 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e590 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e5a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000004a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e5c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e620 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e650 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e688 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e6f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e708 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e720 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e740 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e788 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e7f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e828 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e840 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e858 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e878 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e890 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e8f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e910 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e928 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e948 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e970 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e988 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014e9f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ea98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eac0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ead8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eaf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eb98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ebb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ebc8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ebe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ec98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ecb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ecd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ecf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ed98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014edb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014edd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ede8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ee90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eec0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ef98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014efb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014efd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014eff0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f008 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f028 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f040 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f058 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f070 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f090 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f0f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f148 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f1f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f228 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f298 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f2f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f308 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f358 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f370 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f388 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f3a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f3c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f3d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f3f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f410 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f460 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f4f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f508 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f520 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f538 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f558 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f588 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f5a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f5c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f5e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f618 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f688 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f6f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f710 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f730 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f748 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f760 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f780 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f7f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f820 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f838 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f858 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f878 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f890 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f8a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f8c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f8f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f908 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f920 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f940 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f978 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f990 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f9b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f9d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014f9f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa70 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fa90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fab8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fae8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fb90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fba8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fbc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fbe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fc88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fca0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fcc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fcf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fd80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fda0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fdb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fdd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fde8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fe90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fec0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ff88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ffa0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ffc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014ffe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0014fff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150058 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150070 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150088 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001500e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150100 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150120 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150148 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150160 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150178 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150198 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001501e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150200 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150220 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150238 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150250 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150270 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001502f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150308 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150320 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150340 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150398 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001503f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150408 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150428 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150478 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150498 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001504f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150540 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150558 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150578 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150598 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001505b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001505c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001505e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150618 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150630 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150668 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150698 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001506b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001506d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001506e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150700 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150740 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150770 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001507b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001507c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001507e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150800 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150818 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150830 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150848 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150888 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001508f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150910 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150928 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150948 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150968 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150980 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150998 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001509f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150a80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150aa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ac0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ad8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150af0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150b88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ba8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150bc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150bd8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150bf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150c98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150cb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150cd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ce8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150d88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150da8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150dc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150dd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150df0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150e98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150eb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ec8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ee8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150f88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150fa0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150fc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150fe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00150ff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151058 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151070 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151088 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001510f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151110 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151148 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151160 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151180 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001511f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151228 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151240 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001512f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151328 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151370 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151388 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001513a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001513c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001513f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151420 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151440 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151490 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001514f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151510 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151548 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151560 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151578 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151598 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001515c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001515d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001515f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151610 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151630 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151648 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151660 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001516f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151718 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151730 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151748 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151768 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151788 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001517f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151828 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151848 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151860 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151878 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151890 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001518f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151918 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151940 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151958 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151970 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001519b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001519c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001519e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151a98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ab0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151b80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ba0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151bc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151bd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151bf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151c98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151cb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151cc8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ce8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151d98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151db0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151dd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151df0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e20 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151e88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ec0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ed8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ef0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151f88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151fa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151fc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151fd8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00151ff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152048 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152068 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001520b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001520d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001520e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152118 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152138 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152180 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001521e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152208 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152230 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152260 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152298 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001522b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001522c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001522e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152308 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152320 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152338 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152358 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152378 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152390 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001523f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152410 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152428 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152490 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001524f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152518 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152548 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152560 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152580 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152598 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001525b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001525c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001525e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152608 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152620 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152638 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000036) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001526b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001526c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001526e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152708 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152738 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152788 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001527a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001527c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001527e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001527f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152810 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152830 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152850 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152880 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001528a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001528c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001528d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001528f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152910 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152930 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152948 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152960 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152980 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001529b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001529c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001529e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152a20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152a38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152a50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152a70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152a88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152aa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152ab8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152ad8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152af8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152b10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152b28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152b48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152b60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152b78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152b90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152bb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152bd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152be8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152c00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152c20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152c40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152c58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152c70 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152c90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152ca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152cc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152cd8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152cf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152d18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152d30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152d48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152d68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152d88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152da0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152db8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152dd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152df8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152e10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152e28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152e48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152e68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152e80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152e98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152eb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152ed0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152ee8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152f00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152f20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152f50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152f68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152f88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152fa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152fb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152fd0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00152ff0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153010 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153028 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153040 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153060 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153078 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153090 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001530a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001530c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001530e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001530f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153110 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153180 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001531a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001531c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001531d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001531f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153228 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153240 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153258 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153278 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153290 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001532a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001532c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001532e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153340 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153360 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153378 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153390 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001533a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001533c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001533f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153410 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153428 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153490 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000025) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001534b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001534e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001534f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153510 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153550 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153568 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153580 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001535a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001535e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001535f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153610 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153630 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153648 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153660 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153678 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001536b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001536d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001536e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153708 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153728 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153740 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153758 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153778 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001537a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001537c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001537e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001537f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153828 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153848 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153898 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000025) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001538b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001538e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153900 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153918 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153950 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153968 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153980 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001539a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001539b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001539d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001539e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153a08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153a30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153a48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153a60 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153a80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ab0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ac8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ae0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153b00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153b18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153b30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153b48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153b68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153b88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ba0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153bb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153bd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153c28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153c40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153c58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153c78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153cc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153cd8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153cf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153d18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153d30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153d48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153d68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153d90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153da8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153dc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153de0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153df8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153e10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153e28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153e48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153e78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153e90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ea8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000045) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153ec8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153f18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153f30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153f48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153f68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153f98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153fb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153fc8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00153fe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154000 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154030 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154068 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154098 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001540b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001540e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001540f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154110 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154180 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001541a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001541c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001541d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001541f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154230 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154260 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001542a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001542b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001542d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001542f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154308 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154320 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154338 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154358 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001543b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001543d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001543f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154420 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154440 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154458 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154470 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154488 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001544a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001544c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001544d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001544f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154540 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154558 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154578 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001545a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001545b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001545d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001545f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154610 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154628 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154640 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154660 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001546b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001546d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001546e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154718 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154750 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154768 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154780 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001547a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001547b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001547d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001547e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154830 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154848 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154860 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154898 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001548b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001548c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001548e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154908 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154938 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154958 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154978 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001549a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001549c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001549e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001549f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154a10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154a30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154a60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154a90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ab0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154b00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154b20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154b38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154b50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154b68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154b88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154bb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154bc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154be0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154c00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154c18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154c30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154c48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154c68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154c88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154cb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154cd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154d00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154d18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154d30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000034) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154d50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154d90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154da8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154dc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154de0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154e00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154e18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154e30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154e50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154e78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154e90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ea8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ec8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ef8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154f10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154f30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154f58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154f70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154f88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154fa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154fc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154fe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00154ff8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155068 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155088 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001550a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001550c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001550d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001550f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155110 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155140 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155160 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155178 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155190 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001551a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001551c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001551e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155200 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155218 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155238 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155298 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001552b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001552e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155300 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155318 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155338 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155350 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155380 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001553a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001553c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001553d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001553f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155410 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155440 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155458 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155470 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155490 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001554b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001554c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001554e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155500 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155520 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155538 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155550 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155590 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001555a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001555c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001555e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155618 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155630 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155668 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155698 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001556b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001556d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001556f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155708 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155728 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155748 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155760 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155778 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155798 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001557c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001557e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001557f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155818 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155830 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155848 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155860 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001558a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001558b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001558d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001558f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155910 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155928 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155940 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155980 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001559b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001559d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001559f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155a10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155a28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155a48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155a60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155a90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155ab0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155ad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155ae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155b00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155b20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155b48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155b60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155b78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155b98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155bb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155bc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155be0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155c98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155cb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155cd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155ce8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155d00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155d18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155d38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155d50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155d68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155d80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155da0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155db8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155dd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155de8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000035) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155e08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155e48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155e60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155e78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155e98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155eb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155ec8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155ee0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155f98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155fb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155fd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00155fe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156000 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156018 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000039) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001560b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001560d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001560f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156110 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156128 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156148 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001561a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001561b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001561d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156218 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156230 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156248 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001562a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001562b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001562d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001562f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156328 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156398 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001563b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001563d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001563f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156408 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156428 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156450 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156468 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156480 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001564a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001564c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001564d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001564f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156548 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156560 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156580 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001565a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001565b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001565d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001565f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156608 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156620 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156638 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156678 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156690 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001566a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001566c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001566e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156718 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156750 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156768 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156780 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001567a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001567b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001567d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001567e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156830 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156848 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156860 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001568a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001568c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001568d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001568f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156950 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156970 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001569b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001569c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001569e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156a08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156a20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156a38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156a58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156a90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156aa8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156ac8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156af0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156b08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156b20 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156b40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156b58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156b70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156b88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156ba8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156bd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156be8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156c00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156c20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156c48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156c60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156c78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156c98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156cc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156ce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156cf8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156d18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156d30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156d48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156d60 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156d80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156da0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156db8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156dd0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156df0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156e18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156e30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156e48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156e68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156e80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156e98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156eb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156ed0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156ee8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156f00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156f18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156f50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156f68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156f80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156fa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156fc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156fd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00156ff0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157010 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157048 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157060 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001570b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001570c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001570e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157110 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157140 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157160 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157190 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001571a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001571c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001571e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001571f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157228 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157278 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157290 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001572b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001572d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001572f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157308 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157340 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157358 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157370 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157390 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001573b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001573c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001573e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157400 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157420 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157438 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157450 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157470 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157490 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001574a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001574c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001574e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001574f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157528 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157548 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157568 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157580 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157598 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001575b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001575d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001575e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157600 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157620 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157648 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157660 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157678 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001576b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001576c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001576e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157750 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157788 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001577a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001577b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001577d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001577f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157820 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157840 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157858 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157870 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157888 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001578a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001578c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001578d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001578f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157910 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157928 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157940 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157958 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157978 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001579b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001579c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001579e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157a18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157a30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157a48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157a68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157a88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157aa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157ab8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157ad8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157af8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157b10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157b28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157b48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157b68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157b80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157b98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157bb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157be0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157bf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157c10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157c30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157c58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157c70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157c88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157ca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157cc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157cd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157cf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157d10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157d30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157d48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157d60 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157d80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157d98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157db0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157dc8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157de8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157e00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157e18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157e30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157e50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157e70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157e88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157ea0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157ec0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157ee8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157f00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157f18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157f68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157f80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157f98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157fb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157fd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00157fe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158000 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158020 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158068 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158088 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001580b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001580c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001580e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158140 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158158 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158178 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001581a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001581b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001581d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001581f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158228 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158240 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158298 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001582b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001582d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001582f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158328 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158370 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158388 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001583a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001583c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001583d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001583f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158408 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158428 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158440 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158458 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158470 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158490 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001584b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001584c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001584e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158500 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158540 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158558 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158578 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158590 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001585a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001585c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001585e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158618 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158630 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158688 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001586a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001586c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001586e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158718 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158788 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001587a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001587c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001587d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001587f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158830 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158848 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158860 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001588a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001588c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001588d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001588f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158918 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158930 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158948 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158968 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158988 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001589a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001589b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001589d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158a00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158a18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158a30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158a50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158a90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158aa8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ac8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158b00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158b18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158b38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158b78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158b90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ba8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158bc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158be8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158c00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158c18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158c38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158c50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158c68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158c80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000032) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158cf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158d10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158d30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158d58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158d70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158d88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158da8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158dc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158de0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158df8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000034) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158e18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158e58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158e70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158e88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ec8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ef8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000035) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158f18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158f58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158f70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158f88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158fa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158fe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00158ff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159060 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159078 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159090 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001590b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001590d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001590e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159100 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159120 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159138 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159168 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001591a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001591c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001591d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001591f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159218 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159230 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159248 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159298 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001592b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001592d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001592e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159300 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159318 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000039) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159338 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001593b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001593d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001593f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159420 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159440 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159468 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159498 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001594b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001594f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159528 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159548 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159588 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001595a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001595b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000048) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001595d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159628 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159640 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159658 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159678 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001596b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001596c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001596e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159708 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159738 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159778 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001597a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001597c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001597f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159820 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159840 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159860 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159878 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159890 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001598b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001598d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001598f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159908 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159928 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159940 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159958 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159970 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001599b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001599c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001599e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159a98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ab0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159af0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159b08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159b20 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159b40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159b58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159b70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159b88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ba8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159bc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159bd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159bf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159c10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159c28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159c40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159c58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159c78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159c90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159cc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159cf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159d10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159d28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159d48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159d70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159d88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159da0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159dc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159de0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159df8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159e10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159e30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159e58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159e70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159e88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ec0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ed8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159ef0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159f10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159f50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159f68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159f88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159fb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159fc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00159fe0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a000 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a048 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a068 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a0b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a0d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a0e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a118 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a138 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a180 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a198 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a1b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a1e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a200 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a218 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a238 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a258 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a270 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a288 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a2a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a2d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a2f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a308 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a350 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a380 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a3a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a3c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a3d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a3f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a410 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a460 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a498 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a4b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a4c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a4e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a508 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a520 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a538 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a558 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a578 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a590 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a5a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a5c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a5e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a618 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a668 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a680 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a6a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a6b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a6d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a6e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a708 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a750 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a798 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a7b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a7c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a7e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a828 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a840 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a860 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a898 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a8b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a8d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a8e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a900 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a918 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a950 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a968 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a980 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a9a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a9d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015a9e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aa00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aa20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aa48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aa60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aa78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aa98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aac0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aad8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aaf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ab10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ab30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ab48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ab60 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ab80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ab98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015abb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015abc8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015abe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ac00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ac18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ac30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ac50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ac78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ac90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aca8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015acc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ace8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ad00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ad18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ad38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ad60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ad78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ad90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015adb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015add8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015adf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ae08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ae28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ae48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ae60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ae78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ae98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aeb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aec8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015aee0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015af00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015af20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015af38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015af50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015af70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015af98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015afb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015afc8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015afe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b008 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b020 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b038 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b058 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b070 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b088 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b0a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b0c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b0d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b0f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b108 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b180 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b1a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b1c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b1d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b1f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b238 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b250 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b268 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b2a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b2c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b2d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b2f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b318 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b330 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b348 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b3b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b3d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b3f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b420 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b440 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b490 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b4b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b4d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b4e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b500 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b520 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b538 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b550 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b568 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b588 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b5a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b5b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b5d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b5f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b620 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b650 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b690 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b6a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b6c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b6e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b718 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b730 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b750 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b788 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b7a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b7c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b7e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b800 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b818 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b838 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b858 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b870 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b888 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b8a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b8d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b8e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b900 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b950 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b968 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b980 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b9a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b9c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b9d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015b9f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ba10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ba28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ba40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ba58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ba78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ba98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bab0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bac8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bb08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bb20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bb38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bb58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bb78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bb90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bba8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bbc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bbe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bc00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bc18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bc38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bc58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bc70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bc88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bcc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bcf8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bd18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bd40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bd58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bd70 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bd90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bdb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bdd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bde8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015be08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015be20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015be38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015be50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015be70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015be90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bec0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bef8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bf10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bf28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bf48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bf60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bf78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bf90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bfb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bfc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bfe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015bff8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c048 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c060 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c080 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c0b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c0c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c0e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c130 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c180 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c198 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c1b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c1d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c1f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c228 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c280 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c298 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c2b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c2d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c2f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c308 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c360 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c378 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c3b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c3d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c3e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c460 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c498 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c4b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c4c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c4e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c500 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c518 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c530 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c550 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c568 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c580 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c598 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c5b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c5e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c618 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c688 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c6a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c6d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c6e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c700 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c740 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c770 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c7c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c7e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c7f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c818 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c838 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c850 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c868 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c888 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c8a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c8c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c8d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c8f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c928 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c940 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c958 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c978 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c9a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c9c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015c9e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ca00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ca18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ca30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ca50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ca80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ca98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cab0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015caf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cb10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cb28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cb48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cb68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cb80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cb98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cbb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cbe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cc00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cc18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cc38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cc58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cc70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cc88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ccc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ccf8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cd18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cd40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cd58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cd70 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cd90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cdb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cdd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cde8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ce08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ce28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ce40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ce58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ce78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cea0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ceb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ced0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cef0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cf10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cf28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cf40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cf60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cf78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cf90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cfa8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cfc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cfe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015cff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d048 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d060 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d078 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d0b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d0c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d0e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d148 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d1a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d1b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d1d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d1f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d228 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d278 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d290 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d2b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d2d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d2f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d308 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d360 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d378 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d3b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d3d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d3e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d460 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d498 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d4b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d4c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d4e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d500 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d518 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d530 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d550 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d588 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d5a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d5c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d5e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d618 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d670 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d688 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d6a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d6c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d6e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d6f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d718 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d730 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d748 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d760 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d780 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d798 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d7b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d7c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d7e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d800 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d818 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d830 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d850 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d898 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d8b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d8d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d8e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d900 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d950 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d968 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d988 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d9a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d9c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d9d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015d9f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015da18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015da30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015da48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015da68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015da80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015da98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dab0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dad0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015db00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015db18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015db38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015db58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015db70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015db88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dba8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dbc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dbd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dbf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dc10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dc28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dc40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dc58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dc78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dcb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dcd0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dcf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dd18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dd30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dd48 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dd68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dd80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dd98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ddb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ddd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ddf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015de10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015de28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015de48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015de70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015de88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dea0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dec0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015def8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015df10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000027) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015df30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015df60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015df78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015df90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dfb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dfd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015dff0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e008 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e028 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e040 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e058 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e070 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e090 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e0b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e0c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e0e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e148 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e180 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e198 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e1b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e1d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e1f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e208 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e220 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e240 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e258 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e270 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e288 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e2a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e2c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e2d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e2f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e328 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e340 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e358 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e378 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e390 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e3a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e3c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e3e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e400 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e418 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e430 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e450 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e468 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e480 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e498 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e4b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e4d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e4f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e508 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e540 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e558 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e570 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e590 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e5a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e5c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e5d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e5f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e618 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e630 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e648 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e668 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e6b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e6d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e6e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e718 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e750 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e768 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e780 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e7a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e7c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e7e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e7f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e818 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e840 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e858 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e870 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e890 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e8a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e8c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e8d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e8f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e910 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e928 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e940 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e978 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e9a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e9c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015e9e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ea00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ea18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ea38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ea58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ea70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ea88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eaa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ead0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eae8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eb00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eb20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eb48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eb60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eb78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eb98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ebb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ebd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ebe8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ec08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ec20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ec38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ec50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ec70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ec88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ecb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ecd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ecf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ed10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ed28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000034) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ed48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ed88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eda0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015edb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015edd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015edf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ee10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ee28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ee48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ee68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ee80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ee98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eeb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eed8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eef0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ef08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ef28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ef48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ef60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ef78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ef98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015efc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015efe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015eff8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f018 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f068 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f088 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f0a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f0b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f0d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f0f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f118 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f130 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f148 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f168 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f190 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f1a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f1c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f1e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f1f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f228 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000043) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f248 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f298 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f2b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f2c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f2e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f300 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f318 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f330 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f350 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f370 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f388 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f3a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f3c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f3e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f3f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f410 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f490 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f4b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f4e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f4f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f510 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f550 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f568 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f580 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f5a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f5d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f5f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f608 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f628 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f640 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f670 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f690 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f6b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f6c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f6e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f750 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f7a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f7c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f7e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f808 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f820 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f838 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f858 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f870 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f888 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f8a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f8c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f8e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f8f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f910 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f930 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f948 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f978 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f9b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f9d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015f9e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fa08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fa20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fa38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fa50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fa70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fa90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015faa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fac0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fae0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fb08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fb20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fb38 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fb58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fb78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fb90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fba8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fbc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fbe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fc00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fc18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fc38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fc68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fc80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fc98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fcb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fcd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fce8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fd00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fd20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fd38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fd50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fd68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fd88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fda0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fdb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fdd0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fdf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fe10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fe28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fe40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fe60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fe90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fec0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ff00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ff18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ff30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ff50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ff78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ff90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ffa8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ffc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015ffe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=0015fff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160048 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160060 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160078 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001600b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001600d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001600e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160108 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160140 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160158 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160178 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160198 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001601b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001601c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001601e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160208 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160220 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160238 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160258 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160270 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001602a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001602c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001602e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001602f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160310 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160330 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160360 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160378 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160398 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001603b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001603c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001603e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160400 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160418 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160448 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160468 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160488 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001604a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001604b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001604d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001604f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160508 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160520 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160540 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160558 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160588 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001605a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001605c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001605e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001605f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160618 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160638 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160668 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160688 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001606a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001606c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001606d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001606f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160718 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160730 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160748 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160768 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001607a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001607c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000024) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001607e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160828 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160840 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160860 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160898 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001608b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001608d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001608e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160900 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160918 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160958 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160970 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160988 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001609a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001609c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001609d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001609f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160a10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160a28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160a40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160a58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160a90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160aa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ac0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ae0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160b00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160b18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160b30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160b50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160b78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160b90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ba8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160bc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160be0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160bf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160c10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160c30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160c48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160c60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160c78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160c98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160cb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160cc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ce0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160d00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160d20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000003) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160d38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160d50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160d70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160d90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160da8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160dc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160de0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160df8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160e10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160e28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160e48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160e78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160e90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ea8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ec8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160ee8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160f00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160f18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160f58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160f70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160f88 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160fa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160fd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00160fe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161000 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161020 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161068 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161088 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001610b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001610c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001610e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161100 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161140 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161158 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161178 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001611a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001611b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001611d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001611f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161210 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161228 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161240 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161260 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001612a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001612b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001612d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001612f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161328 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161378 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161390 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001613a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001613c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001613e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001613f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161410 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161430 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161478 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161498 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001614b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001614d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001614e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161508 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161520 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161538 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161550 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161598 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001615b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001615c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001615e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161610 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161628 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161640 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161660 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161688 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001616a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001616b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001616d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001616f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161710 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161728 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000023) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161748 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161778 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161790 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001617a8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001617c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001617e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161800 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161818 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161838 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161860 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001618a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001618c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001618e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161900 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161918 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161938 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161978 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161990 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001619b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001619d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001619f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161a08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161a28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161a50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161a68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161a80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161aa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ac8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ae0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161af8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161b18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161b40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161b58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161b70 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161b90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161bb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161bd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161be8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161c08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161c20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161c38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161c50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161c70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161c90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161cc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161d98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161db8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161de8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161e00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161e18 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161e38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161e50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161e68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161e80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ea0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161eb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ed0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161ee8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161f08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161f20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161f38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161f50 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161f70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161f90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161fa8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161fc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000037) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00161fe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162020 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162050 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162070 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162098 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001620b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001620c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001620e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162108 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162120 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162138 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162158 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162170 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001621a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001621c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001621d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001621f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162208 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162228 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162240 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162258 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162270 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162290 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001622a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001622c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001622d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001622f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162320 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162338 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162350 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162370 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162388 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001623a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001623b8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001623d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001623f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162410 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162428 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162448 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162460 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162478 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162490 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001624b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001624c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001624e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001624f8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162518 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162530 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162548 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162560 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162580 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001625a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001625b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001625d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001625f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162608 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162620 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162638 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162658 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001626b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001626d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001626f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162708 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162720 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162740 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162758 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162788 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001627a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001627c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001627d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001627f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162810 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162838 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162850 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162868 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162888 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001628a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001628b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001628d0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001628f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162908 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162938 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162958 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162980 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001629b0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001629d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001629f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162a10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162a28 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162a48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162a70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162a88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162aa0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162ac0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162af0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162b08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162b20 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162b40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162b60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162b78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162b90 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162bb0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162bd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162bf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162c08 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162c28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162c48 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162c60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162c78 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162c98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162cc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162cd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162cf0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162d10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162d38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162d50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162d68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162d88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162dc8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162de0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162df8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162e18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162e38 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162e50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162e68 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162e88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162ea8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162ec0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162ed8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162ef8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162f10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162f28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162f40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162f60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162f80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162f98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162fb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162fd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00162fe8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163000 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163018 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163038 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163058 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163070 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163088 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001630a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001630c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001630d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001630f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163110 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163138 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163150 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163168 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163188 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001631b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001631c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001631e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163200 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163218 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163230 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163248 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163268 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163290 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001632a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001632c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001632e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001632f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163310 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163328 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163348 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163380 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163398 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001633b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001633d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001633e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163400 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163420 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163438 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163450 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163468 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163488 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001634a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001634c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001634d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001634f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163510 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163528 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163540 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163560 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163590 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001635a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001635c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001635e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163600 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163618 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163630 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163650 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163668 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163680 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163698 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000d) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001636b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001636d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001636e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163700 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000047) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163788 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001637a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001637c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001637e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163800 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163818 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000022) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163838 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163898 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001638b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001638d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001638f0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163908 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163928 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163948 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163960 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163978 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163998 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001639b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001639d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001639e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163a08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163a28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163a40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163a58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163aa0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163ab8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163ad0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163af0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163b10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163b28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163b40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163b60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163b80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163b98 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163bb0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163bd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163bf0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163c08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163c20 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000003b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163c40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163c88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163ca0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163cb8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163cd8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d00 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d18 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d30 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d80 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163d98 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163db8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163dd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163de8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163e00 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000017) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163e20 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163e40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163e58 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163e70 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000046) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163e90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163ee0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163ef8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163f10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000031) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163f30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163f70 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163f88 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163fa0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163fc0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163fe0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00163ff8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164010 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164030 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164050 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164068 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164080 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001640a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001640c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001640d8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001640f0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164110 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164128 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164140 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164158 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164178 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164198 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000009) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001641b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001641c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001641e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164208 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164220 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164238 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000a) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164258 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164270 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164288 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001642a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001642c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001642e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001642f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164310 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164330 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164350 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164368 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164380 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001643a0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001643b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001643d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001643e8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164408 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164420 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164438 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164450 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000011) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164470 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164490 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001644a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001644c0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000019) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001644e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164508 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164520 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164538 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164558 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164570 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164588 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001645a0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000012) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001645c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001645e0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001645f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164610 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000c) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164630 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164648 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164660 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164678 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164698 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001646b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001646c8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001646e0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164700 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164720 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164738 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164750 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000020) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164770 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164798 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001647b0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001647c8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001647e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164800 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000005) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164818 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164830 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164850 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164868 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164880 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164898 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001648b8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001648d0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001648e8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164900 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000015) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164920 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164940 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164958 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164970 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000f) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164990 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001649a8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001649c0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001649d8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=001649f8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164a10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164a28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164a40 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164a60 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164a78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164a90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164aa8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164ac8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164ae0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000007) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164af8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164b10 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000013) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164b30 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164b50 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164b68 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164b80 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164ba0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164bb8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164bd0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164be8 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000016) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164c08 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164c28 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000006) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164c40 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164c58 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000e) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164c78 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164c90 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164ca8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7ec1f903 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164cc0 ret=7ec1f903 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164ce0 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164cf8 ret=7ec1f543 | |
| 000d:Call ntdll.RtlAllocateHeap(00110000,00000000,0000000b) ret=7ec1f543 | |
| 000d:Ret ntdll.RtlAllocateHeap() retval=00164d10 ret=7ec1f543 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149fb8) ret=7ec1f895 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f895 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec1f7fd | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f7fd | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149f98) ret=7ec1f82b | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec1f82b | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00149d28) ret=7ec26f13 | |
| 000d:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ec26f13 | |
| 000d:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ec26fb7 | |
| 000d:R |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment