This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 154c0;section: [.text] | |
| 154e0;kernel32.GetVersionExA | |
| 15533;kernel32.GetModuleHandleA | |
| 16a98;kernel32.HeapCreate | |
| 186e4;kernel32.GetModuleHandleA | |
| 186f4;kernel32.GetProcAddress | |
| GetProcAddress: | |
| Arg[0] = ptr 0x76cd0000 -> {MZ\x90\x00\x03\x00\x00\x00} | |
| Arg[1] = ptr 0x0046b1ac -> "InitializeCriticalSectionAndSpinCount" | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 18717;kernel32.InitializeCriticalSectionAndSpinCount | |
| 1588b;kernel32.GetModuleHandleA | |
| 158a3;kernel32.GetProcAddress | |
| GetProcAddress: | |
| Arg[0] = ptr 0x76cd0000 -> {MZ\x90\x00\x03\x00\x00\x00} | |
| Arg[1] = ptr 0x0046aa78 -> "FlsAlloc" | |
| 158b0;kernel32.GetProcAddress | |
| GetProcAddress: | |
| Arg[0] = ptr 0x76cd0000 -> {MZ\x90\x00\x03\x00\x00\x00} | |
| Arg[1] = ptr 0x0046aa6c -> "FlsGetValue" | |
| 158bd;kernel32.GetProcAddress | |
| GetProcAddress: | |
| Arg[0] = ptr 0x76cd0000 -> {MZ\x90\x00\x03\x00\x00\x00} | |
| Arg[1] = ptr 0x0046aa60 -> "FlsSetValue" | |
| 158ca;kernel32.GetProcAddress | |
| GetProcAddress: | |
| Arg[0] = ptr 0x76cd0000 -> {MZ\x90\x00\x03\x00\x00\x00} | |
| Arg[1] = ptr 0x0046aa58 -> "FlsFree" | |
| 15907;kernel32.FlsAlloc | |
| 16e73;ntdll.RtlAllocateHeap | |
| 15934;kernel32.FlsSetValue | |
| 15948;kernel32.GetCurrentThreadId | |
| 1865b;ntdll.RtlAllocateHeap | |
| 16844;kernel32.GetStartupInfoA | |
| 1696f;kernel32.GetStdHandle | |
| 1697d;kernel32.GetFileType | |
| 1696f;kernel32.GetStdHandle | |
| 1697d;kernel32.GetFileType | |
| 1696f;kernel32.GetStdHandle | |
| 1697d;kernel32.GetFileType | |
| 169d5;kernel32.SetHandleCount | |
| 155c5;kernel32.GetCommandLineA | |
| 166e1;kernel32.GetEnvironmentStringsW | |
| 1674b;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x00565910 -> L"=::=::\" | |
| Arg[3] = 0x00000f9b = 3995 | |
| Arg[4] = 0 | |
| Arg[5] = 0 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1676d;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x00565910 -> L"=::=::\" | |
| Arg[3] = 0x00000f9b = 3995 | |
| Arg[4] = ptr 0x0f310ad8 -> {\xc0\x001\x0f\xc0\x001\x0f} | |
| Arg[5] = 0x00000f9b = 3995 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 16786;kernel32.FreeEnvironmentStringsW | |
| 16de8;ntdll.RtlEnterCriticalSection | |
| 17438;kernel32.GetACP | |
| 1865b;ntdll.RtlAllocateHeap | |
| 17296;kernel32.GetCPInfo | |
| 170ec;kernel32.GetCPInfo | |
| 19a3c;kernel32.GetStringTypeW | |
| 19ab0;kernel32.MultiByteToWideChar | |
| 19b2e;kernel32.MultiByteToWideChar | |
| 19b40;kernel32.GetStringTypeW | |
| 19c87;kernel32.LCMapStringW | |
| 19d20;kernel32.MultiByteToWideChar | |
| 19da1;kernel32.MultiByteToWideChar | |
| 19dbb;kernel32.LCMapStringW | |
| 19e6a;kernel32.LCMapStringW | |
| 19e8d;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x000004e4 = 1252 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0019f414 -> -> { \x00\x01\x00\x02\x00\x03\x00} | |
| Arg[3] = 0x00000100 = 256 | |
| Arg[4] = ptr 0x0019fbb0 -> {[\x04\x00\x00l\xfd\x19\x00} | |
| Arg[5] = 0x00000100 = 256 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 19d20;kernel32.MultiByteToWideChar | |
| 19da1;kernel32.MultiByteToWideChar | |
| 19dbb;kernel32.LCMapStringW | |
| 19e6a;kernel32.LCMapStringW | |
| 19e8d;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x000004e4 = 1252 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0019f3f4 -> -> { \x00\x01\x00\x02\x00\x03\x00} | |
| Arg[3] = 0x00000100 = 256 | |
| Arg[4] = ptr 0x0019fab0 -> {\x00\x00\x00\x00\xe4\xfa\x19\x00} | |
| Arg[5] = 0x00000100 = 256 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 16d18;ntdll.RtlLeaveCriticalSection | |
| 1664d;kernel32.GetModuleFileNameA | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 1865b;ntdll.RtlAllocateHeap | |
| 175bf;kernel32.HeapFree | |
| 15e94;kernel32.GetModuleHandleA | |
| 15ea4;kernel32.GetProcAddress | |
| GetProcAddress: | |
| Arg[0] = ptr 0x76cd0000 -> {MZ\x90\x00\x03\x00\x00\x00} | |
| Arg[1] = ptr 0x0046aac0 -> "IsProcessorFeaturePresent" | |
| 15eb0;kernel32.IsProcessorFeaturePresent | |
| 1865b;ntdll.RtlAllocateHeap | |
| 16de8;ntdll.RtlEnterCriticalSection | |
| 1acc2;ntdll.RtlSizeHeap | |
| 16d18;ntdll.RtlLeaveCriticalSection | |
| 1a928;kernel32.GetSystemTimeAsFileTime | |
| 1a934;kernel32.GetCurrentProcessId | |
| 1a93c;kernel32.GetCurrentThreadId | |
| 1a944;kernel32.GetTickCount | |
| 1a950;kernel32.QueryPerformanceCounter | |
| 15619;kernel32.GetStartupInfoA | |
| 1563c;kernel32.GetModuleHandleA | |
| 2d05;kernel32.OutputDebugStringA | |
| 2a93;kernel32.HeapCreate | |
| 2aab;kernel32.VirtualQuery | |
| 2ab7;kernel32.GetModuleHandleW | |
| 2aca;kernel32.OutputDebugStringA | |
| 2b22;ntdll.RtlAllocateHeap | |
| 2b4f;ntdll.RtlAllocateHeap | |
| 2b63;kernel32.CreateEventW | |
| 271e;ntdll.RtlAllocateHeap | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 252d;ntdll.RtlAllocateHeap | |
| 264f;kernel32.HeapFree | |
| 28f0;ntdll.RtlAllocateHeap | |
| 29af;ntdll.RtlAllocateHeap | |
| 29af;ntdll.RtlAllocateHeap | |
| 29af;ntdll.RtlAllocateHeap | |
| 29af;ntdll.RtlAllocateHeap | |
| 29af;ntdll.RtlAllocateHeap | |
| 2a16;kernel32.HeapFree | |
| 2a29;kernel32.HeapFree | |
| 2bd3;kernel32.WaitForSingleObject | |
| 1261;ntdll.RtlAllocateHeap | |
| 1261;ntdll.RtlAllocateHeap | |
| 1261;ntdll.RtlAllocateHeap | |
| 2bd3;kernel32.WaitForSingleObject | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 230f;kernel32.GetProcessHeap | |
| 2316;ntdll.RtlAllocateHeap | |
| 2bd3;kernel32.WaitForSingleObject | |
| 2207;kernel32.GetModuleHandleW | |
| 2215;kernel32.GetModuleHandleW | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 2bd3;kernel32.WaitForSingleObject | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 2bd3;kernel32.WaitForSingleObject | |
| 1b8e;user32.GetSystemMetrics | |
| 1b94;user32.GetSystemMetrics | |
| 1b9a;user32.GetDC | |
| 1baf;gdi32.GetDeviceCaps | |
| 1bb6;gdi32.GetDeviceCaps | |
| 1bbd;user32.ReleaseDC | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 1cb8;ntdll.ZwQuerySystemInformation | |
| ZwQuerySystemInformation: | |
| Arg[0] = 0x00000005 = 5 | |
| Arg[1] = 0 | |
| Arg[2] = 0 | |
| Arg[3] = ptr 0x0019fc38 -> {\x00\x00\x00\x00\x98\xf7\xa4\x0f} | |
| 1ccb;ntdll.RtlAllocateHeap | |
| 1ce8;ntdll.ZwQuerySystemInformation | |
| ZwQuerySystemInformation: | |
| Arg[0] = 0x00000005 = 5 | |
| Arg[1] = ptr 0x0f98d760 -> {\x00\x00\x00\x00\x00\x00\x00\x00} | |
| Arg[2] = 0x00036510 = 222480 | |
| Arg[3] = ptr 0x0019fc40 -> {\x00\x00\x00\x00`\xd7\x98\x0f} | |
| 1cfd;ntdll.RtlAllocateHeap | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = 0 | |
| Arg[3] = 0 | |
| Arg[4] = ptr 0x0f9c3c78 -> {\x00\x00\x00\x00\x00\x00\x00\x00} | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f98f5c0 -> L"System" | |
| Arg[3] = 0x00000006 = 6 | |
| Arg[4] = ptr 0x0f9c3c78 -> {\x00\x00\x00\x00\x00\x00\x00\x00} | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f98f860 -> L"Registry" | |
| Arg[3] = 0x00000008 = 8 | |
| Arg[4] = ptr 0x0f9c3c78 -> "System" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f98fa88 -> L"smss.exe" | |
| Arg[3] = 0x00000008 = 8 | |
| Arg[4] = ptr 0x0f9c3c78 -> "Registry" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f98fef0 -> L"csrss.exe" | |
| Arg[3] = 0x00000009 = 9 | |
| Arg[4] = ptr 0x0f9c3c78 -> "smss.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9900d8 -> L"wininit.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "csrss.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f990600 -> L"csrss.exe" | |
| Arg[3] = 0x00000009 = 9 | |
| Arg[4] = ptr 0x0f9c3c78 -> "wininit.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f990968 -> L"winlogon.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "csrss.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f990d58 -> L"services.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "winlogon.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f991148 -> L"lsass.exe" | |
| Arg[3] = 0x00000009 = 9 | |
| Arg[4] = ptr 0x0f9c3c78 -> "services.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f991670 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "lsass.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f991958 -> L"fontdrvhost.exe" | |
| Arg[3] = 0x0000000f = 15 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f991c48 -> L"fontdrvhost.exe" | |
| Arg[3] = 0x0000000f = 15 | |
| Arg[4] = ptr 0x0f9c3c78 -> "fontdrvhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9923f8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "fontdrvhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f992720 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f992d88 -> L"dwm.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f992fa8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "dwm.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9933d0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9935b8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9937e0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f993a08 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f993cf0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f993ed8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f994240 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9944e8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f994810 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f994c78 -> L"VBoxService.exe" | |
| Arg[3] = 0x0000000f = 15 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f994f68 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "VBoxService.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f995210 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f995538 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9957a0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9968c8 -> L"Memory Compression" | |
| Arg[3] = 0x00000012 = 18 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f996c40 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "Memory Compression" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f996e68 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f997090 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f997378 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9977e0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f997ac8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f997ef0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f998158 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f998400 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f998628 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f998990 -> L"spoolsv.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f998df8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "spoolsv.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f999060 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f999488 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9998f0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f999bd8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99a180 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99a468 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99a6d0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99a9b8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99aca0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99af48 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99b230 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99b658 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99ba80 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99bce8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99c050 -> L"SgrmBroker.exe" | |
| Arg[3] = 0x0000000e = 14 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99c2c0 -> L"uhssvc.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "SgrmBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99c628 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "uhssvc.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99c8d0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99cc78 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99d260 -> L"SearchIndexer.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99d698 -> L"sihost.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "SearchIndexer.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99db00 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "sihost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99dda8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99e150 -> L"taskhostw.exe" | |
| Arg[3] = 0x0000000d = 13 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99e400 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "taskhostw.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99e668 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f99ea90 -> L"ctfmon.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a2ef8 -> L"explorer.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "ctfmon.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a3228 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "explorer.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a3610 -> L"StartMenuExperienceHost.exe" | |
| Arg[3] = 0x0000001b = 27 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a3818 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "StartMenuExperienceHost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a3c90 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a3ec8 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a4480 -> L"PhoneExperienceHost.exe" | |
| Arg[3] = 0x00000017 = 23 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a4680 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "PhoneExperienceHost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a4af8 -> L"VBoxTray.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a4d68 -> L"ApplicationFrameHost.exe" | |
| Arg[3] = 0x00000018 = 24 | |
| Arg[4] = ptr 0x0f9c3c78 -> "VBoxTray.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a5070 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "ApplicationFrameHost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a5358 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a5940 -> L"SystemSettings.exe" | |
| Arg[3] = 0x00000012 = 18 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a5c38 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "SystemSettings.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a61e0 -> L"Microsoft.Photos.exe" | |
| Arg[3] = 0x00000014 = 20 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a64e0 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "Microsoft.Photos.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a68d8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a6d00 -> L"TextInputHost.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a6ff8 -> L"dllhost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "TextInputHost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a7220 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "dllhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a8048 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a83b0 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a89d8 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a8f80 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a93a8 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a9950 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a9b38 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9a9d20 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9aa108 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9aa670 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9aabd8 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ab180 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ab468 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ab690 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9abf78 -> L"ShellExperienceHost.exe" | |
| Arg[3] = 0x00000017 = 23 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ac1f8 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "ShellExperienceHost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ac470 -> L"MusNotifyIcon.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ac728 -> L"taskhostw.exe" | |
| Arg[3] = 0x0000000d = 13 | |
| Arg[4] = ptr 0x0f9c3c78 -> "MusNotifyIcon.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9aca18 -> L"MoUsoCoreWorker.exe" | |
| Arg[3] = 0x00000013 = 19 | |
| Arg[4] = ptr 0x0f9c3c78 -> "taskhostw.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9accd0 -> L"cmake-gui.exe" | |
| Arg[3] = 0x0000000d = 13 | |
| Arg[4] = ptr 0x0f9c3c78 -> "MoUsoCoreWorker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9acec0 -> L"cmd.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "cmake-gui.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ad120 -> L"conhost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "cmd.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ad7c8 -> L"OneDrive.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "conhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ada38 -> L"mspaint.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "OneDrive.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9adce0 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "mspaint.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9adec8 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9ae0b0 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9af258 -> L"SearchApp.exe" | |
| Arg[3] = 0x0000000d = 13 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9af488 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "SearchApp.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9af730 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9af918 -> L"cmd.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9afb78 -> L"conhost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "cmd.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9afd60 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "conhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9aff48 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b0130 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b0318 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b0500 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b06e8 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b08d0 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b0fb8 -> L"CalculatorApp.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b11b0 -> L"RuntimeBroker.exe" | |
| Arg[3] = 0x00000011 = 17 | |
| Arg[4] = ptr 0x0f9c3c78 -> "CalculatorApp.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b1728 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "RuntimeBroker.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b1c90 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b1eb8 -> L"PE-bear.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b20a0 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "PE-bear.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b2288 -> L"XVI32.exe" | |
| Arg[3] = 0x00000009 = 9 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b2570 -> L"baretail.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "XVI32.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b2820 -> L"notepad++.exe" | |
| Arg[3] = 0x0000000d = 13 | |
| Arg[4] = ptr 0x0f9c3c78 -> "baretail.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b2a10 -> L"cmd.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad++.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b2cf0 -> L"conhost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "cmd.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b3218 -> L"msedge.exe" | |
| Arg[3] = 0x0000000a = 10 | |
| Arg[4] = ptr 0x0f9c3c78 -> "conhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b3400 -> L"notepad.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "msedge.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b37e8 -> L"smartscreen.exe" | |
| Arg[3] = 0x0000000f = 15 | |
| Arg[4] = ptr 0x0f9c3c78 -> "notepad.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b3a18 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "smartscreen.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b3c40 -> L"svchost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b3ea8 -> L"cmd.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "svchost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b4208 -> L"conhost.exe" | |
| Arg[3] = 0x0000000b = 11 | |
| Arg[4] = ptr 0x0f9c3c78 -> "cmd.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b4470 -> L"pin.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "conhost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b4850 -> L"pin.exe" | |
| Arg[3] = 0x00000007 = 7 | |
| Arg[4] = ptr 0x0f9c3c78 -> "pin.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b4af0 -> L"p1.exe" | |
| Arg[3] = 0x00000006 = 6 | |
| Arg[4] = ptr 0x0f9c3c78 -> "pin.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b4e90 -> L"baretail.exe" | |
| Arg[3] = 0x0000000c = 12 | |
| Arg[4] = ptr 0x0f9c3c78 -> "p1.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b5280 -> L"SearchProtocolHost.exe" | |
| Arg[3] = 0x00000016 = 22 | |
| Arg[4] = ptr 0x0f9c3c78 -> "baretail.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1d2f;kernel32.WideCharToMultiByte | |
| WideCharToMultiByte: | |
| Arg[0] = 0x0000fde9 = 65001 | |
| Arg[1] = 0 | |
| Arg[2] = ptr 0x0f9b5600 -> L"SearchFilterHost.exe" | |
| Arg[3] = 0x00000014 = 20 | |
| Arg[4] = ptr 0x0f9c3c78 -> "SearchProtocolHost.exe" | |
| Arg[5] = 0x00001000 = 4096 | |
| Arg[6] = 0 | |
| Arg[7] = 0 | |
| 1df5;kernel32.HeapFree | |
| 1f63;kernel32.HeapFree | |
| 2bd3;kernel32.WaitForSingleObject | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 184d;ntdll.RtlGetVersion | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 1895;kernel32.GetCurrentProcess | |
| 189c;kernel32.VirtualAllocExNuma | |
| 1918;ntdll.ZwAllocateVirtualMemory | |
| 192a;ntdll.RtlAllocateHeap | |
| 1948;kernel32.InterlockedIncrement | |
| 198d;ntdll.RtlAllocateHeap | |
| 19af;kernel32.InterlockedIncrement | |
| 1a64;kernel32.HeapFree | |
| 1aa4;kernel32.HeapFree | |
| 13bd;kernel32.MultiByteToWideChar | |
| 13c8;kernel32.GetModuleHandleW | |
| 13e1;ntdll.RtlAllocateHeap | |
| 13fe;kernel32.InterlockedIncrement | |
| 149f;kernel32.HeapFree | |
| 1b02;kernel32.GetProcessHeap | |
| 1b09;ntdll.RtlAllocateHeap | |
| 2bd3;kernel32.WaitForSingleObject | |
| 1281;kernel32.HeapFree | |
| 1281;kernel32.HeapFree | |
| 1281;kernel32.HeapFree | |
| 2bf5;kernel32.CloseHandle | |
| 2c05;kernel32.HeapFree | |
| 2c4b;kernel32.HeapFree | |
| 2c56;kernel32.HeapDestroy | |
| 244e;ntdll.ZwProtectVirtualMemory | |
| 2459;called: ?? [11790000+0] | |
| > 11790000+2fe;kernel32.LocalAlloc | |
| > 11790000+ba;kernel32.LocalAlloc | |
| > 11790000+260;kernel32.LocalFree | |
| > 11790000+34c;kernel32.VirtualAlloc | |
| > 11790000+3a4;kernel32.VirtualProtect | |
| > 11790000+3bb;kernel32.LocalFree | |
| > 11790000+52;called: ?? [f991000+88] | |
| > f991000+80;called: ?? [f995000+d4d] | |
| > f995000+d58;called: ?? [f998000+0] | |
| > f998000+ca;called: ?? [f995000+d5d] | |
| > f995000+d66;called: ?? [f998000+22e] | |
| > f998000+264;called: ?? [f995000+be1] | |
| > f995000+c22;called: ?? [f998000+269] | |
| > f998000+264;called: ?? [f995000+be1] | |
| > f995000+c22;called: ?? [f998000+269] | |
| > f998000+264;called: ?? [f995000+be1] | |
| > f995000+c22;called: ?? [f998000+269] | |
| > f998000+28a;called: ?? [f995000+d6b] | |
| > f995000+d78;called: ?? [f998000+7c8] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] | |
| > f995000+ba9;called: ?? [f998000+82d] | |
| > f998000+828;called: ?? [f995000+b85] |