Last active
September 27, 2022 19:28
-
-
Save oopsmishap/464dd43139c0876fd9f3ea1fba86cfd3 to your computer and use it in GitHub Desktop.
handletest_x86.dmp.trace
This file has been truncated, but you can view the full file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 0x4010c0 handletest_x86.exe|push ebp|ebp=0x19ff74|esp=0x19ff2c | |
| 0x4010c1 handletest_x86.exe|mov ebp, esp|esp=0x19ff28 | |
| 0x4010c3 handletest_x86.exe|push 0x41e9bc|esp=0x19ff28 | |
| 0x4010c8 handletest_x86.exe|call 0x401080|esp=0x19ff24|eip=0x4010c8 | |
| 0x401080 handletest_x86.exe|push ebp|ebp=0x19ff28|esp=0x19ff20 | |
| 0x401081 handletest_x86.exe|mov ebp, esp|esp=0x19ff1c | |
| 0x401083 handletest_x86.exe|sub esp, 8|esp=0x19ff1c | |
| 0x401086 handletest_x86.exe|lea eax, [ebp + 0xc]|ebp=0x19ff1c | |
| 0x401089 handletest_x86.exe|mov dword ptr [ebp - 4], eax|ebp=0x19ff1c|eax=0x19ff28 | |
| 0x40108c handletest_x86.exe|mov ecx, dword ptr [ebp - 4]|ebp=0x19ff1c | |
| 0x40108f handletest_x86.exe|push ecx|ecx=0x19ff28|esp=0x19ff14 | |
| 0x401090 handletest_x86.exe|push 0|esp=0x19ff10 | |
| 0x401092 handletest_x86.exe|mov edx, dword ptr [ebp + 8]|ebp=0x19ff1c | |
| 0x401095 handletest_x86.exe|push edx|edx=0x41e9bc|esp=0x19ff0c | |
| 0x401096 handletest_x86.exe|push 1|esp=0x19ff08 | |
| 0x401098 handletest_x86.exe|call 0x404b56|esp=0x19ff04|eip=0x401098 | |
| 0x404b56 handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x404b58 handletest_x86.exe|push ebp|ebp=0x19ff1c|esp=0x19ff00 | |
| 0x404b59 handletest_x86.exe|mov ebp, esp|esp=0x19fefc | |
| 0x404b5b handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x38|eax=0x19ff28|ebp=0x19fefc | |
| 0x404b5f handletest_x86.exe|add eax, 0x41e040|eax=0x38 | |
| 0x404b64 handletest_x86.exe|pop ebp|ebp=0x19fefc|esp=0x19fefc | |
| 0x404b65 handletest_x86.exe|ret|esp=0x19ff00 | |
| 0x40109d handletest_x86.exe|add esp, 4|esp=0x19ff04 | |
| 0x4010a0 handletest_x86.exe|push eax|eax=0x41e078|esp=0x19ff08 | |
| 0x4010a1 handletest_x86.exe|call 0x401010|esp=0x19ff04|eip=0x4010a1 | |
| 0x401010 handletest_x86.exe|push ebp|ebp=0x19ff1c|esp=0x19ff00 | |
| 0x401011 handletest_x86.exe|mov ebp, esp|esp=0x19fefc | |
| 0x401013 handletest_x86.exe|mov eax, dword ptr [ebp + 0x14]|ebp=0x19fefc | |
| 0x401016 handletest_x86.exe|push eax|eax=0x19ff28|esp=0x19fefc | |
| 0x401017 handletest_x86.exe|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19fefc | |
| 0x40101a handletest_x86.exe|push ecx|ecx=0x0|esp=0x19fef8 | |
| 0x40101b handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19fefc | |
| 0x40101e handletest_x86.exe|push edx|edx=0x41e9bc|esp=0x19fef4 | |
| 0x40101f handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fefc | |
| 0x401022 handletest_x86.exe|push eax|eax=0x41e078|esp=0x19fef0 | |
| 0x401023 handletest_x86.exe|call 0x401000|esp=0x19feec|eip=0x401023 | |
| 0x401000 handletest_x86.exe|push ebp|ebp=0x19fefc|esp=0x19fee8 | |
| 0x401001 handletest_x86.exe|mov ebp, esp|esp=0x19fee4 | |
| 0x401003 handletest_x86.exe|mov eax, 0x41f450 | |
| 0x401008 handletest_x86.exe|pop ebp|ebp=0x19fee4|esp=0x19fee4 | |
| 0x401009 handletest_x86.exe|ret|esp=0x19fee8 | |
| 0x401028 handletest_x86.exe|mov ecx, dword ptr [eax + 4]|eax=0x41f450 | |
| 0x40102b handletest_x86.exe|push ecx|ecx=0x0|esp=0x19feec | |
| 0x40102c handletest_x86.exe|mov edx, dword ptr [eax]|eax=0x41f450 | |
| 0x40102e handletest_x86.exe|push edx|edx=0x24|esp=0x19fee8 | |
| 0x40102f handletest_x86.exe|call 0x406bce|esp=0x19fee4|eip=0x40102f | |
| 0x406bce handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x406bd0 handletest_x86.exe|push ebp|ebp=0x19fefc|esp=0x19fee0 | |
| 0x406bd1 handletest_x86.exe|mov ebp, esp|esp=0x19fedc | |
| 0x406bd3 handletest_x86.exe|sub esp, 0x5c|esp=0x19fedc | |
| 0x406bd6 handletest_x86.exe|push esi|esi=0x828f90|esp=0x19fe80 | |
| 0x406bd7 handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fedc|esp=0x19fe7c | |
| 0x406bda handletest_x86.exe|lea ecx, [ebp - 0x5c]|ebp=0x19fedc | |
| 0x406bdd handletest_x86.exe|call 0x4044e3|esp=0x19fe78|eip=0x406bdd | |
| 0x4044e3 handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x4044e5 handletest_x86.exe|push ebp|ebp=0x19fedc|esp=0x19fe74 | |
| 0x4044e6 handletest_x86.exe|mov ebp, esp|esp=0x19fe70 | |
| 0x4044e8 handletest_x86.exe|mov edx, ecx|ecx=0x19fe80 | |
| 0x4044ea handletest_x86.exe|xor eax, eax|eax=0x41f450 | |
| 0x4044ec handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19fe70 | |
| 0x4044ef handletest_x86.exe|mov byte ptr [edx + 0x14], al|edx=0x19fe80|al=0x0 | |
| 0x4044f2 handletest_x86.exe|mov dword ptr [edx], eax|edx=0x19fe80|eax=0x0 | |
| 0x4044f4 handletest_x86.exe|mov byte ptr [edx + 8], al|edx=0x19fe80|al=0x0 | |
| 0x4044f7 handletest_x86.exe|mov byte ptr [edx + 0x1c], al|edx=0x19fe80|al=0x0 | |
| 0x4044fa handletest_x86.exe|mov byte ptr [edx + 0x24], al|edx=0x19fe80|al=0x0 | |
| 0x4044fd handletest_x86.exe|test ecx, ecx|ecx=0x0 | |
| 0x4044ff handletest_x86.exe|je 0x404508|eflags=0x246 | |
| 0x404508 handletest_x86.exe|cmp dword ptr [0x41ef7c], eax|eax=0x0 | |
| 0x40450e handletest_x86.exe|jne 0x404525|eflags=0x246 | |
| 0x404510 handletest_x86.exe|mov eax, dword ptr [0x41e1b0] | |
| 0x404515 handletest_x86.exe|mov ecx, dword ptr [0x41e1b4] | |
| 0x40451b handletest_x86.exe|mov byte ptr [edx + 0x14], 1|edx=0x19fe80 | |
| 0x40451f handletest_x86.exe|mov dword ptr [edx + 0x10], ecx|edx=0x19fe80|ecx=0x828ce0 | |
| 0x404522 handletest_x86.exe|mov dword ptr [edx + 0xc], eax|edx=0x19fe80|eax=0x41e0f8 | |
| 0x404525 handletest_x86.exe|mov eax, edx|edx=0x19fe80 | |
| 0x404527 handletest_x86.exe|pop ebp|ebp=0x19fe70|esp=0x19fe70 | |
| 0x404528 handletest_x86.exe|ret 4|esp=0x19fe74 | |
| 0x406be2 handletest_x86.exe|mov eax, dword ptr [ebp + 0x1c]|ebp=0x19fedc | |
| 0x406be5 handletest_x86.exe|mov edx, dword ptr [ebp + 0x10]|ebp=0x19fedc | |
| 0x406be8 handletest_x86.exe|mov esi, dword ptr [ebp + 0x14]|ebp=0x19fedc | |
| 0x406beb handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19fedc | |
| 0x406bee handletest_x86.exe|mov dword ptr [ebp - 0x10], eax|ebp=0x19fedc|eax=0x19ff28 | |
| 0x406bf1 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fedc | |
| 0x406bf4 handletest_x86.exe|mov dword ptr [ebp - 0xc], esi|ebp=0x19fedc|esi=0x41e9bc | |
| 0x406bf7 handletest_x86.exe|mov dword ptr [ebp - 8], edx|ebp=0x19fedc|edx=0x41e078 | |
| 0x406bfa handletest_x86.exe|mov dword ptr [ebp - 0x20], eax|ebp=0x19fedc|eax=0x24 | |
| 0x406bfd handletest_x86.exe|mov dword ptr [ebp - 0x1c], ecx|ebp=0x19fedc|ecx=0x0 | |
| 0x406c00 handletest_x86.exe|test edx, edx|edx=0x41e078 | |
| 0x406c02 handletest_x86.exe|jne 0x406c27|eflags=0x206 | |
| 0x406c27 handletest_x86.exe|test esi, esi|esi=0x41e9bc | |
| 0x406c29 handletest_x86.exe|je 0x406c04|eflags=0x202 | |
| 0x406c2b handletest_x86.exe|lea eax, [ebp - 8]|ebp=0x19fedc | |
| 0x406c2e handletest_x86.exe|mov dword ptr [ebp - 0x14], edx|ebp=0x19fedc|edx=0x41e078 | |
| 0x406c31 handletest_x86.exe|mov dword ptr [ebp - 0x34], eax|ebp=0x19fedc|eax=0x19fed4 | |
| 0x406c34 handletest_x86.exe|lea ecx, [ebp - 1]|ebp=0x19fedc | |
| 0x406c37 handletest_x86.exe|lea eax, [ebp - 0x5c]|ebp=0x19fedc | |
| 0x406c3a handletest_x86.exe|mov dword ptr [ebp - 0x18], edx|ebp=0x19fedc|edx=0x41e078 | |
| 0x406c3d handletest_x86.exe|mov dword ptr [ebp - 0x30], eax|ebp=0x19fedc|eax=0x19fe80 | |
| 0x406c40 handletest_x86.exe|lea eax, [ebp - 0x20]|ebp=0x19fedc | |
| 0x406c43 handletest_x86.exe|mov dword ptr [ebp - 0x2c], eax|ebp=0x19fedc|eax=0x19febc | |
| 0x406c46 handletest_x86.exe|lea eax, [ebp - 0xc]|ebp=0x19fedc | |
| 0x406c49 handletest_x86.exe|mov dword ptr [ebp - 0x28], eax|ebp=0x19fedc|eax=0x19fed0 | |
| 0x406c4c handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19fedc | |
| 0x406c4f handletest_x86.exe|mov dword ptr [ebp - 0x24], eax|ebp=0x19fedc|eax=0x19fecc | |
| 0x406c52 handletest_x86.exe|lea eax, [ebp - 0x14]|ebp=0x19fedc | |
| 0x406c55 handletest_x86.exe|push eax|eax=0x19fec8|esp=0x19fe7c | |
| 0x406c56 handletest_x86.exe|lea eax, [ebp - 0x34]|ebp=0x19fedc | |
| 0x406c59 handletest_x86.exe|push eax|eax=0x19fea8|esp=0x19fe78 | |
| 0x406c5a handletest_x86.exe|lea eax, [ebp - 0x18]|ebp=0x19fedc | |
| 0x406c5d handletest_x86.exe|push eax|eax=0x19fec4|esp=0x19fe74 | |
| 0x406c5e handletest_x86.exe|call 0x405044|esp=0x19fe70|eip=0x406c5e | |
| 0x405044 handletest_x86.exe|push 0xc|esp=0x19fe6c | |
| 0x405046 handletest_x86.exe|push 0x41d0b8|esp=0x19fe68 | |
| 0x40504b handletest_x86.exe|call 0x401d60|esp=0x19fe64|eip=0x40504b | |
| 0x401d60 handletest_x86.exe|push 0x401fd0|esp=0x19fe60 | |
| 0x401d65 handletest_x86.exe|push dword ptr fs:[0]|esp=0x19fe5c | |
| 0x401d6c handletest_x86.exe|mov eax, dword ptr [esp + 0x10]|esp=0x19fe58 | |
| 0x401d70 handletest_x86.exe|mov dword ptr [esp + 0x10], ebp|esp=0x19fe58|ebp=0x19fedc | |
| 0x401d74 handletest_x86.exe|lea ebp, [esp + 0x10]|esp=0x19fe58 | |
| 0x401d78 handletest_x86.exe|sub esp, eax|esp=0x19fe58|eax=0xc | |
| 0x401d7a handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fe4c | |
| 0x401d7b handletest_x86.exe|push esi|esi=0x41e9bc|esp=0x19fe48 | |
| 0x401d7c handletest_x86.exe|push edi|edi=0x828fc0|esp=0x19fe44 | |
| 0x401d7d handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x401d82 handletest_x86.exe|xor dword ptr [ebp - 4], eax|ebp=0x19fe68|eax=0x666841b4 | |
| 0x401d85 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19fe68 | |
| 0x401d87 handletest_x86.exe|push eax|eax=0x6671bfdc|esp=0x19fe40 | |
| 0x401d88 handletest_x86.exe|mov dword ptr [ebp - 0x18], esp|ebp=0x19fe68|esp=0x19fe3c | |
| 0x401d8b handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19fe68|esp=0x19fe3c | |
| 0x401d8e handletest_x86.exe|mov eax, dword ptr [ebp - 4]|ebp=0x19fe68 | |
| 0x401d91 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fe68 | |
| 0x401d98 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19fe68|eax=0x6629910c | |
| 0x401d9b handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19fe68 | |
| 0x401d9e handletest_x86.exe|mov dword ptr fs:[0], eax|eax=0x19fe58 | |
| 0x401da4 handletest_x86.exe|ret|esp=0x19fe38 | |
| 0x405050 handletest_x86.exe|and dword ptr [ebp - 0x1c], 0|ebp=0x19fe68 | |
| 0x405054 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe68 | |
| 0x405057 handletest_x86.exe|push dword ptr [eax]|eax=0x19fec4|esp=0x19fe3c | |
| 0x405059 handletest_x86.exe|call 0x404bb2|esp=0x19fe38|eip=0x405059 | |
| 0x404bb2 handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x404bb4 handletest_x86.exe|push ebp|ebp=0x19fe68|esp=0x19fe34 | |
| 0x404bb5 handletest_x86.exe|mov ebp, esp|esp=0x19fe30 | |
| 0x404bb7 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe30 | |
| 0x404bba handletest_x86.exe|add eax, 0x20|eax=0x41e078 | |
| 0x404bbd handletest_x86.exe|push eax|eax=0x41e098|esp=0x19fe30 | |
| 0x404bbe handletest_x86.exe|call dword ptr [0x417040]|esp=0x19fe2c | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x828fc0 | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19fe30|esp=0x19fe28 | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fe24 | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19fe24 | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19fe24 | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x41e098 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x41e09c | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa03 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x41e098|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x41e098 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19fe24 | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19fe24|esp=0x19fe24 | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19fe28 | |
| 0x404bc4 handletest_x86.exe|pop ebp|ebp=0x19fe30|esp=0x19fe30 | |
| 0x404bc5 handletest_x86.exe|ret|esp=0x19fe34 | |
| 0x40505e handletest_x86.exe|pop ecx|ecx=0x41e098|esp=0x19fe38 | |
| 0x40505f handletest_x86.exe|and dword ptr [ebp - 4], 0|ebp=0x19fe68 | |
| 0x405063 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19fe68 | |
| 0x405066 handletest_x86.exe|call 0x405bf5|esp=0x19fe3c|eip=0x405066 | |
| 0x405bf5 handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x405bf7 handletest_x86.exe|push ebp|ebp=0x19fe68|esp=0x19fe38 | |
| 0x405bf8 handletest_x86.exe|mov ebp, esp|esp=0x19fe34 | |
| 0x405bfa handletest_x86.exe|sub esp, 0x464|esp=0x19fe34 | |
| 0x405c00 handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x405c05 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19fe34 | |
| 0x405c07 handletest_x86.exe|mov dword ptr [ebp - 4], eax|ebp=0x19fe34|eax=0x6671bf80 | |
| 0x405c0a handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19f9d0 | |
| 0x405c0b handletest_x86.exe|push esi|esi=0x41e9bc|esp=0x19f9cc | |
| 0x405c0c handletest_x86.exe|mov esi, ecx|ecx=0x19fea8 | |
| 0x405c0e handletest_x86.exe|push edi|edi=0x828fc0|esp=0x19f9c8 | |
| 0x405c0f handletest_x86.exe|mov eax, dword ptr [esi]|esi=0x19fea8 | |
| 0x405c11 handletest_x86.exe|mov edi, dword ptr [esi + 4]|esi=0x19fea8 | |
| 0x405c14 handletest_x86.exe|mov ebx, dword ptr [eax]|eax=0x19fed4 | |
| 0x405c16 handletest_x86.exe|push ebx|ebx=0x41e078|esp=0x19f9c4 | |
| 0x405c17 handletest_x86.exe|call 0x40c0c4|esp=0x19f9c0|eip=0x405c17 | |
| 0x40c0c4 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40c0c6 handletest_x86.exe|push ebp|ebp=0x19fe34|esp=0x19f9bc | |
| 0x40c0c7 handletest_x86.exe|mov ebp, esp|esp=0x19f9b8 | |
| 0x40c0c9 handletest_x86.exe|push ebx|ebx=0x41e078|esp=0x19f9b8 | |
| 0x40c0ca handletest_x86.exe|push esi|esi=0x19fea8|esp=0x19f9b4 | |
| 0x40c0cb handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19f9b8 | |
| 0x40c0ce handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19f9b0 | |
| 0x40c0cf handletest_x86.exe|push esi|esi=0x41e078|esp=0x19f9ac | |
| 0x40c0d0 handletest_x86.exe|call 0x40c089|esp=0x19f9a8|eip=0x40c0d0 | |
| 0x40c089 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40c08b handletest_x86.exe|push ebp|ebp=0x19f9b8|esp=0x19f9a4 | |
| 0x40c08c handletest_x86.exe|mov ebp, esp|esp=0x19f9a0 | |
| 0x40c08e handletest_x86.exe|push 2|esp=0x19f9a0 | |
| 0x40c090 handletest_x86.exe|call 0x404b56|esp=0x19f99c|eip=0x40c090 | |
| 0x404b56 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x404b58 handletest_x86.exe|push ebp|ebp=0x19f9a0|esp=0x19f998 | |
| 0x404b59 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x404b5b handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x38|eax=0x19fed4|ebp=0x19f994 | |
| 0x404b5f handletest_x86.exe|add eax, 0x41e040|eax=0x70 | |
| 0x404b64 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x404b65 handletest_x86.exe|ret|esp=0x19f998 | |
| 0x40c095 handletest_x86.exe|pop ecx|ecx=0x19fea8|esp=0x19f99c | |
| 0x40c096 handletest_x86.exe|cmp dword ptr [ebp + 8], eax|ebp=0x19f9a0|eax=0x41e0b0 | |
| 0x40c099 handletest_x86.exe|je 0x40c0c0|eflags=0x283 | |
| 0x40c09b handletest_x86.exe|push 1|esp=0x19f9a0 | |
| 0x40c09d handletest_x86.exe|call 0x404b56|esp=0x19f99c|eip=0x40c09d | |
| 0x404b56 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x404b58 handletest_x86.exe|push ebp|ebp=0x19f9a0|esp=0x19f998 | |
| 0x404b59 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x404b5b handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x38|eax=0x41e0b0|ebp=0x19f994 | |
| 0x404b5f handletest_x86.exe|add eax, 0x41e040|eax=0x38 | |
| 0x404b64 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x404b65 handletest_x86.exe|ret|esp=0x19f998 | |
| 0x40c0a2 handletest_x86.exe|pop ecx|ecx=0x2|esp=0x19f99c | |
| 0x40c0a3 handletest_x86.exe|cmp dword ptr [ebp + 8], eax|ebp=0x19f9a0|eax=0x41e078 | |
| 0x40c0a6 handletest_x86.exe|jne 0x40c0bc|eflags=0x246 | |
| 0x40c0a8 handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f9a0|esp=0x19f9a0 | |
| 0x40c0ab handletest_x86.exe|call 0x4087bb|esp=0x19f99c|eip=0x40c0ab | |
| 0x4087bb handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x4087bd handletest_x86.exe|push ebp|ebp=0x19f9a0|esp=0x19f998 | |
| 0x4087be handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x4087c0 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f994 | |
| 0x4087c3 handletest_x86.exe|test eax, eax|eax=0x41e078 | |
| 0x4087c5 handletest_x86.exe|jne 0x4087dc|eflags=0x206 | |
| 0x4087dc handletest_x86.exe|mov eax, dword ptr [eax + 0x10]|eax=0x41e078 | |
| 0x4087df handletest_x86.exe|nop | |
| 0x4087e0 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x4087e1 handletest_x86.exe|ret|esp=0x19f998 | |
| 0x40c0b0 handletest_x86.exe|push eax|eax=0x1|esp=0x19f99c | |
| 0x40c0b1 handletest_x86.exe|call 0x40f1ab|esp=0x19f998|eip=0x40c0b1 | |
| 0x40f1ab handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40f1ad handletest_x86.exe|push ebp|ebp=0x19f9a0|esp=0x19f994 | |
| 0x40f1ae handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x40f1b0 handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x40f1b3 handletest_x86.exe|cmp ecx, -2|ecx=0x1 | |
| 0x40f1b6 handletest_x86.exe|jne 0x40f1c5|eflags=0x217 | |
| 0x40f1c5 handletest_x86.exe|test ecx, ecx|ecx=0x1 | |
| 0x40f1c7 handletest_x86.exe|js 0x40f1ed|eflags=0x202 | |
| 0x40f1c9 handletest_x86.exe|cmp ecx, dword ptr [0x41f1a8]|ecx=0x1 | |
| 0x40f1cf handletest_x86.exe|jae 0x40f1ed|eflags=0x283 | |
| 0x40f1d1 handletest_x86.exe|mov eax, ecx|ecx=0x1 | |
| 0x40f1d3 handletest_x86.exe|and ecx, 0x3f|ecx=0x1 | |
| 0x40f1d6 handletest_x86.exe|shr eax, 6|eax=0x1 | |
| 0x40f1d9 handletest_x86.exe|imul ecx, ecx, 0x38|ecx=0x1 | |
| 0x40f1dc handletest_x86.exe|mov eax, dword ptr [eax*4 + 0x41efa8]|eax=0x0 | |
| 0x40f1e3 handletest_x86.exe|movzx eax, byte ptr [eax + ecx + 0x28]|eax=0x827ed8|ecx=0x38 | |
| 0x40f1e8 handletest_x86.exe|and eax, 0x40|eax=0xc1 | |
| 0x40f1eb handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x40f1ec handletest_x86.exe|ret|esp=0x19f994 | |
| 0x40c0b6 handletest_x86.exe|pop ecx|ecx=0x38|esp=0x19f998 | |
| 0x40c0b7 handletest_x86.exe|pop ecx|ecx=0x1|esp=0x19f99c | |
| 0x40c0b8 handletest_x86.exe|test eax, eax|eax=0x40 | |
| 0x40c0ba handletest_x86.exe|jne 0x40c0c0|eflags=0x202 | |
| 0x40c0c0 handletest_x86.exe|mov al, 1 | |
| 0x40c0c2 handletest_x86.exe|pop ebp|ebp=0x19f9a0|esp=0x19f9a0 | |
| 0x40c0c3 handletest_x86.exe|ret|esp=0x19f9a4 | |
| 0x40c0d5 handletest_x86.exe|pop ecx|ecx=0x41e078|esp=0x19f9a8 | |
| 0x40c0d6 handletest_x86.exe|test al, al|al=0x1 | |
| 0x40c0d8 handletest_x86.exe|je 0x40c169|eflags=0x202 | |
| 0x40c0de handletest_x86.exe|push 1|esp=0x19f9ac | |
| 0x40c0e0 handletest_x86.exe|call 0x404b56|esp=0x19f9a8|eip=0x40c0e0 | |
| 0x404b56 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x404b58 handletest_x86.exe|push ebp|ebp=0x19f9b8|esp=0x19f9a4 | |
| 0x404b59 handletest_x86.exe|mov ebp, esp|esp=0x19f9a0 | |
| 0x404b5b handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x38|eax=0x1|ebp=0x19f9a0 | |
| 0x404b5f handletest_x86.exe|add eax, 0x41e040|eax=0x38 | |
| 0x404b64 handletest_x86.exe|pop ebp|ebp=0x19f9a0|esp=0x19f9a0 | |
| 0x404b65 handletest_x86.exe|ret|esp=0x19f9a4 | |
| 0x40c0e5 handletest_x86.exe|pop ecx|ecx=0x41e078|esp=0x19f9a8 | |
| 0x40c0e6 handletest_x86.exe|push 2|esp=0x19f9ac | |
| 0x40c0e8 handletest_x86.exe|pop ebx|ebx=0x41e078|esp=0x19f9a8 | |
| 0x40c0e9 handletest_x86.exe|cmp esi, eax|esi=0x41e078|eax=0x41e078 | |
| 0x40c0eb handletest_x86.exe|jne 0x40c0f4|eflags=0x246 | |
| 0x40c0ed handletest_x86.exe|mov edi, 0x41f294 | |
| 0x40c0f2 handletest_x86.exe|jmp 0x40c104 | |
| 0x40c104 handletest_x86.exe|inc dword ptr [0x41ee34] | |
| 0x40c10a handletest_x86.exe|lea ecx, [esi + 0xc]|esi=0x41e078 | |
| 0x40c10d handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x41e084 | |
| 0x40c10f handletest_x86.exe|nop | |
| 0x40c110 handletest_x86.exe|test eax, 0x4c0|eax=0x2002 | |
| 0x40c115 handletest_x86.exe|jne 0x40c169|eflags=0x246 | |
| 0x40c117 handletest_x86.exe|mov eax, 0x282 | |
| 0x40c11c handletest_x86.exe|lock or dword ptr [ecx], eax|ecx=0x41e084|eax=0x282 | |
| 0x40c11f handletest_x86.exe|mov eax, dword ptr [edi]|edi=0x41f294 | |
| 0x40c121 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x40c123 handletest_x86.exe|jne 0x40c152|eflags=0x246 | |
| 0x40c125 handletest_x86.exe|push 0x1000|esp=0x19f9ac | |
| 0x40c12a handletest_x86.exe|call 0x40ae84|esp=0x19f9a8|eip=0x40c12a | |
| 0x40ae84 handletest_x86.exe|mov edi, edi|edi=0x41f294 | |
| 0x40ae86 handletest_x86.exe|push ebp|ebp=0x19f9b8|esp=0x19f9a4 | |
| 0x40ae87 handletest_x86.exe|mov ebp, esp|esp=0x19f9a0 | |
| 0x40ae89 handletest_x86.exe|push esi|esi=0x41e078|esp=0x19f9a0 | |
| 0x40ae8a handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19f9a0 | |
| 0x40ae8d handletest_x86.exe|cmp esi, -0x20|esi=0x1000 | |
| 0x40ae90 handletest_x86.exe|ja 0x40aec2|eflags=0x203 | |
| 0x40ae92 handletest_x86.exe|test esi, esi|esi=0x1000 | |
| 0x40ae94 handletest_x86.exe|jne 0x40aead|eflags=0x206 | |
| 0x40aead handletest_x86.exe|push esi|esi=0x1000|esp=0x19f99c | |
| 0x40aeae handletest_x86.exe|push 0|esp=0x19f998 | |
| 0x40aeb0 handletest_x86.exe|push dword ptr [0x41f410]|esp=0x19f994 | |
| 0x40aeb6 handletest_x86.exe|call dword ptr [0x4170a4]|esp=0x19f990 | |
| 0x77174cf0 ntdll.dll:RtlAllocateHeap|mov edi, edi|edi=0x41f294 | |
| 0x77174cf2 ntdll.dll:RtlAllocateHeap+0x2|push ebp|ebp=0x19f9a0|esp=0x19f98c | |
| 0x77174cf3 ntdll.dll:RtlAllocateHeap+0x3|mov ebp, esp|esp=0x19f988 | |
| 0x77174cf5 ntdll.dll:RtlAllocateHeap+0x5|and esp, 0xfffffff8|esp=0x19f988 | |
| 0x77174cf8 ntdll.dll:RtlAllocateHeap+0x8|push ecx|ecx=0x41e084|esp=0x19f988 | |
| 0x77174cf9 ntdll.dll:RtlAllocateHeap+0x9|push esi|esi=0x1000|esp=0x19f984 | |
| 0x77174cfa ntdll.dll:RtlAllocateHeap+0xa|mov esi, dword ptr [ebp + 8]|ebp=0x19f988 | |
| 0x77174cfd ntdll.dll:RtlAllocateHeap+0xd|test esi, esi|esi=0x820000 | |
| 0x77174cff ntdll.dll:RtlAllocateHeap+0xf|je 0x771d332b|eflags=0x206 | |
| 0x77174d05 ntdll.dll:RtlAllocateHeap+0x15|cmp dword ptr [esi + 8], 0xddeeddee|esi=0x820000 | |
| 0x77174d0c ntdll.dll:RtlAllocateHeap+0x1c|mov ecx, esi|esi=0x820000 | |
| 0x77174d0e ntdll.dll:RtlAllocateHeap+0x1e|mov edx, dword ptr [ebp + 0x10]|ebp=0x19f988 | |
| 0x77174d11 ntdll.dll:RtlAllocateHeap+0x21|je 0x771d3342|eflags=0x206 | |
| 0x77174d17 ntdll.dll:RtlAllocateHeap+0x27|test byte ptr [0x77259164], 2 | |
| 0x77174d1e ntdll.dll:RtlAllocateHeap+0x2e|jne 0x771d334f|eflags=0x246 | |
| 0x77174d24 ntdll.dll:RtlAllocateHeap+0x34|push 0|esp=0x19f980 | |
| 0x77174d26 ntdll.dll:RtlAllocateHeap+0x36|push dword ptr [ebp + 0xc]|ebp=0x19f988|esp=0x19f97c | |
| 0x77174d29 ntdll.dll:RtlAllocateHeap+0x39|call 0x77174d40|esp=0x19f978|eip=0x77174d29 | |
| 0x77174d40 ntdll.dll:RtlAllocateHeap+0x50|mov edi, edi|edi=0x41f294 | |
| 0x77174d42 ntdll.dll:RtlAllocateHeap+0x52|push ebp|ebp=0x19f988|esp=0x19f974 | |
| 0x77174d43 ntdll.dll:RtlAllocateHeap+0x53|mov ebp, esp|esp=0x19f970 | |
| 0x77174d45 ntdll.dll:RtlAllocateHeap+0x55|sub esp, 0x6c|esp=0x19f970 | |
| 0x77174d48 ntdll.dll:RtlAllocateHeap+0x58|push ebx|ebx=0x2|esp=0x19f904 | |
| 0x77174d49 ntdll.dll:RtlAllocateHeap+0x59|mov ebx, ecx|ecx=0x820000 | |
| 0x77174d4b ntdll.dll:RtlAllocateHeap+0x5b|mov ecx, dword ptr [ebp + 8]|ebp=0x19f970 | |
| 0x77174d4e ntdll.dll:RtlAllocateHeap+0x5e|push esi|esi=0x820000|esp=0x19f900 | |
| 0x77174d4f ntdll.dll:RtlAllocateHeap+0x5f|push edi|edi=0x41f294|esp=0x19f8fc | |
| 0x77174d50 ntdll.dll:RtlAllocateHeap+0x60|mov edi, edx|edx=0x1000 | |
| 0x77174d52 ntdll.dll:RtlAllocateHeap+0x62|mov dword ptr [ebp - 0xc], ebx|ebp=0x19f970|ebx=0x820000 | |
| 0x77174d55 ntdll.dll:RtlAllocateHeap+0x65|cmp dword ptr [ebx + 8], 0xddeeddee|ebx=0x820000 | |
| 0x77174d5c ntdll.dll:RtlAllocateHeap+0x6c|mov dword ptr [ebp - 0x14], edi|ebp=0x19f970|edi=0x1000 | |
| 0x77174d5f ntdll.dll:RtlAllocateHeap+0x6f|jne 0x77174e49|eflags=0x206 | |
| 0x77174e49 ntdll.dll:RtlAllocateHeap+0x159|mov eax, dword ptr [ebx + 0x44]|ebx=0x820000 | |
| 0x77174e4c ntdll.dll:RtlAllocateHeap+0x15c|or ecx, eax|ecx=0x0|eax=0x0 | |
| 0x77174e4e ntdll.dll:RtlAllocateHeap+0x15e|mov dword ptr [ebp - 0x2c], 0|ebp=0x19f970 | |
| 0x77174e55 ntdll.dll:RtlAllocateHeap+0x165|mov dword ptr [ebp - 0x10], ecx|ebp=0x19f970|ecx=0x0 | |
| 0x77174e58 ntdll.dll:RtlAllocateHeap+0x168|mov dword ptr [ebp - 0x30], 0|ebp=0x19f970 | |
| 0x77174e5f ntdll.dll:RtlAllocateHeap+0x16f|mov dword ptr [ebp - 0x38], 0|ebp=0x19f970 | |
| 0x77174e66 ntdll.dll:RtlAllocateHeap+0x176|cmp edi, 0x7fffffff|edi=0x1000 | |
| 0x77174e6c ntdll.dll:RtlAllocateHeap+0x17c|jbe 0x77174e7a|eflags=0x293 | |
| 0x77174e7a ntdll.dll:RtlAllocateHeap+0x18a|and eax, 0x1000000|eax=0x0 | |
| 0x77174e7f ntdll.dll:RtlAllocateHeap+0x18f|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e81 ntdll.dll:RtlAllocateHeap+0x191|cmp dword ptr [0x772561f4], eax|eax=0x0 | |
| 0x77174e87 ntdll.dll:RtlAllocateHeap+0x197|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e89 ntdll.dll:RtlAllocateHeap+0x199|mov edx, dword ptr [ebx + 0xdc]|ebx=0x820000 | |
| 0x77174e8f ntdll.dll:RtlAllocateHeap+0x19f|mov ecx, edx|edx=0x0 | |
| 0x77174e91 ntdll.dll:RtlAllocateHeap+0x1a1|test ecx, ecx|ecx=0x0 | |
| 0x77174e93 ntdll.dll:RtlAllocateHeap+0x1a3|jne 0x77174e9f|eflags=0x246 | |
| 0x77174e95 ntdll.dll:RtlAllocateHeap+0x1a5|mov ecx, dword ptr [0x77259114] | |
| 0x77174e9b ntdll.dll:RtlAllocateHeap+0x1ab|test ecx, ecx|ecx=0x0 | |
| 0x77174e9d ntdll.dll:RtlAllocateHeap+0x1ad|je 0x77174eca|eflags=0x246 | |
| 0x77174eca ntdll.dll:RtlAllocateHeap+0x1da|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f970 | |
| 0x77174ecd ntdll.dll:RtlAllocateHeap+0x1dd|mov esi, dword ptr [ebx + 0x58]|ebx=0x820000 | |
| 0x77174ed0 ntdll.dll:RtlAllocateHeap+0x1e0|mov dword ptr [ebp - 0x48], esi|ebp=0x19f970|esi=0x0 | |
| 0x77174ed3 ntdll.dll:RtlAllocateHeap+0x1e3|test esi, esi|esi=0x0 | |
| 0x77174ed5 ntdll.dll:RtlAllocateHeap+0x1e5|je 0x77174f1c|eflags=0x246 | |
| 0x77174f1c ntdll.dll:RtlAllocateHeap+0x22c|mov eax, edi|edi=0x1000 | |
| 0x77174f1e ntdll.dll:RtlAllocateHeap+0x22e|test edi, edi|edi=0x1000 | |
| 0x77174f20 ntdll.dll:RtlAllocateHeap+0x230|jne 0x77174f27|eflags=0x206 | |
| 0x77174f27 ntdll.dll:RtlAllocateHeap+0x237|lea esi, [eax + 0xf]|eax=0x1000 | |
| 0x77174f2a ntdll.dll:RtlAllocateHeap+0x23a|and esi, 0xfffffff8|esi=0x100f | |
| 0x77174f2d ntdll.dll:RtlAllocateHeap+0x23d|mov edx, esi|esi=0x1008 | |
| 0x77174f2f ntdll.dll:RtlAllocateHeap+0x23f|mov dword ptr [ebp - 0x2c], esi|ebp=0x19f970|esi=0x1008 | |
| 0x77174f32 ntdll.dll:RtlAllocateHeap+0x242|shr edx, 3|edx=0x1008 | |
| 0x77174f35 ntdll.dll:RtlAllocateHeap+0x245|test dword ptr [ebp - 0x10], 0x7d810f61|ebp=0x19f970 | |
| 0x77174f3c ntdll.dll:RtlAllocateHeap+0x24c|mov dword ptr [ebp - 0x20], edx|ebp=0x19f970|edx=0x201 | |
| 0x77174f3f ntdll.dll:RtlAllocateHeap+0x24f|jne 0x77175cf9|eflags=0x246 | |
| 0x77174f45 ntdll.dll:RtlAllocateHeap+0x255|cmp edi, dword ptr [0x77256ccc]|edi=0x1000 | |
| 0x77174f4b ntdll.dll:RtlAllocateHeap+0x25b|ja 0x77175946|eflags=0x287 | |
| 0x77174f51 ntdll.dll:RtlAllocateHeap+0x261|mov eax, edx|edx=0x201 | |
| 0x77174f53 ntdll.dll:RtlAllocateHeap+0x263|shr eax, 3|eax=0x201 | |
| 0x77174f56 ntdll.dll:RtlAllocateHeap+0x266|mov dl, byte ptr [eax + ebx + 0xf2]|eax=0x40|ebx=0x820000 | |
| 0x77174f5d ntdll.dll:RtlAllocateHeap+0x26d|mov eax, dword ptr [ebp - 0x20]|ebp=0x19f970 | |
| 0x77174f60 ntdll.dll:RtlAllocateHeap+0x270|movzx ecx, al|al=0x1 | |
| 0x77174f63 ntdll.dll:RtlAllocateHeap+0x273|mov eax, 1 | |
| 0x77174f68 ntdll.dll:RtlAllocateHeap+0x278|and ecx, 7|ecx=0x1 | |
| 0x77174f6b ntdll.dll:RtlAllocateHeap+0x27b|shl eax, cl|eax=0x1|cl=0x1 | |
| 0x77174f6d ntdll.dll:RtlAllocateHeap+0x27d|test dl, al|dl=0x0|al=0x2 | |
| 0x77174f6f ntdll.dll:RtlAllocateHeap+0x27f|je 0x77175943|eflags=0x246 | |
| 0x77175943 ntdll.dll:RtlAllocateHeap+0xc53|mov edx, dword ptr [ebp - 0x20]|ebp=0x19f970 | |
| 0x77175946 ntdll.dll:RtlAllocateHeap+0xc56|mov eax, dword ptr [ebx + 0xb4]|ebx=0x820000 | |
| 0x7717594c ntdll.dll:RtlAllocateHeap+0xc5c|cmp edx, dword ptr [eax + 4]|edx=0x201|eax=0x820270 | |
| 0x7717594f ntdll.dll:RtlAllocateHeap+0xc5f|jb 0x77175962|eflags=0x206 | |
| 0x77175951 ntdll.dll:RtlAllocateHeap+0xc61|mov ecx, dword ptr [eax]|eax=0x820270 | |
| 0x77175953 ntdll.dll:RtlAllocateHeap+0xc63|test ecx, ecx|ecx=0x822b00 | |
| 0x77175955 ntdll.dll:RtlAllocateHeap+0xc65|je 0x77175cf0|eflags=0x206 | |
| 0x7717595b ntdll.dll:RtlAllocateHeap+0xc6b|mov eax, ecx|ecx=0x822b00 | |
| 0x7717595d ntdll.dll:RtlAllocateHeap+0xc6d|cmp edx, dword ptr [eax + 4]|edx=0x201|eax=0x822b00 | |
| 0x77175960 ntdll.dll:RtlAllocateHeap+0xc70|jae 0x77175951|eflags=0x283 | |
| 0x77175962 ntdll.dll:RtlAllocateHeap+0xc72|mov ecx, edx|edx=0x201 | |
| 0x77175964 ntdll.dll:RtlAllocateHeap+0xc74|cmp ecx, dword ptr [eax + 4]|ecx=0x201|eax=0x822b00 | |
| 0x77175967 ntdll.dll:RtlAllocateHeap+0xc77|jae 0x77175cf9|eflags=0x283 | |
| 0x7717596d ntdll.dll:RtlAllocateHeap+0xc7d|cmp edx, ecx|edx=0x201|ecx=0x201 | |
| 0x7717596f ntdll.dll:RtlAllocateHeap+0xc7f|jne 0x77175cf9|eflags=0x246 | |
| 0x77175975 ntdll.dll:RtlAllocateHeap+0xc85|sub edx, dword ptr [eax + 0x14]|edx=0x201|eax=0x822b00 | |
| 0x77175978 ntdll.dll:RtlAllocateHeap+0xc88|cmp dword ptr [eax + 8], 0|eax=0x822b00 | |
| 0x7717597c ntdll.dll:RtlAllocateHeap+0xc8c|je 0x77175980|eflags=0x246 | |
| 0x77175980 ntdll.dll:RtlAllocateHeap+0xc90|mov eax, dword ptr [eax + 0x20]|eax=0x822b00 | |
| 0x77175983 ntdll.dll:RtlAllocateHeap+0xc93|lea eax, [eax + edx*4]|eax=0x822c14|edx=0x181 | |
| 0x77175986 ntdll.dll:RtlAllocateHeap+0xc96|jmp 0x77175cfb | |
| 0x77175cfb ntdll.dll:RtlAllocateHeap+0x100b|mov edx, dword ptr [ebp - 0x10]|ebp=0x19f970 | |
| 0x77175cfe ntdll.dll:RtlAllocateHeap+0x100e|lea ecx, [ebp - 0x30]|ebp=0x19f970 | |
| 0x77175d01 ntdll.dll:RtlAllocateHeap+0x1011|push ecx|ecx=0x19f940|esp=0x19f8f8 | |
| 0x77175d02 ntdll.dll:RtlAllocateHeap+0x1012|push eax|eax=0x823218|esp=0x19f8f4 | |
| 0x77175d03 ntdll.dll:RtlAllocateHeap+0x1013|push esi|esi=0x1008|esp=0x19f8f0 | |
| 0x77175d04 ntdll.dll:RtlAllocateHeap+0x1014|push edi|edi=0x1000|esp=0x19f8ec | |
| 0x77175d05 ntdll.dll:RtlAllocateHeap+0x1015|or edx, 2|edx=0x0 | |
| 0x77175d08 ntdll.dll:RtlAllocateHeap+0x1018|mov ecx, ebx|ebx=0x820000 | |
| 0x77175d0a ntdll.dll:RtlAllocateHeap+0x101a|call 0x77175ec0|esp=0x19f8e8|eip=0x77175d0a | |
| 0x77175ec0 ntdll.dll:RtlAllocateHeap+0x11d0|mov edi, edi|edi=0x1000 | |
| 0x77175ec2 ntdll.dll:RtlAllocateHeap+0x11d2|push ebp|ebp=0x19f970|esp=0x19f8e4 | |
| 0x77175ec3 ntdll.dll:RtlAllocateHeap+0x11d3|mov ebp, esp|esp=0x19f8e0 | |
| 0x77175ec5 ntdll.dll:RtlAllocateHeap+0x11d5|push -2|esp=0x19f8e0 | |
| 0x77175ec7 ntdll.dll:RtlAllocateHeap+0x11d7|push 0x7723ec48|esp=0x19f8dc | |
| 0x77175ecc ntdll.dll:RtlAllocateHeap+0x11dc|push 0x771ad210|esp=0x19f8d8 | |
| 0x77175ed1 ntdll.dll:RtlAllocateHeap+0x11e1|mov eax, dword ptr fs:[0] | |
| 0x77175ed7 ntdll.dll:RtlAllocateHeap+0x11e7|push eax|eax=0x19fe58|esp=0x19f8d4 | |
| 0x77175ed8 ntdll.dll:RtlAllocateHeap+0x11e8|sub esp, 0x160|esp=0x19f8d0 | |
| 0x77175ede ntdll.dll:RtlAllocateHeap+0x11ee|push ebx|ebx=0x820000|esp=0x19f770 | |
| 0x77175edf ntdll.dll:RtlAllocateHeap+0x11ef|push esi|esi=0x1008|esp=0x19f76c | |
| 0x77175ee0 ntdll.dll:RtlAllocateHeap+0x11f0|push edi|edi=0x1000|esp=0x19f768 | |
| 0x77175ee1 ntdll.dll:RtlAllocateHeap+0x11f1|mov eax, dword ptr [0x7725e360] | |
| 0x77175ee6 ntdll.dll:RtlAllocateHeap+0x11f6|xor dword ptr [ebp - 8], eax|ebp=0x19f8e0|eax=0xf9e0af5e | |
| 0x77175ee9 ntdll.dll:RtlAllocateHeap+0x11f9|xor eax, ebp|eax=0xf9e0af5e|ebp=0x19f8e0 | |
| 0x77175eeb ntdll.dll:RtlAllocateHeap+0x11fb|push eax|eax=0xf9f957be|esp=0x19f764 | |
| 0x77175eec ntdll.dll:RtlAllocateHeap+0x11fc|lea eax, [ebp - 0x10]|ebp=0x19f8e0 | |
| 0x77175eef ntdll.dll:RtlAllocateHeap+0x11ff|mov dword ptr fs:[0], eax|eax=0x19f8d0 | |
| 0x77175ef5 ntdll.dll:RtlAllocateHeap+0x1205|mov ebx, edx|edx=0x2 | |
| 0x77175ef7 ntdll.dll:RtlAllocateHeap+0x1207|mov dword ptr [ebp - 0x68], ebx|ebp=0x19f8e0|ebx=0x2 | |
| 0x77175efa ntdll.dll:RtlAllocateHeap+0x120a|mov edi, ecx|ecx=0x820000 | |
| 0x77175efc ntdll.dll:RtlAllocateHeap+0x120c|mov dword ptr [ebp - 0xd8], edi|ebp=0x19f8e0|edi=0x820000 | |
| 0x77175f02 ntdll.dll:RtlAllocateHeap+0x1212|mov dword ptr [ebp - 0xb0], 0|ebp=0x19f8e0 | |
| 0x77175f0c ntdll.dll:RtlAllocateHeap+0x121c|mov dword ptr [ebp - 0x64], 1|ebp=0x19f8e0 | |
| 0x77175f13 ntdll.dll:RtlAllocateHeap+0x1223|mov byte ptr [ebp - 0x29], 0|ebp=0x19f8e0 | |
| 0x77175f17 ntdll.dll:RtlAllocateHeap+0x1227|mov dword ptr [ebp - 0x5c], 0|ebp=0x19f8e0 | |
| 0x77175f1e ntdll.dll:RtlAllocateHeap+0x122e|mov dword ptr [ebp - 0x50], 0|ebp=0x19f8e0 | |
| 0x77175f25 ntdll.dll:RtlAllocateHeap+0x1235|mov dword ptr [ebp - 0x9c], 0|ebp=0x19f8e0 | |
| 0x77175f2f ntdll.dll:RtlAllocateHeap+0x123f|mov esi, dword ptr [ebp + 0xc]|ebp=0x19f8e0 | |
| 0x77175f32 ntdll.dll:RtlAllocateHeap+0x1242|shr esi, 3|esi=0x1008 | |
| 0x77175f35 ntdll.dll:RtlAllocateHeap+0x1245|test ebx, 0x7d010f60|ebx=0x2 | |
| 0x77175f3b ntdll.dll:RtlAllocateHeap+0x124b|jne 0x77175f6f|eflags=0x246 | |
| 0x77175f3d ntdll.dll:RtlAllocateHeap+0x124d|cmp dword ptr [ebp + 8], 0x80000000|ebp=0x19f8e0 | |
| 0x77175f44 ntdll.dll:RtlAllocateHeap+0x1254|jae 0x77175f6f|eflags=0xa87 | |
| 0x77175f46 ntdll.dll:RtlAllocateHeap+0x1256|mov cl, 1 | |
| 0x77175f48 ntdll.dll:RtlAllocateHeap+0x1258|mov dword ptr [ebp - 0x34], ecx|ebp=0x19f8e0|ecx=0x820001 | |
| 0x77175f4b ntdll.dll:RtlAllocateHeap+0x125b|mov edx, esi|esi=0x201 | |
| 0x77175f4d ntdll.dll:RtlAllocateHeap+0x125d|mov dword ptr [ebp - 0x30], edx|ebp=0x19f8e0|edx=0x201 | |
| 0x77175f50 ntdll.dll:RtlAllocateHeap+0x1260|cmp edx, 2|edx=0x201 | |
| 0x77175f53 ntdll.dll:RtlAllocateHeap+0x1263|jae 0x77175f61|eflags=0x216 | |
| 0x77175f61 ntdll.dll:RtlAllocateHeap+0x1271|mov eax, dword ptr [ebp + 0x14]|ebp=0x19f8e0 | |
| 0x77175f64 ntdll.dll:RtlAllocateHeap+0x1274|mov dword ptr [eax], 3|eax=0x19f940 | |
| 0x77175f6a ntdll.dll:RtlAllocateHeap+0x127a|jmp 0x7717601c | |
| 0x7717601c ntdll.dll:RtlAllocateHeap+0x132c|and ebx, 0x800000|ebx=0x2 | |
| 0x77176022 ntdll.dll:RtlAllocateHeap+0x1332|je 0x77176039|eflags=0x246 | |
| 0x77176039 ntdll.dll:RtlAllocateHeap+0x1349|mov dword ptr [ebp - 4], 0|ebp=0x19f8e0 | |
| 0x77176040 ntdll.dll:RtlAllocateHeap+0x1350|test byte ptr [ebp - 0x68], 1|ebp=0x19f8e0 | |
| 0x77176044 ntdll.dll:RtlAllocateHeap+0x1354|jne 0x771760d7|eflags=0x246 | |
| 0x7717604a ntdll.dll:RtlAllocateHeap+0x135a|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19f760 | |
| 0x77176050 ntdll.dll:RtlAllocateHeap+0x1360|call 0x77193f20|esp=0x19f75c|eip=0x77176050 | |
| 0x77193f20 ntdll.dll:RtlTryEnterCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77193f22 ntdll.dll:RtlTryEnterCriticalSection+0x2|push ebp|ebp=0x19f8e0|esp=0x19f758 | |
| 0x77193f23 ntdll.dll:RtlTryEnterCriticalSection+0x3|mov ebp, esp|esp=0x19f754 | |
| 0x77193f25 ntdll.dll:RtlTryEnterCriticalSection+0x5|mov eax, dword ptr [ebp + 8]|ebp=0x19f754 | |
| 0x77193f28 ntdll.dll:RtlTryEnterCriticalSection+0x8|mov edx, dword ptr fs:[0x18] | |
| 0x77193f2f ntdll.dll:RtlTryEnterCriticalSection+0xf|lea ecx, [eax + 4]|eax=0x820258 | |
| 0x77193f32 ntdll.dll:RtlTryEnterCriticalSection+0x12|lock btr dword ptr [ecx], 0|ecx=0x82025c | |
| 0x77193f37 ntdll.dll:RtlTryEnterCriticalSection+0x17|jae 0x77193f4f|eflags=0x247 | |
| 0x77193f39 ntdll.dll:RtlTryEnterCriticalSection+0x19|mov ecx, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x77193f3c ntdll.dll:RtlTryEnterCriticalSection+0x1c|mov dword ptr [eax + 0xc], ecx|eax=0x820258|ecx=0x1fc0 | |
| 0x77193f3f ntdll.dll:RtlTryEnterCriticalSection+0x1f|mov dword ptr [eax + 8], 1|eax=0x820258 | |
| 0x77193f46 ntdll.dll:RtlTryEnterCriticalSection+0x26|mov eax, 1 | |
| 0x77193f4b ntdll.dll:RtlTryEnterCriticalSection+0x2b|pop ebp|ebp=0x19f754|esp=0x19f754 | |
| 0x77193f4c ntdll.dll:RtlTryEnterCriticalSection+0x2c|ret 4|esp=0x19f758 | |
| 0x77176055 ntdll.dll:RtlAllocateHeap+0x1365|test eax, eax|eax=0x1 | |
| 0x77176057 ntdll.dll:RtlAllocateHeap+0x1367|jne 0x771760b6|eflags=0x202 | |
| 0x771760b6 ntdll.dll:RtlAllocateHeap+0x13c6|inc dword ptr [edi + 0x214]|edi=0x820000 | |
| 0x771760bc ntdll.dll:RtlAllocateHeap+0x13cc|mov byte ptr [ebp - 0x7d], 1|ebp=0x19f8e0 | |
| 0x771760c0 ntdll.dll:RtlAllocateHeap+0x13d0|mov byte ptr [ebp - 0x29], 1|ebp=0x19f8e0 | |
| 0x771760c4 ntdll.dll:RtlAllocateHeap+0x13d4|test dword ptr [edi + 0x48], 0x30000000|edi=0x820000 | |
| 0x771760cb ntdll.dll:RtlAllocateHeap+0x13db|je 0x771760d4|eflags=0x246 | |
| 0x771760d4 ntdll.dll:RtlAllocateHeap+0x13e4|mov edx, dword ptr [ebp - 0x30]|ebp=0x19f8e0 | |
| 0x771760d7 ntdll.dll:RtlAllocateHeap+0x13e7|cmp edx, dword ptr [edi + 0x5c]|edx=0x201|edi=0x820000 | |
| 0x771760da ntdll.dll:RtlAllocateHeap+0x13ea|ja 0x77177819|eflags=0x283 | |
| 0x771760e0 ntdll.dll:RtlAllocateHeap+0x13f0|test ebx, ebx|ebx=0x0 | |
| 0x771760e2 ntdll.dll:RtlAllocateHeap+0x13f2|jne 0x77176211|eflags=0x246 | |
| 0x771760e8 ntdll.dll:RtlAllocateHeap+0x13f8|movzx eax, word ptr [edi + 0xf0]|edi=0x820000 | |
| 0x771760ef ntdll.dll:RtlAllocateHeap+0x13ff|cmp esi, eax|esi=0x201|eax=0x802 | |
| 0x771760f1 ntdll.dll:RtlAllocateHeap+0x1401|mov eax, dword ptr [ebp + 8]|ebp=0x19f8e0 | |
| 0x771760f4 ntdll.dll:RtlAllocateHeap+0x1404|jb 0x77176130|eflags=0x297 | |
| 0x77176130 ntdll.dll:RtlAllocateHeap+0x1440|cmp eax, dword ptr [0x77256ccc]|eax=0x1000 | |
| 0x77176136 ntdll.dll:RtlAllocateHeap+0x1446|ja 0x77176211|eflags=0x287 | |
| 0x7717613c ntdll.dll:RtlAllocateHeap+0x144c|mov eax, esi|esi=0x201 | |
| 0x7717613e ntdll.dll:RtlAllocateHeap+0x144e|shr eax, 3|eax=0x201 | |
| 0x77176141 ntdll.dll:RtlAllocateHeap+0x1451|add eax, 0xf2|eax=0x40 | |
| 0x77176146 ntdll.dll:RtlAllocateHeap+0x1456|add eax, edi|eax=0x132|edi=0x820000 | |
| 0x77176148 ntdll.dll:RtlAllocateHeap+0x1458|mov dword ptr [ebp - 0x54], eax|ebp=0x19f8e0|eax=0x820132 | |
| 0x7717614b ntdll.dll:RtlAllocateHeap+0x145b|mov dl, byte ptr [eax]|eax=0x820132 | |
| 0x7717614d ntdll.dll:RtlAllocateHeap+0x145d|mov ebx, esi|esi=0x201 | |
| 0x7717614f ntdll.dll:RtlAllocateHeap+0x145f|and ebx, 7|ebx=0x201 | |
| 0x77176152 ntdll.dll:RtlAllocateHeap+0x1462|mov eax, 1 | |
| 0x77176157 ntdll.dll:RtlAllocateHeap+0x1467|mov ecx, ebx|ebx=0x1 | |
| 0x77176159 ntdll.dll:RtlAllocateHeap+0x1469|shl eax, cl|eax=0x1|cl=0x1 | |
| 0x7717615b ntdll.dll:RtlAllocateHeap+0x146b|test dl, al|dl=0x0|al=0x2 | |
| 0x7717615d ntdll.dll:RtlAllocateHeap+0x146d|jne 0x7717620e|eflags=0x246 | |
| 0x77176163 ntdll.dll:RtlAllocateHeap+0x1473|mov eax, dword ptr [edi + 0xec]|edi=0x820000 | |
| 0x77176169 ntdll.dll:RtlAllocateHeap+0x1479|lea esi, [eax + esi*2]|eax=0x821af0|esi=0x201 | |
| 0x7717616c ntdll.dll:RtlAllocateHeap+0x147c|mov dword ptr [ebp - 0xe0], esi|ebp=0x19f8e0|esi=0x821ef2 | |
| 0x77176172 ntdll.dll:RtlAllocateHeap+0x1482|add word ptr [esi], 0x21|esi=0x821ef2 | |
| 0x77176176 ntdll.dll:RtlAllocateHeap+0x1486|mov cx, word ptr [esi]|esi=0x821ef2 | |
| 0x77176179 ntdll.dll:RtlAllocateHeap+0x1489|cmp dword ptr [ebp - 0x9c], 0|ebp=0x19f8e0 | |
| 0x77176180 ntdll.dll:RtlAllocateHeap+0x1490|jne 0x771761aa|eflags=0x246 | |
| 0x77176182 ntdll.dll:RtlAllocateHeap+0x1492|mov al, cl|cl=0x21 | |
| 0x77176184 ntdll.dll:RtlAllocateHeap+0x1494|and al, 0x1f|al=0x21 | |
| 0x77176186 ntdll.dll:RtlAllocateHeap+0x1496|cmp al, 0x10|al=0x1 | |
| 0x77176188 ntdll.dll:RtlAllocateHeap+0x1498|ja 0x771761a0|eflags=0x283 | |
| 0x7717618a ntdll.dll:RtlAllocateHeap+0x149a|mov eax, 0xff00 | |
| 0x7717618f ntdll.dll:RtlAllocateHeap+0x149f|cmp cx, ax|cx=0x21|ax=0xff00 | |
| 0x77176192 ntdll.dll:RtlAllocateHeap+0x14a2|ja 0x771761a0|eflags=0x207 | |
| 0x77176194 ntdll.dll:RtlAllocateHeap+0x14a4|mov dword ptr [ebp - 0xb4], 0|ebp=0x19f8e0 | |
| 0x7717619e ntdll.dll:RtlAllocateHeap+0x14ae|jmp 0x7717620e | |
| 0x7717620e ntdll.dll:RtlAllocateHeap+0x151e|mov edx, dword ptr [ebp - 0x30]|ebp=0x19f8e0 | |
| 0x77176211 ntdll.dll:RtlAllocateHeap+0x1521|mov esi, dword ptr [ebp + 0x10]|ebp=0x19f8e0 | |
| 0x77176214 ntdll.dll:RtlAllocateHeap+0x1524|test esi, esi|esi=0x823218 | |
| 0x77176216 ntdll.dll:RtlAllocateHeap+0x1526|je 0x7717646b|eflags=0x206 | |
| 0x7717621c ntdll.dll:RtlAllocateHeap+0x152c|mov esi, dword ptr [esi]|esi=0x823218 | |
| 0x7717621e ntdll.dll:RtlAllocateHeap+0x152e|test esi, esi|esi=0x0 | |
| 0x77176220 ntdll.dll:RtlAllocateHeap+0x1530|je 0x7717646b|eflags=0x246 | |
| 0x7717646b ntdll.dll:RtlAllocateHeap+0x177b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176471 ntdll.dll:RtlAllocateHeap+0x1781|mov dword ptr [ebp - 0xc0], eax|ebp=0x19f8e0|eax=0x8200c0 | |
| 0x77176477 ntdll.dll:RtlAllocateHeap+0x1787|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717647d ntdll.dll:RtlAllocateHeap+0x178d|mov dword ptr [ebp - 0x28], esi|ebp=0x19f8e0|esi=0x820270 | |
| 0x77176480 ntdll.dll:RtlAllocateHeap+0x1790|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176483 ntdll.dll:RtlAllocateHeap+0x1793|cmp edx, ecx|edx=0x201|ecx=0x80 | |
| 0x77176485 ntdll.dll:RtlAllocateHeap+0x1795|jae 0x7717648b|eflags=0x206 | |
| 0x7717648b ntdll.dll:RtlAllocateHeap+0x179b|mov eax, dword ptr [esi]|esi=0x820270 | |
| 0x7717648d ntdll.dll:RtlAllocateHeap+0x179d|test eax, eax|eax=0x822b00 | |
| 0x7717648f ntdll.dll:RtlAllocateHeap+0x179f|jne 0x7717780f|eflags=0x206 | |
| 0x7717780f ntdll.dll:RtlAllocateHeap+0x2b1f|mov esi, eax|eax=0x822b00 | |
| 0x77177811 ntdll.dll:RtlAllocateHeap+0x2b21|mov dword ptr [ebp - 0x28], eax|ebp=0x19f8e0|eax=0x822b00 | |
| 0x77177814 ntdll.dll:RtlAllocateHeap+0x2b24|jmp 0x77176480 | |
| 0x77176480 ntdll.dll:RtlAllocateHeap+0x1790|mov ecx, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176483 ntdll.dll:RtlAllocateHeap+0x1793|cmp edx, ecx|edx=0x201|ecx=0x800 | |
| 0x77176485 ntdll.dll:RtlAllocateHeap+0x1795|jae 0x7717648b|eflags=0x283 | |
| 0x77176487 ntdll.dll:RtlAllocateHeap+0x1797|mov eax, edx|edx=0x201 | |
| 0x77176489 ntdll.dll:RtlAllocateHeap+0x1799|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19f8e0|eax=0x201 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x201|esi=0x822b00 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19f8e0|eax=0x181 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19f8e0 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19f8e0|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82a3f8 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x293 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82a3f8 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8e0|eax=0x82a3f0 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82a3f0 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19f8e0|ebx=0x5b1ac974 | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x5b1ac974|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19f8e0|ebx=0x7f00017e | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x7f00017e | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x7f00017e | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x7f00017e | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x7f00017e | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x1 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x1|bl=0x7e | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x7f00017e | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x7f00017e | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x7f|cl=0x7f | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x17e | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19f8e0 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x201|eax=0x17e | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19f8e0|ecx=0x83 | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0x83 | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x202 | |
| 0x7717651f ntdll.dll:RtlAllocateHeap+0x182f|mov eax, edx|edx=0x8200c0 | |
| 0x77176521 ntdll.dll:RtlAllocateHeap+0x1831|jmp 0x771766db | |
| 0x771766db ntdll.dll:RtlAllocateHeap+0x19eb|mov dword ptr [ebp - 0x1c], eax|ebp=0x19f8e0|eax=0x8200c0 | |
| 0x771766de ntdll.dll:RtlAllocateHeap+0x19ee|test eax, eax|eax=0x8200c0 | |
| 0x771766e0 ntdll.dll:RtlAllocateHeap+0x19f0|je 0x77177802|eflags=0x206 | |
| 0x771766e6 ntdll.dll:RtlAllocateHeap+0x19f6|mov dword ptr [ebp - 0xf8], eax|ebp=0x19f8e0|eax=0x8200c0 | |
| 0x771766ec ntdll.dll:RtlAllocateHeap+0x19fc|cmp dword ptr [ebp - 0xc0], eax|ebp=0x19f8e0|eax=0x8200c0 | |
| 0x771766f2 ntdll.dll:RtlAllocateHeap+0x1a02|je 0x77176945|eflags=0x246 | |
| 0x77176945 ntdll.dll:RtlAllocateHeap+0x1c55|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f8e0 | |
| 0x77176948 ntdll.dll:RtlAllocateHeap+0x1c58|mov ecx, edi|edi=0x820000 | |
| 0x7717694a ntdll.dll:RtlAllocateHeap+0x1c5a|call 0x7718784d|esp=0x19f760|eip=0x7717694a | |
| 0x7718784d ntdll.dll:RtlSetUserValueHeap+0xa2d|mov edi, edi|edi=0x820000 | |
| 0x7718784f ntdll.dll:RtlSetUserValueHeap+0xa2f|push ebp|ebp=0x19f8e0|esp=0x19f75c | |
| 0x77187850 ntdll.dll:RtlSetUserValueHeap+0xa30|mov ebp, esp|esp=0x19f758 | |
| 0x77187852 ntdll.dll:RtlSetUserValueHeap+0xa32|sub esp, 0x1c|esp=0x19f758 | |
| 0x77187855 ntdll.dll:RtlSetUserValueHeap+0xa35|push ebx|ebx=0x7f00017e|esp=0x19f73c | |
| 0x77187856 ntdll.dll:RtlSetUserValueHeap+0xa36|push esi|esi=0x822b00|esp=0x19f738 | |
| 0x77187857 ntdll.dll:RtlSetUserValueHeap+0xa37|push edi|edi=0x820000|esp=0x19f734 | |
| 0x77187858 ntdll.dll:RtlSetUserValueHeap+0xa38|mov edi, edx|edx=0x1008 | |
| 0x7718785a ntdll.dll:RtlSetUserValueHeap+0xa3a|mov esi, ecx|ecx=0x820000 | |
| 0x7718785c ntdll.dll:RtlSetUserValueHeap+0xa3c|lea edx, [ebp - 0xc]|ebp=0x19f758 | |
| 0x7718785f ntdll.dll:RtlSetUserValueHeap+0xa3f|mov dword ptr [ebp - 0x14], edi|ebp=0x19f758|edi=0x1008 | |
| 0x77187862 ntdll.dll:RtlSetUserValueHeap+0xa42|xor ebx, ebx|ebx=0x7f00017e | |
| 0x77187864 ntdll.dll:RtlSetUserValueHeap+0xa44|lea eax, [edi + 0xfff]|edi=0x1008 | |
| 0x7718786a ntdll.dll:RtlSetUserValueHeap+0xa4a|and eax, 0xfffff000|eax=0x2007 | |
| 0x7718786f ntdll.dll:RtlSetUserValueHeap+0xa4f|mov dword ptr [ebp - 0xc], eax|ebp=0x19f758|eax=0x2000 | |
| 0x77187872 ntdll.dll:RtlSetUserValueHeap+0xa52|call 0x77187a6a|esp=0x19f730|eip=0x77187872 | |
| 0x77187a6a ntdll.dll:RtlSetUserValueHeap+0xc4a|mov edi, edi|edi=0x1008 | |
| 0x77187a6c ntdll.dll:RtlSetUserValueHeap+0xc4c|push ebp|ebp=0x19f758|esp=0x19f72c | |
| 0x77187a6d ntdll.dll:RtlSetUserValueHeap+0xc4d|mov ebp, esp|esp=0x19f728 | |
| 0x77187a6f ntdll.dll:RtlSetUserValueHeap+0xc4f|sub esp, 0x1c|esp=0x19f728 | |
| 0x77187a72 ntdll.dll:RtlSetUserValueHeap+0xc52|push ebx|ebx=0x0|esp=0x19f70c | |
| 0x77187a73 ntdll.dll:RtlSetUserValueHeap+0xc53|push esi|esi=0x820000|esp=0x19f708 | |
| 0x77187a74 ntdll.dll:RtlSetUserValueHeap+0xc54|mov esi, edx|edx=0x19f74c | |
| 0x77187a76 ntdll.dll:RtlSetUserValueHeap+0xc56|push edi|edi=0x1008|esp=0x19f704 | |
| 0x77187a77 ntdll.dll:RtlSetUserValueHeap+0xc57|mov dword ptr [ebp - 8], esi|ebp=0x19f728|esi=0x19f74c | |
| 0x77187a7a ntdll.dll:RtlSetUserValueHeap+0xc5a|mov edi, ecx|ecx=0x820000 | |
| 0x77187a7c ntdll.dll:RtlSetUserValueHeap+0xc5c|mov edx, dword ptr [esi]|esi=0x19f74c | |
| 0x77187a7e ntdll.dll:RtlSetUserValueHeap+0xc5e|call 0x77187e9d|esp=0x19f700|eip=0x77187a7e | |
| 0x77187e9d ntdll.dll:RtlSetUserValueHeap+0x107d|mov edi, edi|edi=0x820000 | |
| 0x77187e9f ntdll.dll:RtlSetUserValueHeap+0x107f|push ecx|ecx=0x820000|esp=0x19f6fc | |
| 0x77187ea0 ntdll.dll:RtlSetUserValueHeap+0x1080|cmp dword ptr [0x7725b414], 1 | |
| 0x77187ea7 ntdll.dll:RtlSetUserValueHeap+0x1087|push esi|esi=0x19f74c|esp=0x19f6f8 | |
| 0x77187ea8 ntdll.dll:RtlSetUserValueHeap+0x1088|push edi|edi=0x820000|esp=0x19f6f4 | |
| 0x77187ea9 ntdll.dll:RtlSetUserValueHeap+0x1089|mov esi, edx|edx=0x2000 | |
| 0x77187eab ntdll.dll:RtlSetUserValueHeap+0x108b|mov edi, ecx|ecx=0x820000 | |
| 0x77187ead ntdll.dll:RtlSetUserValueHeap+0x108d|jge 0x771d5c6a|eflags=0x297 | |
| 0x77187eb3 ntdll.dll:RtlSetUserValueHeap+0x1093|mov edx, dword ptr [edi + 0xb8]|edi=0x820000 | |
| 0x77187eb9 ntdll.dll:RtlSetUserValueHeap+0x1099|test edx, edx|edx=0x0 | |
| 0x77187ebb ntdll.dll:RtlSetUserValueHeap+0x109b|jne 0x771d5cd6|eflags=0x246 | |
| 0x77187ec1 ntdll.dll:RtlSetUserValueHeap+0x10a1|lea ecx, [edi + 0x8c]|edi=0x820000 | |
| 0x77187ec7 ntdll.dll:RtlSetUserValueHeap+0x10a7|mov eax, dword ptr [ecx]|ecx=0x82008c | |
| 0x77187ec9 ntdll.dll:RtlSetUserValueHeap+0x10a9|cmp ecx, eax|ecx=0x82008c|eax=0x82afe8 | |
| 0x77187ecb ntdll.dll:RtlSetUserValueHeap+0x10ab|jne 0x77187ed3|eflags=0x283 | |
| 0x77187ed3 ntdll.dll:RtlSetUserValueHeap+0x10b3|cmp dword ptr [eax + 0x14], esi|eax=0x82afe8|esi=0x2000 | |
| 0x77187ed6 ntdll.dll:RtlSetUserValueHeap+0x10b6|jae 0x77187ecf|eflags=0x206 | |
| 0x77187ecf ntdll.dll:RtlSetUserValueHeap+0x10af|pop edi|edi=0x820000|esp=0x19f6f0 | |
| 0x77187ed0 ntdll.dll:RtlSetUserValueHeap+0x10b0|pop esi|esi=0x2000|esp=0x19f6f4 | |
| 0x77187ed1 ntdll.dll:RtlSetUserValueHeap+0x10b1|pop ecx|ecx=0x82008c|esp=0x19f6f8 | |
| 0x77187ed2 ntdll.dll:RtlSetUserValueHeap+0x10b2|ret|esp=0x19f6fc | |
| 0x77187a83 ntdll.dll:RtlSetUserValueHeap+0xc63|mov edx, eax|eax=0x82afe8 | |
| 0x77187a85 ntdll.dll:RtlSetUserValueHeap+0xc65|lea esi, [edi + 0x8c]|edi=0x820000 | |
| 0x77187a8b ntdll.dll:RtlSetUserValueHeap+0xc6b|mov dword ptr [ebp - 4], edx|ebp=0x19f728|edx=0x82afe8 | |
| 0x77187a8e ntdll.dll:RtlSetUserValueHeap+0xc6e|cmp edx, esi|edx=0x82afe8|esi=0x82008c | |
| 0x77187a90 ntdll.dll:RtlSetUserValueHeap+0xc70|je 0x77187cf5|eflags=0x216 | |
| 0x77187a96 ntdll.dll:RtlSetUserValueHeap+0xc76|cmp dword ptr [0x7725b414], 1 | |
| 0x77187a9d ntdll.dll:RtlSetUserValueHeap+0xc7d|mov esi, dword ptr [ebp - 8]|ebp=0x19f728 | |
| 0x77187aa0 ntdll.dll:RtlSetUserValueHeap+0xc80|jge 0x771d596b|eflags=0x297 | |
| 0x77187aa6 ntdll.dll:RtlSetUserValueHeap+0xc86|lea ebx, [edx - 8]|edx=0x82afe8 | |
| 0x77187aa9 ntdll.dll:RtlSetUserValueHeap+0xc89|mov al, byte ptr [ebx + 6]|ebx=0x82afe0 | |
| 0x77187aac ntdll.dll:RtlSetUserValueHeap+0xc8c|test al, al|al=0x0 | |
| 0x77187aae ntdll.dll:RtlSetUserValueHeap+0xc8e|jne 0x77187cd7|eflags=0x246 | |
| 0x77187ab4 ntdll.dll:RtlSetUserValueHeap+0xc94|mov dword ptr [ebp - 0x10], edi|ebp=0x19f728|edi=0x820000 | |
| 0x77187ab7 ntdll.dll:RtlSetUserValueHeap+0xc97|mov eax, dword ptr [edx + 0x10]|edx=0x82afe8 | |
| 0x77187aba ntdll.dll:RtlSetUserValueHeap+0xc9a|mov dword ptr [ebp - 0xc], eax|ebp=0x19f728|eax=0x82b000 | |
| 0x77187abd ntdll.dll:RtlSetUserValueHeap+0xc9d|mov eax, dword ptr [edi + 0xcc]|edi=0x820000 | |
| 0x77187ac3 ntdll.dll:RtlSetUserValueHeap+0xca3|xor eax, dword ptr [0x7725b6fc]|eax=0xa60aba7e | |
| 0x77187ac9 ntdll.dll:RtlSetUserValueHeap+0xca9|mov dword ptr [ebp - 0x14], eax|ebp=0x19f728|eax=0x0 | |
| 0x77187acc ntdll.dll:RtlSetUserValueHeap+0xcac|jne 0x771d59ce|eflags=0x246 | |
| 0x77187ad2 ntdll.dll:RtlSetUserValueHeap+0xcb2|mov edx, dword ptr [edx + 0x14]|edx=0x82afe8 | |
| 0x77187ad5 ntdll.dll:RtlSetUserValueHeap+0xcb5|mov ecx, edx|edx=0xf4000 | |
| 0x77187ad7 ntdll.dll:RtlSetUserValueHeap+0xcb7|mov eax, dword ptr [edi + 0x6c]|edi=0x820000 | |
| 0x77187ada ntdll.dll:RtlSetUserValueHeap+0xcba|sub ecx, dword ptr [esi]|ecx=0xf4000|esi=0x19f74c | |
| 0x77187adc ntdll.dll:RtlSetUserValueHeap+0xcbc|shl eax, 3|eax=0x800 | |
| 0x77187adf ntdll.dll:RtlSetUserValueHeap+0xcbf|cmp ecx, eax|ecx=0xf2000|eax=0x4000 | |
| 0x77187ae1 ntdll.dll:RtlSetUserValueHeap+0xcc1|jbe 0x77187cf9|eflags=0x206 | |
| 0x77187ae7 ntdll.dll:RtlSetUserValueHeap+0xcc7|mov edx, dword ptr [edi + 0x40]|edi=0x820000 | |
| 0x77187aea ntdll.dll:RtlSetUserValueHeap+0xcca|mov ecx, edi|edi=0x820000 | |
| 0x77187aec ntdll.dll:RtlSetUserValueHeap+0xccc|and edx, 0x40000|edx=0x2 | |
| 0x77187af2 ntdll.dll:RtlSetUserValueHeap+0xcd2|neg edx|edx=0x0 | |
| 0x77187af4 ntdll.dll:RtlSetUserValueHeap+0xcd4|sbb edx, edx|edx=0x0|eflags=0x246 | |
| 0x77187af6 ntdll.dll:RtlSetUserValueHeap+0xcd6|and edx, 0x3c|edx=0x0 | |
| 0x77187af9 ntdll.dll:RtlSetUserValueHeap+0xcd9|add edx, 4|edx=0x0 | |
| 0x77187afc ntdll.dll:RtlSetUserValueHeap+0xcdc|call 0x77188c9d|esp=0x19f700|eip=0x77187afc | |
| 0x77188c9d ntdll.dll:RtlDeleteCriticalSection+0x6cd|mov edi, edi|edi=0x820000 | |
| 0x77188c9f ntdll.dll:RtlDeleteCriticalSection+0x6cf|push ebp|ebp=0x19f728|esp=0x19f6fc | |
| 0x77188ca0 ntdll.dll:RtlDeleteCriticalSection+0x6d0|mov ebp, esp|esp=0x19f6f8 | |
| 0x77188ca2 ntdll.dll:RtlDeleteCriticalSection+0x6d2|and esp, 0xfffffff8|esp=0x19f6f8 | |
| 0x77188ca5 ntdll.dll:RtlDeleteCriticalSection+0x6d5|sub esp, 0x20|esp=0x19f6f8 | |
| 0x77188ca8 ntdll.dll:RtlDeleteCriticalSection+0x6d8|push esi|esi=0x19f74c|esp=0x19f6d8 | |
| 0x77188ca9 ntdll.dll:RtlDeleteCriticalSection+0x6d9|mov esi, edx|edx=0x4 | |
| 0x77188cab ntdll.dll:RtlDeleteCriticalSection+0x6db|push edi|edi=0x820000|esp=0x19f6d4 | |
| 0x77188cac ntdll.dll:RtlDeleteCriticalSection+0x6dc|mov edi, ecx|ecx=0x820000 | |
| 0x77188cae ntdll.dll:RtlDeleteCriticalSection+0x6de|cmp esi, 0x40|esi=0x4 | |
| 0x77188cb1 ntdll.dll:RtlDeleteCriticalSection+0x6e1|je 0x771c978a|eflags=0x283 | |
| 0x77188cb7 ntdll.dll:RtlDeleteCriticalSection+0x6e7|pop edi|edi=0x820000|esp=0x19f6d0 | |
| 0x77188cb8 ntdll.dll:RtlDeleteCriticalSection+0x6e8|mov eax, esi|esi=0x4 | |
| 0x77188cba ntdll.dll:RtlDeleteCriticalSection+0x6ea|pop esi|esi=0x4|esp=0x19f6d4 | |
| 0x77188cbb ntdll.dll:RtlDeleteCriticalSection+0x6eb|mov esp, ebp|ebp=0x19f6f8 | |
| 0x77188cbd ntdll.dll:RtlDeleteCriticalSection+0x6ed|pop ebp|ebp=0x19f6f8|esp=0x19f6f8 | |
| 0x77188cbe ntdll.dll:RtlDeleteCriticalSection+0x6ee|ret|esp=0x19f6fc | |
| 0x77187b01 ntdll.dll:RtlSetUserValueHeap+0xce1|mov edx, dword ptr [edi + 0x1f8]|edi=0x820000 | |
| 0x77187b07 ntdll.dll:RtlSetUserValueHeap+0xce7|lea esi, [edi + 0xd4]|edi=0x820000 | |
| 0x77187b0d ntdll.dll:RtlSetUserValueHeap+0xced|sub edx, dword ptr [edi + 0x244]|edx=0xc000|edi=0x820000 | |
| 0x77187b13 ntdll.dll:RtlSetUserValueHeap+0xcf3|push esi|esi=0x8200d4|esp=0x19f700 | |
| 0x77187b14 ntdll.dll:RtlSetUserValueHeap+0xcf4|mov esi, dword ptr [ebp - 8]|ebp=0x19f728 | |
| 0x77187b17 ntdll.dll:RtlSetUserValueHeap+0xcf7|push edi|edi=0x820000|esp=0x19f6fc | |
| 0x77187b18 ntdll.dll:RtlSetUserValueHeap+0xcf8|mov dword ptr [ebp - 0x14], eax|ebp=0x19f728|eax=0x4 | |
| 0x77187b1b ntdll.dll:RtlSetUserValueHeap+0xcfb|mov ecx, dword ptr [esi]|esi=0x19f74c | |
| 0x77187b1d ntdll.dll:RtlSetUserValueHeap+0xcfd|call 0x771960d8|esp=0x19f6f8|eip=0x77187b1d | |
| 0x771960d8 ntdll.dll:EtwRegisterTraceGuidsW+0x448|mov edi, edi|edi=0x820000 | |
| 0x771960da ntdll.dll:EtwRegisterTraceGuidsW+0x44a|push ebp|ebp=0x19f728|esp=0x19f6f4 | |
| 0x771960db ntdll.dll:EtwRegisterTraceGuidsW+0x44b|mov ebp, esp|esp=0x19f6f0 | |
| 0x771960dd ntdll.dll:EtwRegisterTraceGuidsW+0x44d|push ecx|ecx=0x2000|esp=0x19f6f0 | |
| 0x771960de ntdll.dll:EtwRegisterTraceGuidsW+0x44e|cmp dword ptr [0x772561f4], 0 | |
| 0x771960e5 ntdll.dll:EtwRegisterTraceGuidsW+0x455|push ebx|ebx=0x82afe0|esp=0x19f6ec | |
| 0x771960e6 ntdll.dll:EtwRegisterTraceGuidsW+0x456|push esi|esi=0x19f74c|esp=0x19f6e8 | |
| 0x771960e7 ntdll.dll:EtwRegisterTraceGuidsW+0x457|push edi|edi=0x820000|esp=0x19f6e4 | |
| 0x771960e8 ntdll.dll:EtwRegisterTraceGuidsW+0x458|mov edi, edx|edx=0xc000 | |
| 0x771960ea ntdll.dll:EtwRegisterTraceGuidsW+0x45a|mov ebx, ecx|ecx=0x2000 | |
| 0x771960ec ntdll.dll:EtwRegisterTraceGuidsW+0x45c|jne 0x7719610e|eflags=0x246 | |
| 0x771960ee ntdll.dll:EtwRegisterTraceGuidsW+0x45e|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f6f0 | |
| 0x771960f1 ntdll.dll:EtwRegisterTraceGuidsW+0x461|mov ecx, dword ptr [edx]|edx=0x8200d4 | |
| 0x771960f3 ntdll.dll:EtwRegisterTraceGuidsW+0x463|test ecx, ecx|ecx=0x0 | |
| 0x771960f5 ntdll.dll:EtwRegisterTraceGuidsW+0x465|jne 0x771da3d1|eflags=0x246 | |
| 0x771960fb ntdll.dll:EtwRegisterTraceGuidsW+0x46b|mov ecx, dword ptr [0x7725910c] | |
| 0x77196101 ntdll.dll:EtwRegisterTraceGuidsW+0x471|mov edx, 0x7725910c | |
| 0x77196106 ntdll.dll:EtwRegisterTraceGuidsW+0x476|test ecx, ecx|ecx=0x0 | |
| 0x77196108 ntdll.dll:EtwRegisterTraceGuidsW+0x478|jne 0x771da3d1|eflags=0x246 | |
| 0x7719610e ntdll.dll:EtwRegisterTraceGuidsW+0x47e|xor esi, esi|esi=0x19f74c | |
| 0x77196110 ntdll.dll:EtwRegisterTraceGuidsW+0x480|inc esi|esi=0x0 | |
| 0x77196111 ntdll.dll:EtwRegisterTraceGuidsW+0x481|pop edi|edi=0xc000|esp=0x19f6e0 | |
| 0x77196112 ntdll.dll:EtwRegisterTraceGuidsW+0x482|mov eax, esi|esi=0x1 | |
| 0x77196114 ntdll.dll:EtwRegisterTraceGuidsW+0x484|pop esi|esi=0x1|esp=0x19f6e4 | |
| 0x77196115 ntdll.dll:EtwRegisterTraceGuidsW+0x485|pop ebx|ebx=0x2000|esp=0x19f6e8 | |
| 0x77196116 ntdll.dll:EtwRegisterTraceGuidsW+0x486|pop ecx|ecx=0x0|esp=0x19f6ec | |
| 0x77196117 ntdll.dll:EtwRegisterTraceGuidsW+0x487|pop ebp|ebp=0x19f6f0|esp=0x19f6f0 | |
| 0x77196118 ntdll.dll:EtwRegisterTraceGuidsW+0x488|ret 8|esp=0x19f6f4 | |
| 0x77187b22 ntdll.dll:RtlSetUserValueHeap+0xd02|test eax, eax|eax=0x1 | |
| 0x77187b24 ntdll.dll:RtlSetUserValueHeap+0xd04|je 0x771d59e4|eflags=0x202 | |
| 0x77187b2a ntdll.dll:RtlSetUserValueHeap+0xd0a|push dword ptr [ebp - 0x14]|ebp=0x19f728|esp=0x19f700 | |
| 0x77187b2d ntdll.dll:RtlSetUserValueHeap+0xd0d|lea eax, [ebp - 0xc]|ebp=0x19f728 | |
| 0x77187b30 ntdll.dll:RtlSetUserValueHeap+0xd10|push 0x1000|esp=0x19f6fc | |
| 0x77187b35 ntdll.dll:RtlSetUserValueHeap+0xd15|push esi|esi=0x19f74c|esp=0x19f6f8 | |
| 0x77187b36 ntdll.dll:RtlSetUserValueHeap+0xd16|push 0|esp=0x19f6f4 | |
| 0x77187b38 ntdll.dll:RtlSetUserValueHeap+0xd18|push eax|eax=0x19f71c|esp=0x19f6f0 | |
| 0x77187b39 ntdll.dll:RtlSetUserValueHeap+0xd19|push -1|esp=0x19f6ec | |
| 0x77187b3b ntdll.dll:RtlSetUserValueHeap+0xd1b|call 0x771a4ce0|esp=0x19f6e8|eip=0x77187b3b | |
| 0x771a4ce0 ntdll.dll:NtAllocateVirtualMemory|mov eax, 0x18 | |
| 0x771a4ce5 ntdll.dll:NtAllocateVirtualMemory+0x5|mov edx, 0x771c8f20 | |
| 0x771a4cea ntdll.dll:NtAllocateVirtualMemory+0xa|call edx|edx=0x771c8f20|esp=0x19f6e4 | |
| 0x771c8f20 ntdll.dll:RtlInterlockedCompareExchange64+0x180|jmp dword ptr [0x7725c220] | |
| 0x77126000|mov edx, esp|esp=0x19f6e0 | |
| 0x77126002|sysenter | |
| 0x77126004|ret|esp=0x19f6e0 | |
| 0x771a4cec ntdll.dll:NtAllocateVirtualMemory+0xc|ret 0x18|esp=0x19f6e4 | |
| 0x77187b40 ntdll.dll:RtlSetUserValueHeap+0xd20|inc dword ptr [edi + 0x21c]|edi=0x820000 | |
| 0x77187b46 ntdll.dll:RtlSetUserValueHeap+0xd26|test eax, eax|eax=0x0 | |
| 0x77187b48 ntdll.dll:RtlSetUserValueHeap+0xd28|js 0x771d59ee|eflags=0x246 | |
| 0x77187b4e ntdll.dll:RtlSetUserValueHeap+0xd2e|mov eax, dword ptr fs:[0x30] | |
| 0x77187b54 ntdll.dll:RtlSetUserValueHeap+0xd34|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77187b57 ntdll.dll:RtlSetUserValueHeap+0xd37|test eax, eax|eax=0x0 | |
| 0x77187b59 ntdll.dll:RtlSetUserValueHeap+0xd39|jne 0x771d59f9|eflags=0x246 | |
| 0x77187b5f ntdll.dll:RtlSetUserValueHeap+0xd3f|mov eax, 0x7ffe0380 | |
| 0x77187b64 ntdll.dll:RtlSetUserValueHeap+0xd44|cmp byte ptr [eax], 0|eax=0x7ffe0380 | |
| 0x77187b67 ntdll.dll:RtlSetUserValueHeap+0xd47|jne 0x771d5a15|eflags=0x246 | |
| 0x77187b6d ntdll.dll:RtlSetUserValueHeap+0xd4d|xor edx, edx|edx=0x19f6e0 | |
| 0x77187b6f ntdll.dll:RtlSetUserValueHeap+0xd4f|cmp dword ptr [edi + 0x4c], edx|edi=0x820000|edx=0x0 | |
| 0x77187b72 ntdll.dll:RtlSetUserValueHeap+0xd52|je 0x77187b8a|eflags=0x206 | |
| 0x77187b74 ntdll.dll:RtlSetUserValueHeap+0xd54|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77187b77 ntdll.dll:RtlSetUserValueHeap+0xd57|xor dword ptr [ebx], eax|ebx=0x82afe0|eax=0x241ac80a | |
| 0x77187b79 ntdll.dll:RtlSetUserValueHeap+0xd59|mov al, byte ptr [ebx + 2]|ebx=0x82afe0 | |
| 0x77187b7c ntdll.dll:RtlSetUserValueHeap+0xd5c|xor al, byte ptr [ebx + 1]|al=0x1|ebx=0x82afe0 | |
| 0x77187b7f ntdll.dll:RtlSetUserValueHeap+0xd5f|xor al, byte ptr [ebx]|al=0x1|ebx=0x82afe0 | |
| 0x77187b81 ntdll.dll:RtlSetUserValueHeap+0xd61|cmp byte ptr [ebx + 3], al|ebx=0x82afe0|al=0x5 | |
| 0x77187b84 ntdll.dll:RtlSetUserValueHeap+0xd64|jne 0x771d5a3b|eflags=0x246 | |
| 0x77187b8a ntdll.dll:RtlSetUserValueHeap+0xd6a|mov eax, dword ptr [ebp - 4]|ebp=0x19f728 | |
| 0x77187b8d ntdll.dll:RtlSetUserValueHeap+0xd6d|add eax, 8|eax=0x82afe8 | |
| 0x77187b90 ntdll.dll:RtlSetUserValueHeap+0xd70|mov byte ptr [ebx + 2], dl|ebx=0x82afe0|dl=0x0 | |
| 0x77187b93 ntdll.dll:RtlSetUserValueHeap+0xd73|mov byte ptr [ebx + 7], dl|ebx=0x82afe0|dl=0x0 | |
| 0x77187b96 ntdll.dll:RtlSetUserValueHeap+0xd76|mov ecx, dword ptr [eax + 4]|eax=0x82aff0 | |
| 0x77187b99 ntdll.dll:RtlSetUserValueHeap+0xd79|mov esi, dword ptr [eax]|eax=0x82aff0 | |
| 0x77187b9b ntdll.dll:RtlSetUserValueHeap+0xd7b|mov dword ptr [ebp - 0x18], ecx|ebp=0x19f728|ecx=0x820038 | |
| 0x77187b9e ntdll.dll:RtlSetUserValueHeap+0xd7e|mov ecx, dword ptr [ecx]|ecx=0x820038 | |
| 0x77187ba0 ntdll.dll:RtlSetUserValueHeap+0xd80|cmp ecx, dword ptr [esi + 4]|ecx=0x82aff0|esi=0x820038 | |
| 0x77187ba3 ntdll.dll:RtlSetUserValueHeap+0xd83|mov dword ptr [ebp - 0x14], ecx|ebp=0x19f728|ecx=0x82aff0 | |
| 0x77187ba6 ntdll.dll:RtlSetUserValueHeap+0xd86|mov ecx, dword ptr [ebp - 4]|ebp=0x19f728 | |
| 0x77187ba9 ntdll.dll:RtlSetUserValueHeap+0xd89|jne 0x771d5a4c|eflags=0x246 | |
| 0x77187baf ntdll.dll:RtlSetUserValueHeap+0xd8f|cmp dword ptr [ebp - 0x14], eax|ebp=0x19f728|eax=0x82aff0 | |
| 0x77187bb2 ntdll.dll:RtlSetUserValueHeap+0xd92|jne 0x771d5a4c|eflags=0x246 | |
| 0x77187bb8 ntdll.dll:RtlSetUserValueHeap+0xd98|mov eax, dword ptr [ebp - 0x18]|ebp=0x19f728 | |
| 0x77187bbb ntdll.dll:RtlSetUserValueHeap+0xd9b|mov dword ptr [eax], esi|eax=0x820038|esi=0x820038 | |
| 0x77187bbd ntdll.dll:RtlSetUserValueHeap+0xd9d|mov dword ptr [esi + 4], eax|esi=0x820038|eax=0x820038 | |
| 0x77187bc0 ntdll.dll:RtlSetUserValueHeap+0xda0|cmp dword ptr [ecx + 0x14], 0|ecx=0x82afe8 | |
| 0x77187bc4 ntdll.dll:RtlSetUserValueHeap+0xda4|je 0x77187bf1|eflags=0x206 | |
| 0x77187bc6 ntdll.dll:RtlSetUserValueHeap+0xda6|mov eax, dword ptr [edi + 0xb8]|edi=0x820000 | |
| 0x77187bcc ntdll.dll:RtlSetUserValueHeap+0xdac|test eax, eax|eax=0x0 | |
| 0x77187bce ntdll.dll:RtlSetUserValueHeap+0xdae|jne 0x771d5a68|eflags=0x246 | |
| 0x77187bd4 ntdll.dll:RtlSetUserValueHeap+0xdb4|mov eax, dword ptr [ecx]|ecx=0x82afe8 | |
| 0x77187bd6 ntdll.dll:RtlSetUserValueHeap+0xdb6|mov edx, dword ptr [ecx + 4]|ecx=0x82afe8 | |
| 0x77187bd9 ntdll.dll:RtlSetUserValueHeap+0xdb9|mov esi, dword ptr [eax + 4]|eax=0x82008c | |
| 0x77187bdc ntdll.dll:RtlSetUserValueHeap+0xdbc|cmp dword ptr [edx], esi|edx=0x82008c|esi=0x82afe8 | |
| 0x77187bde ntdll.dll:RtlSetUserValueHeap+0xdbe|jne 0x771d5aa1|eflags=0x246 | |
| 0x77187be4 ntdll.dll:RtlSetUserValueHeap+0xdc4|cmp dword ptr [edx], ecx|edx=0x82008c|ecx=0x82afe8 | |
| 0x77187be6 ntdll.dll:RtlSetUserValueHeap+0xdc6|jne 0x771d5aa1|eflags=0x246 | |
| 0x77187bec ntdll.dll:RtlSetUserValueHeap+0xdcc|mov dword ptr [edx], eax|edx=0x82008c|eax=0x82008c | |
| 0x77187bee ntdll.dll:RtlSetUserValueHeap+0xdce|mov dword ptr [eax + 4], edx|eax=0x82008c|edx=0x82008c | |
| 0x77187bf1 ntdll.dll:RtlSetUserValueHeap+0xdd1|mov esi, dword ptr [ebp - 0x10]|ebp=0x19f728 | |
| 0x77187bf4 ntdll.dll:RtlSetUserValueHeap+0xdd4|dec dword ptr [esi + 0x30]|esi=0x820000 | |
| 0x77187bf7 ntdll.dll:RtlSetUserValueHeap+0xdd7|mov eax, dword ptr [ecx + 0x14]|ecx=0x82afe8 | |
| 0x77187bfa ntdll.dll:RtlSetUserValueHeap+0xdda|shr eax, 0xc|eax=0xf4000 | |
| 0x77187bfd ntdll.dll:RtlSetUserValueHeap+0xddd|sub dword ptr [esi + 0x2c], eax|esi=0x820000|eax=0xf4 | |
| 0x77187c00 ntdll.dll:RtlSetUserValueHeap+0xde0|mov eax, dword ptr [ecx + 0x14]|ecx=0x82afe8 | |
| 0x77187c03 ntdll.dll:RtlSetUserValueHeap+0xde3|add dword ptr [edi + 0x1f8], eax|edi=0x820000|eax=0xf4000 | |
| 0x77187c09 ntdll.dll:RtlSetUserValueHeap+0xde9|inc dword ptr [edi + 0x20c]|edi=0x820000 | |
| 0x77187c0f ntdll.dll:RtlSetUserValueHeap+0xdef|dec dword ptr [edi + 0x208]|edi=0x820000 | |
| 0x77187c15 ntdll.dll:RtlSetUserValueHeap+0xdf5|mov eax, dword ptr [ecx + 0x14]|ecx=0x82afe8 | |
| 0x77187c18 ntdll.dll:RtlSetUserValueHeap+0xdf8|mov dword ptr [ebp - 4], eax|ebp=0x19f728|eax=0xf4000 | |
| 0x77187c1b ntdll.dll:RtlSetUserValueHeap+0xdfb|cmp eax, 0x7f000|eax=0xf4000 | |
| 0x77187c20 ntdll.dll:RtlSetUserValueHeap+0xe00|jb 0x77187c2e|eflags=0x206 | |
| 0x77187c22 ntdll.dll:RtlSetUserValueHeap+0xe02|sub dword ptr [edi + 0x1fc], eax|edi=0x820000|eax=0xf4000 | |
| 0x77187c28 ntdll.dll:RtlSetUserValueHeap+0xe08|mov eax, dword ptr [ecx + 0x14]|ecx=0x82afe8 | |
| 0x77187c2b ntdll.dll:RtlSetUserValueHeap+0xe0b|mov dword ptr [ebp - 4], eax|ebp=0x19f728|eax=0xf4000 | |
| 0x77187c2e ntdll.dll:RtlSetUserValueHeap+0xe0e|mov edx, dword ptr [ebp - 8]|ebp=0x19f728 | |
| 0x77187c31 ntdll.dll:RtlSetUserValueHeap+0xe11|mov esi, dword ptr [ebp - 0x10]|ebp=0x19f728 | |
| 0x77187c34 ntdll.dll:RtlSetUserValueHeap+0xe14|cmp eax, dword ptr [edx]|eax=0xf4000|edx=0x19f74c | |
| 0x77187c36 ntdll.dll:RtlSetUserValueHeap+0xe16|jbe 0x77187d0e|eflags=0x206 | |
| 0x77187c3c ntdll.dll:RtlSetUserValueHeap+0xe1c|push edx|edx=0x19f74c|esp=0x19f700 | |
| 0x77187c3d ntdll.dll:RtlSetUserValueHeap+0xe1d|mov edx, dword ptr [edx]|edx=0x19f74c | |
| 0x77187c3f ntdll.dll:RtlSetUserValueHeap+0xe1f|sub eax, edx|eax=0xf4000|edx=0x2000 | |
| 0x77187c41 ntdll.dll:RtlSetUserValueHeap+0xe21|push ebx|ebx=0x82afe0|esp=0x19f6fc | |
| 0x77187c42 ntdll.dll:RtlSetUserValueHeap+0xe22|push eax|eax=0xf2000|esp=0x19f6f8 | |
| 0x77187c43 ntdll.dll:RtlSetUserValueHeap+0xe23|mov eax, dword ptr [ecx + 0x10]|ecx=0x82afe8 | |
| 0x77187c46 ntdll.dll:RtlSetUserValueHeap+0xe26|add edx, -0x18|edx=0x2000 | |
| 0x77187c49 ntdll.dll:RtlSetUserValueHeap+0xe29|add eax, edx|eax=0x82b000|edx=0x1fe8 | |
| 0x77187c4b ntdll.dll:RtlSetUserValueHeap+0xe2b|mov ecx, edi|edi=0x820000 | |
| 0x77187c4d ntdll.dll:RtlSetUserValueHeap+0xe2d|push eax|eax=0x82cfe8|esp=0x19f6f4 | |
| 0x77187c4e ntdll.dll:RtlSetUserValueHeap+0xe2e|mov edx, esi|esi=0x820000 | |
| 0x77187c50 ntdll.dll:RtlSetUserValueHeap+0xe30|call 0x77187d36|esp=0x19f6f0|eip=0x77187c50 | |
| 0x77187d36 ntdll.dll:RtlSetUserValueHeap+0xf16|mov edi, edi|edi=0x820000 | |
| 0x77187d38 ntdll.dll:RtlSetUserValueHeap+0xf18|push ebp|ebp=0x19f728|esp=0x19f6ec | |
| 0x77187d39 ntdll.dll:RtlSetUserValueHeap+0xf19|mov ebp, esp|esp=0x19f6e8 | |
| 0x77187d3b ntdll.dll:RtlSetUserValueHeap+0xf1b|sub esp, 0xc|esp=0x19f6e8 | |
| 0x77187d3e ntdll.dll:RtlSetUserValueHeap+0xf1e|push ebx|ebx=0x82afe0|esp=0x19f6dc | |
| 0x77187d3f ntdll.dll:RtlSetUserValueHeap+0xf1f|mov ebx, dword ptr [ebp + 8]|ebp=0x19f6e8 | |
| 0x77187d42 ntdll.dll:RtlSetUserValueHeap+0xf22|push esi|esi=0x820000|esp=0x19f6d8 | |
| 0x77187d43 ntdll.dll:RtlSetUserValueHeap+0xf23|push edi|edi=0x820000|esp=0x19f6d4 | |
| 0x77187d44 ntdll.dll:RtlSetUserValueHeap+0xf24|mov edi, ecx|ecx=0x820000 | |
| 0x77187d46 ntdll.dll:RtlSetUserValueHeap+0xf26|mov dword ptr [ebp - 4], edx|ebp=0x19f6e8|edx=0x820000 | |
| 0x77187d49 ntdll.dll:RtlSetUserValueHeap+0xf29|lea eax, [ebx + 0x18]|ebx=0x82cfe8 | |
| 0x77187d4c ntdll.dll:RtlSetUserValueHeap+0xf2c|mov ecx, edx|edx=0x820000 | |
| 0x77187d4e ntdll.dll:RtlSetUserValueHeap+0xf2e|mov dword ptr [ebx + 0x10], eax|ebx=0x82cfe8|eax=0x82d000 | |
| 0x77187d51 ntdll.dll:RtlSetUserValueHeap+0xf31|lea esi, [ebx - 8]|ebx=0x82cfe8 | |
| 0x77187d54 ntdll.dll:RtlSetUserValueHeap+0xf34|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f6e8 | |
| 0x77187d57 ntdll.dll:RtlSetUserValueHeap+0xf37|mov dword ptr [ebx + 0x14], eax|ebx=0x82cfe8|eax=0xf2000 | |
| 0x77187d5a ntdll.dll:RtlSetUserValueHeap+0xf3a|push 4|esp=0x19f6d0 | |
| 0x77187d5c ntdll.dll:RtlSetUserValueHeap+0xf3c|pop eax|eax=0xf2000|esp=0x19f6cc | |
| 0x77187d5d ntdll.dll:RtlSetUserValueHeap+0xf3d|mov word ptr [esi + 2], 1|esi=0x82cfe0 | |
| 0x77187d63 ntdll.dll:RtlSetUserValueHeap+0xf43|mov word ptr [esi], ax|esi=0x82cfe0|ax=0x4 | |
| 0x77187d66 ntdll.dll:RtlSetUserValueHeap+0xf46|mov byte ptr [esi + 7], 3|esi=0x82cfe0 | |
| 0x77187d6a ntdll.dll:RtlSetUserValueHeap+0xf4a|mov edx, dword ptr [ecx + 0x18]|ecx=0x820000 | |
| 0x77187d6d ntdll.dll:RtlSetUserValueHeap+0xf4d|cmp edx, ecx|edx=0x820000|ecx=0x820000 | |
| 0x77187d6f ntdll.dll:RtlSetUserValueHeap+0xf4f|jne 0x77187e50|eflags=0x246 | |
| 0x77187d75 ntdll.dll:RtlSetUserValueHeap+0xf55|xor al, al|al=0x4 | |
| 0x77187d77 ntdll.dll:RtlSetUserValueHeap+0xf57|cmp dword ptr [0x7725b414], 1 | |
| 0x77187d7e ntdll.dll:RtlSetUserValueHeap+0xf5e|mov byte ptr [esi + 6], al|esi=0x82cfe0|al=0x0 | |
| 0x77187d81 ntdll.dll:RtlSetUserValueHeap+0xf61|jge 0x771d5b78|eflags=0x297 | |
| 0x77187d87 ntdll.dll:RtlSetUserValueHeap+0xf67|cmp dword ptr [ebp + 0x10], esi|ebp=0x19f6e8|esi=0x82cfe0 | |
| 0x77187d8a ntdll.dll:RtlSetUserValueHeap+0xf6a|je 0x77187d94|eflags=0x287 | |
| 0x77187d8c ntdll.dll:RtlSetUserValueHeap+0xf6c|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77187d90 ntdll.dll:RtlSetUserValueHeap+0xf70|mov word ptr [esi + 4], ax|esi=0x82cfe0|ax=0x10ad | |
| 0x77187d94 ntdll.dll:RtlSetUserValueHeap+0xf74|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77187d98 ntdll.dll:RtlSetUserValueHeap+0xf78|je 0x77187daa|eflags=0x206 | |
| 0x77187d9a ntdll.dll:RtlSetUserValueHeap+0xf7a|mov al, byte ptr [esi + 1]|esi=0x82cfe0 | |
| 0x77187d9d ntdll.dll:RtlSetUserValueHeap+0xf7d|xor al, byte ptr [esi + 2]|al=0x0|esi=0x82cfe0 | |
| 0x77187da0 ntdll.dll:RtlSetUserValueHeap+0xf80|xor al, byte ptr [esi]|al=0x1|esi=0x82cfe0 | |
| 0x77187da2 ntdll.dll:RtlSetUserValueHeap+0xf82|mov byte ptr [esi + 3], al|esi=0x82cfe0|al=0x5 | |
| 0x77187da5 ntdll.dll:RtlSetUserValueHeap+0xf85|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77187da8 ntdll.dll:RtlSetUserValueHeap+0xf88|xor dword ptr [esi], eax|esi=0x82cfe0|eax=0x241ac80a | |
| 0x77187daa ntdll.dll:RtlSetUserValueHeap+0xf8a|mov edx, dword ptr [ebx + 0x14]|ebx=0x82cfe8 | |
| 0x77187dad ntdll.dll:RtlSetUserValueHeap+0xf8d|test edx, edx|edx=0xf2000 | |
| 0x77187daf ntdll.dll:RtlSetUserValueHeap+0xf8f|je 0x77187ddb|eflags=0x206 | |
| 0x77187db1 ntdll.dll:RtlSetUserValueHeap+0xf91|mov ecx, edi|edi=0x820000 | |
| 0x77187db3 ntdll.dll:RtlSetUserValueHeap+0xf93|call 0x77187e9d|esp=0x19f6d0|eip=0x77187db3 | |
| 0x77187e9d ntdll.dll:RtlSetUserValueHeap+0x107d|mov edi, edi|edi=0x820000 | |
| 0x77187e9f ntdll.dll:RtlSetUserValueHeap+0x107f|push ecx|ecx=0x820000|esp=0x19f6cc | |
| 0x77187ea0 ntdll.dll:RtlSetUserValueHeap+0x1080|cmp dword ptr [0x7725b414], 1 | |
| 0x77187ea7 ntdll.dll:RtlSetUserValueHeap+0x1087|push esi|esi=0x82cfe0|esp=0x19f6c8 | |
| 0x77187ea8 ntdll.dll:RtlSetUserValueHeap+0x1088|push edi|edi=0x820000|esp=0x19f6c4 | |
| 0x77187ea9 ntdll.dll:RtlSetUserValueHeap+0x1089|mov esi, edx|edx=0xf2000 | |
| 0x77187eab ntdll.dll:RtlSetUserValueHeap+0x108b|mov edi, ecx|ecx=0x820000 | |
| 0x77187ead ntdll.dll:RtlSetUserValueHeap+0x108d|jge 0x771d5c6a|eflags=0x297 | |
| 0x77187eb3 ntdll.dll:RtlSetUserValueHeap+0x1093|mov edx, dword ptr [edi + 0xb8]|edi=0x820000 | |
| 0x77187eb9 ntdll.dll:RtlSetUserValueHeap+0x1099|test edx, edx|edx=0x0 | |
| 0x77187ebb ntdll.dll:RtlSetUserValueHeap+0x109b|jne 0x771d5cd6|eflags=0x246 | |
| 0x77187ec1 ntdll.dll:RtlSetUserValueHeap+0x10a1|lea ecx, [edi + 0x8c]|edi=0x820000 | |
| 0x77187ec7 ntdll.dll:RtlSetUserValueHeap+0x10a7|mov eax, dword ptr [ecx]|ecx=0x82008c | |
| 0x77187ec9 ntdll.dll:RtlSetUserValueHeap+0x10a9|cmp ecx, eax|ecx=0x82008c|eax=0x82008c | |
| 0x77187ecb ntdll.dll:RtlSetUserValueHeap+0x10ab|jne 0x77187ed3|eflags=0x246 | |
| 0x77187ecd ntdll.dll:RtlSetUserValueHeap+0x10ad|mov eax, ecx|ecx=0x82008c | |
| 0x77187ecf ntdll.dll:RtlSetUserValueHeap+0x10af|pop edi|edi=0x820000|esp=0x19f6c0 | |
| 0x77187ed0 ntdll.dll:RtlSetUserValueHeap+0x10b0|pop esi|esi=0xf2000|esp=0x19f6c4 | |
| 0x77187ed1 ntdll.dll:RtlSetUserValueHeap+0x10b1|pop ecx|ecx=0x82008c|esp=0x19f6c8 | |
| 0x77187ed2 ntdll.dll:RtlSetUserValueHeap+0x10b2|ret|esp=0x19f6cc | |
| 0x77187db8 ntdll.dll:RtlSetUserValueHeap+0xf98|mov ecx, dword ptr [eax + 4]|eax=0x82008c | |
| 0x77187dbb ntdll.dll:RtlSetUserValueHeap+0xf9b|cmp dword ptr [ecx], eax|ecx=0x82008c|eax=0x82008c | |
| 0x77187dbd ntdll.dll:RtlSetUserValueHeap+0xf9d|jne 0x771d5bda|eflags=0x246 | |
| 0x77187dc3 ntdll.dll:RtlSetUserValueHeap+0xfa3|mov dword ptr [ebx], eax|ebx=0x82cfe8|eax=0x82008c | |
| 0x77187dc5 ntdll.dll:RtlSetUserValueHeap+0xfa5|mov dword ptr [ebx + 4], ecx|ebx=0x82cfe8|ecx=0x82008c | |
| 0x77187dc8 ntdll.dll:RtlSetUserValueHeap+0xfa8|mov dword ptr [ecx], ebx|ecx=0x82008c|ebx=0x82cfe8 | |
| 0x77187dca ntdll.dll:RtlSetUserValueHeap+0xfaa|mov dword ptr [eax + 4], ebx|eax=0x82008c|ebx=0x82cfe8 | |
| 0x77187dcd ntdll.dll:RtlSetUserValueHeap+0xfad|mov edx, dword ptr [edi + 0xb8]|edi=0x820000 | |
| 0x77187dd3 ntdll.dll:RtlSetUserValueHeap+0xfb3|test edx, edx|edx=0x0 | |
| 0x77187dd5 ntdll.dll:RtlSetUserValueHeap+0xfb5|jne 0x771d5bf0|eflags=0x246 | |
| 0x77187ddb ntdll.dll:RtlSetUserValueHeap+0xfbb|mov al, byte ptr [esi + 6]|esi=0x82cfe0 | |
| 0x77187dde ntdll.dll:RtlSetUserValueHeap+0xfbe|test al, al|al=0x0 | |
| 0x77187de0 ntdll.dll:RtlSetUserValueHeap+0xfc0|jne 0x77187e7c|eflags=0x246 | |
| 0x77187de6 ntdll.dll:RtlSetUserValueHeap+0xfc6|mov ecx, edi|edi=0x820000 | |
| 0x77187de8 ntdll.dll:RtlSetUserValueHeap+0xfc8|add ecx, 0x38|ecx=0x820000 | |
| 0x77187deb ntdll.dll:RtlSetUserValueHeap+0xfcb|lea eax, [ebx + 8]|ebx=0x82cfe8 | |
| 0x77187dee ntdll.dll:RtlSetUserValueHeap+0xfce|mov edx, dword ptr [ecx]|ecx=0x820038 | |
| 0x77187df0 ntdll.dll:RtlSetUserValueHeap+0xfd0|cmp dword ptr [edx + 4], ecx|edx=0x820038|ecx=0x820038 | |
| 0x77187df3 ntdll.dll:RtlSetUserValueHeap+0xfd3|jne 0x771d5c1e|eflags=0x246 | |
| 0x77187df9 ntdll.dll:RtlSetUserValueHeap+0xfd9|mov dword ptr [eax], edx|eax=0x82cff0|edx=0x820038 | |
| 0x77187dfb ntdll.dll:RtlSetUserValueHeap+0xfdb|mov dword ptr [eax + 4], ecx|eax=0x82cff0|ecx=0x820038 | |
| 0x77187dfe ntdll.dll:RtlSetUserValueHeap+0xfde|mov dword ptr [edx + 4], eax|edx=0x820038|eax=0x82cff0 | |
| 0x77187e01 ntdll.dll:RtlSetUserValueHeap+0xfe1|mov dword ptr [ecx], eax|ecx=0x820038|eax=0x82cff0 | |
| 0x77187e03 ntdll.dll:RtlSetUserValueHeap+0xfe3|mov ecx, dword ptr [ebp - 4]|ebp=0x19f6e8 | |
| 0x77187e06 ntdll.dll:RtlSetUserValueHeap+0xfe6|inc dword ptr [ecx + 0x30]|ecx=0x820000 | |
| 0x77187e09 ntdll.dll:RtlSetUserValueHeap+0xfe9|mov eax, dword ptr [ebx + 0x14]|ebx=0x82cfe8 | |
| 0x77187e0c ntdll.dll:RtlSetUserValueHeap+0xfec|shr eax, 0xc|eax=0xf2000 | |
| 0x77187e0f ntdll.dll:RtlSetUserValueHeap+0xfef|add dword ptr [ecx + 0x2c], eax|ecx=0x820000|eax=0xf2 | |
| 0x77187e12 ntdll.dll:RtlSetUserValueHeap+0xff2|mov eax, dword ptr [ebx + 0x14]|ebx=0x82cfe8 | |
| 0x77187e15 ntdll.dll:RtlSetUserValueHeap+0xff5|sub dword ptr [edi + 0x1f8], eax|edi=0x820000|eax=0xf2000 | |
| 0x77187e1b ntdll.dll:RtlSetUserValueHeap+0xffb|inc dword ptr [edi + 0x208]|edi=0x820000 | |
| 0x77187e21 ntdll.dll:RtlSetUserValueHeap+0x1001|cmp dword ptr [edi + 0x208], 0xa|edi=0x820000 | |
| 0x77187e28 ntdll.dll:RtlSetUserValueHeap+0x1008|ja 0x771d5c35|eflags=0x293 | |
| 0x77187e2e ntdll.dll:RtlSetUserValueHeap+0x100e|mov eax, dword ptr [ebx + 0x14]|ebx=0x82cfe8 | |
| 0x77187e31 ntdll.dll:RtlSetUserValueHeap+0x1011|cmp eax, 0x7f000|eax=0xf2000 | |
| 0x77187e36 ntdll.dll:RtlSetUserValueHeap+0x1016|jb 0x77187e3e|eflags=0x206 | |
| 0x77187e38 ntdll.dll:RtlSetUserValueHeap+0x1018|add dword ptr [edi + 0x1fc], eax|edi=0x820000|eax=0xf2000 | |
| 0x77187e3e ntdll.dll:RtlSetUserValueHeap+0x101e|sub esi, dword ptr [ebp + 0x10]|esi=0x82cfe0|ebp=0x19f6e8 | |
| 0x77187e41 ntdll.dll:RtlSetUserValueHeap+0x1021|mov eax, dword ptr [ebp + 0x14]|ebp=0x19f6e8 | |
| 0x77187e44 ntdll.dll:RtlSetUserValueHeap+0x1024|sar esi, 3|esi=0x2000 | |
| 0x77187e47 ntdll.dll:RtlSetUserValueHeap+0x1027|pop edi|edi=0x820000|esp=0x19f6d0 | |
| 0x77187e48 ntdll.dll:RtlSetUserValueHeap+0x1028|mov dword ptr [eax], esi|eax=0x19f74c|esi=0x400 | |
| 0x77187e4a ntdll.dll:RtlSetUserValueHeap+0x102a|pop esi|esi=0x400|esp=0x19f6d4 | |
| 0x77187e4b ntdll.dll:RtlSetUserValueHeap+0x102b|pop ebx|ebx=0x82cfe8|esp=0x19f6d8 | |
| 0x77187e4c ntdll.dll:RtlSetUserValueHeap+0x102c|leave|ebp=0x19f6e8|esp=0x19f6dc | |
| 0x77187e4d ntdll.dll:RtlSetUserValueHeap+0x102d|ret 0x10|esp=0x19f6ec | |
| 0x77187c55 ntdll.dll:RtlSetUserValueHeap+0xe35|mov edx, dword ptr [ebp - 8]|ebp=0x19f728 | |
| 0x77187c58 ntdll.dll:RtlSetUserValueHeap+0xe38|shl dword ptr [edx], 3|edx=0x19f74c | |
| 0x77187c5b ntdll.dll:RtlSetUserValueHeap+0xe3b|xor ecx, ecx|ecx=0x820000 | |
| 0x77187c5d ntdll.dll:RtlSetUserValueHeap+0xe3d|mov byte ptr [ebx + 3], cl|ebx=0x82afe0|cl=0x0 | |
| 0x77187c60 ntdll.dll:RtlSetUserValueHeap+0xe40|mov edx, dword ptr [esi + 0x18]|esi=0x820000 | |
| 0x77187c63 ntdll.dll:RtlSetUserValueHeap+0xe43|cmp edx, esi|edx=0x820000|esi=0x820000 | |
| 0x77187c65 ntdll.dll:RtlSetUserValueHeap+0xe45|je 0x77187c8a|eflags=0x246 | |
| 0x77187c8a ntdll.dll:RtlSetUserValueHeap+0xe6a|mov eax, dword ptr fs:[0x30] | |
| 0x77187c90 ntdll.dll:RtlSetUserValueHeap+0xe70|mov byte ptr [ebx + 6], cl|ebx=0x82afe0|cl=0x0 | |
| 0x77187c93 ntdll.dll:RtlSetUserValueHeap+0xe73|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77187c96 ntdll.dll:RtlSetUserValueHeap+0xe76|test eax, eax|eax=0x0 | |
| 0x77187c98 ntdll.dll:RtlSetUserValueHeap+0xe78|jne 0x771d5ab9|eflags=0x246 | |
| 0x77187c9e ntdll.dll:RtlSetUserValueHeap+0xe7e|mov esi, 0x7ffe0380 | |
| 0x77187ca3 ntdll.dll:RtlSetUserValueHeap+0xe83|mov eax, esi|esi=0x7ffe0380 | |
| 0x77187ca5 ntdll.dll:RtlSetUserValueHeap+0xe85|cmp byte ptr [eax], 0|eax=0x7ffe0380 | |
| 0x77187ca8 ntdll.dll:RtlSetUserValueHeap+0xe88|jne 0x771d5ada|eflags=0x246 | |
| 0x77187cae ntdll.dll:RtlSetUserValueHeap+0xe8e|mov esi, dword ptr [ebp - 8]|ebp=0x19f728 | |
| 0x77187cb1 ntdll.dll:RtlSetUserValueHeap+0xe91|mov eax, dword ptr fs:[0x30] | |
| 0x77187cb7 ntdll.dll:RtlSetUserValueHeap+0xe97|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77187cba ntdll.dll:RtlSetUserValueHeap+0xe9a|test eax, eax|eax=0x0 | |
| 0x77187cbc ntdll.dll:RtlSetUserValueHeap+0xe9c|jne 0x771d5b23|eflags=0x246 | |
| 0x77187cc2 ntdll.dll:RtlSetUserValueHeap+0xea2|mov eax, 0x7ffe038a | |
| 0x77187cc7 ntdll.dll:RtlSetUserValueHeap+0xea7|cmp byte ptr [eax], 0|eax=0x7ffe038a | |
| 0x77187cca ntdll.dll:RtlSetUserValueHeap+0xeaa|jne 0x771d5b3f|eflags=0x246 | |
| 0x77187cd0 ntdll.dll:RtlSetUserValueHeap+0xeb0|mov eax, ebx|ebx=0x82afe0 | |
| 0x77187cd2 ntdll.dll:RtlSetUserValueHeap+0xeb2|pop edi|edi=0x820000|esp=0x19f700 | |
| 0x77187cd3 ntdll.dll:RtlSetUserValueHeap+0xeb3|pop esi|esi=0x19f74c|esp=0x19f704 | |
| 0x77187cd4 ntdll.dll:RtlSetUserValueHeap+0xeb4|pop ebx|ebx=0x82afe0|esp=0x19f708 | |
| 0x77187cd5 ntdll.dll:RtlSetUserValueHeap+0xeb5|leave|ebp=0x19f728|esp=0x19f70c | |
| 0x77187cd6 ntdll.dll:RtlSetUserValueHeap+0xeb6|ret|esp=0x19f72c | |
| 0x77187877 ntdll.dll:RtlSetUserValueHeap+0xa57|test eax, eax|eax=0x82afe0 | |
| 0x77187879 ntdll.dll:RtlSetUserValueHeap+0xa59|je 0x771878bd|eflags=0x202 | |
| 0x7718787b ntdll.dll:RtlSetUserValueHeap+0xa5b|shr dword ptr [ebp - 0xc], 3|ebp=0x19f758 | |
| 0x7718787f ntdll.dll:RtlSetUserValueHeap+0xa5f|lea ecx, [ebp - 0xc]|ebp=0x19f758 | |
| 0x77187882 ntdll.dll:RtlSetUserValueHeap+0xa62|push ebx|ebx=0x0|esp=0x19f730 | |
| 0x77187883 ntdll.dll:RtlSetUserValueHeap+0xa63|push ecx|ecx=0x19f74c|esp=0x19f72c | |
| 0x77187884 ntdll.dll:RtlSetUserValueHeap+0xa64|mov edx, eax|eax=0x82afe0 | |
| 0x77187886 ntdll.dll:RtlSetUserValueHeap+0xa66|mov ecx, esi|esi=0x820000 | |
| 0x77187888 ntdll.dll:RtlSetUserValueHeap+0xa68|call 0x77179869|esp=0x19f728|eip=0x77187888 | |
| 0x77179869 ntdll.dll:RtlReleasePebLock+0x19|mov edi, edi|edi=0x1008 | |
| 0x7717986b ntdll.dll:RtlReleasePebLock+0x1b|push ebp|ebp=0x19f758|esp=0x19f724 | |
| 0x7717986c ntdll.dll:RtlReleasePebLock+0x1c|mov ebp, esp|esp=0x19f720 | |
| 0x7717986e ntdll.dll:RtlReleasePebLock+0x1e|movzx eax, word ptr [ecx + 0x54]|ecx=0x820000 | |
| 0x77179872 ntdll.dll:RtlReleasePebLock+0x22|sub esp, 0x14|esp=0x19f720 | |
| 0x77179875 ntdll.dll:RtlReleasePebLock+0x25|push ebx|ebx=0x0|esp=0x19f70c | |
| 0x77179876 ntdll.dll:RtlReleasePebLock+0x26|mov ebx, edx|edx=0x82afe0 | |
| 0x77179878 ntdll.dll:RtlReleasePebLock+0x28|push esi|esi=0x820000|esp=0x19f708 | |
| 0x77179879 ntdll.dll:RtlReleasePebLock+0x29|push edi|edi=0x1008|esp=0x19f704 | |
| 0x7717987a ntdll.dll:RtlReleasePebLock+0x2a|mov edi, ebx|ebx=0x82afe0 | |
| 0x7717987c ntdll.dll:RtlReleasePebLock+0x2c|movzx esi, word ptr [ebx + 4]|ebx=0x82afe0 | |
| 0x77179880 ntdll.dll:RtlReleasePebLock+0x30|xor esi, eax|esi=0x11d3|eax=0x10ad | |
| 0x77179882 ntdll.dll:RtlReleasePebLock+0x32|shl esi, 3|esi=0x17e | |
| 0x77179885 ntdll.dll:RtlReleasePebLock+0x35|sub edi, esi|edi=0x82afe0|esi=0xbf0 | |
| 0x77179887 ntdll.dll:RtlReleasePebLock+0x37|mov esi, ecx|ecx=0x820000 | |
| 0x77179889 ntdll.dll:RtlReleasePebLock+0x39|cmp edi, ebx|edi=0x82a3f0|ebx=0x82afe0 | |
| 0x7717988b ntdll.dll:RtlReleasePebLock+0x3b|je 0x7717989d|eflags=0x283 | |
| 0x7717988d ntdll.dll:RtlReleasePebLock+0x3d|mov eax, dword ptr [esi + 0x4c]|esi=0x820000 | |
| 0x77179890 ntdll.dll:RtlReleasePebLock+0x40|shr eax, 0x14|eax=0x100000 | |
| 0x77179893 ntdll.dll:RtlReleasePebLock+0x43|and al, byte ptr [esi + 0x52]|al=0x1|esi=0x820000 | |
| 0x77179896 ntdll.dll:RtlReleasePebLock+0x46|xor al, byte ptr [edi + 2]|al=0x0|edi=0x82a3f0 | |
| 0x77179899 ntdll.dll:RtlReleasePebLock+0x49|test al, 1|al=0x1a | |
| 0x7717989b ntdll.dll:RtlReleasePebLock+0x4b|je 0x771798ee|eflags=0x246 | |
| 0x771798ee ntdll.dll:RtlReleasePebLock+0x9e|cmp dword ptr [esi + 0x4c], 0|esi=0x820000 | |
| 0x771798f2 ntdll.dll:RtlReleasePebLock+0xa2|je 0x7717990a|eflags=0x206 | |
| 0x771798f4 ntdll.dll:RtlReleasePebLock+0xa4|mov eax, dword ptr [esi + 0x50]|esi=0x820000 | |
| 0x771798f7 ntdll.dll:RtlReleasePebLock+0xa7|xor dword ptr [edi], eax|edi=0x82a3f0|eax=0x241ac80a | |
| 0x771798f9 ntdll.dll:RtlReleasePebLock+0xa9|mov al, byte ptr [edi + 1]|edi=0x82a3f0 | |
| 0x771798fc ntdll.dll:RtlReleasePebLock+0xac|xor al, byte ptr [edi]|al=0x1|edi=0x82a3f0 | |
| 0x771798fe ntdll.dll:RtlReleasePebLock+0xae|xor al, byte ptr [edi + 2]|al=0x7f|edi=0x82a3f0 | |
| 0x77179901 ntdll.dll:RtlReleasePebLock+0xb1|cmp byte ptr [edi + 3], al|edi=0x82a3f0|al=0x7f | |
| 0x77179904 ntdll.dll:RtlReleasePebLock+0xb4|jne 0x771d342f|eflags=0x246 | |
| 0x7717990a ntdll.dll:RtlReleasePebLock+0xba|mov al, byte ptr [ebp + 0xc]|ebp=0x19f720 | |
| 0x7717990d ntdll.dll:RtlReleasePebLock+0xbd|mov byte ptr [ebp - 1], al|ebp=0x19f720|al=0x0 | |
| 0x77179910 ntdll.dll:RtlReleasePebLock+0xc0|test al, al|al=0x0 | |
| 0x77179912 ntdll.dll:RtlReleasePebLock+0xc2|jne 0x771d343c|eflags=0x246 | |
| 0x77179918 ntdll.dll:RtlReleasePebLock+0xc8|mov edx, dword ptr [edi + 0xc]|edi=0x82a3f0 | |
| 0x7717991b ntdll.dll:RtlReleasePebLock+0xcb|lea ecx, [edi + 8]|edi=0x82a3f0 | |
| 0x7717991e ntdll.dll:RtlReleasePebLock+0xce|mov eax, dword ptr [ecx]|ecx=0x82a3f8 | |
| 0x77179920 ntdll.dll:RtlReleasePebLock+0xd0|mov dword ptr [ebp - 8], eax|ebp=0x19f720|eax=0x8200c0 | |
| 0x77179923 ntdll.dll:RtlReleasePebLock+0xd3|mov dword ptr [ebp - 0x10], edx|ebp=0x19f720|edx=0x8266e8 | |
| 0x77179926 ntdll.dll:RtlReleasePebLock+0xd6|mov eax, dword ptr [eax + 4]|eax=0x8200c0 | |
| 0x77179929 ntdll.dll:RtlReleasePebLock+0xd9|cmp dword ptr [edx], eax|edx=0x8266e8|eax=0x82a3f8 | |
| 0x7717992b ntdll.dll:RtlReleasePebLock+0xdb|je 0x77179942|eflags=0x246 | |
| 0x77179942 ntdll.dll:RtlReleasePebLock+0xf2|cmp dword ptr [edx], ecx|edx=0x8266e8|ecx=0x82a3f8 | |
| 0x77179944 ntdll.dll:RtlReleasePebLock+0xf4|jne 0x7717992d|eflags=0x246 | |
| 0x77179946 ntdll.dll:RtlReleasePebLock+0xf6|movzx eax, word ptr [edi]|edi=0x82a3f0 | |
| 0x77179949 ntdll.dll:RtlReleasePebLock+0xf9|sub dword ptr [esi + 0x74], eax|esi=0x820000|eax=0x17e | |
| 0x7717994c ntdll.dll:RtlReleasePebLock+0xfc|mov edx, dword ptr [esi + 0xb4]|esi=0x820000 | |
| 0x77179952 ntdll.dll:RtlReleasePebLock+0x102|test edx, edx|edx=0x820270 | |
| 0x77179954 ntdll.dll:RtlReleasePebLock+0x104|je 0x77179980|eflags=0x202 | |
| 0x77179956 ntdll.dll:RtlReleasePebLock+0x106|movzx eax, word ptr [edi]|edi=0x82a3f0 | |
| 0x77179959 ntdll.dll:RtlReleasePebLock+0x109|mov dword ptr [ebp - 0xc], eax|ebp=0x19f720|eax=0x17e | |
| 0x7717995c ntdll.dll:RtlReleasePebLock+0x10c|cmp eax, dword ptr [edx + 4]|eax=0x17e|edx=0x820270 | |
| 0x7717995f ntdll.dll:RtlReleasePebLock+0x10f|jb 0x77179972|eflags=0x202 | |
| 0x77179961 ntdll.dll:RtlReleasePebLock+0x111|mov eax, dword ptr [edx]|edx=0x820270 | |
| 0x77179963 ntdll.dll:RtlReleasePebLock+0x113|test eax, eax|eax=0x822b00 | |
| 0x77179965 ntdll.dll:RtlReleasePebLock+0x115|je 0x7717996e|eflags=0x206 | |
| 0x77179967 ntdll.dll:RtlReleasePebLock+0x117|mov edx, eax|eax=0x822b00 | |
| 0x77179969 ntdll.dll:RtlReleasePebLock+0x119|movzx eax, word ptr [edi]|edi=0x82a3f0 | |
| 0x7717996c ntdll.dll:RtlReleasePebLock+0x11c|jmp 0x7717995c | |
| 0x7717995c ntdll.dll:RtlReleasePebLock+0x10c|cmp eax, dword ptr [edx + 4]|eax=0x17e|edx=0x822b00 | |
| 0x7717995f ntdll.dll:RtlReleasePebLock+0x10f|jb 0x77179972|eflags=0x287 | |
| 0x77179972 ntdll.dll:RtlReleasePebLock+0x122|push dword ptr [ebp - 0xc]|ebp=0x19f720|esp=0x19f700 | |
| 0x77179975 ntdll.dll:RtlReleasePebLock+0x125|push eax|eax=0x17e|esp=0x19f6fc | |
| 0x77179976 ntdll.dll:RtlReleasePebLock+0x126|push ecx|ecx=0x82a3f8|esp=0x19f6f8 | |
| 0x77179977 ntdll.dll:RtlReleasePebLock+0x127|push 1|esp=0x19f6f4 | |
| 0x77179979 ntdll.dll:RtlReleasePebLock+0x129|mov ecx, esi|esi=0x820000 | |
| 0x7717997b ntdll.dll:RtlReleasePebLock+0x12b|call 0x7718706b|esp=0x19f6f0|eip=0x7717997b | |
| 0x7718706b ntdll.dll:RtlSetUserValueHeap+0x24b|mov edi, edi|edi=0x82a3f0 | |
| 0x7718706d ntdll.dll:RtlSetUserValueHeap+0x24d|push ebp|ebp=0x19f720|esp=0x19f6ec | |
| 0x7718706e ntdll.dll:RtlSetUserValueHeap+0x24e|mov ebp, esp|esp=0x19f6e8 | |
| 0x77187070 ntdll.dll:RtlSetUserValueHeap+0x250|sub esp, 0x14|esp=0x19f6e8 | |
| 0x77187073 ntdll.dll:RtlSetUserValueHeap+0x253|push ebx|ebx=0x82afe0|esp=0x19f6d4 | |
| 0x77187074 ntdll.dll:RtlSetUserValueHeap+0x254|push esi|esi=0x820000|esp=0x19f6d0 | |
| 0x77187075 ntdll.dll:RtlSetUserValueHeap+0x255|mov esi, edx|edx=0x822b00 | |
| 0x77187077 ntdll.dll:RtlSetUserValueHeap+0x257|mov dword ptr [ebp - 8], ecx|ebp=0x19f6e8|ecx=0x820000 | |
| 0x7718707a ntdll.dll:RtlSetUserValueHeap+0x25a|push edi|edi=0x82a3f0|esp=0x19f6cc | |
| 0x7718707b ntdll.dll:RtlSetUserValueHeap+0x25b|mov edi, dword ptr [ebp + 0x10]|ebp=0x19f6e8 | |
| 0x7718707e ntdll.dll:RtlSetUserValueHeap+0x25e|sub edi, dword ptr [esi + 0x14]|edi=0x17e|esi=0x822b00 | |
| 0x77187081 ntdll.dll:RtlSetUserValueHeap+0x261|cmp dword ptr [esi + 8], 0|esi=0x822b00 | |
| 0x77187085 ntdll.dll:RtlSetUserValueHeap+0x265|jne 0x771d534b|eflags=0x246 | |
| 0x7718708b ntdll.dll:RtlSetUserValueHeap+0x26b|mov edx, edi|edi=0xfe | |
| 0x7718708d ntdll.dll:RtlSetUserValueHeap+0x26d|mov dword ptr [ebp - 4], edi|ebp=0x19f6e8|edi=0xfe | |
| 0x77187090 ntdll.dll:RtlSetUserValueHeap+0x270|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x77187093 ntdll.dll:RtlSetUserValueHeap+0x273|mov ecx, dword ptr [eax + edx*4]|eax=0x822c14|edx=0xfe | |
| 0x77187096 ntdll.dll:RtlSetUserValueHeap+0x276|dec dword ptr [esi + 0xc]|esi=0x822b00 | |
| 0x77187099 ntdll.dll:RtlSetUserValueHeap+0x279|mov dword ptr [ebp - 0xc], ecx|ebp=0x19f6e8|ecx=0x82a3f8 | |
| 0x7718709c ntdll.dll:RtlSetUserValueHeap+0x27c|mov ecx, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x7718709f ntdll.dll:RtlSetUserValueHeap+0x27f|lea ebx, [ecx - 1]|ecx=0x800 | |
| 0x771870a2 ntdll.dll:RtlSetUserValueHeap+0x282|mov dword ptr [ebp - 0x10], ebx|ebp=0x19f6e8|ebx=0x7ff | |
| 0x771870a5 ntdll.dll:RtlSetUserValueHeap+0x285|cmp dword ptr [ebp + 0x10], ebx|ebp=0x19f6e8|ebx=0x7ff | |
| 0x771870a8 ntdll.dll:RtlSetUserValueHeap+0x288|je 0x771870e8|eflags=0x293 | |
| 0x771870aa ntdll.dll:RtlSetUserValueHeap+0x28a|mov ebx, dword ptr [ebp + 0xc]|ebp=0x19f6e8 | |
| 0x771870ad ntdll.dll:RtlSetUserValueHeap+0x28d|cmp dword ptr [ebp - 0xc], ebx|ebp=0x19f6e8|ebx=0x82a3f8 | |
| 0x771870b0 ntdll.dll:RtlSetUserValueHeap+0x290|jne 0x771870e1|eflags=0x246 | |
| 0x771870b2 ntdll.dll:RtlSetUserValueHeap+0x292|cmp dword ptr [esi], 0|esi=0x822b00 | |
| 0x771870b5 ntdll.dll:RtlSetUserValueHeap+0x295|jne 0x771870ba|eflags=0x246 | |
| 0x771870b7 ntdll.dll:RtlSetUserValueHeap+0x297|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f6e8 | |
| 0x771870ba ntdll.dll:RtlSetUserValueHeap+0x29a|mov ebx, dword ptr [ebx]|ebx=0x82a3f8 | |
| 0x771870bc ntdll.dll:RtlSetUserValueHeap+0x29c|cmp dword ptr [ebp + 0x10], ecx|ebp=0x19f6e8|ecx=0x7ff | |
| 0x771870bf ntdll.dll:RtlSetUserValueHeap+0x29f|jae 0x771870ed|eflags=0x293 | |
| 0x771870c1 ntdll.dll:RtlSetUserValueHeap+0x2a1|cmp ebx, dword ptr [esi + 0x18]|ebx=0x8200c0|esi=0x822b00 | |
| 0x771870c4 ntdll.dll:RtlSetUserValueHeap+0x2a4|jne 0x771870f4|eflags=0x246 | |
| 0x771870c6 ntdll.dll:RtlSetUserValueHeap+0x2a6|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x771870c9 ntdll.dll:RtlSetUserValueHeap+0x2a9|and dword ptr [eax + edx*4], 0|eax=0x822c14|edx=0xfe | |
| 0x771870cd ntdll.dll:RtlSetUserValueHeap+0x2ad|mov edx, edi|edi=0xfe | |
| 0x771870cf ntdll.dll:RtlSetUserValueHeap+0x2af|mov ecx, dword ptr [esi + 0x1c]|esi=0x822b00 | |
| 0x771870d2 ntdll.dll:RtlSetUserValueHeap+0x2b2|and edi, 0x1f|edi=0xfe | |
| 0x771870d5 ntdll.dll:RtlSetUserValueHeap+0x2b5|shr edx, 5|edx=0xfe | |
| 0x771870d8 ntdll.dll:RtlSetUserValueHeap+0x2b8|mov eax, dword ptr [ecx + edx*4]|ecx=0x822b24|edx=0x7 | |
| 0x771870db ntdll.dll:RtlSetUserValueHeap+0x2bb|btr eax, edi|eax=0x40000000|edi=0x1e | |
| 0x771870de ntdll.dll:RtlSetUserValueHeap+0x2be|mov dword ptr [ecx + edx*4], eax|ecx=0x822b24|edx=0x7|eax=0x0 | |
| 0x771870e1 ntdll.dll:RtlSetUserValueHeap+0x2c1|pop edi|edi=0x1e|esp=0x19f6c8 | |
| 0x771870e2 ntdll.dll:RtlSetUserValueHeap+0x2c2|pop esi|esi=0x822b00|esp=0x19f6cc | |
| 0x771870e3 ntdll.dll:RtlSetUserValueHeap+0x2c3|pop ebx|ebx=0x8200c0|esp=0x19f6d0 | |
| 0x771870e4 ntdll.dll:RtlSetUserValueHeap+0x2c4|leave|ebp=0x19f6e8|esp=0x19f6d4 | |
| 0x771870e5 ntdll.dll:RtlSetUserValueHeap+0x2c5|ret 0x10|esp=0x19f6ec | |
| 0x77179980 ntdll.dll:RtlReleasePebLock+0x130|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f720 | |
| 0x77179983 ntdll.dll:RtlReleasePebLock+0x133|mov eax, dword ptr [ebp - 8]|ebp=0x19f720 | |
| 0x77179986 ntdll.dll:RtlReleasePebLock+0x136|mov dword ptr [ecx], eax|ecx=0x8266e8|eax=0x8200c0 | |
| 0x77179988 ntdll.dll:RtlReleasePebLock+0x138|mov dword ptr [eax + 4], ecx|eax=0x8200c0|ecx=0x8266e8 | |
| 0x7717998b ntdll.dll:RtlReleasePebLock+0x13b|test byte ptr [edi + 2], 8|edi=0x82a3f0 | |
| 0x7717998f ntdll.dll:RtlReleasePebLock+0x13f|jne 0x77179a68|eflags=0x246 | |
| 0x77179995 ntdll.dll:RtlReleasePebLock+0x145|mov cl, byte ptr [edi + 2]|edi=0x82a3f0 | |
| 0x77179998 ntdll.dll:RtlReleasePebLock+0x148|test cl, 4|cl=0x0 | |
| 0x7717999b ntdll.dll:RtlReleasePebLock+0x14b|jne 0x771799c8|eflags=0x246 | |
| 0x7717999d ntdll.dll:RtlReleasePebLock+0x14d|mov edx, dword ptr [ebp + 8]|ebp=0x19f720 | |
| 0x771799a0 ntdll.dll:RtlReleasePebLock+0x150|mov ebx, edi|edi=0x82a3f0 | |
| 0x771799a2 ntdll.dll:RtlReleasePebLock+0x152|movzx eax, word ptr [edi]|edi=0x82a3f0 | |
| 0x771799a5 ntdll.dll:RtlReleasePebLock+0x155|mov byte ptr [edi + 2], 0|edi=0x82a3f0 | |
| 0x771799a9 ntdll.dll:RtlReleasePebLock+0x159|mov byte ptr [edi + 7], 0|edi=0x82a3f0 | |
| 0x771799ad ntdll.dll:RtlReleasePebLock+0x15d|add dword ptr [edx], eax|edx=0x19f74c|eax=0x17e | |
| 0x771799af ntdll.dll:RtlReleasePebLock+0x15f|mov ax, word ptr [edx]|edx=0x19f74c | |
| 0x771799b2 ntdll.dll:RtlReleasePebLock+0x162|mov word ptr [edi], ax|edi=0x82a3f0|ax=0x57e | |
| 0x771799b5 ntdll.dll:RtlReleasePebLock+0x165|mov cx, word ptr [edx]|edx=0x19f74c | |
| 0x771799b8 ntdll.dll:RtlReleasePebLock+0x168|mov eax, dword ptr [edx]|edx=0x19f74c | |
| 0x771799ba ntdll.dll:RtlReleasePebLock+0x16a|xor cx, word ptr [esi + 0x54]|cx=0x57e|esi=0x820000 | |
| 0x771799be ntdll.dll:RtlReleasePebLock+0x16e|mov word ptr [edi + eax*8 + 4], cx|edi=0x82a3f0|eax=0x57e|cx=0x15d3 | |
| 0x771799c3 ntdll.dll:RtlReleasePebLock+0x173|jmp 0x771798a6 | |
| 0x771798a6 ntdll.dll:RtlReleasePebLock+0x56|cmp dword ptr [esi + 0x4c], 0|esi=0x820000 | |
| 0x771798aa ntdll.dll:RtlReleasePebLock+0x5a|mov eax, dword ptr [edx]|edx=0x19f74c | |
| 0x771798ac ntdll.dll:RtlReleasePebLock+0x5c|lea edi, [ebx + eax*8]|ebx=0x82a3f0|eax=0x57e | |
| 0x771798af ntdll.dll:RtlReleasePebLock+0x5f|je 0x771798d1|eflags=0x206 | |
| 0x771798b1 ntdll.dll:RtlReleasePebLock+0x61|mov eax, dword ptr [edi]|edi=0x82cfe0 | |
| 0x771798b3 ntdll.dll:RtlReleasePebLock+0x63|mov edx, dword ptr [esi + 0x50]|esi=0x820000 | |
| 0x771798b6 ntdll.dll:RtlReleasePebLock+0x66|xor edx, eax|edx=0x241ac80a|eax=0x211bc80e | |
| 0x771798b8 ntdll.dll:RtlReleasePebLock+0x68|mov ecx, edx|edx=0x5010004 | |
| 0x771798ba ntdll.dll:RtlReleasePebLock+0x6a|mov eax, edx|edx=0x5010004 | |
| 0x771798bc ntdll.dll:RtlReleasePebLock+0x6c|shr ecx, 0x10|ecx=0x5010004 | |
| 0x771798bf ntdll.dll:RtlReleasePebLock+0x6f|shr eax, 8|eax=0x5010004 | |
| 0x771798c2 ntdll.dll:RtlReleasePebLock+0x72|xor cl, al|cl=0x1|al=0x0 | |
| 0x771798c4 ntdll.dll:RtlReleasePebLock+0x74|xor cl, dl|cl=0x1|dl=0x4 | |
| 0x771798c6 ntdll.dll:RtlReleasePebLock+0x76|shr edx, 0x18|edx=0x5010004 | |
| 0x771798c9 ntdll.dll:RtlReleasePebLock+0x79|cmp dl, cl|dl=0x5|cl=0x5 | |
| 0x771798cb ntdll.dll:RtlReleasePebLock+0x7b|jne 0x771d359f|eflags=0x246 | |
| 0x771798d1 ntdll.dll:RtlReleasePebLock+0x81|mov eax, dword ptr [esi + 0x4c]|esi=0x820000 | |
| 0x771798d4 ntdll.dll:RtlReleasePebLock+0x84|shr eax, 0x14|eax=0x100000 | |
| 0x771798d7 ntdll.dll:RtlReleasePebLock+0x87|and al, byte ptr [esi + 0x52]|al=0x1|esi=0x820000 | |
| 0x771798da ntdll.dll:RtlReleasePebLock+0x8a|xor al, byte ptr [edi + 2]|al=0x0|edi=0x82cfe0 | |
| 0x771798dd ntdll.dll:RtlReleasePebLock+0x8d|test al, 1|al=0x1b | |
| 0x771798df ntdll.dll:RtlReleasePebLock+0x8f|je 0x771d35be|eflags=0x202 | |
| 0x771798e5 ntdll.dll:RtlReleasePebLock+0x95|pop edi|edi=0x82cfe0|esp=0x19f700 | |
| 0x771798e6 ntdll.dll:RtlReleasePebLock+0x96|pop esi|esi=0x820000|esp=0x19f704 | |
| 0x771798e7 ntdll.dll:RtlReleasePebLock+0x97|mov eax, ebx|ebx=0x82a3f0 | |
| 0x771798e9 ntdll.dll:RtlReleasePebLock+0x99|pop ebx|ebx=0x82a3f0|esp=0x19f708 | |
| 0x771798ea ntdll.dll:RtlReleasePebLock+0x9a|leave|ebp=0x19f720|esp=0x19f70c | |
| 0x771798eb ntdll.dll:RtlReleasePebLock+0x9b|ret 8|esp=0x19f724 | |
| 0x7718788d ntdll.dll:RtlSetUserValueHeap+0xa6d|push dword ptr [ebp - 0xc]|ebp=0x19f758|esp=0x19f730 | |
| 0x77187890 ntdll.dll:RtlSetUserValueHeap+0xa70|mov edi, eax|eax=0x82a3f0 | |
| 0x77187892 ntdll.dll:RtlSetUserValueHeap+0xa72|mov ecx, esi|esi=0x820000 | |
| 0x77187894 ntdll.dll:RtlSetUserValueHeap+0xa74|mov edx, edi|edi=0x82a3f0 | |
| 0x77187896 ntdll.dll:RtlSetUserValueHeap+0xa76|call 0x7717a060|esp=0x19f72c|eip=0x77187896 | |
| 0x7717a060 ntdll.dll:RtlReleasePebLock+0x810|mov edi, edi|edi=0x82a3f0 | |
| 0x7717a062 ntdll.dll:RtlReleasePebLock+0x812|push ebp|ebp=0x19f758|esp=0x19f728 | |
| 0x7717a063 ntdll.dll:RtlReleasePebLock+0x813|mov ebp, esp|esp=0x19f724 | |
| 0x7717a065 ntdll.dll:RtlReleasePebLock+0x815|sub esp, 0x18|esp=0x19f724 | |
| 0x7717a068 ntdll.dll:RtlReleasePebLock+0x818|push ebx|ebx=0x0|esp=0x19f70c | |
| 0x7717a069 ntdll.dll:RtlReleasePebLock+0x819|push esi|esi=0x820000|esp=0x19f708 | |
| 0x7717a06a ntdll.dll:RtlReleasePebLock+0x81a|push edi|edi=0x82a3f0|esp=0x19f704 | |
| 0x7717a06b ntdll.dll:RtlReleasePebLock+0x81b|mov edi, ecx|ecx=0x820000 | |
| 0x7717a06d ntdll.dll:RtlReleasePebLock+0x81d|mov esi, edx|edx=0x82a3f0 | |
| 0x7717a06f ntdll.dll:RtlReleasePebLock+0x81f|mov ecx, dword ptr [ebp + 8]|ebp=0x19f724 | |
| 0x7717a072 ntdll.dll:RtlReleasePebLock+0x822|mov dword ptr [ebp - 0xc], ecx|ebp=0x19f724|ecx=0x57e | |
| 0x7717a075 ntdll.dll:RtlReleasePebLock+0x825|test ecx, ecx|ecx=0x57e | |
| 0x7717a077 ntdll.dll:RtlReleasePebLock+0x827|je 0x7717a1c0|eflags=0x206 | |
| 0x7717a07d ntdll.dll:RtlReleasePebLock+0x82d|mov ax, word ptr [esi + 4]|esi=0x82a3f0 | |
| 0x7717a081 ntdll.dll:RtlReleasePebLock+0x831|xor ax, word ptr [edi + 0x54]|ax=0x1024|edi=0x820000 | |
| 0x7717a085 ntdll.dll:RtlReleasePebLock+0x835|movzx ebx, ax|ax=0x89 | |
| 0x7717a088 ntdll.dll:RtlReleasePebLock+0x838|test bx, bx|bx=0x89 | |
| 0x7717a08b ntdll.dll:RtlReleasePebLock+0x83b|je 0x7717a28a|eflags=0x202 | |
| 0x7717a091 ntdll.dll:RtlReleasePebLock+0x841|mov al, byte ptr [esi + 6]|esi=0x82a3f0 | |
| 0x7717a094 ntdll.dll:RtlReleasePebLock+0x844|test al, al|al=0x0 | |
| 0x7717a096 ntdll.dll:RtlReleasePebLock+0x846|jne 0x7717a223|eflags=0x246 | |
| 0x7717a09c ntdll.dll:RtlReleasePebLock+0x84c|mov dword ptr [ebp - 0x10], edi|ebp=0x19f724|edi=0x820000 | |
| 0x7717a09f ntdll.dll:RtlReleasePebLock+0x84f|mov al, byte ptr [esi + 2]|esi=0x82a3f0 | |
| 0x7717a0a2 ntdll.dll:RtlReleasePebLock+0x852|mov byte ptr [ebp - 1], al|ebp=0x19f724|al=0x0 | |
| 0x7717a0a5 ntdll.dll:RtlReleasePebLock+0x855|jmp 0x7717a0b0 | |
| 0x7717a0b0 ntdll.dll:RtlReleasePebLock+0x860|cmp ecx, 0xfe00|ecx=0x57e | |
| 0x7717a0b6 ntdll.dll:RtlReleasePebLock+0x866|ja 0x7717a29c|eflags=0x287 | |
| 0x7717a0bc ntdll.dll:RtlReleasePebLock+0x86c|movzx ecx, cx|cx=0x57e | |
| 0x7717a0bf ntdll.dll:RtlReleasePebLock+0x86f|mov dword ptr [ebp - 8], ecx|ebp=0x19f724|ecx=0x57e | |
| 0x7717a0c2 ntdll.dll:RtlReleasePebLock+0x872|mov edx, dword ptr [ebp - 0x10]|ebp=0x19f724 | |
| 0x7717a0c5 ntdll.dll:RtlReleasePebLock+0x875|mov byte ptr [esi + 2], al|esi=0x82a3f0|al=0x0 | |
| 0x7717a0c8 ntdll.dll:RtlReleasePebLock+0x878|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x7717a0cc ntdll.dll:RtlReleasePebLock+0x87c|xor ax, bx|ax=0x10ad|bx=0x89 | |
| 0x7717a0cf ntdll.dll:RtlReleasePebLock+0x87f|mov word ptr [esi + 4], ax|esi=0x82a3f0|ax=0x1024 | |
| 0x7717a0d3 ntdll.dll:RtlReleasePebLock+0x883|mov ebx, dword ptr [edx + 0x18]|edx=0x820000 | |
| 0x7717a0d6 ntdll.dll:RtlReleasePebLock+0x886|cmp ebx, edx|ebx=0x820000|edx=0x820000 | |
| 0x7717a0d8 ntdll.dll:RtlReleasePebLock+0x888|jne 0x7717a1f0|eflags=0x246 | |
| 0x7717a0de ntdll.dll:RtlReleasePebLock+0x88e|xor al, al|al=0x24 | |
| 0x7717a0e0 ntdll.dll:RtlReleasePebLock+0x890|and byte ptr [esi + 2], 0xf0|esi=0x82a3f0 | |
| 0x7717a0e4 ntdll.dll:RtlReleasePebLock+0x894|mov byte ptr [esi + 6], al|esi=0x82a3f0|al=0x0 | |
| 0x7717a0e7 ntdll.dll:RtlReleasePebLock+0x897|mov word ptr [esi], cx|esi=0x82a3f0|cx=0x57e | |
| 0x7717a0ea ntdll.dll:RtlReleasePebLock+0x89a|mov byte ptr [esi + 3], 0|esi=0x82a3f0 | |
| 0x7717a0ee ntdll.dll:RtlReleasePebLock+0x89e|movzx ebx, cx|cx=0x57e | |
| 0x7717a0f1 ntdll.dll:RtlReleasePebLock+0x8a1|mov byte ptr [esi + 7], 0|esi=0x82a3f0 | |
| 0x7717a0f5 ntdll.dll:RtlReleasePebLock+0x8a5|test byte ptr [edi + 0x40], 0x40|edi=0x820000 | |
| 0x7717a0f9 ntdll.dll:RtlReleasePebLock+0x8a9|mov dword ptr [ebp - 0x14], ebx|ebp=0x19f724|ebx=0x57e | |
| 0x7717a0fc ntdll.dll:RtlReleasePebLock+0x8ac|jne 0x771d3dd6|eflags=0x246 | |
| 0x7717a102 ntdll.dll:RtlReleasePebLock+0x8b2|cmp dword ptr [edi + 0xb4], 0|edi=0x820000 | |
| 0x7717a109 ntdll.dll:RtlReleasePebLock+0x8b9|je 0x7717a279|eflags=0x202 | |
| 0x7717a10f ntdll.dll:RtlReleasePebLock+0x8bf|mov edx, ebx|ebx=0x57e | |
| 0x7717a111 ntdll.dll:RtlReleasePebLock+0x8c1|mov ecx, edi|edi=0x820000 | |
| 0x7717a113 ntdll.dll:RtlReleasePebLock+0x8c3|call 0x7718765e|esp=0x19f700|eip=0x7717a113 | |
| 0x7718765e ntdll.dll:RtlSetUserValueHeap+0x83e|mov edi, edi|edi=0x820000 | |
| 0x77187660 ntdll.dll:RtlSetUserValueHeap+0x840|push ebx|ebx=0x57e|esp=0x19f6fc | |
| 0x77187661 ntdll.dll:RtlSetUserValueHeap+0x841|mov ebx, ecx|ecx=0x820000 | |
| 0x77187663 ntdll.dll:RtlSetUserValueHeap+0x843|push esi|esi=0x82a3f0|esp=0x19f6f8 | |
| 0x77187664 ntdll.dll:RtlSetUserValueHeap+0x844|push edi|edi=0x820000|esp=0x19f6f4 | |
| 0x77187665 ntdll.dll:RtlSetUserValueHeap+0x845|mov edi, edx|edx=0x57e | |
| 0x77187667 ntdll.dll:RtlSetUserValueHeap+0x847|mov esi, dword ptr [ebx + 0xb4]|ebx=0x820000 | |
| 0x7718766d ntdll.dll:RtlSetUserValueHeap+0x84d|cmp edi, dword ptr [esi + 4]|edi=0x57e|esi=0x820270 | |
| 0x77187670 ntdll.dll:RtlSetUserValueHeap+0x850|jae 0x77187689|eflags=0x202 | |
| 0x77187689 ntdll.dll:RtlSetUserValueHeap+0x869|mov eax, dword ptr [esi]|esi=0x820270 | |
| 0x7718768b ntdll.dll:RtlSetUserValueHeap+0x86b|test eax, eax|eax=0x822b00 | |
| 0x7718768d ntdll.dll:RtlSetUserValueHeap+0x86d|je 0x7718769a|eflags=0x206 | |
| 0x7718768f ntdll.dll:RtlSetUserValueHeap+0x86f|mov esi, eax|eax=0x822b00 | |
| 0x77187691 ntdll.dll:RtlSetUserValueHeap+0x871|jmp 0x7718766d | |
| 0x7718766d ntdll.dll:RtlSetUserValueHeap+0x84d|cmp edi, dword ptr [esi + 4]|edi=0x57e|esi=0x822b00 | |
| 0x77187670 ntdll.dll:RtlSetUserValueHeap+0x850|jae 0x77187689|eflags=0x287 | |
| 0x77187672 ntdll.dll:RtlSetUserValueHeap+0x852|mov eax, edi|edi=0x57e | |
| 0x77187674 ntdll.dll:RtlSetUserValueHeap+0x854|push edi|edi=0x57e|esp=0x19f6f0 | |
| 0x77187675 ntdll.dll:RtlSetUserValueHeap+0x855|push eax|eax=0x57e|esp=0x19f6ec | |
| 0x77187676 ntdll.dll:RtlSetUserValueHeap+0x856|push 1|esp=0x19f6e8 | |
| 0x77187678 ntdll.dll:RtlSetUserValueHeap+0x858|mov edx, esi|esi=0x822b00 | |
| 0x7718767a ntdll.dll:RtlSetUserValueHeap+0x85a|mov ecx, ebx|ebx=0x820000 | |
| 0x7718767c ntdll.dll:RtlSetUserValueHeap+0x85c|call 0x7717a2bf|esp=0x19f6e4|eip=0x7718767c | |
| 0x7717a2bf ntdll.dll:RtlReleasePebLock+0xa6f|mov edi, edi|edi=0x57e | |
| 0x7717a2c1 ntdll.dll:RtlReleasePebLock+0xa71|push ebp|ebp=0x19f724|esp=0x19f6e0 | |
| 0x7717a2c2 ntdll.dll:RtlReleasePebLock+0xa72|mov ebp, esp|esp=0x19f6dc | |
| 0x7717a2c4 ntdll.dll:RtlReleasePebLock+0xa74|sub esp, 0x10|esp=0x19f6dc | |
| 0x7717a2c7 ntdll.dll:RtlReleasePebLock+0xa77|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f6dc | |
| 0x7717a2ca ntdll.dll:RtlReleasePebLock+0xa7a|push ebx|ebx=0x820000|esp=0x19f6cc | |
| 0x7717a2cb ntdll.dll:RtlReleasePebLock+0xa7b|push esi|esi=0x822b00|esp=0x19f6c8 | |
| 0x7717a2cc ntdll.dll:RtlReleasePebLock+0xa7c|push edi|edi=0x57e|esp=0x19f6c4 | |
| 0x7717a2cd ntdll.dll:RtlReleasePebLock+0xa7d|mov edi, edx|edx=0x822b00 | |
| 0x7717a2cf ntdll.dll:RtlReleasePebLock+0xa7f|xor esi, esi|esi=0x822b00 | |
| 0x7717a2d1 ntdll.dll:RtlReleasePebLock+0xa81|mov edx, ecx|ecx=0x820000 | |
| 0x7717a2d3 ntdll.dll:RtlReleasePebLock+0xa83|mov dword ptr [ebp - 4], edx|ebp=0x19f6dc|edx=0x820000 | |
| 0x7717a2d6 ntdll.dll:RtlReleasePebLock+0xa86|mov ebx, dword ptr [edi + 0x18]|edi=0x822b00 | |
| 0x7717a2d9 ntdll.dll:RtlReleasePebLock+0xa89|sub eax, dword ptr [edi + 0x14]|eax=0x57e|edi=0x822b00 | |
| 0x7717a2dc ntdll.dll:RtlReleasePebLock+0xa8c|mov dword ptr [ebp - 8], eax|ebp=0x19f6dc|eax=0x4fe | |
| 0x7717a2df ntdll.dll:RtlReleasePebLock+0xa8f|mov eax, dword ptr [ebx + 4]|ebx=0x8200c0 | |
| 0x7717a2e2 ntdll.dll:RtlReleasePebLock+0xa92|cmp ebx, eax|ebx=0x8200c0|eax=0x8266e8 | |
| 0x7717a2e4 ntdll.dll:RtlReleasePebLock+0xa94|je 0x7717a32f|eflags=0x297 | |
| 0x7717a2e6 ntdll.dll:RtlReleasePebLock+0xa96|cmp byte ptr [ebp + 8], 0|ebp=0x19f6dc | |
| 0x7717a2ea ntdll.dll:RtlReleasePebLock+0xa9a|je 0x771d3ea4|eflags=0x202 | |
| 0x7717a2f0 ntdll.dll:RtlReleasePebLock+0xaa0|add eax, -8|eax=0x8266e8 | |
| 0x7717a2f3 ntdll.dll:RtlReleasePebLock+0xaa3|mov dword ptr [ebp - 0x10], eax|ebp=0x19f6dc|eax=0x8266e0 | |
| 0x7717a2f6 ntdll.dll:RtlReleasePebLock+0xaa6|mov eax, dword ptr [eax]|eax=0x8266e0 | |
| 0x7717a2f8 ntdll.dll:RtlReleasePebLock+0xaa8|cmp dword ptr [edx + 0x4c], esi|edx=0x820000|esi=0x0 | |
| 0x7717a2fb ntdll.dll:RtlReleasePebLock+0xaab|je 0x7717a323|eflags=0x206 | |
| 0x7717a2fd ntdll.dll:RtlReleasePebLock+0xaad|mov edx, dword ptr [edx + 0x50]|edx=0x820000 | |
| 0x7717a300 ntdll.dll:RtlReleasePebLock+0xab0|xor edx, eax|edx=0x241ac80a|eax=0x261ac808 | |
| 0x7717a302 ntdll.dll:RtlReleasePebLock+0xab2|mov ecx, edx|edx=0x2000002 | |
| 0x7717a304 ntdll.dll:RtlReleasePebLock+0xab4|mov dword ptr [ebp - 0xc], edx|ebp=0x19f6dc|edx=0x2000002 | |
| 0x7717a307 ntdll.dll:RtlReleasePebLock+0xab7|mov eax, edx|edx=0x2000002 | |
| 0x7717a309 ntdll.dll:RtlReleasePebLock+0xab9|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717a30c ntdll.dll:RtlReleasePebLock+0xabc|shr eax, 8|eax=0x2000002 | |
| 0x7717a30f ntdll.dll:RtlReleasePebLock+0xabf|xor cl, al|cl=0x0|al=0x0 | |
| 0x7717a311 ntdll.dll:RtlReleasePebLock+0xac1|mov eax, edx|edx=0x2000002 | |
| 0x7717a313 ntdll.dll:RtlReleasePebLock+0xac3|shr edx, 0x18|edx=0x2000002 | |
| 0x7717a316 ntdll.dll:RtlReleasePebLock+0xac6|xor cl, al|cl=0x0|al=0x2 | |
| 0x7717a318 ntdll.dll:RtlReleasePebLock+0xac8|cmp dl, cl|dl=0x2|cl=0x2 | |
| 0x7717a31a ntdll.dll:RtlReleasePebLock+0xaca|mov edx, dword ptr [ebp - 4]|ebp=0x19f6dc | |
| 0x7717a31d ntdll.dll:RtlReleasePebLock+0xacd|jne 0x771d3e8b|eflags=0x246 | |
| 0x7717a323 ntdll.dll:RtlReleasePebLock+0xad3|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19f6dc | |
| 0x7717a326 ntdll.dll:RtlReleasePebLock+0xad6|movzx eax, ax|ax=0x2 | |
| 0x7717a329 ntdll.dll:RtlReleasePebLock+0xad9|sub ecx, eax|ecx=0x57e|eax=0x2 | |
| 0x7717a32b ntdll.dll:RtlReleasePebLock+0xadb|test ecx, ecx|ecx=0x57c | |
| 0x7717a32d ntdll.dll:RtlReleasePebLock+0xadd|jle 0x7717a33a|eflags=0x202 | |
| 0x7717a32f ntdll.dll:RtlReleasePebLock+0xadf|mov esi, ebx|ebx=0x8200c0 | |
| 0x7717a331 ntdll.dll:RtlReleasePebLock+0xae1|pop edi|edi=0x822b00|esp=0x19f6c0 | |
| 0x7717a332 ntdll.dll:RtlReleasePebLock+0xae2|mov eax, esi|esi=0x8200c0 | |
| 0x7717a334 ntdll.dll:RtlReleasePebLock+0xae4|pop esi|esi=0x8200c0|esp=0x19f6c4 | |
| 0x7717a335 ntdll.dll:RtlReleasePebLock+0xae5|pop ebx|ebx=0x8200c0|esp=0x19f6c8 | |
| 0x7717a336 ntdll.dll:RtlReleasePebLock+0xae6|leave|ebp=0x19f6dc|esp=0x19f6cc | |
| 0x7717a337 ntdll.dll:RtlReleasePebLock+0xae7|ret 0xc|esp=0x19f6e0 | |
| 0x77187681 ntdll.dll:RtlSetUserValueHeap+0x861|test eax, eax|eax=0x8200c0 | |
| 0x77187683 ntdll.dll:RtlSetUserValueHeap+0x863|je 0x77187693|eflags=0x206 | |
| 0x77187685 ntdll.dll:RtlSetUserValueHeap+0x865|pop edi|edi=0x57e|esp=0x19f6f0 | |
| 0x77187686 ntdll.dll:RtlSetUserValueHeap+0x866|pop esi|esi=0x822b00|esp=0x19f6f4 | |
| 0x77187687 ntdll.dll:RtlSetUserValueHeap+0x867|pop ebx|ebx=0x820000|esp=0x19f6f8 | |
| 0x77187688 ntdll.dll:RtlSetUserValueHeap+0x868|ret|esp=0x19f6fc | |
| 0x7717a118 ntdll.dll:RtlReleasePebLock+0x8c8|mov ecx, eax|eax=0x8200c0 | |
| 0x7717a11a ntdll.dll:RtlReleasePebLock+0x8ca|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x7717a120 ntdll.dll:RtlReleasePebLock+0x8d0|cmp eax, ecx|eax=0x8200c0|ecx=0x8200c0 | |
| 0x7717a122 ntdll.dll:RtlReleasePebLock+0x8d2|jne 0x7717a241|eflags=0x246 | |
| 0x7717a128 ntdll.dll:RtlReleasePebLock+0x8d8|mov eax, dword ptr [ecx + 4]|ecx=0x8200c0 | |
| 0x7717a12b ntdll.dll:RtlReleasePebLock+0x8db|lea ebx, [esi + 8]|esi=0x82a3f0 | |
| 0x7717a12e ntdll.dll:RtlReleasePebLock+0x8de|mov edx, dword ptr [eax]|eax=0x8266e8 | |
| 0x7717a130 ntdll.dll:RtlReleasePebLock+0x8e0|cmp edx, ecx|edx=0x8200c0|ecx=0x8200c0 | |
| 0x7717a132 ntdll.dll:RtlReleasePebLock+0x8e2|jne 0x7717a1c9|eflags=0x246 | |
| 0x7717a138 ntdll.dll:RtlReleasePebLock+0x8e8|mov dword ptr [ebx], ecx|ebx=0x82a3f8|ecx=0x8200c0 | |
| 0x7717a13a ntdll.dll:RtlReleasePebLock+0x8ea|mov dword ptr [ebx + 4], eax|ebx=0x82a3f8|eax=0x8266e8 | |
| 0x7717a13d ntdll.dll:RtlReleasePebLock+0x8ed|mov dword ptr [eax], ebx|eax=0x8266e8|ebx=0x82a3f8 | |
| 0x7717a13f ntdll.dll:RtlReleasePebLock+0x8ef|mov dword ptr [ecx + 4], ebx|ecx=0x8200c0|ebx=0x82a3f8 | |
| 0x7717a142 ntdll.dll:RtlReleasePebLock+0x8f2|movzx eax, word ptr [esi]|esi=0x82a3f0 | |
| 0x7717a145 ntdll.dll:RtlReleasePebLock+0x8f5|add dword ptr [edi + 0x74], eax|edi=0x820000|eax=0x57e | |
| 0x7717a148 ntdll.dll:RtlReleasePebLock+0x8f8|mov edx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717a14e ntdll.dll:RtlReleasePebLock+0x8fe|test edx, edx|edx=0x820270 | |
| 0x7717a150 ntdll.dll:RtlReleasePebLock+0x900|je 0x7717a17f|eflags=0x202 | |
| 0x7717a152 ntdll.dll:RtlReleasePebLock+0x902|movzx ecx, word ptr [esi]|esi=0x82a3f0 | |
| 0x7717a155 ntdll.dll:RtlReleasePebLock+0x905|cmp ecx, dword ptr [edx + 4]|ecx=0x57e|edx=0x820270 | |
| 0x7717a158 ntdll.dll:RtlReleasePebLock+0x908|jb 0x7717a171|eflags=0x202 | |
| 0x7717a15a ntdll.dll:RtlReleasePebLock+0x90a|lea ebx, [ebx]|ebx=0x82a3f8 | |
| 0x7717a160 ntdll.dll:RtlReleasePebLock+0x910|mov eax, dword ptr [edx]|edx=0x820270 | |
| 0x7717a162 ntdll.dll:RtlReleasePebLock+0x912|test eax, eax|eax=0x822b00 | |
| 0x7717a164 ntdll.dll:RtlReleasePebLock+0x914|je 0x7717a26b|eflags=0x206 | |
| 0x7717a16a ntdll.dll:RtlReleasePebLock+0x91a|mov edx, eax|eax=0x822b00 | |
| 0x7717a16c ntdll.dll:RtlReleasePebLock+0x91c|cmp ecx, dword ptr [edx + 4]|ecx=0x57e|edx=0x822b00 | |
| 0x7717a16f ntdll.dll:RtlReleasePebLock+0x91f|jae 0x7717a160|eflags=0x287 | |
| 0x7717a171 ntdll.dll:RtlReleasePebLock+0x921|mov eax, ecx|ecx=0x57e | |
| 0x7717a173 ntdll.dll:RtlReleasePebLock+0x923|push ecx|ecx=0x57e|esp=0x19f700 | |
| 0x7717a174 ntdll.dll:RtlReleasePebLock+0x924|push eax|eax=0x57e|esp=0x19f6fc | |
| 0x7717a175 ntdll.dll:RtlReleasePebLock+0x925|push ebx|ebx=0x82a3f8|esp=0x19f6f8 | |
| 0x7717a176 ntdll.dll:RtlReleasePebLock+0x926|push 1|esp=0x19f6f4 | |
| 0x7717a178 ntdll.dll:RtlReleasePebLock+0x928|mov ecx, edi|edi=0x820000 | |
| 0x7717a17a ntdll.dll:RtlReleasePebLock+0x92a|call 0x771875a5|esp=0x19f6f0|eip=0x7717a17a | |
| 0x771875a5 ntdll.dll:RtlSetUserValueHeap+0x785|mov edi, edi|edi=0x820000 | |
| 0x771875a7 ntdll.dll:RtlSetUserValueHeap+0x787|push ebp|ebp=0x19f724|esp=0x19f6ec | |
| 0x771875a8 ntdll.dll:RtlSetUserValueHeap+0x788|mov ebp, esp|esp=0x19f6e8 | |
| 0x771875aa ntdll.dll:RtlSetUserValueHeap+0x78a|sub esp, 0xc|esp=0x19f6e8 | |
| 0x771875ad ntdll.dll:RtlSetUserValueHeap+0x78d|push ebx|ebx=0x82a3f8|esp=0x19f6dc | |
| 0x771875ae ntdll.dll:RtlSetUserValueHeap+0x78e|push esi|esi=0x82a3f0|esp=0x19f6d8 | |
| 0x771875af ntdll.dll:RtlSetUserValueHeap+0x78f|mov esi, edx|edx=0x822b00 | |
| 0x771875b1 ntdll.dll:RtlSetUserValueHeap+0x791|mov dword ptr [ebp - 0xc], ecx|ebp=0x19f6e8|ecx=0x820000 | |
| 0x771875b4 ntdll.dll:RtlSetUserValueHeap+0x794|push edi|edi=0x820000|esp=0x19f6d4 | |
| 0x771875b5 ntdll.dll:RtlSetUserValueHeap+0x795|mov edi, dword ptr [ebp + 0x10]|ebp=0x19f6e8 | |
| 0x771875b8 ntdll.dll:RtlSetUserValueHeap+0x798|sub edi, dword ptr [esi + 0x14]|edi=0x57e|esi=0x822b00 | |
| 0x771875bb ntdll.dll:RtlSetUserValueHeap+0x79b|cmp dword ptr [esi + 8], 0|esi=0x822b00 | |
| 0x771875bf ntdll.dll:RtlSetUserValueHeap+0x79f|jne 0x771c9763|eflags=0x246 | |
| 0x771875c5 ntdll.dll:RtlSetUserValueHeap+0x7a5|mov edx, edi|edi=0x4fe | |
| 0x771875c7 ntdll.dll:RtlSetUserValueHeap+0x7a7|mov dword ptr [ebp - 4], edi|ebp=0x19f6e8|edi=0x4fe | |
| 0x771875ca ntdll.dll:RtlSetUserValueHeap+0x7aa|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x771875cd ntdll.dll:RtlSetUserValueHeap+0x7ad|inc dword ptr [esi + 0xc]|esi=0x822b00 | |
| 0x771875d0 ntdll.dll:RtlSetUserValueHeap+0x7b0|mov ebx, dword ptr [eax + edx*4]|eax=0x822c14|edx=0x4fe | |
| 0x771875d3 ntdll.dll:RtlSetUserValueHeap+0x7b3|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x771875d6 ntdll.dll:RtlSetUserValueHeap+0x7b6|dec eax|eax=0x800 | |
| 0x771875d7 ntdll.dll:RtlSetUserValueHeap+0x7b7|cmp dword ptr [ebp + 0x10], eax|ebp=0x19f6e8|eax=0x7ff | |
| 0x771875da ntdll.dll:RtlSetUserValueHeap+0x7ba|je 0x77187608|eflags=0x293 | |
| 0x771875dc ntdll.dll:RtlSetUserValueHeap+0x7bc|test ebx, ebx|ebx=0x0 | |
| 0x771875de ntdll.dll:RtlSetUserValueHeap+0x7be|jne 0x7718760d|eflags=0x246 | |
| 0x771875e0 ntdll.dll:RtlSetUserValueHeap+0x7c0|mov ecx, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x771875e3 ntdll.dll:RtlSetUserValueHeap+0x7c3|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f6e8 | |
| 0x771875e6 ntdll.dll:RtlSetUserValueHeap+0x7c6|mov dword ptr [ecx + edx*4], eax|ecx=0x822c14|edx=0x4fe|eax=0x82a3f8 | |
| 0x771875e9 ntdll.dll:RtlSetUserValueHeap+0x7c9|test ebx, ebx|ebx=0x0 | |
| 0x771875eb ntdll.dll:RtlSetUserValueHeap+0x7cb|jne 0x77187601|eflags=0x246 | |
| 0x771875ed ntdll.dll:RtlSetUserValueHeap+0x7cd|mov ecx, dword ptr [esi + 0x1c]|esi=0x822b00 | |
| 0x771875f0 ntdll.dll:RtlSetUserValueHeap+0x7d0|mov edx, edi|edi=0x4fe | |
| 0x771875f2 ntdll.dll:RtlSetUserValueHeap+0x7d2|shr edx, 5|edx=0x4fe | |
| 0x771875f5 ntdll.dll:RtlSetUserValueHeap+0x7d5|and edi, 0x1f|edi=0x4fe | |
| 0x771875f8 ntdll.dll:RtlSetUserValueHeap+0x7d8|mov eax, dword ptr [ecx + edx*4]|ecx=0x822b24|edx=0x27 | |
| 0x771875fb ntdll.dll:RtlSetUserValueHeap+0x7db|bts eax, edi|eax=0x0|edi=0x1e | |
| 0x771875fe ntdll.dll:RtlSetUserValueHeap+0x7de|mov dword ptr [ecx + edx*4], eax|ecx=0x822b24|edx=0x27|eax=0x40000000 | |
| 0x77187601 ntdll.dll:RtlSetUserValueHeap+0x7e1|pop edi|edi=0x1e|esp=0x19f6d0 | |
| 0x77187602 ntdll.dll:RtlSetUserValueHeap+0x7e2|pop esi|esi=0x822b00|esp=0x19f6d4 | |
| 0x77187603 ntdll.dll:RtlSetUserValueHeap+0x7e3|pop ebx|ebx=0x0|esp=0x19f6d8 | |
| 0x77187604 ntdll.dll:RtlSetUserValueHeap+0x7e4|leave|ebp=0x19f6e8|esp=0x19f6dc | |
| 0x77187605 ntdll.dll:RtlSetUserValueHeap+0x7e5|ret 0x10|esp=0x19f6ec | |
| 0x7717a17f ntdll.dll:RtlReleasePebLock+0x92f|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717a183 ntdll.dll:RtlReleasePebLock+0x933|jne 0x7717a1de|eflags=0x206 | |
| 0x7717a1de ntdll.dll:RtlReleasePebLock+0x98e|mov al, byte ptr [esi + 1]|esi=0x82a3f0 | |
| 0x7717a1e1 ntdll.dll:RtlReleasePebLock+0x991|xor al, byte ptr [esi + 2]|al=0x5|esi=0x82a3f0 | |
| 0x7717a1e4 ntdll.dll:RtlReleasePebLock+0x994|xor al, byte ptr [esi]|al=0x5|esi=0x82a3f0 | |
| 0x7717a1e6 ntdll.dll:RtlReleasePebLock+0x996|mov byte ptr [esi + 3], al|esi=0x82a3f0|al=0x7b | |
| 0x7717a1e9 ntdll.dll:RtlReleasePebLock+0x999|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x7717a1ec ntdll.dll:RtlReleasePebLock+0x99c|xor dword ptr [esi], eax|esi=0x82a3f0|eax=0x241ac80a | |
| 0x7717a1ee ntdll.dll:RtlReleasePebLock+0x99e|jmp 0x7717a185 | |
| 0x7717a185 ntdll.dll:RtlReleasePebLock+0x935|mov eax, dword ptr [ebp - 0x14]|ebp=0x19f724 | |
| 0x7717a188 ntdll.dll:RtlReleasePebLock+0x938|mov ecx, dword ptr [ebp - 0xc]|ebp=0x19f724 | |
| 0x7717a18b ntdll.dll:RtlReleasePebLock+0x93b|mov edx, dword ptr [ebp - 8]|ebp=0x19f724 | |
| 0x7717a18e ntdll.dll:RtlReleasePebLock+0x93e|sub ecx, eax|ecx=0x57e|eax=0x57e | |
| 0x7717a190 ntdll.dll:RtlReleasePebLock+0x940|movzx ebx, dx|dx=0x57e | |
| 0x7717a193 ntdll.dll:RtlReleasePebLock+0x943|lea esi, [esi + eax*8]|esi=0x82a3f0|eax=0x57e | |
| 0x7717a196 ntdll.dll:RtlReleasePebLock+0x946|mov dword ptr [ebp - 0xc], ecx|ebp=0x19f724|ecx=0x0 | |
| 0x7717a199 ntdll.dll:RtlReleasePebLock+0x949|mov eax, dword ptr [ebp - 0x10]|ebp=0x19f724 | |
| 0x7717a19c ntdll.dll:RtlReleasePebLock+0x94c|cmp esi, dword ptr [eax + 0x28]|esi=0x82cfe0|eax=0x820000 | |
| 0x7717a19f ntdll.dll:RtlReleasePebLock+0x94f|jae 0x7717a1c0|eflags=0x283 | |
| 0x7717a1a1 ntdll.dll:RtlReleasePebLock+0x951|mov al, byte ptr [ebp - 1]|ebp=0x19f724 | |
| 0x7717a1a4 ntdll.dll:RtlReleasePebLock+0x954|test ecx, ecx|ecx=0x0 | |
| 0x7717a1a6 ntdll.dll:RtlReleasePebLock+0x956|jne 0x7717a0b0|eflags=0x246 | |
| 0x7717a1ac ntdll.dll:RtlReleasePebLock+0x95c|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x7717a1b0 ntdll.dll:RtlReleasePebLock+0x960|xor ax, dx|ax=0x10ad|dx=0x57e | |
| 0x7717a1b3 ntdll.dll:RtlReleasePebLock+0x963|mov word ptr [esi + 4], ax|esi=0x82cfe0|ax=0x15d3 | |
| 0x7717a1b7 ntdll.dll:RtlReleasePebLock+0x967|test dx, dx|dx=0x57e | |
| 0x7717a1ba ntdll.dll:RtlReleasePebLock+0x96a|je 0x771d3e0a|eflags=0x206 | |
| 0x7717a1c0 ntdll.dll:RtlReleasePebLock+0x970|pop edi|edi=0x820000|esp=0x19f700 | |
| 0x7717a1c1 ntdll.dll:RtlReleasePebLock+0x971|pop esi|esi=0x82cfe0|esp=0x19f704 | |
| 0x7717a1c2 ntdll.dll:RtlReleasePebLock+0x972|pop ebx|ebx=0x57e|esp=0x19f708 | |
| 0x7717a1c3 ntdll.dll:RtlReleasePebLock+0x973|mov esp, ebp|ebp=0x19f724 | |
| 0x7717a1c5 ntdll.dll:RtlReleasePebLock+0x975|pop ebp|ebp=0x19f724|esp=0x19f724 | |
| 0x7717a1c6 ntdll.dll:RtlReleasePebLock+0x976|ret 4|esp=0x19f728 | |
| 0x7718789b ntdll.dll:RtlSetUserValueHeap+0xa7b|cmp dword ptr [esi + 0x4c], ebx|esi=0x820000|ebx=0x0 | |
| 0x7718789e ntdll.dll:RtlSetUserValueHeap+0xa7e|je 0x771878b6|eflags=0x206 | |
| 0x771878a0 ntdll.dll:RtlSetUserValueHeap+0xa80|mov eax, dword ptr [esi + 0x50]|esi=0x820000 | |
| 0x771878a3 ntdll.dll:RtlSetUserValueHeap+0xa83|xor dword ptr [edi], eax|edi=0x82a3f0|eax=0x241ac80a | |
| 0x771878a5 ntdll.dll:RtlSetUserValueHeap+0xa85|mov al, byte ptr [edi + 2]|edi=0x82a3f0 | |
| 0x771878a8 ntdll.dll:RtlSetUserValueHeap+0xa88|xor al, byte ptr [edi + 1]|al=0x0|edi=0x82a3f0 | |
| 0x771878ab ntdll.dll:RtlSetUserValueHeap+0xa8b|xor al, byte ptr [edi]|al=0x5|edi=0x82a3f0 | |
| 0x771878ad ntdll.dll:RtlSetUserValueHeap+0xa8d|cmp byte ptr [edi + 3], al|edi=0x82a3f0|al=0x7b | |
| 0x771878b0 ntdll.dll:RtlSetUserValueHeap+0xa90|jne 0x771d57e2|eflags=0x246 | |
| 0x771878b6 ntdll.dll:RtlSetUserValueHeap+0xa96|mov eax, edi|edi=0x82a3f0 | |
| 0x771878b8 ntdll.dll:RtlSetUserValueHeap+0xa98|pop edi|edi=0x82a3f0|esp=0x19f730 | |
| 0x771878b9 ntdll.dll:RtlSetUserValueHeap+0xa99|pop esi|esi=0x820000|esp=0x19f734 | |
| 0x771878ba ntdll.dll:RtlSetUserValueHeap+0xa9a|pop ebx|ebx=0x0|esp=0x19f738 | |
| 0x771878bb ntdll.dll:RtlSetUserValueHeap+0xa9b|leave|ebp=0x19f758|esp=0x19f73c | |
| 0x771878bc ntdll.dll:RtlSetUserValueHeap+0xa9c|ret|esp=0x19f75c | |
| 0x7717694f ntdll.dll:RtlAllocateHeap+0x1c5f|mov ebx, eax|eax=0x82a3f0 | |
| 0x77176951 ntdll.dll:RtlAllocateHeap+0x1c61|mov dword ptr [ebp - 0x60], ebx|ebp=0x19f8e0|ebx=0x82a3f0 | |
| 0x77176954 ntdll.dll:RtlAllocateHeap+0x1c64|test ebx, ebx|ebx=0x82a3f0 | |
| 0x77176956 ntdll.dll:RtlAllocateHeap+0x1c66|je 0x771777f6|eflags=0x206 | |
| 0x7717695c ntdll.dll:RtlAllocateHeap+0x1c6c|lea ecx, [ebx + 8]|ebx=0x82a3f0 | |
| 0x7717695f ntdll.dll:RtlAllocateHeap+0x1c6f|mov esi, dword ptr [ecx]|ecx=0x82a3f8 | |
| 0x77176961 ntdll.dll:RtlAllocateHeap+0x1c71|mov dword ptr [ebp - 0x20], esi|ebp=0x19f8e0|esi=0x8200c0 | |
| 0x77176964 ntdll.dll:RtlAllocateHeap+0x1c74|mov eax, dword ptr [ebx + 0xc]|ebx=0x82a3f0 | |
| 0x77176967 ntdll.dll:RtlAllocateHeap+0x1c77|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8e0|eax=0x8266e8 | |
| 0x7717696a ntdll.dll:RtlAllocateHeap+0x1c7a|mov eax, dword ptr [eax]|eax=0x8266e8 | |
| 0x7717696c ntdll.dll:RtlAllocateHeap+0x1c7c|mov edx, dword ptr [esi + 4]|esi=0x8200c0 | |
| 0x7717696f ntdll.dll:RtlAllocateHeap+0x1c7f|cmp eax, edx|eax=0x82a3f8|edx=0x82a3f8 | |
| 0x77176971 ntdll.dll:RtlAllocateHeap+0x1c81|jne 0x771777dc|eflags=0x246 | |
| 0x77176977 ntdll.dll:RtlAllocateHeap+0x1c87|cmp eax, ecx|eax=0x82a3f8|ecx=0x82a3f8 | |
| 0x77176979 ntdll.dll:RtlAllocateHeap+0x1c89|jne 0x771777dc|eflags=0x246 | |
| 0x7717697f ntdll.dll:RtlAllocateHeap+0x1c8f|movzx eax, word ptr [ebx]|ebx=0x82a3f0 | |
| 0x77176982 ntdll.dll:RtlAllocateHeap+0x1c92|sub dword ptr [edi + 0x74], eax|edi=0x820000|eax=0x57e | |
| 0x77176985 ntdll.dll:RtlAllocateHeap+0x1c95|mov edx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717698b ntdll.dll:RtlAllocateHeap+0x1c9b|test edx, edx|edx=0x820270 | |
| 0x7717698d ntdll.dll:RtlAllocateHeap+0x1c9d|je 0x771769b3|eflags=0x202 | |
| 0x7717698f ntdll.dll:RtlAllocateHeap+0x1c9f|movzx esi, word ptr [ebx]|ebx=0x82a3f0 | |
| 0x77176992 ntdll.dll:RtlAllocateHeap+0x1ca2|cmp esi, dword ptr [edx + 4]|esi=0x57e|edx=0x820270 | |
| 0x77176995 ntdll.dll:RtlAllocateHeap+0x1ca5|jb 0x771769a1|eflags=0x202 | |
| 0x77176997 ntdll.dll:RtlAllocateHeap+0x1ca7|mov eax, dword ptr [edx]|edx=0x820270 | |
| 0x77176999 ntdll.dll:RtlAllocateHeap+0x1ca9|test eax, eax|eax=0x822b00 | |
| 0x7717699b ntdll.dll:RtlAllocateHeap+0x1cab|jne 0x771769e6|eflags=0x206 | |
| 0x771769e6 ntdll.dll:RtlAllocateHeap+0x1cf6|mov edx, eax|eax=0x822b00 | |
| 0x771769e8 ntdll.dll:RtlAllocateHeap+0x1cf8|jmp 0x77176992 | |
| 0x77176992 ntdll.dll:RtlAllocateHeap+0x1ca2|cmp esi, dword ptr [edx + 4]|esi=0x57e|edx=0x822b00 | |
| 0x77176995 ntdll.dll:RtlAllocateHeap+0x1ca5|jb 0x771769a1|eflags=0x287 | |
| 0x771769a1 ntdll.dll:RtlAllocateHeap+0x1cb1|movzx eax, word ptr [ebx]|ebx=0x82a3f0 | |
| 0x771769a4 ntdll.dll:RtlAllocateHeap+0x1cb4|push eax|eax=0x57e|esp=0x19f760 | |
| 0x771769a5 ntdll.dll:RtlAllocateHeap+0x1cb5|push esi|esi=0x57e|esp=0x19f75c | |
| 0x771769a6 ntdll.dll:RtlAllocateHeap+0x1cb6|push ecx|ecx=0x82a3f8|esp=0x19f758 | |
| 0x771769a7 ntdll.dll:RtlAllocateHeap+0x1cb7|push 1|esp=0x19f754 | |
| 0x771769a9 ntdll.dll:RtlAllocateHeap+0x1cb9|mov ecx, edi|edi=0x820000 | |
| 0x771769ab ntdll.dll:RtlAllocateHeap+0x1cbb|call 0x7718706b|esp=0x19f750|eip=0x771769ab | |
| 0x7718706b ntdll.dll:RtlSetUserValueHeap+0x24b|mov edi, edi|edi=0x820000 | |
| 0x7718706d ntdll.dll:RtlSetUserValueHeap+0x24d|push ebp|ebp=0x19f8e0|esp=0x19f74c | |
| 0x7718706e ntdll.dll:RtlSetUserValueHeap+0x24e|mov ebp, esp|esp=0x19f748 | |
| 0x77187070 ntdll.dll:RtlSetUserValueHeap+0x250|sub esp, 0x14|esp=0x19f748 | |
| 0x77187073 ntdll.dll:RtlSetUserValueHeap+0x253|push ebx|ebx=0x82a3f0|esp=0x19f734 | |
| 0x77187074 ntdll.dll:RtlSetUserValueHeap+0x254|push esi|esi=0x57e|esp=0x19f730 | |
| 0x77187075 ntdll.dll:RtlSetUserValueHeap+0x255|mov esi, edx|edx=0x822b00 | |
| 0x77187077 ntdll.dll:RtlSetUserValueHeap+0x257|mov dword ptr [ebp - 8], ecx|ebp=0x19f748|ecx=0x820000 | |
| 0x7718707a ntdll.dll:RtlSetUserValueHeap+0x25a|push edi|edi=0x820000|esp=0x19f72c | |
| 0x7718707b ntdll.dll:RtlSetUserValueHeap+0x25b|mov edi, dword ptr [ebp + 0x10]|ebp=0x19f748 | |
| 0x7718707e ntdll.dll:RtlSetUserValueHeap+0x25e|sub edi, dword ptr [esi + 0x14]|edi=0x57e|esi=0x822b00 | |
| 0x77187081 ntdll.dll:RtlSetUserValueHeap+0x261|cmp dword ptr [esi + 8], 0|esi=0x822b00 | |
| 0x77187085 ntdll.dll:RtlSetUserValueHeap+0x265|jne 0x771d534b|eflags=0x246 | |
| 0x7718708b ntdll.dll:RtlSetUserValueHeap+0x26b|mov edx, edi|edi=0x4fe | |
| 0x7718708d ntdll.dll:RtlSetUserValueHeap+0x26d|mov dword ptr [ebp - 4], edi|ebp=0x19f748|edi=0x4fe | |
| 0x77187090 ntdll.dll:RtlSetUserValueHeap+0x270|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x77187093 ntdll.dll:RtlSetUserValueHeap+0x273|mov ecx, dword ptr [eax + edx*4]|eax=0x822c14|edx=0x4fe | |
| 0x77187096 ntdll.dll:RtlSetUserValueHeap+0x276|dec dword ptr [esi + 0xc]|esi=0x822b00 | |
| 0x77187099 ntdll.dll:RtlSetUserValueHeap+0x279|mov dword ptr [ebp - 0xc], ecx|ebp=0x19f748|ecx=0x82a3f8 | |
| 0x7718709c ntdll.dll:RtlSetUserValueHeap+0x27c|mov ecx, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x7718709f ntdll.dll:RtlSetUserValueHeap+0x27f|lea ebx, [ecx - 1]|ecx=0x800 | |
| 0x771870a2 ntdll.dll:RtlSetUserValueHeap+0x282|mov dword ptr [ebp - 0x10], ebx|ebp=0x19f748|ebx=0x7ff | |
| 0x771870a5 ntdll.dll:RtlSetUserValueHeap+0x285|cmp dword ptr [ebp + 0x10], ebx|ebp=0x19f748|ebx=0x7ff | |
| 0x771870a8 ntdll.dll:RtlSetUserValueHeap+0x288|je 0x771870e8|eflags=0x293 | |
| 0x771870aa ntdll.dll:RtlSetUserValueHeap+0x28a|mov ebx, dword ptr [ebp + 0xc]|ebp=0x19f748 | |
| 0x771870ad ntdll.dll:RtlSetUserValueHeap+0x28d|cmp dword ptr [ebp - 0xc], ebx|ebp=0x19f748|ebx=0x82a3f8 | |
| 0x771870b0 ntdll.dll:RtlSetUserValueHeap+0x290|jne 0x771870e1|eflags=0x246 | |
| 0x771870b2 ntdll.dll:RtlSetUserValueHeap+0x292|cmp dword ptr [esi], 0|esi=0x822b00 | |
| 0x771870b5 ntdll.dll:RtlSetUserValueHeap+0x295|jne 0x771870ba|eflags=0x246 | |
| 0x771870b7 ntdll.dll:RtlSetUserValueHeap+0x297|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f748 | |
| 0x771870ba ntdll.dll:RtlSetUserValueHeap+0x29a|mov ebx, dword ptr [ebx]|ebx=0x82a3f8 | |
| 0x771870bc ntdll.dll:RtlSetUserValueHeap+0x29c|cmp dword ptr [ebp + 0x10], ecx|ebp=0x19f748|ecx=0x7ff | |
| 0x771870bf ntdll.dll:RtlSetUserValueHeap+0x29f|jae 0x771870ed|eflags=0x293 | |
| 0x771870c1 ntdll.dll:RtlSetUserValueHeap+0x2a1|cmp ebx, dword ptr [esi + 0x18]|ebx=0x8200c0|esi=0x822b00 | |
| 0x771870c4 ntdll.dll:RtlSetUserValueHeap+0x2a4|jne 0x771870f4|eflags=0x246 | |
| 0x771870c6 ntdll.dll:RtlSetUserValueHeap+0x2a6|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x771870c9 ntdll.dll:RtlSetUserValueHeap+0x2a9|and dword ptr [eax + edx*4], 0|eax=0x822c14|edx=0x4fe | |
| 0x771870cd ntdll.dll:RtlSetUserValueHeap+0x2ad|mov edx, edi|edi=0x4fe | |
| 0x771870cf ntdll.dll:RtlSetUserValueHeap+0x2af|mov ecx, dword ptr [esi + 0x1c]|esi=0x822b00 | |
| 0x771870d2 ntdll.dll:RtlSetUserValueHeap+0x2b2|and edi, 0x1f|edi=0x4fe | |
| 0x771870d5 ntdll.dll:RtlSetUserValueHeap+0x2b5|shr edx, 5|edx=0x4fe | |
| 0x771870d8 ntdll.dll:RtlSetUserValueHeap+0x2b8|mov eax, dword ptr [ecx + edx*4]|ecx=0x822b24|edx=0x27 | |
| 0x771870db ntdll.dll:RtlSetUserValueHeap+0x2bb|btr eax, edi|eax=0x40000000|edi=0x1e | |
| 0x771870de ntdll.dll:RtlSetUserValueHeap+0x2be|mov dword ptr [ecx + edx*4], eax|ecx=0x822b24|edx=0x27|eax=0x0 | |
| 0x771870e1 ntdll.dll:RtlSetUserValueHeap+0x2c1|pop edi|edi=0x1e|esp=0x19f728 | |
| 0x771870e2 ntdll.dll:RtlSetUserValueHeap+0x2c2|pop esi|esi=0x822b00|esp=0x19f72c | |
| 0x771870e3 ntdll.dll:RtlSetUserValueHeap+0x2c3|pop ebx|ebx=0x8200c0|esp=0x19f730 | |
| 0x771870e4 ntdll.dll:RtlSetUserValueHeap+0x2c4|leave|ebp=0x19f748|esp=0x19f734 | |
| 0x771870e5 ntdll.dll:RtlSetUserValueHeap+0x2c5|ret 0x10|esp=0x19f74c | |
| 0x771769b0 ntdll.dll:RtlAllocateHeap+0x1cc0|mov esi, dword ptr [ebp - 0x20]|ebp=0x19f8e0 | |
| 0x771769b3 ntdll.dll:RtlAllocateHeap+0x1cc3|mov eax, dword ptr [ebp - 0x24]|ebp=0x19f8e0 | |
| 0x771769b6 ntdll.dll:RtlAllocateHeap+0x1cc6|mov dword ptr [eax], esi|eax=0x8266e8|esi=0x8200c0 | |
| 0x771769b8 ntdll.dll:RtlAllocateHeap+0x1cc8|mov dword ptr [esi + 4], eax|esi=0x8200c0|eax=0x8266e8 | |
| 0x771769bb ntdll.dll:RtlAllocateHeap+0x1ccb|test byte ptr [ebx + 2], 8|ebx=0x82a3f0 | |
| 0x771769bf ntdll.dll:RtlAllocateHeap+0x1ccf|je 0x771769ea|eflags=0x246 | |
| 0x771769ea ntdll.dll:RtlAllocateHeap+0x1cfa|mov byte ptr [ebp - 0x45], 1|ebp=0x19f8e0 | |
| 0x771769ee ntdll.dll:RtlAllocateHeap+0x1cfe|mov cl, byte ptr [ebx + 2]|ebx=0x82a3f0 | |
| 0x771769f1 ntdll.dll:RtlAllocateHeap+0x1d01|mov byte ptr [ebp - 0x43], cl|ebp=0x19f8e0|cl=0x0 | |
| 0x771769f4 ntdll.dll:RtlAllocateHeap+0x1d04|mov esi, dword ptr [ebp - 0x64]|ebp=0x19f8e0 | |
| 0x771769f7 ntdll.dll:RtlAllocateHeap+0x1d07|test esi, esi|esi=0x1 | |
| 0x771769f9 ntdll.dll:RtlAllocateHeap+0x1d09|jne 0x77176ac5|eflags=0x202 | |
| 0x77176ac5 ntdll.dll:RtlAllocateHeap+0x1dd5|mov dword ptr [ebp - 0x6c], ebx|ebp=0x19f8e0|ebx=0x82a3f0 | |
| 0x77176ac8 ntdll.dll:RtlAllocateHeap+0x1dd8|test byte ptr [ebx + 2], 1|ebx=0x82a3f0 | |
| 0x77176acc ntdll.dll:RtlAllocateHeap+0x1ddc|je 0x77176ae6|eflags=0x246 | |
| 0x77176ae6 ntdll.dll:RtlAllocateHeap+0x1df6|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f8e0 | |
| 0x77176ae9 ntdll.dll:RtlAllocateHeap+0x1df9|mov byte ptr [ebx + 2], al|ebx=0x82a3f0|al=0x1 | |
| 0x77176aec ntdll.dll:RtlAllocateHeap+0x1dfc|movzx edx, word ptr [ebx]|ebx=0x82a3f0 | |
| 0x77176aef ntdll.dll:RtlAllocateHeap+0x1dff|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19f8e0 | |
| 0x77176af2 ntdll.dll:RtlAllocateHeap+0x1e02|sub edx, ecx|edx=0x57e|ecx=0x201 | |
| 0x77176af4 ntdll.dll:RtlAllocateHeap+0x1e04|mov dword ptr [ebp - 0x3c], edx|ebp=0x19f8e0|edx=0x37d | |
| 0x77176af7 ntdll.dll:RtlAllocateHeap+0x1e07|mov dword ptr [ebp - 0x100], edx|ebp=0x19f8e0|edx=0x37d | |
| 0x77176afd ntdll.dll:RtlAllocateHeap+0x1e0d|movzx eax, cx|cx=0x201 | |
| 0x77176b00 ntdll.dll:RtlAllocateHeap+0x1e10|mov dword ptr [ebp - 0x20], eax|ebp=0x19f8e0|eax=0x201 | |
| 0x77176b03 ntdll.dll:RtlAllocateHeap+0x1e13|mov word ptr [ebx], ax|ebx=0x82a3f0|ax=0x201 | |
| 0x77176b06 ntdll.dll:RtlAllocateHeap+0x1e16|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f8e0 | |
| 0x77176b09 ntdll.dll:RtlAllocateHeap+0x1e19|sub eax, dword ptr [ebp + 8]|eax=0x1008|ebp=0x19f8e0 | |
| 0x77176b0c ntdll.dll:RtlAllocateHeap+0x1e1c|mov dword ptr [ebp - 0x7c], eax|ebp=0x19f8e0|eax=0x8 | |
| 0x77176b0f ntdll.dll:RtlAllocateHeap+0x1e1f|cmp eax, 0x3f|eax=0x8 | |
| 0x77176b12 ntdll.dll:RtlAllocateHeap+0x1e22|jae 0x77176b19|eflags=0x297 | |
| 0x77176b14 ntdll.dll:RtlAllocateHeap+0x1e24|mov byte ptr [ebx + 7], al|ebx=0x82a3f0|al=0x8 | |
| 0x77176b17 ntdll.dll:RtlAllocateHeap+0x1e27|jmp 0x77176b21 | |
| 0x77176b21 ntdll.dll:RtlAllocateHeap+0x1e31|mov byte ptr [ebx + 3], 0|ebx=0x82a3f0 | |
| 0x77176b25 ntdll.dll:RtlAllocateHeap+0x1e35|test edx, edx|edx=0x37d | |
| 0x77176b27 ntdll.dll:RtlAllocateHeap+0x1e37|je 0x77176b47|eflags=0x206 | |
| 0x77176b29 ntdll.dll:RtlAllocateHeap+0x1e39|cmp edx, 1|edx=0x37d | |
| 0x77176b2c ntdll.dll:RtlAllocateHeap+0x1e3c|jne 0x77176c8c|eflags=0x202 | |
| 0x77176c8c ntdll.dll:RtlAllocateHeap+0x1f9c|xor eax, eax|eax=0x8 | |
| 0x77176c8e ntdll.dll:RtlAllocateHeap+0x1f9e|test esi, esi|esi=0x1 | |
| 0x77176c90 ntdll.dll:RtlAllocateHeap+0x1fa0|sete al|al=0x0|eflags=0x202 | |
| 0x77176c93 ntdll.dll:RtlAllocateHeap+0x1fa3|mov dword ptr [ebp - 0x1c], eax|ebp=0x19f8e0|eax=0x0 | |
| 0x77176c96 ntdll.dll:RtlAllocateHeap+0x1fa6|mov dword ptr [ebp - 0xac], eax|ebp=0x19f8e0|eax=0x0 | |
| 0x77176c9c ntdll.dll:RtlAllocateHeap+0x1fac|mov al, byte ptr [ebx + 6]|ebx=0x82a3f0 | |
| 0x77176c9f ntdll.dll:RtlAllocateHeap+0x1faf|test al, al|al=0x0 | |
| 0x77176ca1 ntdll.dll:RtlAllocateHeap+0x1fb1|je 0x77176cbd|eflags=0x246 | |
| 0x77176cbd ntdll.dll:RtlAllocateHeap+0x1fcd|mov ecx, edi|edi=0x820000 | |
| 0x77176cbf ntdll.dll:RtlAllocateHeap+0x1fcf|mov esi, edi|edi=0x820000 | |
| 0x77176cc1 ntdll.dll:RtlAllocateHeap+0x1fd1|mov dword ptr [ebp - 0xcc], ecx|ebp=0x19f8e0|ecx=0x820000 | |
| 0x77176cc7 ntdll.dll:RtlAllocateHeap+0x1fd7|mov dword ptr [ebp - 0x24], edx|ebp=0x19f8e0|edx=0x37d | |
| 0x77176cca ntdll.dll:RtlAllocateHeap+0x1fda|mov eax, dword ptr [ebp - 0x30]|ebp=0x19f8e0 | |
| 0x77176ccd ntdll.dll:RtlAllocateHeap+0x1fdd|lea ebx, [ebx + eax*8]|ebx=0x82a3f0|eax=0x201 | |
| 0x77176cd0 ntdll.dll:RtlAllocateHeap+0x1fe0|mov dword ptr [ebp - 0x54], 0|ebp=0x19f8e0 | |
| 0x77176cd7 ntdll.dll:RtlAllocateHeap+0x1fe7|mov al, byte ptr [ebp - 0x43]|ebp=0x19f8e0 | |
| 0x77176cda ntdll.dll:RtlAllocateHeap+0x1fea|mov byte ptr [ebx + 2], al|ebx=0x82b3f8|al=0x0 | |
| 0x77176cdd ntdll.dll:RtlAllocateHeap+0x1fed|mov byte ptr [ebx + 7], 0|ebx=0x82b3f8 | |
| 0x77176ce1 ntdll.dll:RtlAllocateHeap+0x1ff1|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77176ce5 ntdll.dll:RtlAllocateHeap+0x1ff5|xor ax, word ptr [ebp - 0x20]|ax=0x10ad|ebp=0x19f8e0 | |
| 0x77176ce9 ntdll.dll:RtlAllocateHeap+0x1ff9|mov word ptr [ebx + 4], ax|ebx=0x82b3f8|ax=0x12ac | |
| 0x77176ced ntdll.dll:RtlAllocateHeap+0x1ffd|cmp dword ptr [ecx + 0x18], esi|ecx=0x820000|esi=0x820000 | |
| 0x77176cf0 ntdll.dll:RtlAllocateHeap+0x2000|jne 0x77176cf6|eflags=0x246 | |
| 0x77176cf2 ntdll.dll:RtlAllocateHeap+0x2002|xor al, al|al=0xac | |
| 0x77176cf4 ntdll.dll:RtlAllocateHeap+0x2004|jmp 0x77176d27 | |
| 0x77176d27 ntdll.dll:RtlAllocateHeap+0x2037|mov byte ptr [ebp - 0x7e], al|ebp=0x19f8e0|al=0x0 | |
| 0x77176d2a ntdll.dll:RtlAllocateHeap+0x203a|mov byte ptr [ebx + 6], al|ebx=0x82b3f8|al=0x0 | |
| 0x77176d2d ntdll.dll:RtlAllocateHeap+0x203d|mov byte ptr [ebx + 3], 0|ebx=0x82b3f8 | |
| 0x77176d31 ntdll.dll:RtlAllocateHeap+0x2041|mov word ptr [ebx], dx|ebx=0x82b3f8|dx=0x37d | |
| 0x77176d34 ntdll.dll:RtlAllocateHeap+0x2044|lea esi, [ebx + edx*8]|ebx=0x82b3f8|edx=0x37d | |
| 0x77176d37 ntdll.dll:RtlAllocateHeap+0x2047|mov ecx, dword ptr [edi + 0x4c]|edi=0x820000 | |
| 0x77176d3a ntdll.dll:RtlAllocateHeap+0x204a|mov eax, ecx|ecx=0x100000 | |
| 0x77176d3c ntdll.dll:RtlAllocateHeap+0x204c|shr eax, 0x14|eax=0x100000 | |
| 0x77176d3f ntdll.dll:RtlAllocateHeap+0x204f|and al, byte ptr [edi + 0x52]|al=0x1|edi=0x820000 | |
| 0x77176d42 ntdll.dll:RtlAllocateHeap+0x2052|xor al, byte ptr [esi + 2]|al=0x0|esi=0x82cfe0 | |
| 0x77176d45 ntdll.dll:RtlAllocateHeap+0x2055|test al, 1|al=0x1b | |
| 0x77176d47 ntdll.dll:RtlAllocateHeap+0x2057|je 0x771772aa|eflags=0x202 | |
| 0x77176d4d ntdll.dll:RtlAllocateHeap+0x205d|movzx edx, dx|dx=0x37d | |
| 0x77176d50 ntdll.dll:RtlAllocateHeap+0x2060|mov dword ptr [ebp - 0x28], edx|ebp=0x19f8e0|edx=0x37d | |
| 0x77176d53 ntdll.dll:RtlAllocateHeap+0x2063|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77176d57 ntdll.dll:RtlAllocateHeap+0x2067|xor ax, dx|ax=0x10ad|dx=0x37d | |
| 0x77176d5a ntdll.dll:RtlAllocateHeap+0x206a|mov word ptr [esi + 4], ax|esi=0x82cfe0|ax=0x13d0 | |
| 0x77176d5e ntdll.dll:RtlAllocateHeap+0x206e|cmp byte ptr [ebp - 0x1c], 0|ebp=0x19f8e0 | |
| 0x77176d62 ntdll.dll:RtlAllocateHeap+0x2072|jne 0x771771bf|eflags=0x246 | |
| 0x77176d68 ntdll.dll:RtlAllocateHeap+0x2078|mov byte ptr [ebx + 2], 0|ebx=0x82b3f8 | |
| 0x77176d6c ntdll.dll:RtlAllocateHeap+0x207c|mov byte ptr [ebx + 7], 0|ebx=0x82b3f8 | |
| 0x77176d70 ntdll.dll:RtlAllocateHeap+0x2080|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176d76 ntdll.dll:RtlAllocateHeap+0x2086|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x77176d7c ntdll.dll:RtlAllocateHeap+0x208c|mov dword ptr [ebp - 0x1c], esi|ebp=0x19f8e0|esi=0x820270 | |
| 0x77176d7f ntdll.dll:RtlAllocateHeap+0x208f|test esi, esi|esi=0x820270 | |
| 0x77176d81 ntdll.dll:RtlAllocateHeap+0x2091|je 0x7717701d|eflags=0x202 | |
| 0x77176d87 ntdll.dll:RtlAllocateHeap+0x2097|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176d8a ntdll.dll:RtlAllocateHeap+0x209a|cmp edx, ecx|edx=0x37d|ecx=0x80 | |
| 0x77176d8c ntdll.dll:RtlAllocateHeap+0x209c|jae 0x77176d92|eflags=0x202 | |
| 0x77176d92 ntdll.dll:RtlAllocateHeap+0x20a2|mov eax, dword ptr [esi]|esi=0x820270 | |
| 0x77176d94 ntdll.dll:RtlAllocateHeap+0x20a4|test eax, eax|eax=0x822b00 | |
| 0x77176d96 ntdll.dll:RtlAllocateHeap+0x20a6|jne 0x77177013|eflags=0x206 | |
| 0x77177013 ntdll.dll:RtlAllocateHeap+0x2323|mov esi, eax|eax=0x822b00 | |
| 0x77177015 ntdll.dll:RtlAllocateHeap+0x2325|mov dword ptr [ebp - 0x1c], esi|ebp=0x19f8e0|esi=0x822b00 | |
| 0x77177018 ntdll.dll:RtlAllocateHeap+0x2328|jmp 0x77176d87 | |
| 0x77176d87 ntdll.dll:RtlAllocateHeap+0x2097|mov ecx, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176d8a ntdll.dll:RtlAllocateHeap+0x209a|cmp edx, ecx|edx=0x37d|ecx=0x800 | |
| 0x77176d8c ntdll.dll:RtlAllocateHeap+0x209c|jae 0x77176d92|eflags=0x287 | |
| 0x77176d8e ntdll.dll:RtlAllocateHeap+0x209e|mov eax, edx|edx=0x37d | |
| 0x77176d90 ntdll.dll:RtlAllocateHeap+0x20a0|jmp 0x77176d9f | |
| 0x77176d9f ntdll.dll:RtlAllocateHeap+0x20af|mov dword ptr [ebp - 0x74], eax|ebp=0x19f8e0|eax=0x37d | |
| 0x77176da2 ntdll.dll:RtlAllocateHeap+0x20b2|sub eax, dword ptr [esi + 0x14]|eax=0x37d|esi=0x822b00 | |
| 0x77176da5 ntdll.dll:RtlAllocateHeap+0x20b5|mov dword ptr [ebp - 0x3c], eax|ebp=0x19f8e0|eax=0x2fd | |
| 0x77176da8 ntdll.dll:RtlAllocateHeap+0x20b8|mov dword ptr [ebp - 0x7c], 0|ebp=0x19f8e0 | |
| 0x77176daf ntdll.dll:RtlAllocateHeap+0x20bf|mov eax, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x77176db2 ntdll.dll:RtlAllocateHeap+0x20c2|mov dword ptr [ebp - 0x34], eax|ebp=0x19f8e0|eax=0x8200c0 | |
| 0x77176db5 ntdll.dll:RtlAllocateHeap+0x20c5|mov ecx, dword ptr [eax + 4]|eax=0x8200c0 | |
| 0x77176db8 ntdll.dll:RtlAllocateHeap+0x20c8|cmp eax, ecx|eax=0x8200c0|ecx=0x8266e8 | |
| 0x77176dba ntdll.dll:RtlAllocateHeap+0x20ca|jne 0x77176dc3|eflags=0x297 | |
| 0x77176dc3 ntdll.dll:RtlAllocateHeap+0x20d3|lea eax, [ecx - 8]|ecx=0x8266e8 | |
| 0x77176dc6 ntdll.dll:RtlAllocateHeap+0x20d6|mov dword ptr [ebp - 0x20], eax|ebp=0x19f8e0|eax=0x8266e0 | |
| 0x77176dc9 ntdll.dll:RtlAllocateHeap+0x20d9|mov edx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176dcb ntdll.dll:RtlAllocateHeap+0x20db|mov dword ptr [ebp - 0x158], edx|ebp=0x19f8e0|edx=0x261ac808 | |
| 0x77176dd1 ntdll.dll:RtlAllocateHeap+0x20e1|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176dd5 ntdll.dll:RtlAllocateHeap+0x20e5|je 0x77176e12|eflags=0x206 | |
| 0x77176dd7 ntdll.dll:RtlAllocateHeap+0x20e7|xor edx, dword ptr [edi + 0x50]|edx=0x261ac808|edi=0x820000 | |
| 0x77176dda ntdll.dll:RtlAllocateHeap+0x20ea|mov dword ptr [ebp - 0x24], edx|ebp=0x19f8e0|edx=0x2000002 | |
| 0x77176ddd ntdll.dll:RtlAllocateHeap+0x20ed|mov dword ptr [ebp - 0x158], edx|ebp=0x19f8e0|edx=0x2000002 | |
| 0x77176de3 ntdll.dll:RtlAllocateHeap+0x20f3|mov ecx, edx|edx=0x2000002 | |
| 0x77176de5 ntdll.dll:RtlAllocateHeap+0x20f5|shr ecx, 0x10|ecx=0x2000002 | |
| 0x77176de8 ntdll.dll:RtlAllocateHeap+0x20f8|mov eax, edx|edx=0x2000002 | |
| 0x77176dea ntdll.dll:RtlAllocateHeap+0x20fa|shr eax, 8|eax=0x2000002 | |
| 0x77176ded ntdll.dll:RtlAllocateHeap+0x20fd|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176def ntdll.dll:RtlAllocateHeap+0x20ff|xor cl, dl|cl=0x0|dl=0x2 | |
| 0x77176df1 ntdll.dll:RtlAllocateHeap+0x2101|mov eax, edx|edx=0x2000002 | |
| 0x77176df3 ntdll.dll:RtlAllocateHeap+0x2103|shr eax, 0x18|eax=0x2000002 | |
| 0x77176df6 ntdll.dll:RtlAllocateHeap+0x2106|cmp al, cl|al=0x2|cl=0x2 | |
| 0x77176df8 ntdll.dll:RtlAllocateHeap+0x2108|je 0x77176e12|eflags=0x246 | |
| 0x77176e12 ntdll.dll:RtlAllocateHeap+0x2122|movzx eax, dx|dx=0x2 | |
| 0x77176e15 ntdll.dll:RtlAllocateHeap+0x2125|mov ecx, dword ptr [ebp - 0x28]|ebp=0x19f8e0 | |
| 0x77176e18 ntdll.dll:RtlAllocateHeap+0x2128|sub ecx, eax|ecx=0x37d|eax=0x2 | |
| 0x77176e1a ntdll.dll:RtlAllocateHeap+0x212a|mov dword ptr [ebp - 0x104], ecx|ebp=0x19f8e0|ecx=0x37b | |
| 0x77176e20 ntdll.dll:RtlAllocateHeap+0x2130|test ecx, ecx|ecx=0x37b | |
| 0x77176e22 ntdll.dll:RtlAllocateHeap+0x2132|jle 0x77176e2c|eflags=0x206 | |
| 0x77176e24 ntdll.dll:RtlAllocateHeap+0x2134|mov ecx, dword ptr [ebp - 0x34]|ebp=0x19f8e0 | |
| 0x77176e27 ntdll.dll:RtlAllocateHeap+0x2137|jmp 0x77176ff7 | |
| 0x77176ff7 ntdll.dll:RtlAllocateHeap+0x2307|test ecx, ecx|ecx=0x8200c0 | |
| 0x77176ff9 ntdll.dll:RtlAllocateHeap+0x2309|je 0x77177006|eflags=0x206 | |
| 0x77176ffb ntdll.dll:RtlAllocateHeap+0x230b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77177001 ntdll.dll:RtlAllocateHeap+0x2311|jmp 0x7717701f | |
| 0x7717701f ntdll.dll:RtlAllocateHeap+0x232f|mov esi, dword ptr [ebp - 0x28]|ebp=0x19f8e0 | |
| 0x77177022 ntdll.dll:RtlAllocateHeap+0x2332|cmp eax, ecx|eax=0x8200c0|ecx=0x8200c0 | |
| 0x77177024 ntdll.dll:RtlAllocateHeap+0x2334|je 0x7717705b|eflags=0x246 | |
| 0x7717705b ntdll.dll:RtlAllocateHeap+0x236b|lea eax, [ebx + 8]|ebx=0x82b3f8 | |
| 0x7717705e ntdll.dll:RtlAllocateHeap+0x236e|mov edx, dword ptr [ecx + 4]|ecx=0x8200c0 | |
| 0x77177061 ntdll.dll:RtlAllocateHeap+0x2371|mov esi, dword ptr [edx]|edx=0x8266e8 | |
| 0x77177063 ntdll.dll:RtlAllocateHeap+0x2373|cmp esi, ecx|esi=0x8200c0|ecx=0x8200c0 | |
| 0x77177065 ntdll.dll:RtlAllocateHeap+0x2375|jne 0x77177073|eflags=0x246 | |
| 0x77177067 ntdll.dll:RtlAllocateHeap+0x2377|mov dword ptr [eax], ecx|eax=0x82b400|ecx=0x8200c0 | |
| 0x77177069 ntdll.dll:RtlAllocateHeap+0x2379|mov dword ptr [eax + 4], edx|eax=0x82b400|edx=0x8266e8 | |
| 0x7717706c ntdll.dll:RtlAllocateHeap+0x237c|mov dword ptr [edx], eax|edx=0x8266e8|eax=0x82b400 | |
| 0x7717706e ntdll.dll:RtlAllocateHeap+0x237e|mov dword ptr [ecx + 4], eax|ecx=0x8200c0|eax=0x82b400 | |
| 0x77177071 ntdll.dll:RtlAllocateHeap+0x2381|jmp 0x77177083 | |
| 0x77177083 ntdll.dll:RtlAllocateHeap+0x2393|movzx eax, word ptr [ebx]|ebx=0x82b3f8 | |
| 0x77177086 ntdll.dll:RtlAllocateHeap+0x2396|add dword ptr [edi + 0x74], eax|edi=0x820000|eax=0x37d | |
| 0x77177089 ntdll.dll:RtlAllocateHeap+0x2399|mov ecx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717708f ntdll.dll:RtlAllocateHeap+0x239f|mov dword ptr [ebp - 0x34], ecx|ebp=0x19f8e0|ecx=0x820270 | |
| 0x77177092 ntdll.dll:RtlAllocateHeap+0x23a2|test ecx, ecx|ecx=0x820270 | |
| 0x77177094 ntdll.dll:RtlAllocateHeap+0x23a4|je 0x77177196|eflags=0x202 | |
| 0x7717709a ntdll.dll:RtlAllocateHeap+0x23aa|movzx eax, word ptr [ebx]|ebx=0x82b3f8 | |
| 0x7717709d ntdll.dll:RtlAllocateHeap+0x23ad|mov dword ptr [ebp - 0x7c], eax|ebp=0x19f8e0|eax=0x37d | |
| 0x771770a0 ntdll.dll:RtlAllocateHeap+0x23b0|mov esi, dword ptr [ecx + 4]|ecx=0x820270 | |
| 0x771770a3 ntdll.dll:RtlAllocateHeap+0x23b3|cmp eax, esi|eax=0x37d|esi=0x80 | |
| 0x771770a5 ntdll.dll:RtlAllocateHeap+0x23b5|jae 0x771770b1|eflags=0x202 | |
| 0x771770b1 ntdll.dll:RtlAllocateHeap+0x23c1|mov edx, dword ptr [ecx]|ecx=0x820270 | |
| 0x771770b3 ntdll.dll:RtlAllocateHeap+0x23c3|test edx, edx|edx=0x822b00 | |
| 0x771770b5 ntdll.dll:RtlAllocateHeap+0x23c5|jne 0x771771b5|eflags=0x206 | |
| 0x771771b5 ntdll.dll:RtlAllocateHeap+0x24c5|mov ecx, edx|edx=0x822b00 | |
| 0x771771b7 ntdll.dll:RtlAllocateHeap+0x24c7|mov dword ptr [ebp - 0x34], ecx|ebp=0x19f8e0|ecx=0x822b00 | |
| 0x771771ba ntdll.dll:RtlAllocateHeap+0x24ca|jmp 0x771770a0 | |
| 0x771770a0 ntdll.dll:RtlAllocateHeap+0x23b0|mov esi, dword ptr [ecx + 4]|ecx=0x822b00 | |
| 0x771770a3 ntdll.dll:RtlAllocateHeap+0x23b3|cmp eax, esi|eax=0x37d|esi=0x800 | |
| 0x771770a5 ntdll.dll:RtlAllocateHeap+0x23b5|jae 0x771770b1|eflags=0x287 | |
| 0x771770a7 ntdll.dll:RtlAllocateHeap+0x23b7|mov edx, eax|eax=0x37d | |
| 0x771770a9 ntdll.dll:RtlAllocateHeap+0x23b9|lea eax, [esi - 1]|esi=0x800 | |
| 0x771770ac ntdll.dll:RtlAllocateHeap+0x23bc|mov dword ptr [ebp - 0x54], eax|ebp=0x19f8e0|eax=0x7ff | |
| 0x771770af ntdll.dll:RtlAllocateHeap+0x23bf|jmp 0x771770c1 | |
| 0x771770c1 ntdll.dll:RtlAllocateHeap+0x23d1|mov esi, edx|edx=0x37d | |
| 0x771770c3 ntdll.dll:RtlAllocateHeap+0x23d3|sub esi, dword ptr [ecx + 0x14]|esi=0x37d|ecx=0x822b00 | |
| 0x771770c6 ntdll.dll:RtlAllocateHeap+0x23d6|mov dword ptr [ebp - 0x3c], esi|ebp=0x19f8e0|esi=0x2fd | |
| 0x771770c9 ntdll.dll:RtlAllocateHeap+0x23d9|cmp dword ptr [ecx + 8], 0|ecx=0x822b00 | |
| 0x771770cd ntdll.dll:RtlAllocateHeap+0x23dd|lea eax, [esi + esi]|esi=0x2fd | |
| 0x771770d0 ntdll.dll:RtlAllocateHeap+0x23e0|jne 0x771770d4|eflags=0x246 | |
| 0x771770d2 ntdll.dll:RtlAllocateHeap+0x23e2|mov eax, esi|esi=0x2fd | |
| 0x771770d4 ntdll.dll:RtlAllocateHeap+0x23e4|inc dword ptr [ecx + 0xc]|ecx=0x822b00 | |
| 0x771770d7 ntdll.dll:RtlAllocateHeap+0x23e7|shl eax, 2|eax=0x2fd | |
| 0x771770da ntdll.dll:RtlAllocateHeap+0x23ea|mov dword ptr [ebp - 0x8c], eax|ebp=0x19f8e0|eax=0xbf4 | |
| 0x771770e0 ntdll.dll:RtlAllocateHeap+0x23f0|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771770e3 ntdll.dll:RtlAllocateHeap+0x23f3|mov esi, dword ptr [ebp - 0x8c]|ebp=0x19f8e0 | |
| 0x771770e9 ntdll.dll:RtlAllocateHeap+0x23f9|mov eax, dword ptr [esi + eax]|esi=0xbf4|eax=0x822c14 | |
| 0x771770ec ntdll.dll:RtlAllocateHeap+0x23fc|mov dword ptr [ebp - 0x84], eax|ebp=0x19f8e0|eax=0x0 | |
| 0x771770f2 ntdll.dll:RtlAllocateHeap+0x2402|cmp edx, dword ptr [ebp - 0x54]|edx=0x37d|ebp=0x19f8e0 | |
| 0x771770f5 ntdll.dll:RtlAllocateHeap+0x2405|mov esi, dword ptr [ebp - 0x3c]|ebp=0x19f8e0 | |
| 0x771770f8 ntdll.dll:RtlAllocateHeap+0x2408|jne 0x771770fd|eflags=0x297 | |
| 0x771770fd ntdll.dll:RtlAllocateHeap+0x240d|test eax, eax|eax=0x0 | |
| 0x771770ff ntdll.dll:RtlAllocateHeap+0x240f|je 0x77177165|eflags=0x246 | |
| 0x77177165 ntdll.dll:RtlAllocateHeap+0x2475|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x77177168 ntdll.dll:RtlAllocateHeap+0x2478|lea ecx, [ebx + 8]|ebx=0x82b3f8 | |
| 0x7717716b ntdll.dll:RtlAllocateHeap+0x247b|mov edx, dword ptr [ebp - 0x8c]|ebp=0x19f8e0 | |
| 0x77177171 ntdll.dll:RtlAllocateHeap+0x2481|mov dword ptr [edx + eax], ecx|edx=0xbf4|eax=0x822c14|ecx=0x82b400 | |
| 0x77177174 ntdll.dll:RtlAllocateHeap+0x2484|cmp dword ptr [ebp - 0x84], 0|ebp=0x19f8e0 | |
| 0x7717717b ntdll.dll:RtlAllocateHeap+0x248b|jne 0x77177196|eflags=0x246 | |
| 0x7717717d ntdll.dll:RtlAllocateHeap+0x248d|shr esi, 5|esi=0x2fd | |
| 0x77177180 ntdll.dll:RtlAllocateHeap+0x2490|mov ecx, dword ptr [ebp - 0x3c]|ebp=0x19f8e0 | |
| 0x77177183 ntdll.dll:RtlAllocateHeap+0x2493|and ecx, 0x1f|ecx=0x2fd | |
| 0x77177186 ntdll.dll:RtlAllocateHeap+0x2496|mov edx, 1 | |
| 0x7717718b ntdll.dll:RtlAllocateHeap+0x249b|shl edx, cl|edx=0x1|cl=0x1d | |
| 0x7717718d ntdll.dll:RtlAllocateHeap+0x249d|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f8e0 | |
| 0x77177190 ntdll.dll:RtlAllocateHeap+0x24a0|mov eax, dword ptr [eax + 0x1c]|eax=0x822b00 | |
| 0x77177193 ntdll.dll:RtlAllocateHeap+0x24a3|or dword ptr [eax + esi*4], edx|eax=0x822b24|esi=0x17|edx=0x20000000 | |
| 0x77177196 ntdll.dll:RtlAllocateHeap+0x24a6|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717719a ntdll.dll:RtlAllocateHeap+0x24aa|je 0x77177637|eflags=0x206 | |
| 0x771771a0 ntdll.dll:RtlAllocateHeap+0x24b0|mov al, byte ptr [ebx + 2]|ebx=0x82b3f8 | |
| 0x771771a3 ntdll.dll:RtlAllocateHeap+0x24b3|xor al, byte ptr [ebx + 1]|al=0x0|ebx=0x82b3f8 | |
| 0x771771a6 ntdll.dll:RtlAllocateHeap+0x24b6|xor al, byte ptr [ebx]|al=0x3|ebx=0x82b3f8 | |
| 0x771771a8 ntdll.dll:RtlAllocateHeap+0x24b8|mov byte ptr [ebx + 3], al|ebx=0x82b3f8|al=0x7e | |
| 0x771771ab ntdll.dll:RtlAllocateHeap+0x24bb|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x771771ae ntdll.dll:RtlAllocateHeap+0x24be|xor dword ptr [ebx], eax|ebx=0x82b3f8|eax=0x241ac80a | |
| 0x771771b0 ntdll.dll:RtlAllocateHeap+0x24c0|jmp 0x77177637 | |
| 0x77177637 ntdll.dll:RtlAllocateHeap+0x2947|mov byte ptr [ebp - 0x7f], 1|ebp=0x19f8e0 | |
| 0x7717763b ntdll.dll:RtlAllocateHeap+0x294b|mov byte ptr [ebp - 0x43], 0|ebp=0x19f8e0 | |
| 0x7717763f ntdll.dll:RtlAllocateHeap+0x294f|jmp 0x77176b47 | |
| 0x77176b47 ntdll.dll:RtlAllocateHeap+0x1e57|mov ecx, dword ptr [ebp - 0x6c]|ebp=0x19f8e0 | |
| 0x77176b4a ntdll.dll:RtlAllocateHeap+0x1e5a|lea ebx, [ecx + 8]|ecx=0x82a3f0 | |
| 0x77176b4d ntdll.dll:RtlAllocateHeap+0x1e5d|mov dword ptr [ebp - 0x5c], ebx|ebp=0x19f8e0|ebx=0x82a3f8 | |
| 0x77176b50 ntdll.dll:RtlAllocateHeap+0x1e60|movzx eax, word ptr [ecx]|ecx=0x82a3f0 | |
| 0x77176b53 ntdll.dll:RtlAllocateHeap+0x1e63|lea esi, [eax*8]|eax=0x201 | |
| 0x77176b5a ntdll.dll:RtlAllocateHeap+0x1e6a|mov dword ptr [ebp - 0xb0], esi|ebp=0x19f8e0|esi=0x1008 | |
| 0x77176b60 ntdll.dll:RtlAllocateHeap+0x1e70|lea edx, [ecx + 7]|ecx=0x82a3f0 | |
| 0x77176b63 ntdll.dll:RtlAllocateHeap+0x1e73|mov dword ptr [ebp - 0x54], edx|ebp=0x19f8e0|edx=0x82a3f7 | |
| 0x77176b66 ntdll.dll:RtlAllocateHeap+0x1e76|mov ecx, esi|esi=0x1008 | |
| 0x77176b68 ntdll.dll:RtlAllocateHeap+0x1e78|mov al, byte ptr [edx]|edx=0x82a3f7 | |
| 0x77176b6a ntdll.dll:RtlAllocateHeap+0x1e7a|and al, 0x3f|al=0x8 | |
| 0x77176b6c ntdll.dll:RtlAllocateHeap+0x1e7c|cmp al, 0x3f|al=0x8 | |
| 0x77176b6e ntdll.dll:RtlAllocateHeap+0x1e7e|jne 0x77176b7b|eflags=0x297 | |
| 0x77176b7b ntdll.dll:RtlAllocateHeap+0x1e8b|cmp dword ptr [ebp - 0x64], 0|ebp=0x19f8e0 | |
| 0x77176b7f ntdll.dll:RtlAllocateHeap+0x1e8f|je 0x771776a1|eflags=0x202 | |
| 0x77176b85 ntdll.dll:RtlAllocateHeap+0x1e95|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176b89 ntdll.dll:RtlAllocateHeap+0x1e99|je 0x77176b9e|eflags=0x206 | |
| 0x77176b8b ntdll.dll:RtlAllocateHeap+0x1e9b|mov ecx, dword ptr [ebp - 0x6c]|ebp=0x19f8e0 | |
| 0x77176b8e ntdll.dll:RtlAllocateHeap+0x1e9e|mov al, byte ptr [ecx + 2]|ecx=0x82a3f0 | |
| 0x77176b91 ntdll.dll:RtlAllocateHeap+0x1ea1|xor al, byte ptr [ecx + 1]|al=0x1|ecx=0x82a3f0 | |
| 0x77176b94 ntdll.dll:RtlAllocateHeap+0x1ea4|xor al, byte ptr [ecx]|al=0x3|ecx=0x82a3f0 | |
| 0x77176b96 ntdll.dll:RtlAllocateHeap+0x1ea6|mov byte ptr [ecx + 3], al|ecx=0x82a3f0|al=0x2 | |
| 0x77176b99 ntdll.dll:RtlAllocateHeap+0x1ea9|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77176b9c ntdll.dll:RtlAllocateHeap+0x1eac|xor dword ptr [ecx], eax|ecx=0x82a3f0|eax=0x241ac80a | |
| 0x77176b9e ntdll.dll:RtlAllocateHeap+0x1eae|cmp byte ptr [ebp - 0x29], 0|ebp=0x19f8e0 | |
| 0x77176ba2 ntdll.dll:RtlAllocateHeap+0x1eb2|je 0x77176c5f|eflags=0x202 | |
| 0x77176ba8 ntdll.dll:RtlAllocateHeap+0x1eb8|test dword ptr [edi + 0x44], 0x1000000|edi=0x820000 | |
| 0x77176baf ntdll.dll:RtlAllocateHeap+0x1ebf|jne 0x77176c50|eflags=0x246 | |
| 0x77176bb5 ntdll.dll:RtlAllocateHeap+0x1ec5|inc dword ptr [edi + 0x22c]|edi=0x820000 | |
| 0x77176bbb ntdll.dll:RtlAllocateHeap+0x1ecb|mov edx, dword ptr [edi + 0x234]|edi=0x820000 | |
| 0x77176bc1 ntdll.dll:RtlAllocateHeap+0x1ed1|cmp dword ptr [edi + 0x22c], edx|edi=0x820000|edx=0x1 | |
| 0x77176bc7 ntdll.dll:RtlAllocateHeap+0x1ed7|jbe 0x77176bf5|eflags=0x246 | |
| 0x77176bf5 ntdll.dll:RtlAllocateHeap+0x1f05|inc dword ptr [edi + 0x238]|edi=0x820000 | |
| 0x77176bfb ntdll.dll:RtlAllocateHeap+0x1f0b|cmp dword ptr [edi + 0x238], 0x1000|edi=0x820000 | |
| 0x77176c05 ntdll.dll:RtlAllocateHeap+0x1f15|jb 0x77176c50|eflags=0x287 | |
| 0x77176c50 ntdll.dll:RtlAllocateHeap+0x1f60|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19f760 | |
| 0x77176c56 ntdll.dll:RtlAllocateHeap+0x1f66|call 0x77177b20|esp=0x19f75c|eip=0x77176c56 | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19f8e0|esp=0x19f758 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19f754 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19f754 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x82a3f8|esp=0x19f74c | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19f754 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x1008|esp=0x19f748 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x820000|esp=0x19f744 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x820258 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x820258 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x820258 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0x82a3f0 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x82025c|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x82025c|esp=0x19f740 | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19f744 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x820258|esp=0x19f748 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19f754 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19f754|esp=0x19f754 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19f758 | |
| 0x77176c5b ntdll.dll:RtlAllocateHeap+0x1f6b|mov byte ptr [ebp - 0x29], 0|ebp=0x19f8e0 | |
| 0x77176c5f ntdll.dll:RtlAllocateHeap+0x1f6f|test byte ptr [ebp - 0x68], 8|ebp=0x19f8e0 | |
| 0x77176c63 ntdll.dll:RtlAllocateHeap+0x1f73|je 0x77177a7e|eflags=0x246 | |
| 0x77177a7e ntdll.dll:RtlAllocateHeap+0x2d8e|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19f8e0 | |
| 0x77177a85 ntdll.dll:RtlAllocateHeap+0x2d95|call 0x77177aa9|esp=0x19f760|eip=0x77177a85 | |
| 0x77177aa9 ntdll.dll:RtlAllocateHeap+0x2db9|cmp byte ptr [ebp - 0x29], 0|ebp=0x19f8e0 | |
| 0x77177aad ntdll.dll:RtlAllocateHeap+0x2dbd|je 0x77177acd|eflags=0x246 | |
| 0x77177acd ntdll.dll:RtlAllocateHeap+0x2ddd|ret|esp=0x19f75c | |
| 0x77177a8a ntdll.dll:RtlAllocateHeap+0x2d9a|call 0x77177ce0|esp=0x19f760|eip=0x77177a8a | |
| 0x77177ce0 ntdll.dll:RtlGetCurrentServiceSessionId|mov eax, dword ptr fs:[0x30] | |
| 0x77177ce6 ntdll.dll:RtlGetCurrentServiceSessionId+0x6|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77177ce9 ntdll.dll:RtlGetCurrentServiceSessionId+0x9|test eax, eax|eax=0x0 | |
| 0x77177ceb ntdll.dll:RtlGetCurrentServiceSessionId+0xb|jne 0x77177cee|eflags=0x246 | |
| 0x77177ced ntdll.dll:RtlGetCurrentServiceSessionId+0xd|ret|esp=0x19f75c | |
| 0x77177a8f ntdll.dll:RtlAllocateHeap+0x2d9f|test eax, eax|eax=0x0 | |
| 0x77177a91 ntdll.dll:RtlAllocateHeap+0x2da1|je 0x77177ace|eflags=0x246 | |
| 0x77177ace ntdll.dll:RtlAllocateHeap+0x2dde|mov eax, 0x7ffe0388 | |
| 0x77177ad3 ntdll.dll:RtlAllocateHeap+0x2de3|cmp byte ptr [eax], 0|eax=0x7ffe0388 | |
| 0x77177ad6 ntdll.dll:RtlAllocateHeap+0x2de6|je 0x77177af7|eflags=0x246 | |
| 0x77177af7 ntdll.dll:RtlAllocateHeap+0x2e07|mov eax, dword ptr [ebp - 0x5c]|ebp=0x19f8e0 | |
| 0x77177afa ntdll.dll:RtlAllocateHeap+0x2e0a|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f8e0 | |
| 0x77177afd ntdll.dll:RtlAllocateHeap+0x2e0d|mov dword ptr fs:[0], ecx|ecx=0x19fe58 | |
| 0x77177b04 ntdll.dll:RtlAllocateHeap+0x2e14|pop ecx|ecx=0x19fe58|esp=0x19f760 | |
| 0x77177b05 ntdll.dll:RtlAllocateHeap+0x2e15|pop edi|edi=0x820000|esp=0x19f764 | |
| 0x77177b06 ntdll.dll:RtlAllocateHeap+0x2e16|pop esi|esi=0x1008|esp=0x19f768 | |
| 0x77177b07 ntdll.dll:RtlAllocateHeap+0x2e17|pop ebx|ebx=0x82a3f8|esp=0x19f76c | |
| 0x77177b08 ntdll.dll:RtlAllocateHeap+0x2e18|mov esp, ebp|ebp=0x19f8e0 | |
| 0x77177b0a ntdll.dll:RtlAllocateHeap+0x2e1a|pop ebp|ebp=0x19f8e0|esp=0x19f8e0 | |
| 0x77177b0b ntdll.dll:RtlAllocateHeap+0x2e1b|ret 0x10|esp=0x19f8e4 | |
| 0x77175d0f ntdll.dll:RtlAllocateHeap+0x101f|mov edi, eax|eax=0x82a3f8 | |
| 0x77175d11 ntdll.dll:RtlAllocateHeap+0x1021|test edi, edi|edi=0x82a3f8 | |
| 0x77175d13 ntdll.dll:RtlAllocateHeap+0x1023|je 0x77175d5a|eflags=0x202 | |
| 0x77175d15 ntdll.dll:RtlAllocateHeap+0x1025|mov ecx, dword ptr [ebp - 0x14]|ebp=0x19f970 | |
| 0x77175d18 ntdll.dll:RtlAllocateHeap+0x1028|mov edx, dword ptr [ebp - 0x48]|ebp=0x19f970 | |
| 0x77175d1b ntdll.dll:RtlAllocateHeap+0x102b|test edx, edx|edx=0x0 | |
| 0x77175d1d ntdll.dll:RtlAllocateHeap+0x102d|je 0x77175d97|eflags=0x246 | |
| 0x77175d97 ntdll.dll:RtlAllocateHeap+0x10a7|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f970 | |
| 0x77175d9a ntdll.dll:RtlAllocateHeap+0x10aa|mov eax, dword ptr fs:[0x30] | |
| 0x77175da0 ntdll.dll:RtlAllocateHeap+0x10b0|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77175da3 ntdll.dll:RtlAllocateHeap+0x10b3|test eax, eax|eax=0x0 | |
| 0x77175da5 ntdll.dll:RtlAllocateHeap+0x10b5|je 0x77175dbc|eflags=0x246 | |
| 0x77175dbc ntdll.dll:RtlAllocateHeap+0x10cc|mov eax, 0x7ffe0380 | |
| 0x77175dc1 ntdll.dll:RtlAllocateHeap+0x10d1|cmp byte ptr [eax], 0|eax=0x7ffe0380 | |
| 0x77175dc4 ntdll.dll:RtlAllocateHeap+0x10d4|je 0x77175e5c|eflags=0x246 | |
| 0x77175e5c ntdll.dll:RtlAllocateHeap+0x116c|mov eax, dword ptr [0x77259694] | |
| 0x77175e61 ntdll.dll:RtlAllocateHeap+0x1171|test al, 1|al=0x0 | |
| 0x77175e63 ntdll.dll:RtlAllocateHeap+0x1173|je 0x77175ea0|eflags=0x246 | |
| 0x77175ea0 ntdll.dll:RtlAllocateHeap+0x11b0|mov eax, edi|edi=0x82a3f8 | |
| 0x77175ea2 ntdll.dll:RtlAllocateHeap+0x11b2|pop edi|edi=0x82a3f8|esp=0x19f8f8 | |
| 0x77175ea3 ntdll.dll:RtlAllocateHeap+0x11b3|pop esi|esi=0x1008|esp=0x19f8fc | |
| 0x77175ea4 ntdll.dll:RtlAllocateHeap+0x11b4|pop ebx|ebx=0x820000|esp=0x19f900 | |
| 0x77175ea5 ntdll.dll:RtlAllocateHeap+0x11b5|mov esp, ebp|ebp=0x19f970 | |
| 0x77175ea7 ntdll.dll:RtlAllocateHeap+0x11b7|pop ebp|ebp=0x19f970|esp=0x19f970 | |
| 0x77175ea8 ntdll.dll:RtlAllocateHeap+0x11b8|ret 8|esp=0x19f974 | |
| 0x77174d2e ntdll.dll:RtlAllocateHeap+0x3e|pop esi|esi=0x820000|esp=0x19f980 | |
| 0x77174d2f ntdll.dll:RtlAllocateHeap+0x3f|mov esp, ebp|ebp=0x19f988 | |
| 0x77174d31 ntdll.dll:RtlAllocateHeap+0x41|pop ebp|ebp=0x19f988|esp=0x19f988 | |
| 0x77174d32 ntdll.dll:RtlAllocateHeap+0x42|ret 0xc|esp=0x19f98c | |
| 0x40aebc handletest_x86.exe|test eax, eax|eax=0x82a3f8 | |
| 0x40aebe handletest_x86.exe|je 0x40ae99|eflags=0x202 | |
| 0x40aec0 handletest_x86.exe|jmp 0x40aecf | |
| 0x40aecf handletest_x86.exe|pop esi|esi=0x1000|esp=0x19f99c | |
| 0x40aed0 handletest_x86.exe|pop ebp|ebp=0x19f9a0|esp=0x19f9a0 | |
| 0x40aed1 handletest_x86.exe|ret|esp=0x19f9a4 | |
| 0x40c12f handletest_x86.exe|push 0|esp=0x19f9a8 | |
| 0x40c131 handletest_x86.exe|mov dword ptr [edi], eax|edi=0x41f294|eax=0x82a3f8 | |
| 0x40c133 handletest_x86.exe|call 0x40a413|esp=0x19f9a4|eip=0x40c133 | |
| 0x40a413 handletest_x86.exe|mov edi, edi|edi=0x41f294 | |
| 0x40a415 handletest_x86.exe|push ebp|ebp=0x19f9b8|esp=0x19f9a0 | |
| 0x40a416 handletest_x86.exe|mov ebp, esp|esp=0x19f99c | |
| 0x40a418 handletest_x86.exe|cmp dword ptr [ebp + 8], 0|ebp=0x19f99c | |
| 0x40a41c handletest_x86.exe|je 0x40a44b|eflags=0x246 | |
| 0x40a44b handletest_x86.exe|pop ebp|ebp=0x19f99c|esp=0x19f99c | |
| 0x40a44c handletest_x86.exe|ret|esp=0x19f9a0 | |
| 0x40c138 handletest_x86.exe|mov eax, dword ptr [edi]|edi=0x41f294 | |
| 0x40c13a handletest_x86.exe|pop ecx|ecx=0x0|esp=0x19f9a4 | |
| 0x40c13b handletest_x86.exe|pop ecx|ecx=0x0|esp=0x19f9a8 | |
| 0x40c13c handletest_x86.exe|test eax, eax|eax=0x82a3f8 | |
| 0x40c13e handletest_x86.exe|jne 0x40c152|eflags=0x202 | |
| 0x40c152 handletest_x86.exe|mov dword ptr [esi + 4], eax|esi=0x41e078|eax=0x82a3f8 | |
| 0x40c155 handletest_x86.exe|mov eax, dword ptr [edi]|edi=0x41f294 | |
| 0x40c157 handletest_x86.exe|mov dword ptr [esi], eax|esi=0x41e078|eax=0x82a3f8 | |
| 0x40c159 handletest_x86.exe|mov dword ptr [esi + 8], 0x1000|esi=0x41e078 | |
| 0x40c160 handletest_x86.exe|mov dword ptr [esi + 0x18], 0x1000|esi=0x41e078 | |
| 0x40c167 handletest_x86.exe|jmp 0x40c14e | |
| 0x40c14e handletest_x86.exe|mov al, 1 | |
| 0x40c150 handletest_x86.exe|jmp 0x40c16b | |
| 0x40c16b handletest_x86.exe|pop edi|edi=0x41f294|esp=0x19f9ac | |
| 0x40c16c handletest_x86.exe|pop esi|esi=0x41e078|esp=0x19f9b0 | |
| 0x40c16d handletest_x86.exe|pop ebx|ebx=0x2|esp=0x19f9b4 | |
| 0x40c16e handletest_x86.exe|pop ebp|ebp=0x19f9b8|esp=0x19f9b8 | |
| 0x40c16f handletest_x86.exe|ret|esp=0x19f9bc | |
| 0x405c1c handletest_x86.exe|mov byte ptr [ebp - 0x464], al|ebp=0x19fe34|al=0x1 | |
| 0x405c22 handletest_x86.exe|mov eax, dword ptr [esi]|esi=0x19fea8 | |
| 0x405c24 handletest_x86.exe|pop ecx|ecx=0x1000|esp=0x19f9c0 | |
| 0x405c25 handletest_x86.exe|lea ecx, [ebp - 0x45c]|ebp=0x19fe34 | |
| 0x405c2b handletest_x86.exe|mov eax, dword ptr [eax]|eax=0x19fed4 | |
| 0x405c2d handletest_x86.exe|mov dword ptr [ebp - 0x460], eax|ebp=0x19fe34|eax=0x41e078 | |
| 0x405c33 handletest_x86.exe|mov eax, dword ptr [esi + 0x10]|esi=0x19fea8 | |
| 0x405c36 handletest_x86.exe|push dword ptr [eax]|eax=0x19fecc|esp=0x19f9c4 | |
| 0x405c38 handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19fea8 | |
| 0x405c3b handletest_x86.exe|push dword ptr [esi + 4]|esi=0x19fea8|esp=0x19f9c0 | |
| 0x405c3e handletest_x86.exe|push dword ptr [eax]|eax=0x19fed0|esp=0x19f9bc | |
| 0x405c40 handletest_x86.exe|mov eax, dword ptr [esi + 8]|esi=0x19fea8 | |
| 0x405c43 handletest_x86.exe|push dword ptr [eax + 4]|eax=0x19febc|esp=0x19f9b8 | |
| 0x405c46 handletest_x86.exe|push dword ptr [eax]|eax=0x19febc|esp=0x19f9b4 | |
| 0x405c48 handletest_x86.exe|lea eax, [ebp - 0x460]|ebp=0x19fe34 | |
| 0x405c4e handletest_x86.exe|push eax|eax=0x19f9d4|esp=0x19f9b0 | |
| 0x405c4f handletest_x86.exe|call 0x405b50|esp=0x19f9ac|eip=0x405c4f | |
| 0x405b50 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x405b52 handletest_x86.exe|push ebp|ebp=0x19fe34|esp=0x19f9a8 | |
| 0x405b53 handletest_x86.exe|mov ebp, esp|esp=0x19f9a4 | |
| 0x405b55 handletest_x86.exe|mov eax, dword ptr [ebp + 0x18]|ebp=0x19f9a4 | |
| 0x405b58 handletest_x86.exe|mov edx, ecx|ecx=0x19f9d8 | |
| 0x405b5a handletest_x86.exe|xor ecx, ecx|ecx=0x19f9d8 | |
| 0x405b5c handletest_x86.exe|mov dword ptr [edx + 8], eax|edx=0x19f9d8|eax=0x19fe80 | |
| 0x405b5f handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f9a4 | |
| 0x405b62 handletest_x86.exe|mov dword ptr [edx], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b64 handletest_x86.exe|mov dword ptr [edx + 4], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b67 handletest_x86.exe|mov dword ptr [edx + 0xc], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b6a handletest_x86.exe|mov dword ptr [edx + 0x10], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b6d handletest_x86.exe|mov dword ptr [edx + 0x43c], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b73 handletest_x86.exe|mov dword ptr [edx + 0x440], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b79 handletest_x86.exe|mov dword ptr [edx + 0x14], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b7c handletest_x86.exe|mov byte ptr [edx + 0x18], cl|edx=0x19f9d8|cl=0x0 | |
| 0x405b7f handletest_x86.exe|mov dword ptr [edx + 0x1c], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b82 handletest_x86.exe|mov dword ptr [edx + 0x20], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b85 handletest_x86.exe|mov dword ptr [edx + 0x24], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b88 handletest_x86.exe|mov word ptr [edx + 0x2c], cx|edx=0x19f9d8|cx=0x0 | |
| 0x405b8c handletest_x86.exe|mov dword ptr [edx + 0x34], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405b8f handletest_x86.exe|mov byte ptr [edx + 0x38], cl|edx=0x19f9d8|cl=0x0 | |
| 0x405b92 handletest_x86.exe|mov eax, dword ptr [eax]|eax=0x19f9d4 | |
| 0x405b94 handletest_x86.exe|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19f9a4 | |
| 0x405b97 handletest_x86.exe|mov dword ptr [edx + 0x448], eax|edx=0x19f9d8|eax=0x41e078 | |
| 0x405b9d handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f9a4 | |
| 0x405ba0 handletest_x86.exe|mov dword ptr [edx], eax|edx=0x19f9d8|eax=0x24 | |
| 0x405ba2 handletest_x86.exe|mov eax, dword ptr [ebp + 0x14]|ebp=0x19f9a4 | |
| 0x405ba5 handletest_x86.exe|mov dword ptr [edx + 0xc], eax|edx=0x19f9d8|eax=0x41e9bc | |
| 0x405ba8 handletest_x86.exe|mov eax, dword ptr [ebp + 0x1c]|ebp=0x19f9a4 | |
| 0x405bab handletest_x86.exe|mov dword ptr [edx + 0x10], eax|edx=0x19f9d8|eax=0x19ff28 | |
| 0x405bae handletest_x86.exe|mov eax, edx|edx=0x19f9d8 | |
| 0x405bb0 handletest_x86.exe|mov dword ptr [edx + 4], ecx|edx=0x19f9d8|ecx=0x0 | |
| 0x405bb3 handletest_x86.exe|pop ebp|ebp=0x19f9a4|esp=0x19f9a4 | |
| 0x405bb4 handletest_x86.exe|ret 0x18|esp=0x19f9a8 | |
| 0x405c54 handletest_x86.exe|and dword ptr [ebp - 0xc], 0|ebp=0x19fe34 | |
| 0x405c58 handletest_x86.exe|lea ecx, [ebp - 0x45c]|ebp=0x19fe34 | |
| 0x405c5e handletest_x86.exe|call 0x405e00|esp=0x19f9c4|eip=0x405c5e | |
| 0x405e00 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x405e02 handletest_x86.exe|push ebp|ebp=0x19fe34|esp=0x19f9c0 | |
| 0x405e03 handletest_x86.exe|mov ebp, esp|esp=0x19f9bc | |
| 0x405e05 handletest_x86.exe|sub esp, 0xc|esp=0x19f9bc | |
| 0x405e08 handletest_x86.exe|push ebx|ebx=0x41e078|esp=0x19f9b0 | |
| 0x405e09 handletest_x86.exe|push esi|esi=0x19fea8|esp=0x19f9ac | |
| 0x405e0a handletest_x86.exe|mov esi, ecx|ecx=0x19f9d8 | |
| 0x405e0c handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19f9a8 | |
| 0x405e0d handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405e10 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405e16 handletest_x86.exe|call 0x4069e6|esp=0x19f9a0|eip=0x405e16 | |
| 0x4069e6 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x4069e8 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f99c | |
| 0x4069e9 handletest_x86.exe|mov ebp, esp|esp=0x19f998 | |
| 0x4069eb handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x4069ed handletest_x86.exe|test eax, eax|eax=0x41e078 | |
| 0x4069ef handletest_x86.exe|jne 0x406a13|eflags=0x206 | |
| 0x406a13 handletest_x86.exe|push eax|eax=0x41e078|esp=0x19f998 | |
| 0x406a14 handletest_x86.exe|call 0x406a1e|esp=0x19f994|eip=0x406a14 | |
| 0x406a1e handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406a20 handletest_x86.exe|push ebp|ebp=0x19f998|esp=0x19f990 | |
| 0x406a21 handletest_x86.exe|mov ebp, esp|esp=0x19f98c | |
| 0x406a23 handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19f98c | |
| 0x406a26 handletest_x86.exe|push esi|esi=0x19f9d8|esp=0x19f98c | |
| 0x406a27 handletest_x86.exe|mov eax, dword ptr [ecx + 0xc]|ecx=0x41e078 | |
| 0x406a2a handletest_x86.exe|nop | |
| 0x406a2b handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406a2e handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406a30 handletest_x86.exe|jne 0x406aa0|eflags=0x246 | |
| 0x406a32 handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19f988 | |
| 0x406a33 handletest_x86.exe|push ecx|ecx=0x41e078|esp=0x19f984 | |
| 0x406a34 handletest_x86.exe|call 0x4087bb|esp=0x19f980|eip=0x406a34 | |
| 0x4087bb handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x4087bd handletest_x86.exe|push ebp|ebp=0x19f98c|esp=0x19f97c | |
| 0x4087be handletest_x86.exe|mov ebp, esp|esp=0x19f978 | |
| 0x4087c0 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f978 | |
| 0x4087c3 handletest_x86.exe|test eax, eax|eax=0x41e078 | |
| 0x4087c5 handletest_x86.exe|jne 0x4087dc|eflags=0x206 | |
| 0x4087dc handletest_x86.exe|mov eax, dword ptr [eax + 0x10]|eax=0x41e078 | |
| 0x4087df handletest_x86.exe|nop | |
| 0x4087e0 handletest_x86.exe|pop ebp|ebp=0x19f978|esp=0x19f978 | |
| 0x4087e1 handletest_x86.exe|ret|esp=0x19f97c | |
| 0x406a39 handletest_x86.exe|pop ecx|ecx=0x41e078|esp=0x19f980 | |
| 0x406a3a handletest_x86.exe|mov ecx, 0x41e2c0 | |
| 0x406a3f handletest_x86.exe|cmp eax, -1|eax=0x1 | |
| 0x406a42 handletest_x86.exe|je 0x406a5f|eflags=0x213 | |
| 0x406a44 handletest_x86.exe|cmp eax, -2|eax=0x1 | |
| 0x406a47 handletest_x86.exe|je 0x406a5f|eflags=0x217 | |
| 0x406a49 handletest_x86.exe|mov esi, eax|eax=0x1 | |
| 0x406a4b handletest_x86.exe|mov edx, eax|eax=0x1 | |
| 0x406a4d handletest_x86.exe|and esi, 0x3f|esi=0x1 | |
| 0x406a50 handletest_x86.exe|sar edx, 6|edx=0x1 | |
| 0x406a53 handletest_x86.exe|imul edi, esi, 0x38|edi=0x19fe80|esi=0x1 | |
| 0x406a56 handletest_x86.exe|add edi, dword ptr [edx*4 + 0x41efa8]|edi=0x38|edx=0x0 | |
| 0x406a5d handletest_x86.exe|jmp 0x406a6b | |
| 0x406a6b handletest_x86.exe|cmp byte ptr [edi + 0x29], 0|edi=0x827f10 | |
| 0x406a6f handletest_x86.exe|pop edi|edi=0x827f10|esp=0x19f984 | |
| 0x406a70 handletest_x86.exe|jne 0x406a8c|eflags=0x246 | |
| 0x406a72 handletest_x86.exe|cmp eax, -1|eax=0x1 | |
| 0x406a75 handletest_x86.exe|je 0x406a86|eflags=0x213 | |
| 0x406a77 handletest_x86.exe|cmp eax, -2|eax=0x1 | |
| 0x406a7a handletest_x86.exe|je 0x406a86|eflags=0x217 | |
| 0x406a7c handletest_x86.exe|imul ecx, esi, 0x38|ecx=0x41e2c0|esi=0x1 | |
| 0x406a7f handletest_x86.exe|add ecx, dword ptr [edx*4 + 0x41efa8]|ecx=0x38|edx=0x0 | |
| 0x406a86 handletest_x86.exe|test byte ptr [ecx + 0x2d], 1|ecx=0x827f10 | |
| 0x406a8a handletest_x86.exe|je 0x406aa0|eflags=0x246 | |
| 0x406aa0 handletest_x86.exe|mov al, 1 | |
| 0x406aa2 handletest_x86.exe|pop esi|esi=0x1|esp=0x19f988 | |
| 0x406aa3 handletest_x86.exe|pop ebp|ebp=0x19f98c|esp=0x19f98c | |
| 0x406aa4 handletest_x86.exe|ret|esp=0x19f990 | |
| 0x406a19 handletest_x86.exe|pop ecx|ecx=0x827f10|esp=0x19f994 | |
| 0x406a1a handletest_x86.exe|pop ebp|ebp=0x19f998|esp=0x19f998 | |
| 0x406a1b handletest_x86.exe|ret 4|esp=0x19f99c | |
| 0x405e1b handletest_x86.exe|test al, al|al=0x1 | |
| 0x405e1d handletest_x86.exe|je 0x405e4c|eflags=0x202 | |
| 0x405e1f handletest_x86.exe|cmp dword ptr [esi + 0xc], 0|esi=0x19f9d8 | |
| 0x405e23 handletest_x86.exe|jne 0x406016|eflags=0x202 | |
| 0x406016 handletest_x86.exe|inc dword ptr [esi + 0x450]|esi=0x19f9d8 | |
| 0x40601c handletest_x86.exe|cmp dword ptr [esi + 0x450], 2|esi=0x19f9d8 | |
| 0x406023 handletest_x86.exe|jne 0x405e54|eflags=0x297 | |
| 0x405e54 handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405e57 handletest_x86.exe|and dword ptr [esi + 0x34], 0|esi=0x19f9d8 | |
| 0x405e5b handletest_x86.exe|mov byte ptr [esi + 0x18], 0|esi=0x19f9d8 | |
| 0x405e5f handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9bc | |
| 0x405e61 handletest_x86.exe|inc eax|eax=0x41e9bc | |
| 0x405e62 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9bd | |
| 0x405e65 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x43 | |
| 0x405e68 handletest_x86.exe|test bl, bl|bl=0x43 | |
| 0x405e6a handletest_x86.exe|je 0x406016|eflags=0x202 | |
| 0x405e70 handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x43 | |
| 0x405e73 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405e76 handletest_x86.exe|mov bh, bl|bl=0x43 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x246 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f943 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x23 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f923|cl=0x43 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x43 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x23 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x23 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x43 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x43 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x43|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x43 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x43 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x44 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x43 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x81|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x43|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x216 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3f8|cl=0x43 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x43 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x43 | |
| 0x406afa handletest_x86.exe|setne al|al=0x43|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9bd | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9bd | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9be | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x6f | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x6f | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x6f | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x6f | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f96f | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x4f | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x287 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f94f|cl=0x6f | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x6f | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x4f | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x4f | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x6f | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x6f | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x6f|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x6f | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x6f | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x70 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x6f | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x6f|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3f9|cl=0x6f | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x6f | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x6f | |
| 0x406afa handletest_x86.exe|setne al|al=0x6f|eflags=0x203 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9be | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9be | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9bf | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x6e | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x6e | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x6e | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x6e | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f96e | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x4e | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x283 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f94e|cl=0x6e | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x6e | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x4e | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x4e | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x6e | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x6e | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x6e|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x6e | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x6e | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x6f | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x6e | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x6e|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3fa|cl=0x6e | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x6e | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x6e | |
| 0x406afa handletest_x86.exe|setne al|al=0x6e|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9bf | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9bf | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c0 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x73 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x73 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x73 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x73 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f973 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x53 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f953|cl=0x73 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x73 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x53 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x53 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x73 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x73 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x73|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x73 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x73 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x74 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x73 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x73|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3fb|cl=0x73 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x73 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x73 | |
| 0x406afa handletest_x86.exe|setne al|al=0x73|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c0 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c0 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c1 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x6f | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x6f | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x6f | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x6f | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f96f | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x4f | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x287 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f94f|cl=0x6f | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x6f | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x4f | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x4f | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x6f | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x6f | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x6f|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x6f | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x6f | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x70 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x6f | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x6f|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3fc|cl=0x6f | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x6f | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x6f | |
| 0x406afa handletest_x86.exe|setne al|al=0x6f|eflags=0x203 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c1 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c1 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c2 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x6c | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x6c | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x6c | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x6c | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f96c | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x4c | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x283 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f94c|cl=0x6c | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x6c | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x4c | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x4c | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x7 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x7 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x38 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x38 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x6c | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x6c | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x6c|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x6c | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x6c | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x6d | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x6c | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x6c|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3fd|cl=0x6c | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x6c | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x6c | |
| 0x406afa handletest_x86.exe|setne al|al=0x6c|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c2 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c2 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c3 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x65 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x65 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x65 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x65 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f965 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x45 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f945|cl=0x65 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x65 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x45 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x45 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x65 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x65 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x65|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x65 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x65 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x66 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x65 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x82|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x65|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3fe|cl=0x65 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x65 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x65 | |
| 0x406afa handletest_x86.exe|setne al|al=0x65|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c3 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c3 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c4 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x20 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x20 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x20 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x20 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f920 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x0 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f900|cl=0x20 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x20 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x0 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x0 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x6 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x6 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x30 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x30 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x20 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x20 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x20|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x20 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x20 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x21 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x20 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x48|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x20|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a3ff|cl=0x20 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x20 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x20 | |
| 0x406afa handletest_x86.exe|setne al|al=0x20|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c4 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c4 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c5 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x6f | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x6f | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x6f | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x6f | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f96f | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x4f | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x287 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f94f|cl=0x6f | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x6f | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x4f | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x4f | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x6f | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x6f | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x6f|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x6f | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x6f | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x70 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x6f | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x6f|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a400|cl=0x6f | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x6f | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x6f | |
| 0x406afa handletest_x86.exe|setne al|al=0x6f|eflags=0x203 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c5 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c5 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c6 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x75 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x75 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x75 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x75 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f975 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x55 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x293 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f955|cl=0x75 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x75 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x55 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x55 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x75 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x75 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x75|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x75 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x75 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x76 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x75 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x75|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a401|cl=0x75 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x75 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x75 | |
| 0x406afa handletest_x86.exe|setne al|al=0x75|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c6 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c6 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c7 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x74 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x74 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x74 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f974 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x54 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f954|cl=0x74 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x74 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x54 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x54 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x7 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x7 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x38 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x38 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x74 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x74|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x74 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x74 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x75 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x74 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x74|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a402|cl=0x74 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x74 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x74 | |
| 0x406afa handletest_x86.exe|setne al|al=0x74|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c7 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c7 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c8 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x70 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x70 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x70 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x70 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f970 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x50 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f950|cl=0x70 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x70 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x50 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x50 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x70 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x70 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x70|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x70 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x70 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x71 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x70 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x70|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a403|cl=0x70 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x70 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x70 | |
| 0x406afa handletest_x86.exe|setne al|al=0x70|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c8 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c8 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9c9 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x75 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x75 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x75 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x75 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f975 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x55 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x293 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f955|cl=0x75 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x75 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x55 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x55 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x75 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x75 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x75|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x75 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x75 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x76 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x75 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x75|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a404|cl=0x75 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x75 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x75 | |
| 0x406afa handletest_x86.exe|setne al|al=0x75|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9c9 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9c9 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9ca | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x74 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x74 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x74 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f974 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x54 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f954|cl=0x74 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x74 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x54 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x54 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x7 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x7 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x38 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x38 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x74 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x74|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x74 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x74 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x75 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x74 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x74|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a405|cl=0x74 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x74 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x74 | |
| 0x406afa handletest_x86.exe|setne al|al=0x74|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9ca | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9ca | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9cb | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x20 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x20 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x20 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x20 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f920 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x0 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f900|cl=0x20 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x20 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x0 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x0 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x6 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x6 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x30 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x30 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x20 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x20 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x20|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x20 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x20 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x21 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x20 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x48|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x20|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a406|cl=0x20 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x20 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x20 | |
| 0x406afa handletest_x86.exe|setne al|al=0x20|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9cb | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9cb | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9cc | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x74 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x74 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x74 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f974 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x54 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f954|cl=0x74 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x74 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x54 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x54 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x7 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x7 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x38 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x38 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x74 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x74|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x74 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x74 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x75 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x74 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x74|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a407|cl=0x74 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x74 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x74 | |
| 0x406afa handletest_x86.exe|setne al|al=0x74|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9cc | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9cc | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9cd | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x65 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x65 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x65 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x65 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f965 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x45 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f945|cl=0x65 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x65 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x45 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x45 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x65 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x65 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x65|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x65 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x65 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x66 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x65 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x82|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x65|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x212 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a408|cl=0x65 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x65 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x65 | |
| 0x406afa handletest_x86.exe|setne al|al=0x65|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9cd | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9cd | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9ce | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x73 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x73 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x73 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x73 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x202 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f973 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x53 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f953|cl=0x73 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x73 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x53 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x53 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x8 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x8 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x40 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x40 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x73 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x73 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x73|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x73 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x73 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x74 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x287 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x73 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x73|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a409|cl=0x73 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x73 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x73 | |
| 0x406afa handletest_x86.exe|setne al|al=0x73|eflags=0x217 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9ce | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9ce | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9cf | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x74 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x74 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x74 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x206 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f974 | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0x54 | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x297 | |
| 0x405d00 handletest_x86.exe|movsx eax, cl|eax=0x19f954|cl=0x74 | |
| 0x405d03 handletest_x86.exe|sub eax, 0x20|eax=0x74 | |
| 0x405d06 handletest_x86.exe|and eax, 0x7f|eax=0x54 | |
| 0x405d09 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c89]|eax=0x54 | |
| 0x405d10 handletest_x86.exe|jmp 0x405d14 | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x7 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x7 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x38 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x38 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0x74 | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0x74 | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0x74|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0x74 | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0x74 | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0x75 | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0x74 | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x2|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0x74|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x206 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a40a|cl=0x74 | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0x74 | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0x74 | |
| 0x406afa handletest_x86.exe|setne al|al=0x74|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9cf | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9cf | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9d0 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0xa | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0xa | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0xa | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0xa | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x206 | |
| 0x405e78 handletest_x86.exe|cmp dword ptr [eax], 0|eax=0x19f9ec | |
| 0x405e7b handletest_x86.exe|jl 0x406016|eflags=0x202 | |
| 0x405e81 handletest_x86.exe|movzx eax, byte ptr [esi + 0x18]|esi=0x19f9d8 | |
| 0x405e85 handletest_x86.exe|mov ecx, esi|esi=0x19f9d8 | |
| 0x405e87 handletest_x86.exe|push eax|eax=0x0|esp=0x19f9a4 | |
| 0x405e88 handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f9bc|esp=0x19f9a0 | |
| 0x405e8b handletest_x86.exe|call 0x405cf1|esp=0x19f99c|eip=0x405e8b | |
| 0x405cf1 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x405cf3 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f998 | |
| 0x405cf4 handletest_x86.exe|mov ebp, esp|esp=0x19f994 | |
| 0x405cf6 handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f994 | |
| 0x405cf9 handletest_x86.exe|lea eax, [ecx - 0x20]|ecx=0x19f90a | |
| 0x405cfc handletest_x86.exe|cmp al, 0x5a|al=0xea | |
| 0x405cfe handletest_x86.exe|ja 0x405d12|eflags=0x286 | |
| 0x405d12 handletest_x86.exe|xor al, al|al=0xea | |
| 0x405d14 handletest_x86.exe|movzx ecx, al|al=0x0 | |
| 0x405d17 handletest_x86.exe|movzx eax, byte ptr [ebp + 0xc]|ebp=0x19f994 | |
| 0x405d1b handletest_x86.exe|lea eax, [eax + ecx*8]|eax=0x0|ecx=0x0 | |
| 0x405d1e handletest_x86.exe|and eax, 0x7f|eax=0x0 | |
| 0x405d21 handletest_x86.exe|mov al, byte ptr [eax*2 + 0x417c88]|eax=0x0 | |
| 0x405d28 handletest_x86.exe|pop ebp|ebp=0x19f994|esp=0x19f994 | |
| 0x405d29 handletest_x86.exe|ret 8|esp=0x19f998 | |
| 0x405e90 handletest_x86.exe|mov byte ptr [esi + 0x18], al|esi=0x19f9d8|al=0x0 | |
| 0x405e93 handletest_x86.exe|cmp al, 8|al=0x0 | |
| 0x405e95 handletest_x86.exe|jae 0x40606c|eflags=0x293 | |
| 0x405e9b handletest_x86.exe|movzx eax, al|al=0x0 | |
| 0x405e9e handletest_x86.exe|cmp eax, 7|eax=0x0 | |
| 0x405ea1 handletest_x86.exe|ja 0x405e4c|eflags=0x297 | |
| 0x405ea3 handletest_x86.exe|jmp dword ptr [eax*4 + 0x40608c]|eax=0x0 | |
| 0x405eaa handletest_x86.exe|mov edi, dword ptr [esi + 8]|esi=0x19f9d8 | |
| 0x405ead handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x405eaf handletest_x86.exe|mov byte ptr [esi + 0x38], al|esi=0x19f9d8|al=0x0 | |
| 0x405eb2 handletest_x86.exe|mov byte ptr [ebp - 4], bl|ebp=0x19f9bc|bl=0xa | |
| 0x405eb5 handletest_x86.exe|cmp byte ptr [edi + 0x14], al|edi=0x19fe80|al=0x0 | |
| 0x405eb8 handletest_x86.exe|jne 0x405ec9|eflags=0x202 | |
| 0x405ec9 handletest_x86.exe|push 0x8000|esp=0x19f9a4 | |
| 0x405ece handletest_x86.exe|movsx eax, bl|eax=0x0|bl=0xa | |
| 0x405ed1 handletest_x86.exe|push eax|eax=0xa|esp=0x19f9a0 | |
| 0x405ed2 handletest_x86.exe|mov eax, dword ptr [edi + 0xc]|edi=0x19fe80 | |
| 0x405ed5 handletest_x86.exe|mov byte ptr [ebp - 8], bh|ebp=0x19f9bc|bh=0xa | |
| 0x405ed8 handletest_x86.exe|push dword ptr [eax]|eax=0x41e0f8|esp=0x19f99c | |
| 0x405eda handletest_x86.exe|call 0x406bac|esp=0x19f998|eip=0x405eda | |
| 0x406bac handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x406bae handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406baf handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406bb1 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406bb4 handletest_x86.exe|lea eax, [ecx + 1]|ecx=0xa | |
| 0x406bb7 handletest_x86.exe|cmp eax, 0x100|eax=0xb | |
| 0x406bbc handletest_x86.exe|ja 0x406bca|eflags=0x283 | |
| 0x406bbe handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f990 | |
| 0x406bc1 handletest_x86.exe|movzx eax, word ptr [eax + ecx*2]|eax=0x418c60|ecx=0xa | |
| 0x406bc5 handletest_x86.exe|and eax, dword ptr [ebp + 0x10]|eax=0x28|ebp=0x19f990 | |
| 0x406bc8 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406bc9 handletest_x86.exe|ret|esp=0x19f994 | |
| 0x405edf handletest_x86.exe|add esp, 0xc|esp=0x19f998 | |
| 0x405ee2 handletest_x86.exe|lea edi, [esi + 0x14]|esi=0x19f9d8 | |
| 0x405ee5 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x405ee7 handletest_x86.exe|je 0x405f12|eflags=0x246 | |
| 0x405f12 handletest_x86.exe|push dword ptr [esi + 8]|esi=0x19f9d8|esp=0x19f9a4 | |
| 0x405f15 handletest_x86.exe|lea ecx, [esi + 0x448]|esi=0x19f9d8 | |
| 0x405f1b handletest_x86.exe|push edi|edi=0x19f9ec|esp=0x19f9a0 | |
| 0x405f1c handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f9bc|esp=0x19f99c | |
| 0x405f1f handletest_x86.exe|call 0x406aa5|esp=0x19f998|eip=0x405f1f | |
| 0x406aa5 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406aa7 handletest_x86.exe|push ebp|ebp=0x19f9bc|esp=0x19f994 | |
| 0x406aa8 handletest_x86.exe|mov ebp, esp|esp=0x19f990 | |
| 0x406aaa handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f990|esp=0x19f990 | |
| 0x406aad handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19f990|esp=0x19f98c | |
| 0x406ab0 handletest_x86.exe|call 0x406ac7|esp=0x19f988|eip=0x406ab0 | |
| 0x406ac7 handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x406ac9 handletest_x86.exe|push ebp|ebp=0x19f990|esp=0x19f984 | |
| 0x406aca handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x406acc handletest_x86.exe|mov eax, dword ptr [ecx]|ecx=0x19fe20 | |
| 0x406ace handletest_x86.exe|mov eax, dword ptr [eax + 0xc]|eax=0x41e078 | |
| 0x406ad1 handletest_x86.exe|nop | |
| 0x406ad2 handletest_x86.exe|shr eax, 0xc|eax=0x2282 | |
| 0x406ad5 handletest_x86.exe|test al, 1|al=0x2 | |
| 0x406ad7 handletest_x86.exe|je 0x406ae5|eflags=0x246 | |
| 0x406ae5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f980|esp=0x19f980 | |
| 0x406ae8 handletest_x86.exe|movsx eax, byte ptr [ebp + 8]|eax=0x2|ebp=0x19f980 | |
| 0x406aec handletest_x86.exe|push dword ptr [ecx]|ecx=0x19fe20|esp=0x19f97c | |
| 0x406aee handletest_x86.exe|push eax|eax=0xa|esp=0x19f978 | |
| 0x406aef handletest_x86.exe|call 0x40c05c|esp=0x19f974|eip=0x406aef | |
| 0x40c05c handletest_x86.exe|mov edi, edi|edi=0x19f9ec | |
| 0x40c05e handletest_x86.exe|push ebp|ebp=0x19f980|esp=0x19f970 | |
| 0x40c05f handletest_x86.exe|mov ebp, esp|esp=0x19f96c | |
| 0x40c061 handletest_x86.exe|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f96c | |
| 0x40c064 handletest_x86.exe|sub dword ptr [edx + 8], 1|edx=0x41e078 | |
| 0x40c068 handletest_x86.exe|jns 0x40c07b|eflags=0x202 | |
| 0x40c07b handletest_x86.exe|mov eax, dword ptr [edx]|edx=0x41e078 | |
| 0x40c07d handletest_x86.exe|mov cl, byte ptr [ebp + 8]|ebp=0x19f96c | |
| 0x40c080 handletest_x86.exe|mov byte ptr [eax], cl|eax=0x82a40b|cl=0xa | |
| 0x40c082 handletest_x86.exe|inc dword ptr [edx]|edx=0x41e078 | |
| 0x40c084 handletest_x86.exe|movzx eax, cl|cl=0xa | |
| 0x40c087 handletest_x86.exe|pop ebp|ebp=0x19f96c|esp=0x19f96c | |
| 0x40c088 handletest_x86.exe|ret|esp=0x19f970 | |
| 0x406af4 handletest_x86.exe|add esp, 0xc|esp=0x19f974 | |
| 0x406af7 handletest_x86.exe|cmp eax, -1|eax=0xa | |
| 0x406afa handletest_x86.exe|setne al|al=0xa|eflags=0x213 | |
| 0x406afd handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x406afe handletest_x86.exe|ret 8|esp=0x19f984 | |
| 0x406ab5 handletest_x86.exe|test al, al|al=0x1 | |
| 0x406ab7 handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f990 | |
| 0x406aba handletest_x86.exe|je 0x406ac0|eflags=0x202 | |
| 0x406abc handletest_x86.exe|inc dword ptr [eax]|eax=0x19f9ec | |
| 0x406abe handletest_x86.exe|jmp 0x406ac3 | |
| 0x406ac3 handletest_x86.exe|pop ebp|ebp=0x19f990|esp=0x19f990 | |
| 0x406ac4 handletest_x86.exe|ret 0xc|esp=0x19f994 | |
| 0x405f24 handletest_x86.exe|jmp 0x405ffa | |
| 0x405ffa handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19f9d8 | |
| 0x405ffd handletest_x86.exe|mov bl, byte ptr [eax]|eax=0x41e9d0 | |
| 0x405fff handletest_x86.exe|inc eax|eax=0x41e9d0 | |
| 0x406000 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19f9d8|eax=0x41e9d1 | |
| 0x406003 handletest_x86.exe|mov bh, bl|bl=0x0 | |
| 0x406005 handletest_x86.exe|mov byte ptr [esi + 0x2d], bl|esi=0x19f9d8|bl=0x0 | |
| 0x406008 handletest_x86.exe|lea eax, [esi + 0x14]|esi=0x19f9d8 | |
| 0x40600b handletest_x86.exe|mov byte ptr [ebp - 0xc], bl|ebp=0x19f9bc|bl=0x0 | |
| 0x40600e handletest_x86.exe|test bl, bl|bl=0x0 | |
| 0x406010 handletest_x86.exe|jne 0x405e78|eflags=0x246 | |
| 0x406016 handletest_x86.exe|inc dword ptr [esi + 0x450]|esi=0x19f9d8 | |
| 0x40601c handletest_x86.exe|cmp dword ptr [esi + 0x450], 2|esi=0x19f9d8 | |
| 0x406023 handletest_x86.exe|jne 0x405e54|eflags=0x246 | |
| 0x406029 handletest_x86.exe|mov eax, dword ptr [esi + 0x14]|esi=0x19f9d8 | |
| 0x40602c handletest_x86.exe|jmp 0x405e4f | |
| 0x405e4f handletest_x86.exe|pop edi|edi=0x19f9ec|esp=0x19f9a4 | |
| 0x405e50 handletest_x86.exe|pop esi|esi=0x19f9d8|esp=0x19f9a8 | |
| 0x405e51 handletest_x86.exe|pop ebx|ebx=0x410000|esp=0x19f9ac | |
| 0x405e52 handletest_x86.exe|leave|ebp=0x19f9bc|esp=0x19f9b0 | |
| 0x405e53 handletest_x86.exe|ret|esp=0x19f9c0 | |
| 0x405c63 handletest_x86.exe|lea ecx, [ebp - 0x420]|ebp=0x19fe34 | |
| 0x405c69 handletest_x86.exe|mov esi, eax|eax=0x14 | |
| 0x405c6b handletest_x86.exe|call 0x405bb7|esp=0x19f9c4|eip=0x405c6b | |
| 0x405bb7 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x405bb9 handletest_x86.exe|push esi|esi=0x14|esp=0x19f9c0 | |
| 0x405bba handletest_x86.exe|mov esi, ecx|ecx=0x19fa14 | |
| 0x405bbc handletest_x86.exe|push dword ptr [esi + 0x404]|esi=0x19fa14|esp=0x19f9bc | |
| 0x405bc2 handletest_x86.exe|call 0x40a413|esp=0x19f9b8|eip=0x405bc2 | |
| 0x40a413 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40a415 handletest_x86.exe|push ebp|ebp=0x19fe34|esp=0x19f9b4 | |
| 0x40a416 handletest_x86.exe|mov ebp, esp|esp=0x19f9b0 | |
| 0x40a418 handletest_x86.exe|cmp dword ptr [ebp + 8], 0|ebp=0x19f9b0 | |
| 0x40a41c handletest_x86.exe|je 0x40a44b|eflags=0x246 | |
| 0x40a44b handletest_x86.exe|pop ebp|ebp=0x19f9b0|esp=0x19f9b0 | |
| 0x40a44c handletest_x86.exe|ret|esp=0x19f9b4 | |
| 0x405bc7 handletest_x86.exe|and dword ptr [esi + 0x404], 0|esi=0x19fa14 | |
| 0x405bce handletest_x86.exe|pop ecx|ecx=0x19fa14|esp=0x19f9b8 | |
| 0x405bcf handletest_x86.exe|pop esi|esi=0x19fa14|esp=0x19f9bc | |
| 0x405bd0 handletest_x86.exe|ret|esp=0x19f9c0 | |
| 0x405c70 handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19f9c4 | |
| 0x405c71 handletest_x86.exe|push ebx|ebx=0x41e078|esp=0x19f9c0 | |
| 0x405c72 handletest_x86.exe|push dword ptr [ebp - 0x464]|ebp=0x19fe34|esp=0x19f9bc | |
| 0x405c78 handletest_x86.exe|call 0x40c170|esp=0x19f9b8|eip=0x405c78 | |
| 0x40c170 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40c172 handletest_x86.exe|push ebp|ebp=0x19fe34|esp=0x19f9b4 | |
| 0x40c173 handletest_x86.exe|mov ebp, esp|esp=0x19f9b0 | |
| 0x40c175 handletest_x86.exe|cmp byte ptr [ebp + 8], 0|ebp=0x19f9b0 | |
| 0x40c179 handletest_x86.exe|je 0x40c1ac|eflags=0x202 | |
| 0x40c17b handletest_x86.exe|push esi|esi=0x14|esp=0x19f9b0 | |
| 0x40c17c handletest_x86.exe|mov esi, dword ptr [ebp + 0xc]|ebp=0x19f9b0 | |
| 0x40c17f handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19f9ac | |
| 0x40c180 handletest_x86.exe|lea edi, [esi + 0xc]|esi=0x41e078 | |
| 0x40c183 handletest_x86.exe|mov eax, dword ptr [edi]|edi=0x41e084 | |
| 0x40c185 handletest_x86.exe|nop | |
| 0x40c186 handletest_x86.exe|shr eax, 9|eax=0x2282 | |
| 0x40c189 handletest_x86.exe|test al, 1|al=0x11 | |
| 0x40c18b handletest_x86.exe|je 0x40c1aa|eflags=0x202 | |
| 0x40c18d handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f9b0|esp=0x19f9a8 | |
| 0x40c190 handletest_x86.exe|push esi|esi=0x41e078|esp=0x19f9a4 | |
| 0x40c191 handletest_x86.exe|call 0x40ab69|esp=0x19f9a0|eip=0x40c191 | |
| 0x40ab69 handletest_x86.exe|mov edi, edi|edi=0x41e084 | |
| 0x40ab6b handletest_x86.exe|push ebp|ebp=0x19f9b0|esp=0x19f99c | |
| 0x40ab6c handletest_x86.exe|mov ebp, esp|esp=0x19f998 | |
| 0x40ab6e handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19f998 | |
| 0x40ab71 handletest_x86.exe|push ebx|ebx=0x41e078|esp=0x19f998 | |
| 0x40ab72 handletest_x86.exe|push esi|esi=0x41e078|esp=0x19f994 | |
| 0x40ab73 handletest_x86.exe|push edi|edi=0x41e084|esp=0x19f990 | |
| 0x40ab74 handletest_x86.exe|lea esi, [ecx + 0xc]|ecx=0x41e078 | |
| 0x40ab77 handletest_x86.exe|mov edx, dword ptr [esi]|esi=0x41e084 | |
| 0x40ab79 handletest_x86.exe|nop | |
| 0x40ab7a handletest_x86.exe|mov eax, edx|edx=0x2282 | |
| 0x40ab7c handletest_x86.exe|and al, 3|al=0x82 | |
| 0x40ab7e handletest_x86.exe|cmp al, 2|al=0x2 | |
| 0x40ab80 handletest_x86.exe|jne 0x40abcb|eflags=0x246 | |
| 0x40ab82 handletest_x86.exe|test dl, 0xc0|dl=0x82 | |
| 0x40ab85 handletest_x86.exe|je 0x40abcb|eflags=0x282 | |
| 0x40ab87 handletest_x86.exe|mov edi, dword ptr [ecx]|ecx=0x41e078 | |
| 0x40ab89 handletest_x86.exe|mov ebx, dword ptr [ecx + 4]|ecx=0x41e078 | |
| 0x40ab8c handletest_x86.exe|sub edi, ebx|edi=0x82a40c|ebx=0x82a3f8 | |
| 0x40ab8e handletest_x86.exe|mov dword ptr [ecx], ebx|ecx=0x41e078|ebx=0x82a3f8 | |
| 0x40ab90 handletest_x86.exe|and dword ptr [ecx + 8], 0|ecx=0x41e078 | |
| 0x40ab94 handletest_x86.exe|test edi, edi|edi=0x14 | |
| 0x40ab96 handletest_x86.exe|jle 0x40abcb|eflags=0x206 | |
| 0x40ab98 handletest_x86.exe|push ecx|ecx=0x41e078|esp=0x19f98c | |
| 0x40ab99 handletest_x86.exe|call 0x4087bb|esp=0x19f988|eip=0x40ab99 | |
| 0x4087bb handletest_x86.exe|mov edi, edi|edi=0x14 | |
| 0x4087bd handletest_x86.exe|push ebp|ebp=0x19f998|esp=0x19f984 | |
| 0x4087be handletest_x86.exe|mov ebp, esp|esp=0x19f980 | |
| 0x4087c0 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f980 | |
| 0x4087c3 handletest_x86.exe|test eax, eax|eax=0x41e078 | |
| 0x4087c5 handletest_x86.exe|jne 0x4087dc|eflags=0x206 | |
| 0x4087dc handletest_x86.exe|mov eax, dword ptr [eax + 0x10]|eax=0x41e078 | |
| 0x4087df handletest_x86.exe|nop | |
| 0x4087e0 handletest_x86.exe|pop ebp|ebp=0x19f980|esp=0x19f980 | |
| 0x4087e1 handletest_x86.exe|ret|esp=0x19f984 | |
| 0x40ab9e handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f998|esp=0x19f988 | |
| 0x40aba1 handletest_x86.exe|push edi|edi=0x14|esp=0x19f984 | |
| 0x40aba2 handletest_x86.exe|push ebx|ebx=0x82a3f8|esp=0x19f980 | |
| 0x40aba3 handletest_x86.exe|push eax|eax=0x1|esp=0x19f97c | |
| 0x40aba4 handletest_x86.exe|call 0x410688|esp=0x19f978|eip=0x40aba4 | |
| 0x410688 handletest_x86.exe|push 0x10|esp=0x19f974 | |
| 0x41068a handletest_x86.exe|push 0x41d560|esp=0x19f970 | |
| 0x41068f handletest_x86.exe|call 0x401d60|esp=0x19f96c|eip=0x41068f | |
| 0x401d60 handletest_x86.exe|push 0x401fd0|esp=0x19f968 | |
| 0x401d65 handletest_x86.exe|push dword ptr fs:[0]|esp=0x19f964 | |
| 0x401d6c handletest_x86.exe|mov eax, dword ptr [esp + 0x10]|esp=0x19f960 | |
| 0x401d70 handletest_x86.exe|mov dword ptr [esp + 0x10], ebp|esp=0x19f960|ebp=0x19f998 | |
| 0x401d74 handletest_x86.exe|lea ebp, [esp + 0x10]|esp=0x19f960 | |
| 0x401d78 handletest_x86.exe|sub esp, eax|esp=0x19f960|eax=0x10 | |
| 0x401d7a handletest_x86.exe|push ebx|ebx=0x82a3f8|esp=0x19f950 | |
| 0x401d7b handletest_x86.exe|push esi|esi=0x41e084|esp=0x19f94c | |
| 0x401d7c handletest_x86.exe|push edi|edi=0x14|esp=0x19f948 | |
| 0x401d7d handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x401d82 handletest_x86.exe|xor dword ptr [ebp - 4], eax|ebp=0x19f970|eax=0x666841b4 | |
| 0x401d85 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19f970 | |
| 0x401d87 handletest_x86.exe|push eax|eax=0x6671b8c4|esp=0x19f944 | |
| 0x401d88 handletest_x86.exe|mov dword ptr [ebp - 0x18], esp|ebp=0x19f970|esp=0x19f940 | |
| 0x401d8b handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f970|esp=0x19f940 | |
| 0x401d8e handletest_x86.exe|mov eax, dword ptr [ebp - 4]|ebp=0x19f970 | |
| 0x401d91 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19f970 | |
| 0x401d98 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19f970|eax=0x662994d4 | |
| 0x401d9b handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19f970 | |
| 0x401d9e handletest_x86.exe|mov dword ptr fs:[0], eax|eax=0x19f960 | |
| 0x401da4 handletest_x86.exe|ret|esp=0x19f93c | |
| 0x410694 handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19f970 | |
| 0x410697 handletest_x86.exe|cmp esi, -2|esi=0x1 | |
| 0x41069a handletest_x86.exe|jne 0x4106b7|eflags=0x217 | |
| 0x4106b7 handletest_x86.exe|test esi, esi|esi=0x1 | |
| 0x4106b9 handletest_x86.exe|js 0x410758|eflags=0x202 | |
| 0x4106bf handletest_x86.exe|cmp esi, dword ptr [0x41f1a8]|esi=0x1 | |
| 0x4106c5 handletest_x86.exe|jae 0x410758|eflags=0x283 | |
| 0x4106cb handletest_x86.exe|mov ebx, esi|esi=0x1 | |
| 0x4106cd handletest_x86.exe|shr ebx, 6|ebx=0x1 | |
| 0x4106d0 handletest_x86.exe|mov eax, esi|esi=0x1 | |
| 0x4106d2 handletest_x86.exe|and eax, 0x3f|eax=0x1 | |
| 0x4106d5 handletest_x86.exe|imul ecx, eax, 0x38|ecx=0x41e078|eax=0x1 | |
| 0x4106d8 handletest_x86.exe|mov dword ptr [ebp - 0x20], ecx|ebp=0x19f970|ecx=0x38 | |
| 0x4106db handletest_x86.exe|mov eax, dword ptr [ebx*4 + 0x41efa8]|ebx=0x0 | |
| 0x4106e2 handletest_x86.exe|test byte ptr [ecx + eax + 0x28], 1|ecx=0x38|eax=0x827ed8 | |
| 0x4106e7 handletest_x86.exe|je 0x410758|eflags=0x202 | |
| 0x4106e9 handletest_x86.exe|push esi|esi=0x1|esp=0x19f940 | |
| 0x4106ea handletest_x86.exe|call 0x40dd99|esp=0x19f93c|eip=0x4106ea | |
| 0x40dd99 handletest_x86.exe|mov edi, edi|edi=0x14 | |
| 0x40dd9b handletest_x86.exe|push ebp|ebp=0x19f970|esp=0x19f938 | |
| 0x40dd9c handletest_x86.exe|mov ebp, esp|esp=0x19f934 | |
| 0x40dd9e handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f934 | |
| 0x40dda1 handletest_x86.exe|mov ecx, eax|eax=0x1 | |
| 0x40dda3 handletest_x86.exe|and eax, 0x3f|eax=0x1 | |
| 0x40dda6 handletest_x86.exe|sar ecx, 6|ecx=0x1 | |
| 0x40dda9 handletest_x86.exe|imul eax, eax, 0x38|eax=0x1 | |
| 0x40ddac handletest_x86.exe|add eax, dword ptr [ecx*4 + 0x41efa8]|eax=0x38|ecx=0x0 | |
| 0x40ddb3 handletest_x86.exe|push eax|eax=0x827f10|esp=0x19f934 | |
| 0x40ddb4 handletest_x86.exe|call dword ptr [0x417040]|esp=0x19f930 | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x14 | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19f934|esp=0x19f92c | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19f928 | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19f928 | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19f928 | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x827f10 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x827f14 | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa07 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x827f10|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x827f10 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19f928 | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19f928|esp=0x19f928 | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19f92c | |
| 0x40ddba handletest_x86.exe|pop ebp|ebp=0x19f934|esp=0x19f934 | |
| 0x40ddbb handletest_x86.exe|ret|esp=0x19f938 | |
| 0x4106ef handletest_x86.exe|pop ecx|ecx=0x827f10|esp=0x19f93c | |
| 0x4106f0 handletest_x86.exe|or edi, 0xffffffff|edi=0x14 | |
| 0x4106f3 handletest_x86.exe|mov dword ptr [ebp - 0x1c], edi|ebp=0x19f970|edi=0xffffffff | |
| 0x4106f6 handletest_x86.exe|xor ecx, ecx|ecx=0x1 | |
| 0x4106f8 handletest_x86.exe|mov dword ptr [ebp - 4], ecx|ebp=0x19f970|ecx=0x0 | |
| 0x4106fb handletest_x86.exe|mov eax, dword ptr [ebx*4 + 0x41efa8]|ebx=0x0 | |
| 0x410702 handletest_x86.exe|mov edx, dword ptr [ebp - 0x20]|ebp=0x19f970 | |
| 0x410705 handletest_x86.exe|test byte ptr [edx + eax + 0x28], 1|edx=0x38|eax=0x827ed8 | |
| 0x41070a handletest_x86.exe|jne 0x410723|eflags=0x202 | |
| 0x410723 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19f970|esp=0x19f940 | |
| 0x410726 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19f970|esp=0x19f93c | |
| 0x410729 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19f970|esp=0x19f938 | |
| 0x41072c handletest_x86.exe|push esi|esi=0x1|esp=0x19f934 | |
| 0x41072d handletest_x86.exe|call 0x410790|esp=0x19f930|eip=0x41072d | |
| 0x410790 handletest_x86.exe|mov edi, edi|edi=0xffffffff | |
| 0x410792 handletest_x86.exe|push ebp|ebp=0x19f970|esp=0x19f92c | |
| 0x410793 handletest_x86.exe|mov ebp, esp|esp=0x19f928 | |
| 0x410795 handletest_x86.exe|sub esp, 0x30|esp=0x19f928 | |
| 0x410798 handletest_x86.exe|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19f928 | |
| 0x41079b handletest_x86.exe|mov eax, dword ptr [ebp + 0xc]|ebp=0x19f928 | |
| 0x41079e handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19f928|eax=0x82a3f8 | |
| 0x4107a1 handletest_x86.exe|mov dword ptr [ebp - 0xc], ecx|ebp=0x19f928|ecx=0x14 | |
| 0x4107a4 handletest_x86.exe|push ebx|ebx=0x0|esp=0x19f8f8 | |
| 0x4107a5 handletest_x86.exe|mov ebx, dword ptr [ebp + 0x14]|ebp=0x19f928 | |
| 0x4107a8 handletest_x86.exe|push esi|esi=0x1|esp=0x19f8f4 | |
| 0x4107a9 handletest_x86.exe|push edi|edi=0xffffffff|esp=0x19f8f0 | |
| 0x4107aa handletest_x86.exe|mov edi, dword ptr [ebp + 8]|ebp=0x19f928 | |
| 0x4107ad handletest_x86.exe|test ecx, ecx|ecx=0x14 | |
| 0x4107af handletest_x86.exe|je 0x410989|eflags=0x206 | |
| 0x4107b5 handletest_x86.exe|test eax, eax|eax=0x82a3f8 | |
| 0x4107b7 handletest_x86.exe|jne 0x4107e3|eflags=0x202 | |
| 0x4107e3 handletest_x86.exe|mov eax, edi|edi=0x1 | |
| 0x4107e5 handletest_x86.exe|mov esi, edi|edi=0x1 | |
| 0x4107e7 handletest_x86.exe|and eax, 0x3f|eax=0x1 | |
| 0x4107ea handletest_x86.exe|sar esi, 6|esi=0x1 | |
| 0x4107ed handletest_x86.exe|imul edx, eax, 0x38|edx=0x38|eax=0x1 | |
| 0x4107f0 handletest_x86.exe|mov dword ptr [ebp - 0x10], esi|ebp=0x19f928|esi=0x0 | |
| 0x4107f3 handletest_x86.exe|mov eax, dword ptr [esi*4 + 0x41efa8]|esi=0x0 | |
| 0x4107fa handletest_x86.exe|mov dword ptr [ebp - 0x30], eax|ebp=0x19f928|eax=0x827ed8 | |
| 0x4107fd handletest_x86.exe|mov dword ptr [ebp - 0x14], edx|ebp=0x19f928|edx=0x38 | |
| 0x410800 handletest_x86.exe|mov al, byte ptr [edx + eax + 0x29]|edx=0x38|eax=0x827ed8 | |
| 0x410804 handletest_x86.exe|mov byte ptr [ebp - 1], al|ebp=0x19f928|al=0x0 | |
| 0x410807 handletest_x86.exe|cmp al, 2|al=0x0 | |
| 0x410809 handletest_x86.exe|je 0x41080f|eflags=0x293 | |
| 0x41080b handletest_x86.exe|cmp al, 1|al=0x0 | |
| 0x41080d handletest_x86.exe|jne 0x410817|eflags=0x297 | |
| 0x410817 handletest_x86.exe|mov eax, dword ptr [ebp - 0x30]|ebp=0x19f928 | |
| 0x41081a handletest_x86.exe|xor esi, esi|esi=0x0 | |
| 0x41081c handletest_x86.exe|test byte ptr [edx + eax + 0x28], 0x20|edx=0x38|eax=0x827ed8 | |
| 0x410821 handletest_x86.exe|je 0x410831|eflags=0x246 | |
| 0x410831 handletest_x86.exe|push ebx|ebx=0x19fe80|esp=0x19f8ec | |
| 0x410832 handletest_x86.exe|push edi|edi=0x1|esp=0x19f8e8 | |
| 0x410833 handletest_x86.exe|call 0x4102dd|esp=0x19f8e4|eip=0x410833 | |
| 0x4102dd handletest_x86.exe|mov edi, edi|edi=0x1 | |
| 0x4102df handletest_x86.exe|push ebp|ebp=0x19f928|esp=0x19f8e0 | |
| 0x4102e0 handletest_x86.exe|mov ebp, esp|esp=0x19f8dc | |
| 0x4102e2 handletest_x86.exe|push ecx|ecx=0x14|esp=0x19f8dc | |
| 0x4102e3 handletest_x86.exe|push ebx|ebx=0x19fe80|esp=0x19f8d8 | |
| 0x4102e4 handletest_x86.exe|push esi|esi=0x0|esp=0x19f8d4 | |
| 0x4102e5 handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19f8dc | |
| 0x4102e8 handletest_x86.exe|push edi|edi=0x1|esp=0x19f8d0 | |
| 0x4102e9 handletest_x86.exe|push esi|esi=0x1|esp=0x19f8cc | |
| 0x4102ea handletest_x86.exe|call 0x40f1ab|esp=0x19f8c8|eip=0x4102ea | |
| 0x40f1ab handletest_x86.exe|mov edi, edi|edi=0x1 | |
| 0x40f1ad handletest_x86.exe|push ebp|ebp=0x19f8dc|esp=0x19f8c4 | |
| 0x40f1ae handletest_x86.exe|mov ebp, esp|esp=0x19f8c0 | |
| 0x40f1b0 handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19f8c0 | |
| 0x40f1b3 handletest_x86.exe|cmp ecx, -2|ecx=0x1 | |
| 0x40f1b6 handletest_x86.exe|jne 0x40f1c5|eflags=0x217 | |
| 0x40f1c5 handletest_x86.exe|test ecx, ecx|ecx=0x1 | |
| 0x40f1c7 handletest_x86.exe|js 0x40f1ed|eflags=0x202 | |
| 0x40f1c9 handletest_x86.exe|cmp ecx, dword ptr [0x41f1a8]|ecx=0x1 | |
| 0x40f1cf handletest_x86.exe|jae 0x40f1ed|eflags=0x283 | |
| 0x40f1d1 handletest_x86.exe|mov eax, ecx|ecx=0x1 | |
| 0x40f1d3 handletest_x86.exe|and ecx, 0x3f|ecx=0x1 | |
| 0x40f1d6 handletest_x86.exe|shr eax, 6|eax=0x1 | |
| 0x40f1d9 handletest_x86.exe|imul ecx, ecx, 0x38|ecx=0x1 | |
| 0x40f1dc handletest_x86.exe|mov eax, dword ptr [eax*4 + 0x41efa8]|eax=0x0 | |
| 0x40f1e3 handletest_x86.exe|movzx eax, byte ptr [eax + ecx + 0x28]|eax=0x827ed8|ecx=0x38 | |
| 0x40f1e8 handletest_x86.exe|and eax, 0x40|eax=0xc1 | |
| 0x40f1eb handletest_x86.exe|pop ebp|ebp=0x19f8c0|esp=0x19f8c0 | |
| 0x40f1ec handletest_x86.exe|ret|esp=0x19f8c4 | |
| 0x4102ef handletest_x86.exe|pop ecx|ecx=0x38|esp=0x19f8c8 | |
| 0x4102f0 handletest_x86.exe|test eax, eax|eax=0x40 | |
| 0x4102f2 handletest_x86.exe|je 0x410354|eflags=0x202 | |
| 0x4102f4 handletest_x86.exe|mov edi, esi|esi=0x1 | |
| 0x4102f6 handletest_x86.exe|and esi, 0x3f|esi=0x1 | |
| 0x4102f9 handletest_x86.exe|sar edi, 6|edi=0x1 | |
| 0x4102fc handletest_x86.exe|imul ebx, esi, 0x38|ebx=0x19fe80|esi=0x1 | |
| 0x4102ff handletest_x86.exe|mov eax, dword ptr [edi*4 + 0x41efa8]|edi=0x0 | |
| 0x410306 handletest_x86.exe|cmp byte ptr [eax + ebx + 0x28], 0|eax=0x827ed8|ebx=0x38 | |
| 0x41030b handletest_x86.exe|jge 0x410354|eflags=0x282 | |
| 0x41030d handletest_x86.exe|mov esi, dword ptr [ebp + 0xc]|ebp=0x19f8dc | |
| 0x410310 handletest_x86.exe|cmp byte ptr [esi + 0x14], 0|esi=0x19fe80 | |
| 0x410314 handletest_x86.exe|jne 0x41031d|eflags=0x202 | |
| 0x41031d handletest_x86.exe|mov eax, dword ptr [esi + 0xc]|esi=0x19fe80 | |
| 0x410320 handletest_x86.exe|cmp dword ptr [eax + 0xa8], 0|eax=0x41e0f8 | |
| 0x410327 handletest_x86.exe|jne 0x410337|eflags=0x246 | |
| 0x410329 handletest_x86.exe|mov eax, dword ptr [edi*4 + 0x41efa8]|edi=0x0 | |
| 0x410330 handletest_x86.exe|cmp byte ptr [eax + ebx + 0x29], 0|eax=0x827ed8|ebx=0x38 | |
| 0x410335 handletest_x86.exe|je 0x410354|eflags=0x246 | |
| 0x410354 handletest_x86.exe|xor al, al|al=0xd8 | |
| 0x410356 handletest_x86.exe|pop edi|edi=0x0|esp=0x19f8cc | |
| 0x410357 handletest_x86.exe|pop esi|esi=0x19fe80|esp=0x19f8d0 | |
| 0x410358 handletest_x86.exe|pop ebx|ebx=0x38|esp=0x19f8d4 | |
| 0x410359 handletest_x86.exe|leave|ebp=0x19f8dc|esp=0x19f8d8 | |
| 0x41035a handletest_x86.exe|ret|esp=0x19f8e0 | |
| 0x410838 handletest_x86.exe|pop ecx|ecx=0x1|esp=0x19f8e4 | |
| 0x410839 handletest_x86.exe|pop ecx|ecx=0x1|esp=0x19f8e8 | |
| 0x41083a handletest_x86.exe|test al, al|al=0x0 | |
| 0x41083c handletest_x86.exe|je 0x41087e|eflags=0x246 | |
| 0x41087e handletest_x86.exe|mov eax, dword ptr [ebp - 0x10]|ebp=0x19f928 | |
| 0x410881 handletest_x86.exe|mov ecx, dword ptr [eax*4 + 0x41efa8]|eax=0x0 | |
| 0x410888 handletest_x86.exe|mov eax, dword ptr [ebp - 0x14]|ebp=0x19f928 | |
| 0x41088b handletest_x86.exe|cmp byte ptr [eax + ecx + 0x28], 0|eax=0x38|ecx=0x827ed8 | |
| 0x410890 handletest_x86.exe|jge 0x4108e1|eflags=0x282 | |
| 0x410892 handletest_x86.exe|movsx eax, byte ptr [ebp - 1]|eax=0x38|ebp=0x19f928 | |
| 0x410896 handletest_x86.exe|sub eax, esi|eax=0x0|esi=0x0 | |
| 0x410898 handletest_x86.exe|je 0x4108cf|eflags=0x246 | |
| 0x4108cf handletest_x86.exe|push dword ptr [ebp - 0xc]|ebp=0x19f928|esp=0x19f8ec | |
| 0x4108d2 handletest_x86.exe|lea eax, [ebp - 0x2c]|ebp=0x19f928 | |
| 0x4108d5 handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19f928|esp=0x19f8e8 | |
| 0x4108d8 handletest_x86.exe|push edi|edi=0x1|esp=0x19f8e4 | |
| 0x4108d9 handletest_x86.exe|push eax|eax=0x19f8fc|esp=0x19f8e0 | |
| 0x4108da handletest_x86.exe|call 0x41035b|esp=0x19f8dc|eip=0x4108da | |
| 0x41035b handletest_x86.exe|mov edi, edi|edi=0x1 | |
| 0x41035d handletest_x86.exe|push ebp|ebp=0x19f928|esp=0x19f8d8 | |
| 0x41035e handletest_x86.exe|mov ebp, esp|esp=0x19f8d4 | |
| 0x410360 handletest_x86.exe|mov eax, 0x140c | |
| 0x410365 handletest_x86.exe|call 0x416120|esp=0x19f8d4|eip=0x410365 | |
| 0x416120 handletest_x86.exe|push ecx|ecx=0x827ed8|esp=0x19f8d0 | |
| 0x416121 handletest_x86.exe|lea ecx, [esp + 4]|esp=0x19f8cc | |
| 0x416125 handletest_x86.exe|sub ecx, eax|ecx=0x19f8d0|eax=0x140c | |
| 0x416127 handletest_x86.exe|sbb eax, eax|eax=0x140c|eflags=0x212 | |
| 0x416129 handletest_x86.exe|not eax|eax=0x0 | |
| 0x41612b handletest_x86.exe|and ecx, eax|ecx=0x19e4c4|eax=0xffffffff | |
| 0x41612d handletest_x86.exe|mov eax, esp|esp=0x19f8cc | |
| 0x41612f handletest_x86.exe|and eax, 0xfffff000|eax=0x19f8cc | |
| 0x416134 handletest_x86.exe|cmp ecx, eax|ecx=0x19e4c4|eax=0x19f000 | |
| 0x416136 handletest_x86.exe|jb 0x416142|eflags=0x283 | |
| 0x416142 handletest_x86.exe|sub eax, 0x1000|eax=0x19f000 | |
| 0x416147 handletest_x86.exe|test dword ptr [eax], eax|eax=0x19e000 | |
| 0x416149 handletest_x86.exe|jmp 0x416134 | |
| 0x416134 handletest_x86.exe|cmp ecx, eax|ecx=0x19e4c4|eax=0x19e000 | |
| 0x416136 handletest_x86.exe|jb 0x416142|eflags=0x202 | |
| 0x416138 handletest_x86.exe|mov eax, ecx|ecx=0x19e4c4 | |
| 0x41613a handletest_x86.exe|pop ecx|ecx=0x19e4c4|esp=0x19f8cc | |
| 0x41613b handletest_x86.exe|xchg eax, esp|eax=0x19e4c4|esp=0x19f8d0 | |
| 0x41613c handletest_x86.exe|mov eax, dword ptr [eax]|eax=0x19f8d0 | |
| 0x41613e handletest_x86.exe|mov dword ptr [esp], eax|esp=0x19e4c4|eax=0x41036a | |
| 0x416141 handletest_x86.exe|ret|esp=0x19e4c4 | |
| 0x41036a handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x41036f handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19f8d4 | |
| 0x410371 handletest_x86.exe|mov dword ptr [ebp - 4], eax|ebp=0x19f8d4|eax=0x6671b960 | |
| 0x410374 handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f8d4 | |
| 0x410377 handletest_x86.exe|mov eax, ecx|ecx=0x1 | |
| 0x410379 handletest_x86.exe|mov edx, dword ptr [ebp + 0x14]|ebp=0x19f8d4 | |
| 0x41037c handletest_x86.exe|and ecx, 0x3f|ecx=0x1 | |
| 0x41037f handletest_x86.exe|sar eax, 6|eax=0x1 | |
| 0x410382 handletest_x86.exe|imul ecx, ecx, 0x38|ecx=0x1 | |
| 0x410385 handletest_x86.exe|push ebx|ebx=0x19fe80|esp=0x19e4c8 | |
| 0x410386 handletest_x86.exe|mov ebx, dword ptr [ebp + 8]|ebp=0x19f8d4 | |
| 0x410389 handletest_x86.exe|mov eax, dword ptr [eax*4 + 0x41efa8]|eax=0x0 | |
| 0x410390 handletest_x86.exe|push esi|esi=0x0|esp=0x19e4c4 | |
| 0x410391 handletest_x86.exe|push edi|edi=0x1|esp=0x19e4c0 | |
| 0x410392 handletest_x86.exe|mov edi, ebx|ebx=0x19f8fc | |
| 0x410394 handletest_x86.exe|mov eax, dword ptr [eax + ecx + 0x18]|eax=0x827ed8|ecx=0x38 | |
| 0x410398 handletest_x86.exe|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19f8d4 | |
| 0x41039b handletest_x86.exe|add edx, ecx|edx=0x14|ecx=0x82a3f8 | |
| 0x41039d handletest_x86.exe|mov dword ptr [ebp - 0x1408], eax|ebp=0x19f8d4|eax=0xb0 | |
| 0x4103a3 handletest_x86.exe|xor eax, eax|eax=0xb0 | |
| 0x4103a5 handletest_x86.exe|stosd dword ptr es:[edi], eax|edi=0x19f8fc|eax=0x0|eflags=0x246 | |
| 0x4103a6 handletest_x86.exe|mov dword ptr [ebp - 0x140c], edx|ebp=0x19f8d4|edx=0x82a40c | |
| 0x4103ac handletest_x86.exe|stosd dword ptr es:[edi], eax|edi=0x19f900|eax=0x0|eflags=0x246 | |
| 0x4103ad handletest_x86.exe|stosd dword ptr es:[edi], eax|edi=0x19f904|eax=0x0|eflags=0x246 | |
| 0x4103ae handletest_x86.exe|cmp ecx, edx|ecx=0x82a3f8|edx=0x82a40c | |
| 0x4103b0 handletest_x86.exe|jae 0x410425|eflags=0x293 | |
| 0x4103b2 handletest_x86.exe|mov edi, dword ptr [ebp - 0x1408]|ebp=0x19f8d4 | |
| 0x4103b8 handletest_x86.exe|lea esi, [ebp - 0x1404]|ebp=0x19f8d4 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3f8|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3f8 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3f8 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x43 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d0|al=0x43 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d0 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d1|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3f9|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3f9 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3f9 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x6f | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x206 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d1|al=0x6f | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d1 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d2|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3fa|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3fa | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3fa | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x6e | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x202 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d2|al=0x6e | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d2 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d3|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3fb|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3fb | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3fb | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x73 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d3|al=0x73 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d3 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d4|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3fc|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x287 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3fc | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3fc | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x6f | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x206 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d4|al=0x6f | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d4 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d5|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3fd|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x283 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3fd | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3fd | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x6c | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x202 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d5|al=0x6c | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d5 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d6|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3fe|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x283 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3fe | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3fe | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x65 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x212 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d6|al=0x65 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d6 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d7|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a3ff|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x287 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a3ff | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a3ff | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x20 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x212 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d7|al=0x20 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d7 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d8|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a400|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a400 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a400 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x6f | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x206 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d8|al=0x6f | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d8 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4d9|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a401|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a401 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a401 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x75 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x212 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4d9|al=0x75 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4d9 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4da|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a402|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a402 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a402 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x74 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4da|al=0x74 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4da | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4db|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a403|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a403 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a403 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x70 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4db|al=0x70 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4db | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4dc|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a404|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a404 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a404 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x75 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x212 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4dc|al=0x75 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4dc | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4dd|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a405|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a405 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a405 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x74 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4dd|al=0x74 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4dd | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4de|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a406|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a406 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a406 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x20 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x212 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4de|al=0x20 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4de | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4df|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x283 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a407|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a407 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a407 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x74 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4df|al=0x74 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4df | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4e0|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a408|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a408 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a408 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x65 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x212 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4e0|al=0x65 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4e0 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4e1|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a409|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a409 | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a409 | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x73 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4e1|al=0x73 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4e1 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4e2|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a40a|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x293 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a40a | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a40a | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0x74 | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x216 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4e2|al=0x74 | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4e2 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4e3|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x297 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a40b|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x297 | |
| 0x4103c2 handletest_x86.exe|mov al, byte ptr [ecx]|ecx=0x82a40b | |
| 0x4103c4 handletest_x86.exe|inc ecx|ecx=0x82a40b | |
| 0x4103c5 handletest_x86.exe|cmp al, 0xa|al=0xa | |
| 0x4103c7 handletest_x86.exe|jne 0x4103d0|eflags=0x246 | |
| 0x4103c9 handletest_x86.exe|inc dword ptr [ebx + 8]|ebx=0x19f8fc | |
| 0x4103cc handletest_x86.exe|mov byte ptr [esi], 0xd|esi=0x19e4e3 | |
| 0x4103cf handletest_x86.exe|inc esi|esi=0x19e4e3 | |
| 0x4103d0 handletest_x86.exe|mov byte ptr [esi], al|esi=0x19e4e4|al=0xa | |
| 0x4103d2 handletest_x86.exe|inc esi|esi=0x19e4e4 | |
| 0x4103d3 handletest_x86.exe|lea eax, [ebp - 5]|ebp=0x19f8d4 | |
| 0x4103d6 handletest_x86.exe|cmp esi, eax|esi=0x19e4e5|eax=0x19f8cf | |
| 0x4103d8 handletest_x86.exe|jb 0x4103be|eflags=0x293 | |
| 0x4103be handletest_x86.exe|cmp ecx, edx|ecx=0x82a40c|edx=0x82a40c | |
| 0x4103c0 handletest_x86.exe|jae 0x4103da|eflags=0x246 | |
| 0x4103da handletest_x86.exe|lea eax, [ebp - 0x1404]|ebp=0x19f8d4 | |
| 0x4103e0 handletest_x86.exe|mov dword ptr [ebp + 0x10], ecx|ebp=0x19f8d4|ecx=0x82a40c | |
| 0x4103e3 handletest_x86.exe|sub esi, eax|esi=0x19e4e5|eax=0x19e4d0 | |
| 0x4103e5 handletest_x86.exe|lea eax, [ebp - 0x1408]|ebp=0x19f8d4 | |
| 0x4103eb handletest_x86.exe|push 0|esp=0x19e4bc | |
| 0x4103ed handletest_x86.exe|push eax|eax=0x19e4cc|esp=0x19e4b8 | |
| 0x4103ee handletest_x86.exe|push esi|esi=0x15|esp=0x19e4b4 | |
| 0x4103ef handletest_x86.exe|lea eax, [ebp - 0x1404]|ebp=0x19f8d4 | |
| 0x4103f5 handletest_x86.exe|push eax|eax=0x19e4d0|esp=0x19e4b0 | |
| 0x4103f6 handletest_x86.exe|push edi|edi=0xb0|esp=0x19e4ac | |
| 0x4103f7 handletest_x86.exe|call dword ptr [0x41707c]|esp=0x19e4a8 | |
| 0x75c63f20 kernel32.dll:WriteFile|jmp dword ptr [0x75cc1094] | |
| 0x76f71560 kernelbase.dll:WriteFile|push 0x18|esp=0x19e4a4 | |
| 0x76f71562 kernelbase.dll:WriteFile+0x2|push 0x770518a8|esp=0x19e4a0 | |
| 0x76f71567 kernelbase.dll:WriteFile+0x7|call 0x76fe153c|esp=0x19e49c|eip=0x76f71567 | |
| 0x76fe153c kernelbase.dll:GetNumaNodeProcessorMask2+0x1b8c|push 0x76fa8e80|esp=0x19e498 | |
| 0x76fe1541 kernelbase.dll:GetNumaNodeProcessorMask2+0x1b91|push dword ptr fs:[0]|esp=0x19e494 | |
| 0x76fe1547 kernelbase.dll:GetNumaNodeProcessorMask2+0x1b97|mov eax, dword ptr [esp + 0x10]|esp=0x19e490 | |
| 0x76fe154b kernelbase.dll:GetNumaNodeProcessorMask2+0x1b9b|mov dword ptr [esp + 0x10], ebp|esp=0x19e490|ebp=0x19f8d4 | |
| 0x76fe154f kernelbase.dll:GetNumaNodeProcessorMask2+0x1b9f|lea ebp, [esp + 0x10]|esp=0x19e490 | |
| 0x76fe1553 kernelbase.dll:GetNumaNodeProcessorMask2+0x1ba3|sub esp, eax|esp=0x19e490|eax=0x18 | |
| 0x76fe1555 kernelbase.dll:GetNumaNodeProcessorMask2+0x1ba5|push ebx|ebx=0x19f8fc|esp=0x19e478 | |
| 0x76fe1556 kernelbase.dll:GetNumaNodeProcessorMask2+0x1ba6|push esi|esi=0x15|esp=0x19e474 | |
| 0x76fe1557 kernelbase.dll:GetNumaNodeProcessorMask2+0x1ba7|push edi|edi=0xb0|esp=0x19e470 | |
| 0x76fe1558 kernelbase.dll:GetNumaNodeProcessorMask2+0x1ba8|mov eax, dword ptr [0x77065bd0] | |
| 0x76fe155d kernelbase.dll:GetNumaNodeProcessorMask2+0x1bad|xor dword ptr [ebp - 4], eax|ebp=0x19e4a0|eax=0x92df5544 | |
| 0x76fe1560 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bb0|xor eax, ebp|eax=0x92df5544|ebp=0x19e4a0 | |
| 0x76fe1562 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bb2|push eax|eax=0x92c6b1e4|esp=0x19e46c | |
| 0x76fe1563 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bb3|mov dword ptr [ebp - 0x18], esp|ebp=0x19e4a0|esp=0x19e468 | |
| 0x76fe1566 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bb6|push dword ptr [ebp - 8]|ebp=0x19e4a0|esp=0x19e468 | |
| 0x76fe1569 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bb9|mov eax, dword ptr [ebp - 4]|ebp=0x19e4a0 | |
| 0x76fe156c kernelbase.dll:GetNumaNodeProcessorMask2+0x1bbc|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19e4a0 | |
| 0x76fe1573 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bc3|mov dword ptr [ebp - 8], eax|ebp=0x19e4a0|eax=0xe5da4dec | |
| 0x76fe1576 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bc6|lea eax, [ebp - 0x10]|ebp=0x19e4a0 | |
| 0x76fe1579 kernelbase.dll:GetNumaNodeProcessorMask2+0x1bc9|mov dword ptr fs:[0], eax|eax=0x19e490 | |
| 0x76fe157e kernelbase.dll:GetNumaNodeProcessorMask2+0x1bce|ret|esp=0x19e464 | |
| 0x76f7156c kernelbase.dll:WriteFile+0xc|xor ecx, ecx|ecx=0x82a40c | |
| 0x76f7156e kernelbase.dll:WriteFile+0xe|mov dword ptr [ebp - 0x20], ecx|ebp=0x19e4a0|ecx=0x0 | |
| 0x76f71571 kernelbase.dll:WriteFile+0x11|mov dword ptr [ebp - 0x1c], ecx|ebp=0x19e4a0|ecx=0x0 | |
| 0x76f71574 kernelbase.dll:WriteFile+0x14|mov esi, dword ptr [ebp + 0x14]|ebp=0x19e4a0 | |
| 0x76f71577 kernelbase.dll:WriteFile+0x17|test esi, esi|esi=0x19e4cc | |
| 0x76f71579 kernelbase.dll:WriteFile+0x19|je 0x76f7157d|eflags=0x206 | |
| 0x76f7157b kernelbase.dll:WriteFile+0x1b|mov dword ptr [esi], ecx|esi=0x19e4cc|ecx=0x0 | |
| 0x76f7157d kernelbase.dll:WriteFile+0x1d|mov edi, dword ptr [ebp + 8]|ebp=0x19e4a0 | |
| 0x76f71580 kernelbase.dll:WriteFile+0x20|cmp edi, -0xc|edi=0xb0 | |
| 0x76f71583 kernelbase.dll:WriteFile+0x23|je 0x76fe5fc7|eflags=0x213 | |
| 0x76f71589 kernelbase.dll:WriteFile+0x29|cmp edi, -0xb|edi=0xb0 | |
| 0x76f7158c kernelbase.dll:WriteFile+0x2c|je 0x76fe5fb6|eflags=0x217 | |
| 0x76f71592 kernelbase.dll:WriteFile+0x32|cmp edi, -0xa|edi=0xb0 | |
| 0x76f71595 kernelbase.dll:WriteFile+0x35|je 0x76fe5fa5|eflags=0x213 | |
| 0x76f7159b kernelbase.dll:WriteFile+0x3b|mov ebx, dword ptr [ebp + 0x18]|ebp=0x19e4a0 | |
| 0x76f7159e kernelbase.dll:WriteFile+0x3e|push ecx|ecx=0x0|esp=0x19e468 | |
| 0x76f7159f kernelbase.dll:WriteFile+0x3f|test ebx, ebx|ebx=0x0 | |
| 0x76f715a1 kernelbase.dll:WriteFile+0x41|jne 0x76f715ec|eflags=0x246 | |
| 0x76f715a3 kernelbase.dll:WriteFile+0x43|push ecx|ecx=0x0|esp=0x19e464 | |
| 0x76f715a4 kernelbase.dll:WriteFile+0x44|push dword ptr [ebp + 0x10]|ebp=0x19e4a0|esp=0x19e460 | |
| 0x76f715a7 kernelbase.dll:WriteFile+0x47|push dword ptr [ebp + 0xc]|ebp=0x19e4a0|esp=0x19e45c | |
| 0x76f715aa kernelbase.dll:WriteFile+0x4a|lea eax, [ebp - 0x20]|ebp=0x19e4a0 | |
| 0x76f715ad kernelbase.dll:WriteFile+0x4d|push eax|eax=0x19e480|esp=0x19e458 | |
| 0x76f715ae kernelbase.dll:WriteFile+0x4e|push ecx|ecx=0x0|esp=0x19e454 | |
| 0x76f715af kernelbase.dll:WriteFile+0x4f|push ecx|ecx=0x0|esp=0x19e450 | |
| 0x76f715b0 kernelbase.dll:WriteFile+0x50|push ecx|ecx=0x0|esp=0x19e44c | |
| 0x76f715b1 kernelbase.dll:WriteFile+0x51|push edi|edi=0xb0|esp=0x19e448 | |
| 0x76f715b2 kernelbase.dll:WriteFile+0x52|call dword ptr [0x77069818]|esp=0x19e444 | |
| 0x771a4be0 ntdll.dll:NtWriteFile|mov eax, 0x1a0008 | |
| 0x771a4be5 ntdll.dll:NtWriteFile+0x5|mov edx, 0x771c8f20 | |
| 0x771a4bea ntdll.dll:NtWriteFile+0xa|call edx|edx=0x771c8f20|esp=0x19e440 | |
| 0x771c8f20 ntdll.dll:RtlInterlockedCompareExchange64+0x180|jmp dword ptr [0x7725c220] | |
| 0x77126000|mov edx, esp|esp=0x19e43c | |
| 0x77126002|sysenter | |
| 0x77126004|ret|esp=0x19e43c | |
| 0x771a4bec ntdll.dll:NtWriteFile+0xc|ret 0x24|esp=0x19e440 | |
| 0x76f715b8 kernelbase.dll:WriteFile+0x58|mov ecx, eax|eax=0x0 | |
| 0x76f715ba kernelbase.dll:WriteFile+0x5a|cmp ecx, 0x103|ecx=0x0 | |
| 0x76f715c0 kernelbase.dll:WriteFile+0x60|je 0x76fe5ff9|eflags=0x293 | |
| 0x76f715c6 kernelbase.dll:WriteFile+0x66|test ecx, ecx|ecx=0x0 | |
| 0x76f715c8 kernelbase.dll:WriteFile+0x68|js 0x76fe6012|eflags=0x246 | |
| 0x76f715ce kernelbase.dll:WriteFile+0x6e|test esi, esi|esi=0x19e4cc | |
| 0x76f715d0 kernelbase.dll:WriteFile+0x70|je 0x76f715d7|eflags=0x206 | |
| 0x76f715d2 kernelbase.dll:WriteFile+0x72|mov eax, dword ptr [ebp - 0x1c]|ebp=0x19e4a0 | |
| 0x76f715d5 kernelbase.dll:WriteFile+0x75|mov dword ptr [esi], eax|esi=0x19e4cc|eax=0x0 | |
| 0x76f715d7 kernelbase.dll:WriteFile+0x77|xor eax, eax|eax=0x0 | |
| 0x76f715d9 kernelbase.dll:WriteFile+0x79|inc eax|eax=0x0 | |
| 0x76f715da kernelbase.dll:WriteFile+0x7a|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19e4a0 | |
| 0x76f715dd kernelbase.dll:WriteFile+0x7d|mov dword ptr fs:[0], ecx|ecx=0x19f960 | |
| 0x76f715e4 kernelbase.dll:WriteFile+0x84|pop ecx|ecx=0x19f960|esp=0x19e468 | |
| 0x76f715e5 kernelbase.dll:WriteFile+0x85|pop edi|edi=0xb0|esp=0x19e46c | |
| 0x76f715e6 kernelbase.dll:WriteFile+0x86|pop esi|esi=0x19e4cc|esp=0x19e470 | |
| 0x76f715e7 kernelbase.dll:WriteFile+0x87|pop ebx|ebx=0x0|esp=0x19e474 | |
| 0x76f715e8 kernelbase.dll:WriteFile+0x88|leave|ebp=0x19e4a0|esp=0x19e478 | |
| 0x76f715e9 kernelbase.dll:WriteFile+0x89|ret 0x14|esp=0x19e4a4 | |
| 0x4103fd handletest_x86.exe|test eax, eax|eax=0x1 | |
| 0x4103ff handletest_x86.exe|je 0x41041d|eflags=0x202 | |
| 0x410401 handletest_x86.exe|mov eax, dword ptr [ebp - 0x1408]|ebp=0x19f8d4 | |
| 0x410407 handletest_x86.exe|add dword ptr [ebx + 4], eax|ebx=0x19f8fc|eax=0x0 | |
| 0x41040a handletest_x86.exe|cmp eax, esi|eax=0x0|esi=0x15 | |
| 0x41040c handletest_x86.exe|jb 0x410425|eflags=0x297 | |
| 0x410425 handletest_x86.exe|mov ecx, dword ptr [ebp - 4]|ebp=0x19f8d4 | |
| 0x410428 handletest_x86.exe|mov eax, ebx|ebx=0x19f8fc | |
| 0x41042a handletest_x86.exe|pop edi|edi=0xb0|esp=0x19e4bc | |
| 0x41042b handletest_x86.exe|pop esi|esi=0x15|esp=0x19e4c0 | |
| 0x41042c handletest_x86.exe|xor ecx, ebp|ecx=0x6671b960|ebp=0x19f8d4 | |
| 0x41042e handletest_x86.exe|pop ebx|ebx=0x19f8fc|esp=0x19e4c4 | |
| 0x41042f handletest_x86.exe|call 0x401450|esp=0x19e4c8|eip=0x41042f | |
| 0x401450 handletest_x86.exe|cmp ecx, dword ptr [0x41e004]|ecx=0x666841b4 | |
| 0x401456 handletest_x86.exe|jne 0x401459|eflags=0x246 | |
| 0x401458 handletest_x86.exe|ret|esp=0x19e4c4 | |
| 0x410434 handletest_x86.exe|leave|ebp=0x19f8d4|esp=0x19e4c8 | |
| 0x410435 handletest_x86.exe|ret|esp=0x19f8d8 | |
| 0x4108df handletest_x86.exe|jmp 0x4108b8 | |
| 0x4108b8 handletest_x86.exe|add esp, 0x10|esp=0x19f8dc | |
| 0x4108bb handletest_x86.exe|jmp 0x410861 | |
| 0x410861 handletest_x86.exe|mov esi, eax|eax=0x19f8fc | |
| 0x410863 handletest_x86.exe|jmp 0x41090f | |
| 0x41090f handletest_x86.exe|lea edi, [ebp - 0x20]|ebp=0x19f928 | |
| 0x410912 handletest_x86.exe|movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19f908|esi=0x19f8fc|eflags=0x202 | |
| 0x410913 handletest_x86.exe|movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19f90c|esi=0x19f900|eflags=0x202 | |
| 0x410914 handletest_x86.exe|movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19f910|esi=0x19f904|eflags=0x202 | |
| 0x410915 handletest_x86.exe|mov eax, dword ptr [ebp - 0x1c]|ebp=0x19f928 | |
| 0x410918 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x41091a handletest_x86.exe|jne 0x410984|eflags=0x246 | |
| 0x41091c handletest_x86.exe|mov eax, dword ptr [ebp - 0x20]|ebp=0x19f928 | |
| 0x41091f handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x410921 handletest_x86.exe|je 0x41094f|eflags=0x246 | |
| 0x41094f handletest_x86.exe|xor esi, esi|esi=0x19f908 | |
| 0x410951 handletest_x86.exe|mov eax, dword ptr [ebp - 0x10]|ebp=0x19f928 | |
| 0x410954 handletest_x86.exe|mov ecx, dword ptr [ebp - 0x14]|ebp=0x19f928 | |
| 0x410957 handletest_x86.exe|mov eax, dword ptr [eax*4 + 0x41efa8]|eax=0x0 | |
| 0x41095e handletest_x86.exe|test byte ptr [ecx + eax + 0x28], 0x40|ecx=0x38|eax=0x827ed8 | |
| 0x410963 handletest_x86.exe|je 0x41096d|eflags=0x202 | |
| 0x410965 handletest_x86.exe|mov eax, dword ptr [ebp - 8]|ebp=0x19f928 | |
| 0x410968 handletest_x86.exe|cmp byte ptr [eax], 0x1a|eax=0x82a3f8 | |
| 0x41096b handletest_x86.exe|je 0x410989|eflags=0x212 | |
| 0x41096d handletest_x86.exe|mov byte ptr [ebx + 0x1c], 1|ebx=0x19fe80 | |
| 0x410971 handletest_x86.exe|mov dword ptr [ebx + 0x18], 0x1c|ebx=0x19fe80 | |
| 0x410978 handletest_x86.exe|mov byte ptr [ebx + 0x24], 1|ebx=0x19fe80 | |
| 0x41097c handletest_x86.exe|mov dword ptr [ebx + 0x20], esi|ebx=0x19fe80|esi=0x0 | |
| 0x41097f handletest_x86.exe|jmp 0x4107db | |
| 0x4107db handletest_x86.exe|or eax, 0xffffffff|eax=0x82a3f8 | |
| 0x4107de handletest_x86.exe|jmp 0x41098b | |
| 0x41098b handletest_x86.exe|pop edi|edi=0x19f914|esp=0x19f8ec | |
| 0x41098c handletest_x86.exe|pop esi|esi=0x0|esp=0x19f8f0 | |
| 0x41098d handletest_x86.exe|pop ebx|ebx=0x19fe80|esp=0x19f8f4 | |
| 0x41098e handletest_x86.exe|leave|ebp=0x19f928|esp=0x19f8f8 | |
| 0x41098f handletest_x86.exe|ret|esp=0x19f92c | |
| 0x410732 handletest_x86.exe|add esp, 0x10|esp=0x19f930 | |
| 0x410735 handletest_x86.exe|mov edi, eax|eax=0xffffffff | |
| 0x410737 handletest_x86.exe|mov dword ptr [ebp - 0x1c], edi|ebp=0x19f970|edi=0xffffffff | |
| 0x41073a handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19f970 | |
| 0x410741 handletest_x86.exe|call 0x410750|esp=0x19f940|eip=0x410741 | |
| 0x410750 handletest_x86.exe|push esi|esi=0x1|esp=0x19f93c | |
| 0x410751 handletest_x86.exe|call 0x40de4e|esp=0x19f938|eip=0x410751 | |
| 0x40de4e handletest_x86.exe|mov edi, edi|edi=0xffffffff | |
| 0x40de50 handletest_x86.exe|push ebp|ebp=0x19f970|esp=0x19f934 | |
| 0x40de51 handletest_x86.exe|mov ebp, esp|esp=0x19f930 | |
| 0x40de53 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19f930 | |
| 0x40de56 handletest_x86.exe|mov ecx, eax|eax=0x1 | |
| 0x40de58 handletest_x86.exe|and eax, 0x3f|eax=0x1 | |
| 0x40de5b handletest_x86.exe|sar ecx, 6|ecx=0x1 | |
| 0x40de5e handletest_x86.exe|imul eax, eax, 0x38|eax=0x1 | |
| 0x40de61 handletest_x86.exe|add eax, dword ptr [ecx*4 + 0x41efa8]|eax=0x38|ecx=0x0 | |
| 0x40de68 handletest_x86.exe|push eax|eax=0x827f10|esp=0x19f930 | |
| 0x40de69 handletest_x86.exe|call dword ptr [0x417044]|esp=0x19f92c | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0xffffffff | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19f930|esp=0x19f928 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19f924 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19f924 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x0|esp=0x19f91c | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19f924 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x1|esp=0x19f918 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0xffffffff|esp=0x19f914 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x827f10 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x827f10 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x827f10 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0x0 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x827f14|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x827f14|esp=0x19f910 | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19f914 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x827f10|esp=0x19f918 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19f924 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19f924|esp=0x19f924 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19f928 | |
| 0x40de6f handletest_x86.exe|pop ebp|ebp=0x19f930|esp=0x19f930 | |
| 0x40de70 handletest_x86.exe|ret|esp=0x19f934 | |
| 0x410756 handletest_x86.exe|pop ecx|ecx=0xffffffff|esp=0x19f938 | |
| 0x410757 handletest_x86.exe|ret|esp=0x19f93c | |
| 0x410746 handletest_x86.exe|mov eax, edi|edi=0xffffffff | |
| 0x410748 handletest_x86.exe|jmp 0x410780 | |
| 0x410780 handletest_x86.exe|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f970 | |
| 0x410783 handletest_x86.exe|mov dword ptr fs:[0], ecx|ecx=0x19fe58 | |
| 0x41078a handletest_x86.exe|pop ecx|ecx=0x19fe58|esp=0x19f940 | |
| 0x41078b handletest_x86.exe|pop edi|edi=0xffffffff|esp=0x19f944 | |
| 0x41078c handletest_x86.exe|pop esi|esi=0x1|esp=0x19f948 | |
| 0x41078d handletest_x86.exe|pop ebx|ebx=0x0|esp=0x19f94c | |
| 0x41078e handletest_x86.exe|leave|ebp=0x19f970|esp=0x19f950 | |
| 0x41078f handletest_x86.exe|ret|esp=0x19f974 | |
| 0x40aba9 handletest_x86.exe|add esp, 0x14|esp=0x19f978 | |
| 0x40abac handletest_x86.exe|cmp edi, eax|edi=0x14|eax=0xffffffff | |
| 0x40abae handletest_x86.exe|je 0x40abbb|eflags=0x213 | |
| 0x40abb0 handletest_x86.exe|push 0x10|esp=0x19f98c | |
| 0x40abb2 handletest_x86.exe|pop eax|eax=0xffffffff|esp=0x19f988 | |
| 0x40abb3 handletest_x86.exe|lock or dword ptr [esi], eax|esi=0x41e084|eax=0x10 | |
| 0x40abb6 handletest_x86.exe|or eax, 0xffffffff|eax=0x10 | |
| 0x40abb9 handletest_x86.exe|jmp 0x40abcd | |
| 0x40abcd handletest_x86.exe|pop edi|edi=0x14|esp=0x19f98c | |
| 0x40abce handletest_x86.exe|pop esi|esi=0x41e084|esp=0x19f990 | |
| 0x40abcf handletest_x86.exe|pop ebx|ebx=0x82a3f8|esp=0x19f994 | |
| 0x40abd0 handletest_x86.exe|pop ebp|ebp=0x19f998|esp=0x19f998 | |
| 0x40abd1 handletest_x86.exe|ret|esp=0x19f99c | |
| 0x40c196 handletest_x86.exe|pop ecx|ecx=0x6671b8c4|esp=0x19f9a0 | |
| 0x40c197 handletest_x86.exe|pop ecx|ecx=0x41e078|esp=0x19f9a4 | |
| 0x40c198 handletest_x86.exe|mov eax, 0xfffffd7f | |
| 0x40c19d handletest_x86.exe|lock and dword ptr [edi], eax|edi=0x41e084|eax=0xfffffd7f | |
| 0x40c1a0 handletest_x86.exe|xor eax, eax|eax=0xfffffd7f | |
| 0x40c1a2 handletest_x86.exe|mov dword ptr [esi + 0x18], eax|esi=0x41e078|eax=0x0 | |
| 0x40c1a5 handletest_x86.exe|mov dword ptr [esi + 4], eax|esi=0x41e078|eax=0x0 | |
| 0x40c1a8 handletest_x86.exe|mov dword ptr [esi], eax|esi=0x41e078|eax=0x0 | |
| 0x40c1aa handletest_x86.exe|pop edi|edi=0x41e084|esp=0x19f9a8 | |
| 0x40c1ab handletest_x86.exe|pop esi|esi=0x41e078|esp=0x19f9ac | |
| 0x40c1ac handletest_x86.exe|pop ebp|ebp=0x19f9b0|esp=0x19f9b0 | |
| 0x40c1ad handletest_x86.exe|ret|esp=0x19f9b4 | |
| 0x405c7d handletest_x86.exe|mov ecx, dword ptr [ebp - 4]|ebp=0x19fe34 | |
| 0x405c80 handletest_x86.exe|add esp, 0xc|esp=0x19f9b8 | |
| 0x405c83 handletest_x86.exe|mov eax, esi|esi=0x14 | |
| 0x405c85 handletest_x86.exe|xor ecx, ebp|ecx=0x6671bf80|ebp=0x19fe34 | |
| 0x405c87 handletest_x86.exe|pop edi|edi=0x19fe80|esp=0x19f9c4 | |
| 0x405c88 handletest_x86.exe|pop esi|esi=0x14|esp=0x19f9c8 | |
| 0x405c89 handletest_x86.exe|pop ebx|ebx=0x41e078|esp=0x19f9cc | |
| 0x405c8a handletest_x86.exe|call 0x401450|esp=0x19f9d0|eip=0x405c8a | |
| 0x401450 handletest_x86.exe|cmp ecx, dword ptr [0x41e004]|ecx=0x666841b4 | |
| 0x401456 handletest_x86.exe|jne 0x401459|eflags=0x246 | |
| 0x401458 handletest_x86.exe|ret|esp=0x19f9cc | |
| 0x405c8f handletest_x86.exe|leave|ebp=0x19fe34|esp=0x19f9d0 | |
| 0x405c90 handletest_x86.exe|ret|esp=0x19fe38 | |
| 0x40506b handletest_x86.exe|mov esi, eax|eax=0x14 | |
| 0x40506d handletest_x86.exe|mov dword ptr [ebp - 0x1c], esi|ebp=0x19fe68|esi=0x14 | |
| 0x405070 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fe68 | |
| 0x405077 handletest_x86.exe|call 0x405093|esp=0x19fe3c|eip=0x405077 | |
| 0x405093 handletest_x86.exe|mov eax, dword ptr [ebp + 0x10]|ebp=0x19fe68 | |
| 0x405096 handletest_x86.exe|push dword ptr [eax]|eax=0x19fec8|esp=0x19fe38 | |
| 0x405098 handletest_x86.exe|call 0x404bc6|esp=0x19fe34|eip=0x405098 | |
| 0x404bc6 handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x404bc8 handletest_x86.exe|push ebp|ebp=0x19fe68|esp=0x19fe30 | |
| 0x404bc9 handletest_x86.exe|mov ebp, esp|esp=0x19fe2c | |
| 0x404bcb handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe2c | |
| 0x404bce handletest_x86.exe|add eax, 0x20|eax=0x41e078 | |
| 0x404bd1 handletest_x86.exe|push eax|eax=0x41e098|esp=0x19fe2c | |
| 0x404bd2 handletest_x86.exe|call dword ptr [0x417044]|esp=0x19fe28 | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x828fc0 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19fe2c|esp=0x19fe24 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19fe20 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19fe20 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x2a3000|esp=0x19fe18 | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19fe20 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x14|esp=0x19fe14 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x828fc0|esp=0x19fe10 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x41e098 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x41e098 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x41e098 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0x666841b4 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x41e09c|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x41e09c|esp=0x19fe0c | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19fe10 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x41e098|esp=0x19fe14 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19fe20 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19fe20|esp=0x19fe20 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19fe24 | |
| 0x404bd8 handletest_x86.exe|pop ebp|ebp=0x19fe2c|esp=0x19fe2c | |
| 0x404bd9 handletest_x86.exe|ret|esp=0x19fe30 | |
| 0x40509d handletest_x86.exe|pop ecx|ecx=0xffffffff|esp=0x19fe34 | |
| 0x40509e handletest_x86.exe|ret|esp=0x19fe38 | |
| 0x40507c handletest_x86.exe|mov eax, esi|esi=0x14 | |
| 0x40507e handletest_x86.exe|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fe68 | |
| 0x405081 handletest_x86.exe|mov dword ptr fs:[0], ecx|ecx=0x19ff64 | |
| 0x405088 handletest_x86.exe|pop ecx|ecx=0x19ff64|esp=0x19fe3c | |
| 0x405089 handletest_x86.exe|pop edi|edi=0x828fc0|esp=0x19fe40 | |
| 0x40508a handletest_x86.exe|pop esi|esi=0x14|esp=0x19fe44 | |
| 0x40508b handletest_x86.exe|pop ebx|ebx=0x2a3000|esp=0x19fe48 | |
| 0x40508c handletest_x86.exe|leave|ebp=0x19fe68|esp=0x19fe4c | |
| 0x40508d handletest_x86.exe|ret 0xc|esp=0x19fe6c | |
| 0x406c63 handletest_x86.exe|mov esi, eax|eax=0x14 | |
| 0x406c65 handletest_x86.exe|lea ecx, [ebp - 0x5c]|ebp=0x19fedc | |
| 0x406c68 handletest_x86.exe|call 0x40452b|esp=0x19fe7c|eip=0x406c68 | |
| 0x40452b handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x40452d handletest_x86.exe|push esi|esi=0x14|esp=0x19fe78 | |
| 0x40452e handletest_x86.exe|push edi|edi=0x828fc0|esp=0x19fe74 | |
| 0x40452f handletest_x86.exe|mov edi, ecx|ecx=0x19fe80 | |
| 0x404531 handletest_x86.exe|cmp byte ptr [edi + 0x14], 2|edi=0x19fe80 | |
| 0x404535 handletest_x86.exe|jne 0x404540|eflags=0x297 | |
| 0x404540 handletest_x86.exe|cmp byte ptr [edi + 0x1c], 0|edi=0x19fe80 | |
| 0x404544 handletest_x86.exe|je 0x404551|eflags=0x202 | |
| 0x404546 handletest_x86.exe|mov esi, dword ptr [edi + 0x18]|edi=0x19fe80 | |
| 0x404549 handletest_x86.exe|call 0x404968|esp=0x19fe70|eip=0x404549 | |
| 0x404968 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40496a handletest_x86.exe|push esi|esi=0x1c|esp=0x19fe6c | |
| 0x40496b handletest_x86.exe|mov esi, ecx|ecx=0x19fe80 | |
| 0x40496d handletest_x86.exe|cmp dword ptr [esi], 0|esi=0x19fe80 | |
| 0x404970 handletest_x86.exe|jne 0x40497b|eflags=0x246 | |
| 0x404972 handletest_x86.exe|call 0x404922|esp=0x19fe68|eip=0x404972 | |
| 0x404922 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x404924 handletest_x86.exe|push ebp|ebp=0x19fedc|esp=0x19fe64 | |
| 0x404925 handletest_x86.exe|mov ebp, esp|esp=0x19fe60 | |
| 0x404927 handletest_x86.exe|push ecx|ecx=0x19fe80|esp=0x19fe60 | |
| 0x404928 handletest_x86.exe|push esi|esi=0x19fe80|esp=0x19fe5c | |
| 0x404929 handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19fe58 | |
| 0x40492a handletest_x86.exe|mov edi, ecx|ecx=0x19fe80 | |
| 0x40492c handletest_x86.exe|call dword ptr [0x417038]|esp=0x19fe54 | |
| 0x75c549b0 kernel32.dll:GetLastError|jmp dword ptr [0x75cc0f68] | |
| 0x76f728d0 kernelbase.dll:GetLastError|mov eax, dword ptr fs:[0x18] | |
| 0x76f728d6 kernelbase.dll:GetLastError+0x6|mov eax, dword ptr [eax + 0x34]|eax=0x2a6000 | |
| 0x76f728d9 kernelbase.dll:GetLastError+0x9|ret|esp=0x19fe50 | |
| 0x404932 handletest_x86.exe|cmp byte ptr [edi + 8], 0|edi=0x19fe80 | |
| 0x404936 handletest_x86.exe|mov dword ptr [ebp - 4], eax|ebp=0x19fe60|eax=0x0 | |
| 0x404939 handletest_x86.exe|jne 0x404946|eflags=0x246 | |
| 0x40493b handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x40493d handletest_x86.exe|mov byte ptr [edi + 8], 1|edi=0x19fe80 | |
| 0x404941 handletest_x86.exe|mov dword ptr [edi + 4], eax|edi=0x19fe80|eax=0x0 | |
| 0x404944 handletest_x86.exe|jmp 0x404949 | |
| 0x404949 handletest_x86.exe|push eax|eax=0x0|esp=0x19fe54 | |
| 0x40494a handletest_x86.exe|lea eax, [ebp - 4]|ebp=0x19fe60 | |
| 0x40494d handletest_x86.exe|push eax|eax=0x19fe5c|esp=0x19fe50 | |
| 0x40494e handletest_x86.exe|call 0x409180|esp=0x19fe4c|eip=0x40494e | |
| 0x409180 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x409182 handletest_x86.exe|push ebp|ebp=0x19fe60|esp=0x19fe48 | |
| 0x409183 handletest_x86.exe|mov ebp, esp|esp=0x19fe44 | |
| 0x409185 handletest_x86.exe|mov eax, dword ptr [0x41e0f0] | |
| 0x40918a handletest_x86.exe|push esi|esi=0x19fe80|esp=0x19fe44 | |
| 0x40918b handletest_x86.exe|push edi|edi=0x19fe80|esp=0x19fe40 | |
| 0x40918c handletest_x86.exe|xor edi, edi|edi=0x19fe80 | |
| 0x40918e handletest_x86.exe|cmp eax, -1|eax=0x2 | |
| 0x409191 handletest_x86.exe|je 0x4091ab|eflags=0x217 | |
| 0x409193 handletest_x86.exe|push eax|eax=0x2|esp=0x19fe3c | |
| 0x409194 handletest_x86.exe|call 0x40a73d|esp=0x19fe38|eip=0x409194 | |
| 0x40a73d handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x40a73f handletest_x86.exe|push ebp|ebp=0x19fe44|esp=0x19fe34 | |
| 0x40a740 handletest_x86.exe|mov ebp, esp|esp=0x19fe30 | |
| 0x40a742 handletest_x86.exe|push esi|esi=0x19fe80|esp=0x19fe30 | |
| 0x40a743 handletest_x86.exe|push 0x418a90|esp=0x19fe2c | |
| 0x40a748 handletest_x86.exe|push 0x418a88|esp=0x19fe28 | |
| 0x40a74d handletest_x86.exe|push 0x417c08|esp=0x19fe24 | |
| 0x40a752 handletest_x86.exe|push 0x20|esp=0x19fe20 | |
| 0x40a754 handletest_x86.exe|call 0x40a580|esp=0x19fe1c|eip=0x40a754 | |
| 0x40a580 handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x40a582 handletest_x86.exe|push ebp|ebp=0x19fe30|esp=0x19fe18 | |
| 0x40a583 handletest_x86.exe|mov ebp, esp|esp=0x19fe14 | |
| 0x40a585 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe14 | |
| 0x40a588 handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fe14 | |
| 0x40a589 handletest_x86.exe|push edi|edi=0x0|esp=0x19fe10 | |
| 0x40a58a handletest_x86.exe|lea ebx, [eax*4 + 0x41f200]|eax=0x20 | |
| 0x40a591 handletest_x86.exe|mov eax, dword ptr [ebx]|ebx=0x41f280 | |
| 0x40a593 handletest_x86.exe|nop | |
| 0x40a594 handletest_x86.exe|mov edx, dword ptr [0x41e004] | |
| 0x40a59a handletest_x86.exe|or edi, 0xffffffff|edi=0x0 | |
| 0x40a59d handletest_x86.exe|mov ecx, edx|edx=0x666841b4 | |
| 0x40a59f handletest_x86.exe|xor edx, eax|edx=0x666841b4|eax=0x9f6f2edb | |
| 0x40a5a1 handletest_x86.exe|and ecx, 0x1f|ecx=0x666841b4 | |
| 0x40a5a4 handletest_x86.exe|ror edx, cl|edx=0xf9076f6f|cl=0x14 | |
| 0x40a5a6 handletest_x86.exe|cmp edx, edi|edx=0x76f6ff90|edi=0xffffffff | |
| 0x40a5a8 handletest_x86.exe|jne 0x40a5ae|eflags=0x213 | |
| 0x40a5ae handletest_x86.exe|test edx, edx|edx=0x76f6ff90 | |
| 0x40a5b0 handletest_x86.exe|je 0x40a5b6|eflags=0x206 | |
| 0x40a5b2 handletest_x86.exe|mov eax, edx|edx=0x76f6ff90 | |
| 0x40a5b4 handletest_x86.exe|jmp 0x40a5ff | |
| 0x40a5ff handletest_x86.exe|pop edi|edi=0xffffffff|esp=0x19fe0c | |
| 0x40a600 handletest_x86.exe|pop ebx|ebx=0x41f280|esp=0x19fe10 | |
| 0x40a601 handletest_x86.exe|pop ebp|ebp=0x19fe14|esp=0x19fe14 | |
| 0x40a602 handletest_x86.exe|ret|esp=0x19fe18 | |
| 0x40a759 handletest_x86.exe|mov esi, eax|eax=0x76f6ff90 | |
| 0x40a75b handletest_x86.exe|add esp, 0x10|esp=0x19fe1c | |
| 0x40a75e handletest_x86.exe|test esi, esi|esi=0x76f6ff90 | |
| 0x40a760 handletest_x86.exe|je 0x40a774|eflags=0x206 | |
| 0x40a762 handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fe30|esp=0x19fe2c | |
| 0x40a765 handletest_x86.exe|mov ecx, esi|esi=0x76f6ff90 | |
| 0x40a767 handletest_x86.exe|call dword ptr [0x41711c]|esp=0x19fe28 | |
| 0x401af7 handletest_x86.exe|ret 0|esp=0x19fe24 | |
| 0x40a76d handletest_x86.exe|call esi|esi=0x76f6ff90|esp=0x19fe28 | |
| 0x76f6ff90 kernelbase.dll:FlsGetValue|mov edi, edi|edi=0x0 | |
| 0x76f6ff92 kernelbase.dll:FlsGetValue+0x2|push ebp|ebp=0x19fe30|esp=0x19fe24 | |
| 0x76f6ff93 kernelbase.dll:FlsGetValue+0x3|mov ebp, esp|esp=0x19fe20 | |
| 0x76f6ff95 kernelbase.dll:FlsGetValue+0x5|push ecx|ecx=0x76f6ff90|esp=0x19fe20 | |
| 0x76f6ff96 kernelbase.dll:FlsGetValue+0x6|push esi|esi=0x76f6ff90|esp=0x19fe1c | |
| 0x76f6ff97 kernelbase.dll:FlsGetValue+0x7|mov esi, dword ptr fs:[0x18] | |
| 0x76f6ff9e kernelbase.dll:FlsGetValue+0xe|lea eax, [ebp - 4]|ebp=0x19fe20 | |
| 0x76f6ffa1 kernelbase.dll:FlsGetValue+0x11|push eax|eax=0x19fe1c|esp=0x19fe18 | |
| 0x76f6ffa2 kernelbase.dll:FlsGetValue+0x12|push dword ptr [ebp + 8]|ebp=0x19fe20|esp=0x19fe14 | |
| 0x76f6ffa5 kernelbase.dll:FlsGetValue+0x15|call dword ptr [0x7706996c]|esp=0x19fe10 | |
| 0x771bc670 ntdll.dll:RtlFlsGetValue|mov edi, edi|edi=0x0 | |
| 0x771bc672 ntdll.dll:RtlFlsGetValue+0x2|push ebp|ebp=0x19fe20|esp=0x19fe0c | |
| 0x771bc673 ntdll.dll:RtlFlsGetValue+0x3|mov ebp, esp|esp=0x19fe08 | |
| 0x771bc675 ntdll.dll:RtlFlsGetValue+0x5|mov eax, dword ptr fs:[0x18] | |
| 0x771bc67b ntdll.dll:RtlFlsGetValue+0xb|mov ecx, dword ptr [eax + 0xfb4]|eax=0x2a6000 | |
| 0x771bc681 ntdll.dll:RtlFlsGetValue+0x11|mov eax, dword ptr [ebp + 8]|ebp=0x19fe08 | |
| 0x771bc684 ntdll.dll:RtlFlsGetValue+0x14|test eax, eax|eax=0x2 | |
| 0x771bc686 ntdll.dll:RtlFlsGetValue+0x16|je 0x771bc6c4|eflags=0x202 | |
| 0x771bc688 ntdll.dll:RtlFlsGetValue+0x18|cmp eax, 0xff0|eax=0x2 | |
| 0x771bc68d ntdll.dll:RtlFlsGetValue+0x1d|jae 0x771bc6c4|eflags=0x287 | |
| 0x771bc68f ntdll.dll:RtlFlsGetValue+0x1f|test ecx, ecx|ecx=0x826710 | |
| 0x771bc691 ntdll.dll:RtlFlsGetValue+0x21|jne 0x771bc69a|eflags=0x202 | |
| 0x771bc69a ntdll.dll:RtlFlsGetValue+0x2a|push esi|esi=0x2a6000|esp=0x19fe08 | |
| 0x771bc69b ntdll.dll:RtlFlsGetValue+0x2b|lea esi, [eax + 0x10]|eax=0x2 | |
| 0x771bc69e ntdll.dll:RtlFlsGetValue+0x2e|xor edx, edx|edx=0x76f6ff90 | |
| 0x771bc6a0 ntdll.dll:RtlFlsGetValue+0x30|bsr eax, esi|eax=0x2|esi=0x12 | |
| 0x771bc6a3 ntdll.dll:RtlFlsGetValue+0x33|btc esi, eax|esi=0x12|eax=0x4 | |
| 0x771bc6a6 ntdll.dll:RtlFlsGetValue+0x36|mov eax, dword ptr [ecx + eax*4 - 8]|ecx=0x826710|eax=0x4 | |
| 0x771bc6aa ntdll.dll:RtlFlsGetValue+0x3a|test eax, eax|eax=0x827b18 | |
| 0x771bc6ac ntdll.dll:RtlFlsGetValue+0x3c|je 0x771bc6ba|eflags=0x206 | |
| 0x771bc6ae ntdll.dll:RtlFlsGetValue+0x3e|lea eax, [eax + esi*4]|eax=0x827b18|esi=0x2 | |
| 0x771bc6b1 ntdll.dll:RtlFlsGetValue+0x41|add eax, 4|eax=0x827b20 | |
| 0x771bc6b4 ntdll.dll:RtlFlsGetValue+0x44|je 0x771bc6ba|eflags=0x206 | |
| 0x771bc6b6 ntdll.dll:RtlFlsGetValue+0x46|mov eax, dword ptr [eax]|eax=0x827b24 | |
| 0x771bc6b8 ntdll.dll:RtlFlsGetValue+0x48|jmp 0x771bc6bc | |
| 0x771bc6bc ntdll.dll:RtlFlsGetValue+0x4c|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19fe08 | |
| 0x771bc6bf ntdll.dll:RtlFlsGetValue+0x4f|pop esi|esi=0x2|esp=0x19fe04 | |
| 0x771bc6c0 ntdll.dll:RtlFlsGetValue+0x50|mov dword ptr [ecx], eax|ecx=0x19fe1c|eax=0x827b68 | |
| 0x771bc6c2 ntdll.dll:RtlFlsGetValue+0x52|jmp 0x771bc6c9 | |
| 0x771bc6c9 ntdll.dll:RtlFlsGetValue+0x59|mov eax, edx|edx=0x0 | |
| 0x771bc6cb ntdll.dll:RtlFlsGetValue+0x5b|pop ebp|ebp=0x19fe08|esp=0x19fe08 | |
| 0x771bc6cc ntdll.dll:RtlFlsGetValue+0x5c|ret 8|esp=0x19fe0c | |
| 0x76f6ffab kernelbase.dll:FlsGetValue+0x1b|test eax, eax|eax=0x0 | |
| 0x76f6ffad kernelbase.dll:FlsGetValue+0x1d|jns 0x76f6ffcb|eflags=0x246 | |
| 0x76f6ffcb kernelbase.dll:FlsGetValue+0x3b|mov dword ptr [esi + 0x34], 0|esi=0x2a6000 | |
| 0x76f6ffd2 kernelbase.dll:FlsGetValue+0x42|mov eax, dword ptr [ebp - 4]|ebp=0x19fe20 | |
| 0x76f6ffd5 kernelbase.dll:FlsGetValue+0x45|pop esi|esi=0x2a6000|esp=0x19fe18 | |
| 0x76f6ffd6 kernelbase.dll:FlsGetValue+0x46|mov esp, ebp|ebp=0x19fe20 | |
| 0x76f6ffd8 kernelbase.dll:FlsGetValue+0x48|pop ebp|ebp=0x19fe20|esp=0x19fe20 | |
| 0x76f6ffd9 kernelbase.dll:FlsGetValue+0x49|ret 4|esp=0x19fe24 | |
| 0x40a76f handletest_x86.exe|pop esi|esi=0x76f6ff90|esp=0x19fe2c | |
| 0x40a770 handletest_x86.exe|pop ebp|ebp=0x19fe30|esp=0x19fe30 | |
| 0x40a771 handletest_x86.exe|ret 4|esp=0x19fe34 | |
| 0x409199 handletest_x86.exe|mov esi, eax|eax=0x827b68 | |
| 0x40919b handletest_x86.exe|test esi, esi|esi=0x827b68 | |
| 0x40919d handletest_x86.exe|je 0x4091a6|eflags=0x202 | |
| 0x40919f handletest_x86.exe|cmp esi, -1|esi=0x827b68 | |
| 0x4091a2 handletest_x86.exe|je 0x40921d|eflags=0x217 | |
| 0x4091a4 handletest_x86.exe|jmp 0x409214 | |
| 0x409214 handletest_x86.exe|imul edi, dword ptr [ebp + 0xc], 0x364|edi=0x0|ebp=0x19fe44 | |
| 0x40921b handletest_x86.exe|add edi, esi|edi=0x0|esi=0x827b68 | |
| 0x40921d handletest_x86.exe|mov eax, edi|edi=0x827b68 | |
| 0x40921f handletest_x86.exe|pop edi|edi=0x827b68|esp=0x19fe3c | |
| 0x409220 handletest_x86.exe|pop esi|esi=0x827b68|esp=0x19fe40 | |
| 0x409221 handletest_x86.exe|pop ebp|ebp=0x19fe44|esp=0x19fe44 | |
| 0x409222 handletest_x86.exe|ret|esp=0x19fe48 | |
| 0x404953 handletest_x86.exe|pop ecx|ecx=0x19fe1c|esp=0x19fe4c | |
| 0x404954 handletest_x86.exe|pop ecx|ecx=0x19fe5c|esp=0x19fe50 | |
| 0x404955 handletest_x86.exe|push dword ptr [ebp - 4]|ebp=0x19fe60|esp=0x19fe54 | |
| 0x404958 handletest_x86.exe|mov esi, eax|eax=0x827b68 | |
| 0x40495a handletest_x86.exe|mov dword ptr [edi], esi|edi=0x19fe80|esi=0x827b68 | |
| 0x40495c handletest_x86.exe|call dword ptr [0x41703c]|esp=0x19fe50 | |
| 0x75c54560 kernel32.dll:SetLastError|jmp dword ptr [0x75cc1d30] | |
| 0x7718b6c0 ntdll.dll:RtlRestoreLastWin32Error|mov edi, edi|edi=0x19fe80 | |
| 0x7718b6c2 ntdll.dll:RtlRestoreLastWin32Error+0x2|push ebp|ebp=0x19fe60|esp=0x19fe4c | |
| 0x7718b6c3 ntdll.dll:RtlRestoreLastWin32Error+0x3|mov ebp, esp|esp=0x19fe48 | |
| 0x7718b6c5 ntdll.dll:RtlRestoreLastWin32Error+0x5|and esp, 0xfffffff8|esp=0x19fe48 | |
| 0x7718b6c8 ntdll.dll:RtlRestoreLastWin32Error+0x8|sub esp, 0x18|esp=0x19fe48 | |
| 0x7718b6cb ntdll.dll:RtlRestoreLastWin32Error+0xb|mov eax, dword ptr [0x7725e360] | |
| 0x7718b6d0 ntdll.dll:RtlRestoreLastWin32Error+0x10|xor eax, esp|eax=0xf9e0af5e|esp=0x19fe30 | |
| 0x7718b6d2 ntdll.dll:RtlRestoreLastWin32Error+0x12|mov dword ptr [esp + 0x14], eax|esp=0x19fe30|eax=0xf9f9516e | |
| 0x7718b6d6 ntdll.dll:RtlRestoreLastWin32Error+0x16|mov eax, dword ptr fs:[0x18] | |
| 0x7718b6dc ntdll.dll:RtlRestoreLastWin32Error+0x1c|mov edx, dword ptr [0x7725b728] | |
| 0x7718b6e2 ntdll.dll:RtlRestoreLastWin32Error+0x22|mov ecx, dword ptr [ebp + 8]|ebp=0x19fe48 | |
| 0x7718b6e5 ntdll.dll:RtlRestoreLastWin32Error+0x25|test edx, edx|edx=0x0 | |
| 0x7718b6e7 ntdll.dll:RtlRestoreLastWin32Error+0x27|jne 0x7718b71e|eflags=0x246 | |
| 0x7718b6e9 ntdll.dll:RtlRestoreLastWin32Error+0x29|cmp dword ptr [eax + 0x34], ecx|eax=0x2a6000|ecx=0x0 | |
| 0x7718b6ec ntdll.dll:RtlRestoreLastWin32Error+0x2c|jne 0x7718b6ff|eflags=0x246 | |
| 0x7718b6ee ntdll.dll:RtlRestoreLastWin32Error+0x2e|mov ecx, dword ptr [esp + 0x14]|esp=0x19fe30 | |
| 0x7718b6f2 ntdll.dll:RtlRestoreLastWin32Error+0x32|xor ecx, esp|ecx=0xf9f9516e|esp=0x19fe30 | |
| 0x7718b6f4 ntdll.dll:RtlRestoreLastWin32Error+0x34|call 0x771a6de0|esp=0x19fe30|eip=0x7718b6f4 | |
| 0x771a6de0 ntdll.dll:RtlRetrieveNtUserPfn+0x110|cmp ecx, dword ptr [0x7725e360]|ecx=0xf9e0af5e | |
| 0x771a6de6 ntdll.dll:RtlRetrieveNtUserPfn+0x116|jne 0x771a6deb|eflags=0x246 | |
| 0x771a6de8 ntdll.dll:RtlRetrieveNtUserPfn+0x118|ret 0|esp=0x19fe2c | |
| 0x7718b6f9 ntdll.dll:RtlRestoreLastWin32Error+0x39|mov esp, ebp|ebp=0x19fe48 | |
| 0x7718b6fb ntdll.dll:RtlRestoreLastWin32Error+0x3b|pop ebp|ebp=0x19fe48|esp=0x19fe48 | |
| 0x7718b6fc ntdll.dll:RtlRestoreLastWin32Error+0x3c|ret 4|esp=0x19fe4c | |
| 0x404962 handletest_x86.exe|pop edi|edi=0x19fe80|esp=0x19fe54 | |
| 0x404963 handletest_x86.exe|mov eax, esi|esi=0x827b68 | |
| 0x404965 handletest_x86.exe|pop esi|esi=0x827b68|esp=0x19fe58 | |
| 0x404966 handletest_x86.exe|leave|ebp=0x19fe60|esp=0x19fe5c | |
| 0x404967 handletest_x86.exe|ret|esp=0x19fe64 | |
| 0x404977 handletest_x86.exe|test eax, eax|eax=0x827b68 | |
| 0x404979 handletest_x86.exe|je 0x40497f|eflags=0x202 | |
| 0x40497b handletest_x86.exe|mov eax, dword ptr [esi]|esi=0x19fe80 | |
| 0x40497d handletest_x86.exe|pop esi|esi=0x19fe80|esp=0x19fe68 | |
| 0x40497e handletest_x86.exe|ret|esp=0x19fe6c | |
| 0x40454e handletest_x86.exe|mov dword ptr [eax + 0x10], esi|eax=0x827b68|esi=0x1c | |
| 0x404551 handletest_x86.exe|cmp byte ptr [edi + 0x24], 0|edi=0x19fe80 | |
| 0x404555 handletest_x86.exe|je 0x404564|eflags=0x202 | |
| 0x404557 handletest_x86.exe|mov esi, dword ptr [edi + 0x20]|edi=0x19fe80 | |
| 0x40455a handletest_x86.exe|mov ecx, edi|edi=0x19fe80 | |
| 0x40455c handletest_x86.exe|call 0x404968|esp=0x19fe70|eip=0x40455c | |
| 0x404968 handletest_x86.exe|mov edi, edi|edi=0x19fe80 | |
| 0x40496a handletest_x86.exe|push esi|esi=0x0|esp=0x19fe6c | |
| 0x40496b handletest_x86.exe|mov esi, ecx|ecx=0x19fe80 | |
| 0x40496d handletest_x86.exe|cmp dword ptr [esi], 0|esi=0x19fe80 | |
| 0x404970 handletest_x86.exe|jne 0x40497b|eflags=0x202 | |
| 0x40497b handletest_x86.exe|mov eax, dword ptr [esi]|esi=0x19fe80 | |
| 0x40497d handletest_x86.exe|pop esi|esi=0x19fe80|esp=0x19fe68 | |
| 0x40497e handletest_x86.exe|ret|esp=0x19fe6c | |
| 0x404561 handletest_x86.exe|mov dword ptr [eax + 0x14], esi|eax=0x827b68|esi=0x0 | |
| 0x404564 handletest_x86.exe|pop edi|edi=0x19fe80|esp=0x19fe70 | |
| 0x404565 handletest_x86.exe|pop esi|esi=0x0|esp=0x19fe74 | |
| 0x404566 handletest_x86.exe|ret|esp=0x19fe78 | |
| 0x406c6d handletest_x86.exe|mov eax, esi|esi=0x14 | |
| 0x406c6f handletest_x86.exe|pop esi|esi=0x14|esp=0x19fe7c | |
| 0x406c70 handletest_x86.exe|leave|ebp=0x19fedc|esp=0x19fe80 | |
| 0x406c71 handletest_x86.exe|ret|esp=0x19fee0 | |
| 0x401034 handletest_x86.exe|add esp, 0x18|esp=0x19fee4 | |
| 0x401037 handletest_x86.exe|pop ebp|ebp=0x19fefc|esp=0x19fefc | |
| 0x401038 handletest_x86.exe|ret|esp=0x19ff00 | |
| 0x4010a6 handletest_x86.exe|add esp, 0x10|esp=0x19ff04 | |
| 0x4010a9 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19ff1c|eax=0x14 | |
| 0x4010ac handletest_x86.exe|mov dword ptr [ebp - 4], 0|ebp=0x19ff1c | |
| 0x4010b3 handletest_x86.exe|mov eax, dword ptr [ebp - 8]|ebp=0x19ff1c | |
| 0x4010b6 handletest_x86.exe|mov esp, ebp|ebp=0x19ff1c | |
| 0x4010b8 handletest_x86.exe|pop ebp|ebp=0x19ff1c|esp=0x19ff1c | |
| 0x4010b9 handletest_x86.exe|ret|esp=0x19ff20 | |
| 0x4010cd handletest_x86.exe|add esp, 4|esp=0x19ff24 | |
| 0x4010d0 handletest_x86.exe|pop ebp|ebp=0x19ff28|esp=0x19ff28 | |
| 0x4010d1 handletest_x86.exe|ret|esp=0x19ff2c | |
| 0x4010e0 handletest_x86.exe|push ebp|ebp=0x19ff74|esp=0x19ff2c | |
| 0x4010e1 handletest_x86.exe|mov ebp, esp|esp=0x19ff28 | |
| 0x4010e3 handletest_x86.exe|sub esp, 0xc|esp=0x19ff28 | |
| 0x4010e6 handletest_x86.exe|mov dword ptr [ebp - 4], 0|ebp=0x19ff28 | |
| 0x4010ed handletest_x86.exe|mov dword ptr [ebp - 8], 0|ebp=0x19ff28 | |
| 0x4010f4 handletest_x86.exe|push 0x41e9b8|esp=0x19ff1c | |
| 0x4010f9 handletest_x86.exe|push 0x41e9a8|esp=0x19ff18 | |
| 0x4010fe handletest_x86.exe|call 0x404a77|esp=0x19ff14|eip=0x4010fe | |
| 0x404a77 handletest_x86.exe|mov edi, edi|edi=0x828fc0 | |
| 0x404a79 handletest_x86.exe|push ebp|ebp=0x19ff28|esp=0x19ff10 | |
| 0x404a7a handletest_x86.exe|mov ebp, esp|esp=0x19ff0c | |
| 0x404a7c handletest_x86.exe|push 0x40|esp=0x19ff0c | |
| 0x404a7e handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19ff0c|esp=0x19ff08 | |
| 0x404a81 handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19ff0c|esp=0x19ff04 | |
| 0x404a84 handletest_x86.exe|call 0x4049c0|esp=0x19ff00|eip=0x404a84 | |
| 0x4049c0 handletest_x86.exe|push 0x10|esp=0x19fefc | |
| 0x4049c2 handletest_x86.exe|push 0x41d058|esp=0x19fef8 | |
| 0x4049c7 handletest_x86.exe|call 0x401d60|esp=0x19fef4|eip=0x4049c7 | |
| 0x401d60 handletest_x86.exe|push 0x401fd0|esp=0x19fef0 | |
| 0x401d65 handletest_x86.exe|push dword ptr fs:[0]|esp=0x19feec | |
| 0x401d6c handletest_x86.exe|mov eax, dword ptr [esp + 0x10]|esp=0x19fee8 | |
| 0x401d70 handletest_x86.exe|mov dword ptr [esp + 0x10], ebp|esp=0x19fee8|ebp=0x19ff0c | |
| 0x401d74 handletest_x86.exe|lea ebp, [esp + 0x10]|esp=0x19fee8 | |
| 0x401d78 handletest_x86.exe|sub esp, eax|esp=0x19fee8|eax=0x10 | |
| 0x401d7a handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fed8 | |
| 0x401d7b handletest_x86.exe|push esi|esi=0x828f90|esp=0x19fed4 | |
| 0x401d7c handletest_x86.exe|push edi|edi=0x828fc0|esp=0x19fed0 | |
| 0x401d7d handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x401d82 handletest_x86.exe|xor dword ptr [ebp - 4], eax|ebp=0x19fef8|eax=0x666841b4 | |
| 0x401d85 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19fef8 | |
| 0x401d87 handletest_x86.exe|push eax|eax=0x6671bf4c|esp=0x19fecc | |
| 0x401d88 handletest_x86.exe|mov dword ptr [ebp - 0x18], esp|ebp=0x19fef8|esp=0x19fec8 | |
| 0x401d8b handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19fef8|esp=0x19fec8 | |
| 0x401d8e handletest_x86.exe|mov eax, dword ptr [ebp - 4]|ebp=0x19fef8 | |
| 0x401d91 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fef8 | |
| 0x401d98 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19fef8|eax=0x662991ec | |
| 0x401d9b handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19fef8 | |
| 0x401d9e handletest_x86.exe|mov dword ptr fs:[0], eax|eax=0x19fee8 | |
| 0x401da4 handletest_x86.exe|ret|esp=0x19fec4 | |
| 0x4049cc handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19fef8 | |
| 0x4049cf handletest_x86.exe|test esi, esi|esi=0x41e9a8 | |
| 0x4049d1 handletest_x86.exe|jne 0x4049e7|eflags=0x202 | |
| 0x4049e7 handletest_x86.exe|mov edi, dword ptr [ebp + 0xc]|ebp=0x19fef8 | |
| 0x4049ea handletest_x86.exe|test edi, edi|edi=0x41e9b8 | |
| 0x4049ec handletest_x86.exe|je 0x4049d3|eflags=0x206 | |
| 0x4049ee handletest_x86.exe|cmp byte ptr [edi], 0|edi=0x41e9b8 | |
| 0x4049f1 handletest_x86.exe|je 0x4049d3|eflags=0x206 | |
| 0x4049f3 handletest_x86.exe|cmp byte ptr [esi], 0|esi=0x41e9a8 | |
| 0x4049f6 handletest_x86.exe|jne 0x404a05|eflags=0x206 | |
| 0x404a05 handletest_x86.exe|lea eax, [ebp - 0x1c]|ebp=0x19fef8 | |
| 0x404a08 handletest_x86.exe|push eax|eax=0x19fedc|esp=0x19fec8 | |
| 0x404a09 handletest_x86.exe|call 0x409e84|esp=0x19fec4|eip=0x404a09 | |
| 0x409e84 handletest_x86.exe|push 0xc|esp=0x19fec0 | |
| 0x409e86 handletest_x86.exe|push 0x41d380|esp=0x19febc | |
| 0x409e8b handletest_x86.exe|call 0x401d60|esp=0x19feb8|eip=0x409e8b | |
| 0x401d60 handletest_x86.exe|push 0x401fd0|esp=0x19feb4 | |
| 0x401d65 handletest_x86.exe|push dword ptr fs:[0]|esp=0x19feb0 | |
| 0x401d6c handletest_x86.exe|mov eax, dword ptr [esp + 0x10]|esp=0x19feac | |
| 0x401d70 handletest_x86.exe|mov dword ptr [esp + 0x10], ebp|esp=0x19feac|ebp=0x19fef8 | |
| 0x401d74 handletest_x86.exe|lea ebp, [esp + 0x10]|esp=0x19feac | |
| 0x401d78 handletest_x86.exe|sub esp, eax|esp=0x19feac|eax=0xc | |
| 0x401d7a handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fea0 | |
| 0x401d7b handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fe9c | |
| 0x401d7c handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fe98 | |
| 0x401d7d handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x401d82 handletest_x86.exe|xor dword ptr [ebp - 4], eax|ebp=0x19febc|eax=0x666841b4 | |
| 0x401d85 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19febc | |
| 0x401d87 handletest_x86.exe|push eax|eax=0x6671bf08|esp=0x19fe94 | |
| 0x401d88 handletest_x86.exe|mov dword ptr [ebp - 0x18], esp|ebp=0x19febc|esp=0x19fe90 | |
| 0x401d8b handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19febc|esp=0x19fe90 | |
| 0x401d8e handletest_x86.exe|mov eax, dword ptr [ebp - 4]|ebp=0x19febc | |
| 0x401d91 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19febc | |
| 0x401d98 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19febc|eax=0x66299234 | |
| 0x401d9b handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19febc | |
| 0x401d9e handletest_x86.exe|mov dword ptr fs:[0], eax|eax=0x19feac | |
| 0x401da4 handletest_x86.exe|ret|esp=0x19fe8c | |
| 0x409e90 handletest_x86.exe|xor edi, edi|edi=0x41e9b8 | |
| 0x409e92 handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19febc | |
| 0x409e95 handletest_x86.exe|mov dword ptr [esi], edi|esi=0x19fedc|edi=0x0 | |
| 0x409e97 handletest_x86.exe|push 8|esp=0x19fe90 | |
| 0x409e99 handletest_x86.exe|call 0x40dbbb|esp=0x19fe8c|eip=0x409e99 | |
| 0x40dbbb handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x40dbbd handletest_x86.exe|push ebp|ebp=0x19febc|esp=0x19fe88 | |
| 0x40dbbe handletest_x86.exe|mov ebp, esp|esp=0x19fe84 | |
| 0x40dbc0 handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x18|eax=0x19feac|ebp=0x19fe84 | |
| 0x40dbc4 handletest_x86.exe|add eax, 0x41f2b0|eax=0xc0 | |
| 0x40dbc9 handletest_x86.exe|push eax|eax=0x41f370|esp=0x19fe84 | |
| 0x40dbca handletest_x86.exe|call dword ptr [0x417040]|esp=0x19fe80 | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x0 | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19fe84|esp=0x19fe7c | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fe78 | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19fe78 | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19fe78 | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x41f370 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x41f374 | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa07 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x41f370|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x41f370 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19fe78 | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19fe78|esp=0x19fe78 | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19fe7c | |
| 0x40dbd0 handletest_x86.exe|pop ebp|ebp=0x19fe84|esp=0x19fe84 | |
| 0x40dbd1 handletest_x86.exe|ret|esp=0x19fe88 | |
| 0x409e9e handletest_x86.exe|pop ecx|ecx=0x41f370|esp=0x19fe8c | |
| 0x409e9f handletest_x86.exe|mov dword ptr [ebp - 4], edi|ebp=0x19febc|edi=0x0 | |
| 0x409ea2 handletest_x86.exe|lea eax, [ebp - 0x1c]|ebp=0x19febc | |
| 0x409ea5 handletest_x86.exe|push eax|eax=0x19fea0|esp=0x19fe90 | |
| 0x409ea6 handletest_x86.exe|call 0x409f28|esp=0x19fe8c|eip=0x409ea6 | |
| 0x409f28 handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x409f2a handletest_x86.exe|push ebp|ebp=0x19febc|esp=0x19fe88 | |
| 0x409f2b handletest_x86.exe|mov ebp, esp|esp=0x19fe84 | |
| 0x409f2d handletest_x86.exe|push ecx|ecx=0x8|esp=0x19fe84 | |
| 0x409f2e handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fe80 | |
| 0x409f2f handletest_x86.exe|mov ebx, dword ptr [0x41ee2c] | |
| 0x409f35 handletest_x86.exe|push esi|esi=0x19fedc|esp=0x19fe7c | |
| 0x409f36 handletest_x86.exe|push edi|edi=0x0|esp=0x19fe78 | |
| 0x409f37 handletest_x86.exe|mov edi, dword ptr [0x41ee30] | |
| 0x409f3d handletest_x86.exe|add edi, 0xc|edi=0x8297a8 | |
| 0x409f40 handletest_x86.exe|add ebx, -3|ebx=0x200 | |
| 0x409f43 handletest_x86.exe|lea ebx, [edi + ebx*4]|edi=0x8297b4|ebx=0x1fd | |
| 0x409f46 handletest_x86.exe|mov dword ptr [ebp - 4], ebx|ebp=0x19fe84|ebx=0x829fa8 | |
| 0x409f49 handletest_x86.exe|jmp 0x409f8d | |
| 0x409f8d handletest_x86.exe|cmp edi, ebx|edi=0x8297b4|ebx=0x829fa8 | |
| 0x409f8f handletest_x86.exe|jne 0x409f4b|eflags=0x297 | |
| 0x409f4b handletest_x86.exe|mov esi, dword ptr [edi]|edi=0x8297b4 | |
| 0x409f4d handletest_x86.exe|test esi, esi|esi=0x0 | |
| 0x409f4f handletest_x86.exe|je 0x409fa3|eflags=0x246 | |
| 0x409fa3 handletest_x86.exe|push 0x38|esp=0x19fe74 | |
| 0x409fa5 handletest_x86.exe|push 1|esp=0x19fe70 | |
| 0x409fa7 handletest_x86.exe|call 0x40a3b6|esp=0x19fe6c|eip=0x409fa7 | |
| 0x40a3b6 handletest_x86.exe|mov edi, edi|edi=0x8297b4 | |
| 0x40a3b8 handletest_x86.exe|push ebp|ebp=0x19fe84|esp=0x19fe68 | |
| 0x40a3b9 handletest_x86.exe|mov ebp, esp|esp=0x19fe64 | |
| 0x40a3bb handletest_x86.exe|push esi|esi=0x0|esp=0x19fe64 | |
| 0x40a3bc handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19fe64 | |
| 0x40a3bf handletest_x86.exe|test esi, esi|esi=0x1 | |
| 0x40a3c1 handletest_x86.exe|je 0x40a3cf|eflags=0x202 | |
| 0x40a3c3 handletest_x86.exe|push -0x20|esp=0x19fe60 | |
| 0x40a3c5 handletest_x86.exe|xor edx, edx|edx=0x2a6000 | |
| 0x40a3c7 handletest_x86.exe|pop eax|eax=0x19fea0|esp=0x19fe5c | |
| 0x40a3c8 handletest_x86.exe|div esi|esi=0x1|eax=0xffffffe0|edx=0x0 | |
| 0x40a3ca handletest_x86.exe|cmp eax, dword ptr [ebp + 0xc]|eax=0xffffffe0|ebp=0x19fe64 | |
| 0x40a3cd handletest_x86.exe|jb 0x40a403|eflags=0x292 | |
| 0x40a3cf handletest_x86.exe|imul esi, dword ptr [ebp + 0xc]|esi=0x1|ebp=0x19fe64 | |
| 0x40a3d3 handletest_x86.exe|test esi, esi|esi=0x38 | |
| 0x40a3d5 handletest_x86.exe|jne 0x40a3ee|eflags=0x202 | |
| 0x40a3ee handletest_x86.exe|push esi|esi=0x38|esp=0x19fe60 | |
| 0x40a3ef handletest_x86.exe|push 8|esp=0x19fe5c | |
| 0x40a3f1 handletest_x86.exe|push dword ptr [0x41f410]|esp=0x19fe58 | |
| 0x40a3f7 handletest_x86.exe|call dword ptr [0x4170a4]|esp=0x19fe54 | |
| 0x77174cf0 ntdll.dll:RtlAllocateHeap|mov edi, edi|edi=0x8297b4 | |
| 0x77174cf2 ntdll.dll:RtlAllocateHeap+0x2|push ebp|ebp=0x19fe64|esp=0x19fe50 | |
| 0x77174cf3 ntdll.dll:RtlAllocateHeap+0x3|mov ebp, esp|esp=0x19fe4c | |
| 0x77174cf5 ntdll.dll:RtlAllocateHeap+0x5|and esp, 0xfffffff8|esp=0x19fe4c | |
| 0x77174cf8 ntdll.dll:RtlAllocateHeap+0x8|push ecx|ecx=0x8|esp=0x19fe48 | |
| 0x77174cf9 ntdll.dll:RtlAllocateHeap+0x9|push esi|esi=0x38|esp=0x19fe44 | |
| 0x77174cfa ntdll.dll:RtlAllocateHeap+0xa|mov esi, dword ptr [ebp + 8]|ebp=0x19fe4c | |
| 0x77174cfd ntdll.dll:RtlAllocateHeap+0xd|test esi, esi|esi=0x820000 | |
| 0x77174cff ntdll.dll:RtlAllocateHeap+0xf|je 0x771d332b|eflags=0x206 | |
| 0x77174d05 ntdll.dll:RtlAllocateHeap+0x15|cmp dword ptr [esi + 8], 0xddeeddee|esi=0x820000 | |
| 0x77174d0c ntdll.dll:RtlAllocateHeap+0x1c|mov ecx, esi|esi=0x820000 | |
| 0x77174d0e ntdll.dll:RtlAllocateHeap+0x1e|mov edx, dword ptr [ebp + 0x10]|ebp=0x19fe4c | |
| 0x77174d11 ntdll.dll:RtlAllocateHeap+0x21|je 0x771d3342|eflags=0x206 | |
| 0x77174d17 ntdll.dll:RtlAllocateHeap+0x27|test byte ptr [0x77259164], 2 | |
| 0x77174d1e ntdll.dll:RtlAllocateHeap+0x2e|jne 0x771d334f|eflags=0x246 | |
| 0x77174d24 ntdll.dll:RtlAllocateHeap+0x34|push 0|esp=0x19fe40 | |
| 0x77174d26 ntdll.dll:RtlAllocateHeap+0x36|push dword ptr [ebp + 0xc]|ebp=0x19fe4c|esp=0x19fe3c | |
| 0x77174d29 ntdll.dll:RtlAllocateHeap+0x39|call 0x77174d40|esp=0x19fe38|eip=0x77174d29 | |
| 0x77174d40 ntdll.dll:RtlAllocateHeap+0x50|mov edi, edi|edi=0x8297b4 | |
| 0x77174d42 ntdll.dll:RtlAllocateHeap+0x52|push ebp|ebp=0x19fe4c|esp=0x19fe34 | |
| 0x77174d43 ntdll.dll:RtlAllocateHeap+0x53|mov ebp, esp|esp=0x19fe30 | |
| 0x77174d45 ntdll.dll:RtlAllocateHeap+0x55|sub esp, 0x6c|esp=0x19fe30 | |
| 0x77174d48 ntdll.dll:RtlAllocateHeap+0x58|push ebx|ebx=0x829fa8|esp=0x19fdc4 | |
| 0x77174d49 ntdll.dll:RtlAllocateHeap+0x59|mov ebx, ecx|ecx=0x820000 | |
| 0x77174d4b ntdll.dll:RtlAllocateHeap+0x5b|mov ecx, dword ptr [ebp + 8]|ebp=0x19fe30 | |
| 0x77174d4e ntdll.dll:RtlAllocateHeap+0x5e|push esi|esi=0x820000|esp=0x19fdc0 | |
| 0x77174d4f ntdll.dll:RtlAllocateHeap+0x5f|push edi|edi=0x8297b4|esp=0x19fdbc | |
| 0x77174d50 ntdll.dll:RtlAllocateHeap+0x60|mov edi, edx|edx=0x38 | |
| 0x77174d52 ntdll.dll:RtlAllocateHeap+0x62|mov dword ptr [ebp - 0xc], ebx|ebp=0x19fe30|ebx=0x820000 | |
| 0x77174d55 ntdll.dll:RtlAllocateHeap+0x65|cmp dword ptr [ebx + 8], 0xddeeddee|ebx=0x820000 | |
| 0x77174d5c ntdll.dll:RtlAllocateHeap+0x6c|mov dword ptr [ebp - 0x14], edi|ebp=0x19fe30|edi=0x38 | |
| 0x77174d5f ntdll.dll:RtlAllocateHeap+0x6f|jne 0x77174e49|eflags=0x206 | |
| 0x77174e49 ntdll.dll:RtlAllocateHeap+0x159|mov eax, dword ptr [ebx + 0x44]|ebx=0x820000 | |
| 0x77174e4c ntdll.dll:RtlAllocateHeap+0x15c|or ecx, eax|ecx=0x8|eax=0x0 | |
| 0x77174e4e ntdll.dll:RtlAllocateHeap+0x15e|mov dword ptr [ebp - 0x2c], 0|ebp=0x19fe30 | |
| 0x77174e55 ntdll.dll:RtlAllocateHeap+0x165|mov dword ptr [ebp - 0x10], ecx|ebp=0x19fe30|ecx=0x8 | |
| 0x77174e58 ntdll.dll:RtlAllocateHeap+0x168|mov dword ptr [ebp - 0x30], 0|ebp=0x19fe30 | |
| 0x77174e5f ntdll.dll:RtlAllocateHeap+0x16f|mov dword ptr [ebp - 0x38], 0|ebp=0x19fe30 | |
| 0x77174e66 ntdll.dll:RtlAllocateHeap+0x176|cmp edi, 0x7fffffff|edi=0x38 | |
| 0x77174e6c ntdll.dll:RtlAllocateHeap+0x17c|jbe 0x77174e7a|eflags=0x297 | |
| 0x77174e7a ntdll.dll:RtlAllocateHeap+0x18a|and eax, 0x1000000|eax=0x0 | |
| 0x77174e7f ntdll.dll:RtlAllocateHeap+0x18f|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e81 ntdll.dll:RtlAllocateHeap+0x191|cmp dword ptr [0x772561f4], eax|eax=0x0 | |
| 0x77174e87 ntdll.dll:RtlAllocateHeap+0x197|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e89 ntdll.dll:RtlAllocateHeap+0x199|mov edx, dword ptr [ebx + 0xdc]|ebx=0x820000 | |
| 0x77174e8f ntdll.dll:RtlAllocateHeap+0x19f|mov ecx, edx|edx=0x0 | |
| 0x77174e91 ntdll.dll:RtlAllocateHeap+0x1a1|test ecx, ecx|ecx=0x0 | |
| 0x77174e93 ntdll.dll:RtlAllocateHeap+0x1a3|jne 0x77174e9f|eflags=0x246 | |
| 0x77174e95 ntdll.dll:RtlAllocateHeap+0x1a5|mov ecx, dword ptr [0x77259114] | |
| 0x77174e9b ntdll.dll:RtlAllocateHeap+0x1ab|test ecx, ecx|ecx=0x0 | |
| 0x77174e9d ntdll.dll:RtlAllocateHeap+0x1ad|je 0x77174eca|eflags=0x246 | |
| 0x77174eca ntdll.dll:RtlAllocateHeap+0x1da|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fe30 | |
| 0x77174ecd ntdll.dll:RtlAllocateHeap+0x1dd|mov esi, dword ptr [ebx + 0x58]|ebx=0x820000 | |
| 0x77174ed0 ntdll.dll:RtlAllocateHeap+0x1e0|mov dword ptr [ebp - 0x48], esi|ebp=0x19fe30|esi=0x0 | |
| 0x77174ed3 ntdll.dll:RtlAllocateHeap+0x1e3|test esi, esi|esi=0x0 | |
| 0x77174ed5 ntdll.dll:RtlAllocateHeap+0x1e5|je 0x77174f1c|eflags=0x246 | |
| 0x77174f1c ntdll.dll:RtlAllocateHeap+0x22c|mov eax, edi|edi=0x38 | |
| 0x77174f1e ntdll.dll:RtlAllocateHeap+0x22e|test edi, edi|edi=0x38 | |
| 0x77174f20 ntdll.dll:RtlAllocateHeap+0x230|jne 0x77174f27|eflags=0x202 | |
| 0x77174f27 ntdll.dll:RtlAllocateHeap+0x237|lea esi, [eax + 0xf]|eax=0x38 | |
| 0x77174f2a ntdll.dll:RtlAllocateHeap+0x23a|and esi, 0xfffffff8|esi=0x47 | |
| 0x77174f2d ntdll.dll:RtlAllocateHeap+0x23d|mov edx, esi|esi=0x40 | |
| 0x77174f2f ntdll.dll:RtlAllocateHeap+0x23f|mov dword ptr [ebp - 0x2c], esi|ebp=0x19fe30|esi=0x40 | |
| 0x77174f32 ntdll.dll:RtlAllocateHeap+0x242|shr edx, 3|edx=0x40 | |
| 0x77174f35 ntdll.dll:RtlAllocateHeap+0x245|test dword ptr [ebp - 0x10], 0x7d810f61|ebp=0x19fe30 | |
| 0x77174f3c ntdll.dll:RtlAllocateHeap+0x24c|mov dword ptr [ebp - 0x20], edx|ebp=0x19fe30|edx=0x8 | |
| 0x77174f3f ntdll.dll:RtlAllocateHeap+0x24f|jne 0x77175cf9|eflags=0x246 | |
| 0x77174f45 ntdll.dll:RtlAllocateHeap+0x255|cmp edi, dword ptr [0x77256ccc]|edi=0x38 | |
| 0x77174f4b ntdll.dll:RtlAllocateHeap+0x25b|ja 0x77175946|eflags=0x283 | |
| 0x77174f51 ntdll.dll:RtlAllocateHeap+0x261|mov eax, edx|edx=0x8 | |
| 0x77174f53 ntdll.dll:RtlAllocateHeap+0x263|shr eax, 3|eax=0x8 | |
| 0x77174f56 ntdll.dll:RtlAllocateHeap+0x266|mov dl, byte ptr [eax + ebx + 0xf2]|eax=0x1|ebx=0x820000 | |
| 0x77174f5d ntdll.dll:RtlAllocateHeap+0x26d|mov eax, dword ptr [ebp - 0x20]|ebp=0x19fe30 | |
| 0x77174f60 ntdll.dll:RtlAllocateHeap+0x270|movzx ecx, al|al=0x8 | |
| 0x77174f63 ntdll.dll:RtlAllocateHeap+0x273|mov eax, 1 | |
| 0x77174f68 ntdll.dll:RtlAllocateHeap+0x278|and ecx, 7|ecx=0x8 | |
| 0x77174f6b ntdll.dll:RtlAllocateHeap+0x27b|shl eax, cl|eax=0x1|cl=0x0 | |
| 0x77174f6d ntdll.dll:RtlAllocateHeap+0x27d|test dl, al|dl=0x0|al=0x1 | |
| 0x77174f6f ntdll.dll:RtlAllocateHeap+0x27f|je 0x77175943|eflags=0x246 | |
| 0x77175943 ntdll.dll:RtlAllocateHeap+0xc53|mov edx, dword ptr [ebp - 0x20]|ebp=0x19fe30 | |
| 0x77175946 ntdll.dll:RtlAllocateHeap+0xc56|mov eax, dword ptr [ebx + 0xb4]|ebx=0x820000 | |
| 0x7717594c ntdll.dll:RtlAllocateHeap+0xc5c|cmp edx, dword ptr [eax + 4]|edx=0x8|eax=0x820270 | |
| 0x7717594f ntdll.dll:RtlAllocateHeap+0xc5f|jb 0x77175962|eflags=0x287 | |
| 0x77175962 ntdll.dll:RtlAllocateHeap+0xc72|mov ecx, edx|edx=0x8 | |
| 0x77175964 ntdll.dll:RtlAllocateHeap+0xc74|cmp ecx, dword ptr [eax + 4]|ecx=0x8|eax=0x820270 | |
| 0x77175967 ntdll.dll:RtlAllocateHeap+0xc77|jae 0x77175cf9|eflags=0x287 | |
| 0x7717596d ntdll.dll:RtlAllocateHeap+0xc7d|cmp edx, ecx|edx=0x8|ecx=0x8 | |
| 0x7717596f ntdll.dll:RtlAllocateHeap+0xc7f|jne 0x77175cf9|eflags=0x246 | |
| 0x77175975 ntdll.dll:RtlAllocateHeap+0xc85|sub edx, dword ptr [eax + 0x14]|edx=0x8|eax=0x820270 | |
| 0x77175978 ntdll.dll:RtlAllocateHeap+0xc88|cmp dword ptr [eax + 8], 0|eax=0x820270 | |
| 0x7717597c ntdll.dll:RtlAllocateHeap+0xc8c|je 0x77175980|eflags=0x246 | |
| 0x77175980 ntdll.dll:RtlAllocateHeap+0xc90|mov eax, dword ptr [eax + 0x20]|eax=0x820270 | |
| 0x77175983 ntdll.dll:RtlAllocateHeap+0xc93|lea eax, [eax + edx*4]|eax=0x8202a4|edx=0x8 | |
| 0x77175986 ntdll.dll:RtlAllocateHeap+0xc96|jmp 0x77175cfb | |
| 0x77175cfb ntdll.dll:RtlAllocateHeap+0x100b|mov edx, dword ptr [ebp - 0x10]|ebp=0x19fe30 | |
| 0x77175cfe ntdll.dll:RtlAllocateHeap+0x100e|lea ecx, [ebp - 0x30]|ebp=0x19fe30 | |
| 0x77175d01 ntdll.dll:RtlAllocateHeap+0x1011|push ecx|ecx=0x19fe00|esp=0x19fdb8 | |
| 0x77175d02 ntdll.dll:RtlAllocateHeap+0x1012|push eax|eax=0x8202c4|esp=0x19fdb4 | |
| 0x77175d03 ntdll.dll:RtlAllocateHeap+0x1013|push esi|esi=0x40|esp=0x19fdb0 | |
| 0x77175d04 ntdll.dll:RtlAllocateHeap+0x1014|push edi|edi=0x38|esp=0x19fdac | |
| 0x77175d05 ntdll.dll:RtlAllocateHeap+0x1015|or edx, 2|edx=0x8 | |
| 0x77175d08 ntdll.dll:RtlAllocateHeap+0x1018|mov ecx, ebx|ebx=0x820000 | |
| 0x77175d0a ntdll.dll:RtlAllocateHeap+0x101a|call 0x77175ec0|esp=0x19fda8|eip=0x77175d0a | |
| 0x77175ec0 ntdll.dll:RtlAllocateHeap+0x11d0|mov edi, edi|edi=0x38 | |
| 0x77175ec2 ntdll.dll:RtlAllocateHeap+0x11d2|push ebp|ebp=0x19fe30|esp=0x19fda4 | |
| 0x77175ec3 ntdll.dll:RtlAllocateHeap+0x11d3|mov ebp, esp|esp=0x19fda0 | |
| 0x77175ec5 ntdll.dll:RtlAllocateHeap+0x11d5|push -2|esp=0x19fda0 | |
| 0x77175ec7 ntdll.dll:RtlAllocateHeap+0x11d7|push 0x7723ec48|esp=0x19fd9c | |
| 0x77175ecc ntdll.dll:RtlAllocateHeap+0x11dc|push 0x771ad210|esp=0x19fd98 | |
| 0x77175ed1 ntdll.dll:RtlAllocateHeap+0x11e1|mov eax, dword ptr fs:[0] | |
| 0x77175ed7 ntdll.dll:RtlAllocateHeap+0x11e7|push eax|eax=0x19feac|esp=0x19fd94 | |
| 0x77175ed8 ntdll.dll:RtlAllocateHeap+0x11e8|sub esp, 0x160|esp=0x19fd90 | |
| 0x77175ede ntdll.dll:RtlAllocateHeap+0x11ee|push ebx|ebx=0x820000|esp=0x19fc30 | |
| 0x77175edf ntdll.dll:RtlAllocateHeap+0x11ef|push esi|esi=0x40|esp=0x19fc2c | |
| 0x77175ee0 ntdll.dll:RtlAllocateHeap+0x11f0|push edi|edi=0x38|esp=0x19fc28 | |
| 0x77175ee1 ntdll.dll:RtlAllocateHeap+0x11f1|mov eax, dword ptr [0x7725e360] | |
| 0x77175ee6 ntdll.dll:RtlAllocateHeap+0x11f6|xor dword ptr [ebp - 8], eax|ebp=0x19fda0|eax=0xf9e0af5e | |
| 0x77175ee9 ntdll.dll:RtlAllocateHeap+0x11f9|xor eax, ebp|eax=0xf9e0af5e|ebp=0x19fda0 | |
| 0x77175eeb ntdll.dll:RtlAllocateHeap+0x11fb|push eax|eax=0xf9f952fe|esp=0x19fc24 | |
| 0x77175eec ntdll.dll:RtlAllocateHeap+0x11fc|lea eax, [ebp - 0x10]|ebp=0x19fda0 | |
| 0x77175eef ntdll.dll:RtlAllocateHeap+0x11ff|mov dword ptr fs:[0], eax|eax=0x19fd90 | |
| 0x77175ef5 ntdll.dll:RtlAllocateHeap+0x1205|mov ebx, edx|edx=0xa | |
| 0x77175ef7 ntdll.dll:RtlAllocateHeap+0x1207|mov dword ptr [ebp - 0x68], ebx|ebp=0x19fda0|ebx=0xa | |
| 0x77175efa ntdll.dll:RtlAllocateHeap+0x120a|mov edi, ecx|ecx=0x820000 | |
| 0x77175efc ntdll.dll:RtlAllocateHeap+0x120c|mov dword ptr [ebp - 0xd8], edi|ebp=0x19fda0|edi=0x820000 | |
| 0x77175f02 ntdll.dll:RtlAllocateHeap+0x1212|mov dword ptr [ebp - 0xb0], 0|ebp=0x19fda0 | |
| 0x77175f0c ntdll.dll:RtlAllocateHeap+0x121c|mov dword ptr [ebp - 0x64], 1|ebp=0x19fda0 | |
| 0x77175f13 ntdll.dll:RtlAllocateHeap+0x1223|mov byte ptr [ebp - 0x29], 0|ebp=0x19fda0 | |
| 0x77175f17 ntdll.dll:RtlAllocateHeap+0x1227|mov dword ptr [ebp - 0x5c], 0|ebp=0x19fda0 | |
| 0x77175f1e ntdll.dll:RtlAllocateHeap+0x122e|mov dword ptr [ebp - 0x50], 0|ebp=0x19fda0 | |
| 0x77175f25 ntdll.dll:RtlAllocateHeap+0x1235|mov dword ptr [ebp - 0x9c], 0|ebp=0x19fda0 | |
| 0x77175f2f ntdll.dll:RtlAllocateHeap+0x123f|mov esi, dword ptr [ebp + 0xc]|ebp=0x19fda0 | |
| 0x77175f32 ntdll.dll:RtlAllocateHeap+0x1242|shr esi, 3|esi=0x40 | |
| 0x77175f35 ntdll.dll:RtlAllocateHeap+0x1245|test ebx, 0x7d010f60|ebx=0xa | |
| 0x77175f3b ntdll.dll:RtlAllocateHeap+0x124b|jne 0x77175f6f|eflags=0x246 | |
| 0x77175f3d ntdll.dll:RtlAllocateHeap+0x124d|cmp dword ptr [ebp + 8], 0x80000000|ebp=0x19fda0 | |
| 0x77175f44 ntdll.dll:RtlAllocateHeap+0x1254|jae 0x77175f6f|eflags=0xa83 | |
| 0x77175f46 ntdll.dll:RtlAllocateHeap+0x1256|mov cl, 1 | |
| 0x77175f48 ntdll.dll:RtlAllocateHeap+0x1258|mov dword ptr [ebp - 0x34], ecx|ebp=0x19fda0|ecx=0x820001 | |
| 0x77175f4b ntdll.dll:RtlAllocateHeap+0x125b|mov edx, esi|esi=0x8 | |
| 0x77175f4d ntdll.dll:RtlAllocateHeap+0x125d|mov dword ptr [ebp - 0x30], edx|ebp=0x19fda0|edx=0x8 | |
| 0x77175f50 ntdll.dll:RtlAllocateHeap+0x1260|cmp edx, 2|edx=0x8 | |
| 0x77175f53 ntdll.dll:RtlAllocateHeap+0x1263|jae 0x77175f61|eflags=0x206 | |
| 0x77175f61 ntdll.dll:RtlAllocateHeap+0x1271|mov eax, dword ptr [ebp + 0x14]|ebp=0x19fda0 | |
| 0x77175f64 ntdll.dll:RtlAllocateHeap+0x1274|mov dword ptr [eax], 3|eax=0x19fe00 | |
| 0x77175f6a ntdll.dll:RtlAllocateHeap+0x127a|jmp 0x7717601c | |
| 0x7717601c ntdll.dll:RtlAllocateHeap+0x132c|and ebx, 0x800000|ebx=0xa | |
| 0x77176022 ntdll.dll:RtlAllocateHeap+0x1332|je 0x77176039|eflags=0x246 | |
| 0x77176039 ntdll.dll:RtlAllocateHeap+0x1349|mov dword ptr [ebp - 4], 0|ebp=0x19fda0 | |
| 0x77176040 ntdll.dll:RtlAllocateHeap+0x1350|test byte ptr [ebp - 0x68], 1|ebp=0x19fda0 | |
| 0x77176044 ntdll.dll:RtlAllocateHeap+0x1354|jne 0x771760d7|eflags=0x246 | |
| 0x7717604a ntdll.dll:RtlAllocateHeap+0x135a|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19fc20 | |
| 0x77176050 ntdll.dll:RtlAllocateHeap+0x1360|call 0x77193f20|esp=0x19fc1c|eip=0x77176050 | |
| 0x77193f20 ntdll.dll:RtlTryEnterCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77193f22 ntdll.dll:RtlTryEnterCriticalSection+0x2|push ebp|ebp=0x19fda0|esp=0x19fc18 | |
| 0x77193f23 ntdll.dll:RtlTryEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fc14 | |
| 0x77193f25 ntdll.dll:RtlTryEnterCriticalSection+0x5|mov eax, dword ptr [ebp + 8]|ebp=0x19fc14 | |
| 0x77193f28 ntdll.dll:RtlTryEnterCriticalSection+0x8|mov edx, dword ptr fs:[0x18] | |
| 0x77193f2f ntdll.dll:RtlTryEnterCriticalSection+0xf|lea ecx, [eax + 4]|eax=0x820258 | |
| 0x77193f32 ntdll.dll:RtlTryEnterCriticalSection+0x12|lock btr dword ptr [ecx], 0|ecx=0x82025c | |
| 0x77193f37 ntdll.dll:RtlTryEnterCriticalSection+0x17|jae 0x77193f4f|eflags=0x247 | |
| 0x77193f39 ntdll.dll:RtlTryEnterCriticalSection+0x19|mov ecx, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x77193f3c ntdll.dll:RtlTryEnterCriticalSection+0x1c|mov dword ptr [eax + 0xc], ecx|eax=0x820258|ecx=0x1fc0 | |
| 0x77193f3f ntdll.dll:RtlTryEnterCriticalSection+0x1f|mov dword ptr [eax + 8], 1|eax=0x820258 | |
| 0x77193f46 ntdll.dll:RtlTryEnterCriticalSection+0x26|mov eax, 1 | |
| 0x77193f4b ntdll.dll:RtlTryEnterCriticalSection+0x2b|pop ebp|ebp=0x19fc14|esp=0x19fc14 | |
| 0x77193f4c ntdll.dll:RtlTryEnterCriticalSection+0x2c|ret 4|esp=0x19fc18 | |
| 0x77176055 ntdll.dll:RtlAllocateHeap+0x1365|test eax, eax|eax=0x1 | |
| 0x77176057 ntdll.dll:RtlAllocateHeap+0x1367|jne 0x771760b6|eflags=0x202 | |
| 0x771760b6 ntdll.dll:RtlAllocateHeap+0x13c6|inc dword ptr [edi + 0x214]|edi=0x820000 | |
| 0x771760bc ntdll.dll:RtlAllocateHeap+0x13cc|mov byte ptr [ebp - 0x7d], 1|ebp=0x19fda0 | |
| 0x771760c0 ntdll.dll:RtlAllocateHeap+0x13d0|mov byte ptr [ebp - 0x29], 1|ebp=0x19fda0 | |
| 0x771760c4 ntdll.dll:RtlAllocateHeap+0x13d4|test dword ptr [edi + 0x48], 0x30000000|edi=0x820000 | |
| 0x771760cb ntdll.dll:RtlAllocateHeap+0x13db|je 0x771760d4|eflags=0x246 | |
| 0x771760d4 ntdll.dll:RtlAllocateHeap+0x13e4|mov edx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x771760d7 ntdll.dll:RtlAllocateHeap+0x13e7|cmp edx, dword ptr [edi + 0x5c]|edx=0x8|edi=0x820000 | |
| 0x771760da ntdll.dll:RtlAllocateHeap+0x13ea|ja 0x77177819|eflags=0x283 | |
| 0x771760e0 ntdll.dll:RtlAllocateHeap+0x13f0|test ebx, ebx|ebx=0x0 | |
| 0x771760e2 ntdll.dll:RtlAllocateHeap+0x13f2|jne 0x77176211|eflags=0x246 | |
| 0x771760e8 ntdll.dll:RtlAllocateHeap+0x13f8|movzx eax, word ptr [edi + 0xf0]|edi=0x820000 | |
| 0x771760ef ntdll.dll:RtlAllocateHeap+0x13ff|cmp esi, eax|esi=0x8|eax=0x802 | |
| 0x771760f1 ntdll.dll:RtlAllocateHeap+0x1401|mov eax, dword ptr [ebp + 8]|ebp=0x19fda0 | |
| 0x771760f4 ntdll.dll:RtlAllocateHeap+0x1404|jb 0x77176130|eflags=0x287 | |
| 0x77176130 ntdll.dll:RtlAllocateHeap+0x1440|cmp eax, dword ptr [0x77256ccc]|eax=0x38 | |
| 0x77176136 ntdll.dll:RtlAllocateHeap+0x1446|ja 0x77176211|eflags=0x283 | |
| 0x7717613c ntdll.dll:RtlAllocateHeap+0x144c|mov eax, esi|esi=0x8 | |
| 0x7717613e ntdll.dll:RtlAllocateHeap+0x144e|shr eax, 3|eax=0x8 | |
| 0x77176141 ntdll.dll:RtlAllocateHeap+0x1451|add eax, 0xf2|eax=0x1 | |
| 0x77176146 ntdll.dll:RtlAllocateHeap+0x1456|add eax, edi|eax=0xf3|edi=0x820000 | |
| 0x77176148 ntdll.dll:RtlAllocateHeap+0x1458|mov dword ptr [ebp - 0x54], eax|ebp=0x19fda0|eax=0x8200f3 | |
| 0x7717614b ntdll.dll:RtlAllocateHeap+0x145b|mov dl, byte ptr [eax]|eax=0x8200f3 | |
| 0x7717614d ntdll.dll:RtlAllocateHeap+0x145d|mov ebx, esi|esi=0x8 | |
| 0x7717614f ntdll.dll:RtlAllocateHeap+0x145f|and ebx, 7|ebx=0x8 | |
| 0x77176152 ntdll.dll:RtlAllocateHeap+0x1462|mov eax, 1 | |
| 0x77176157 ntdll.dll:RtlAllocateHeap+0x1467|mov ecx, ebx|ebx=0x0 | |
| 0x77176159 ntdll.dll:RtlAllocateHeap+0x1469|shl eax, cl|eax=0x1|cl=0x0 | |
| 0x7717615b ntdll.dll:RtlAllocateHeap+0x146b|test dl, al|dl=0x0|al=0x1 | |
| 0x7717615d ntdll.dll:RtlAllocateHeap+0x146d|jne 0x7717620e|eflags=0x246 | |
| 0x77176163 ntdll.dll:RtlAllocateHeap+0x1473|mov eax, dword ptr [edi + 0xec]|edi=0x820000 | |
| 0x77176169 ntdll.dll:RtlAllocateHeap+0x1479|lea esi, [eax + esi*2]|eax=0x821af0|esi=0x8 | |
| 0x7717616c ntdll.dll:RtlAllocateHeap+0x147c|mov dword ptr [ebp - 0xe0], esi|ebp=0x19fda0|esi=0x821b00 | |
| 0x77176172 ntdll.dll:RtlAllocateHeap+0x1482|add word ptr [esi], 0x21|esi=0x821b00 | |
| 0x77176176 ntdll.dll:RtlAllocateHeap+0x1486|mov cx, word ptr [esi]|esi=0x821b00 | |
| 0x77176179 ntdll.dll:RtlAllocateHeap+0x1489|cmp dword ptr [ebp - 0x9c], 0|ebp=0x19fda0 | |
| 0x77176180 ntdll.dll:RtlAllocateHeap+0x1490|jne 0x771761aa|eflags=0x246 | |
| 0x77176182 ntdll.dll:RtlAllocateHeap+0x1492|mov al, cl|cl=0xa5 | |
| 0x77176184 ntdll.dll:RtlAllocateHeap+0x1494|and al, 0x1f|al=0xa5 | |
| 0x77176186 ntdll.dll:RtlAllocateHeap+0x1496|cmp al, 0x10|al=0x5 | |
| 0x77176188 ntdll.dll:RtlAllocateHeap+0x1498|ja 0x771761a0|eflags=0x287 | |
| 0x7717618a ntdll.dll:RtlAllocateHeap+0x149a|mov eax, 0xff00 | |
| 0x7717618f ntdll.dll:RtlAllocateHeap+0x149f|cmp cx, ax|cx=0xa5|ax=0xff00 | |
| 0x77176192 ntdll.dll:RtlAllocateHeap+0x14a2|ja 0x771761a0|eflags=0x207 | |
| 0x77176194 ntdll.dll:RtlAllocateHeap+0x14a4|mov dword ptr [ebp - 0xb4], 0|ebp=0x19fda0 | |
| 0x7717619e ntdll.dll:RtlAllocateHeap+0x14ae|jmp 0x7717620e | |
| 0x7717620e ntdll.dll:RtlAllocateHeap+0x151e|mov edx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x77176211 ntdll.dll:RtlAllocateHeap+0x1521|mov esi, dword ptr [ebp + 0x10]|ebp=0x19fda0 | |
| 0x77176214 ntdll.dll:RtlAllocateHeap+0x1524|test esi, esi|esi=0x8202c4 | |
| 0x77176216 ntdll.dll:RtlAllocateHeap+0x1526|je 0x7717646b|eflags=0x202 | |
| 0x7717621c ntdll.dll:RtlAllocateHeap+0x152c|mov esi, dword ptr [esi]|esi=0x8202c4 | |
| 0x7717621e ntdll.dll:RtlAllocateHeap+0x152e|test esi, esi|esi=0x0 | |
| 0x77176220 ntdll.dll:RtlAllocateHeap+0x1530|je 0x7717646b|eflags=0x246 | |
| 0x7717646b ntdll.dll:RtlAllocateHeap+0x177b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176471 ntdll.dll:RtlAllocateHeap+0x1781|mov dword ptr [ebp - 0xc0], eax|ebp=0x19fda0|eax=0x8200c0 | |
| 0x77176477 ntdll.dll:RtlAllocateHeap+0x1787|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717647d ntdll.dll:RtlAllocateHeap+0x178d|mov dword ptr [ebp - 0x28], esi|ebp=0x19fda0|esi=0x820270 | |
| 0x77176480 ntdll.dll:RtlAllocateHeap+0x1790|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176483 ntdll.dll:RtlAllocateHeap+0x1793|cmp edx, ecx|edx=0x8|ecx=0x80 | |
| 0x77176485 ntdll.dll:RtlAllocateHeap+0x1795|jae 0x7717648b|eflags=0x287 | |
| 0x77176487 ntdll.dll:RtlAllocateHeap+0x1797|mov eax, edx|edx=0x8 | |
| 0x77176489 ntdll.dll:RtlAllocateHeap+0x1799|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fda0|eax=0x8 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x8|esi=0x820270 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19fda0|eax=0x8 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19fda0 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x820270 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19fda0|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82b400 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x287 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82b400 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x82b3f8 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82b3f8 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fda0|ebx=0x5a1acb77 | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x5a1acb77|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fda0|ebx=0x7e00037d | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x7e00037d | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x7e00037d | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x7e00037d | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x7e00037d | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x3 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x3|bl=0x7d | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x7e00037d | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x7e00037d | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x7e|cl=0x7e | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x37d | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x8|eax=0x37d | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19fda0|ecx=0xfffffc8b | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0xfffffc8b | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x286 | |
| 0x77176526 ntdll.dll:RtlAllocateHeap+0x1836|mov eax, dword ptr [edx]|edx=0x8200c0 | |
| 0x77176528 ntdll.dll:RtlAllocateHeap+0x1838|add eax, -8|eax=0x8266e8 | |
| 0x7717652b ntdll.dll:RtlAllocateHeap+0x183b|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x8266e0 | |
| 0x7717652e ntdll.dll:RtlAllocateHeap+0x183e|mov ebx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176530 ntdll.dll:RtlAllocateHeap+0x1840|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fda0|ebx=0x261ac808 | |
| 0x77176536 ntdll.dll:RtlAllocateHeap+0x1846|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717653a ntdll.dll:RtlAllocateHeap+0x184a|je 0x77176574|eflags=0x206 | |
| 0x7717653c ntdll.dll:RtlAllocateHeap+0x184c|xor ebx, dword ptr [edi + 0x50]|ebx=0x261ac808|edi=0x820000 | |
| 0x7717653f ntdll.dll:RtlAllocateHeap+0x184f|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fda0|ebx=0x2000002 | |
| 0x77176545 ntdll.dll:RtlAllocateHeap+0x1855|mov ecx, ebx|ebx=0x2000002 | |
| 0x77176547 ntdll.dll:RtlAllocateHeap+0x1857|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717654a ntdll.dll:RtlAllocateHeap+0x185a|mov eax, ebx|ebx=0x2000002 | |
| 0x7717654c ntdll.dll:RtlAllocateHeap+0x185c|shr eax, 8|eax=0x2000002 | |
| 0x7717654f ntdll.dll:RtlAllocateHeap+0x185f|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176551 ntdll.dll:RtlAllocateHeap+0x1861|xor cl, bl|cl=0x0|bl=0x2 | |
| 0x77176553 ntdll.dll:RtlAllocateHeap+0x1863|mov eax, ebx|ebx=0x2000002 | |
| 0x77176555 ntdll.dll:RtlAllocateHeap+0x1865|shr eax, 0x18|eax=0x2000002 | |
| 0x77176558 ntdll.dll:RtlAllocateHeap+0x1868|cmp al, cl|al=0x2|cl=0x2 | |
| 0x7717655a ntdll.dll:RtlAllocateHeap+0x186a|je 0x77176574|eflags=0x246 | |
| 0x77176574 ntdll.dll:RtlAllocateHeap+0x1884|movzx eax, bx|bx=0x2 | |
| 0x77176577 ntdll.dll:RtlAllocateHeap+0x1887|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x7717657a ntdll.dll:RtlAllocateHeap+0x188a|sub ecx, eax|ecx=0x8|eax=0x2 | |
| 0x7717657c ntdll.dll:RtlAllocateHeap+0x188c|mov dword ptr [ebp - 0xf0], ecx|ebp=0x19fda0|ecx=0x6 | |
| 0x77176582 ntdll.dll:RtlAllocateHeap+0x1892|test ecx, ecx|ecx=0x6 | |
| 0x77176584 ntdll.dll:RtlAllocateHeap+0x1894|jg 0x7717658d|eflags=0x206 | |
| 0x7717658d ntdll.dll:RtlAllocateHeap+0x189d|cmp dword ptr [esi], 0|esi=0x820270 | |
| 0x77176590 ntdll.dll:RtlAllocateHeap+0x18a0|jne 0x7717662a|eflags=0x206 | |
| 0x7717662a ntdll.dll:RtlAllocateHeap+0x193a|mov ecx, dword ptr [ebp - 0x4c]|ebp=0x19fda0 | |
| 0x7717662d ntdll.dll:RtlAllocateHeap+0x193d|mov edx, ecx|ecx=0x8 | |
| 0x7717662f ntdll.dll:RtlAllocateHeap+0x193f|shr edx, 5|edx=0x8 | |
| 0x77176632 ntdll.dll:RtlAllocateHeap+0x1942|mov eax, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176635 ntdll.dll:RtlAllocateHeap+0x1945|sub eax, dword ptr [esi + 0x14]|eax=0x80|esi=0x820270 | |
| 0x77176638 ntdll.dll:RtlAllocateHeap+0x1948|shr eax, 5|eax=0x80 | |
| 0x7717663b ntdll.dll:RtlAllocateHeap+0x194b|dec eax|eax=0x4 | |
| 0x7717663c ntdll.dll:RtlAllocateHeap+0x194c|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x3 | |
| 0x7717663f ntdll.dll:RtlAllocateHeap+0x194f|mov eax, dword ptr [esi + 0x1c]|esi=0x820270 | |
| 0x77176642 ntdll.dll:RtlAllocateHeap+0x1952|lea eax, [eax + edx*4]|eax=0x820294|edx=0x0 | |
| 0x77176645 ntdll.dll:RtlAllocateHeap+0x1955|and ecx, 0x1f|ecx=0x8 | |
| 0x77176648 ntdll.dll:RtlAllocateHeap+0x1958|or ebx, 0xffffffff|ebx=0x2000002 | |
| 0x7717664b ntdll.dll:RtlAllocateHeap+0x195b|shl ebx, cl|ebx=0xffffffff|cl=0x8 | |
| 0x7717664d ntdll.dll:RtlAllocateHeap+0x195d|and ebx, dword ptr [eax]|ebx=0xffffff00|eax=0x820294 | |
| 0x7717664f ntdll.dll:RtlAllocateHeap+0x195f|mov ecx, dword ptr [ebp - 0x24]|ebp=0x19fda0 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x820294 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x0 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x0|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x820294 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x820298 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x0 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x820298 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x1 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x1|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x820298 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x82029c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x1 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x82029c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x2 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x2|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x82029c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x8202a0 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x2 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x8202a0 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x3 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x3|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x246 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x8202a0 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x8202a4 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x3 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x8202a4 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x4 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x4|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x202 | |
| 0x7717666e ntdll.dll:RtlAllocateHeap+0x197e|test ebx, ebx|ebx=0x0 | |
| 0x77176670 ntdll.dll:RtlAllocateHeap+0x1980|je 0x77177802|eflags=0x246 | |
| 0x77177802 ntdll.dll:RtlAllocateHeap+0x2b12|mov esi, dword ptr [esi]|esi=0x820270 | |
| 0x77177804 ntdll.dll:RtlAllocateHeap+0x2b14|mov dword ptr [ebp - 0x28], esi|ebp=0x19fda0|esi=0x822b00 | |
| 0x77177807 ntdll.dll:RtlAllocateHeap+0x2b17|mov eax, dword ptr [esi + 0x14]|esi=0x822b00 | |
| 0x7717780a ntdll.dll:RtlAllocateHeap+0x2b1a|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fda0|eax=0x80 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x80|esi=0x822b00 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19fda0|eax=0x0 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19fda0 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19fda0|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82b400 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x287 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82b400 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x82b3f8 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82b3f8 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fda0|ebx=0x5a1acb77 | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x5a1acb77|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fda0|ebx=0x7e00037d | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x7e00037d | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x7e00037d | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x7e00037d | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x7e00037d | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x3 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x3|bl=0x7d | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x7e00037d | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x7e00037d | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x7e|cl=0x7e | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x37d | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x8|eax=0x37d | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19fda0|ecx=0xfffffc8b | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0xfffffc8b | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x286 | |
| 0x77176526 ntdll.dll:RtlAllocateHeap+0x1836|mov eax, dword ptr [edx]|edx=0x8200c0 | |
| 0x77176528 ntdll.dll:RtlAllocateHeap+0x1838|add eax, -8|eax=0x8266e8 | |
| 0x7717652b ntdll.dll:RtlAllocateHeap+0x183b|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x8266e0 | |
| 0x7717652e ntdll.dll:RtlAllocateHeap+0x183e|mov ebx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176530 ntdll.dll:RtlAllocateHeap+0x1840|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fda0|ebx=0x261ac808 | |
| 0x77176536 ntdll.dll:RtlAllocateHeap+0x1846|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717653a ntdll.dll:RtlAllocateHeap+0x184a|je 0x77176574|eflags=0x206 | |
| 0x7717653c ntdll.dll:RtlAllocateHeap+0x184c|xor ebx, dword ptr [edi + 0x50]|ebx=0x261ac808|edi=0x820000 | |
| 0x7717653f ntdll.dll:RtlAllocateHeap+0x184f|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fda0|ebx=0x2000002 | |
| 0x77176545 ntdll.dll:RtlAllocateHeap+0x1855|mov ecx, ebx|ebx=0x2000002 | |
| 0x77176547 ntdll.dll:RtlAllocateHeap+0x1857|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717654a ntdll.dll:RtlAllocateHeap+0x185a|mov eax, ebx|ebx=0x2000002 | |
| 0x7717654c ntdll.dll:RtlAllocateHeap+0x185c|shr eax, 8|eax=0x2000002 | |
| 0x7717654f ntdll.dll:RtlAllocateHeap+0x185f|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176551 ntdll.dll:RtlAllocateHeap+0x1861|xor cl, bl|cl=0x0|bl=0x2 | |
| 0x77176553 ntdll.dll:RtlAllocateHeap+0x1863|mov eax, ebx|ebx=0x2000002 | |
| 0x77176555 ntdll.dll:RtlAllocateHeap+0x1865|shr eax, 0x18|eax=0x2000002 | |
| 0x77176558 ntdll.dll:RtlAllocateHeap+0x1868|cmp al, cl|al=0x2|cl=0x2 | |
| 0x7717655a ntdll.dll:RtlAllocateHeap+0x186a|je 0x77176574|eflags=0x246 | |
| 0x77176574 ntdll.dll:RtlAllocateHeap+0x1884|movzx eax, bx|bx=0x2 | |
| 0x77176577 ntdll.dll:RtlAllocateHeap+0x1887|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x7717657a ntdll.dll:RtlAllocateHeap+0x188a|sub ecx, eax|ecx=0x8|eax=0x2 | |
| 0x7717657c ntdll.dll:RtlAllocateHeap+0x188c|mov dword ptr [ebp - 0xf0], ecx|ebp=0x19fda0|ecx=0x6 | |
| 0x77176582 ntdll.dll:RtlAllocateHeap+0x1892|test ecx, ecx|ecx=0x6 | |
| 0x77176584 ntdll.dll:RtlAllocateHeap+0x1894|jg 0x7717658d|eflags=0x206 | |
| 0x7717658d ntdll.dll:RtlAllocateHeap+0x189d|cmp dword ptr [esi], 0|esi=0x822b00 | |
| 0x77176590 ntdll.dll:RtlAllocateHeap+0x18a0|jne 0x7717662a|eflags=0x246 | |
| 0x77176596 ntdll.dll:RtlAllocateHeap+0x18a6|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176599 ntdll.dll:RtlAllocateHeap+0x18a9|dec eax|eax=0x800 | |
| 0x7717659a ntdll.dll:RtlAllocateHeap+0x18aa|cmp dword ptr [ebp - 0x3c], eax|ebp=0x19fda0|eax=0x7ff | |
| 0x7717659d ntdll.dll:RtlAllocateHeap+0x18ad|jne 0x7717662a|eflags=0x297 | |
| 0x7717662a ntdll.dll:RtlAllocateHeap+0x193a|mov ecx, dword ptr [ebp - 0x4c]|ebp=0x19fda0 | |
| 0x7717662d ntdll.dll:RtlAllocateHeap+0x193d|mov edx, ecx|ecx=0x0 | |
| 0x7717662f ntdll.dll:RtlAllocateHeap+0x193f|shr edx, 5|edx=0x0 | |
| 0x77176632 ntdll.dll:RtlAllocateHeap+0x1942|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176635 ntdll.dll:RtlAllocateHeap+0x1945|sub eax, dword ptr [esi + 0x14]|eax=0x800|esi=0x822b00 | |
| 0x77176638 ntdll.dll:RtlAllocateHeap+0x1948|shr eax, 5|eax=0x780 | |
| 0x7717663b ntdll.dll:RtlAllocateHeap+0x194b|dec eax|eax=0x3c | |
| 0x7717663c ntdll.dll:RtlAllocateHeap+0x194c|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x3b | |
| 0x7717663f ntdll.dll:RtlAllocateHeap+0x194f|mov eax, dword ptr [esi + 0x1c]|esi=0x822b00 | |
| 0x77176642 ntdll.dll:RtlAllocateHeap+0x1952|lea eax, [eax + edx*4]|eax=0x822b24|edx=0x0 | |
| 0x77176645 ntdll.dll:RtlAllocateHeap+0x1955|and ecx, 0x1f|ecx=0x0 | |
| 0x77176648 ntdll.dll:RtlAllocateHeap+0x1958|or ebx, 0xffffffff|ebx=0x2000002 | |
| 0x7717664b ntdll.dll:RtlAllocateHeap+0x195b|shl ebx, cl|ebx=0xffffffff|cl=0x0 | |
| 0x7717664d ntdll.dll:RtlAllocateHeap+0x195d|and ebx, dword ptr [eax]|ebx=0xffffffff|eax=0x822b24 | |
| 0x7717664f ntdll.dll:RtlAllocateHeap+0x195f|mov ecx, dword ptr [ebp - 0x24]|ebp=0x19fda0 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b24 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x0 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x0|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b24 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b28 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x0 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b28 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x1 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x1|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b28 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b2c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x1 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b2c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x2 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x2|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b2c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b30 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x2 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b30 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x3 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x3|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b30 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b34 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x3 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b34 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x4 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x4|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b34 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b38 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x4 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b38 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x5 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x5|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b38 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b3c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x5 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b3c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x6 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x6|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b3c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b40 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x6 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b40 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x7 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x7|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b40 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b44 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x7 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b44 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x8 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x8|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b44 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b48 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x8 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b48 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x9 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x9|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b48 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b4c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x9 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b4c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0xa | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xa|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b4c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b50 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xa | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b50 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0xb | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xb|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x283 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b50 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b54 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xb | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b54 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0xc | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xc|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x287 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b54 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b58 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xc | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b58 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0xd | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xd|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x287 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b58 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b5c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xd | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b5c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0xe | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xe|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x283 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b5c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b60 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xe | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b60 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0xf | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xf|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x287 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b60 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b64 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xf | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b64 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x10 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x10|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b64 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b68 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x10 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b68 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x11 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x11|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b68 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b6c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x11 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b6c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x12 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x12|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b6c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b70 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x12 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b70 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x13 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x13|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b70 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b74 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x13 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b74 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x14 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x14|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b74 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b78 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x14 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b78 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x15 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x15|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b78 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b7c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x15 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b7c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x16 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x16|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b7c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b80 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x16 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fda0|eax=0x822b80 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x17 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x20000000 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x206 | |
| 0x77176676 ntdll.dll:RtlAllocateHeap+0x1986|test bx, bx|bx=0x0 | |
| 0x77176679 ntdll.dll:RtlAllocateHeap+0x1989|je 0x7717669d|eflags=0x246 | |
| 0x7717669d ntdll.dll:RtlAllocateHeap+0x19ad|mov eax, ebx|ebx=0x20000000 | |
| 0x7717669f ntdll.dll:RtlAllocateHeap+0x19af|shr eax, 0x10|eax=0x20000000 | |
| 0x771766a2 ntdll.dll:RtlAllocateHeap+0x19b2|movzx eax, al|al=0x0 | |
| 0x771766a5 ntdll.dll:RtlAllocateHeap+0x19b5|test eax, eax|eax=0x0 | |
| 0x771766a7 ntdll.dll:RtlAllocateHeap+0x19b7|je 0x771766b5|eflags=0x246 | |
| 0x771766b5 ntdll.dll:RtlAllocateHeap+0x19c5|shr ebx, 0x18|ebx=0x20000000 | |
| 0x771766b8 ntdll.dll:RtlAllocateHeap+0x19c8|movzx eax, byte ptr [ebx + 0x7713c1c0]|ebx=0x20 | |
| 0x771766bf ntdll.dll:RtlAllocateHeap+0x19cf|add eax, 0x18|eax=0x5 | |
| 0x771766c2 ntdll.dll:RtlAllocateHeap+0x19d2|shl edx, 5|edx=0x17 | |
| 0x771766c5 ntdll.dll:RtlAllocateHeap+0x19d5|add edx, eax|edx=0x2e0|eax=0x1d | |
| 0x771766c7 ntdll.dll:RtlAllocateHeap+0x19d7|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fda0|edx=0x2fd | |
| 0x771766cd ntdll.dll:RtlAllocateHeap+0x19dd|cmp dword ptr [esi + 8], 0|esi=0x822b00 | |
| 0x771766d1 ntdll.dll:RtlAllocateHeap+0x19e1|je 0x771766d5|eflags=0x246 | |
| 0x771766d5 ntdll.dll:RtlAllocateHeap+0x19e5|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x771766d8 ntdll.dll:RtlAllocateHeap+0x19e8|mov eax, dword ptr [eax + edx*4]|eax=0x822c14|edx=0x2fd | |
| 0x771766db ntdll.dll:RtlAllocateHeap+0x19eb|mov dword ptr [ebp - 0x1c], eax|ebp=0x19fda0|eax=0x82b400 | |
| 0x771766de ntdll.dll:RtlAllocateHeap+0x19ee|test eax, eax|eax=0x82b400 | |
| 0x771766e0 ntdll.dll:RtlAllocateHeap+0x19f0|je 0x77177802|eflags=0x206 | |
| 0x771766e6 ntdll.dll:RtlAllocateHeap+0x19f6|mov dword ptr [ebp - 0xf8], eax|ebp=0x19fda0|eax=0x82b400 | |
| 0x771766ec ntdll.dll:RtlAllocateHeap+0x19fc|cmp dword ptr [ebp - 0xc0], eax|ebp=0x19fda0|eax=0x82b400 | |
| 0x771766f2 ntdll.dll:RtlAllocateHeap+0x1a02|je 0x77176945|eflags=0x287 | |
| 0x771766f8 ntdll.dll:RtlAllocateHeap+0x1a08|lea ebx, [eax - 8]|eax=0x82b400 | |
| 0x771766fb ntdll.dll:RtlAllocateHeap+0x1a0b|mov dword ptr [ebp - 0x60], ebx|ebp=0x19fda0|ebx=0x82b3f8 | |
| 0x771766fe ntdll.dll:RtlAllocateHeap+0x1a0e|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176702 ntdll.dll:RtlAllocateHeap+0x1a12|je 0x77176723|eflags=0x206 | |
| 0x77176704 ntdll.dll:RtlAllocateHeap+0x1a14|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77176707 ntdll.dll:RtlAllocateHeap+0x1a17|xor dword ptr [ebx], eax|ebx=0x82b3f8|eax=0x241ac80a | |
| 0x77176709 ntdll.dll:RtlAllocateHeap+0x1a19|mov al, byte ptr [ebx + 2]|ebx=0x82b3f8 | |
| 0x7717670c ntdll.dll:RtlAllocateHeap+0x1a1c|xor al, byte ptr [ebx + 1]|al=0x0|ebx=0x82b3f8 | |
| 0x7717670f ntdll.dll:RtlAllocateHeap+0x1a1f|xor al, byte ptr [ebx]|al=0x3|ebx=0x82b3f8 | |
| 0x77176711 ntdll.dll:RtlAllocateHeap+0x1a21|cmp byte ptr [ebx + 3], al|ebx=0x82b3f8|al=0x7e | |
| 0x77176714 ntdll.dll:RtlAllocateHeap+0x1a24|je 0x77176720|eflags=0x246 | |
| 0x77176720 ntdll.dll:RtlAllocateHeap+0x1a30|mov eax, dword ptr [ebp - 0x1c]|ebp=0x19fda0 | |
| 0x77176723 ntdll.dll:RtlAllocateHeap+0x1a33|movzx esi, word ptr [ebx]|ebx=0x82b3f8 | |
| 0x77176726 ntdll.dll:RtlAllocateHeap+0x1a36|cmp esi, dword ptr [ebp - 0x30]|esi=0x37d|ebp=0x19fda0 | |
| 0x77176729 ntdll.dll:RtlAllocateHeap+0x1a39|jb 0x7717692f|eflags=0x202 | |
| 0x7717672f ntdll.dll:RtlAllocateHeap+0x1a3f|mov edx, dword ptr [ebx + 8]|ebx=0x82b3f8 | |
| 0x77176732 ntdll.dll:RtlAllocateHeap+0x1a42|mov dword ptr [ebp - 0x84], edx|ebp=0x19fda0|edx=0x8200c0 | |
| 0x77176738 ntdll.dll:RtlAllocateHeap+0x1a48|mov ecx, dword ptr [ebx + 0xc]|ebx=0x82b3f8 | |
| 0x7717673b ntdll.dll:RtlAllocateHeap+0x1a4b|mov dword ptr [ebp - 0x20], ecx|ebp=0x19fda0|ecx=0x8266e8 | |
| 0x7717673e ntdll.dll:RtlAllocateHeap+0x1a4e|mov ecx, dword ptr [ecx]|ecx=0x8266e8 | |
| 0x77176740 ntdll.dll:RtlAllocateHeap+0x1a50|mov edx, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x77176743 ntdll.dll:RtlAllocateHeap+0x1a53|cmp ecx, edx|ecx=0x82b400|edx=0x82b400 | |
| 0x77176745 ntdll.dll:RtlAllocateHeap+0x1a55|jne 0x77176915|eflags=0x246 | |
| 0x7717674b ntdll.dll:RtlAllocateHeap+0x1a5b|cmp ecx, eax|ecx=0x82b400|eax=0x82b400 | |
| 0x7717674d ntdll.dll:RtlAllocateHeap+0x1a5d|jne 0x77176915|eflags=0x246 | |
| 0x77176753 ntdll.dll:RtlAllocateHeap+0x1a63|sub dword ptr [edi + 0x74], esi|edi=0x820000|esi=0x37d | |
| 0x77176756 ntdll.dll:RtlAllocateHeap+0x1a66|mov ecx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717675c ntdll.dll:RtlAllocateHeap+0x1a6c|mov dword ptr [ebp - 0x28], ecx|ebp=0x19fda0|ecx=0x820270 | |
| 0x7717675f ntdll.dll:RtlAllocateHeap+0x1a6f|test ecx, ecx|ecx=0x820270 | |
| 0x77176761 ntdll.dll:RtlAllocateHeap+0x1a71|je 0x77176883|eflags=0x202 | |
| 0x77176767 ntdll.dll:RtlAllocateHeap+0x1a77|movzx eax, word ptr [ebx]|ebx=0x82b3f8 | |
| 0x7717676a ntdll.dll:RtlAllocateHeap+0x1a7a|mov dword ptr [ebp - 0x4c], eax|ebp=0x19fda0|eax=0x37d | |
| 0x7717676d ntdll.dll:RtlAllocateHeap+0x1a7d|lea ecx, [ecx]|ecx=0x820270 | |
| 0x77176770 ntdll.dll:RtlAllocateHeap+0x1a80|mov esi, dword ptr [ecx + 4]|ecx=0x820270 | |
| 0x77176773 ntdll.dll:RtlAllocateHeap+0x1a83|mov dword ptr [ebp - 0x74], esi|ebp=0x19fda0|esi=0x80 | |
| 0x77176776 ntdll.dll:RtlAllocateHeap+0x1a86|cmp eax, esi|eax=0x37d|esi=0x80 | |
| 0x77176778 ntdll.dll:RtlAllocateHeap+0x1a88|jae 0x77176785|eflags=0x202 | |
| 0x77176785 ntdll.dll:RtlAllocateHeap+0x1a95|mov edx, dword ptr [ecx]|ecx=0x820270 | |
| 0x77176787 ntdll.dll:RtlAllocateHeap+0x1a97|test edx, edx|edx=0x822b00 | |
| 0x77176789 ntdll.dll:RtlAllocateHeap+0x1a99|jne 0x77176902|eflags=0x206 | |
| 0x77176902 ntdll.dll:RtlAllocateHeap+0x1c12|mov ecx, edx|edx=0x822b00 | |
| 0x77176904 ntdll.dll:RtlAllocateHeap+0x1c14|mov dword ptr [ebp - 0x28], ecx|ebp=0x19fda0|ecx=0x822b00 | |
| 0x77176907 ntdll.dll:RtlAllocateHeap+0x1c17|jmp 0x77176770 | |
| 0x77176770 ntdll.dll:RtlAllocateHeap+0x1a80|mov esi, dword ptr [ecx + 4]|ecx=0x822b00 | |
| 0x77176773 ntdll.dll:RtlAllocateHeap+0x1a83|mov dword ptr [ebp - 0x74], esi|ebp=0x19fda0|esi=0x800 | |
| 0x77176776 ntdll.dll:RtlAllocateHeap+0x1a86|cmp eax, esi|eax=0x37d|esi=0x800 | |
| 0x77176778 ntdll.dll:RtlAllocateHeap+0x1a88|jae 0x77176785|eflags=0x287 | |
| 0x7717677a ntdll.dll:RtlAllocateHeap+0x1a8a|lea edx, [esi - 1]|esi=0x800 | |
| 0x7717677d ntdll.dll:RtlAllocateHeap+0x1a8d|mov dword ptr [ebp - 0x8c], edx|ebp=0x19fda0|edx=0x7ff | |
| 0x77176783 ntdll.dll:RtlAllocateHeap+0x1a93|jmp 0x7717679b | |
| 0x7717679b ntdll.dll:RtlAllocateHeap+0x1aab|movzx edx, word ptr [ebx]|ebx=0x82b3f8 | |
| 0x7717679e ntdll.dll:RtlAllocateHeap+0x1aae|mov dword ptr [ebp - 0x7c], edx|ebp=0x19fda0|edx=0x37d | |
| 0x771767a1 ntdll.dll:RtlAllocateHeap+0x1ab1|mov edx, eax|eax=0x37d | |
| 0x771767a3 ntdll.dll:RtlAllocateHeap+0x1ab3|sub edx, dword ptr [ecx + 0x14]|edx=0x37d|ecx=0x822b00 | |
| 0x771767a6 ntdll.dll:RtlAllocateHeap+0x1ab6|mov dword ptr [ebp - 0x1c], edx|ebp=0x19fda0|edx=0x2fd | |
| 0x771767a9 ntdll.dll:RtlAllocateHeap+0x1ab9|cmp dword ptr [ecx + 8], 0|ecx=0x822b00 | |
| 0x771767ad ntdll.dll:RtlAllocateHeap+0x1abd|lea eax, [edx + edx]|edx=0x2fd | |
| 0x771767b0 ntdll.dll:RtlAllocateHeap+0x1ac0|jne 0x771767b4|eflags=0x246 | |
| 0x771767b2 ntdll.dll:RtlAllocateHeap+0x1ac2|mov eax, edx|edx=0x2fd | |
| 0x771767b4 ntdll.dll:RtlAllocateHeap+0x1ac4|shl eax, 2|eax=0x2fd | |
| 0x771767b7 ntdll.dll:RtlAllocateHeap+0x1ac7|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fda0|eax=0xbf4 | |
| 0x771767ba ntdll.dll:RtlAllocateHeap+0x1aca|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771767bd ntdll.dll:RtlAllocateHeap+0x1acd|add eax, dword ptr [ebp - 0x3c]|eax=0x822c14|ebp=0x19fda0 | |
| 0x771767c0 ntdll.dll:RtlAllocateHeap+0x1ad0|mov dword ptr [ebp - 0x54], eax|ebp=0x19fda0|eax=0x823808 | |
| 0x771767c3 ntdll.dll:RtlAllocateHeap+0x1ad3|mov eax, dword ptr [eax]|eax=0x823808 | |
| 0x771767c5 ntdll.dll:RtlAllocateHeap+0x1ad5|mov dword ptr [ebp - 0x24], eax|ebp=0x19fda0|eax=0x82b400 | |
| 0x771767c8 ntdll.dll:RtlAllocateHeap+0x1ad8|dec dword ptr [ecx + 0xc]|ecx=0x822b00 | |
| 0x771767cb ntdll.dll:RtlAllocateHeap+0x1adb|mov eax, dword ptr [ebp - 0x8c]|ebp=0x19fda0 | |
| 0x771767d1 ntdll.dll:RtlAllocateHeap+0x1ae1|cmp dword ptr [ebp - 0x4c], eax|ebp=0x19fda0|eax=0x7ff | |
| 0x771767d4 ntdll.dll:RtlAllocateHeap+0x1ae4|jne 0x771767d9|eflags=0x297 | |
| 0x771767d9 ntdll.dll:RtlAllocateHeap+0x1ae9|lea esi, [ebx + 8]|ebx=0x82b3f8 | |
| 0x771767dc ntdll.dll:RtlAllocateHeap+0x1aec|cmp dword ptr [ebp - 0x24], esi|ebp=0x19fda0|esi=0x82b400 | |
| 0x771767df ntdll.dll:RtlAllocateHeap+0x1aef|mov esi, dword ptr [ebp - 0x74]|ebp=0x19fda0 | |
| 0x771767e2 ntdll.dll:RtlAllocateHeap+0x1af2|jne 0x77176883|eflags=0x246 | |
| 0x771767e8 ntdll.dll:RtlAllocateHeap+0x1af8|mov dword ptr [ebp - 0xc4], esi|ebp=0x19fda0|esi=0x800 | |
| 0x771767ee ntdll.dll:RtlAllocateHeap+0x1afe|cmp dword ptr [ecx], 0|ecx=0x822b00 | |
| 0x771767f1 ntdll.dll:RtlAllocateHeap+0x1b01|jne 0x771767fb|eflags=0x246 | |
| 0x771767f3 ntdll.dll:RtlAllocateHeap+0x1b03|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fda0|eax=0x7ff | |
| 0x771767f9 ntdll.dll:RtlAllocateHeap+0x1b09|jmp 0x771767fe | |
| 0x771767fe ntdll.dll:RtlAllocateHeap+0x1b0e|mov esi, dword ptr [ebx + 8]|ebx=0x82b3f8 | |
| 0x77176801 ntdll.dll:RtlAllocateHeap+0x1b11|mov edx, dword ptr [ecx + 0x18]|ecx=0x822b00 | |
| 0x77176804 ntdll.dll:RtlAllocateHeap+0x1b14|mov dword ptr [ebp - 0x24], edx|ebp=0x19fda0|edx=0x8200c0 | |
| 0x77176807 ntdll.dll:RtlAllocateHeap+0x1b17|cmp dword ptr [ebp - 0x4c], eax|ebp=0x19fda0|eax=0x7ff | |
| 0x7717680a ntdll.dll:RtlAllocateHeap+0x1b1a|mov edx, dword ptr [ebp - 0x1c]|ebp=0x19fda0 | |
| 0x7717680d ntdll.dll:RtlAllocateHeap+0x1b1d|jae 0x771768ee|eflags=0x297 | |
| 0x77176813 ntdll.dll:RtlAllocateHeap+0x1b23|cmp esi, dword ptr [ecx + 0x18]|esi=0x8200c0|ecx=0x822b00 | |
| 0x77176816 ntdll.dll:RtlAllocateHeap+0x1b26|je 0x771768bf|eflags=0x246 | |
| 0x771768bf ntdll.dll:RtlAllocateHeap+0x1bcf|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771768c2 ntdll.dll:RtlAllocateHeap+0x1bd2|mov ecx, dword ptr [ebp - 0x3c]|ebp=0x19fda0 | |
| 0x771768c5 ntdll.dll:RtlAllocateHeap+0x1bd5|mov dword ptr [ecx + eax], 0|ecx=0xbf4|eax=0x822c14 | |
| 0x771768cc ntdll.dll:RtlAllocateHeap+0x1bdc|mov esi, edx|edx=0x2fd | |
| 0x771768ce ntdll.dll:RtlAllocateHeap+0x1bde|shr esi, 5|esi=0x2fd | |
| 0x771768d1 ntdll.dll:RtlAllocateHeap+0x1be1|and edx, 0x1f|edx=0x2fd | |
| 0x771768d4 ntdll.dll:RtlAllocateHeap+0x1be4|mov dword ptr [ebp - 0x1c], edx|ebp=0x19fda0|edx=0x1d | |
| 0x771768d7 ntdll.dll:RtlAllocateHeap+0x1be7|mov edx, 1 | |
| 0x771768dc ntdll.dll:RtlAllocateHeap+0x1bec|mov ecx, dword ptr [ebp - 0x1c]|ebp=0x19fda0 | |
| 0x771768df ntdll.dll:RtlAllocateHeap+0x1bef|shl edx, cl|edx=0x1|cl=0x1d | |
| 0x771768e1 ntdll.dll:RtlAllocateHeap+0x1bf1|mov eax, dword ptr [ebp - 0x28]|ebp=0x19fda0 | |
| 0x771768e4 ntdll.dll:RtlAllocateHeap+0x1bf4|mov eax, dword ptr [eax + 0x1c]|eax=0x822b00 | |
| 0x771768e7 ntdll.dll:RtlAllocateHeap+0x1bf7|not edx|edx=0x20000000 | |
| 0x771768e9 ntdll.dll:RtlAllocateHeap+0x1bf9|and dword ptr [eax + esi*4], edx|eax=0x822b24|esi=0x17|edx=0xdfffffff | |
| 0x771768ec ntdll.dll:RtlAllocateHeap+0x1bfc|jmp 0x77176883 | |
| 0x77176883 ntdll.dll:RtlAllocateHeap+0x1b93|mov eax, dword ptr [ebp - 0x84]|ebp=0x19fda0 | |
| 0x77176889 ntdll.dll:RtlAllocateHeap+0x1b99|mov ecx, dword ptr [ebp - 0x20]|ebp=0x19fda0 | |
| 0x7717688c ntdll.dll:RtlAllocateHeap+0x1b9c|mov dword ptr [ecx], eax|ecx=0x8266e8|eax=0x8200c0 | |
| 0x7717688e ntdll.dll:RtlAllocateHeap+0x1b9e|mov dword ptr [eax + 4], ecx|eax=0x8200c0|ecx=0x8266e8 | |
| 0x77176891 ntdll.dll:RtlAllocateHeap+0x1ba1|test byte ptr [ebx + 2], 8|ebx=0x82b3f8 | |
| 0x77176895 ntdll.dll:RtlAllocateHeap+0x1ba5|je 0x7717690c|eflags=0x246 | |
| 0x7717690c ntdll.dll:RtlAllocateHeap+0x1c1c|mov byte ptr [ebp - 0x42], 1|ebp=0x19fda0 | |
| 0x77176910 ntdll.dll:RtlAllocateHeap+0x1c20|jmp 0x771769ee | |
| 0x771769ee ntdll.dll:RtlAllocateHeap+0x1cfe|mov cl, byte ptr [ebx + 2]|ebx=0x82b3f8 | |
| 0x771769f1 ntdll.dll:RtlAllocateHeap+0x1d01|mov byte ptr [ebp - 0x43], cl|ebp=0x19fda0|cl=0x0 | |
| 0x771769f4 ntdll.dll:RtlAllocateHeap+0x1d04|mov esi, dword ptr [ebp - 0x64]|ebp=0x19fda0 | |
| 0x771769f7 ntdll.dll:RtlAllocateHeap+0x1d07|test esi, esi|esi=0x1 | |
| 0x771769f9 ntdll.dll:RtlAllocateHeap+0x1d09|jne 0x77176ac5|eflags=0x202 | |
| 0x77176ac5 ntdll.dll:RtlAllocateHeap+0x1dd5|mov dword ptr [ebp - 0x6c], ebx|ebp=0x19fda0|ebx=0x82b3f8 | |
| 0x77176ac8 ntdll.dll:RtlAllocateHeap+0x1dd8|test byte ptr [ebx + 2], 1|ebx=0x82b3f8 | |
| 0x77176acc ntdll.dll:RtlAllocateHeap+0x1ddc|je 0x77176ae6|eflags=0x246 | |
| 0x77176ae6 ntdll.dll:RtlAllocateHeap+0x1df6|mov eax, dword ptr [ebp - 0x34]|ebp=0x19fda0 | |
| 0x77176ae9 ntdll.dll:RtlAllocateHeap+0x1df9|mov byte ptr [ebx + 2], al|ebx=0x82b3f8|al=0x1 | |
| 0x77176aec ntdll.dll:RtlAllocateHeap+0x1dfc|movzx edx, word ptr [ebx]|ebx=0x82b3f8 | |
| 0x77176aef ntdll.dll:RtlAllocateHeap+0x1dff|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x77176af2 ntdll.dll:RtlAllocateHeap+0x1e02|sub edx, ecx|edx=0x37d|ecx=0x8 | |
| 0x77176af4 ntdll.dll:RtlAllocateHeap+0x1e04|mov dword ptr [ebp - 0x3c], edx|ebp=0x19fda0|edx=0x375 | |
| 0x77176af7 ntdll.dll:RtlAllocateHeap+0x1e07|mov dword ptr [ebp - 0x100], edx|ebp=0x19fda0|edx=0x375 | |
| 0x77176afd ntdll.dll:RtlAllocateHeap+0x1e0d|movzx eax, cx|cx=0x8 | |
| 0x77176b00 ntdll.dll:RtlAllocateHeap+0x1e10|mov dword ptr [ebp - 0x20], eax|ebp=0x19fda0|eax=0x8 | |
| 0x77176b03 ntdll.dll:RtlAllocateHeap+0x1e13|mov word ptr [ebx], ax|ebx=0x82b3f8|ax=0x8 | |
| 0x77176b06 ntdll.dll:RtlAllocateHeap+0x1e16|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fda0 | |
| 0x77176b09 ntdll.dll:RtlAllocateHeap+0x1e19|sub eax, dword ptr [ebp + 8]|eax=0x40|ebp=0x19fda0 | |
| 0x77176b0c ntdll.dll:RtlAllocateHeap+0x1e1c|mov dword ptr [ebp - 0x7c], eax|ebp=0x19fda0|eax=0x8 | |
| 0x77176b0f ntdll.dll:RtlAllocateHeap+0x1e1f|cmp eax, 0x3f|eax=0x8 | |
| 0x77176b12 ntdll.dll:RtlAllocateHeap+0x1e22|jae 0x77176b19|eflags=0x297 | |
| 0x77176b14 ntdll.dll:RtlAllocateHeap+0x1e24|mov byte ptr [ebx + 7], al|ebx=0x82b3f8|al=0x8 | |
| 0x77176b17 ntdll.dll:RtlAllocateHeap+0x1e27|jmp 0x77176b21 | |
| 0x77176b21 ntdll.dll:RtlAllocateHeap+0x1e31|mov byte ptr [ebx + 3], 0|ebx=0x82b3f8 | |
| 0x77176b25 ntdll.dll:RtlAllocateHeap+0x1e35|test edx, edx|edx=0x375 | |
| 0x77176b27 ntdll.dll:RtlAllocateHeap+0x1e37|je 0x77176b47|eflags=0x202 | |
| 0x77176b29 ntdll.dll:RtlAllocateHeap+0x1e39|cmp edx, 1|edx=0x375 | |
| 0x77176b2c ntdll.dll:RtlAllocateHeap+0x1e3c|jne 0x77176c8c|eflags=0x206 | |
| 0x77176c8c ntdll.dll:RtlAllocateHeap+0x1f9c|xor eax, eax|eax=0x8 | |
| 0x77176c8e ntdll.dll:RtlAllocateHeap+0x1f9e|test esi, esi|esi=0x1 | |
| 0x77176c90 ntdll.dll:RtlAllocateHeap+0x1fa0|sete al|al=0x0|eflags=0x202 | |
| 0x77176c93 ntdll.dll:RtlAllocateHeap+0x1fa3|mov dword ptr [ebp - 0x1c], eax|ebp=0x19fda0|eax=0x0 | |
| 0x77176c96 ntdll.dll:RtlAllocateHeap+0x1fa6|mov dword ptr [ebp - 0xac], eax|ebp=0x19fda0|eax=0x0 | |
| 0x77176c9c ntdll.dll:RtlAllocateHeap+0x1fac|mov al, byte ptr [ebx + 6]|ebx=0x82b3f8 | |
| 0x77176c9f ntdll.dll:RtlAllocateHeap+0x1faf|test al, al|al=0x0 | |
| 0x77176ca1 ntdll.dll:RtlAllocateHeap+0x1fb1|je 0x77176cbd|eflags=0x246 | |
| 0x77176cbd ntdll.dll:RtlAllocateHeap+0x1fcd|mov ecx, edi|edi=0x820000 | |
| 0x77176cbf ntdll.dll:RtlAllocateHeap+0x1fcf|mov esi, edi|edi=0x820000 | |
| 0x77176cc1 ntdll.dll:RtlAllocateHeap+0x1fd1|mov dword ptr [ebp - 0xcc], ecx|ebp=0x19fda0|ecx=0x820000 | |
| 0x77176cc7 ntdll.dll:RtlAllocateHeap+0x1fd7|mov dword ptr [ebp - 0x24], edx|ebp=0x19fda0|edx=0x375 | |
| 0x77176cca ntdll.dll:RtlAllocateHeap+0x1fda|mov eax, dword ptr [ebp - 0x30]|ebp=0x19fda0 | |
| 0x77176ccd ntdll.dll:RtlAllocateHeap+0x1fdd|lea ebx, [ebx + eax*8]|ebx=0x82b3f8|eax=0x8 | |
| 0x77176cd0 ntdll.dll:RtlAllocateHeap+0x1fe0|mov dword ptr [ebp - 0x54], 0|ebp=0x19fda0 | |
| 0x77176cd7 ntdll.dll:RtlAllocateHeap+0x1fe7|mov al, byte ptr [ebp - 0x43]|ebp=0x19fda0 | |
| 0x77176cda ntdll.dll:RtlAllocateHeap+0x1fea|mov byte ptr [ebx + 2], al|ebx=0x82b438|al=0x0 | |
| 0x77176cdd ntdll.dll:RtlAllocateHeap+0x1fed|mov byte ptr [ebx + 7], 0|ebx=0x82b438 | |
| 0x77176ce1 ntdll.dll:RtlAllocateHeap+0x1ff1|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77176ce5 ntdll.dll:RtlAllocateHeap+0x1ff5|xor ax, word ptr [ebp - 0x20]|ax=0x10ad|ebp=0x19fda0 | |
| 0x77176ce9 ntdll.dll:RtlAllocateHeap+0x1ff9|mov word ptr [ebx + 4], ax|ebx=0x82b438|ax=0x10a5 | |
| 0x77176ced ntdll.dll:RtlAllocateHeap+0x1ffd|cmp dword ptr [ecx + 0x18], esi|ecx=0x820000|esi=0x820000 | |
| 0x77176cf0 ntdll.dll:RtlAllocateHeap+0x2000|jne 0x77176cf6|eflags=0x246 | |
| 0x77176cf2 ntdll.dll:RtlAllocateHeap+0x2002|xor al, al|al=0xa5 | |
| 0x77176cf4 ntdll.dll:RtlAllocateHeap+0x2004|jmp 0x77176d27 | |
| 0x77176d27 ntdll.dll:RtlAllocateHeap+0x2037|mov byte ptr [ebp - 0x7e], al|ebp=0x19fda0|al=0x0 | |
| 0x77176d2a ntdll.dll:RtlAllocateHeap+0x203a|mov byte ptr [ebx + 6], al|ebx=0x82b438|al=0x0 | |
| 0x77176d2d ntdll.dll:RtlAllocateHeap+0x203d|mov byte ptr [ebx + 3], 0|ebx=0x82b438 | |
| 0x77176d31 ntdll.dll:RtlAllocateHeap+0x2041|mov word ptr [ebx], dx|ebx=0x82b438|dx=0x375 | |
| 0x77176d34 ntdll.dll:RtlAllocateHeap+0x2044|lea esi, [ebx + edx*8]|ebx=0x82b438|edx=0x375 | |
| 0x77176d37 ntdll.dll:RtlAllocateHeap+0x2047|mov ecx, dword ptr [edi + 0x4c]|edi=0x820000 | |
| 0x77176d3a ntdll.dll:RtlAllocateHeap+0x204a|mov eax, ecx|ecx=0x100000 | |
| 0x77176d3c ntdll.dll:RtlAllocateHeap+0x204c|shr eax, 0x14|eax=0x100000 | |
| 0x77176d3f ntdll.dll:RtlAllocateHeap+0x204f|and al, byte ptr [edi + 0x52]|al=0x1|edi=0x820000 | |
| 0x77176d42 ntdll.dll:RtlAllocateHeap+0x2052|xor al, byte ptr [esi + 2]|al=0x0|esi=0x82cfe0 | |
| 0x77176d45 ntdll.dll:RtlAllocateHeap+0x2055|test al, 1|al=0x1b | |
| 0x77176d47 ntdll.dll:RtlAllocateHeap+0x2057|je 0x771772aa|eflags=0x202 | |
| 0x77176d4d ntdll.dll:RtlAllocateHeap+0x205d|movzx edx, dx|dx=0x375 | |
| 0x77176d50 ntdll.dll:RtlAllocateHeap+0x2060|mov dword ptr [ebp - 0x28], edx|ebp=0x19fda0|edx=0x375 | |
| 0x77176d53 ntdll.dll:RtlAllocateHeap+0x2063|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77176d57 ntdll.dll:RtlAllocateHeap+0x2067|xor ax, dx|ax=0x10ad|dx=0x375 | |
| 0x77176d5a ntdll.dll:RtlAllocateHeap+0x206a|mov word ptr [esi + 4], ax|esi=0x82cfe0|ax=0x13d8 | |
| 0x77176d5e ntdll.dll:RtlAllocateHeap+0x206e|cmp byte ptr [ebp - 0x1c], 0|ebp=0x19fda0 | |
| 0x77176d62 ntdll.dll:RtlAllocateHeap+0x2072|jne 0x771771bf|eflags=0x246 | |
| 0x77176d68 ntdll.dll:RtlAllocateHeap+0x2078|mov byte ptr [ebx + 2], 0|ebx=0x82b438 | |
| 0x77176d6c ntdll.dll:RtlAllocateHeap+0x207c|mov byte ptr [ebx + 7], 0|ebx=0x82b438 | |
| 0x77176d70 ntdll.dll:RtlAllocateHeap+0x2080|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176d76 ntdll.dll:RtlAllocateHeap+0x2086|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x77176d7c ntdll.dll:RtlAllocateHeap+0x208c|mov dword ptr [ebp - 0x1c], esi|ebp=0x19fda0|esi=0x820270 | |
| 0x77176d7f ntdll.dll:RtlAllocateHeap+0x208f|test esi, esi|esi=0x820270 | |
| 0x77176d81 ntdll.dll:RtlAllocateHeap+0x2091|je 0x7717701d|eflags=0x202 | |
| 0x77176d87 ntdll.dll:RtlAllocateHeap+0x2097|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176d8a ntdll.dll:RtlAllocateHeap+0x209a|cmp edx, ecx|edx=0x375|ecx=0x80 | |
| 0x77176d8c ntdll.dll:RtlAllocateHeap+0x209c|jae 0x77176d92|eflags=0x206 | |
| 0x77176d92 ntdll.dll:RtlAllocateHeap+0x20a2|mov eax, dword ptr [esi]|esi=0x820270 | |
| 0x77176d94 ntdll.dll:RtlAllocateHeap+0x20a4|test eax, eax|eax=0x822b00 | |
| 0x77176d96 ntdll.dll:RtlAllocateHeap+0x20a6|jne 0x77177013|eflags=0x206 | |
| 0x77177013 ntdll.dll:RtlAllocateHeap+0x2323|mov esi, eax|eax=0x822b00 | |
| 0x77177015 ntdll.dll:RtlAllocateHeap+0x2325|mov dword ptr [ebp - 0x1c], esi|ebp=0x19fda0|esi=0x822b00 | |
| 0x77177018 ntdll.dll:RtlAllocateHeap+0x2328|jmp 0x77176d87 | |
| 0x77176d87 ntdll.dll:RtlAllocateHeap+0x2097|mov ecx, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176d8a ntdll.dll:RtlAllocateHeap+0x209a|cmp edx, ecx|edx=0x375|ecx=0x800 | |
| 0x77176d8c ntdll.dll:RtlAllocateHeap+0x209c|jae 0x77176d92|eflags=0x283 | |
| 0x77176d8e ntdll.dll:RtlAllocateHeap+0x209e|mov eax, edx|edx=0x375 | |
| 0x77176d90 ntdll.dll:RtlAllocateHeap+0x20a0|jmp 0x77176d9f | |
| 0x77176d9f ntdll.dll:RtlAllocateHeap+0x20af|mov dword ptr [ebp - 0x74], eax|ebp=0x19fda0|eax=0x375 | |
| 0x77176da2 ntdll.dll:RtlAllocateHeap+0x20b2|sub eax, dword ptr [esi + 0x14]|eax=0x375|esi=0x822b00 | |
| 0x77176da5 ntdll.dll:RtlAllocateHeap+0x20b5|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fda0|eax=0x2f5 | |
| 0x77176da8 ntdll.dll:RtlAllocateHeap+0x20b8|mov dword ptr [ebp - 0x7c], 0|ebp=0x19fda0 | |
| 0x77176daf ntdll.dll:RtlAllocateHeap+0x20bf|mov eax, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x77176db2 ntdll.dll:RtlAllocateHeap+0x20c2|mov dword ptr [ebp - 0x34], eax|ebp=0x19fda0|eax=0x8200c0 | |
| 0x77176db5 ntdll.dll:RtlAllocateHeap+0x20c5|mov ecx, dword ptr [eax + 4]|eax=0x8200c0 | |
| 0x77176db8 ntdll.dll:RtlAllocateHeap+0x20c8|cmp eax, ecx|eax=0x8200c0|ecx=0x8266e8 | |
| 0x77176dba ntdll.dll:RtlAllocateHeap+0x20ca|jne 0x77176dc3|eflags=0x297 | |
| 0x77176dc3 ntdll.dll:RtlAllocateHeap+0x20d3|lea eax, [ecx - 8]|ecx=0x8266e8 | |
| 0x77176dc6 ntdll.dll:RtlAllocateHeap+0x20d6|mov dword ptr [ebp - 0x20], eax|ebp=0x19fda0|eax=0x8266e0 | |
| 0x77176dc9 ntdll.dll:RtlAllocateHeap+0x20d9|mov edx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176dcb ntdll.dll:RtlAllocateHeap+0x20db|mov dword ptr [ebp - 0x158], edx|ebp=0x19fda0|edx=0x261ac808 | |
| 0x77176dd1 ntdll.dll:RtlAllocateHeap+0x20e1|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176dd5 ntdll.dll:RtlAllocateHeap+0x20e5|je 0x77176e12|eflags=0x206 | |
| 0x77176dd7 ntdll.dll:RtlAllocateHeap+0x20e7|xor edx, dword ptr [edi + 0x50]|edx=0x261ac808|edi=0x820000 | |
| 0x77176dda ntdll.dll:RtlAllocateHeap+0x20ea|mov dword ptr [ebp - 0x24], edx|ebp=0x19fda0|edx=0x2000002 | |
| 0x77176ddd ntdll.dll:RtlAllocateHeap+0x20ed|mov dword ptr [ebp - 0x158], edx|ebp=0x19fda0|edx=0x2000002 | |
| 0x77176de3 ntdll.dll:RtlAllocateHeap+0x20f3|mov ecx, edx|edx=0x2000002 | |
| 0x77176de5 ntdll.dll:RtlAllocateHeap+0x20f5|shr ecx, 0x10|ecx=0x2000002 | |
| 0x77176de8 ntdll.dll:RtlAllocateHeap+0x20f8|mov eax, edx|edx=0x2000002 | |
| 0x77176dea ntdll.dll:RtlAllocateHeap+0x20fa|shr eax, 8|eax=0x2000002 | |
| 0x77176ded ntdll.dll:RtlAllocateHeap+0x20fd|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176def ntdll.dll:RtlAllocateHeap+0x20ff|xor cl, dl|cl=0x0|dl=0x2 | |
| 0x77176df1 ntdll.dll:RtlAllocateHeap+0x2101|mov eax, edx|edx=0x2000002 | |
| 0x77176df3 ntdll.dll:RtlAllocateHeap+0x2103|shr eax, 0x18|eax=0x2000002 | |
| 0x77176df6 ntdll.dll:RtlAllocateHeap+0x2106|cmp al, cl|al=0x2|cl=0x2 | |
| 0x77176df8 ntdll.dll:RtlAllocateHeap+0x2108|je 0x77176e12|eflags=0x246 | |
| 0x77176e12 ntdll.dll:RtlAllocateHeap+0x2122|movzx eax, dx|dx=0x2 | |
| 0x77176e15 ntdll.dll:RtlAllocateHeap+0x2125|mov ecx, dword ptr [ebp - 0x28]|ebp=0x19fda0 | |
| 0x77176e18 ntdll.dll:RtlAllocateHeap+0x2128|sub ecx, eax|ecx=0x375|eax=0x2 | |
| 0x77176e1a ntdll.dll:RtlAllocateHeap+0x212a|mov dword ptr [ebp - 0x104], ecx|ebp=0x19fda0|ecx=0x373 | |
| 0x77176e20 ntdll.dll:RtlAllocateHeap+0x2130|test ecx, ecx|ecx=0x373 | |
| 0x77176e22 ntdll.dll:RtlAllocateHeap+0x2132|jle 0x77176e2c|eflags=0x202 | |
| 0x77176e24 ntdll.dll:RtlAllocateHeap+0x2134|mov ecx, dword ptr [ebp - 0x34]|ebp=0x19fda0 | |
| 0x77176e27 ntdll.dll:RtlAllocateHeap+0x2137|jmp 0x77176ff7 | |
| 0x77176ff7 ntdll.dll:RtlAllocateHeap+0x2307|test ecx, ecx|ecx=0x8200c0 | |
| 0x77176ff9 ntdll.dll:RtlAllocateHeap+0x2309|je 0x77177006|eflags=0x206 | |
| 0x77176ffb ntdll.dll:RtlAllocateHeap+0x230b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77177001 ntdll.dll:RtlAllocateHeap+0x2311|jmp 0x7717701f | |
| 0x7717701f ntdll.dll:RtlAllocateHeap+0x232f|mov esi, dword ptr [ebp - 0x28]|ebp=0x19fda0 | |
| 0x77177022 ntdll.dll:RtlAllocateHeap+0x2332|cmp eax, ecx|eax=0x8200c0|ecx=0x8200c0 | |
| 0x77177024 ntdll.dll:RtlAllocateHeap+0x2334|je 0x7717705b|eflags=0x246 | |
| 0x7717705b ntdll.dll:RtlAllocateHeap+0x236b|lea eax, [ebx + 8]|ebx=0x82b438 | |
| 0x7717705e ntdll.dll:RtlAllocateHeap+0x236e|mov edx, dword ptr [ecx + 4]|ecx=0x8200c0 | |
| 0x77177061 ntdll.dll:RtlAllocateHeap+0x2371|mov esi, dword ptr [edx]|edx=0x8266e8 | |
| 0x77177063 ntdll.dll:RtlAllocateHeap+0x2373|cmp esi, ecx|esi=0x8200c0|ecx=0x8200c0 | |
| 0x77177065 ntdll.dll:RtlAllocateHeap+0x2375|jne 0x77177073|eflags=0x246 | |
| 0x77177067 ntdll.dll:RtlAllocateHeap+0x2377|mov dword ptr [eax], ecx|eax=0x82b440|ecx=0x8200c0 | |
| 0x77177069 ntdll.dll:RtlAllocateHeap+0x2379|mov dword ptr [eax + 4], edx|eax=0x82b440|edx=0x8266e8 | |
| 0x7717706c ntdll.dll:RtlAllocateHeap+0x237c|mov dword ptr [edx], eax|edx=0x8266e8|eax=0x82b440 | |
| 0x7717706e ntdll.dll:RtlAllocateHeap+0x237e|mov dword ptr [ecx + 4], eax|ecx=0x8200c0|eax=0x82b440 | |
| 0x77177071 ntdll.dll:RtlAllocateHeap+0x2381|jmp 0x77177083 | |
| 0x77177083 ntdll.dll:RtlAllocateHeap+0x2393|movzx eax, word ptr [ebx]|ebx=0x82b438 | |
| 0x77177086 ntdll.dll:RtlAllocateHeap+0x2396|add dword ptr [edi + 0x74], eax|edi=0x820000|eax=0x375 | |
| 0x77177089 ntdll.dll:RtlAllocateHeap+0x2399|mov ecx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717708f ntdll.dll:RtlAllocateHeap+0x239f|mov dword ptr [ebp - 0x34], ecx|ebp=0x19fda0|ecx=0x820270 | |
| 0x77177092 ntdll.dll:RtlAllocateHeap+0x23a2|test ecx, ecx|ecx=0x820270 | |
| 0x77177094 ntdll.dll:RtlAllocateHeap+0x23a4|je 0x77177196|eflags=0x202 | |
| 0x7717709a ntdll.dll:RtlAllocateHeap+0x23aa|movzx eax, word ptr [ebx]|ebx=0x82b438 | |
| 0x7717709d ntdll.dll:RtlAllocateHeap+0x23ad|mov dword ptr [ebp - 0x7c], eax|ebp=0x19fda0|eax=0x375 | |
| 0x771770a0 ntdll.dll:RtlAllocateHeap+0x23b0|mov esi, dword ptr [ecx + 4]|ecx=0x820270 | |
| 0x771770a3 ntdll.dll:RtlAllocateHeap+0x23b3|cmp eax, esi|eax=0x375|esi=0x80 | |
| 0x771770a5 ntdll.dll:RtlAllocateHeap+0x23b5|jae 0x771770b1|eflags=0x206 | |
| 0x771770b1 ntdll.dll:RtlAllocateHeap+0x23c1|mov edx, dword ptr [ecx]|ecx=0x820270 | |
| 0x771770b3 ntdll.dll:RtlAllocateHeap+0x23c3|test edx, edx|edx=0x822b00 | |
| 0x771770b5 ntdll.dll:RtlAllocateHeap+0x23c5|jne 0x771771b5|eflags=0x206 | |
| 0x771771b5 ntdll.dll:RtlAllocateHeap+0x24c5|mov ecx, edx|edx=0x822b00 | |
| 0x771771b7 ntdll.dll:RtlAllocateHeap+0x24c7|mov dword ptr [ebp - 0x34], ecx|ebp=0x19fda0|ecx=0x822b00 | |
| 0x771771ba ntdll.dll:RtlAllocateHeap+0x24ca|jmp 0x771770a0 | |
| 0x771770a0 ntdll.dll:RtlAllocateHeap+0x23b0|mov esi, dword ptr [ecx + 4]|ecx=0x822b00 | |
| 0x771770a3 ntdll.dll:RtlAllocateHeap+0x23b3|cmp eax, esi|eax=0x375|esi=0x800 | |
| 0x771770a5 ntdll.dll:RtlAllocateHeap+0x23b5|jae 0x771770b1|eflags=0x283 | |
| 0x771770a7 ntdll.dll:RtlAllocateHeap+0x23b7|mov edx, eax|eax=0x375 | |
| 0x771770a9 ntdll.dll:RtlAllocateHeap+0x23b9|lea eax, [esi - 1]|esi=0x800 | |
| 0x771770ac ntdll.dll:RtlAllocateHeap+0x23bc|mov dword ptr [ebp - 0x54], eax|ebp=0x19fda0|eax=0x7ff | |
| 0x771770af ntdll.dll:RtlAllocateHeap+0x23bf|jmp 0x771770c1 | |
| 0x771770c1 ntdll.dll:RtlAllocateHeap+0x23d1|mov esi, edx|edx=0x375 | |
| 0x771770c3 ntdll.dll:RtlAllocateHeap+0x23d3|sub esi, dword ptr [ecx + 0x14]|esi=0x375|ecx=0x822b00 | |
| 0x771770c6 ntdll.dll:RtlAllocateHeap+0x23d6|mov dword ptr [ebp - 0x3c], esi|ebp=0x19fda0|esi=0x2f5 | |
| 0x771770c9 ntdll.dll:RtlAllocateHeap+0x23d9|cmp dword ptr [ecx + 8], 0|ecx=0x822b00 | |
| 0x771770cd ntdll.dll:RtlAllocateHeap+0x23dd|lea eax, [esi + esi]|esi=0x2f5 | |
| 0x771770d0 ntdll.dll:RtlAllocateHeap+0x23e0|jne 0x771770d4|eflags=0x246 | |
| 0x771770d2 ntdll.dll:RtlAllocateHeap+0x23e2|mov eax, esi|esi=0x2f5 | |
| 0x771770d4 ntdll.dll:RtlAllocateHeap+0x23e4|inc dword ptr [ecx + 0xc]|ecx=0x822b00 | |
| 0x771770d7 ntdll.dll:RtlAllocateHeap+0x23e7|shl eax, 2|eax=0x2f5 | |
| 0x771770da ntdll.dll:RtlAllocateHeap+0x23ea|mov dword ptr [ebp - 0x8c], eax|ebp=0x19fda0|eax=0xbd4 | |
| 0x771770e0 ntdll.dll:RtlAllocateHeap+0x23f0|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771770e3 ntdll.dll:RtlAllocateHeap+0x23f3|mov esi, dword ptr [ebp - 0x8c]|ebp=0x19fda0 | |
| 0x771770e9 ntdll.dll:RtlAllocateHeap+0x23f9|mov eax, dword ptr [esi + eax]|esi=0xbd4|eax=0x822c14 | |
| 0x771770ec ntdll.dll:RtlAllocateHeap+0x23fc|mov dword ptr [ebp - 0x84], eax|ebp=0x19fda0|eax=0x0 | |
| 0x771770f2 ntdll.dll:RtlAllocateHeap+0x2402|cmp edx, dword ptr [ebp - 0x54]|edx=0x375|ebp=0x19fda0 | |
| 0x771770f5 ntdll.dll:RtlAllocateHeap+0x2405|mov esi, dword ptr [ebp - 0x3c]|ebp=0x19fda0 | |
| 0x771770f8 ntdll.dll:RtlAllocateHeap+0x2408|jne 0x771770fd|eflags=0x293 | |
| 0x771770fd ntdll.dll:RtlAllocateHeap+0x240d|test eax, eax|eax=0x0 | |
| 0x771770ff ntdll.dll:RtlAllocateHeap+0x240f|je 0x77177165|eflags=0x246 | |
| 0x77177165 ntdll.dll:RtlAllocateHeap+0x2475|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x77177168 ntdll.dll:RtlAllocateHeap+0x2478|lea ecx, [ebx + 8]|ebx=0x82b438 | |
| 0x7717716b ntdll.dll:RtlAllocateHeap+0x247b|mov edx, dword ptr [ebp - 0x8c]|ebp=0x19fda0 | |
| 0x77177171 ntdll.dll:RtlAllocateHeap+0x2481|mov dword ptr [edx + eax], ecx|edx=0xbd4|eax=0x822c14|ecx=0x82b440 | |
| 0x77177174 ntdll.dll:RtlAllocateHeap+0x2484|cmp dword ptr [ebp - 0x84], 0|ebp=0x19fda0 | |
| 0x7717717b ntdll.dll:RtlAllocateHeap+0x248b|jne 0x77177196|eflags=0x246 | |
| 0x7717717d ntdll.dll:RtlAllocateHeap+0x248d|shr esi, 5|esi=0x2f5 | |
| 0x77177180 ntdll.dll:RtlAllocateHeap+0x2490|mov ecx, dword ptr [ebp - 0x3c]|ebp=0x19fda0 | |
| 0x77177183 ntdll.dll:RtlAllocateHeap+0x2493|and ecx, 0x1f|ecx=0x2f5 | |
| 0x77177186 ntdll.dll:RtlAllocateHeap+0x2496|mov edx, 1 | |
| 0x7717718b ntdll.dll:RtlAllocateHeap+0x249b|shl edx, cl|edx=0x1|cl=0x15 | |
| 0x7717718d ntdll.dll:RtlAllocateHeap+0x249d|mov eax, dword ptr [ebp - 0x34]|ebp=0x19fda0 | |
| 0x77177190 ntdll.dll:RtlAllocateHeap+0x24a0|mov eax, dword ptr [eax + 0x1c]|eax=0x822b00 | |
| 0x77177193 ntdll.dll:RtlAllocateHeap+0x24a3|or dword ptr [eax + esi*4], edx|eax=0x822b24|esi=0x17|edx=0x200000 | |
| 0x77177196 ntdll.dll:RtlAllocateHeap+0x24a6|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717719a ntdll.dll:RtlAllocateHeap+0x24aa|je 0x77177637|eflags=0x206 | |
| 0x771771a0 ntdll.dll:RtlAllocateHeap+0x24b0|mov al, byte ptr [ebx + 2]|ebx=0x82b438 | |
| 0x771771a3 ntdll.dll:RtlAllocateHeap+0x24b3|xor al, byte ptr [ebx + 1]|al=0x0|ebx=0x82b438 | |
| 0x771771a6 ntdll.dll:RtlAllocateHeap+0x24b6|xor al, byte ptr [ebx]|al=0x3|ebx=0x82b438 | |
| 0x771771a8 ntdll.dll:RtlAllocateHeap+0x24b8|mov byte ptr [ebx + 3], al|ebx=0x82b438|al=0x76 | |
| 0x771771ab ntdll.dll:RtlAllocateHeap+0x24bb|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x771771ae ntdll.dll:RtlAllocateHeap+0x24be|xor dword ptr [ebx], eax|ebx=0x82b438|eax=0x241ac80a | |
| 0x771771b0 ntdll.dll:RtlAllocateHeap+0x24c0|jmp 0x77177637 | |
| 0x77177637 ntdll.dll:RtlAllocateHeap+0x2947|mov byte ptr [ebp - 0x7f], 1|ebp=0x19fda0 | |
| 0x7717763b ntdll.dll:RtlAllocateHeap+0x294b|mov byte ptr [ebp - 0x43], 0|ebp=0x19fda0 | |
| 0x7717763f ntdll.dll:RtlAllocateHeap+0x294f|jmp 0x77176b47 | |
| 0x77176b47 ntdll.dll:RtlAllocateHeap+0x1e57|mov ecx, dword ptr [ebp - 0x6c]|ebp=0x19fda0 | |
| 0x77176b4a ntdll.dll:RtlAllocateHeap+0x1e5a|lea ebx, [ecx + 8]|ecx=0x82b3f8 | |
| 0x77176b4d ntdll.dll:RtlAllocateHeap+0x1e5d|mov dword ptr [ebp - 0x5c], ebx|ebp=0x19fda0|ebx=0x82b400 | |
| 0x77176b50 ntdll.dll:RtlAllocateHeap+0x1e60|movzx eax, word ptr [ecx]|ecx=0x82b3f8 | |
| 0x77176b53 ntdll.dll:RtlAllocateHeap+0x1e63|lea esi, [eax*8]|eax=0x8 | |
| 0x77176b5a ntdll.dll:RtlAllocateHeap+0x1e6a|mov dword ptr [ebp - 0xb0], esi|ebp=0x19fda0|esi=0x40 | |
| 0x77176b60 ntdll.dll:RtlAllocateHeap+0x1e70|lea edx, [ecx + 7]|ecx=0x82b3f8 | |
| 0x77176b63 ntdll.dll:RtlAllocateHeap+0x1e73|mov dword ptr [ebp - 0x54], edx|ebp=0x19fda0|edx=0x82b3ff | |
| 0x77176b66 ntdll.dll:RtlAllocateHeap+0x1e76|mov ecx, esi|esi=0x40 | |
| 0x77176b68 ntdll.dll:RtlAllocateHeap+0x1e78|mov al, byte ptr [edx]|edx=0x82b3ff | |
| 0x77176b6a ntdll.dll:RtlAllocateHeap+0x1e7a|and al, 0x3f|al=0x8 | |
| 0x77176b6c ntdll.dll:RtlAllocateHeap+0x1e7c|cmp al, 0x3f|al=0x8 | |
| 0x77176b6e ntdll.dll:RtlAllocateHeap+0x1e7e|jne 0x77176b7b|eflags=0x297 | |
| 0x77176b7b ntdll.dll:RtlAllocateHeap+0x1e8b|cmp dword ptr [ebp - 0x64], 0|ebp=0x19fda0 | |
| 0x77176b7f ntdll.dll:RtlAllocateHeap+0x1e8f|je 0x771776a1|eflags=0x202 | |
| 0x77176b85 ntdll.dll:RtlAllocateHeap+0x1e95|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176b89 ntdll.dll:RtlAllocateHeap+0x1e99|je 0x77176b9e|eflags=0x206 | |
| 0x77176b8b ntdll.dll:RtlAllocateHeap+0x1e9b|mov ecx, dword ptr [ebp - 0x6c]|ebp=0x19fda0 | |
| 0x77176b8e ntdll.dll:RtlAllocateHeap+0x1e9e|mov al, byte ptr [ecx + 2]|ecx=0x82b3f8 | |
| 0x77176b91 ntdll.dll:RtlAllocateHeap+0x1ea1|xor al, byte ptr [ecx + 1]|al=0x1|ecx=0x82b3f8 | |
| 0x77176b94 ntdll.dll:RtlAllocateHeap+0x1ea4|xor al, byte ptr [ecx]|al=0x1|ecx=0x82b3f8 | |
| 0x77176b96 ntdll.dll:RtlAllocateHeap+0x1ea6|mov byte ptr [ecx + 3], al|ecx=0x82b3f8|al=0x9 | |
| 0x77176b99 ntdll.dll:RtlAllocateHeap+0x1ea9|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77176b9c ntdll.dll:RtlAllocateHeap+0x1eac|xor dword ptr [ecx], eax|ecx=0x82b3f8|eax=0x241ac80a | |
| 0x77176b9e ntdll.dll:RtlAllocateHeap+0x1eae|cmp byte ptr [ebp - 0x29], 0|ebp=0x19fda0 | |
| 0x77176ba2 ntdll.dll:RtlAllocateHeap+0x1eb2|je 0x77176c5f|eflags=0x202 | |
| 0x77176ba8 ntdll.dll:RtlAllocateHeap+0x1eb8|test dword ptr [edi + 0x44], 0x1000000|edi=0x820000 | |
| 0x77176baf ntdll.dll:RtlAllocateHeap+0x1ebf|jne 0x77176c50|eflags=0x246 | |
| 0x77176bb5 ntdll.dll:RtlAllocateHeap+0x1ec5|inc dword ptr [edi + 0x22c]|edi=0x820000 | |
| 0x77176bbb ntdll.dll:RtlAllocateHeap+0x1ecb|mov edx, dword ptr [edi + 0x234]|edi=0x820000 | |
| 0x77176bc1 ntdll.dll:RtlAllocateHeap+0x1ed1|cmp dword ptr [edi + 0x22c], edx|edi=0x820000|edx=0x1 | |
| 0x77176bc7 ntdll.dll:RtlAllocateHeap+0x1ed7|jbe 0x77176bf5|eflags=0x202 | |
| 0x77176bc9 ntdll.dll:RtlAllocateHeap+0x1ed9|mov dword ptr [edi + 0x22c], 0|edi=0x820000 | |
| 0x77176bd3 ntdll.dll:RtlAllocateHeap+0x1ee3|mov eax, dword ptr [edi + 0x74]|edi=0x820000 | |
| 0x77176bd6 ntdll.dll:RtlAllocateHeap+0x1ee6|shl eax, 3|eax=0x377 | |
| 0x77176bd9 ntdll.dll:RtlAllocateHeap+0x1ee9|mov ecx, dword ptr [edi + 0x1f8]|edi=0x820000 | |
| 0x77176bdf ntdll.dll:RtlAllocateHeap+0x1eef|sub ecx, eax|ecx=0xe000|eax=0x1bb8 | |
| 0x77176be1 ntdll.dll:RtlAllocateHeap+0x1ef1|cmp ecx, dword ptr [edi + 0x248]|ecx=0xc448|edi=0x820000 | |
| 0x77176be7 ntdll.dll:RtlAllocateHeap+0x1ef7|jbe 0x77176bef|eflags=0x206 | |
| 0x77176be9 ntdll.dll:RtlAllocateHeap+0x1ef9|mov dword ptr [edi + 0x248], ecx|edi=0x820000|ecx=0xc448 | |
| 0x77176bef ntdll.dll:RtlAllocateHeap+0x1eff|mov dword ptr [edi + 0x24c], ecx|edi=0x820000|ecx=0xc448 | |
| 0x77176bf5 ntdll.dll:RtlAllocateHeap+0x1f05|inc dword ptr [edi + 0x238]|edi=0x820000 | |
| 0x77176bfb ntdll.dll:RtlAllocateHeap+0x1f0b|cmp dword ptr [edi + 0x238], 0x1000|edi=0x820000 | |
| 0x77176c05 ntdll.dll:RtlAllocateHeap+0x1f15|jb 0x77176c50|eflags=0x283 | |
| 0x77176c50 ntdll.dll:RtlAllocateHeap+0x1f60|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19fc20 | |
| 0x77176c56 ntdll.dll:RtlAllocateHeap+0x1f66|call 0x77177b20|esp=0x19fc1c|eip=0x77176c56 | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19fda0|esp=0x19fc18 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19fc14 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19fc14 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x82b400|esp=0x19fc0c | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19fc14 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x40|esp=0x19fc08 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x820000|esp=0x19fc04 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x820258 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x820258 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x820258 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0xc448 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x82025c|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x82025c|esp=0x19fc00 | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19fc04 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x820258|esp=0x19fc08 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19fc14 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19fc14|esp=0x19fc14 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19fc18 | |
| 0x77176c5b ntdll.dll:RtlAllocateHeap+0x1f6b|mov byte ptr [ebp - 0x29], 0|ebp=0x19fda0 | |
| 0x77176c5f ntdll.dll:RtlAllocateHeap+0x1f6f|test byte ptr [ebp - 0x68], 8|ebp=0x19fda0 | |
| 0x77176c63 ntdll.dll:RtlAllocateHeap+0x1f73|je 0x77177a7e|eflags=0x202 | |
| 0x77176c69 ntdll.dll:RtlAllocateHeap+0x1f79|lea eax, [esi - 8]|esi=0x40 | |
| 0x77176c6c ntdll.dll:RtlAllocateHeap+0x1f7c|push eax|eax=0x38|esp=0x19fc20 | |
| 0x77176c6d ntdll.dll:RtlAllocateHeap+0x1f7d|push 0|esp=0x19fc1c | |
| 0x77176c6f ntdll.dll:RtlAllocateHeap+0x1f7f|push dword ptr [ebp - 0x5c]|ebp=0x19fda0|esp=0x19fc18 | |
| 0x77176c72 ntdll.dll:RtlAllocateHeap+0x1f82|call 0x771ab3c0|esp=0x19fc14|eip=0x77176c72 | |
| 0x771ab3c0 ntdll.dll:memset|mov edx, dword ptr [esp + 0xc]|esp=0x19fc10 | |
| 0x771ab3c4 ntdll.dll:memset+0x4|mov ecx, dword ptr [esp + 4]|esp=0x19fc10 | |
| 0x771ab3c8 ntdll.dll:memset+0x8|test edx, edx|edx=0x38 | |
| 0x771ab3ca ntdll.dll:memset+0xa|je 0x771ab41b|eflags=0x202 | |
| 0x771ab3cc ntdll.dll:memset+0xc|xor eax, eax|eax=0x38 | |
| 0x771ab3ce ntdll.dll:memset+0xe|mov al, byte ptr [esp + 8]|esp=0x19fc10 | |
| 0x771ab3d2 ntdll.dll:memset+0x12|push edi|edi=0x820000|esp=0x19fc10 | |
| 0x771ab3d3 ntdll.dll:memset+0x13|mov edi, ecx|ecx=0x82b400 | |
| 0x771ab3d5 ntdll.dll:memset+0x15|cmp edx, 4|edx=0x38 | |
| 0x771ab3d8 ntdll.dll:memset+0x18|jb 0x771ab40b|eflags=0x202 | |
| 0x771ab3da ntdll.dll:memset+0x1a|neg ecx|ecx=0x82b400 | |
| 0x771ab3dc ntdll.dll:memset+0x1c|and ecx, 3|ecx=0xff7d4c00 | |
| 0x771ab3df ntdll.dll:memset+0x1f|je 0x771ab3ed|eflags=0x246 | |
| 0x771ab3ed ntdll.dll:memset+0x2d|mov ecx, eax|eax=0x0 | |
| 0x771ab3ef ntdll.dll:memset+0x2f|shl eax, 8|eax=0x0 | |
| 0x771ab3f2 ntdll.dll:memset+0x32|add eax, ecx|eax=0x0|ecx=0x0 | |
| 0x771ab3f4 ntdll.dll:memset+0x34|mov ecx, eax|eax=0x0 | |
| 0x771ab3f6 ntdll.dll:memset+0x36|shl eax, 0x10|eax=0x0 | |
| 0x771ab3f9 ntdll.dll:memset+0x39|add eax, ecx|eax=0x0|ecx=0x0 | |
| 0x771ab3fb ntdll.dll:memset+0x3b|mov ecx, edx|edx=0x38 | |
| 0x771ab3fd ntdll.dll:memset+0x3d|and edx, 3|edx=0x38 | |
| 0x771ab400 ntdll.dll:memset+0x40|shr ecx, 2|ecx=0x38 | |
| 0x771ab403 ntdll.dll:memset+0x43|je 0x771ab40b|eflags=0x202 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b400|eax=0x0|eflags=0x202|ecx=0xe | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b404|eax=0x0|eflags=0x202|ecx=0xd | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b408|eax=0x0|eflags=0x202|ecx=0xc | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b40c|eax=0x0|eflags=0x202|ecx=0xb | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b410|eax=0x0|eflags=0x202|ecx=0xa | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b414|eax=0x0|eflags=0x202|ecx=0x9 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b418|eax=0x0|eflags=0x202|ecx=0x8 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b41c|eax=0x0|eflags=0x202|ecx=0x7 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b420|eax=0x0|eflags=0x202|ecx=0x6 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b424|eax=0x0|eflags=0x202|ecx=0x5 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b428|eax=0x0|eflags=0x202|ecx=0x4 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b42c|eax=0x0|eflags=0x202|ecx=0x3 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b430|eax=0x0|eflags=0x202|ecx=0x2 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b434|eax=0x0|eflags=0x202|ecx=0x1 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x82b438|eax=0x0|eflags=0x202|ecx=0x0 | |
| 0x771ab407 ntdll.dll:memset+0x47|test edx, edx|edx=0x0 | |
| 0x771ab409 ntdll.dll:memset+0x49|je 0x771ab415|eflags=0x246 | |
| 0x771ab415 ntdll.dll:memset+0x55|mov eax, dword ptr [esp + 8]|esp=0x19fc0c | |
| 0x771ab419 ntdll.dll:memset+0x59|pop edi|edi=0x82b438|esp=0x19fc0c | |
| 0x771ab41a ntdll.dll:memset+0x5a|ret|esp=0x19fc10 | |
| 0x77176c77 ntdll.dll:RtlAllocateHeap+0x1f87|add esp, 0xc|esp=0x19fc14 | |
| 0x77176c7a ntdll.dll:RtlAllocateHeap+0x1f8a|jmp 0x77177a7e | |
| 0x77177a7e ntdll.dll:RtlAllocateHeap+0x2d8e|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fda0 | |
| 0x77177a85 ntdll.dll:RtlAllocateHeap+0x2d95|call 0x77177aa9|esp=0x19fc20|eip=0x77177a85 | |
| 0x77177aa9 ntdll.dll:RtlAllocateHeap+0x2db9|cmp byte ptr [ebp - 0x29], 0|ebp=0x19fda0 | |
| 0x77177aad ntdll.dll:RtlAllocateHeap+0x2dbd|je 0x77177acd|eflags=0x246 | |
| 0x77177acd ntdll.dll:RtlAllocateHeap+0x2ddd|ret|esp=0x19fc1c | |
| 0x77177a8a ntdll.dll:RtlAllocateHeap+0x2d9a|call 0x77177ce0|esp=0x19fc20|eip=0x77177a8a | |
| 0x77177ce0 ntdll.dll:RtlGetCurrentServiceSessionId|mov eax, dword ptr fs:[0x30] | |
| 0x77177ce6 ntdll.dll:RtlGetCurrentServiceSessionId+0x6|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77177ce9 ntdll.dll:RtlGetCurrentServiceSessionId+0x9|test eax, eax|eax=0x0 | |
| 0x77177ceb ntdll.dll:RtlGetCurrentServiceSessionId+0xb|jne 0x77177cee|eflags=0x246 | |
| 0x77177ced ntdll.dll:RtlGetCurrentServiceSessionId+0xd|ret|esp=0x19fc1c | |
| 0x77177a8f ntdll.dll:RtlAllocateHeap+0x2d9f|test eax, eax|eax=0x0 | |
| 0x77177a91 ntdll.dll:RtlAllocateHeap+0x2da1|je 0x77177ace|eflags=0x246 | |
| 0x77177ace ntdll.dll:RtlAllocateHeap+0x2dde|mov eax, 0x7ffe0388 | |
| 0x77177ad3 ntdll.dll:RtlAllocateHeap+0x2de3|cmp byte ptr [eax], 0|eax=0x7ffe0388 | |
| 0x77177ad6 ntdll.dll:RtlAllocateHeap+0x2de6|je 0x77177af7|eflags=0x246 | |
| 0x77177af7 ntdll.dll:RtlAllocateHeap+0x2e07|mov eax, dword ptr [ebp - 0x5c]|ebp=0x19fda0 | |
| 0x77177afa ntdll.dll:RtlAllocateHeap+0x2e0a|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fda0 | |
| 0x77177afd ntdll.dll:RtlAllocateHeap+0x2e0d|mov dword ptr fs:[0], ecx|ecx=0x19feac | |
| 0x77177b04 ntdll.dll:RtlAllocateHeap+0x2e14|pop ecx|ecx=0x19feac|esp=0x19fc20 | |
| 0x77177b05 ntdll.dll:RtlAllocateHeap+0x2e15|pop edi|edi=0x820000|esp=0x19fc24 | |
| 0x77177b06 ntdll.dll:RtlAllocateHeap+0x2e16|pop esi|esi=0x40|esp=0x19fc28 | |
| 0x77177b07 ntdll.dll:RtlAllocateHeap+0x2e17|pop ebx|ebx=0x82b400|esp=0x19fc2c | |
| 0x77177b08 ntdll.dll:RtlAllocateHeap+0x2e18|mov esp, ebp|ebp=0x19fda0 | |
| 0x77177b0a ntdll.dll:RtlAllocateHeap+0x2e1a|pop ebp|ebp=0x19fda0|esp=0x19fda0 | |
| 0x77177b0b ntdll.dll:RtlAllocateHeap+0x2e1b|ret 0x10|esp=0x19fda4 | |
| 0x77175d0f ntdll.dll:RtlAllocateHeap+0x101f|mov edi, eax|eax=0x82b400 | |
| 0x77175d11 ntdll.dll:RtlAllocateHeap+0x1021|test edi, edi|edi=0x82b400 | |
| 0x77175d13 ntdll.dll:RtlAllocateHeap+0x1023|je 0x77175d5a|eflags=0x206 | |
| 0x77175d15 ntdll.dll:RtlAllocateHeap+0x1025|mov ecx, dword ptr [ebp - 0x14]|ebp=0x19fe30 | |
| 0x77175d18 ntdll.dll:RtlAllocateHeap+0x1028|mov edx, dword ptr [ebp - 0x48]|ebp=0x19fe30 | |
| 0x77175d1b ntdll.dll:RtlAllocateHeap+0x102b|test edx, edx|edx=0x0 | |
| 0x77175d1d ntdll.dll:RtlAllocateHeap+0x102d|je 0x77175d97|eflags=0x246 | |
| 0x77175d97 ntdll.dll:RtlAllocateHeap+0x10a7|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fe30 | |
| 0x77175d9a ntdll.dll:RtlAllocateHeap+0x10aa|mov eax, dword ptr fs:[0x30] | |
| 0x77175da0 ntdll.dll:RtlAllocateHeap+0x10b0|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77175da3 ntdll.dll:RtlAllocateHeap+0x10b3|test eax, eax|eax=0x0 | |
| 0x77175da5 ntdll.dll:RtlAllocateHeap+0x10b5|je 0x77175dbc|eflags=0x246 | |
| 0x77175dbc ntdll.dll:RtlAllocateHeap+0x10cc|mov eax, 0x7ffe0380 | |
| 0x77175dc1 ntdll.dll:RtlAllocateHeap+0x10d1|cmp byte ptr [eax], 0|eax=0x7ffe0380 | |
| 0x77175dc4 ntdll.dll:RtlAllocateHeap+0x10d4|je 0x77175e5c|eflags=0x246 | |
| 0x77175e5c ntdll.dll:RtlAllocateHeap+0x116c|mov eax, dword ptr [0x77259694] | |
| 0x77175e61 ntdll.dll:RtlAllocateHeap+0x1171|test al, 1|al=0x0 | |
| 0x77175e63 ntdll.dll:RtlAllocateHeap+0x1173|je 0x77175ea0|eflags=0x246 | |
| 0x77175ea0 ntdll.dll:RtlAllocateHeap+0x11b0|mov eax, edi|edi=0x82b400 | |
| 0x77175ea2 ntdll.dll:RtlAllocateHeap+0x11b2|pop edi|edi=0x82b400|esp=0x19fdb8 | |
| 0x77175ea3 ntdll.dll:RtlAllocateHeap+0x11b3|pop esi|esi=0x40|esp=0x19fdbc | |
| 0x77175ea4 ntdll.dll:RtlAllocateHeap+0x11b4|pop ebx|ebx=0x820000|esp=0x19fdc0 | |
| 0x77175ea5 ntdll.dll:RtlAllocateHeap+0x11b5|mov esp, ebp|ebp=0x19fe30 | |
| 0x77175ea7 ntdll.dll:RtlAllocateHeap+0x11b7|pop ebp|ebp=0x19fe30|esp=0x19fe30 | |
| 0x77175ea8 ntdll.dll:RtlAllocateHeap+0x11b8|ret 8|esp=0x19fe34 | |
| 0x77174d2e ntdll.dll:RtlAllocateHeap+0x3e|pop esi|esi=0x820000|esp=0x19fe40 | |
| 0x77174d2f ntdll.dll:RtlAllocateHeap+0x3f|mov esp, ebp|ebp=0x19fe4c | |
| 0x77174d31 ntdll.dll:RtlAllocateHeap+0x41|pop ebp|ebp=0x19fe4c|esp=0x19fe4c | |
| 0x77174d32 ntdll.dll:RtlAllocateHeap+0x42|ret 0xc|esp=0x19fe50 | |
| 0x40a3fd handletest_x86.exe|test eax, eax|eax=0x82b400 | |
| 0x40a3ff handletest_x86.exe|je 0x40a3da|eflags=0x206 | |
| 0x40a401 handletest_x86.exe|jmp 0x40a410 | |
| 0x40a410 handletest_x86.exe|pop esi|esi=0x38|esp=0x19fe60 | |
| 0x40a411 handletest_x86.exe|pop ebp|ebp=0x19fe64|esp=0x19fe64 | |
| 0x40a412 handletest_x86.exe|ret|esp=0x19fe68 | |
| 0x409fac handletest_x86.exe|push 0|esp=0x19fe6c | |
| 0x409fae handletest_x86.exe|mov dword ptr [edi], eax|edi=0x8297b4|eax=0x82b400 | |
| 0x409fb0 handletest_x86.exe|call 0x40a413|esp=0x19fe68|eip=0x409fb0 | |
| 0x40a413 handletest_x86.exe|mov edi, edi|edi=0x8297b4 | |
| 0x40a415 handletest_x86.exe|push ebp|ebp=0x19fe84|esp=0x19fe64 | |
| 0x40a416 handletest_x86.exe|mov ebp, esp|esp=0x19fe60 | |
| 0x40a418 handletest_x86.exe|cmp dword ptr [ebp + 8], 0|ebp=0x19fe60 | |
| 0x40a41c handletest_x86.exe|je 0x40a44b|eflags=0x246 | |
| 0x40a44b handletest_x86.exe|pop ebp|ebp=0x19fe60|esp=0x19fe60 | |
| 0x40a44c handletest_x86.exe|ret|esp=0x19fe64 | |
| 0x409fb5 handletest_x86.exe|mov eax, dword ptr [edi]|edi=0x8297b4 | |
| 0x409fb7 handletest_x86.exe|add esp, 0xc|esp=0x19fe68 | |
| 0x409fba handletest_x86.exe|test eax, eax|eax=0x82b400 | |
| 0x409fbc handletest_x86.exe|je 0x409f91|eflags=0x206 | |
| 0x409fbe handletest_x86.exe|or dword ptr [eax + 0x10], 0xffffffff|eax=0x82b400 | |
| 0x409fc2 handletest_x86.exe|mov eax, dword ptr [edi]|edi=0x8297b4 | |
| 0x409fc4 handletest_x86.exe|push 0|esp=0x19fe74 | |
| 0x409fc6 handletest_x86.exe|push 0xfa0|esp=0x19fe70 | |
| 0x409fcb handletest_x86.exe|add eax, 0x20|eax=0x82b400 | |
| 0x409fce handletest_x86.exe|push eax|eax=0x82b420|esp=0x19fe6c | |
| 0x409fcf handletest_x86.exe|call 0x40a7be|esp=0x19fe68|eip=0x409fcf | |
| 0x40a7be handletest_x86.exe|mov edi, edi|edi=0x8297b4 | |
| 0x40a7c0 handletest_x86.exe|push ebp|ebp=0x19fe84|esp=0x19fe64 | |
| 0x40a7c1 handletest_x86.exe|mov ebp, esp|esp=0x19fe60 | |
| 0x40a7c3 handletest_x86.exe|push esi|esi=0x0|esp=0x19fe60 | |
| 0x40a7c4 handletest_x86.exe|push 0x418a18|esp=0x19fe5c | |
| 0x40a7c9 handletest_x86.exe|push 0x418a10|esp=0x19fe58 | |
| 0x40a7ce handletest_x86.exe|push 0x417c30|esp=0x19fe54 | |
| 0x40a7d3 handletest_x86.exe|push 0xe|esp=0x19fe50 | |
| 0x40a7d5 handletest_x86.exe|call 0x40a580|esp=0x19fe4c|eip=0x40a7d5 | |
| 0x40a580 handletest_x86.exe|mov edi, edi|edi=0x8297b4 | |
| 0x40a582 handletest_x86.exe|push ebp|ebp=0x19fe60|esp=0x19fe48 | |
| 0x40a583 handletest_x86.exe|mov ebp, esp|esp=0x19fe44 | |
| 0x40a585 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe44 | |
| 0x40a588 handletest_x86.exe|push ebx|ebx=0x829fa8|esp=0x19fe44 | |
| 0x40a589 handletest_x86.exe|push edi|edi=0x8297b4|esp=0x19fe40 | |
| 0x40a58a handletest_x86.exe|lea ebx, [eax*4 + 0x41f200]|eax=0xe | |
| 0x40a591 handletest_x86.exe|mov eax, dword ptr [ebx]|ebx=0x41f238 | |
| 0x40a593 handletest_x86.exe|nop | |
| 0x40a594 handletest_x86.exe|mov edx, dword ptr [0x41e004] | |
| 0x40a59a handletest_x86.exe|or edi, 0xffffffff|edi=0x8297b4 | |
| 0x40a59d handletest_x86.exe|mov ecx, edx|edx=0x666841b4 | |
| 0x40a59f handletest_x86.exe|xor edx, eax|edx=0x666841b4|eax=0x16f2e3f | |
| 0x40a5a1 handletest_x86.exe|and ecx, 0x1f|ecx=0x666841b4 | |
| 0x40a5a4 handletest_x86.exe|ror edx, cl|edx=0x67076f8b|cl=0x14 | |
| 0x40a5a6 handletest_x86.exe|cmp edx, edi|edx=0x76f8b670|edi=0xffffffff | |
| 0x40a5a8 handletest_x86.exe|jne 0x40a5ae|eflags=0x217 | |
| 0x40a5ae handletest_x86.exe|test edx, edx|edx=0x76f8b670 | |
| 0x40a5b0 handletest_x86.exe|je 0x40a5b6|eflags=0x202 | |
| 0x40a5b2 handletest_x86.exe|mov eax, edx|edx=0x76f8b670 | |
| 0x40a5b4 handletest_x86.exe|jmp 0x40a5ff | |
| 0x40a5ff handletest_x86.exe|pop edi|edi=0xffffffff|esp=0x19fe3c | |
| 0x40a600 handletest_x86.exe|pop ebx|ebx=0x41f238|esp=0x19fe40 | |
| 0x40a601 handletest_x86.exe|pop ebp|ebp=0x19fe44|esp=0x19fe44 | |
| 0x40a602 handletest_x86.exe|ret|esp=0x19fe48 | |
| 0x40a7da handletest_x86.exe|mov esi, eax|eax=0x76f8b670 | |
| 0x40a7dc handletest_x86.exe|add esp, 0x10|esp=0x19fe4c | |
| 0x40a7df handletest_x86.exe|test esi, esi|esi=0x76f8b670 | |
| 0x40a7e1 handletest_x86.exe|je 0x40a7f8|eflags=0x202 | |
| 0x40a7e3 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fe60|esp=0x19fe5c | |
| 0x40a7e6 handletest_x86.exe|mov ecx, esi|esi=0x76f8b670 | |
| 0x40a7e8 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fe60|esp=0x19fe58 | |
| 0x40a7eb handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fe60|esp=0x19fe54 | |
| 0x40a7ee handletest_x86.exe|call dword ptr [0x41711c]|esp=0x19fe50 | |
| 0x401af7 handletest_x86.exe|ret 0|esp=0x19fe4c | |
| 0x40a7f4 handletest_x86.exe|call esi|esi=0x76f8b670|esp=0x19fe50 | |
| 0x76f8b670 kernelbase.dll:InitializeCriticalSectionEx|mov edi, edi|edi=0x8297b4 | |
| 0x76f8b672 kernelbase.dll:InitializeCriticalSectionEx+0x2|push ebp|ebp=0x19fe60|esp=0x19fe4c | |
| 0x76f8b673 kernelbase.dll:InitializeCriticalSectionEx+0x3|mov ebp, esp|esp=0x19fe48 | |
| 0x76f8b675 kernelbase.dll:InitializeCriticalSectionEx+0x5|push dword ptr [ebp + 0x10]|ebp=0x19fe48|esp=0x19fe48 | |
| 0x76f8b678 kernelbase.dll:InitializeCriticalSectionEx+0x8|push dword ptr [ebp + 0xc]|ebp=0x19fe48|esp=0x19fe44 | |
| 0x76f8b67b kernelbase.dll:InitializeCriticalSectionEx+0xb|push dword ptr [ebp + 8]|ebp=0x19fe48|esp=0x19fe40 | |
| 0x76f8b67e kernelbase.dll:InitializeCriticalSectionEx+0xe|call dword ptr [0x770691c4]|esp=0x19fe3c | |
| 0x77166780 ntdll.dll:RtlInitializeCriticalSectionEx|mov edi, edi|edi=0x8297b4 | |
| 0x77166782 ntdll.dll:RtlInitializeCriticalSectionEx+0x2|push ebp|ebp=0x19fe48|esp=0x19fe38 | |
| 0x77166783 ntdll.dll:RtlInitializeCriticalSectionEx+0x3|mov ebp, esp|esp=0x19fe34 | |
| 0x77166785 ntdll.dll:RtlInitializeCriticalSectionEx+0x5|and esp, 0xfffffff8|esp=0x19fe34 | |
| 0x77166788 ntdll.dll:RtlInitializeCriticalSectionEx+0x8|sub esp, 0x34|esp=0x19fe30 | |
| 0x7716678b ntdll.dll:RtlInitializeCriticalSectionEx+0xb|mov eax, dword ptr [0x7725e360] | |
| 0x77166790 ntdll.dll:RtlInitializeCriticalSectionEx+0x10|xor eax, esp|eax=0xf9e0af5e|esp=0x19fdfc | |
| 0x77166792 ntdll.dll:RtlInitializeCriticalSectionEx+0x12|mov dword ptr [esp + 0x30], eax|esp=0x19fdfc|eax=0xf9f952a2 | |
| 0x77166796 ntdll.dll:RtlInitializeCriticalSectionEx+0x16|mov eax, dword ptr [ebp + 0x10]|ebp=0x19fe34 | |
| 0x77166799 ntdll.dll:RtlInitializeCriticalSectionEx+0x19|push esi|esi=0x76f8b670|esp=0x19fdfc | |
| 0x7716679a ntdll.dll:RtlInitializeCriticalSectionEx+0x1a|mov esi, dword ptr [ebp + 8]|ebp=0x19fe34 | |
| 0x7716679d ntdll.dll:RtlInitializeCriticalSectionEx+0x1d|test eax, 0xe0000000|eax=0x0 | |
| 0x771667a2 ntdll.dll:RtlInitializeCriticalSectionEx+0x22|jne 0x771667b4|eflags=0x246 | |
| 0x771667a4 ntdll.dll:RtlInitializeCriticalSectionEx+0x24|mov ecx, eax|eax=0x0 | |
| 0x771667a6 ntdll.dll:RtlInitializeCriticalSectionEx+0x26|and ecx, 0x11000000|ecx=0x0 | |
| 0x771667ac ntdll.dll:RtlInitializeCriticalSectionEx+0x2c|cmp ecx, 0x11000000|ecx=0x0 | |
| 0x771667b2 ntdll.dll:RtlInitializeCriticalSectionEx+0x32|jne 0x771667cb|eflags=0x287 | |
| 0x771667cb ntdll.dll:RtlInitializeCriticalSectionEx+0x4b|mov edx, dword ptr [ebp + 0xc]|ebp=0x19fe34 | |
| 0x771667ce ntdll.dll:RtlInitializeCriticalSectionEx+0x4e|test edx, 0xff000000|edx=0xfa0 | |
| 0x771667d4 ntdll.dll:RtlInitializeCriticalSectionEx+0x54|jne 0x771c94f5|eflags=0x246 | |
| 0x771667da ntdll.dll:RtlInitializeCriticalSectionEx+0x5a|test eax, 0x4000000|eax=0x0 | |
| 0x771667df ntdll.dll:RtlInitializeCriticalSectionEx+0x5f|jne 0x77166865|eflags=0x246 | |
| 0x771667e5 ntdll.dll:RtlInitializeCriticalSectionEx+0x65|mov ecx, dword ptr fs:[0x30] | |
| 0x771667ec ntdll.dll:RtlInitializeCriticalSectionEx+0x6c|mov dword ptr [esi + 4], 0xffffffff|esi=0x82b420 | |
| 0x771667f3 ntdll.dll:RtlInitializeCriticalSectionEx+0x73|mov dword ptr [esi + 8], 0|esi=0x82b420 | |
| 0x771667fa ntdll.dll:RtlInitializeCriticalSectionEx+0x7a|mov dword ptr [esi + 0xc], 0|esi=0x82b420 | |
| 0x77166801 ntdll.dll:RtlInitializeCriticalSectionEx+0x81|mov dword ptr [esi + 0x10], 0|esi=0x82b420 | |
| 0x77166808 ntdll.dll:RtlInitializeCriticalSectionEx+0x88|cmp dword ptr [ecx + 0x64], 1|ecx=0x2a3000 | |
| 0x7716680c ntdll.dll:RtlInitializeCriticalSectionEx+0x8c|jbe 0x77166897|eflags=0x206 | |
| 0x77166812 ntdll.dll:RtlInitializeCriticalSectionEx+0x92|test eax, 0x2000000|eax=0x0 | |
| 0x77166817 ntdll.dll:RtlInitializeCriticalSectionEx+0x97|jne 0x77166879|eflags=0x246 | |
| 0x77166819 ntdll.dll:RtlInitializeCriticalSectionEx+0x99|test edx, edx|edx=0xfa0 | |
| 0x7716681b ntdll.dll:RtlInitializeCriticalSectionEx+0x9b|je 0x77166879|eflags=0x206 | |
| 0x7716681d ntdll.dll:RtlInitializeCriticalSectionEx+0x9d|and edx, 0xffffff|edx=0xfa0 | |
| 0x77166823 ntdll.dll:RtlInitializeCriticalSectionEx+0xa3|mov ecx, eax|eax=0x0 | |
| 0x77166825 ntdll.dll:RtlInitializeCriticalSectionEx+0xa5|and ecx, 0x9000000|ecx=0x0 | |
| 0x7716682b ntdll.dll:RtlInitializeCriticalSectionEx+0xab|or ecx, edx|ecx=0x0|edx=0xfa0 | |
| 0x7716682d ntdll.dll:RtlInitializeCriticalSectionEx+0xad|mov dword ptr [esi + 0x14], ecx|esi=0x82b420|ecx=0xfa0 | |
| 0x77166830 ntdll.dll:RtlInitializeCriticalSectionEx+0xb0|test eax, 0x10000000|eax=0x0 | |
| 0x77166835 ntdll.dll:RtlInitializeCriticalSectionEx+0xb5|jne 0x77166880|eflags=0x246 | |
| 0x77166837 ntdll.dll:RtlInitializeCriticalSectionEx+0xb7|cmp byte ptr [0x77257b20], 0 | |
| 0x7716683e ntdll.dll:RtlInitializeCriticalSectionEx+0xbe|jne 0x77166880|eflags=0x246 | |
| 0x77166840 ntdll.dll:RtlInitializeCriticalSectionEx+0xc0|mov dword ptr [esi], 0xffffffff|esi=0x82b420 | |
| 0x77166846 ntdll.dll:RtlInitializeCriticalSectionEx+0xc6|mov eax, dword ptr fs:[0x30] | |
| 0x7716684c ntdll.dll:RtlInitializeCriticalSectionEx+0xcc|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x7716684f ntdll.dll:RtlInitializeCriticalSectionEx+0xcf|test eax, eax|eax=0x0 | |
| 0x77166851 ntdll.dll:RtlInitializeCriticalSectionEx+0xd1|jne 0x771c950b|eflags=0x246 | |
| 0x77166857 ntdll.dll:RtlInitializeCriticalSectionEx+0xd7|mov eax, 0x7ffe0382 | |
| 0x7716685c ntdll.dll:RtlInitializeCriticalSectionEx+0xdc|cmp byte ptr [eax], 0|eax=0x7ffe0382 | |
| 0x7716685f ntdll.dll:RtlInitializeCriticalSectionEx+0xdf|jne 0x771c9527|eflags=0x246 | |
| 0x77166865 ntdll.dll:RtlInitializeCriticalSectionEx+0xe5|mov ecx, dword ptr [esp + 0x34]|esp=0x19fdf8 | |
| 0x77166869 ntdll.dll:RtlInitializeCriticalSectionEx+0xe9|xor eax, eax|eax=0x7ffe0382 | |
| 0x7716686b ntdll.dll:RtlInitializeCriticalSectionEx+0xeb|pop esi|esi=0x82b420|esp=0x19fdf8 | |
| 0x7716686c ntdll.dll:RtlInitializeCriticalSectionEx+0xec|xor ecx, esp|ecx=0xf9f952a2|esp=0x19fdfc | |
| 0x7716686e ntdll.dll:RtlInitializeCriticalSectionEx+0xee|call 0x771a6de0|esp=0x19fdfc|eip=0x7716686e | |
| 0x771a6de0 ntdll.dll:RtlRetrieveNtUserPfn+0x110|cmp ecx, dword ptr [0x7725e360]|ecx=0xf9e0af5e | |
| 0x771a6de6 ntdll.dll:RtlRetrieveNtUserPfn+0x116|jne 0x771a6deb|eflags=0x246 | |
| 0x771a6de8 ntdll.dll:RtlRetrieveNtUserPfn+0x118|ret 0|esp=0x19fdf8 | |
| 0x77166873 ntdll.dll:RtlInitializeCriticalSectionEx+0xf3|mov esp, ebp|ebp=0x19fe34 | |
| 0x77166875 ntdll.dll:RtlInitializeCriticalSectionEx+0xf5|pop ebp|ebp=0x19fe34|esp=0x19fe34 | |
| 0x77166876 ntdll.dll:RtlInitializeCriticalSectionEx+0xf6|ret 0xc|esp=0x19fe38 | |
| 0x76f8b684 kernelbase.dll:InitializeCriticalSectionEx+0x14|test eax, eax|eax=0x0 | |
| 0x76f8b686 kernelbase.dll:InitializeCriticalSectionEx+0x16|js 0x76fea4ae|eflags=0x246 | |
| 0x76f8b68c kernelbase.dll:InitializeCriticalSectionEx+0x1c|xor eax, eax|eax=0x0 | |
| 0x76f8b68e kernelbase.dll:InitializeCriticalSectionEx+0x1e|inc eax|eax=0x0 | |
| 0x76f8b68f kernelbase.dll:InitializeCriticalSectionEx+0x1f|pop ebp|ebp=0x19fe48|esp=0x19fe48 | |
| 0x76f8b690 kernelbase.dll:InitializeCriticalSectionEx+0x20|ret 0xc|esp=0x19fe4c | |
| 0x40a7f6 handletest_x86.exe|jmp 0x40a804 | |
| 0x40a804 handletest_x86.exe|pop esi|esi=0x76f8b670|esp=0x19fe5c | |
| 0x40a805 handletest_x86.exe|pop ebp|ebp=0x19fe60|esp=0x19fe60 | |
| 0x40a806 handletest_x86.exe|ret 0xc|esp=0x19fe64 | |
| 0x409fd4 handletest_x86.exe|mov esi, dword ptr [edi]|edi=0x8297b4 | |
| 0x409fd6 handletest_x86.exe|mov ecx, 0x2000 | |
| 0x409fdb handletest_x86.exe|lea eax, [esi + 0xc]|esi=0x82b400 | |
| 0x409fde handletest_x86.exe|lock or dword ptr [eax], ecx|eax=0x82b40c|ecx=0x2000 | |
| 0x409fe1 handletest_x86.exe|push esi|esi=0x82b400|esp=0x19fe74 | |
| 0x409fe2 handletest_x86.exe|call 0x404bb2|esp=0x19fe70|eip=0x409fe2 | |
| 0x404bb2 handletest_x86.exe|mov edi, edi|edi=0x8297b4 | |
| 0x404bb4 handletest_x86.exe|push ebp|ebp=0x19fe84|esp=0x19fe6c | |
| 0x404bb5 handletest_x86.exe|mov ebp, esp|esp=0x19fe68 | |
| 0x404bb7 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe68 | |
| 0x404bba handletest_x86.exe|add eax, 0x20|eax=0x82b400 | |
| 0x404bbd handletest_x86.exe|push eax|eax=0x82b420|esp=0x19fe68 | |
| 0x404bbe handletest_x86.exe|call dword ptr [0x417040]|esp=0x19fe64 | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x8297b4 | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19fe68|esp=0x19fe60 | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fe5c | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19fe5c | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19fe5c | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x82b420 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x82b424 | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa03 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x82b420|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x82b420 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19fe5c | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19fe5c|esp=0x19fe5c | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19fe60 | |
| 0x404bc4 handletest_x86.exe|pop ebp|ebp=0x19fe68|esp=0x19fe68 | |
| 0x404bc5 handletest_x86.exe|ret|esp=0x19fe6c | |
| 0x409fe7 handletest_x86.exe|pop ecx|ecx=0x82b420|esp=0x19fe70 | |
| 0x409fe8 handletest_x86.exe|jmp 0x409f9c | |
| 0x409f9c handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fe84 | |
| 0x409f9f handletest_x86.exe|mov dword ptr [eax], esi|eax=0x19fea0|esi=0x82b400 | |
| 0x409fa1 handletest_x86.exe|jmp 0x409f97 | |
| 0x409f97 handletest_x86.exe|pop edi|edi=0x8297b4|esp=0x19fe74 | |
| 0x409f98 handletest_x86.exe|pop esi|esi=0x82b400|esp=0x19fe78 | |
| 0x409f99 handletest_x86.exe|pop ebx|ebx=0x829fa8|esp=0x19fe7c | |
| 0x409f9a handletest_x86.exe|leave|ebp=0x19fe84|esp=0x19fe80 | |
| 0x409f9b handletest_x86.exe|ret|esp=0x19fe88 | |
| 0x409eab handletest_x86.exe|pop ecx|ecx=0x82b400|esp=0x19fe8c | |
| 0x409eac handletest_x86.exe|mov eax, dword ptr [eax]|eax=0x19fea0 | |
| 0x409eae handletest_x86.exe|mov dword ptr [esi], eax|esi=0x19fedc|eax=0x82b400 | |
| 0x409eb0 handletest_x86.exe|test eax, eax|eax=0x82b400 | |
| 0x409eb2 handletest_x86.exe|je 0x409ec3|eflags=0x206 | |
| 0x409eb4 handletest_x86.exe|mov dword ptr [eax + 8], edi|eax=0x82b400|edi=0x0 | |
| 0x409eb7 handletest_x86.exe|mov dword ptr [eax + 0x1c], edi|eax=0x82b400|edi=0x0 | |
| 0x409eba handletest_x86.exe|mov dword ptr [eax], edi|eax=0x82b400|edi=0x0 | |
| 0x409ebc handletest_x86.exe|mov dword ptr [eax + 4], edi|eax=0x82b400|edi=0x0 | |
| 0x409ebf handletest_x86.exe|or dword ptr [eax + 0x10], 0xffffffff|eax=0x82b400 | |
| 0x409ec3 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19febc | |
| 0x409eca handletest_x86.exe|call 0x409ee4|esp=0x19fe90|eip=0x409eca | |
| 0x409ee4 handletest_x86.exe|push 8|esp=0x19fe8c | |
| 0x409ee6 handletest_x86.exe|call 0x40dc03|esp=0x19fe88|eip=0x409ee6 | |
| 0x40dc03 handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x40dc05 handletest_x86.exe|push ebp|ebp=0x19febc|esp=0x19fe84 | |
| 0x40dc06 handletest_x86.exe|mov ebp, esp|esp=0x19fe80 | |
| 0x40dc08 handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x18|eax=0x82b400|ebp=0x19fe80 | |
| 0x40dc0c handletest_x86.exe|add eax, 0x41f2b0|eax=0xc0 | |
| 0x40dc11 handletest_x86.exe|push eax|eax=0x41f370|esp=0x19fe80 | |
| 0x40dc12 handletest_x86.exe|call dword ptr [0x417044]|esp=0x19fe7c | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x0 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19fe80|esp=0x19fe78 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19fe74 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19fe74 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x2a3000|esp=0x19fe6c | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19fe74 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x19fedc|esp=0x19fe68 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x0|esp=0x19fe64 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x41f370 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x41f370 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x41f370 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0x19fea0 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x41f374|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x41f374|esp=0x19fe60 | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19fe64 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x41f370|esp=0x19fe68 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19fe74 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19fe74|esp=0x19fe74 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19fe78 | |
| 0x40dc18 handletest_x86.exe|pop ebp|ebp=0x19fe80|esp=0x19fe80 | |
| 0x40dc19 handletest_x86.exe|ret|esp=0x19fe84 | |
| 0x409eeb handletest_x86.exe|pop ecx|ecx=0xffffffff|esp=0x19fe88 | |
| 0x409eec handletest_x86.exe|ret|esp=0x19fe8c | |
| 0x409ecf handletest_x86.exe|mov eax, esi|esi=0x19fedc | |
| 0x409ed1 handletest_x86.exe|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19febc | |
| 0x409ed4 handletest_x86.exe|mov dword ptr fs:[0], ecx|ecx=0x19fee8 | |
| 0x409edb handletest_x86.exe|pop ecx|ecx=0x19fee8|esp=0x19fe90 | |
| 0x409edc handletest_x86.exe|pop edi|edi=0x0|esp=0x19fe94 | |
| 0x409edd handletest_x86.exe|pop esi|esi=0x19fedc|esp=0x19fe98 | |
| 0x409ede handletest_x86.exe|pop ebx|ebx=0x2a3000|esp=0x19fe9c | |
| 0x409edf handletest_x86.exe|leave|ebp=0x19febc|esp=0x19fea0 | |
| 0x409ee0 handletest_x86.exe|ret|esp=0x19fec0 | |
| 0x404a0e handletest_x86.exe|pop ecx|ecx=0x6671bf08|esp=0x19fec4 | |
| 0x404a0f handletest_x86.exe|cmp dword ptr [ebp - 0x1c], 0|ebp=0x19fef8 | |
| 0x404a13 handletest_x86.exe|jne 0x404a22|eflags=0x206 | |
| 0x404a22 handletest_x86.exe|and dword ptr [ebp - 0x20], 0|ebp=0x19fef8 | |
| 0x404a26 handletest_x86.exe|and dword ptr [ebp - 4], 0|ebp=0x19fef8 | |
| 0x404a2a handletest_x86.exe|push dword ptr [ebp - 0x1c]|ebp=0x19fef8|esp=0x19fec8 | |
| 0x404a2d handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fef8|esp=0x19fec4 | |
| 0x404a30 handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fec0 | |
| 0x404a31 handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19febc | |
| 0x404a32 handletest_x86.exe|call 0x40a3ab|esp=0x19feb8|eip=0x404a32 | |
| 0x40a3ab handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40a3ad handletest_x86.exe|push ebp|ebp=0x19fef8|esp=0x19feb4 | |
| 0x40a3ae handletest_x86.exe|mov ebp, esp|esp=0x19feb0 | |
| 0x40a3b0 handletest_x86.exe|pop ebp|ebp=0x19feb0|esp=0x19feb0 | |
| 0x40a3b1 handletest_x86.exe|jmp 0x40a214 | |
| 0x40a214 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40a216 handletest_x86.exe|push ebp|ebp=0x19fef8|esp=0x19feb4 | |
| 0x40a217 handletest_x86.exe|mov ebp, esp|esp=0x19feb0 | |
| 0x40a219 handletest_x86.exe|sub esp, 0x1c|esp=0x19feb0 | |
| 0x40a21c handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fe94 | |
| 0x40a21d handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fe90 | |
| 0x40a21e handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19feb0|esp=0x19fe8c | |
| 0x40a221 handletest_x86.exe|lea eax, [ebp - 0x1c]|ebp=0x19feb0 | |
| 0x40a224 handletest_x86.exe|push eax|eax=0x19fe94|esp=0x19fe88 | |
| 0x40a225 handletest_x86.exe|call 0x409fea|esp=0x19fe84|eip=0x40a225 | |
| 0x409fea handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x409fec handletest_x86.exe|push ebp|ebp=0x19feb0|esp=0x19fe80 | |
| 0x409fed handletest_x86.exe|mov ebp, esp|esp=0x19fe7c | |
| 0x409fef handletest_x86.exe|push ecx|ecx=0x19fedc|esp=0x19fe7c | |
| 0x409ff0 handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fe78 | |
| 0x409ff1 handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19fe7c | |
| 0x409ff4 handletest_x86.exe|xor eax, eax|eax=0x19fe94 | |
| 0x409ff6 handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fe74 | |
| 0x409ff7 handletest_x86.exe|mov edi, esi|esi=0x19fe94 | |
| 0x409ff9 handletest_x86.exe|stosd dword ptr es:[edi], eax|edi=0x19fe94|eax=0x0|eflags=0x246 | |
| 0x409ffa handletest_x86.exe|stosd dword ptr es:[edi], eax|edi=0x19fe98|eax=0x0|eflags=0x246 | |
| 0x409ffb handletest_x86.exe|stosd dword ptr es:[edi], eax|edi=0x19fe9c|eax=0x0|eflags=0x246 | |
| 0x409ffc handletest_x86.exe|mov eax, dword ptr [0x41ef84] | |
| 0x40a001 handletest_x86.exe|mov edi, dword ptr [ebp + 0xc]|ebp=0x19fe7c | |
| 0x40a004 handletest_x86.exe|mov dword ptr [esi + 4], eax|esi=0x19fe94|eax=0x0 | |
| 0x40a007 handletest_x86.exe|jmp 0x40a00a | |
| 0x40a00a handletest_x86.exe|mov al, byte ptr [edi]|edi=0x41e9b8 | |
| 0x40a00c handletest_x86.exe|cmp al, 0x20|al=0x72 | |
| 0x40a00e handletest_x86.exe|je 0x40a009|eflags=0x202 | |
| 0x40a010 handletest_x86.exe|cmp al, 0x61|al=0x72 | |
| 0x40a012 handletest_x86.exe|je 0x40a042|eflags=0x206 | |
| 0x40a014 handletest_x86.exe|cmp al, 0x72|al=0x72 | |
| 0x40a016 handletest_x86.exe|je 0x40a039|eflags=0x246 | |
| 0x40a039 handletest_x86.exe|mov dword ptr [esi + 4], 1|esi=0x19fe94 | |
| 0x40a040 handletest_x86.exe|jmp 0x40a04f | |
| 0x40a04f handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fe70 | |
| 0x40a050 handletest_x86.exe|inc edi|edi=0x41e9b8 | |
| 0x40a051 handletest_x86.exe|mov byte ptr [ebp - 1], 0|ebp=0x19fe7c | |
| 0x40a055 handletest_x86.exe|xor bl, bl|bl=0x0 | |
| 0x40a057 handletest_x86.exe|mov byte ptr [ebp - 2], 0|ebp=0x19fe7c | |
| 0x40a05b handletest_x86.exe|xor bh, bh|bh=0x30 | |
| 0x40a05d handletest_x86.exe|mov cl, 1 | |
| 0x40a05f handletest_x86.exe|mov al, byte ptr [edi]|edi=0x41e9b9 | |
| 0x40a061 handletest_x86.exe|test al, al|al=0x0 | |
| 0x40a063 handletest_x86.exe|je 0x40a143|eflags=0x246 | |
| 0x40a143 handletest_x86.exe|test bh, bh|bh=0x0 | |
| 0x40a145 handletest_x86.exe|je 0x40a148|eflags=0x246 | |
| 0x40a148 handletest_x86.exe|cmp byte ptr [edi], 0x20|edi=0x41e9b9 | |
| 0x40a14b handletest_x86.exe|je 0x40a147|eflags=0x283 | |
| 0x40a14d handletest_x86.exe|test bh, bh|bh=0x0 | |
| 0x40a14f handletest_x86.exe|jne 0x40a162|eflags=0x246 | |
| 0x40a151 handletest_x86.exe|cmp byte ptr [edi], bh|edi=0x41e9b9|bh=0x0 | |
| 0x40a153 handletest_x86.exe|jne 0x40a1fd|eflags=0x246 | |
| 0x40a159 handletest_x86.exe|mov byte ptr [esi + 8], 1|esi=0x19fe94 | |
| 0x40a15d handletest_x86.exe|jmp 0x40a20d | |
| 0x40a20d handletest_x86.exe|pop ebx|ebx=0x2a0000|esp=0x19fe6c | |
| 0x40a20e handletest_x86.exe|pop edi|edi=0x41e9b9|esp=0x19fe70 | |
| 0x40a20f handletest_x86.exe|mov eax, esi|esi=0x19fe94 | |
| 0x40a211 handletest_x86.exe|pop esi|esi=0x19fe94|esp=0x19fe74 | |
| 0x40a212 handletest_x86.exe|leave|ebp=0x19fe7c|esp=0x19fe78 | |
| 0x40a213 handletest_x86.exe|ret|esp=0x19fe80 | |
| 0x40a22a handletest_x86.exe|mov esi, eax|eax=0x19fe94 | |
| 0x40a22c handletest_x86.exe|lea edi, [ebp - 0x10]|ebp=0x19feb0 | |
| 0x40a22f handletest_x86.exe|pop ecx|ecx=0x19fe01|esp=0x19fe84 | |
| 0x40a230 handletest_x86.exe|pop ecx|ecx=0x19fe94|esp=0x19fe88 | |
| 0x40a231 handletest_x86.exe|movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fea0|esi=0x19fe94|eflags=0x246 | |
| 0x40a232 handletest_x86.exe|movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fea4|esi=0x19fe98|eflags=0x246 | |
| 0x40a233 handletest_x86.exe|movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fea8|esi=0x19fe9c|eflags=0x246 | |
| 0x40a234 handletest_x86.exe|cmp byte ptr [ebp - 8], 0|ebp=0x19feb0 | |
| 0x40a238 handletest_x86.exe|pop edi|edi=0x19feac|esp=0x19fe8c | |
| 0x40a239 handletest_x86.exe|pop esi|esi=0x19fea0|esp=0x19fe90 | |
| 0x40a23a handletest_x86.exe|je 0x40a293|eflags=0x202 | |
| 0x40a23c handletest_x86.exe|push 0x180|esp=0x19fe94 | |
| 0x40a241 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19feb0|esp=0x19fe90 | |
| 0x40a244 handletest_x86.exe|lea eax, [ebp - 4]|ebp=0x19feb0 | |
| 0x40a247 handletest_x86.exe|push dword ptr [ebp - 0x10]|ebp=0x19feb0|esp=0x19fe8c | |
| 0x40a24a handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19feb0|esp=0x19fe88 | |
| 0x40a24d handletest_x86.exe|push eax|eax=0x19feac|esp=0x19fe84 | |
| 0x40a24e handletest_x86.exe|call 0x40f9be|esp=0x19fe80|eip=0x40a24e | |
| 0x40f9be handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40f9c0 handletest_x86.exe|push ebp|ebp=0x19feb0|esp=0x19fe7c | |
| 0x40f9c1 handletest_x86.exe|mov ebp, esp|esp=0x19fe78 | |
| 0x40f9c3 handletest_x86.exe|push 1|esp=0x19fe78 | |
| 0x40f9c5 handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fe78|esp=0x19fe74 | |
| 0x40f9c8 handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fe78|esp=0x19fe70 | |
| 0x40f9cb handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fe78|esp=0x19fe6c | |
| 0x40f9ce handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fe78|esp=0x19fe68 | |
| 0x40f9d1 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fe78|esp=0x19fe64 | |
| 0x40f9d4 handletest_x86.exe|call 0x40f388|esp=0x19fe60|eip=0x40f9d4 | |
| 0x40f388 handletest_x86.exe|push 0x10|esp=0x19fe5c | |
| 0x40f38a handletest_x86.exe|push 0x41d520|esp=0x19fe58 | |
| 0x40f38f handletest_x86.exe|call 0x401d60|esp=0x19fe54|eip=0x40f38f | |
| 0x401d60 handletest_x86.exe|push 0x401fd0|esp=0x19fe50 | |
| 0x401d65 handletest_x86.exe|push dword ptr fs:[0]|esp=0x19fe4c | |
| 0x401d6c handletest_x86.exe|mov eax, dword ptr [esp + 0x10]|esp=0x19fe48 | |
| 0x401d70 handletest_x86.exe|mov dword ptr [esp + 0x10], ebp|esp=0x19fe48|ebp=0x19fe78 | |
| 0x401d74 handletest_x86.exe|lea ebp, [esp + 0x10]|esp=0x19fe48 | |
| 0x401d78 handletest_x86.exe|sub esp, eax|esp=0x19fe48|eax=0x10 | |
| 0x401d7a handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fe38 | |
| 0x401d7b handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fe34 | |
| 0x401d7c handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fe30 | |
| 0x401d7d handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x401d82 handletest_x86.exe|xor dword ptr [ebp - 4], eax|ebp=0x19fe58|eax=0x666841b4 | |
| 0x401d85 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19fe58 | |
| 0x401d87 handletest_x86.exe|push eax|eax=0x6671bfec|esp=0x19fe2c | |
| 0x401d88 handletest_x86.exe|mov dword ptr [ebp - 0x18], esp|ebp=0x19fe58|esp=0x19fe28 | |
| 0x401d8b handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19fe58|esp=0x19fe28 | |
| 0x401d8e handletest_x86.exe|mov eax, dword ptr [ebp - 4]|ebp=0x19fe58 | |
| 0x401d91 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fe58 | |
| 0x401d98 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19fe58|eax=0x66299494 | |
| 0x401d9b handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19fe58 | |
| 0x401d9e handletest_x86.exe|mov dword ptr fs:[0], eax|eax=0x19fe48 | |
| 0x401da4 handletest_x86.exe|ret|esp=0x19fe24 | |
| 0x40f394 handletest_x86.exe|mov esi, dword ptr [ebp + 0x18]|ebp=0x19fe58 | |
| 0x40f397 handletest_x86.exe|test esi, esi|esi=0x19feac | |
| 0x40f399 handletest_x86.exe|jne 0x40f3ae|eflags=0x206 | |
| 0x40f3ae handletest_x86.exe|or dword ptr [esi], 0xffffffff|esi=0x19feac | |
| 0x40f3b1 handletest_x86.exe|cmp dword ptr [ebp + 8], 0|ebp=0x19fe58 | |
| 0x40f3b5 handletest_x86.exe|je 0x40f39b|eflags=0x202 | |
| 0x40f3b7 handletest_x86.exe|cmp dword ptr [ebp + 0x1c], 0|ebp=0x19fe58 | |
| 0x40f3bb handletest_x86.exe|je 0x40f3c6|eflags=0x202 | |
| 0x40f3bd handletest_x86.exe|test dword ptr [ebp + 0x14], 0xfffffe7f|ebp=0x19fe58 | |
| 0x40f3c4 handletest_x86.exe|jne 0x40f39b|eflags=0x246 | |
| 0x40f3c6 handletest_x86.exe|xor eax, eax|eax=0x19fe48 | |
| 0x40f3c8 handletest_x86.exe|mov dword ptr [ebp - 0x20], eax|ebp=0x19fe58|eax=0x0 | |
| 0x40f3cb handletest_x86.exe|mov dword ptr [ebp - 0x1c], eax|ebp=0x19fe58|eax=0x0 | |
| 0x40f3ce handletest_x86.exe|mov dword ptr [ebp - 4], eax|ebp=0x19fe58|eax=0x0 | |
| 0x40f3d1 handletest_x86.exe|push dword ptr [ebp + 0x1c]|ebp=0x19fe58|esp=0x19fe28 | |
| 0x40f3d4 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fe58|esp=0x19fe24 | |
| 0x40f3d7 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fe58|esp=0x19fe20 | |
| 0x40f3da handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fe58|esp=0x19fe1c | |
| 0x40f3dd handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fe58|esp=0x19fe18 | |
| 0x40f3e0 handletest_x86.exe|push esi|esi=0x19feac|esp=0x19fe14 | |
| 0x40f3e1 handletest_x86.exe|lea eax, [ebp - 0x20]|ebp=0x19fe58 | |
| 0x40f3e4 handletest_x86.exe|push eax|eax=0x19fe38|esp=0x19fe10 | |
| 0x40f3e5 handletest_x86.exe|call 0x40f950|esp=0x19fe0c|eip=0x40f3e5 | |
| 0x40f950 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40f952 handletest_x86.exe|push ebp|ebp=0x19fe58|esp=0x19fe08 | |
| 0x40f953 handletest_x86.exe|mov ebp, esp|esp=0x19fe04 | |
| 0x40f955 handletest_x86.exe|sub esp, 0x18|esp=0x19fe04 | |
| 0x40f958 handletest_x86.exe|xor eax, eax|eax=0x19fe38 | |
| 0x40f95a handletest_x86.exe|push esi|esi=0x19feac|esp=0x19fdec | |
| 0x40f95b handletest_x86.exe|mov dword ptr [ebp - 0x18], eax|ebp=0x19fe04|eax=0x0 | |
| 0x40f95e handletest_x86.exe|mov dword ptr [ebp - 0x14], eax|ebp=0x19fe04|eax=0x0 | |
| 0x40f961 handletest_x86.exe|mov dword ptr [ebp - 0x10], eax|ebp=0x19fe04|eax=0x0 | |
| 0x40f964 handletest_x86.exe|mov dword ptr [ebp - 0xc], eax|ebp=0x19fe04|eax=0x0 | |
| 0x40f967 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19fe04|eax=0x0 | |
| 0x40f96a handletest_x86.exe|mov byte ptr [ebp - 4], al|ebp=0x19fe04|al=0x0 | |
| 0x40f96d handletest_x86.exe|call 0x40ca77|esp=0x19fde8|eip=0x40f96d | |
| 0x40ca77 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40ca79 handletest_x86.exe|push ebp|ebp=0x19fe04|esp=0x19fde4 | |
| 0x40ca7a handletest_x86.exe|mov ebp, esp|esp=0x19fde0 | |
| 0x40ca7c handletest_x86.exe|sub esp, 0x10|esp=0x19fde0 | |
| 0x40ca7f handletest_x86.exe|push 0|esp=0x19fdd0 | |
| 0x40ca81 handletest_x86.exe|lea ecx, [ebp - 0x10]|ebp=0x19fde0 | |
| 0x40ca84 handletest_x86.exe|call 0x40c9a8|esp=0x19fdcc|eip=0x40ca84 | |
| 0x40c9a8 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40c9aa handletest_x86.exe|push ebp|ebp=0x19fde0|esp=0x19fdc8 | |
| 0x40c9ab handletest_x86.exe|mov ebp, esp|esp=0x19fdc4 | |
| 0x40c9ad handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fdc4 | |
| 0x40c9ae handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fdc0 | |
| 0x40c9af handletest_x86.exe|mov edi, ecx|ecx=0x19fdd0 | |
| 0x40c9b1 handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19fdc4 | |
| 0x40c9b4 handletest_x86.exe|mov byte ptr [edi + 0xc], 0|edi=0x19fdd0 | |
| 0x40c9b8 handletest_x86.exe|lea ebx, [edi + 4]|edi=0x19fdd0 | |
| 0x40c9bb handletest_x86.exe|test ecx, ecx|ecx=0x0 | |
| 0x40c9bd handletest_x86.exe|je 0x40c9c6|eflags=0x246 | |
| 0x40c9c6 handletest_x86.exe|cmp dword ptr [0x41ef7c], 0 | |
| 0x40c9cd handletest_x86.exe|jne 0x40c9e1|eflags=0x246 | |
| 0x40c9cf handletest_x86.exe|mov eax, dword ptr [0x41e1b0] | |
| 0x40c9d4 handletest_x86.exe|mov ecx, dword ptr [0x41e1b4] | |
| 0x40c9da handletest_x86.exe|mov dword ptr [ebx], eax|ebx=0x19fdd4|eax=0x41e0f8 | |
| 0x40c9dc handletest_x86.exe|mov dword ptr [ebx + 4], ecx|ebx=0x19fdd4|ecx=0x828ce0 | |
| 0x40c9df handletest_x86.exe|jmp 0x40ca22 | |
| 0x40ca22 handletest_x86.exe|mov eax, edi|edi=0x19fdd0 | |
| 0x40ca24 handletest_x86.exe|pop edi|edi=0x19fdd0|esp=0x19fdbc | |
| 0x40ca25 handletest_x86.exe|pop ebx|ebx=0x19fdd4|esp=0x19fdc0 | |
| 0x40ca26 handletest_x86.exe|pop ebp|ebp=0x19fdc4|esp=0x19fdc4 | |
| 0x40ca27 handletest_x86.exe|ret 4|esp=0x19fdc8 | |
| 0x40ca89 handletest_x86.exe|mov eax, dword ptr [ebp - 0xc]|ebp=0x19fde0 | |
| 0x40ca8c handletest_x86.exe|mov edx, 0xfde9 | |
| 0x40ca91 handletest_x86.exe|cmp dword ptr [eax + 8], edx|eax=0x41e0f8|edx=0xfde9 | |
| 0x40ca94 handletest_x86.exe|je 0x40caa2|eflags=0x297 | |
| 0x40ca96 handletest_x86.exe|call 0x40a643|esp=0x19fdd0|eip=0x40ca96 | |
| 0x40a643 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40a645 handletest_x86.exe|push esi|esi=0x19feac|esp=0x19fdcc | |
| 0x40a646 handletest_x86.exe|call 0x40a44d|esp=0x19fdc8|eip=0x40a646 | |
| 0x40a44d handletest_x86.exe|push 0x4189e8|esp=0x19fdc4 | |
| 0x40a452 handletest_x86.exe|push 0x4189e4|esp=0x19fdc0 | |
| 0x40a457 handletest_x86.exe|push 0x4189e8|esp=0x19fdbc | |
| 0x40a45c handletest_x86.exe|push 0|esp=0x19fdb8 | |
| 0x40a45e handletest_x86.exe|call 0x40a580|esp=0x19fdb4|eip=0x40a45e | |
| 0x40a580 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40a582 handletest_x86.exe|push ebp|ebp=0x19fde0|esp=0x19fdb0 | |
| 0x40a583 handletest_x86.exe|mov ebp, esp|esp=0x19fdac | |
| 0x40a585 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fdac | |
| 0x40a588 handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fdac | |
| 0x40a589 handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fda8 | |
| 0x40a58a handletest_x86.exe|lea ebx, [eax*4 + 0x41f200]|eax=0x0 | |
| 0x40a591 handletest_x86.exe|mov eax, dword ptr [ebx]|ebx=0x41f200 | |
| 0x40a593 handletest_x86.exe|nop | |
| 0x40a594 handletest_x86.exe|mov edx, dword ptr [0x41e004] | |
| 0x40a59a handletest_x86.exe|or edi, 0xffffffff|edi=0x41e9b8 | |
| 0x40a59d handletest_x86.exe|mov ecx, edx|edx=0x666841b4 | |
| 0x40a59f handletest_x86.exe|xor edx, eax|edx=0x666841b4|eax=0xce6f1dd6 | |
| 0x40a5a1 handletest_x86.exe|and ecx, 0x1f|ecx=0x666841b4 | |
| 0x40a5a4 handletest_x86.exe|ror edx, cl|edx=0xa8075c62|cl=0x14 | |
| 0x40a5a6 handletest_x86.exe|cmp edx, edi|edx=0x75c62a80|edi=0xffffffff | |
| 0x40a5a8 handletest_x86.exe|jne 0x40a5ae|eflags=0x217 | |
| 0x40a5ae handletest_x86.exe|test edx, edx|edx=0x75c62a80 | |
| 0x40a5b0 handletest_x86.exe|je 0x40a5b6|eflags=0x202 | |
| 0x40a5b2 handletest_x86.exe|mov eax, edx|edx=0x75c62a80 | |
| 0x40a5b4 handletest_x86.exe|jmp 0x40a5ff | |
| 0x40a5ff handletest_x86.exe|pop edi|edi=0xffffffff|esp=0x19fda4 | |
| 0x40a600 handletest_x86.exe|pop ebx|ebx=0x41f200|esp=0x19fda8 | |
| 0x40a601 handletest_x86.exe|pop ebp|ebp=0x19fdac|esp=0x19fdac | |
| 0x40a602 handletest_x86.exe|ret|esp=0x19fdb0 | |
| 0x40a463 handletest_x86.exe|add esp, 0x10|esp=0x19fdb4 | |
| 0x40a466 handletest_x86.exe|ret|esp=0x19fdc4 | |
| 0x40a64b handletest_x86.exe|mov esi, eax|eax=0x75c62a80 | |
| 0x40a64d handletest_x86.exe|test esi, esi|esi=0x75c62a80 | |
| 0x40a64f handletest_x86.exe|je 0x40a65d|eflags=0x202 | |
| 0x40a651 handletest_x86.exe|mov ecx, esi|esi=0x75c62a80 | |
| 0x40a653 handletest_x86.exe|call dword ptr [0x41711c]|esp=0x19fdc8 | |
| 0x401af7 handletest_x86.exe|ret 0|esp=0x19fdc4 | |
| 0x40a659 handletest_x86.exe|call esi|esi=0x75c62a80|esp=0x19fdc8 | |
| 0x75c62a80 kernel32.dll:AreFileApisANSI|jmp dword ptr [0x75cc0bd0] | |
| 0x76fa75e0 kernelbase.dll:AreFileApisANSI|xor eax, eax|eax=0x75c62a80 | |
| 0x76fa75e2 kernelbase.dll:AreFileApisANSI+0x2|cmp dword ptr [0x770654e4], 0x7703f360 | |
| 0x76fa75ec kernelbase.dll:AreFileApisANSI+0xc|sete al|al=0x0|eflags=0x246 | |
| 0x76fa75ef kernelbase.dll:AreFileApisANSI+0xf|ret|esp=0x19fdc4 | |
| 0x40a65b handletest_x86.exe|pop esi|esi=0x75c62a80|esp=0x19fdc8 | |
| 0x40a65c handletest_x86.exe|ret|esp=0x19fdcc | |
| 0x40ca9b handletest_x86.exe|xor edx, edx|edx=0x75c62a80 | |
| 0x40ca9d handletest_x86.exe|test eax, eax|eax=0x1 | |
| 0x40ca9f handletest_x86.exe|jne 0x40caa2|eflags=0x202 | |
| 0x40caa2 handletest_x86.exe|cmp byte ptr [ebp - 4], 0|ebp=0x19fde0 | |
| 0x40caa6 handletest_x86.exe|je 0x40cab2|eflags=0x246 | |
| 0x40cab2 handletest_x86.exe|mov eax, edx|edx=0x0 | |
| 0x40cab4 handletest_x86.exe|leave|ebp=0x19fde0|esp=0x19fdd0 | |
| 0x40cab5 handletest_x86.exe|ret|esp=0x19fde4 | |
| 0x40f972 handletest_x86.exe|push eax|eax=0x0|esp=0x19fde8 | |
| 0x40f973 handletest_x86.exe|lea eax, [ebp - 0x18]|ebp=0x19fe04 | |
| 0x40f976 handletest_x86.exe|push eax|eax=0x19fdec|esp=0x19fde4 | |
| 0x40f977 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fe04|esp=0x19fde0 | |
| 0x40f97a handletest_x86.exe|call 0x40c4d8|esp=0x19fddc|eip=0x40f97a | |
| 0x40c4d8 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40c4da handletest_x86.exe|push ebp|ebp=0x19fe04|esp=0x19fdd8 | |
| 0x40c4db handletest_x86.exe|mov ebp, esp|esp=0x19fdd4 | |
| 0x40c4dd handletest_x86.exe|push ecx|ecx=0x75c62a80|esp=0x19fdd4 | |
| 0x40c4de handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fdd4|esp=0x19fdd0 | |
| 0x40c4e1 handletest_x86.exe|lea eax, [ebp - 1]|ebp=0x19fdd4 | |
| 0x40c4e4 handletest_x86.exe|push eax|eax=0x19fdd3|esp=0x19fdcc | |
| 0x40c4e5 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fdd4|esp=0x19fdc8 | |
| 0x40c4e8 handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fdd4|esp=0x19fdc4 | |
| 0x40c4eb handletest_x86.exe|call 0x40c360|esp=0x19fdc0|eip=0x40c4eb | |
| 0x40c360 handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40c362 handletest_x86.exe|push ebp|ebp=0x19fdd4|esp=0x19fdbc | |
| 0x40c363 handletest_x86.exe|mov ebp, esp|esp=0x19fdb8 | |
| 0x40c365 handletest_x86.exe|push esi|esi=0x19feac|esp=0x19fdb8 | |
| 0x40c366 handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19fdb8 | |
| 0x40c369 handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fdb4 | |
| 0x40c36a handletest_x86.exe|test esi, esi|esi=0x41e9a8 | |
| 0x40c36c handletest_x86.exe|jne 0x40c388|eflags=0x202 | |
| 0x40c388 handletest_x86.exe|xor edi, edi|edi=0x41e9b8 | |
| 0x40c38a handletest_x86.exe|cmp byte ptr [esi], 0|esi=0x41e9a8 | |
| 0x40c38d handletest_x86.exe|jne 0x40c3ae|eflags=0x206 | |
| 0x40c3ae handletest_x86.exe|push edi|edi=0x0|esp=0x19fdb0 | |
| 0x40c3af handletest_x86.exe|push edi|edi=0x0|esp=0x19fdac | |
| 0x40c3b0 handletest_x86.exe|push -1|esp=0x19fda8 | |
| 0x40c3b2 handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fda4 | |
| 0x40c3b3 handletest_x86.exe|push 9|esp=0x19fda0 | |
| 0x40c3b5 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fdb8|esp=0x19fd9c | |
| 0x40c3b8 handletest_x86.exe|call 0x40d5e8|esp=0x19fd98|eip=0x40c3b8 | |
| 0x40d5e8 handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x40d5ea handletest_x86.exe|push ebp|ebp=0x19fdb8|esp=0x19fd94 | |
| 0x40d5eb handletest_x86.exe|mov ebp, esp|esp=0x19fd90 | |
| 0x40d5ed handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fd90 | |
| 0x40d5f0 handletest_x86.exe|mov ecx, 0xc435 | |
| 0x40d5f5 handletest_x86.exe|cmp eax, ecx|eax=0x0|ecx=0xc435 | |
| 0x40d5f7 handletest_x86.exe|ja 0x40d621|eflags=0x293 | |
| 0x40d5f9 handletest_x86.exe|je 0x40d660|eflags=0x293 | |
| 0x40d5fb handletest_x86.exe|cmp eax, 0x2a|eax=0x0 | |
| 0x40d5fe handletest_x86.exe|je 0x40d660|eflags=0x293 | |
| 0x40d600 handletest_x86.exe|cmp eax, 0xc42b|eax=0x0 | |
| 0x40d605 handletest_x86.exe|jbe 0x40d61c|eflags=0x293 | |
| 0x40d61c handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19fd90 | |
| 0x40d61f handletest_x86.exe|jmp 0x40d64a | |
| 0x40d64a handletest_x86.exe|push dword ptr [ebp + 0x1c]|ebp=0x19fd90|esp=0x19fd90 | |
| 0x40d64d handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fd90|esp=0x19fd8c | |
| 0x40d650 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fd90|esp=0x19fd88 | |
| 0x40d653 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fd90|esp=0x19fd84 | |
| 0x40d656 handletest_x86.exe|push ecx|ecx=0x9|esp=0x19fd80 | |
| 0x40d657 handletest_x86.exe|push eax|eax=0x0|esp=0x19fd7c | |
| 0x40d658 handletest_x86.exe|call dword ptr [0x4170d4]|esp=0x19fd78 | |
| 0x75c54340 kernel32.dll:MultiByteToWideChar|mov edi, edi|edi=0x0 | |
| 0x75c54342 kernel32.dll:MultiByteToWideChar+0x2|push ebp|ebp=0x19fd90|esp=0x19fd74 | |
| 0x75c54343 kernel32.dll:MultiByteToWideChar+0x3|mov ebp, esp|esp=0x19fd70 | |
| 0x75c54345 kernel32.dll:MultiByteToWideChar+0x5|pop ebp|ebp=0x19fd70|esp=0x19fd70 | |
| 0x75c54346 kernel32.dll:MultiByteToWideChar+0x6|jmp dword ptr [0x75cc1800] | |
| 0x76f74470 kernelbase.dll:MultiByteToWideChar|mov edi, edi|edi=0x0 | |
| 0x76f74472 kernelbase.dll:MultiByteToWideChar+0x2|push ebp|ebp=0x19fd90|esp=0x19fd74 | |
| 0x76f74473 kernelbase.dll:MultiByteToWideChar+0x3|mov ebp, esp|esp=0x19fd70 | |
| 0x76f74475 kernelbase.dll:MultiByteToWideChar+0x5|sub esp, 0xf4|esp=0x19fd70 | |
| 0x76f7447b kernelbase.dll:MultiByteToWideChar+0xb|mov eax, dword ptr [0x77065bd0] | |
| 0x76f74480 kernelbase.dll:MultiByteToWideChar+0x10|xor eax, ebp|eax=0x92df5544|ebp=0x19fd70 | |
| 0x76f74482 kernelbase.dll:MultiByteToWideChar+0x12|mov dword ptr [ebp - 4], eax|ebp=0x19fd70|eax=0x92c6a834 | |
| 0x76f74485 kernelbase.dll:MultiByteToWideChar+0x15|mov eax, dword ptr [ebp + 0x18]|ebp=0x19fd70 | |
| 0x76f74488 kernelbase.dll:MultiByteToWideChar+0x18|mov edx, dword ptr [ebp + 8]|ebp=0x19fd70 | |
| 0x76f7448b kernelbase.dll:MultiByteToWideChar+0x1b|mov ecx, dword ptr [ebp + 0x14]|ebp=0x19fd70 | |
| 0x76f7448e kernelbase.dll:MultiByteToWideChar+0x1e|push ebx|ebx=0x2a3000|esp=0x19fc7c | |
| 0x76f7448f kernelbase.dll:MultiByteToWideChar+0x1f|push esi|esi=0x41e9a8|esp=0x19fc78 | |
| 0x76f74490 kernelbase.dll:MultiByteToWideChar+0x20|mov esi, dword ptr [ebp + 0x10]|ebp=0x19fd70 | |
| 0x76f74493 kernelbase.dll:MultiByteToWideChar+0x23|xor ebx, ebx|ebx=0x2a3000 | |
| 0x76f74495 kernelbase.dll:MultiByteToWideChar+0x25|mov dword ptr [ebp - 0xe4], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f7449b kernelbase.dll:MultiByteToWideChar+0x2b|mov eax, dword ptr [ebp + 0x1c]|ebp=0x19fd70 | |
| 0x76f7449e kernelbase.dll:MultiByteToWideChar+0x2e|mov dword ptr [ebp - 0xc8], ecx|ebp=0x19fd70|ecx=0xffffffff | |
| 0x76f744a4 kernelbase.dll:MultiByteToWideChar+0x34|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f744aa kernelbase.dll:MultiByteToWideChar+0x3a|push edi|edi=0x0|esp=0x19fc74 | |
| 0x76f744ab kernelbase.dll:MultiByteToWideChar+0x3b|cmp edx, 0xea60|edx=0x0 | |
| 0x76f744b1 kernelbase.dll:MultiByteToWideChar+0x41|jae 0x76f74773|eflags=0x287 | |
| 0x76f744b7 kernelbase.dll:MultiByteToWideChar+0x47|cmp edx, 0x4b0|edx=0x0 | |
| 0x76f744bd kernelbase.dll:MultiByteToWideChar+0x4d|je 0x76f74765|eflags=0x287 | |
| 0x76f744c3 kernelbase.dll:MultiByteToWideChar+0x53|cmp edx, 0x4b1|edx=0x0 | |
| 0x76f744c9 kernelbase.dll:MultiByteToWideChar+0x59|je 0x76f74757|eflags=0x293 | |
| 0x76f744cf kernelbase.dll:MultiByteToWideChar+0x5f|cmp edx, 0x2ee0|edx=0x0 | |
| 0x76f744d5 kernelbase.dll:MultiByteToWideChar+0x65|je 0x76f74749|eflags=0x283 | |
| 0x76f744db kernelbase.dll:MultiByteToWideChar+0x6b|cmp edx, 0x2ee1|edx=0x0 | |
| 0x76f744e1 kernelbase.dll:MultiByteToWideChar+0x71|je 0x76f7473b|eflags=0x293 | |
| 0x76f744e7 kernelbase.dll:MultiByteToWideChar+0x77|cmp edx, 3|edx=0x0 | |
| 0x76f744ea kernelbase.dll:MultiByteToWideChar+0x7a|jne 0x76f74639|eflags=0x293 | |
| 0x76f74639 kernelbase.dll:MultiByteToWideChar+0x1c9|test edx, edx|edx=0x0 | |
| 0x76f7463b kernelbase.dll:MultiByteToWideChar+0x1cb|jne 0x76f7465d|eflags=0x246 | |
| 0x76f7463d kernelbase.dll:MultiByteToWideChar+0x1cd|mov edx, dword ptr [0x77065c10] | |
| 0x76f74643 kernelbase.dll:MultiByteToWideChar+0x1d3|mov edi, dword ptr [0x77067780] | |
| 0x76f74649 kernelbase.dll:MultiByteToWideChar+0x1d9|mov ecx, dword ptr [ebp - 0xc8]|ebp=0x19fd70 | |
| 0x76f7464f kernelbase.dll:MultiByteToWideChar+0x1df|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74655 kernelbase.dll:MultiByteToWideChar+0x1e5|jmp 0x76f74779 | |
| 0x76f74779 kernelbase.dll:MultiByteToWideChar+0x309|mov dword ptr [ebp - 0xd0], edi|ebp=0x19fd70|edi=0x8273c0 | |
| 0x76f7477f kernelbase.dll:MultiByteToWideChar+0x30f|cmp edx, 0xea60|edx=0x4e4 | |
| 0x76f74785 kernelbase.dll:MultiByteToWideChar+0x315|jae 0x76f751c7|eflags=0x287 | |
| 0x76f7478b kernelbase.dll:MultiByteToWideChar+0x31b|cmp edx, 0x4b0|edx=0x4e4 | |
| 0x76f74791 kernelbase.dll:MultiByteToWideChar+0x321|je 0x76f751c7|eflags=0x202 | |
| 0x76f74797 kernelbase.dll:MultiByteToWideChar+0x327|cmp edx, 0x4b1|edx=0x4e4 | |
| 0x76f7479d kernelbase.dll:MultiByteToWideChar+0x32d|je 0x76f751c7|eflags=0x206 | |
| 0x76f747a3 kernelbase.dll:MultiByteToWideChar+0x333|cmp edx, 0x2ee0|edx=0x4e4 | |
| 0x76f747a9 kernelbase.dll:MultiByteToWideChar+0x339|je 0x76f751c7|eflags=0x283 | |
| 0x76f747af kernelbase.dll:MultiByteToWideChar+0x33f|cmp edx, 0x2ee1|edx=0x4e4 | |
| 0x76f747b5 kernelbase.dll:MultiByteToWideChar+0x345|je 0x76f751c7|eflags=0x287 | |
| 0x76f747bb kernelbase.dll:MultiByteToWideChar+0x34b|test ecx, ecx|ecx=0xffffffff | |
| 0x76f747bd kernelbase.dll:MultiByteToWideChar+0x34d|je 0x76f751ab|eflags=0x286 | |
| 0x76f747c3 kernelbase.dll:MultiByteToWideChar+0x353|test eax, eax|eax=0x0 | |
| 0x76f747c5 kernelbase.dll:MultiByteToWideChar+0x355|js 0x76f751ab|eflags=0x246 | |
| 0x76f747cb kernelbase.dll:MultiByteToWideChar+0x35b|test esi, esi|esi=0x41e9a8 | |
| 0x76f747cd kernelbase.dll:MultiByteToWideChar+0x35d|je 0x76f751ab|eflags=0x202 | |
| 0x76f747d3 kernelbase.dll:MultiByteToWideChar+0x363|test eax, eax|eax=0x0 | |
| 0x76f747d5 kernelbase.dll:MultiByteToWideChar+0x365|je 0x76f747f5|eflags=0x246 | |
| 0x76f747f5 kernelbase.dll:MultiByteToWideChar+0x385|cmp ecx, -1|ecx=0xffffffff | |
| 0x76f747f8 kernelbase.dll:MultiByteToWideChar+0x388|jg 0x76f74833|eflags=0x246 | |
| 0x76f747fa kernelbase.dll:MultiByteToWideChar+0x38a|mov ecx, 0x7fffffff | |
| 0x76f747ff kernelbase.dll:MultiByteToWideChar+0x38f|mov eax, esi|esi=0x41e9a8 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9a8|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9a8 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7fffffff | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9a9|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x202 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9a9 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffe | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9aa|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9aa | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffd | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ab|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ab | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffc | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ac|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x202 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ac | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffb | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ad|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ad | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffa | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ae|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ae | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff9 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9af|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9af | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff8 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b0|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b0 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff7 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b1|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b1 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff6 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b2|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b2 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff5 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b3|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b3 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff4 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b4|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b4 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff3 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b5|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b5 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff2 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b6|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b6 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff1 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b7|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x246 | |
| 0x76f7480b kernelbase.dll:MultiByteToWideChar+0x39b|test ecx, ecx|ecx=0x7ffffff0 | |
| 0x76f7480d kernelbase.dll:MultiByteToWideChar+0x39d|je 0x76f751ab|eflags=0x206 | |
| 0x76f74813 kernelbase.dll:MultiByteToWideChar+0x3a3|mov eax, 0x7fffffff | |
| 0x76f74818 kernelbase.dll:MultiByteToWideChar+0x3a8|sub eax, ecx|eax=0x7fffffff|ecx=0x7ffffff0 | |
| 0x76f7481a kernelbase.dll:MultiByteToWideChar+0x3aa|neg ecx|ecx=0x7ffffff0 | |
| 0x76f7481c kernelbase.dll:MultiByteToWideChar+0x3ac|sbb ecx, ecx|ecx=0x80000010|eflags=0x283 | |
| 0x76f7481e kernelbase.dll:MultiByteToWideChar+0x3ae|and ecx, eax|ecx=0xffffffff|eax=0xf | |
| 0x76f74820 kernelbase.dll:MultiByteToWideChar+0x3b0|inc ecx|ecx=0xf | |
| 0x76f74821 kernelbase.dll:MultiByteToWideChar+0x3b1|cmp ecx, 0x7fffffff|ecx=0x10 | |
| 0x76f74827 kernelbase.dll:MultiByteToWideChar+0x3b7|ja 0x76f751ab|eflags=0x297 | |
| 0x76f7482d kernelbase.dll:MultiByteToWideChar+0x3bd|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74833 kernelbase.dll:MultiByteToWideChar+0x3c3|test edi, edi|edi=0x8273c0 | |
| 0x76f74835 kernelbase.dll:MultiByteToWideChar+0x3c5|jne 0x76f748d4|eflags=0x206 | |
| 0x76f748d4 kernelbase.dll:MultiByteToWideChar+0x464|mov eax, dword ptr [edi + 4]|edi=0x8273c0 | |
| 0x76f748d7 kernelbase.dll:MultiByteToWideChar+0x467|test eax, eax|eax=0x0 | |
| 0x76f748d9 kernelbase.dll:MultiByteToWideChar+0x469|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f748df kernelbase.dll:MultiByteToWideChar+0x46f|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f748e5 kernelbase.dll:MultiByteToWideChar+0x475|je 0x76f7492d|eflags=0x246 | |
| 0x76f7492d kernelbase.dll:MultiByteToWideChar+0x4bd|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fd70 | |
| 0x76f74930 kernelbase.dll:MultiByteToWideChar+0x4c0|test eax, 0xfffffff0|eax=0x9 | |
| 0x76f74935 kernelbase.dll:MultiByteToWideChar+0x4c5|jne 0x76f7518c|eflags=0x246 | |
| 0x76f7493b kernelbase.dll:MultiByteToWideChar+0x4cb|and eax, 3|eax=0x9 | |
| 0x76f7493e kernelbase.dll:MultiByteToWideChar+0x4ce|cmp al, 3|al=0x1 | |
| 0x76f74940 kernelbase.dll:MultiByteToWideChar+0x4d0|je 0x76f7518c|eflags=0x293 | |
| 0x76f74946 kernelbase.dll:MultiByteToWideChar+0x4d6|lea edx, [ecx + esi]|ecx=0x10|esi=0x41e9a8 | |
| 0x76f74949 kernelbase.dll:MultiByteToWideChar+0x4d9|mov dword ptr [ebp - 0xdc], edx|ebp=0x19fd70|edx=0x41e9b8 | |
| 0x76f7494f kernelbase.dll:MultiByteToWideChar+0x4df|mov edx, dword ptr [ebp + 0xc]|ebp=0x19fd70 | |
| 0x76f74952 kernelbase.dll:MultiByteToWideChar+0x4e2|mov eax, edx|edx=0x9 | |
| 0x76f74954 kernelbase.dll:MultiByteToWideChar+0x4e4|and eax, 2|eax=0x9 | |
| 0x76f74957 kernelbase.dll:MultiByteToWideChar+0x4e7|mov dword ptr [ebp - 0xc8], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f7495d kernelbase.dll:MultiByteToWideChar+0x4ed|test dl, 4|dl=0x9 | |
| 0x76f74960 kernelbase.dll:MultiByteToWideChar+0x4f0|je 0x76f7496f|eflags=0x246 | |
| 0x76f7496f kernelbase.dll:MultiByteToWideChar+0x4ff|mov eax, dword ptr [edi + 0xc]|edi=0x8273c0 | |
| 0x76f74972 kernelbase.dll:MultiByteToWideChar+0x502|mov dword ptr [ebp - 0xe0], eax|ebp=0x19fd70|eax=0x5d001c | |
| 0x76f74978 kernelbase.dll:MultiByteToWideChar+0x508|and edx, 8|edx=0x9 | |
| 0x76f7497b kernelbase.dll:MultiByteToWideChar+0x50b|mov dword ptr [ebp - 0xd8], edx|ebp=0x19fd70|edx=0x8 | |
| 0x76f74981 kernelbase.dll:MultiByteToWideChar+0x511|mov edx, dword ptr [edi + 8]|edi=0x8273c0 | |
| 0x76f74984 kernelbase.dll:MultiByteToWideChar+0x514|mov dword ptr [ebp - 0xe8], edx|ebp=0x19fd70|edx=0x5d0002 | |
| 0x76f7498a kernelbase.dll:MultiByteToWideChar+0x51a|movzx edx, word ptr [edx + 2]|edx=0x5d0002 | |
| 0x76f7498e kernelbase.dll:MultiByteToWideChar+0x51e|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x1 | |
| 0x76f74994 kernelbase.dll:MultiByteToWideChar+0x524|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f7499a kernelbase.dll:MultiByteToWideChar+0x52a|cmp dword ptr [ebp - 0xd4], ebx|ebp=0x19fd70|ebx=0x0 | |
| 0x76f749a0 kernelbase.dll:MultiByteToWideChar+0x530|jne 0x76f74cff|eflags=0x246 | |
| 0x76f749a6 kernelbase.dll:MultiByteToWideChar+0x536|cmp word ptr [ebp - 0xc4], 1|ebp=0x19fd70 | |
| 0x76f749ae kernelbase.dll:MultiByteToWideChar+0x53e|jne 0x76f74ab8|eflags=0x246 | |
| 0x76f749b4 kernelbase.dll:MultiByteToWideChar+0x544|cmp dword ptr [ebp - 0xc8], ebx|ebp=0x19fd70|ebx=0x0 | |
| 0x76f749ba kernelbase.dll:MultiByteToWideChar+0x54a|je 0x76f74a35|eflags=0x246 | |
| 0x76f74a35 kernelbase.dll:MultiByteToWideChar+0x5c5|cmp dword ptr [ebp - 0xd8], ebx|ebp=0x19fd70|ebx=0x0 | |
| 0x76f74a3b kernelbase.dll:MultiByteToWideChar+0x5cb|mov ebx, ecx|ecx=0x10 | |
| 0x76f74a3d kernelbase.dll:MultiByteToWideChar+0x5cd|je 0x76f749fb|eflags=0x202 | |
| 0x76f74a3f kernelbase.dll:MultiByteToWideChar+0x5cf|cmp esi, edx|esi=0x41e9a8|edx=0x41e9b8 | |
| 0x76f74a41 kernelbase.dll:MultiByteToWideChar+0x5d1|jae 0x76f749fb|eflags=0x287 | |
| 0x76f74a43 kernelbase.dll:MultiByteToWideChar+0x5d3|mov ecx, dword ptr [ebp - 0xe0]|ebp=0x19fd70 | |
| 0x76f74a49 kernelbase.dll:MultiByteToWideChar+0x5d9|mov edi, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74a4f kernelbase.dll:MultiByteToWideChar+0x5df|nop | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9a8 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x2e | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x2e | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x2e | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x2e | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x2e | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x2e | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x2e | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x2e|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x293 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9a8 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9a9|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x283 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9a9 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x2f | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x2f | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x2f | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x2f | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x2f | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x2f | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x2f | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x2f|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x287 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x203 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9a9 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9aa|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x283 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9aa | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x74 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x74 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x74 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x74 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x74|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9aa | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9ab|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x287 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9ab | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x65 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x65 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x65 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x65 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x65 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x65 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x65 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x65|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x212 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9ab | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9ac|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x283 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9ac | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x73 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x73 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x73 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x73 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x73 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x73 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x73 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x73|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x212 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x203 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9ac | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9ad|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x287 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9ad | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x74 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x74 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x74 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x74 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x74|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9ad | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9ae|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x287 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9ae | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x5f | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x5f | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x5f | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x5f | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x5f | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x5f | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x5f | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x5f|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x202 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9ae | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9af|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x283 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9af | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x66 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x66 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x66 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x66 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x66 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x66 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x66 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x66|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9af | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b0|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x293 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b0 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x69 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x69 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x69 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x69 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x69 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x69 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x69 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x69|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x212 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b0 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b1|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x297 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b1 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x6c | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x6c | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x6c | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x6c | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x6c | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x6c | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x6c | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x6c|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b1 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b2|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x297 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b2 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x65 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x65 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x65 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x65 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x65 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x65 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x65 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x65|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x212 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b2 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b3|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x293 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b3 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x2e | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x2e | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x2e | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x2e | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x2e | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x2e | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x2e | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x2e|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x293 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b3 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b4|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x297 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b4 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x74 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x74 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x74 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x74 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x74|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b4 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b5|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x293 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b5 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x78 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x78 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x78 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x78 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x78 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x78 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x78 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x78|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b5 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b6|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x293 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b6 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x74 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x74 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x74 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x74 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x74 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x74|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x216 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b6 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b7|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x297 | |
| 0x76f74a50 kernelbase.dll:MultiByteToWideChar+0x5e0|mov al, byte ptr [esi]|esi=0x41e9b7 | |
| 0x76f74a52 kernelbase.dll:MultiByteToWideChar+0x5e2|mov byte ptr [ebp - 0xc9], al|ebp=0x19fd70|al=0x0 | |
| 0x76f74a58 kernelbase.dll:MultiByteToWideChar+0x5e8|movzx eax, al|al=0x0 | |
| 0x76f74a5b kernelbase.dll:MultiByteToWideChar+0x5eb|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x0 | |
| 0x76f74a5f kernelbase.dll:MultiByteToWideChar+0x5ef|mov edx, eax|eax=0x0 | |
| 0x76f74a61 kernelbase.dll:MultiByteToWideChar+0x5f1|mov word ptr [ebp - 0x10], ax|ebp=0x19fd70|ax=0x0 | |
| 0x76f74a65 kernelbase.dll:MultiByteToWideChar+0x5f5|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x0 | |
| 0x76f74a6b kernelbase.dll:MultiByteToWideChar+0x5fb|mov dword ptr [ebp - 0xc8], edx|ebp=0x19fd70|edx=0x0 | |
| 0x76f74a71 kernelbase.dll:MultiByteToWideChar+0x601|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74a77 kernelbase.dll:MultiByteToWideChar+0x607|cmp ax, word ptr [edi + 6]|ax=0x0|edi=0x5d0002 | |
| 0x76f74a7b kernelbase.dll:MultiByteToWideChar+0x60b|jne 0x76f74a8e|eflags=0x293 | |
| 0x76f74a8e kernelbase.dll:MultiByteToWideChar+0x61e|mov eax, 0xe000 | |
| 0x76f74a93 kernelbase.dll:MultiByteToWideChar+0x623|cmp word ptr [ebp - 0xc4], ax|ebp=0x19fd70|ax=0xe000 | |
| 0x76f74a9a kernelbase.dll:MultiByteToWideChar+0x62a|jb 0x76f74aae|eflags=0x207 | |
| 0x76f74aae kernelbase.dll:MultiByteToWideChar+0x63e|inc esi|esi=0x41e9b7 | |
| 0x76f74aaf kernelbase.dll:MultiByteToWideChar+0x63f|cmp esi, edx|esi=0x41e9b8|edx=0x41e9b8 | |
| 0x76f74ab1 kernelbase.dll:MultiByteToWideChar+0x641|jb 0x76f74a50|eflags=0x246 | |
| 0x76f74ab3 kernelbase.dll:MultiByteToWideChar+0x643|jmp 0x76f749fb | |
| 0x76f749fb kernelbase.dll:MultiByteToWideChar+0x58b|mov eax, ebx|ebx=0x10 | |
| 0x76f749fd kernelbase.dll:MultiByteToWideChar+0x58d|pop edi|edi=0x5d0002|esp=0x19fc70 | |
| 0x76f749fe kernelbase.dll:MultiByteToWideChar+0x58e|pop esi|esi=0x41e9b8|esp=0x19fc74 | |
| 0x76f749ff kernelbase.dll:MultiByteToWideChar+0x58f|pop ebx|ebx=0x10|esp=0x19fc78 | |
| 0x76f74a00 kernelbase.dll:MultiByteToWideChar+0x590|mov ecx, dword ptr [ebp - 4]|ebp=0x19fd70 | |
| 0x76f74a03 kernelbase.dll:MultiByteToWideChar+0x593|xor ecx, ebp|ecx=0x92c6a834|ebp=0x19fd70 | |
| 0x76f74a05 kernelbase.dll:MultiByteToWideChar+0x595|call 0x76fa8b52|esp=0x19fc7c|eip=0x76f74a05 | |
| 0x76fa8b52 kernelbase.dll:CreateIoCompletionPort+0x72|cmp ecx, dword ptr [0x77065bd0]|ecx=0x92df5544 | |
| 0x76fa8b58 kernelbase.dll:CreateIoCompletionPort+0x78|jne 0x76fa8b5d|eflags=0x246 | |
| 0x76fa8b5a kernelbase.dll:CreateIoCompletionPort+0x7a|ret 0|esp=0x19fc78 | |
| 0x76f74a0a kernelbase.dll:MultiByteToWideChar+0x59a|mov esp, ebp|ebp=0x19fd70 | |
| 0x76f74a0c kernelbase.dll:MultiByteToWideChar+0x59c|pop ebp|ebp=0x19fd70|esp=0x19fd70 | |
| 0x76f74a0d kernelbase.dll:MultiByteToWideChar+0x59d|ret 0x18|esp=0x19fd74 | |
| 0x40d65e handletest_x86.exe|pop ebp|ebp=0x19fd90|esp=0x19fd90 | |
| 0x40d65f handletest_x86.exe|ret|esp=0x19fd94 | |
| 0x40c3bd handletest_x86.exe|add esp, 0x18|esp=0x19fd98 | |
| 0x40c3c0 handletest_x86.exe|test eax, eax|eax=0x10 | |
| 0x40c3c2 handletest_x86.exe|jne 0x40c3da|eflags=0x202 | |
| 0x40c3da handletest_x86.exe|mov edi, dword ptr [ebp + 0xc]|ebp=0x19fdb8 | |
| 0x40c3dd handletest_x86.exe|cmp eax, dword ptr [edi + 0xc]|eax=0x10|edi=0x19fdec | |
| 0x40c3e0 handletest_x86.exe|jbe 0x40c3ee|eflags=0x202 | |
| 0x40c3e2 handletest_x86.exe|push eax|eax=0x10|esp=0x19fdb0 | |
| 0x40c3e3 handletest_x86.exe|mov ecx, edi|edi=0x19fdec | |
| 0x40c3e5 handletest_x86.exe|call 0x40cb0c|esp=0x19fdac|eip=0x40c3e5 | |
| 0x40cb0c handletest_x86.exe|mov edi, edi|edi=0x19fdec | |
| 0x40cb0e handletest_x86.exe|push ebp|ebp=0x19fdb8|esp=0x19fda8 | |
| 0x40cb0f handletest_x86.exe|mov ebp, esp|esp=0x19fda4 | |
| 0x40cb11 handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fda4 | |
| 0x40cb12 handletest_x86.exe|push edi|edi=0x19fdec|esp=0x19fda0 | |
| 0x40cb13 handletest_x86.exe|mov esi, ecx|ecx=0x19fdec | |
| 0x40cb15 handletest_x86.exe|call 0x40cab6|esp=0x19fd9c|eip=0x40cb15 | |
| 0x40cab6 handletest_x86.exe|mov edi, edi|edi=0x19fdec | |
| 0x40cab8 handletest_x86.exe|push esi|esi=0x19fdec|esp=0x19fd98 | |
| 0x40cab9 handletest_x86.exe|mov esi, ecx|ecx=0x19fdec | |
| 0x40cabb handletest_x86.exe|cmp byte ptr [esi + 0x14], 0|esi=0x19fdec | |
| 0x40cabf handletest_x86.exe|je 0x40cace|eflags=0x246 | |
| 0x40cace handletest_x86.exe|pop esi|esi=0x19fdec|esp=0x19fd94 | |
| 0x40cacf handletest_x86.exe|ret|esp=0x19fd98 | |
| 0x40cb1a handletest_x86.exe|mov edi, dword ptr [ebp + 8]|ebp=0x19fda4 | |
| 0x40cb1d handletest_x86.exe|push esi|esi=0x19fdec|esp=0x19fd9c | |
| 0x40cb1e handletest_x86.exe|lea eax, [edi + edi]|edi=0x10 | |
| 0x40cb21 handletest_x86.exe|push eax|eax=0x20|esp=0x19fd98 | |
| 0x40cb22 handletest_x86.exe|lea eax, [esi + 8]|esi=0x19fdec | |
| 0x40cb25 handletest_x86.exe|push eax|eax=0x19fdf4|esp=0x19fd94 | |
| 0x40cb26 handletest_x86.exe|call 0x40cb4b|esp=0x19fd90|eip=0x40cb26 | |
| 0x40cb4b handletest_x86.exe|mov edi, edi|edi=0x10 | |
| 0x40cb4d handletest_x86.exe|push ebp|ebp=0x19fda4|esp=0x19fd8c | |
| 0x40cb4e handletest_x86.exe|mov ebp, esp|esp=0x19fd88 | |
| 0x40cb50 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fd88|esp=0x19fd88 | |
| 0x40cb53 handletest_x86.exe|call 0x40ae84|esp=0x19fd84|eip=0x40cb53 | |
| 0x40ae84 handletest_x86.exe|mov edi, edi|edi=0x10 | |
| 0x40ae86 handletest_x86.exe|push ebp|ebp=0x19fd88|esp=0x19fd80 | |
| 0x40ae87 handletest_x86.exe|mov ebp, esp|esp=0x19fd7c | |
| 0x40ae89 handletest_x86.exe|push esi|esi=0x19fdec|esp=0x19fd7c | |
| 0x40ae8a handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19fd7c | |
| 0x40ae8d handletest_x86.exe|cmp esi, -0x20|esi=0x20 | |
| 0x40ae90 handletest_x86.exe|ja 0x40aec2|eflags=0x203 | |
| 0x40ae92 handletest_x86.exe|test esi, esi|esi=0x20 | |
| 0x40ae94 handletest_x86.exe|jne 0x40aead|eflags=0x202 | |
| 0x40aead handletest_x86.exe|push esi|esi=0x20|esp=0x19fd78 | |
| 0x40aeae handletest_x86.exe|push 0|esp=0x19fd74 | |
| 0x40aeb0 handletest_x86.exe|push dword ptr [0x41f410]|esp=0x19fd70 | |
| 0x40aeb6 handletest_x86.exe|call dword ptr [0x4170a4]|esp=0x19fd6c | |
| 0x77174cf0 ntdll.dll:RtlAllocateHeap|mov edi, edi|edi=0x10 | |
| 0x77174cf2 ntdll.dll:RtlAllocateHeap+0x2|push ebp|ebp=0x19fd7c|esp=0x19fd68 | |
| 0x77174cf3 ntdll.dll:RtlAllocateHeap+0x3|mov ebp, esp|esp=0x19fd64 | |
| 0x77174cf5 ntdll.dll:RtlAllocateHeap+0x5|and esp, 0xfffffff8|esp=0x19fd64 | |
| 0x77174cf8 ntdll.dll:RtlAllocateHeap+0x8|push ecx|ecx=0x19fdec|esp=0x19fd60 | |
| 0x77174cf9 ntdll.dll:RtlAllocateHeap+0x9|push esi|esi=0x20|esp=0x19fd5c | |
| 0x77174cfa ntdll.dll:RtlAllocateHeap+0xa|mov esi, dword ptr [ebp + 8]|ebp=0x19fd64 | |
| 0x77174cfd ntdll.dll:RtlAllocateHeap+0xd|test esi, esi|esi=0x820000 | |
| 0x77174cff ntdll.dll:RtlAllocateHeap+0xf|je 0x771d332b|eflags=0x206 | |
| 0x77174d05 ntdll.dll:RtlAllocateHeap+0x15|cmp dword ptr [esi + 8], 0xddeeddee|esi=0x820000 | |
| 0x77174d0c ntdll.dll:RtlAllocateHeap+0x1c|mov ecx, esi|esi=0x820000 | |
| 0x77174d0e ntdll.dll:RtlAllocateHeap+0x1e|mov edx, dword ptr [ebp + 0x10]|ebp=0x19fd64 | |
| 0x77174d11 ntdll.dll:RtlAllocateHeap+0x21|je 0x771d3342|eflags=0x206 | |
| 0x77174d17 ntdll.dll:RtlAllocateHeap+0x27|test byte ptr [0x77259164], 2 | |
| 0x77174d1e ntdll.dll:RtlAllocateHeap+0x2e|jne 0x771d334f|eflags=0x246 | |
| 0x77174d24 ntdll.dll:RtlAllocateHeap+0x34|push 0|esp=0x19fd58 | |
| 0x77174d26 ntdll.dll:RtlAllocateHeap+0x36|push dword ptr [ebp + 0xc]|ebp=0x19fd64|esp=0x19fd54 | |
| 0x77174d29 ntdll.dll:RtlAllocateHeap+0x39|call 0x77174d40|esp=0x19fd50|eip=0x77174d29 | |
| 0x77174d40 ntdll.dll:RtlAllocateHeap+0x50|mov edi, edi|edi=0x10 | |
| 0x77174d42 ntdll.dll:RtlAllocateHeap+0x52|push ebp|ebp=0x19fd64|esp=0x19fd4c | |
| 0x77174d43 ntdll.dll:RtlAllocateHeap+0x53|mov ebp, esp|esp=0x19fd48 | |
| 0x77174d45 ntdll.dll:RtlAllocateHeap+0x55|sub esp, 0x6c|esp=0x19fd48 | |
| 0x77174d48 ntdll.dll:RtlAllocateHeap+0x58|push ebx|ebx=0x2a3000|esp=0x19fcdc | |
| 0x77174d49 ntdll.dll:RtlAllocateHeap+0x59|mov ebx, ecx|ecx=0x820000 | |
| 0x77174d4b ntdll.dll:RtlAllocateHeap+0x5b|mov ecx, dword ptr [ebp + 8]|ebp=0x19fd48 | |
| 0x77174d4e ntdll.dll:RtlAllocateHeap+0x5e|push esi|esi=0x820000|esp=0x19fcd8 | |
| 0x77174d4f ntdll.dll:RtlAllocateHeap+0x5f|push edi|edi=0x10|esp=0x19fcd4 | |
| 0x77174d50 ntdll.dll:RtlAllocateHeap+0x60|mov edi, edx|edx=0x20 | |
| 0x77174d52 ntdll.dll:RtlAllocateHeap+0x62|mov dword ptr [ebp - 0xc], ebx|ebp=0x19fd48|ebx=0x820000 | |
| 0x77174d55 ntdll.dll:RtlAllocateHeap+0x65|cmp dword ptr [ebx + 8], 0xddeeddee|ebx=0x820000 | |
| 0x77174d5c ntdll.dll:RtlAllocateHeap+0x6c|mov dword ptr [ebp - 0x14], edi|ebp=0x19fd48|edi=0x20 | |
| 0x77174d5f ntdll.dll:RtlAllocateHeap+0x6f|jne 0x77174e49|eflags=0x206 | |
| 0x77174e49 ntdll.dll:RtlAllocateHeap+0x159|mov eax, dword ptr [ebx + 0x44]|ebx=0x820000 | |
| 0x77174e4c ntdll.dll:RtlAllocateHeap+0x15c|or ecx, eax|ecx=0x0|eax=0x0 | |
| 0x77174e4e ntdll.dll:RtlAllocateHeap+0x15e|mov dword ptr [ebp - 0x2c], 0|ebp=0x19fd48 | |
| 0x77174e55 ntdll.dll:RtlAllocateHeap+0x165|mov dword ptr [ebp - 0x10], ecx|ebp=0x19fd48|ecx=0x0 | |
| 0x77174e58 ntdll.dll:RtlAllocateHeap+0x168|mov dword ptr [ebp - 0x30], 0|ebp=0x19fd48 | |
| 0x77174e5f ntdll.dll:RtlAllocateHeap+0x16f|mov dword ptr [ebp - 0x38], 0|ebp=0x19fd48 | |
| 0x77174e66 ntdll.dll:RtlAllocateHeap+0x176|cmp edi, 0x7fffffff|edi=0x20 | |
| 0x77174e6c ntdll.dll:RtlAllocateHeap+0x17c|jbe 0x77174e7a|eflags=0x297 | |
| 0x77174e7a ntdll.dll:RtlAllocateHeap+0x18a|and eax, 0x1000000|eax=0x0 | |
| 0x77174e7f ntdll.dll:RtlAllocateHeap+0x18f|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e81 ntdll.dll:RtlAllocateHeap+0x191|cmp dword ptr [0x772561f4], eax|eax=0x0 | |
| 0x77174e87 ntdll.dll:RtlAllocateHeap+0x197|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e89 ntdll.dll:RtlAllocateHeap+0x199|mov edx, dword ptr [ebx + 0xdc]|ebx=0x820000 | |
| 0x77174e8f ntdll.dll:RtlAllocateHeap+0x19f|mov ecx, edx|edx=0x0 | |
| 0x77174e91 ntdll.dll:RtlAllocateHeap+0x1a1|test ecx, ecx|ecx=0x0 | |
| 0x77174e93 ntdll.dll:RtlAllocateHeap+0x1a3|jne 0x77174e9f|eflags=0x246 | |
| 0x77174e95 ntdll.dll:RtlAllocateHeap+0x1a5|mov ecx, dword ptr [0x77259114] | |
| 0x77174e9b ntdll.dll:RtlAllocateHeap+0x1ab|test ecx, ecx|ecx=0x0 | |
| 0x77174e9d ntdll.dll:RtlAllocateHeap+0x1ad|je 0x77174eca|eflags=0x246 | |
| 0x77174eca ntdll.dll:RtlAllocateHeap+0x1da|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fd48 | |
| 0x77174ecd ntdll.dll:RtlAllocateHeap+0x1dd|mov esi, dword ptr [ebx + 0x58]|ebx=0x820000 | |
| 0x77174ed0 ntdll.dll:RtlAllocateHeap+0x1e0|mov dword ptr [ebp - 0x48], esi|ebp=0x19fd48|esi=0x0 | |
| 0x77174ed3 ntdll.dll:RtlAllocateHeap+0x1e3|test esi, esi|esi=0x0 | |
| 0x77174ed5 ntdll.dll:RtlAllocateHeap+0x1e5|je 0x77174f1c|eflags=0x246 | |
| 0x77174f1c ntdll.dll:RtlAllocateHeap+0x22c|mov eax, edi|edi=0x20 | |
| 0x77174f1e ntdll.dll:RtlAllocateHeap+0x22e|test edi, edi|edi=0x20 | |
| 0x77174f20 ntdll.dll:RtlAllocateHeap+0x230|jne 0x77174f27|eflags=0x202 | |
| 0x77174f27 ntdll.dll:RtlAllocateHeap+0x237|lea esi, [eax + 0xf]|eax=0x20 | |
| 0x77174f2a ntdll.dll:RtlAllocateHeap+0x23a|and esi, 0xfffffff8|esi=0x2f | |
| 0x77174f2d ntdll.dll:RtlAllocateHeap+0x23d|mov edx, esi|esi=0x28 | |
| 0x77174f2f ntdll.dll:RtlAllocateHeap+0x23f|mov dword ptr [ebp - 0x2c], esi|ebp=0x19fd48|esi=0x28 | |
| 0x77174f32 ntdll.dll:RtlAllocateHeap+0x242|shr edx, 3|edx=0x28 | |
| 0x77174f35 ntdll.dll:RtlAllocateHeap+0x245|test dword ptr [ebp - 0x10], 0x7d810f61|ebp=0x19fd48 | |
| 0x77174f3c ntdll.dll:RtlAllocateHeap+0x24c|mov dword ptr [ebp - 0x20], edx|ebp=0x19fd48|edx=0x5 | |
| 0x77174f3f ntdll.dll:RtlAllocateHeap+0x24f|jne 0x77175cf9|eflags=0x246 | |
| 0x77174f45 ntdll.dll:RtlAllocateHeap+0x255|cmp edi, dword ptr [0x77256ccc]|edi=0x20 | |
| 0x77174f4b ntdll.dll:RtlAllocateHeap+0x25b|ja 0x77175946|eflags=0x283 | |
| 0x77174f51 ntdll.dll:RtlAllocateHeap+0x261|mov eax, edx|edx=0x5 | |
| 0x77174f53 ntdll.dll:RtlAllocateHeap+0x263|shr eax, 3|eax=0x5 | |
| 0x77174f56 ntdll.dll:RtlAllocateHeap+0x266|mov dl, byte ptr [eax + ebx + 0xf2]|eax=0x0|ebx=0x820000 | |
| 0x77174f5d ntdll.dll:RtlAllocateHeap+0x26d|mov eax, dword ptr [ebp - 0x20]|ebp=0x19fd48 | |
| 0x77174f60 ntdll.dll:RtlAllocateHeap+0x270|movzx ecx, al|al=0x5 | |
| 0x77174f63 ntdll.dll:RtlAllocateHeap+0x273|mov eax, 1 | |
| 0x77174f68 ntdll.dll:RtlAllocateHeap+0x278|and ecx, 7|ecx=0x5 | |
| 0x77174f6b ntdll.dll:RtlAllocateHeap+0x27b|shl eax, cl|eax=0x1|cl=0x5 | |
| 0x77174f6d ntdll.dll:RtlAllocateHeap+0x27d|test dl, al|dl=0x10|al=0x20 | |
| 0x77174f6f ntdll.dll:RtlAllocateHeap+0x27f|je 0x77175943|eflags=0x246 | |
| 0x77175943 ntdll.dll:RtlAllocateHeap+0xc53|mov edx, dword ptr [ebp - 0x20]|ebp=0x19fd48 | |
| 0x77175946 ntdll.dll:RtlAllocateHeap+0xc56|mov eax, dword ptr [ebx + 0xb4]|ebx=0x820000 | |
| 0x7717594c ntdll.dll:RtlAllocateHeap+0xc5c|cmp edx, dword ptr [eax + 4]|edx=0x5|eax=0x820270 | |
| 0x7717594f ntdll.dll:RtlAllocateHeap+0xc5f|jb 0x77175962|eflags=0x283 | |
| 0x77175962 ntdll.dll:RtlAllocateHeap+0xc72|mov ecx, edx|edx=0x5 | |
| 0x77175964 ntdll.dll:RtlAllocateHeap+0xc74|cmp ecx, dword ptr [eax + 4]|ecx=0x5|eax=0x820270 | |
| 0x77175967 ntdll.dll:RtlAllocateHeap+0xc77|jae 0x77175cf9|eflags=0x283 | |
| 0x7717596d ntdll.dll:RtlAllocateHeap+0xc7d|cmp edx, ecx|edx=0x5|ecx=0x5 | |
| 0x7717596f ntdll.dll:RtlAllocateHeap+0xc7f|jne 0x77175cf9|eflags=0x246 | |
| 0x77175975 ntdll.dll:RtlAllocateHeap+0xc85|sub edx, dword ptr [eax + 0x14]|edx=0x5|eax=0x820270 | |
| 0x77175978 ntdll.dll:RtlAllocateHeap+0xc88|cmp dword ptr [eax + 8], 0|eax=0x820270 | |
| 0x7717597c ntdll.dll:RtlAllocateHeap+0xc8c|je 0x77175980|eflags=0x246 | |
| 0x77175980 ntdll.dll:RtlAllocateHeap+0xc90|mov eax, dword ptr [eax + 0x20]|eax=0x820270 | |
| 0x77175983 ntdll.dll:RtlAllocateHeap+0xc93|lea eax, [eax + edx*4]|eax=0x8202a4|edx=0x5 | |
| 0x77175986 ntdll.dll:RtlAllocateHeap+0xc96|jmp 0x77175cfb | |
| 0x77175cfb ntdll.dll:RtlAllocateHeap+0x100b|mov edx, dword ptr [ebp - 0x10]|ebp=0x19fd48 | |
| 0x77175cfe ntdll.dll:RtlAllocateHeap+0x100e|lea ecx, [ebp - 0x30]|ebp=0x19fd48 | |
| 0x77175d01 ntdll.dll:RtlAllocateHeap+0x1011|push ecx|ecx=0x19fd18|esp=0x19fcd0 | |
| 0x77175d02 ntdll.dll:RtlAllocateHeap+0x1012|push eax|eax=0x8202b8|esp=0x19fccc | |
| 0x77175d03 ntdll.dll:RtlAllocateHeap+0x1013|push esi|esi=0x28|esp=0x19fcc8 | |
| 0x77175d04 ntdll.dll:RtlAllocateHeap+0x1014|push edi|edi=0x20|esp=0x19fcc4 | |
| 0x77175d05 ntdll.dll:RtlAllocateHeap+0x1015|or edx, 2|edx=0x0 | |
| 0x77175d08 ntdll.dll:RtlAllocateHeap+0x1018|mov ecx, ebx|ebx=0x820000 | |
| 0x77175d0a ntdll.dll:RtlAllocateHeap+0x101a|call 0x77175ec0|esp=0x19fcc0|eip=0x77175d0a | |
| 0x77175ec0 ntdll.dll:RtlAllocateHeap+0x11d0|mov edi, edi|edi=0x20 | |
| 0x77175ec2 ntdll.dll:RtlAllocateHeap+0x11d2|push ebp|ebp=0x19fd48|esp=0x19fcbc | |
| 0x77175ec3 ntdll.dll:RtlAllocateHeap+0x11d3|mov ebp, esp|esp=0x19fcb8 | |
| 0x77175ec5 ntdll.dll:RtlAllocateHeap+0x11d5|push -2|esp=0x19fcb8 | |
| 0x77175ec7 ntdll.dll:RtlAllocateHeap+0x11d7|push 0x7723ec48|esp=0x19fcb4 | |
| 0x77175ecc ntdll.dll:RtlAllocateHeap+0x11dc|push 0x771ad210|esp=0x19fcb0 | |
| 0x77175ed1 ntdll.dll:RtlAllocateHeap+0x11e1|mov eax, dword ptr fs:[0] | |
| 0x77175ed7 ntdll.dll:RtlAllocateHeap+0x11e7|push eax|eax=0x19fe48|esp=0x19fcac | |
| 0x77175ed8 ntdll.dll:RtlAllocateHeap+0x11e8|sub esp, 0x160|esp=0x19fca8 | |
| 0x77175ede ntdll.dll:RtlAllocateHeap+0x11ee|push ebx|ebx=0x820000|esp=0x19fb48 | |
| 0x77175edf ntdll.dll:RtlAllocateHeap+0x11ef|push esi|esi=0x28|esp=0x19fb44 | |
| 0x77175ee0 ntdll.dll:RtlAllocateHeap+0x11f0|push edi|edi=0x20|esp=0x19fb40 | |
| 0x77175ee1 ntdll.dll:RtlAllocateHeap+0x11f1|mov eax, dword ptr [0x7725e360] | |
| 0x77175ee6 ntdll.dll:RtlAllocateHeap+0x11f6|xor dword ptr [ebp - 8], eax|ebp=0x19fcb8|eax=0xf9e0af5e | |
| 0x77175ee9 ntdll.dll:RtlAllocateHeap+0x11f9|xor eax, ebp|eax=0xf9e0af5e|ebp=0x19fcb8 | |
| 0x77175eeb ntdll.dll:RtlAllocateHeap+0x11fb|push eax|eax=0xf9f953e6|esp=0x19fb3c | |
| 0x77175eec ntdll.dll:RtlAllocateHeap+0x11fc|lea eax, [ebp - 0x10]|ebp=0x19fcb8 | |
| 0x77175eef ntdll.dll:RtlAllocateHeap+0x11ff|mov dword ptr fs:[0], eax|eax=0x19fca8 | |
| 0x77175ef5 ntdll.dll:RtlAllocateHeap+0x1205|mov ebx, edx|edx=0x2 | |
| 0x77175ef7 ntdll.dll:RtlAllocateHeap+0x1207|mov dword ptr [ebp - 0x68], ebx|ebp=0x19fcb8|ebx=0x2 | |
| 0x77175efa ntdll.dll:RtlAllocateHeap+0x120a|mov edi, ecx|ecx=0x820000 | |
| 0x77175efc ntdll.dll:RtlAllocateHeap+0x120c|mov dword ptr [ebp - 0xd8], edi|ebp=0x19fcb8|edi=0x820000 | |
| 0x77175f02 ntdll.dll:RtlAllocateHeap+0x1212|mov dword ptr [ebp - 0xb0], 0|ebp=0x19fcb8 | |
| 0x77175f0c ntdll.dll:RtlAllocateHeap+0x121c|mov dword ptr [ebp - 0x64], 1|ebp=0x19fcb8 | |
| 0x77175f13 ntdll.dll:RtlAllocateHeap+0x1223|mov byte ptr [ebp - 0x29], 0|ebp=0x19fcb8 | |
| 0x77175f17 ntdll.dll:RtlAllocateHeap+0x1227|mov dword ptr [ebp - 0x5c], 0|ebp=0x19fcb8 | |
| 0x77175f1e ntdll.dll:RtlAllocateHeap+0x122e|mov dword ptr [ebp - 0x50], 0|ebp=0x19fcb8 | |
| 0x77175f25 ntdll.dll:RtlAllocateHeap+0x1235|mov dword ptr [ebp - 0x9c], 0|ebp=0x19fcb8 | |
| 0x77175f2f ntdll.dll:RtlAllocateHeap+0x123f|mov esi, dword ptr [ebp + 0xc]|ebp=0x19fcb8 | |
| 0x77175f32 ntdll.dll:RtlAllocateHeap+0x1242|shr esi, 3|esi=0x28 | |
| 0x77175f35 ntdll.dll:RtlAllocateHeap+0x1245|test ebx, 0x7d010f60|ebx=0x2 | |
| 0x77175f3b ntdll.dll:RtlAllocateHeap+0x124b|jne 0x77175f6f|eflags=0x246 | |
| 0x77175f3d ntdll.dll:RtlAllocateHeap+0x124d|cmp dword ptr [ebp + 8], 0x80000000|ebp=0x19fcb8 | |
| 0x77175f44 ntdll.dll:RtlAllocateHeap+0x1254|jae 0x77175f6f|eflags=0xa83 | |
| 0x77175f46 ntdll.dll:RtlAllocateHeap+0x1256|mov cl, 1 | |
| 0x77175f48 ntdll.dll:RtlAllocateHeap+0x1258|mov dword ptr [ebp - 0x34], ecx|ebp=0x19fcb8|ecx=0x820001 | |
| 0x77175f4b ntdll.dll:RtlAllocateHeap+0x125b|mov edx, esi|esi=0x5 | |
| 0x77175f4d ntdll.dll:RtlAllocateHeap+0x125d|mov dword ptr [ebp - 0x30], edx|ebp=0x19fcb8|edx=0x5 | |
| 0x77175f50 ntdll.dll:RtlAllocateHeap+0x1260|cmp edx, 2|edx=0x5 | |
| 0x77175f53 ntdll.dll:RtlAllocateHeap+0x1263|jae 0x77175f61|eflags=0x206 | |
| 0x77175f61 ntdll.dll:RtlAllocateHeap+0x1271|mov eax, dword ptr [ebp + 0x14]|ebp=0x19fcb8 | |
| 0x77175f64 ntdll.dll:RtlAllocateHeap+0x1274|mov dword ptr [eax], 3|eax=0x19fd18 | |
| 0x77175f6a ntdll.dll:RtlAllocateHeap+0x127a|jmp 0x7717601c | |
| 0x7717601c ntdll.dll:RtlAllocateHeap+0x132c|and ebx, 0x800000|ebx=0x2 | |
| 0x77176022 ntdll.dll:RtlAllocateHeap+0x1332|je 0x77176039|eflags=0x246 | |
| 0x77176039 ntdll.dll:RtlAllocateHeap+0x1349|mov dword ptr [ebp - 4], 0|ebp=0x19fcb8 | |
| 0x77176040 ntdll.dll:RtlAllocateHeap+0x1350|test byte ptr [ebp - 0x68], 1|ebp=0x19fcb8 | |
| 0x77176044 ntdll.dll:RtlAllocateHeap+0x1354|jne 0x771760d7|eflags=0x246 | |
| 0x7717604a ntdll.dll:RtlAllocateHeap+0x135a|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19fb38 | |
| 0x77176050 ntdll.dll:RtlAllocateHeap+0x1360|call 0x77193f20|esp=0x19fb34|eip=0x77176050 | |
| 0x77193f20 ntdll.dll:RtlTryEnterCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77193f22 ntdll.dll:RtlTryEnterCriticalSection+0x2|push ebp|ebp=0x19fcb8|esp=0x19fb30 | |
| 0x77193f23 ntdll.dll:RtlTryEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fb2c | |
| 0x77193f25 ntdll.dll:RtlTryEnterCriticalSection+0x5|mov eax, dword ptr [ebp + 8]|ebp=0x19fb2c | |
| 0x77193f28 ntdll.dll:RtlTryEnterCriticalSection+0x8|mov edx, dword ptr fs:[0x18] | |
| 0x77193f2f ntdll.dll:RtlTryEnterCriticalSection+0xf|lea ecx, [eax + 4]|eax=0x820258 | |
| 0x77193f32 ntdll.dll:RtlTryEnterCriticalSection+0x12|lock btr dword ptr [ecx], 0|ecx=0x82025c | |
| 0x77193f37 ntdll.dll:RtlTryEnterCriticalSection+0x17|jae 0x77193f4f|eflags=0x247 | |
| 0x77193f39 ntdll.dll:RtlTryEnterCriticalSection+0x19|mov ecx, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x77193f3c ntdll.dll:RtlTryEnterCriticalSection+0x1c|mov dword ptr [eax + 0xc], ecx|eax=0x820258|ecx=0x1fc0 | |
| 0x77193f3f ntdll.dll:RtlTryEnterCriticalSection+0x1f|mov dword ptr [eax + 8], 1|eax=0x820258 | |
| 0x77193f46 ntdll.dll:RtlTryEnterCriticalSection+0x26|mov eax, 1 | |
| 0x77193f4b ntdll.dll:RtlTryEnterCriticalSection+0x2b|pop ebp|ebp=0x19fb2c|esp=0x19fb2c | |
| 0x77193f4c ntdll.dll:RtlTryEnterCriticalSection+0x2c|ret 4|esp=0x19fb30 | |
| 0x77176055 ntdll.dll:RtlAllocateHeap+0x1365|test eax, eax|eax=0x1 | |
| 0x77176057 ntdll.dll:RtlAllocateHeap+0x1367|jne 0x771760b6|eflags=0x202 | |
| 0x771760b6 ntdll.dll:RtlAllocateHeap+0x13c6|inc dword ptr [edi + 0x214]|edi=0x820000 | |
| 0x771760bc ntdll.dll:RtlAllocateHeap+0x13cc|mov byte ptr [ebp - 0x7d], 1|ebp=0x19fcb8 | |
| 0x771760c0 ntdll.dll:RtlAllocateHeap+0x13d0|mov byte ptr [ebp - 0x29], 1|ebp=0x19fcb8 | |
| 0x771760c4 ntdll.dll:RtlAllocateHeap+0x13d4|test dword ptr [edi + 0x48], 0x30000000|edi=0x820000 | |
| 0x771760cb ntdll.dll:RtlAllocateHeap+0x13db|je 0x771760d4|eflags=0x246 | |
| 0x771760d4 ntdll.dll:RtlAllocateHeap+0x13e4|mov edx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x771760d7 ntdll.dll:RtlAllocateHeap+0x13e7|cmp edx, dword ptr [edi + 0x5c]|edx=0x5|edi=0x820000 | |
| 0x771760da ntdll.dll:RtlAllocateHeap+0x13ea|ja 0x77177819|eflags=0x287 | |
| 0x771760e0 ntdll.dll:RtlAllocateHeap+0x13f0|test ebx, ebx|ebx=0x0 | |
| 0x771760e2 ntdll.dll:RtlAllocateHeap+0x13f2|jne 0x77176211|eflags=0x246 | |
| 0x771760e8 ntdll.dll:RtlAllocateHeap+0x13f8|movzx eax, word ptr [edi + 0xf0]|edi=0x820000 | |
| 0x771760ef ntdll.dll:RtlAllocateHeap+0x13ff|cmp esi, eax|esi=0x5|eax=0x802 | |
| 0x771760f1 ntdll.dll:RtlAllocateHeap+0x1401|mov eax, dword ptr [ebp + 8]|ebp=0x19fcb8 | |
| 0x771760f4 ntdll.dll:RtlAllocateHeap+0x1404|jb 0x77176130|eflags=0x287 | |
| 0x77176130 ntdll.dll:RtlAllocateHeap+0x1440|cmp eax, dword ptr [0x77256ccc]|eax=0x20 | |
| 0x77176136 ntdll.dll:RtlAllocateHeap+0x1446|ja 0x77176211|eflags=0x283 | |
| 0x7717613c ntdll.dll:RtlAllocateHeap+0x144c|mov eax, esi|esi=0x5 | |
| 0x7717613e ntdll.dll:RtlAllocateHeap+0x144e|shr eax, 3|eax=0x5 | |
| 0x77176141 ntdll.dll:RtlAllocateHeap+0x1451|add eax, 0xf2|eax=0x0 | |
| 0x77176146 ntdll.dll:RtlAllocateHeap+0x1456|add eax, edi|eax=0xf2|edi=0x820000 | |
| 0x77176148 ntdll.dll:RtlAllocateHeap+0x1458|mov dword ptr [ebp - 0x54], eax|ebp=0x19fcb8|eax=0x8200f2 | |
| 0x7717614b ntdll.dll:RtlAllocateHeap+0x145b|mov dl, byte ptr [eax]|eax=0x8200f2 | |
| 0x7717614d ntdll.dll:RtlAllocateHeap+0x145d|mov ebx, esi|esi=0x5 | |
| 0x7717614f ntdll.dll:RtlAllocateHeap+0x145f|and ebx, 7|ebx=0x5 | |
| 0x77176152 ntdll.dll:RtlAllocateHeap+0x1462|mov eax, 1 | |
| 0x77176157 ntdll.dll:RtlAllocateHeap+0x1467|mov ecx, ebx|ebx=0x5 | |
| 0x77176159 ntdll.dll:RtlAllocateHeap+0x1469|shl eax, cl|eax=0x1|cl=0x5 | |
| 0x7717615b ntdll.dll:RtlAllocateHeap+0x146b|test dl, al|dl=0x10|al=0x20 | |
| 0x7717615d ntdll.dll:RtlAllocateHeap+0x146d|jne 0x7717620e|eflags=0x246 | |
| 0x77176163 ntdll.dll:RtlAllocateHeap+0x1473|mov eax, dword ptr [edi + 0xec]|edi=0x820000 | |
| 0x77176169 ntdll.dll:RtlAllocateHeap+0x1479|lea esi, [eax + esi*2]|eax=0x821af0|esi=0x5 | |
| 0x7717616c ntdll.dll:RtlAllocateHeap+0x147c|mov dword ptr [ebp - 0xe0], esi|ebp=0x19fcb8|esi=0x821afa | |
| 0x77176172 ntdll.dll:RtlAllocateHeap+0x1482|add word ptr [esi], 0x21|esi=0x821afa | |
| 0x77176176 ntdll.dll:RtlAllocateHeap+0x1486|mov cx, word ptr [esi]|esi=0x821afa | |
| 0x77176179 ntdll.dll:RtlAllocateHeap+0x1489|cmp dword ptr [ebp - 0x9c], 0|ebp=0x19fcb8 | |
| 0x77176180 ntdll.dll:RtlAllocateHeap+0x1490|jne 0x771761aa|eflags=0x246 | |
| 0x77176182 ntdll.dll:RtlAllocateHeap+0x1492|mov al, cl|cl=0xef | |
| 0x77176184 ntdll.dll:RtlAllocateHeap+0x1494|and al, 0x1f|al=0xef | |
| 0x77176186 ntdll.dll:RtlAllocateHeap+0x1496|cmp al, 0x10|al=0xf | |
| 0x77176188 ntdll.dll:RtlAllocateHeap+0x1498|ja 0x771761a0|eflags=0x287 | |
| 0x7717618a ntdll.dll:RtlAllocateHeap+0x149a|mov eax, 0xff00 | |
| 0x7717618f ntdll.dll:RtlAllocateHeap+0x149f|cmp cx, ax|cx=0x1ef|ax=0xff00 | |
| 0x77176192 ntdll.dll:RtlAllocateHeap+0x14a2|ja 0x771761a0|eflags=0x203 | |
| 0x77176194 ntdll.dll:RtlAllocateHeap+0x14a4|mov dword ptr [ebp - 0xb4], 0|ebp=0x19fcb8 | |
| 0x7717619e ntdll.dll:RtlAllocateHeap+0x14ae|jmp 0x7717620e | |
| 0x7717620e ntdll.dll:RtlAllocateHeap+0x151e|mov edx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x77176211 ntdll.dll:RtlAllocateHeap+0x1521|mov esi, dword ptr [ebp + 0x10]|ebp=0x19fcb8 | |
| 0x77176214 ntdll.dll:RtlAllocateHeap+0x1524|test esi, esi|esi=0x8202b8 | |
| 0x77176216 ntdll.dll:RtlAllocateHeap+0x1526|je 0x7717646b|eflags=0x206 | |
| 0x7717621c ntdll.dll:RtlAllocateHeap+0x152c|mov esi, dword ptr [esi]|esi=0x8202b8 | |
| 0x7717621e ntdll.dll:RtlAllocateHeap+0x152e|test esi, esi|esi=0x0 | |
| 0x77176220 ntdll.dll:RtlAllocateHeap+0x1530|je 0x7717646b|eflags=0x246 | |
| 0x7717646b ntdll.dll:RtlAllocateHeap+0x177b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176471 ntdll.dll:RtlAllocateHeap+0x1781|mov dword ptr [ebp - 0xc0], eax|ebp=0x19fcb8|eax=0x8200c0 | |
| 0x77176477 ntdll.dll:RtlAllocateHeap+0x1787|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717647d ntdll.dll:RtlAllocateHeap+0x178d|mov dword ptr [ebp - 0x28], esi|ebp=0x19fcb8|esi=0x820270 | |
| 0x77176480 ntdll.dll:RtlAllocateHeap+0x1790|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176483 ntdll.dll:RtlAllocateHeap+0x1793|cmp edx, ecx|edx=0x5|ecx=0x80 | |
| 0x77176485 ntdll.dll:RtlAllocateHeap+0x1795|jae 0x7717648b|eflags=0x283 | |
| 0x77176487 ntdll.dll:RtlAllocateHeap+0x1797|mov eax, edx|edx=0x5 | |
| 0x77176489 ntdll.dll:RtlAllocateHeap+0x1799|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fcb8|eax=0x5 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x5|esi=0x820270 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19fcb8|eax=0x5 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19fcb8 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x820270 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19fcb8|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82b440 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x283 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82b440 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x82b438 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82b438 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fcb8|ebx=0x521acb7f | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x521acb7f|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fcb8|ebx=0x76000375 | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x76000375 | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x76000375 | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x76000375 | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x76000375 | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x3 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x3|bl=0x75 | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x76000375 | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x76000375 | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x76|cl=0x76 | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x375 | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x5|eax=0x375 | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19fcb8|ecx=0xfffffc90 | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0xfffffc90 | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x286 | |
| 0x77176526 ntdll.dll:RtlAllocateHeap+0x1836|mov eax, dword ptr [edx]|edx=0x8200c0 | |
| 0x77176528 ntdll.dll:RtlAllocateHeap+0x1838|add eax, -8|eax=0x8266e8 | |
| 0x7717652b ntdll.dll:RtlAllocateHeap+0x183b|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x8266e0 | |
| 0x7717652e ntdll.dll:RtlAllocateHeap+0x183e|mov ebx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176530 ntdll.dll:RtlAllocateHeap+0x1840|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fcb8|ebx=0x261ac808 | |
| 0x77176536 ntdll.dll:RtlAllocateHeap+0x1846|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717653a ntdll.dll:RtlAllocateHeap+0x184a|je 0x77176574|eflags=0x206 | |
| 0x7717653c ntdll.dll:RtlAllocateHeap+0x184c|xor ebx, dword ptr [edi + 0x50]|ebx=0x261ac808|edi=0x820000 | |
| 0x7717653f ntdll.dll:RtlAllocateHeap+0x184f|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fcb8|ebx=0x2000002 | |
| 0x77176545 ntdll.dll:RtlAllocateHeap+0x1855|mov ecx, ebx|ebx=0x2000002 | |
| 0x77176547 ntdll.dll:RtlAllocateHeap+0x1857|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717654a ntdll.dll:RtlAllocateHeap+0x185a|mov eax, ebx|ebx=0x2000002 | |
| 0x7717654c ntdll.dll:RtlAllocateHeap+0x185c|shr eax, 8|eax=0x2000002 | |
| 0x7717654f ntdll.dll:RtlAllocateHeap+0x185f|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176551 ntdll.dll:RtlAllocateHeap+0x1861|xor cl, bl|cl=0x0|bl=0x2 | |
| 0x77176553 ntdll.dll:RtlAllocateHeap+0x1863|mov eax, ebx|ebx=0x2000002 | |
| 0x77176555 ntdll.dll:RtlAllocateHeap+0x1865|shr eax, 0x18|eax=0x2000002 | |
| 0x77176558 ntdll.dll:RtlAllocateHeap+0x1868|cmp al, cl|al=0x2|cl=0x2 | |
| 0x7717655a ntdll.dll:RtlAllocateHeap+0x186a|je 0x77176574|eflags=0x246 | |
| 0x77176574 ntdll.dll:RtlAllocateHeap+0x1884|movzx eax, bx|bx=0x2 | |
| 0x77176577 ntdll.dll:RtlAllocateHeap+0x1887|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x7717657a ntdll.dll:RtlAllocateHeap+0x188a|sub ecx, eax|ecx=0x5|eax=0x2 | |
| 0x7717657c ntdll.dll:RtlAllocateHeap+0x188c|mov dword ptr [ebp - 0xf0], ecx|ebp=0x19fcb8|ecx=0x3 | |
| 0x77176582 ntdll.dll:RtlAllocateHeap+0x1892|test ecx, ecx|ecx=0x3 | |
| 0x77176584 ntdll.dll:RtlAllocateHeap+0x1894|jg 0x7717658d|eflags=0x206 | |
| 0x7717658d ntdll.dll:RtlAllocateHeap+0x189d|cmp dword ptr [esi], 0|esi=0x820270 | |
| 0x77176590 ntdll.dll:RtlAllocateHeap+0x18a0|jne 0x7717662a|eflags=0x206 | |
| 0x7717662a ntdll.dll:RtlAllocateHeap+0x193a|mov ecx, dword ptr [ebp - 0x4c]|ebp=0x19fcb8 | |
| 0x7717662d ntdll.dll:RtlAllocateHeap+0x193d|mov edx, ecx|ecx=0x5 | |
| 0x7717662f ntdll.dll:RtlAllocateHeap+0x193f|shr edx, 5|edx=0x5 | |
| 0x77176632 ntdll.dll:RtlAllocateHeap+0x1942|mov eax, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176635 ntdll.dll:RtlAllocateHeap+0x1945|sub eax, dword ptr [esi + 0x14]|eax=0x80|esi=0x820270 | |
| 0x77176638 ntdll.dll:RtlAllocateHeap+0x1948|shr eax, 5|eax=0x80 | |
| 0x7717663b ntdll.dll:RtlAllocateHeap+0x194b|dec eax|eax=0x4 | |
| 0x7717663c ntdll.dll:RtlAllocateHeap+0x194c|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x3 | |
| 0x7717663f ntdll.dll:RtlAllocateHeap+0x194f|mov eax, dword ptr [esi + 0x1c]|esi=0x820270 | |
| 0x77176642 ntdll.dll:RtlAllocateHeap+0x1952|lea eax, [eax + edx*4]|eax=0x820294|edx=0x0 | |
| 0x77176645 ntdll.dll:RtlAllocateHeap+0x1955|and ecx, 0x1f|ecx=0x5 | |
| 0x77176648 ntdll.dll:RtlAllocateHeap+0x1958|or ebx, 0xffffffff|ebx=0x2000002 | |
| 0x7717664b ntdll.dll:RtlAllocateHeap+0x195b|shl ebx, cl|ebx=0xffffffff|cl=0x5 | |
| 0x7717664d ntdll.dll:RtlAllocateHeap+0x195d|and ebx, dword ptr [eax]|ebx=0xffffffe0|eax=0x820294 | |
| 0x7717664f ntdll.dll:RtlAllocateHeap+0x195f|mov ecx, dword ptr [ebp - 0x24]|ebp=0x19fcb8 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x820294 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x0 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x0|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x820294 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x820298 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x0 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x820298 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x1 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x1|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x820298 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x82029c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x1 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x82029c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x2 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x2|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x82029c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x8202a0 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x2 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x8202a0 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x3 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x3|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x246 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x8202a0 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x8202a4 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x3 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x8202a4 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x4 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x4|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x202 | |
| 0x7717666e ntdll.dll:RtlAllocateHeap+0x197e|test ebx, ebx|ebx=0x0 | |
| 0x77176670 ntdll.dll:RtlAllocateHeap+0x1980|je 0x77177802|eflags=0x246 | |
| 0x77177802 ntdll.dll:RtlAllocateHeap+0x2b12|mov esi, dword ptr [esi]|esi=0x820270 | |
| 0x77177804 ntdll.dll:RtlAllocateHeap+0x2b14|mov dword ptr [ebp - 0x28], esi|ebp=0x19fcb8|esi=0x822b00 | |
| 0x77177807 ntdll.dll:RtlAllocateHeap+0x2b17|mov eax, dword ptr [esi + 0x14]|esi=0x822b00 | |
| 0x7717780a ntdll.dll:RtlAllocateHeap+0x2b1a|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fcb8|eax=0x80 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x80|esi=0x822b00 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19fcb8|eax=0x0 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19fcb8 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19fcb8|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82b440 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x283 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82b440 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x82b438 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82b438 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fcb8|ebx=0x521acb7f | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x521acb7f|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19fcb8|ebx=0x76000375 | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x76000375 | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x76000375 | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x76000375 | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x76000375 | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x3 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x3|bl=0x75 | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x76000375 | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x76000375 | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x76|cl=0x76 | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x375 | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x5|eax=0x375 | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19fcb8|ecx=0xfffffc90 | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0xfffffc90 | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x286 | |
| 0x77176526 ntdll.dll:RtlAllocateHeap+0x1836|mov eax, dword ptr [edx]|edx=0x8200c0 | |
| 0x77176528 ntdll.dll:RtlAllocateHeap+0x1838|add eax, -8|eax=0x8266e8 | |
| 0x7717652b ntdll.dll:RtlAllocateHeap+0x183b|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x8266e0 | |
| 0x7717652e ntdll.dll:RtlAllocateHeap+0x183e|mov ebx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176530 ntdll.dll:RtlAllocateHeap+0x1840|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fcb8|ebx=0x261ac808 | |
| 0x77176536 ntdll.dll:RtlAllocateHeap+0x1846|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717653a ntdll.dll:RtlAllocateHeap+0x184a|je 0x77176574|eflags=0x206 | |
| 0x7717653c ntdll.dll:RtlAllocateHeap+0x184c|xor ebx, dword ptr [edi + 0x50]|ebx=0x261ac808|edi=0x820000 | |
| 0x7717653f ntdll.dll:RtlAllocateHeap+0x184f|mov dword ptr [ebp - 0x140], ebx|ebp=0x19fcb8|ebx=0x2000002 | |
| 0x77176545 ntdll.dll:RtlAllocateHeap+0x1855|mov ecx, ebx|ebx=0x2000002 | |
| 0x77176547 ntdll.dll:RtlAllocateHeap+0x1857|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717654a ntdll.dll:RtlAllocateHeap+0x185a|mov eax, ebx|ebx=0x2000002 | |
| 0x7717654c ntdll.dll:RtlAllocateHeap+0x185c|shr eax, 8|eax=0x2000002 | |
| 0x7717654f ntdll.dll:RtlAllocateHeap+0x185f|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176551 ntdll.dll:RtlAllocateHeap+0x1861|xor cl, bl|cl=0x0|bl=0x2 | |
| 0x77176553 ntdll.dll:RtlAllocateHeap+0x1863|mov eax, ebx|ebx=0x2000002 | |
| 0x77176555 ntdll.dll:RtlAllocateHeap+0x1865|shr eax, 0x18|eax=0x2000002 | |
| 0x77176558 ntdll.dll:RtlAllocateHeap+0x1868|cmp al, cl|al=0x2|cl=0x2 | |
| 0x7717655a ntdll.dll:RtlAllocateHeap+0x186a|je 0x77176574|eflags=0x246 | |
| 0x77176574 ntdll.dll:RtlAllocateHeap+0x1884|movzx eax, bx|bx=0x2 | |
| 0x77176577 ntdll.dll:RtlAllocateHeap+0x1887|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x7717657a ntdll.dll:RtlAllocateHeap+0x188a|sub ecx, eax|ecx=0x5|eax=0x2 | |
| 0x7717657c ntdll.dll:RtlAllocateHeap+0x188c|mov dword ptr [ebp - 0xf0], ecx|ebp=0x19fcb8|ecx=0x3 | |
| 0x77176582 ntdll.dll:RtlAllocateHeap+0x1892|test ecx, ecx|ecx=0x3 | |
| 0x77176584 ntdll.dll:RtlAllocateHeap+0x1894|jg 0x7717658d|eflags=0x206 | |
| 0x7717658d ntdll.dll:RtlAllocateHeap+0x189d|cmp dword ptr [esi], 0|esi=0x822b00 | |
| 0x77176590 ntdll.dll:RtlAllocateHeap+0x18a0|jne 0x7717662a|eflags=0x246 | |
| 0x77176596 ntdll.dll:RtlAllocateHeap+0x18a6|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176599 ntdll.dll:RtlAllocateHeap+0x18a9|dec eax|eax=0x800 | |
| 0x7717659a ntdll.dll:RtlAllocateHeap+0x18aa|cmp dword ptr [ebp - 0x3c], eax|ebp=0x19fcb8|eax=0x7ff | |
| 0x7717659d ntdll.dll:RtlAllocateHeap+0x18ad|jne 0x7717662a|eflags=0x297 | |
| 0x7717662a ntdll.dll:RtlAllocateHeap+0x193a|mov ecx, dword ptr [ebp - 0x4c]|ebp=0x19fcb8 | |
| 0x7717662d ntdll.dll:RtlAllocateHeap+0x193d|mov edx, ecx|ecx=0x0 | |
| 0x7717662f ntdll.dll:RtlAllocateHeap+0x193f|shr edx, 5|edx=0x0 | |
| 0x77176632 ntdll.dll:RtlAllocateHeap+0x1942|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176635 ntdll.dll:RtlAllocateHeap+0x1945|sub eax, dword ptr [esi + 0x14]|eax=0x800|esi=0x822b00 | |
| 0x77176638 ntdll.dll:RtlAllocateHeap+0x1948|shr eax, 5|eax=0x780 | |
| 0x7717663b ntdll.dll:RtlAllocateHeap+0x194b|dec eax|eax=0x3c | |
| 0x7717663c ntdll.dll:RtlAllocateHeap+0x194c|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x3b | |
| 0x7717663f ntdll.dll:RtlAllocateHeap+0x194f|mov eax, dword ptr [esi + 0x1c]|esi=0x822b00 | |
| 0x77176642 ntdll.dll:RtlAllocateHeap+0x1952|lea eax, [eax + edx*4]|eax=0x822b24|edx=0x0 | |
| 0x77176645 ntdll.dll:RtlAllocateHeap+0x1955|and ecx, 0x1f|ecx=0x0 | |
| 0x77176648 ntdll.dll:RtlAllocateHeap+0x1958|or ebx, 0xffffffff|ebx=0x2000002 | |
| 0x7717664b ntdll.dll:RtlAllocateHeap+0x195b|shl ebx, cl|ebx=0xffffffff|cl=0x0 | |
| 0x7717664d ntdll.dll:RtlAllocateHeap+0x195d|and ebx, dword ptr [eax]|ebx=0xffffffff|eax=0x822b24 | |
| 0x7717664f ntdll.dll:RtlAllocateHeap+0x195f|mov ecx, dword ptr [ebp - 0x24]|ebp=0x19fcb8 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b24 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x0 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x0|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b24 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b28 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x0 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b28 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x1 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x1|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b28 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b2c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x1 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b2c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x2 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x2|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b2c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b30 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x2 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b30 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x3 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x3|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b30 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b34 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x3 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b34 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x4 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x4|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b34 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b38 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x4 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b38 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x5 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x5|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b38 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b3c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x5 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b3c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x6 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x6|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b3c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b40 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x6 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b40 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x7 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x7|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b40 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b44 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x7 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b44 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x8 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x8|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b44 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b48 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x8 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b48 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x9 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x9|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b48 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b4c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x9 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b4c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0xa | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xa|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b4c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b50 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xa | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b50 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0xb | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xb|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x283 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b50 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b54 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xb | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b54 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0xc | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xc|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x287 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b54 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b58 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xc | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b58 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0xd | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xd|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x287 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b58 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b5c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xd | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b5c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0xe | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xe|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x283 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b5c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b60 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xe | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b60 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0xf | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0xf|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x287 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b60 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b64 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0xf | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b64 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x10 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x10|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b64 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b68 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x10 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b68 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x11 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x11|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b68 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b6c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x11 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b6c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x12 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x12|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b6c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b70 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x12 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b70 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x13 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x13|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b70 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b74 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x13 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b74 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x14 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x14|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b74 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b78 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x14 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b78 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x15 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x15|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b78 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b7c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x15 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b7c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x16 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x16|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b7c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b80 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x16 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19fcb8|eax=0x822b80 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x17 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x200000 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x206 | |
| 0x77176676 ntdll.dll:RtlAllocateHeap+0x1986|test bx, bx|bx=0x0 | |
| 0x77176679 ntdll.dll:RtlAllocateHeap+0x1989|je 0x7717669d|eflags=0x246 | |
| 0x7717669d ntdll.dll:RtlAllocateHeap+0x19ad|mov eax, ebx|ebx=0x200000 | |
| 0x7717669f ntdll.dll:RtlAllocateHeap+0x19af|shr eax, 0x10|eax=0x200000 | |
| 0x771766a2 ntdll.dll:RtlAllocateHeap+0x19b2|movzx eax, al|al=0x20 | |
| 0x771766a5 ntdll.dll:RtlAllocateHeap+0x19b5|test eax, eax|eax=0x20 | |
| 0x771766a7 ntdll.dll:RtlAllocateHeap+0x19b7|je 0x771766b5|eflags=0x202 | |
| 0x771766a9 ntdll.dll:RtlAllocateHeap+0x19b9|movzx eax, byte ptr [eax + 0x7713c1c0]|eax=0x20 | |
| 0x771766b0 ntdll.dll:RtlAllocateHeap+0x19c0|add eax, 0x10|eax=0x5 | |
| 0x771766b3 ntdll.dll:RtlAllocateHeap+0x19c3|jmp 0x771766c2 | |
| 0x771766c2 ntdll.dll:RtlAllocateHeap+0x19d2|shl edx, 5|edx=0x17 | |
| 0x771766c5 ntdll.dll:RtlAllocateHeap+0x19d5|add edx, eax|edx=0x2e0|eax=0x15 | |
| 0x771766c7 ntdll.dll:RtlAllocateHeap+0x19d7|mov dword ptr [ebp - 0xa0], edx|ebp=0x19fcb8|edx=0x2f5 | |
| 0x771766cd ntdll.dll:RtlAllocateHeap+0x19dd|cmp dword ptr [esi + 8], 0|esi=0x822b00 | |
| 0x771766d1 ntdll.dll:RtlAllocateHeap+0x19e1|je 0x771766d5|eflags=0x246 | |
| 0x771766d5 ntdll.dll:RtlAllocateHeap+0x19e5|mov eax, dword ptr [esi + 0x20]|esi=0x822b00 | |
| 0x771766d8 ntdll.dll:RtlAllocateHeap+0x19e8|mov eax, dword ptr [eax + edx*4]|eax=0x822c14|edx=0x2f5 | |
| 0x771766db ntdll.dll:RtlAllocateHeap+0x19eb|mov dword ptr [ebp - 0x1c], eax|ebp=0x19fcb8|eax=0x82b440 | |
| 0x771766de ntdll.dll:RtlAllocateHeap+0x19ee|test eax, eax|eax=0x82b440 | |
| 0x771766e0 ntdll.dll:RtlAllocateHeap+0x19f0|je 0x77177802|eflags=0x202 | |
| 0x771766e6 ntdll.dll:RtlAllocateHeap+0x19f6|mov dword ptr [ebp - 0xf8], eax|ebp=0x19fcb8|eax=0x82b440 | |
| 0x771766ec ntdll.dll:RtlAllocateHeap+0x19fc|cmp dword ptr [ebp - 0xc0], eax|ebp=0x19fcb8|eax=0x82b440 | |
| 0x771766f2 ntdll.dll:RtlAllocateHeap+0x1a02|je 0x77176945|eflags=0x283 | |
| 0x771766f8 ntdll.dll:RtlAllocateHeap+0x1a08|lea ebx, [eax - 8]|eax=0x82b440 | |
| 0x771766fb ntdll.dll:RtlAllocateHeap+0x1a0b|mov dword ptr [ebp - 0x60], ebx|ebp=0x19fcb8|ebx=0x82b438 | |
| 0x771766fe ntdll.dll:RtlAllocateHeap+0x1a0e|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176702 ntdll.dll:RtlAllocateHeap+0x1a12|je 0x77176723|eflags=0x206 | |
| 0x77176704 ntdll.dll:RtlAllocateHeap+0x1a14|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77176707 ntdll.dll:RtlAllocateHeap+0x1a17|xor dword ptr [ebx], eax|ebx=0x82b438|eax=0x241ac80a | |
| 0x77176709 ntdll.dll:RtlAllocateHeap+0x1a19|mov al, byte ptr [ebx + 2]|ebx=0x82b438 | |
| 0x7717670c ntdll.dll:RtlAllocateHeap+0x1a1c|xor al, byte ptr [ebx + 1]|al=0x0|ebx=0x82b438 | |
| 0x7717670f ntdll.dll:RtlAllocateHeap+0x1a1f|xor al, byte ptr [ebx]|al=0x3|ebx=0x82b438 | |
| 0x77176711 ntdll.dll:RtlAllocateHeap+0x1a21|cmp byte ptr [ebx + 3], al|ebx=0x82b438|al=0x76 | |
| 0x77176714 ntdll.dll:RtlAllocateHeap+0x1a24|je 0x77176720|eflags=0x246 | |
| 0x77176720 ntdll.dll:RtlAllocateHeap+0x1a30|mov eax, dword ptr [ebp - 0x1c]|ebp=0x19fcb8 | |
| 0x77176723 ntdll.dll:RtlAllocateHeap+0x1a33|movzx esi, word ptr [ebx]|ebx=0x82b438 | |
| 0x77176726 ntdll.dll:RtlAllocateHeap+0x1a36|cmp esi, dword ptr [ebp - 0x30]|esi=0x375|ebp=0x19fcb8 | |
| 0x77176729 ntdll.dll:RtlAllocateHeap+0x1a39|jb 0x7717692f|eflags=0x202 | |
| 0x7717672f ntdll.dll:RtlAllocateHeap+0x1a3f|mov edx, dword ptr [ebx + 8]|ebx=0x82b438 | |
| 0x77176732 ntdll.dll:RtlAllocateHeap+0x1a42|mov dword ptr [ebp - 0x84], edx|ebp=0x19fcb8|edx=0x8200c0 | |
| 0x77176738 ntdll.dll:RtlAllocateHeap+0x1a48|mov ecx, dword ptr [ebx + 0xc]|ebx=0x82b438 | |
| 0x7717673b ntdll.dll:RtlAllocateHeap+0x1a4b|mov dword ptr [ebp - 0x20], ecx|ebp=0x19fcb8|ecx=0x8266e8 | |
| 0x7717673e ntdll.dll:RtlAllocateHeap+0x1a4e|mov ecx, dword ptr [ecx]|ecx=0x8266e8 | |
| 0x77176740 ntdll.dll:RtlAllocateHeap+0x1a50|mov edx, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x77176743 ntdll.dll:RtlAllocateHeap+0x1a53|cmp ecx, edx|ecx=0x82b440|edx=0x82b440 | |
| 0x77176745 ntdll.dll:RtlAllocateHeap+0x1a55|jne 0x77176915|eflags=0x246 | |
| 0x7717674b ntdll.dll:RtlAllocateHeap+0x1a5b|cmp ecx, eax|ecx=0x82b440|eax=0x82b440 | |
| 0x7717674d ntdll.dll:RtlAllocateHeap+0x1a5d|jne 0x77176915|eflags=0x246 | |
| 0x77176753 ntdll.dll:RtlAllocateHeap+0x1a63|sub dword ptr [edi + 0x74], esi|edi=0x820000|esi=0x375 | |
| 0x77176756 ntdll.dll:RtlAllocateHeap+0x1a66|mov ecx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717675c ntdll.dll:RtlAllocateHeap+0x1a6c|mov dword ptr [ebp - 0x28], ecx|ebp=0x19fcb8|ecx=0x820270 | |
| 0x7717675f ntdll.dll:RtlAllocateHeap+0x1a6f|test ecx, ecx|ecx=0x820270 | |
| 0x77176761 ntdll.dll:RtlAllocateHeap+0x1a71|je 0x77176883|eflags=0x202 | |
| 0x77176767 ntdll.dll:RtlAllocateHeap+0x1a77|movzx eax, word ptr [ebx]|ebx=0x82b438 | |
| 0x7717676a ntdll.dll:RtlAllocateHeap+0x1a7a|mov dword ptr [ebp - 0x4c], eax|ebp=0x19fcb8|eax=0x375 | |
| 0x7717676d ntdll.dll:RtlAllocateHeap+0x1a7d|lea ecx, [ecx]|ecx=0x820270 | |
| 0x77176770 ntdll.dll:RtlAllocateHeap+0x1a80|mov esi, dword ptr [ecx + 4]|ecx=0x820270 | |
| 0x77176773 ntdll.dll:RtlAllocateHeap+0x1a83|mov dword ptr [ebp - 0x74], esi|ebp=0x19fcb8|esi=0x80 | |
| 0x77176776 ntdll.dll:RtlAllocateHeap+0x1a86|cmp eax, esi|eax=0x375|esi=0x80 | |
| 0x77176778 ntdll.dll:RtlAllocateHeap+0x1a88|jae 0x77176785|eflags=0x206 | |
| 0x77176785 ntdll.dll:RtlAllocateHeap+0x1a95|mov edx, dword ptr [ecx]|ecx=0x820270 | |
| 0x77176787 ntdll.dll:RtlAllocateHeap+0x1a97|test edx, edx|edx=0x822b00 | |
| 0x77176789 ntdll.dll:RtlAllocateHeap+0x1a99|jne 0x77176902|eflags=0x206 | |
| 0x77176902 ntdll.dll:RtlAllocateHeap+0x1c12|mov ecx, edx|edx=0x822b00 | |
| 0x77176904 ntdll.dll:RtlAllocateHeap+0x1c14|mov dword ptr [ebp - 0x28], ecx|ebp=0x19fcb8|ecx=0x822b00 | |
| 0x77176907 ntdll.dll:RtlAllocateHeap+0x1c17|jmp 0x77176770 | |
| 0x77176770 ntdll.dll:RtlAllocateHeap+0x1a80|mov esi, dword ptr [ecx + 4]|ecx=0x822b00 | |
| 0x77176773 ntdll.dll:RtlAllocateHeap+0x1a83|mov dword ptr [ebp - 0x74], esi|ebp=0x19fcb8|esi=0x800 | |
| 0x77176776 ntdll.dll:RtlAllocateHeap+0x1a86|cmp eax, esi|eax=0x375|esi=0x800 | |
| 0x77176778 ntdll.dll:RtlAllocateHeap+0x1a88|jae 0x77176785|eflags=0x283 | |
| 0x7717677a ntdll.dll:RtlAllocateHeap+0x1a8a|lea edx, [esi - 1]|esi=0x800 | |
| 0x7717677d ntdll.dll:RtlAllocateHeap+0x1a8d|mov dword ptr [ebp - 0x8c], edx|ebp=0x19fcb8|edx=0x7ff | |
| 0x77176783 ntdll.dll:RtlAllocateHeap+0x1a93|jmp 0x7717679b | |
| 0x7717679b ntdll.dll:RtlAllocateHeap+0x1aab|movzx edx, word ptr [ebx]|ebx=0x82b438 | |
| 0x7717679e ntdll.dll:RtlAllocateHeap+0x1aae|mov dword ptr [ebp - 0x7c], edx|ebp=0x19fcb8|edx=0x375 | |
| 0x771767a1 ntdll.dll:RtlAllocateHeap+0x1ab1|mov edx, eax|eax=0x375 | |
| 0x771767a3 ntdll.dll:RtlAllocateHeap+0x1ab3|sub edx, dword ptr [ecx + 0x14]|edx=0x375|ecx=0x822b00 | |
| 0x771767a6 ntdll.dll:RtlAllocateHeap+0x1ab6|mov dword ptr [ebp - 0x1c], edx|ebp=0x19fcb8|edx=0x2f5 | |
| 0x771767a9 ntdll.dll:RtlAllocateHeap+0x1ab9|cmp dword ptr [ecx + 8], 0|ecx=0x822b00 | |
| 0x771767ad ntdll.dll:RtlAllocateHeap+0x1abd|lea eax, [edx + edx]|edx=0x2f5 | |
| 0x771767b0 ntdll.dll:RtlAllocateHeap+0x1ac0|jne 0x771767b4|eflags=0x246 | |
| 0x771767b2 ntdll.dll:RtlAllocateHeap+0x1ac2|mov eax, edx|edx=0x2f5 | |
| 0x771767b4 ntdll.dll:RtlAllocateHeap+0x1ac4|shl eax, 2|eax=0x2f5 | |
| 0x771767b7 ntdll.dll:RtlAllocateHeap+0x1ac7|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fcb8|eax=0xbd4 | |
| 0x771767ba ntdll.dll:RtlAllocateHeap+0x1aca|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771767bd ntdll.dll:RtlAllocateHeap+0x1acd|add eax, dword ptr [ebp - 0x3c]|eax=0x822c14|ebp=0x19fcb8 | |
| 0x771767c0 ntdll.dll:RtlAllocateHeap+0x1ad0|mov dword ptr [ebp - 0x54], eax|ebp=0x19fcb8|eax=0x8237e8 | |
| 0x771767c3 ntdll.dll:RtlAllocateHeap+0x1ad3|mov eax, dword ptr [eax]|eax=0x8237e8 | |
| 0x771767c5 ntdll.dll:RtlAllocateHeap+0x1ad5|mov dword ptr [ebp - 0x24], eax|ebp=0x19fcb8|eax=0x82b440 | |
| 0x771767c8 ntdll.dll:RtlAllocateHeap+0x1ad8|dec dword ptr [ecx + 0xc]|ecx=0x822b00 | |
| 0x771767cb ntdll.dll:RtlAllocateHeap+0x1adb|mov eax, dword ptr [ebp - 0x8c]|ebp=0x19fcb8 | |
| 0x771767d1 ntdll.dll:RtlAllocateHeap+0x1ae1|cmp dword ptr [ebp - 0x4c], eax|ebp=0x19fcb8|eax=0x7ff | |
| 0x771767d4 ntdll.dll:RtlAllocateHeap+0x1ae4|jne 0x771767d9|eflags=0x293 | |
| 0x771767d9 ntdll.dll:RtlAllocateHeap+0x1ae9|lea esi, [ebx + 8]|ebx=0x82b438 | |
| 0x771767dc ntdll.dll:RtlAllocateHeap+0x1aec|cmp dword ptr [ebp - 0x24], esi|ebp=0x19fcb8|esi=0x82b440 | |
| 0x771767df ntdll.dll:RtlAllocateHeap+0x1aef|mov esi, dword ptr [ebp - 0x74]|ebp=0x19fcb8 | |
| 0x771767e2 ntdll.dll:RtlAllocateHeap+0x1af2|jne 0x77176883|eflags=0x246 | |
| 0x771767e8 ntdll.dll:RtlAllocateHeap+0x1af8|mov dword ptr [ebp - 0xc4], esi|ebp=0x19fcb8|esi=0x800 | |
| 0x771767ee ntdll.dll:RtlAllocateHeap+0x1afe|cmp dword ptr [ecx], 0|ecx=0x822b00 | |
| 0x771767f1 ntdll.dll:RtlAllocateHeap+0x1b01|jne 0x771767fb|eflags=0x246 | |
| 0x771767f3 ntdll.dll:RtlAllocateHeap+0x1b03|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fcb8|eax=0x7ff | |
| 0x771767f9 ntdll.dll:RtlAllocateHeap+0x1b09|jmp 0x771767fe | |
| 0x771767fe ntdll.dll:RtlAllocateHeap+0x1b0e|mov esi, dword ptr [ebx + 8]|ebx=0x82b438 | |
| 0x77176801 ntdll.dll:RtlAllocateHeap+0x1b11|mov edx, dword ptr [ecx + 0x18]|ecx=0x822b00 | |
| 0x77176804 ntdll.dll:RtlAllocateHeap+0x1b14|mov dword ptr [ebp - 0x24], edx|ebp=0x19fcb8|edx=0x8200c0 | |
| 0x77176807 ntdll.dll:RtlAllocateHeap+0x1b17|cmp dword ptr [ebp - 0x4c], eax|ebp=0x19fcb8|eax=0x7ff | |
| 0x7717680a ntdll.dll:RtlAllocateHeap+0x1b1a|mov edx, dword ptr [ebp - 0x1c]|ebp=0x19fcb8 | |
| 0x7717680d ntdll.dll:RtlAllocateHeap+0x1b1d|jae 0x771768ee|eflags=0x293 | |
| 0x77176813 ntdll.dll:RtlAllocateHeap+0x1b23|cmp esi, dword ptr [ecx + 0x18]|esi=0x8200c0|ecx=0x822b00 | |
| 0x77176816 ntdll.dll:RtlAllocateHeap+0x1b26|je 0x771768bf|eflags=0x246 | |
| 0x771768bf ntdll.dll:RtlAllocateHeap+0x1bcf|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771768c2 ntdll.dll:RtlAllocateHeap+0x1bd2|mov ecx, dword ptr [ebp - 0x3c]|ebp=0x19fcb8 | |
| 0x771768c5 ntdll.dll:RtlAllocateHeap+0x1bd5|mov dword ptr [ecx + eax], 0|ecx=0xbd4|eax=0x822c14 | |
| 0x771768cc ntdll.dll:RtlAllocateHeap+0x1bdc|mov esi, edx|edx=0x2f5 | |
| 0x771768ce ntdll.dll:RtlAllocateHeap+0x1bde|shr esi, 5|esi=0x2f5 | |
| 0x771768d1 ntdll.dll:RtlAllocateHeap+0x1be1|and edx, 0x1f|edx=0x2f5 | |
| 0x771768d4 ntdll.dll:RtlAllocateHeap+0x1be4|mov dword ptr [ebp - 0x1c], edx|ebp=0x19fcb8|edx=0x15 | |
| 0x771768d7 ntdll.dll:RtlAllocateHeap+0x1be7|mov edx, 1 | |
| 0x771768dc ntdll.dll:RtlAllocateHeap+0x1bec|mov ecx, dword ptr [ebp - 0x1c]|ebp=0x19fcb8 | |
| 0x771768df ntdll.dll:RtlAllocateHeap+0x1bef|shl edx, cl|edx=0x1|cl=0x15 | |
| 0x771768e1 ntdll.dll:RtlAllocateHeap+0x1bf1|mov eax, dword ptr [ebp - 0x28]|ebp=0x19fcb8 | |
| 0x771768e4 ntdll.dll:RtlAllocateHeap+0x1bf4|mov eax, dword ptr [eax + 0x1c]|eax=0x822b00 | |
| 0x771768e7 ntdll.dll:RtlAllocateHeap+0x1bf7|not edx|edx=0x200000 | |
| 0x771768e9 ntdll.dll:RtlAllocateHeap+0x1bf9|and dword ptr [eax + esi*4], edx|eax=0x822b24|esi=0x17|edx=0xffdfffff | |
| 0x771768ec ntdll.dll:RtlAllocateHeap+0x1bfc|jmp 0x77176883 | |
| 0x77176883 ntdll.dll:RtlAllocateHeap+0x1b93|mov eax, dword ptr [ebp - 0x84]|ebp=0x19fcb8 | |
| 0x77176889 ntdll.dll:RtlAllocateHeap+0x1b99|mov ecx, dword ptr [ebp - 0x20]|ebp=0x19fcb8 | |
| 0x7717688c ntdll.dll:RtlAllocateHeap+0x1b9c|mov dword ptr [ecx], eax|ecx=0x8266e8|eax=0x8200c0 | |
| 0x7717688e ntdll.dll:RtlAllocateHeap+0x1b9e|mov dword ptr [eax + 4], ecx|eax=0x8200c0|ecx=0x8266e8 | |
| 0x77176891 ntdll.dll:RtlAllocateHeap+0x1ba1|test byte ptr [ebx + 2], 8|ebx=0x82b438 | |
| 0x77176895 ntdll.dll:RtlAllocateHeap+0x1ba5|je 0x7717690c|eflags=0x246 | |
| 0x7717690c ntdll.dll:RtlAllocateHeap+0x1c1c|mov byte ptr [ebp - 0x42], 1|ebp=0x19fcb8 | |
| 0x77176910 ntdll.dll:RtlAllocateHeap+0x1c20|jmp 0x771769ee | |
| 0x771769ee ntdll.dll:RtlAllocateHeap+0x1cfe|mov cl, byte ptr [ebx + 2]|ebx=0x82b438 | |
| 0x771769f1 ntdll.dll:RtlAllocateHeap+0x1d01|mov byte ptr [ebp - 0x43], cl|ebp=0x19fcb8|cl=0x0 | |
| 0x771769f4 ntdll.dll:RtlAllocateHeap+0x1d04|mov esi, dword ptr [ebp - 0x64]|ebp=0x19fcb8 | |
| 0x771769f7 ntdll.dll:RtlAllocateHeap+0x1d07|test esi, esi|esi=0x1 | |
| 0x771769f9 ntdll.dll:RtlAllocateHeap+0x1d09|jne 0x77176ac5|eflags=0x202 | |
| 0x77176ac5 ntdll.dll:RtlAllocateHeap+0x1dd5|mov dword ptr [ebp - 0x6c], ebx|ebp=0x19fcb8|ebx=0x82b438 | |
| 0x77176ac8 ntdll.dll:RtlAllocateHeap+0x1dd8|test byte ptr [ebx + 2], 1|ebx=0x82b438 | |
| 0x77176acc ntdll.dll:RtlAllocateHeap+0x1ddc|je 0x77176ae6|eflags=0x246 | |
| 0x77176ae6 ntdll.dll:RtlAllocateHeap+0x1df6|mov eax, dword ptr [ebp - 0x34]|ebp=0x19fcb8 | |
| 0x77176ae9 ntdll.dll:RtlAllocateHeap+0x1df9|mov byte ptr [ebx + 2], al|ebx=0x82b438|al=0x1 | |
| 0x77176aec ntdll.dll:RtlAllocateHeap+0x1dfc|movzx edx, word ptr [ebx]|ebx=0x82b438 | |
| 0x77176aef ntdll.dll:RtlAllocateHeap+0x1dff|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x77176af2 ntdll.dll:RtlAllocateHeap+0x1e02|sub edx, ecx|edx=0x375|ecx=0x5 | |
| 0x77176af4 ntdll.dll:RtlAllocateHeap+0x1e04|mov dword ptr [ebp - 0x3c], edx|ebp=0x19fcb8|edx=0x370 | |
| 0x77176af7 ntdll.dll:RtlAllocateHeap+0x1e07|mov dword ptr [ebp - 0x100], edx|ebp=0x19fcb8|edx=0x370 | |
| 0x77176afd ntdll.dll:RtlAllocateHeap+0x1e0d|movzx eax, cx|cx=0x5 | |
| 0x77176b00 ntdll.dll:RtlAllocateHeap+0x1e10|mov dword ptr [ebp - 0x20], eax|ebp=0x19fcb8|eax=0x5 | |
| 0x77176b03 ntdll.dll:RtlAllocateHeap+0x1e13|mov word ptr [ebx], ax|ebx=0x82b438|ax=0x5 | |
| 0x77176b06 ntdll.dll:RtlAllocateHeap+0x1e16|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fcb8 | |
| 0x77176b09 ntdll.dll:RtlAllocateHeap+0x1e19|sub eax, dword ptr [ebp + 8]|eax=0x28|ebp=0x19fcb8 | |
| 0x77176b0c ntdll.dll:RtlAllocateHeap+0x1e1c|mov dword ptr [ebp - 0x7c], eax|ebp=0x19fcb8|eax=0x8 | |
| 0x77176b0f ntdll.dll:RtlAllocateHeap+0x1e1f|cmp eax, 0x3f|eax=0x8 | |
| 0x77176b12 ntdll.dll:RtlAllocateHeap+0x1e22|jae 0x77176b19|eflags=0x297 | |
| 0x77176b14 ntdll.dll:RtlAllocateHeap+0x1e24|mov byte ptr [ebx + 7], al|ebx=0x82b438|al=0x8 | |
| 0x77176b17 ntdll.dll:RtlAllocateHeap+0x1e27|jmp 0x77176b21 | |
| 0x77176b21 ntdll.dll:RtlAllocateHeap+0x1e31|mov byte ptr [ebx + 3], 0|ebx=0x82b438 | |
| 0x77176b25 ntdll.dll:RtlAllocateHeap+0x1e35|test edx, edx|edx=0x370 | |
| 0x77176b27 ntdll.dll:RtlAllocateHeap+0x1e37|je 0x77176b47|eflags=0x202 | |
| 0x77176b29 ntdll.dll:RtlAllocateHeap+0x1e39|cmp edx, 1|edx=0x370 | |
| 0x77176b2c ntdll.dll:RtlAllocateHeap+0x1e3c|jne 0x77176c8c|eflags=0x216 | |
| 0x77176c8c ntdll.dll:RtlAllocateHeap+0x1f9c|xor eax, eax|eax=0x8 | |
| 0x77176c8e ntdll.dll:RtlAllocateHeap+0x1f9e|test esi, esi|esi=0x1 | |
| 0x77176c90 ntdll.dll:RtlAllocateHeap+0x1fa0|sete al|al=0x0|eflags=0x202 | |
| 0x77176c93 ntdll.dll:RtlAllocateHeap+0x1fa3|mov dword ptr [ebp - 0x1c], eax|ebp=0x19fcb8|eax=0x0 | |
| 0x77176c96 ntdll.dll:RtlAllocateHeap+0x1fa6|mov dword ptr [ebp - 0xac], eax|ebp=0x19fcb8|eax=0x0 | |
| 0x77176c9c ntdll.dll:RtlAllocateHeap+0x1fac|mov al, byte ptr [ebx + 6]|ebx=0x82b438 | |
| 0x77176c9f ntdll.dll:RtlAllocateHeap+0x1faf|test al, al|al=0x0 | |
| 0x77176ca1 ntdll.dll:RtlAllocateHeap+0x1fb1|je 0x77176cbd|eflags=0x246 | |
| 0x77176cbd ntdll.dll:RtlAllocateHeap+0x1fcd|mov ecx, edi|edi=0x820000 | |
| 0x77176cbf ntdll.dll:RtlAllocateHeap+0x1fcf|mov esi, edi|edi=0x820000 | |
| 0x77176cc1 ntdll.dll:RtlAllocateHeap+0x1fd1|mov dword ptr [ebp - 0xcc], ecx|ebp=0x19fcb8|ecx=0x820000 | |
| 0x77176cc7 ntdll.dll:RtlAllocateHeap+0x1fd7|mov dword ptr [ebp - 0x24], edx|ebp=0x19fcb8|edx=0x370 | |
| 0x77176cca ntdll.dll:RtlAllocateHeap+0x1fda|mov eax, dword ptr [ebp - 0x30]|ebp=0x19fcb8 | |
| 0x77176ccd ntdll.dll:RtlAllocateHeap+0x1fdd|lea ebx, [ebx + eax*8]|ebx=0x82b438|eax=0x5 | |
| 0x77176cd0 ntdll.dll:RtlAllocateHeap+0x1fe0|mov dword ptr [ebp - 0x54], 0|ebp=0x19fcb8 | |
| 0x77176cd7 ntdll.dll:RtlAllocateHeap+0x1fe7|mov al, byte ptr [ebp - 0x43]|ebp=0x19fcb8 | |
| 0x77176cda ntdll.dll:RtlAllocateHeap+0x1fea|mov byte ptr [ebx + 2], al|ebx=0x82b460|al=0x0 | |
| 0x77176cdd ntdll.dll:RtlAllocateHeap+0x1fed|mov byte ptr [ebx + 7], 0|ebx=0x82b460 | |
| 0x77176ce1 ntdll.dll:RtlAllocateHeap+0x1ff1|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77176ce5 ntdll.dll:RtlAllocateHeap+0x1ff5|xor ax, word ptr [ebp - 0x20]|ax=0x10ad|ebp=0x19fcb8 | |
| 0x77176ce9 ntdll.dll:RtlAllocateHeap+0x1ff9|mov word ptr [ebx + 4], ax|ebx=0x82b460|ax=0x10a8 | |
| 0x77176ced ntdll.dll:RtlAllocateHeap+0x1ffd|cmp dword ptr [ecx + 0x18], esi|ecx=0x820000|esi=0x820000 | |
| 0x77176cf0 ntdll.dll:RtlAllocateHeap+0x2000|jne 0x77176cf6|eflags=0x246 | |
| 0x77176cf2 ntdll.dll:RtlAllocateHeap+0x2002|xor al, al|al=0xa8 | |
| 0x77176cf4 ntdll.dll:RtlAllocateHeap+0x2004|jmp 0x77176d27 | |
| 0x77176d27 ntdll.dll:RtlAllocateHeap+0x2037|mov byte ptr [ebp - 0x7e], al|ebp=0x19fcb8|al=0x0 | |
| 0x77176d2a ntdll.dll:RtlAllocateHeap+0x203a|mov byte ptr [ebx + 6], al|ebx=0x82b460|al=0x0 | |
| 0x77176d2d ntdll.dll:RtlAllocateHeap+0x203d|mov byte ptr [ebx + 3], 0|ebx=0x82b460 | |
| 0x77176d31 ntdll.dll:RtlAllocateHeap+0x2041|mov word ptr [ebx], dx|ebx=0x82b460|dx=0x370 | |
| 0x77176d34 ntdll.dll:RtlAllocateHeap+0x2044|lea esi, [ebx + edx*8]|ebx=0x82b460|edx=0x370 | |
| 0x77176d37 ntdll.dll:RtlAllocateHeap+0x2047|mov ecx, dword ptr [edi + 0x4c]|edi=0x820000 | |
| 0x77176d3a ntdll.dll:RtlAllocateHeap+0x204a|mov eax, ecx|ecx=0x100000 | |
| 0x77176d3c ntdll.dll:RtlAllocateHeap+0x204c|shr eax, 0x14|eax=0x100000 | |
| 0x77176d3f ntdll.dll:RtlAllocateHeap+0x204f|and al, byte ptr [edi + 0x52]|al=0x1|edi=0x820000 | |
| 0x77176d42 ntdll.dll:RtlAllocateHeap+0x2052|xor al, byte ptr [esi + 2]|al=0x0|esi=0x82cfe0 | |
| 0x77176d45 ntdll.dll:RtlAllocateHeap+0x2055|test al, 1|al=0x1b | |
| 0x77176d47 ntdll.dll:RtlAllocateHeap+0x2057|je 0x771772aa|eflags=0x202 | |
| 0x77176d4d ntdll.dll:RtlAllocateHeap+0x205d|movzx edx, dx|dx=0x370 | |
| 0x77176d50 ntdll.dll:RtlAllocateHeap+0x2060|mov dword ptr [ebp - 0x28], edx|ebp=0x19fcb8|edx=0x370 | |
| 0x77176d53 ntdll.dll:RtlAllocateHeap+0x2063|mov ax, word ptr [edi + 0x54]|edi=0x820000 | |
| 0x77176d57 ntdll.dll:RtlAllocateHeap+0x2067|xor ax, dx|ax=0x10ad|dx=0x370 | |
| 0x77176d5a ntdll.dll:RtlAllocateHeap+0x206a|mov word ptr [esi + 4], ax|esi=0x82cfe0|ax=0x13dd | |
| 0x77176d5e ntdll.dll:RtlAllocateHeap+0x206e|cmp byte ptr [ebp - 0x1c], 0|ebp=0x19fcb8 | |
| 0x77176d62 ntdll.dll:RtlAllocateHeap+0x2072|jne 0x771771bf|eflags=0x246 | |
| 0x77176d68 ntdll.dll:RtlAllocateHeap+0x2078|mov byte ptr [ebx + 2], 0|ebx=0x82b460 | |
| 0x77176d6c ntdll.dll:RtlAllocateHeap+0x207c|mov byte ptr [ebx + 7], 0|ebx=0x82b460 | |
| 0x77176d70 ntdll.dll:RtlAllocateHeap+0x2080|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176d76 ntdll.dll:RtlAllocateHeap+0x2086|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x77176d7c ntdll.dll:RtlAllocateHeap+0x208c|mov dword ptr [ebp - 0x1c], esi|ebp=0x19fcb8|esi=0x820270 | |
| 0x77176d7f ntdll.dll:RtlAllocateHeap+0x208f|test esi, esi|esi=0x820270 | |
| 0x77176d81 ntdll.dll:RtlAllocateHeap+0x2091|je 0x7717701d|eflags=0x202 | |
| 0x77176d87 ntdll.dll:RtlAllocateHeap+0x2097|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176d8a ntdll.dll:RtlAllocateHeap+0x209a|cmp edx, ecx|edx=0x370|ecx=0x80 | |
| 0x77176d8c ntdll.dll:RtlAllocateHeap+0x209c|jae 0x77176d92|eflags=0x206 | |
| 0x77176d92 ntdll.dll:RtlAllocateHeap+0x20a2|mov eax, dword ptr [esi]|esi=0x820270 | |
| 0x77176d94 ntdll.dll:RtlAllocateHeap+0x20a4|test eax, eax|eax=0x822b00 | |
| 0x77176d96 ntdll.dll:RtlAllocateHeap+0x20a6|jne 0x77177013|eflags=0x206 | |
| 0x77177013 ntdll.dll:RtlAllocateHeap+0x2323|mov esi, eax|eax=0x822b00 | |
| 0x77177015 ntdll.dll:RtlAllocateHeap+0x2325|mov dword ptr [ebp - 0x1c], esi|ebp=0x19fcb8|esi=0x822b00 | |
| 0x77177018 ntdll.dll:RtlAllocateHeap+0x2328|jmp 0x77176d87 | |
| 0x77176d87 ntdll.dll:RtlAllocateHeap+0x2097|mov ecx, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176d8a ntdll.dll:RtlAllocateHeap+0x209a|cmp edx, ecx|edx=0x370|ecx=0x800 | |
| 0x77176d8c ntdll.dll:RtlAllocateHeap+0x209c|jae 0x77176d92|eflags=0x283 | |
| 0x77176d8e ntdll.dll:RtlAllocateHeap+0x209e|mov eax, edx|edx=0x370 | |
| 0x77176d90 ntdll.dll:RtlAllocateHeap+0x20a0|jmp 0x77176d9f | |
| 0x77176d9f ntdll.dll:RtlAllocateHeap+0x20af|mov dword ptr [ebp - 0x74], eax|ebp=0x19fcb8|eax=0x370 | |
| 0x77176da2 ntdll.dll:RtlAllocateHeap+0x20b2|sub eax, dword ptr [esi + 0x14]|eax=0x370|esi=0x822b00 | |
| 0x77176da5 ntdll.dll:RtlAllocateHeap+0x20b5|mov dword ptr [ebp - 0x3c], eax|ebp=0x19fcb8|eax=0x2f0 | |
| 0x77176da8 ntdll.dll:RtlAllocateHeap+0x20b8|mov dword ptr [ebp - 0x7c], 0|ebp=0x19fcb8 | |
| 0x77176daf ntdll.dll:RtlAllocateHeap+0x20bf|mov eax, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x77176db2 ntdll.dll:RtlAllocateHeap+0x20c2|mov dword ptr [ebp - 0x34], eax|ebp=0x19fcb8|eax=0x8200c0 | |
| 0x77176db5 ntdll.dll:RtlAllocateHeap+0x20c5|mov ecx, dword ptr [eax + 4]|eax=0x8200c0 | |
| 0x77176db8 ntdll.dll:RtlAllocateHeap+0x20c8|cmp eax, ecx|eax=0x8200c0|ecx=0x8266e8 | |
| 0x77176dba ntdll.dll:RtlAllocateHeap+0x20ca|jne 0x77176dc3|eflags=0x297 | |
| 0x77176dc3 ntdll.dll:RtlAllocateHeap+0x20d3|lea eax, [ecx - 8]|ecx=0x8266e8 | |
| 0x77176dc6 ntdll.dll:RtlAllocateHeap+0x20d6|mov dword ptr [ebp - 0x20], eax|ebp=0x19fcb8|eax=0x8266e0 | |
| 0x77176dc9 ntdll.dll:RtlAllocateHeap+0x20d9|mov edx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176dcb ntdll.dll:RtlAllocateHeap+0x20db|mov dword ptr [ebp - 0x158], edx|ebp=0x19fcb8|edx=0x261ac808 | |
| 0x77176dd1 ntdll.dll:RtlAllocateHeap+0x20e1|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176dd5 ntdll.dll:RtlAllocateHeap+0x20e5|je 0x77176e12|eflags=0x206 | |
| 0x77176dd7 ntdll.dll:RtlAllocateHeap+0x20e7|xor edx, dword ptr [edi + 0x50]|edx=0x261ac808|edi=0x820000 | |
| 0x77176dda ntdll.dll:RtlAllocateHeap+0x20ea|mov dword ptr [ebp - 0x24], edx|ebp=0x19fcb8|edx=0x2000002 | |
| 0x77176ddd ntdll.dll:RtlAllocateHeap+0x20ed|mov dword ptr [ebp - 0x158], edx|ebp=0x19fcb8|edx=0x2000002 | |
| 0x77176de3 ntdll.dll:RtlAllocateHeap+0x20f3|mov ecx, edx|edx=0x2000002 | |
| 0x77176de5 ntdll.dll:RtlAllocateHeap+0x20f5|shr ecx, 0x10|ecx=0x2000002 | |
| 0x77176de8 ntdll.dll:RtlAllocateHeap+0x20f8|mov eax, edx|edx=0x2000002 | |
| 0x77176dea ntdll.dll:RtlAllocateHeap+0x20fa|shr eax, 8|eax=0x2000002 | |
| 0x77176ded ntdll.dll:RtlAllocateHeap+0x20fd|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176def ntdll.dll:RtlAllocateHeap+0x20ff|xor cl, dl|cl=0x0|dl=0x2 | |
| 0x77176df1 ntdll.dll:RtlAllocateHeap+0x2101|mov eax, edx|edx=0x2000002 | |
| 0x77176df3 ntdll.dll:RtlAllocateHeap+0x2103|shr eax, 0x18|eax=0x2000002 | |
| 0x77176df6 ntdll.dll:RtlAllocateHeap+0x2106|cmp al, cl|al=0x2|cl=0x2 | |
| 0x77176df8 ntdll.dll:RtlAllocateHeap+0x2108|je 0x77176e12|eflags=0x246 | |
| 0x77176e12 ntdll.dll:RtlAllocateHeap+0x2122|movzx eax, dx|dx=0x2 | |
| 0x77176e15 ntdll.dll:RtlAllocateHeap+0x2125|mov ecx, dword ptr [ebp - 0x28]|ebp=0x19fcb8 | |
| 0x77176e18 ntdll.dll:RtlAllocateHeap+0x2128|sub ecx, eax|ecx=0x370|eax=0x2 | |
| 0x77176e1a ntdll.dll:RtlAllocateHeap+0x212a|mov dword ptr [ebp - 0x104], ecx|ebp=0x19fcb8|ecx=0x36e | |
| 0x77176e20 ntdll.dll:RtlAllocateHeap+0x2130|test ecx, ecx|ecx=0x36e | |
| 0x77176e22 ntdll.dll:RtlAllocateHeap+0x2132|jle 0x77176e2c|eflags=0x202 | |
| 0x77176e24 ntdll.dll:RtlAllocateHeap+0x2134|mov ecx, dword ptr [ebp - 0x34]|ebp=0x19fcb8 | |
| 0x77176e27 ntdll.dll:RtlAllocateHeap+0x2137|jmp 0x77176ff7 | |
| 0x77176ff7 ntdll.dll:RtlAllocateHeap+0x2307|test ecx, ecx|ecx=0x8200c0 | |
| 0x77176ff9 ntdll.dll:RtlAllocateHeap+0x2309|je 0x77177006|eflags=0x206 | |
| 0x77176ffb ntdll.dll:RtlAllocateHeap+0x230b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77177001 ntdll.dll:RtlAllocateHeap+0x2311|jmp 0x7717701f | |
| 0x7717701f ntdll.dll:RtlAllocateHeap+0x232f|mov esi, dword ptr [ebp - 0x28]|ebp=0x19fcb8 | |
| 0x77177022 ntdll.dll:RtlAllocateHeap+0x2332|cmp eax, ecx|eax=0x8200c0|ecx=0x8200c0 | |
| 0x77177024 ntdll.dll:RtlAllocateHeap+0x2334|je 0x7717705b|eflags=0x246 | |
| 0x7717705b ntdll.dll:RtlAllocateHeap+0x236b|lea eax, [ebx + 8]|ebx=0x82b460 | |
| 0x7717705e ntdll.dll:RtlAllocateHeap+0x236e|mov edx, dword ptr [ecx + 4]|ecx=0x8200c0 | |
| 0x77177061 ntdll.dll:RtlAllocateHeap+0x2371|mov esi, dword ptr [edx]|edx=0x8266e8 | |
| 0x77177063 ntdll.dll:RtlAllocateHeap+0x2373|cmp esi, ecx|esi=0x8200c0|ecx=0x8200c0 | |
| 0x77177065 ntdll.dll:RtlAllocateHeap+0x2375|jne 0x77177073|eflags=0x246 | |
| 0x77177067 ntdll.dll:RtlAllocateHeap+0x2377|mov dword ptr [eax], ecx|eax=0x82b468|ecx=0x8200c0 | |
| 0x77177069 ntdll.dll:RtlAllocateHeap+0x2379|mov dword ptr [eax + 4], edx|eax=0x82b468|edx=0x8266e8 | |
| 0x7717706c ntdll.dll:RtlAllocateHeap+0x237c|mov dword ptr [edx], eax|edx=0x8266e8|eax=0x82b468 | |
| 0x7717706e ntdll.dll:RtlAllocateHeap+0x237e|mov dword ptr [ecx + 4], eax|ecx=0x8200c0|eax=0x82b468 | |
| 0x77177071 ntdll.dll:RtlAllocateHeap+0x2381|jmp 0x77177083 | |
| 0x77177083 ntdll.dll:RtlAllocateHeap+0x2393|movzx eax, word ptr [ebx]|ebx=0x82b460 | |
| 0x77177086 ntdll.dll:RtlAllocateHeap+0x2396|add dword ptr [edi + 0x74], eax|edi=0x820000|eax=0x370 | |
| 0x77177089 ntdll.dll:RtlAllocateHeap+0x2399|mov ecx, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717708f ntdll.dll:RtlAllocateHeap+0x239f|mov dword ptr [ebp - 0x34], ecx|ebp=0x19fcb8|ecx=0x820270 | |
| 0x77177092 ntdll.dll:RtlAllocateHeap+0x23a2|test ecx, ecx|ecx=0x820270 | |
| 0x77177094 ntdll.dll:RtlAllocateHeap+0x23a4|je 0x77177196|eflags=0x202 | |
| 0x7717709a ntdll.dll:RtlAllocateHeap+0x23aa|movzx eax, word ptr [ebx]|ebx=0x82b460 | |
| 0x7717709d ntdll.dll:RtlAllocateHeap+0x23ad|mov dword ptr [ebp - 0x7c], eax|ebp=0x19fcb8|eax=0x370 | |
| 0x771770a0 ntdll.dll:RtlAllocateHeap+0x23b0|mov esi, dword ptr [ecx + 4]|ecx=0x820270 | |
| 0x771770a3 ntdll.dll:RtlAllocateHeap+0x23b3|cmp eax, esi|eax=0x370|esi=0x80 | |
| 0x771770a5 ntdll.dll:RtlAllocateHeap+0x23b5|jae 0x771770b1|eflags=0x206 | |
| 0x771770b1 ntdll.dll:RtlAllocateHeap+0x23c1|mov edx, dword ptr [ecx]|ecx=0x820270 | |
| 0x771770b3 ntdll.dll:RtlAllocateHeap+0x23c3|test edx, edx|edx=0x822b00 | |
| 0x771770b5 ntdll.dll:RtlAllocateHeap+0x23c5|jne 0x771771b5|eflags=0x206 | |
| 0x771771b5 ntdll.dll:RtlAllocateHeap+0x24c5|mov ecx, edx|edx=0x822b00 | |
| 0x771771b7 ntdll.dll:RtlAllocateHeap+0x24c7|mov dword ptr [ebp - 0x34], ecx|ebp=0x19fcb8|ecx=0x822b00 | |
| 0x771771ba ntdll.dll:RtlAllocateHeap+0x24ca|jmp 0x771770a0 | |
| 0x771770a0 ntdll.dll:RtlAllocateHeap+0x23b0|mov esi, dword ptr [ecx + 4]|ecx=0x822b00 | |
| 0x771770a3 ntdll.dll:RtlAllocateHeap+0x23b3|cmp eax, esi|eax=0x370|esi=0x800 | |
| 0x771770a5 ntdll.dll:RtlAllocateHeap+0x23b5|jae 0x771770b1|eflags=0x283 | |
| 0x771770a7 ntdll.dll:RtlAllocateHeap+0x23b7|mov edx, eax|eax=0x370 | |
| 0x771770a9 ntdll.dll:RtlAllocateHeap+0x23b9|lea eax, [esi - 1]|esi=0x800 | |
| 0x771770ac ntdll.dll:RtlAllocateHeap+0x23bc|mov dword ptr [ebp - 0x54], eax|ebp=0x19fcb8|eax=0x7ff | |
| 0x771770af ntdll.dll:RtlAllocateHeap+0x23bf|jmp 0x771770c1 | |
| 0x771770c1 ntdll.dll:RtlAllocateHeap+0x23d1|mov esi, edx|edx=0x370 | |
| 0x771770c3 ntdll.dll:RtlAllocateHeap+0x23d3|sub esi, dword ptr [ecx + 0x14]|esi=0x370|ecx=0x822b00 | |
| 0x771770c6 ntdll.dll:RtlAllocateHeap+0x23d6|mov dword ptr [ebp - 0x3c], esi|ebp=0x19fcb8|esi=0x2f0 | |
| 0x771770c9 ntdll.dll:RtlAllocateHeap+0x23d9|cmp dword ptr [ecx + 8], 0|ecx=0x822b00 | |
| 0x771770cd ntdll.dll:RtlAllocateHeap+0x23dd|lea eax, [esi + esi]|esi=0x2f0 | |
| 0x771770d0 ntdll.dll:RtlAllocateHeap+0x23e0|jne 0x771770d4|eflags=0x246 | |
| 0x771770d2 ntdll.dll:RtlAllocateHeap+0x23e2|mov eax, esi|esi=0x2f0 | |
| 0x771770d4 ntdll.dll:RtlAllocateHeap+0x23e4|inc dword ptr [ecx + 0xc]|ecx=0x822b00 | |
| 0x771770d7 ntdll.dll:RtlAllocateHeap+0x23e7|shl eax, 2|eax=0x2f0 | |
| 0x771770da ntdll.dll:RtlAllocateHeap+0x23ea|mov dword ptr [ebp - 0x8c], eax|ebp=0x19fcb8|eax=0xbc0 | |
| 0x771770e0 ntdll.dll:RtlAllocateHeap+0x23f0|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x771770e3 ntdll.dll:RtlAllocateHeap+0x23f3|mov esi, dword ptr [ebp - 0x8c]|ebp=0x19fcb8 | |
| 0x771770e9 ntdll.dll:RtlAllocateHeap+0x23f9|mov eax, dword ptr [esi + eax]|esi=0xbc0|eax=0x822c14 | |
| 0x771770ec ntdll.dll:RtlAllocateHeap+0x23fc|mov dword ptr [ebp - 0x84], eax|ebp=0x19fcb8|eax=0x0 | |
| 0x771770f2 ntdll.dll:RtlAllocateHeap+0x2402|cmp edx, dword ptr [ebp - 0x54]|edx=0x370|ebp=0x19fcb8 | |
| 0x771770f5 ntdll.dll:RtlAllocateHeap+0x2405|mov esi, dword ptr [ebp - 0x3c]|ebp=0x19fcb8 | |
| 0x771770f8 ntdll.dll:RtlAllocateHeap+0x2408|jne 0x771770fd|eflags=0x297 | |
| 0x771770fd ntdll.dll:RtlAllocateHeap+0x240d|test eax, eax|eax=0x0 | |
| 0x771770ff ntdll.dll:RtlAllocateHeap+0x240f|je 0x77177165|eflags=0x246 | |
| 0x77177165 ntdll.dll:RtlAllocateHeap+0x2475|mov eax, dword ptr [ecx + 0x20]|ecx=0x822b00 | |
| 0x77177168 ntdll.dll:RtlAllocateHeap+0x2478|lea ecx, [ebx + 8]|ebx=0x82b460 | |
| 0x7717716b ntdll.dll:RtlAllocateHeap+0x247b|mov edx, dword ptr [ebp - 0x8c]|ebp=0x19fcb8 | |
| 0x77177171 ntdll.dll:RtlAllocateHeap+0x2481|mov dword ptr [edx + eax], ecx|edx=0xbc0|eax=0x822c14|ecx=0x82b468 | |
| 0x77177174 ntdll.dll:RtlAllocateHeap+0x2484|cmp dword ptr [ebp - 0x84], 0|ebp=0x19fcb8 | |
| 0x7717717b ntdll.dll:RtlAllocateHeap+0x248b|jne 0x77177196|eflags=0x246 | |
| 0x7717717d ntdll.dll:RtlAllocateHeap+0x248d|shr esi, 5|esi=0x2f0 | |
| 0x77177180 ntdll.dll:RtlAllocateHeap+0x2490|mov ecx, dword ptr [ebp - 0x3c]|ebp=0x19fcb8 | |
| 0x77177183 ntdll.dll:RtlAllocateHeap+0x2493|and ecx, 0x1f|ecx=0x2f0 | |
| 0x77177186 ntdll.dll:RtlAllocateHeap+0x2496|mov edx, 1 | |
| 0x7717718b ntdll.dll:RtlAllocateHeap+0x249b|shl edx, cl|edx=0x1|cl=0x10 | |
| 0x7717718d ntdll.dll:RtlAllocateHeap+0x249d|mov eax, dword ptr [ebp - 0x34]|ebp=0x19fcb8 | |
| 0x77177190 ntdll.dll:RtlAllocateHeap+0x24a0|mov eax, dword ptr [eax + 0x1c]|eax=0x822b00 | |
| 0x77177193 ntdll.dll:RtlAllocateHeap+0x24a3|or dword ptr [eax + esi*4], edx|eax=0x822b24|esi=0x17|edx=0x10000 | |
| 0x77177196 ntdll.dll:RtlAllocateHeap+0x24a6|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717719a ntdll.dll:RtlAllocateHeap+0x24aa|je 0x77177637|eflags=0x206 | |
| 0x771771a0 ntdll.dll:RtlAllocateHeap+0x24b0|mov al, byte ptr [ebx + 2]|ebx=0x82b460 | |
| 0x771771a3 ntdll.dll:RtlAllocateHeap+0x24b3|xor al, byte ptr [ebx + 1]|al=0x0|ebx=0x82b460 | |
| 0x771771a6 ntdll.dll:RtlAllocateHeap+0x24b6|xor al, byte ptr [ebx]|al=0x3|ebx=0x82b460 | |
| 0x771771a8 ntdll.dll:RtlAllocateHeap+0x24b8|mov byte ptr [ebx + 3], al|ebx=0x82b460|al=0x73 | |
| 0x771771ab ntdll.dll:RtlAllocateHeap+0x24bb|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x771771ae ntdll.dll:RtlAllocateHeap+0x24be|xor dword ptr [ebx], eax|ebx=0x82b460|eax=0x241ac80a | |
| 0x771771b0 ntdll.dll:RtlAllocateHeap+0x24c0|jmp 0x77177637 | |
| 0x77177637 ntdll.dll:RtlAllocateHeap+0x2947|mov byte ptr [ebp - 0x7f], 1|ebp=0x19fcb8 | |
| 0x7717763b ntdll.dll:RtlAllocateHeap+0x294b|mov byte ptr [ebp - 0x43], 0|ebp=0x19fcb8 | |
| 0x7717763f ntdll.dll:RtlAllocateHeap+0x294f|jmp 0x77176b47 | |
| 0x77176b47 ntdll.dll:RtlAllocateHeap+0x1e57|mov ecx, dword ptr [ebp - 0x6c]|ebp=0x19fcb8 | |
| 0x77176b4a ntdll.dll:RtlAllocateHeap+0x1e5a|lea ebx, [ecx + 8]|ecx=0x82b438 | |
| 0x77176b4d ntdll.dll:RtlAllocateHeap+0x1e5d|mov dword ptr [ebp - 0x5c], ebx|ebp=0x19fcb8|ebx=0x82b440 | |
| 0x77176b50 ntdll.dll:RtlAllocateHeap+0x1e60|movzx eax, word ptr [ecx]|ecx=0x82b438 | |
| 0x77176b53 ntdll.dll:RtlAllocateHeap+0x1e63|lea esi, [eax*8]|eax=0x5 | |
| 0x77176b5a ntdll.dll:RtlAllocateHeap+0x1e6a|mov dword ptr [ebp - 0xb0], esi|ebp=0x19fcb8|esi=0x28 | |
| 0x77176b60 ntdll.dll:RtlAllocateHeap+0x1e70|lea edx, [ecx + 7]|ecx=0x82b438 | |
| 0x77176b63 ntdll.dll:RtlAllocateHeap+0x1e73|mov dword ptr [ebp - 0x54], edx|ebp=0x19fcb8|edx=0x82b43f | |
| 0x77176b66 ntdll.dll:RtlAllocateHeap+0x1e76|mov ecx, esi|esi=0x28 | |
| 0x77176b68 ntdll.dll:RtlAllocateHeap+0x1e78|mov al, byte ptr [edx]|edx=0x82b43f | |
| 0x77176b6a ntdll.dll:RtlAllocateHeap+0x1e7a|and al, 0x3f|al=0x8 | |
| 0x77176b6c ntdll.dll:RtlAllocateHeap+0x1e7c|cmp al, 0x3f|al=0x8 | |
| 0x77176b6e ntdll.dll:RtlAllocateHeap+0x1e7e|jne 0x77176b7b|eflags=0x297 | |
| 0x77176b7b ntdll.dll:RtlAllocateHeap+0x1e8b|cmp dword ptr [ebp - 0x64], 0|ebp=0x19fcb8 | |
| 0x77176b7f ntdll.dll:RtlAllocateHeap+0x1e8f|je 0x771776a1|eflags=0x202 | |
| 0x77176b85 ntdll.dll:RtlAllocateHeap+0x1e95|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x77176b89 ntdll.dll:RtlAllocateHeap+0x1e99|je 0x77176b9e|eflags=0x206 | |
| 0x77176b8b ntdll.dll:RtlAllocateHeap+0x1e9b|mov ecx, dword ptr [ebp - 0x6c]|ebp=0x19fcb8 | |
| 0x77176b8e ntdll.dll:RtlAllocateHeap+0x1e9e|mov al, byte ptr [ecx + 2]|ecx=0x82b438 | |
| 0x77176b91 ntdll.dll:RtlAllocateHeap+0x1ea1|xor al, byte ptr [ecx + 1]|al=0x1|ecx=0x82b438 | |
| 0x77176b94 ntdll.dll:RtlAllocateHeap+0x1ea4|xor al, byte ptr [ecx]|al=0x1|ecx=0x82b438 | |
| 0x77176b96 ntdll.dll:RtlAllocateHeap+0x1ea6|mov byte ptr [ecx + 3], al|ecx=0x82b438|al=0x4 | |
| 0x77176b99 ntdll.dll:RtlAllocateHeap+0x1ea9|mov eax, dword ptr [edi + 0x50]|edi=0x820000 | |
| 0x77176b9c ntdll.dll:RtlAllocateHeap+0x1eac|xor dword ptr [ecx], eax|ecx=0x82b438|eax=0x241ac80a | |
| 0x77176b9e ntdll.dll:RtlAllocateHeap+0x1eae|cmp byte ptr [ebp - 0x29], 0|ebp=0x19fcb8 | |
| 0x77176ba2 ntdll.dll:RtlAllocateHeap+0x1eb2|je 0x77176c5f|eflags=0x202 | |
| 0x77176ba8 ntdll.dll:RtlAllocateHeap+0x1eb8|test dword ptr [edi + 0x44], 0x1000000|edi=0x820000 | |
| 0x77176baf ntdll.dll:RtlAllocateHeap+0x1ebf|jne 0x77176c50|eflags=0x246 | |
| 0x77176bb5 ntdll.dll:RtlAllocateHeap+0x1ec5|inc dword ptr [edi + 0x22c]|edi=0x820000 | |
| 0x77176bbb ntdll.dll:RtlAllocateHeap+0x1ecb|mov edx, dword ptr [edi + 0x234]|edi=0x820000 | |
| 0x77176bc1 ntdll.dll:RtlAllocateHeap+0x1ed1|cmp dword ptr [edi + 0x22c], edx|edi=0x820000|edx=0x1 | |
| 0x77176bc7 ntdll.dll:RtlAllocateHeap+0x1ed7|jbe 0x77176bf5|eflags=0x246 | |
| 0x77176bf5 ntdll.dll:RtlAllocateHeap+0x1f05|inc dword ptr [edi + 0x238]|edi=0x820000 | |
| 0x77176bfb ntdll.dll:RtlAllocateHeap+0x1f0b|cmp dword ptr [edi + 0x238], 0x1000|edi=0x820000 | |
| 0x77176c05 ntdll.dll:RtlAllocateHeap+0x1f15|jb 0x77176c50|eflags=0x287 | |
| 0x77176c50 ntdll.dll:RtlAllocateHeap+0x1f60|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19fb38 | |
| 0x77176c56 ntdll.dll:RtlAllocateHeap+0x1f66|call 0x77177b20|esp=0x19fb34|eip=0x77176c56 | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19fcb8|esp=0x19fb30 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19fb2c | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19fb2c | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x82b440|esp=0x19fb24 | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19fb2c | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x28|esp=0x19fb20 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x820000|esp=0x19fb1c | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x820258 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x820258 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x820258 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0x82b438 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x82025c|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x82025c|esp=0x19fb18 | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19fb1c | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x820258|esp=0x19fb20 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19fb2c | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19fb2c|esp=0x19fb2c | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19fb30 | |
| 0x77176c5b ntdll.dll:RtlAllocateHeap+0x1f6b|mov byte ptr [ebp - 0x29], 0|ebp=0x19fcb8 | |
| 0x77176c5f ntdll.dll:RtlAllocateHeap+0x1f6f|test byte ptr [ebp - 0x68], 8|ebp=0x19fcb8 | |
| 0x77176c63 ntdll.dll:RtlAllocateHeap+0x1f73|je 0x77177a7e|eflags=0x246 | |
| 0x77177a7e ntdll.dll:RtlAllocateHeap+0x2d8e|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fcb8 | |
| 0x77177a85 ntdll.dll:RtlAllocateHeap+0x2d95|call 0x77177aa9|esp=0x19fb38|eip=0x77177a85 | |
| 0x77177aa9 ntdll.dll:RtlAllocateHeap+0x2db9|cmp byte ptr [ebp - 0x29], 0|ebp=0x19fcb8 | |
| 0x77177aad ntdll.dll:RtlAllocateHeap+0x2dbd|je 0x77177acd|eflags=0x246 | |
| 0x77177acd ntdll.dll:RtlAllocateHeap+0x2ddd|ret|esp=0x19fb34 | |
| 0x77177a8a ntdll.dll:RtlAllocateHeap+0x2d9a|call 0x77177ce0|esp=0x19fb38|eip=0x77177a8a | |
| 0x77177ce0 ntdll.dll:RtlGetCurrentServiceSessionId|mov eax, dword ptr fs:[0x30] | |
| 0x77177ce6 ntdll.dll:RtlGetCurrentServiceSessionId+0x6|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77177ce9 ntdll.dll:RtlGetCurrentServiceSessionId+0x9|test eax, eax|eax=0x0 | |
| 0x77177ceb ntdll.dll:RtlGetCurrentServiceSessionId+0xb|jne 0x77177cee|eflags=0x246 | |
| 0x77177ced ntdll.dll:RtlGetCurrentServiceSessionId+0xd|ret|esp=0x19fb34 | |
| 0x77177a8f ntdll.dll:RtlAllocateHeap+0x2d9f|test eax, eax|eax=0x0 | |
| 0x77177a91 ntdll.dll:RtlAllocateHeap+0x2da1|je 0x77177ace|eflags=0x246 | |
| 0x77177ace ntdll.dll:RtlAllocateHeap+0x2dde|mov eax, 0x7ffe0388 | |
| 0x77177ad3 ntdll.dll:RtlAllocateHeap+0x2de3|cmp byte ptr [eax], 0|eax=0x7ffe0388 | |
| 0x77177ad6 ntdll.dll:RtlAllocateHeap+0x2de6|je 0x77177af7|eflags=0x246 | |
| 0x77177af7 ntdll.dll:RtlAllocateHeap+0x2e07|mov eax, dword ptr [ebp - 0x5c]|ebp=0x19fcb8 | |
| 0x77177afa ntdll.dll:RtlAllocateHeap+0x2e0a|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fcb8 | |
| 0x77177afd ntdll.dll:RtlAllocateHeap+0x2e0d|mov dword ptr fs:[0], ecx|ecx=0x19fe48 | |
| 0x77177b04 ntdll.dll:RtlAllocateHeap+0x2e14|pop ecx|ecx=0x19fe48|esp=0x19fb38 | |
| 0x77177b05 ntdll.dll:RtlAllocateHeap+0x2e15|pop edi|edi=0x820000|esp=0x19fb3c | |
| 0x77177b06 ntdll.dll:RtlAllocateHeap+0x2e16|pop esi|esi=0x28|esp=0x19fb40 | |
| 0x77177b07 ntdll.dll:RtlAllocateHeap+0x2e17|pop ebx|ebx=0x82b440|esp=0x19fb44 | |
| 0x77177b08 ntdll.dll:RtlAllocateHeap+0x2e18|mov esp, ebp|ebp=0x19fcb8 | |
| 0x77177b0a ntdll.dll:RtlAllocateHeap+0x2e1a|pop ebp|ebp=0x19fcb8|esp=0x19fcb8 | |
| 0x77177b0b ntdll.dll:RtlAllocateHeap+0x2e1b|ret 0x10|esp=0x19fcbc | |
| 0x77175d0f ntdll.dll:RtlAllocateHeap+0x101f|mov edi, eax|eax=0x82b440 | |
| 0x77175d11 ntdll.dll:RtlAllocateHeap+0x1021|test edi, edi|edi=0x82b440 | |
| 0x77175d13 ntdll.dll:RtlAllocateHeap+0x1023|je 0x77175d5a|eflags=0x202 | |
| 0x77175d15 ntdll.dll:RtlAllocateHeap+0x1025|mov ecx, dword ptr [ebp - 0x14]|ebp=0x19fd48 | |
| 0x77175d18 ntdll.dll:RtlAllocateHeap+0x1028|mov edx, dword ptr [ebp - 0x48]|ebp=0x19fd48 | |
| 0x77175d1b ntdll.dll:RtlAllocateHeap+0x102b|test edx, edx|edx=0x0 | |
| 0x77175d1d ntdll.dll:RtlAllocateHeap+0x102d|je 0x77175d97|eflags=0x246 | |
| 0x77175d97 ntdll.dll:RtlAllocateHeap+0x10a7|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fd48 | |
| 0x77175d9a ntdll.dll:RtlAllocateHeap+0x10aa|mov eax, dword ptr fs:[0x30] | |
| 0x77175da0 ntdll.dll:RtlAllocateHeap+0x10b0|mov eax, dword ptr [eax + 0x50]|eax=0x2a3000 | |
| 0x77175da3 ntdll.dll:RtlAllocateHeap+0x10b3|test eax, eax|eax=0x0 | |
| 0x77175da5 ntdll.dll:RtlAllocateHeap+0x10b5|je 0x77175dbc|eflags=0x246 | |
| 0x77175dbc ntdll.dll:RtlAllocateHeap+0x10cc|mov eax, 0x7ffe0380 | |
| 0x77175dc1 ntdll.dll:RtlAllocateHeap+0x10d1|cmp byte ptr [eax], 0|eax=0x7ffe0380 | |
| 0x77175dc4 ntdll.dll:RtlAllocateHeap+0x10d4|je 0x77175e5c|eflags=0x246 | |
| 0x77175e5c ntdll.dll:RtlAllocateHeap+0x116c|mov eax, dword ptr [0x77259694] | |
| 0x77175e61 ntdll.dll:RtlAllocateHeap+0x1171|test al, 1|al=0x0 | |
| 0x77175e63 ntdll.dll:RtlAllocateHeap+0x1173|je 0x77175ea0|eflags=0x246 | |
| 0x77175ea0 ntdll.dll:RtlAllocateHeap+0x11b0|mov eax, edi|edi=0x82b440 | |
| 0x77175ea2 ntdll.dll:RtlAllocateHeap+0x11b2|pop edi|edi=0x82b440|esp=0x19fcd0 | |
| 0x77175ea3 ntdll.dll:RtlAllocateHeap+0x11b3|pop esi|esi=0x28|esp=0x19fcd4 | |
| 0x77175ea4 ntdll.dll:RtlAllocateHeap+0x11b4|pop ebx|ebx=0x820000|esp=0x19fcd8 | |
| 0x77175ea5 ntdll.dll:RtlAllocateHeap+0x11b5|mov esp, ebp|ebp=0x19fd48 | |
| 0x77175ea7 ntdll.dll:RtlAllocateHeap+0x11b7|pop ebp|ebp=0x19fd48|esp=0x19fd48 | |
| 0x77175ea8 ntdll.dll:RtlAllocateHeap+0x11b8|ret 8|esp=0x19fd4c | |
| 0x77174d2e ntdll.dll:RtlAllocateHeap+0x3e|pop esi|esi=0x820000|esp=0x19fd58 | |
| 0x77174d2f ntdll.dll:RtlAllocateHeap+0x3f|mov esp, ebp|ebp=0x19fd64 | |
| 0x77174d31 ntdll.dll:RtlAllocateHeap+0x41|pop ebp|ebp=0x19fd64|esp=0x19fd64 | |
| 0x77174d32 ntdll.dll:RtlAllocateHeap+0x42|ret 0xc|esp=0x19fd68 | |
| 0x40aebc handletest_x86.exe|test eax, eax|eax=0x82b440 | |
| 0x40aebe handletest_x86.exe|je 0x40ae99|eflags=0x202 | |
| 0x40aec0 handletest_x86.exe|jmp 0x40aecf | |
| 0x40aecf handletest_x86.exe|pop esi|esi=0x20|esp=0x19fd78 | |
| 0x40aed0 handletest_x86.exe|pop ebp|ebp=0x19fd7c|esp=0x19fd7c | |
| 0x40aed1 handletest_x86.exe|ret|esp=0x19fd80 | |
| 0x40cb58 handletest_x86.exe|pop ecx|ecx=0x0|esp=0x19fd84 | |
| 0x40cb59 handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19fd88 | |
| 0x40cb5c handletest_x86.exe|mov dword ptr [ecx], eax|ecx=0x19fdf4|eax=0x82b440 | |
| 0x40cb5e handletest_x86.exe|neg eax|eax=0x82b440 | |
| 0x40cb60 handletest_x86.exe|sbb eax, eax|eax=0xff7d4bc0|eflags=0x287 | |
| 0x40cb62 handletest_x86.exe|and eax, 0xfffffff4|eax=0xffffffff | |
| 0x40cb65 handletest_x86.exe|add eax, 0xc|eax=0xfffffff4 | |
| 0x40cb68 handletest_x86.exe|pop ebp|ebp=0x19fd88|esp=0x19fd88 | |
| 0x40cb69 handletest_x86.exe|ret|esp=0x19fd8c | |
| 0x40cb2b handletest_x86.exe|add esp, 0xc|esp=0x19fd90 | |
| 0x40cb2e handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x40cb30 handletest_x86.exe|je 0x40cb3c|eflags=0x246 | |
| 0x40cb3c handletest_x86.exe|mov byte ptr [esi + 0x14], 1|esi=0x19fdec | |
| 0x40cb40 handletest_x86.exe|xor eax, eax|eax=0x0 | |
| 0x40cb42 handletest_x86.exe|mov dword ptr [esi + 0xc], edi|esi=0x19fdec|edi=0x10 | |
| 0x40cb45 handletest_x86.exe|pop edi|edi=0x10|esp=0x19fd9c | |
| 0x40cb46 handletest_x86.exe|pop esi|esi=0x19fdec|esp=0x19fda0 | |
| 0x40cb47 handletest_x86.exe|pop ebp|ebp=0x19fda4|esp=0x19fda4 | |
| 0x40cb48 handletest_x86.exe|ret 4|esp=0x19fda8 | |
| 0x40c3ea handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x40c3ec handletest_x86.exe|jne 0x40c40e|eflags=0x246 | |
| 0x40c3ee handletest_x86.exe|push dword ptr [edi + 0xc]|edi=0x19fdec|esp=0x19fdb0 | |
| 0x40c3f1 handletest_x86.exe|push dword ptr [edi + 8]|edi=0x19fdec|esp=0x19fdac | |
| 0x40c3f4 handletest_x86.exe|push -1|esp=0x19fda8 | |
| 0x40c3f6 handletest_x86.exe|push esi|esi=0x41e9a8|esp=0x19fda4 | |
| 0x40c3f7 handletest_x86.exe|push 9|esp=0x19fda0 | |
| 0x40c3f9 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fdb8|esp=0x19fd9c | |
| 0x40c3fc handletest_x86.exe|call 0x40d5e8|esp=0x19fd98|eip=0x40c3fc | |
| 0x40d5e8 handletest_x86.exe|mov edi, edi|edi=0x19fdec | |
| 0x40d5ea handletest_x86.exe|push ebp|ebp=0x19fdb8|esp=0x19fd94 | |
| 0x40d5eb handletest_x86.exe|mov ebp, esp|esp=0x19fd90 | |
| 0x40d5ed handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fd90 | |
| 0x40d5f0 handletest_x86.exe|mov ecx, 0xc435 | |
| 0x40d5f5 handletest_x86.exe|cmp eax, ecx|eax=0x0|ecx=0xc435 | |
| 0x40d5f7 handletest_x86.exe|ja 0x40d621|eflags=0x293 | |
| 0x40d5f9 handletest_x86.exe|je 0x40d660|eflags=0x293 | |
| 0x40d5fb handletest_x86.exe|cmp eax, 0x2a|eax=0x0 | |
| 0x40d5fe handletest_x86.exe|je 0x40d660|eflags=0x293 | |
| 0x40d600 handletest_x86.exe|cmp eax, 0xc42b|eax=0x0 | |
| 0x40d605 handletest_x86.exe|jbe 0x40d61c|eflags=0x293 | |
| 0x40d61c handletest_x86.exe|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19fd90 | |
| 0x40d61f handletest_x86.exe|jmp 0x40d64a | |
| 0x40d64a handletest_x86.exe|push dword ptr [ebp + 0x1c]|ebp=0x19fd90|esp=0x19fd90 | |
| 0x40d64d handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fd90|esp=0x19fd8c | |
| 0x40d650 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fd90|esp=0x19fd88 | |
| 0x40d653 handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fd90|esp=0x19fd84 | |
| 0x40d656 handletest_x86.exe|push ecx|ecx=0x9|esp=0x19fd80 | |
| 0x40d657 handletest_x86.exe|push eax|eax=0x0|esp=0x19fd7c | |
| 0x40d658 handletest_x86.exe|call dword ptr [0x4170d4]|esp=0x19fd78 | |
| 0x75c54340 kernel32.dll:MultiByteToWideChar|mov edi, edi|edi=0x19fdec | |
| 0x75c54342 kernel32.dll:MultiByteToWideChar+0x2|push ebp|ebp=0x19fd90|esp=0x19fd74 | |
| 0x75c54343 kernel32.dll:MultiByteToWideChar+0x3|mov ebp, esp|esp=0x19fd70 | |
| 0x75c54345 kernel32.dll:MultiByteToWideChar+0x5|pop ebp|ebp=0x19fd70|esp=0x19fd70 | |
| 0x75c54346 kernel32.dll:MultiByteToWideChar+0x6|jmp dword ptr [0x75cc1800] | |
| 0x76f74470 kernelbase.dll:MultiByteToWideChar|mov edi, edi|edi=0x19fdec | |
| 0x76f74472 kernelbase.dll:MultiByteToWideChar+0x2|push ebp|ebp=0x19fd90|esp=0x19fd74 | |
| 0x76f74473 kernelbase.dll:MultiByteToWideChar+0x3|mov ebp, esp|esp=0x19fd70 | |
| 0x76f74475 kernelbase.dll:MultiByteToWideChar+0x5|sub esp, 0xf4|esp=0x19fd70 | |
| 0x76f7447b kernelbase.dll:MultiByteToWideChar+0xb|mov eax, dword ptr [0x77065bd0] | |
| 0x76f74480 kernelbase.dll:MultiByteToWideChar+0x10|xor eax, ebp|eax=0x92df5544|ebp=0x19fd70 | |
| 0x76f74482 kernelbase.dll:MultiByteToWideChar+0x12|mov dword ptr [ebp - 4], eax|ebp=0x19fd70|eax=0x92c6a834 | |
| 0x76f74485 kernelbase.dll:MultiByteToWideChar+0x15|mov eax, dword ptr [ebp + 0x18]|ebp=0x19fd70 | |
| 0x76f74488 kernelbase.dll:MultiByteToWideChar+0x18|mov edx, dword ptr [ebp + 8]|ebp=0x19fd70 | |
| 0x76f7448b kernelbase.dll:MultiByteToWideChar+0x1b|mov ecx, dword ptr [ebp + 0x14]|ebp=0x19fd70 | |
| 0x76f7448e kernelbase.dll:MultiByteToWideChar+0x1e|push ebx|ebx=0x2a3000|esp=0x19fc7c | |
| 0x76f7448f kernelbase.dll:MultiByteToWideChar+0x1f|push esi|esi=0x41e9a8|esp=0x19fc78 | |
| 0x76f74490 kernelbase.dll:MultiByteToWideChar+0x20|mov esi, dword ptr [ebp + 0x10]|ebp=0x19fd70 | |
| 0x76f74493 kernelbase.dll:MultiByteToWideChar+0x23|xor ebx, ebx|ebx=0x2a3000 | |
| 0x76f74495 kernelbase.dll:MultiByteToWideChar+0x25|mov dword ptr [ebp - 0xe4], eax|ebp=0x19fd70|eax=0x82b440 | |
| 0x76f7449b kernelbase.dll:MultiByteToWideChar+0x2b|mov eax, dword ptr [ebp + 0x1c]|ebp=0x19fd70 | |
| 0x76f7449e kernelbase.dll:MultiByteToWideChar+0x2e|mov dword ptr [ebp - 0xc8], ecx|ebp=0x19fd70|ecx=0xffffffff | |
| 0x76f744a4 kernelbase.dll:MultiByteToWideChar+0x34|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x10 | |
| 0x76f744aa kernelbase.dll:MultiByteToWideChar+0x3a|push edi|edi=0x19fdec|esp=0x19fc74 | |
| 0x76f744ab kernelbase.dll:MultiByteToWideChar+0x3b|cmp edx, 0xea60|edx=0x0 | |
| 0x76f744b1 kernelbase.dll:MultiByteToWideChar+0x41|jae 0x76f74773|eflags=0x287 | |
| 0x76f744b7 kernelbase.dll:MultiByteToWideChar+0x47|cmp edx, 0x4b0|edx=0x0 | |
| 0x76f744bd kernelbase.dll:MultiByteToWideChar+0x4d|je 0x76f74765|eflags=0x287 | |
| 0x76f744c3 kernelbase.dll:MultiByteToWideChar+0x53|cmp edx, 0x4b1|edx=0x0 | |
| 0x76f744c9 kernelbase.dll:MultiByteToWideChar+0x59|je 0x76f74757|eflags=0x293 | |
| 0x76f744cf kernelbase.dll:MultiByteToWideChar+0x5f|cmp edx, 0x2ee0|edx=0x0 | |
| 0x76f744d5 kernelbase.dll:MultiByteToWideChar+0x65|je 0x76f74749|eflags=0x283 | |
| 0x76f744db kernelbase.dll:MultiByteToWideChar+0x6b|cmp edx, 0x2ee1|edx=0x0 | |
| 0x76f744e1 kernelbase.dll:MultiByteToWideChar+0x71|je 0x76f7473b|eflags=0x293 | |
| 0x76f744e7 kernelbase.dll:MultiByteToWideChar+0x77|cmp edx, 3|edx=0x0 | |
| 0x76f744ea kernelbase.dll:MultiByteToWideChar+0x7a|jne 0x76f74639|eflags=0x293 | |
| 0x76f74639 kernelbase.dll:MultiByteToWideChar+0x1c9|test edx, edx|edx=0x0 | |
| 0x76f7463b kernelbase.dll:MultiByteToWideChar+0x1cb|jne 0x76f7465d|eflags=0x246 | |
| 0x76f7463d kernelbase.dll:MultiByteToWideChar+0x1cd|mov edx, dword ptr [0x77065c10] | |
| 0x76f74643 kernelbase.dll:MultiByteToWideChar+0x1d3|mov edi, dword ptr [0x77067780] | |
| 0x76f74649 kernelbase.dll:MultiByteToWideChar+0x1d9|mov ecx, dword ptr [ebp - 0xc8]|ebp=0x19fd70 | |
| 0x76f7464f kernelbase.dll:MultiByteToWideChar+0x1df|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74655 kernelbase.dll:MultiByteToWideChar+0x1e5|jmp 0x76f74779 | |
| 0x76f74779 kernelbase.dll:MultiByteToWideChar+0x309|mov dword ptr [ebp - 0xd0], edi|ebp=0x19fd70|edi=0x8273c0 | |
| 0x76f7477f kernelbase.dll:MultiByteToWideChar+0x30f|cmp edx, 0xea60|edx=0x4e4 | |
| 0x76f74785 kernelbase.dll:MultiByteToWideChar+0x315|jae 0x76f751c7|eflags=0x287 | |
| 0x76f7478b kernelbase.dll:MultiByteToWideChar+0x31b|cmp edx, 0x4b0|edx=0x4e4 | |
| 0x76f74791 kernelbase.dll:MultiByteToWideChar+0x321|je 0x76f751c7|eflags=0x202 | |
| 0x76f74797 kernelbase.dll:MultiByteToWideChar+0x327|cmp edx, 0x4b1|edx=0x4e4 | |
| 0x76f7479d kernelbase.dll:MultiByteToWideChar+0x32d|je 0x76f751c7|eflags=0x206 | |
| 0x76f747a3 kernelbase.dll:MultiByteToWideChar+0x333|cmp edx, 0x2ee0|edx=0x4e4 | |
| 0x76f747a9 kernelbase.dll:MultiByteToWideChar+0x339|je 0x76f751c7|eflags=0x283 | |
| 0x76f747af kernelbase.dll:MultiByteToWideChar+0x33f|cmp edx, 0x2ee1|edx=0x4e4 | |
| 0x76f747b5 kernelbase.dll:MultiByteToWideChar+0x345|je 0x76f751c7|eflags=0x287 | |
| 0x76f747bb kernelbase.dll:MultiByteToWideChar+0x34b|test ecx, ecx|ecx=0xffffffff | |
| 0x76f747bd kernelbase.dll:MultiByteToWideChar+0x34d|je 0x76f751ab|eflags=0x286 | |
| 0x76f747c3 kernelbase.dll:MultiByteToWideChar+0x353|test eax, eax|eax=0x10 | |
| 0x76f747c5 kernelbase.dll:MultiByteToWideChar+0x355|js 0x76f751ab|eflags=0x202 | |
| 0x76f747cb kernelbase.dll:MultiByteToWideChar+0x35b|test esi, esi|esi=0x41e9a8 | |
| 0x76f747cd kernelbase.dll:MultiByteToWideChar+0x35d|je 0x76f751ab|eflags=0x202 | |
| 0x76f747d3 kernelbase.dll:MultiByteToWideChar+0x363|test eax, eax|eax=0x10 | |
| 0x76f747d5 kernelbase.dll:MultiByteToWideChar+0x365|je 0x76f747f5|eflags=0x202 | |
| 0x76f747d7 kernelbase.dll:MultiByteToWideChar+0x367|cmp dword ptr [ebp - 0xe4], ebx|ebp=0x19fd70|ebx=0x0 | |
| 0x76f747dd kernelbase.dll:MultiByteToWideChar+0x36d|je 0x76f751ab|eflags=0x202 | |
| 0x76f747e3 kernelbase.dll:MultiByteToWideChar+0x373|mov edi, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f747e9 kernelbase.dll:MultiByteToWideChar+0x379|cmp esi, dword ptr [ebp - 0xe4]|esi=0x41e9a8|ebp=0x19fd70 | |
| 0x76f747ef kernelbase.dll:MultiByteToWideChar+0x37f|je 0x76f751ab|eflags=0x283 | |
| 0x76f747f5 kernelbase.dll:MultiByteToWideChar+0x385|cmp ecx, -1|ecx=0xffffffff | |
| 0x76f747f8 kernelbase.dll:MultiByteToWideChar+0x388|jg 0x76f74833|eflags=0x246 | |
| 0x76f747fa kernelbase.dll:MultiByteToWideChar+0x38a|mov ecx, 0x7fffffff | |
| 0x76f747ff kernelbase.dll:MultiByteToWideChar+0x38f|mov eax, esi|esi=0x41e9a8 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9a8|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9a8 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7fffffff | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9a9|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x202 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9a9 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffe | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9aa|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9aa | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffd | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ab|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ab | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffc | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ac|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x202 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ac | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffb | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ad|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ad | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffffa | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9ae|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9ae | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff9 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9af|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9af | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff8 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b0|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b0 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff7 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b1|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b1 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff6 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b2|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b2 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff5 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b3|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b3 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff4 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b4|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b4 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff3 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b5|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b5 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff2 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x202 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b6|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x206 | |
| 0x76f74805 kernelbase.dll:MultiByteToWideChar+0x395|inc eax|eax=0x41e9b6 | |
| 0x76f74806 kernelbase.dll:MultiByteToWideChar+0x396|sub ecx, 1|ecx=0x7ffffff1 | |
| 0x76f74809 kernelbase.dll:MultiByteToWideChar+0x399|jne 0x76f74801|eflags=0x206 | |
| 0x76f74801 kernelbase.dll:MultiByteToWideChar+0x391|cmp byte ptr [eax], bl|eax=0x41e9b7|bl=0x0 | |
| 0x76f74803 kernelbase.dll:MultiByteToWideChar+0x393|je 0x76f7480b|eflags=0x246 | |
| 0x76f7480b kernelbase.dll:MultiByteToWideChar+0x39b|test ecx, ecx|ecx=0x7ffffff0 | |
| 0x76f7480d kernelbase.dll:MultiByteToWideChar+0x39d|je 0x76f751ab|eflags=0x206 | |
| 0x76f74813 kernelbase.dll:MultiByteToWideChar+0x3a3|mov eax, 0x7fffffff | |
| 0x76f74818 kernelbase.dll:MultiByteToWideChar+0x3a8|sub eax, ecx|eax=0x7fffffff|ecx=0x7ffffff0 | |
| 0x76f7481a kernelbase.dll:MultiByteToWideChar+0x3aa|neg ecx|ecx=0x7ffffff0 | |
| 0x76f7481c kernelbase.dll:MultiByteToWideChar+0x3ac|sbb ecx, ecx|ecx=0x80000010|eflags=0x283 | |
| 0x76f7481e kernelbase.dll:MultiByteToWideChar+0x3ae|and ecx, eax|ecx=0xffffffff|eax=0xf | |
| 0x76f74820 kernelbase.dll:MultiByteToWideChar+0x3b0|inc ecx|ecx=0xf | |
| 0x76f74821 kernelbase.dll:MultiByteToWideChar+0x3b1|cmp ecx, 0x7fffffff|ecx=0x10 | |
| 0x76f74827 kernelbase.dll:MultiByteToWideChar+0x3b7|ja 0x76f751ab|eflags=0x297 | |
| 0x76f7482d kernelbase.dll:MultiByteToWideChar+0x3bd|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74833 kernelbase.dll:MultiByteToWideChar+0x3c3|test edi, edi|edi=0x8273c0 | |
| 0x76f74835 kernelbase.dll:MultiByteToWideChar+0x3c5|jne 0x76f748d4|eflags=0x206 | |
| 0x76f748d4 kernelbase.dll:MultiByteToWideChar+0x464|mov eax, dword ptr [edi + 4]|edi=0x8273c0 | |
| 0x76f748d7 kernelbase.dll:MultiByteToWideChar+0x467|test eax, eax|eax=0x0 | |
| 0x76f748d9 kernelbase.dll:MultiByteToWideChar+0x469|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f748df kernelbase.dll:MultiByteToWideChar+0x46f|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f748e5 kernelbase.dll:MultiByteToWideChar+0x475|je 0x76f7492d|eflags=0x246 | |
| 0x76f7492d kernelbase.dll:MultiByteToWideChar+0x4bd|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fd70 | |
| 0x76f74930 kernelbase.dll:MultiByteToWideChar+0x4c0|test eax, 0xfffffff0|eax=0x9 | |
| 0x76f74935 kernelbase.dll:MultiByteToWideChar+0x4c5|jne 0x76f7518c|eflags=0x246 | |
| 0x76f7493b kernelbase.dll:MultiByteToWideChar+0x4cb|and eax, 3|eax=0x9 | |
| 0x76f7493e kernelbase.dll:MultiByteToWideChar+0x4ce|cmp al, 3|al=0x1 | |
| 0x76f74940 kernelbase.dll:MultiByteToWideChar+0x4d0|je 0x76f7518c|eflags=0x293 | |
| 0x76f74946 kernelbase.dll:MultiByteToWideChar+0x4d6|lea edx, [ecx + esi]|ecx=0x10|esi=0x41e9a8 | |
| 0x76f74949 kernelbase.dll:MultiByteToWideChar+0x4d9|mov dword ptr [ebp - 0xdc], edx|ebp=0x19fd70|edx=0x41e9b8 | |
| 0x76f7494f kernelbase.dll:MultiByteToWideChar+0x4df|mov edx, dword ptr [ebp + 0xc]|ebp=0x19fd70 | |
| 0x76f74952 kernelbase.dll:MultiByteToWideChar+0x4e2|mov eax, edx|edx=0x9 | |
| 0x76f74954 kernelbase.dll:MultiByteToWideChar+0x4e4|and eax, 2|eax=0x9 | |
| 0x76f74957 kernelbase.dll:MultiByteToWideChar+0x4e7|mov dword ptr [ebp - 0xc8], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f7495d kernelbase.dll:MultiByteToWideChar+0x4ed|test dl, 4|dl=0x9 | |
| 0x76f74960 kernelbase.dll:MultiByteToWideChar+0x4f0|je 0x76f7496f|eflags=0x246 | |
| 0x76f7496f kernelbase.dll:MultiByteToWideChar+0x4ff|mov eax, dword ptr [edi + 0xc]|edi=0x8273c0 | |
| 0x76f74972 kernelbase.dll:MultiByteToWideChar+0x502|mov dword ptr [ebp - 0xe0], eax|ebp=0x19fd70|eax=0x5d001c | |
| 0x76f74978 kernelbase.dll:MultiByteToWideChar+0x508|and edx, 8|edx=0x9 | |
| 0x76f7497b kernelbase.dll:MultiByteToWideChar+0x50b|mov dword ptr [ebp - 0xd8], edx|ebp=0x19fd70|edx=0x8 | |
| 0x76f74981 kernelbase.dll:MultiByteToWideChar+0x511|mov edx, dword ptr [edi + 8]|edi=0x8273c0 | |
| 0x76f74984 kernelbase.dll:MultiByteToWideChar+0x514|mov dword ptr [ebp - 0xe8], edx|ebp=0x19fd70|edx=0x5d0002 | |
| 0x76f7498a kernelbase.dll:MultiByteToWideChar+0x51a|movzx edx, word ptr [edx + 2]|edx=0x5d0002 | |
| 0x76f7498e kernelbase.dll:MultiByteToWideChar+0x51e|mov dword ptr [ebp - 0xc4], edx|ebp=0x19fd70|edx=0x1 | |
| 0x76f74994 kernelbase.dll:MultiByteToWideChar+0x524|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f7499a kernelbase.dll:MultiByteToWideChar+0x52a|cmp dword ptr [ebp - 0xd4], ebx|ebp=0x19fd70|ebx=0x0 | |
| 0x76f749a0 kernelbase.dll:MultiByteToWideChar+0x530|jne 0x76f74cff|eflags=0x202 | |
| 0x76f74cff kernelbase.dll:MultiByteToWideChar+0x88f|cmp word ptr [ebp - 0xc4], 1|ebp=0x19fd70 | |
| 0x76f74d07 kernelbase.dll:MultiByteToWideChar+0x897|mov edi, dword ptr [ebp - 0xe4]|ebp=0x19fd70 | |
| 0x76f74d0d kernelbase.dll:MultiByteToWideChar+0x89d|mov eax, edi|edi=0x82b440 | |
| 0x76f74d0f kernelbase.dll:MultiByteToWideChar+0x89f|mov ebx, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74d15 kernelbase.dll:MultiByteToWideChar+0x8a5|lea ebx, [eax + ebx*2]|eax=0x82b440|ebx=0x10 | |
| 0x76f74d18 kernelbase.dll:MultiByteToWideChar+0x8a8|mov eax, dword ptr [ebp - 0xe0]|ebp=0x19fd70 | |
| 0x76f74d1e kernelbase.dll:MultiByteToWideChar+0x8ae|jne 0x76f74eb7|eflags=0x246 | |
| 0x76f74d24 kernelbase.dll:MultiByteToWideChar+0x8b4|cmp dword ptr [ebp - 0xc8], 0|ebp=0x19fd70 | |
| 0x76f74d2b kernelbase.dll:MultiByteToWideChar+0x8bb|je 0x76f74db7|eflags=0x246 | |
| 0x76f74db7 kernelbase.dll:MultiByteToWideChar+0x947|cmp dword ptr [ebp - 0xd8], 0|ebp=0x19fd70 | |
| 0x76f74dbe kernelbase.dll:MultiByteToWideChar+0x94e|mov ebx, ecx|ecx=0x10 | |
| 0x76f74dc0 kernelbase.dll:MultiByteToWideChar+0x950|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74dc6 kernelbase.dll:MultiByteToWideChar+0x956|je 0x76f74e82|eflags=0x202 | |
| 0x76f74dcc kernelbase.dll:MultiByteToWideChar+0x95c|cmp eax, ecx|eax=0x10|ecx=0x10 | |
| 0x76f74dce kernelbase.dll:MultiByteToWideChar+0x95e|jge 0x76f74dd2|eflags=0x246 | |
| 0x76f74dd2 kernelbase.dll:MultiByteToWideChar+0x962|mov dword ptr [ebp - 0xd4], ebx|ebp=0x19fd70|ebx=0x10 | |
| 0x76f74dd8 kernelbase.dll:MultiByteToWideChar+0x968|test ebx, ebx|ebx=0x10 | |
| 0x76f74dda kernelbase.dll:MultiByteToWideChar+0x96a|jle 0x76f75168|eflags=0x202 | |
| 0x76f74de0 kernelbase.dll:MultiByteToWideChar+0x970|mov ecx, dword ptr [ebp - 0xe0]|ebp=0x19fd70 | |
| 0x76f74de6 kernelbase.dll:MultiByteToWideChar+0x976|mov dword ptr [ebp - 0xd8], 0xe000|ebp=0x19fd70 | |
| 0x76f74df0 kernelbase.dll:MultiByteToWideChar+0x980|mov dword ptr [ebp - 0xc8], 0xf8ff|ebp=0x19fd70 | |
| 0x76f74dfa kernelbase.dll:MultiByteToWideChar+0x98a|lea ebx, [ebx]|ebx=0x10 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9a8 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x2e | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b440|ax=0x2e | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x2e | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x2e|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x293 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x2e|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9a8 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x10 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b440 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0xf | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0xf | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9a9 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x2f | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b442|ax=0x2f | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x2f | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x2f|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x287 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x2f|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x203 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9a9 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0xf | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b442 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0xe | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0xe | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9aa | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b444|ax=0x74 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x74 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x74|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x74|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9aa | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0xe | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b444 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0xd | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0xd | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9ab | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x65 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b446|ax=0x65 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x65 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x65|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x212 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x65|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9ab | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0xd | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b446 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0xc | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0xc | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9ac | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x73 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b448|ax=0x73 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x73 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x73|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x212 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x73|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x203 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9ac | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0xc | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b448 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0xb | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0xb | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9ad | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b44a|ax=0x74 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x74 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x74|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x74|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9ad | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0xb | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b44a | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0xa | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0xa | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9ae | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x5f | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b44c|ax=0x5f | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x5f | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x5f|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x202 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x5f|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9ae | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0xa | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b44c | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x9 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x9 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9af | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x66 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b44e|ax=0x66 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x66 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x66|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x66|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9af | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x9 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b44e | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x8 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x8 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b0 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x69 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b450|ax=0x69 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x69 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x69|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x212 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x69|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b0 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x8 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b450 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x7 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x7 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b1 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x6c | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b452|ax=0x6c | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x6c | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x6c|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x6c|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b1 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x7 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b452 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x6 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x6 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b2 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x65 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b454|ax=0x65 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x65 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x65|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x212 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x65|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b2 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x6 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b454 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x5 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x5 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b3 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x2e | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b456|ax=0x2e | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x2e | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x2e|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x293 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x2e|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b3 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x5 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b456 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x4 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x4 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b4 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b458|ax=0x74 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x74 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x74|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x74|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b4 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x4 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b458 | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x3 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x3 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x206 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b5 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x78 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b45a|ax=0x78 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x78 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x78|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x78|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b5 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x3 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b45a | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x2 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x2 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b6 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x74 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b45c|ax=0x74 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x74 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x74|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x216 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x74|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b6 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x2 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b45c | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x1 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x1 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x202 | |
| 0x76f74e00 kernelbase.dll:MultiByteToWideChar+0x990|movzx eax, byte ptr [esi]|esi=0x41e9b7 | |
| 0x76f74e03 kernelbase.dll:MultiByteToWideChar+0x993|movzx eax, word ptr [ecx + eax*2]|ecx=0x5d001c|eax=0x0 | |
| 0x76f74e07 kernelbase.dll:MultiByteToWideChar+0x997|mov word ptr [edi], ax|edi=0x82b45e|ax=0x0 | |
| 0x76f74e0a kernelbase.dll:MultiByteToWideChar+0x99a|mov dword ptr [ebp - 0xe8], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f74e10 kernelbase.dll:MultiByteToWideChar+0x9a0|mov eax, dword ptr [ebp - 0xd0]|ebp=0x19fd70 | |
| 0x76f74e16 kernelbase.dll:MultiByteToWideChar+0x9a6|mov eax, dword ptr [eax + 8]|eax=0x8273c0 | |
| 0x76f74e19 kernelbase.dll:MultiByteToWideChar+0x9a9|mov dword ptr [ebp - 0xc4], eax|ebp=0x19fd70|eax=0x5d0002 | |
| 0x76f74e1f kernelbase.dll:MultiByteToWideChar+0x9af|mov edx, eax|eax=0x5d0002 | |
| 0x76f74e21 kernelbase.dll:MultiByteToWideChar+0x9b1|mov eax, dword ptr [ebp - 0xe8]|ebp=0x19fd70 | |
| 0x76f74e27 kernelbase.dll:MultiByteToWideChar+0x9b7|cmp ax, word ptr [edx + 6]|ax=0x0|edx=0x5d0002 | |
| 0x76f74e2b kernelbase.dll:MultiByteToWideChar+0x9bb|mov edx, dword ptr [ebp - 0xdc]|ebp=0x19fd70 | |
| 0x76f74e31 kernelbase.dll:MultiByteToWideChar+0x9c1|jne 0x76f74e52|eflags=0x293 | |
| 0x76f74e52 kernelbase.dll:MultiByteToWideChar+0x9e2|cmp ax, word ptr [ebp - 0xd8]|ax=0x0|ebp=0x19fd70 | |
| 0x76f74e59 kernelbase.dll:MultiByteToWideChar+0x9e9|jb 0x76f74e68|eflags=0x207 | |
| 0x76f74e68 kernelbase.dll:MultiByteToWideChar+0x9f8|mov eax, dword ptr [ebp - 0xd4]|ebp=0x19fd70 | |
| 0x76f74e6e kernelbase.dll:MultiByteToWideChar+0x9fe|inc esi|esi=0x41e9b7 | |
| 0x76f74e6f kernelbase.dll:MultiByteToWideChar+0x9ff|dec eax|eax=0x1 | |
| 0x76f74e70 kernelbase.dll:MultiByteToWideChar+0xa00|add edi, 2|edi=0x82b45e | |
| 0x76f74e73 kernelbase.dll:MultiByteToWideChar+0xa03|mov dword ptr [ebp - 0xd4], eax|ebp=0x19fd70|eax=0x0 | |
| 0x76f74e79 kernelbase.dll:MultiByteToWideChar+0xa09|test eax, eax|eax=0x0 | |
| 0x76f74e7b kernelbase.dll:MultiByteToWideChar+0xa0b|jg 0x76f74e00|eflags=0x246 | |
| 0x76f74e7d kernelbase.dll:MultiByteToWideChar+0xa0d|jmp 0x76f75168 | |
| 0x76f75168 kernelbase.dll:MultiByteToWideChar+0xcf8|cmp esi, edx|esi=0x41e9b8|edx=0x41e9b8 | |
| 0x76f7516a kernelbase.dll:MultiByteToWideChar+0xcfa|jae 0x76f749fb|eflags=0x246 | |
| 0x76f749fb kernelbase.dll:MultiByteToWideChar+0x58b|mov eax, ebx|ebx=0x10 | |
| 0x76f749fd kernelbase.dll:MultiByteToWideChar+0x58d|pop edi|edi=0x82b460|esp=0x19fc70 | |
| 0x76f749fe kernelbase.dll:MultiByteToWideChar+0x58e|pop esi|esi=0x41e9b8|esp=0x19fc74 | |
| 0x76f749ff kernelbase.dll:MultiByteToWideChar+0x58f|pop ebx|ebx=0x10|esp=0x19fc78 | |
| 0x76f74a00 kernelbase.dll:MultiByteToWideChar+0x590|mov ecx, dword ptr [ebp - 4]|ebp=0x19fd70 | |
| 0x76f74a03 kernelbase.dll:MultiByteToWideChar+0x593|xor ecx, ebp|ecx=0x92c6a834|ebp=0x19fd70 | |
| 0x76f74a05 kernelbase.dll:MultiByteToWideChar+0x595|call 0x76fa8b52|esp=0x19fc7c|eip=0x76f74a05 | |
| 0x76fa8b52 kernelbase.dll:CreateIoCompletionPort+0x72|cmp ecx, dword ptr [0x77065bd0]|ecx=0x92df5544 | |
| 0x76fa8b58 kernelbase.dll:CreateIoCompletionPort+0x78|jne 0x76fa8b5d|eflags=0x246 | |
| 0x76fa8b5a kernelbase.dll:CreateIoCompletionPort+0x7a|ret 0|esp=0x19fc78 | |
| 0x76f74a0a kernelbase.dll:MultiByteToWideChar+0x59a|mov esp, ebp|ebp=0x19fd70 | |
| 0x76f74a0c kernelbase.dll:MultiByteToWideChar+0x59c|pop ebp|ebp=0x19fd70|esp=0x19fd70 | |
| 0x76f74a0d kernelbase.dll:MultiByteToWideChar+0x59d|ret 0x18|esp=0x19fd74 | |
| 0x40d65e handletest_x86.exe|pop ebp|ebp=0x19fd90|esp=0x19fd90 | |
| 0x40d65f handletest_x86.exe|ret|esp=0x19fd94 | |
| 0x40c401 handletest_x86.exe|add esp, 0x18|esp=0x19fd98 | |
| 0x40c404 handletest_x86.exe|test eax, eax|eax=0x10 | |
| 0x40c406 handletest_x86.exe|je 0x40c3c4|eflags=0x202 | |
| 0x40c408 handletest_x86.exe|dec eax|eax=0x10 | |
| 0x40c409 handletest_x86.exe|mov dword ptr [edi + 0x10], eax|edi=0x19fdec|eax=0xf | |
| 0x40c40c handletest_x86.exe|xor eax, eax|eax=0xf | |
| 0x40c40e handletest_x86.exe|pop edi|edi=0x19fdec|esp=0x19fdb0 | |
| 0x40c40f handletest_x86.exe|pop esi|esi=0x41e9a8|esp=0x19fdb4 | |
| 0x40c410 handletest_x86.exe|pop ebp|ebp=0x19fdb8|esp=0x19fdb8 | |
| 0x40c411 handletest_x86.exe|ret|esp=0x19fdbc | |
| 0x40c4f0 handletest_x86.exe|add esp, 0x10|esp=0x19fdc0 | |
| 0x40c4f3 handletest_x86.exe|leave|ebp=0x19fdd4|esp=0x19fdd0 | |
| 0x40c4f4 handletest_x86.exe|ret|esp=0x19fdd8 | |
| 0x40f97f handletest_x86.exe|add esp, 0xc|esp=0x19fddc | |
| 0x40f982 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x40f984 handletest_x86.exe|je 0x40f98b|eflags=0x246 | |
| 0x40f98b handletest_x86.exe|push dword ptr [ebp + 0x20]|ebp=0x19fe04|esp=0x19fde8 | |
| 0x40f98e handletest_x86.exe|push dword ptr [ebp + 0x1c]|ebp=0x19fe04|esp=0x19fde4 | |
| 0x40f991 handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fe04|esp=0x19fde0 | |
| 0x40f994 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fe04|esp=0x19fddc | |
| 0x40f997 handletest_x86.exe|push dword ptr [ebp - 0x10]|ebp=0x19fe04|esp=0x19fdd8 | |
| 0x40f99a handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fe04|esp=0x19fdd4 | |
| 0x40f99d handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fe04|esp=0x19fdd0 | |
| 0x40f9a0 handletest_x86.exe|call 0x40f9de|esp=0x19fdcc|eip=0x40f9a0 | |
| 0x40f9de handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40f9e0 handletest_x86.exe|push ebp|ebp=0x19fe04|esp=0x19fdc8 | |
| 0x40f9e1 handletest_x86.exe|mov ebp, esp|esp=0x19fdc4 | |
| 0x40f9e3 handletest_x86.exe|sub esp, 0x48|esp=0x19fdc4 | |
| 0x40f9e6 handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fd7c | |
| 0x40f9e7 handletest_x86.exe|push esi|esi=0x19feac|esp=0x19fd78 | |
| 0x40f9e8 handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fd74 | |
| 0x40f9e9 handletest_x86.exe|push dword ptr [ebp + 0x1c]|ebp=0x19fdc4|esp=0x19fd70 | |
| 0x40f9ec handletest_x86.exe|lea eax, [ebp - 0x48]|ebp=0x19fdc4 | |
| 0x40f9ef handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fdc4|esp=0x19fd6c | |
| 0x40f9f2 handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fdc4|esp=0x19fd68 | |
| 0x40f9f5 handletest_x86.exe|push eax|eax=0x19fd7c|esp=0x19fd64 | |
| 0x40f9f6 handletest_x86.exe|call 0x40f72c|esp=0x19fd60|eip=0x40f9f6 | |
| 0x40f72c handletest_x86.exe|mov edi, edi|edi=0x41e9b8 | |
| 0x40f72e handletest_x86.exe|push ebp|ebp=0x19fdc4|esp=0x19fd5c | |
| 0x40f72f handletest_x86.exe|mov ebp, esp|esp=0x19fd58 | |
| 0x40f731 handletest_x86.exe|push ecx|ecx=0x92df5544|esp=0x19fd58 | |
| 0x40f732 handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fd54 | |
| 0x40f733 handletest_x86.exe|mov ebx, dword ptr [ebp + 0xc]|ebp=0x19fd58 | |
| 0x40f736 handletest_x86.exe|mov eax, ebx|ebx=0x0 | |
| 0x40f738 handletest_x86.exe|push esi|esi=0x19feac|esp=0x19fd50 | |
| 0x40f739 handletest_x86.exe|mov esi, dword ptr [ebp + 8]|ebp=0x19fd58 | |
| 0x40f73c handletest_x86.exe|and eax, 3|eax=0x0 | |
| 0x40f73f handletest_x86.exe|push edi|edi=0x41e9b8|esp=0x19fd4c | |
| 0x40f740 handletest_x86.exe|mov edi, 0x80000000 | |
| 0x40f745 handletest_x86.exe|mov byte ptr [esi], 0|esi=0x19fd7c | |
| 0x40f748 handletest_x86.exe|sub eax, 0|eax=0x0 | |
| 0x40f74b handletest_x86.exe|je 0x40f794|eflags=0x246 | |
| 0x40f794 handletest_x86.exe|mov eax, edi|edi=0x80000000 | |
| 0x40f796 handletest_x86.exe|push ebx|ebx=0x0|esp=0x19fd48 | |
| 0x40f797 handletest_x86.exe|mov dword ptr [esi + 4], eax|esi=0x19fd7c|eax=0x80000000 | |
| 0x40f79a handletest_x86.exe|call 0x40f6bc|esp=0x19fd44|eip=0x40f79a | |
| 0x40f6bc handletest_x86.exe|mov edi, edi|edi=0x80000000 | |
| 0x40f6be handletest_x86.exe|push ebp|ebp=0x19fd58|esp=0x19fd40 | |
| 0x40f6bf handletest_x86.exe|mov ebp, esp|esp=0x19fd3c | |
| 0x40f6c1 handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fd3c | |
| 0x40f6c4 handletest_x86.exe|mov edx, 0x700 | |
| 0x40f6c9 handletest_x86.exe|and eax, edx|eax=0x0|edx=0x700 | |
| 0x40f6cb handletest_x86.exe|mov ecx, 0x400 | |
| 0x40f6d0 handletest_x86.exe|cmp eax, ecx|eax=0x0|ecx=0x400 | |
| 0x40f6d2 handletest_x86.exe|ja 0x40f6fc|eflags=0x287 | |
| 0x40f6d4 handletest_x86.exe|je 0x40f6f7|eflags=0x287 | |
| 0x40f6d6 handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x40f6d8 handletest_x86.exe|je 0x40f6f7|eflags=0x246 | |
| 0x40f6f7 handletest_x86.exe|push 3|esp=0x19fd3c | |
| 0x40f6f9 handletest_x86.exe|pop eax|eax=0x0|esp=0x19fd38 | |
| 0x40f6fa handletest_x86.exe|pop ebp|ebp=0x19fd3c|esp=0x19fd3c | |
| 0x40f6fb handletest_x86.exe|ret|esp=0x19fd40 | |
| 0x40f79f handletest_x86.exe|pop ecx|ecx=0x400|esp=0x19fd44 | |
| 0x40f7a0 handletest_x86.exe|mov dword ptr [esi + 8], eax|esi=0x19fd7c|eax=0x3 | |
| 0x40f7a3 handletest_x86.exe|mov eax, dword ptr [ebp + 0x10]|ebp=0x19fd58 | |
| 0x40f7a6 handletest_x86.exe|push 0x10|esp=0x19fd48 | |
| 0x40f7a8 handletest_x86.exe|pop ecx|ecx=0x0|esp=0x19fd44 | |
| 0x40f7a9 handletest_x86.exe|sub eax, ecx|eax=0x40|ecx=0x10 | |
| 0x40f7ab handletest_x86.exe|je 0x40f7eb|eflags=0x206 | |
| 0x40f7ad handletest_x86.exe|sub eax, ecx|eax=0x30|ecx=0x10 | |
| 0x40f7af handletest_x86.exe|je 0x40f7e6|eflags=0x202 | |
| 0x40f7b1 handletest_x86.exe|sub eax, ecx|eax=0x20|ecx=0x10 | |
| 0x40f7b3 handletest_x86.exe|je 0x40f7e1|eflags=0x202 | |
| 0x40f7b5 handletest_x86.exe|sub eax, ecx|eax=0x10|ecx=0x10 | |
| 0x40f7b7 handletest_x86.exe|je 0x40f7dd|eflags=0x246 | |
| 0x40f7dd handletest_x86.exe|push 3|esp=0x19fd48 | |
| 0x40f7df handletest_x86.exe|jmp 0x40f7e3 | |
| 0x40f7e3 handletest_x86.exe|pop eax|eax=0x0|esp=0x19fd44 | |
| 0x40f7e4 handletest_x86.exe|jmp 0x40f7ed | |
| 0x40f7ed handletest_x86.exe|and dword ptr [esi + 0x14], 0|esi=0x19fd7c | |
| 0x40f7f1 handletest_x86.exe|mov dword ptr [esi + 0xc], eax|esi=0x19fd7c|eax=0x3 | |
| 0x40f7f4 handletest_x86.exe|mov dword ptr [esi + 0x10], 0x80|esi=0x19fd7c | |
| 0x40f7fb handletest_x86.exe|test bl, bl|bl=0x0 | |
| 0x40f7fd handletest_x86.exe|jns 0x40f802|eflags=0x246 | |
| 0x40f802 handletest_x86.exe|mov edi, 0x8000 | |
| 0x40f807 handletest_x86.exe|test edi, ebx|edi=0x8000|ebx=0x0 | |
| 0x40f809 handletest_x86.exe|jne 0x40f829|eflags=0x246 | |
| 0x40f80b handletest_x86.exe|test ebx, 0x74000|ebx=0x0 | |
| 0x40f811 handletest_x86.exe|jne 0x40f826|eflags=0x246 | |
| 0x40f813 handletest_x86.exe|lea eax, [ebp - 4]|ebp=0x19fd58 | |
| 0x40f816 handletest_x86.exe|push eax|eax=0x19fd54|esp=0x19fd48 | |
| 0x40f817 handletest_x86.exe|call 0x407c1f|esp=0x19fd44|eip=0x40f817 | |
| 0x407c1f handletest_x86.exe|mov edi, edi|edi=0x8000 | |
| 0x407c21 handletest_x86.exe|push ebp|ebp=0x19fd58|esp=0x19fd40 | |
| 0x407c22 handletest_x86.exe|mov ebp, esp|esp=0x19fd3c | |
| 0x407c24 handletest_x86.exe|mov ecx, dword ptr [ebp + 8]|ebp=0x19fd3c | |
| 0x407c27 handletest_x86.exe|test ecx, ecx|ecx=0x19fd54 | |
| 0x407c29 handletest_x86.exe|jne 0x407c40|eflags=0x202 | |
| 0x407c40 handletest_x86.exe|mov eax, dword ptr [0x41f404] | |
| 0x407c45 handletest_x86.exe|nop | |
| 0x407c46 handletest_x86.exe|mov dword ptr [ecx], eax|ecx=0x19fd54|eax=0x4000 | |
| 0x407c48 handletest_x86.exe|xor eax, eax|eax=0x4000 | |
| 0x407c4a handletest_x86.exe|pop ebp|ebp=0x19fd3c|esp=0x19fd3c | |
| 0x407c4b handletest_x86.exe|ret|esp=0x19fd40 | |
| 0x40f81c handletest_x86.exe|pop ecx|ecx=0x19fd54|esp=0x19fd44 | |
| 0x40f81d handletest_x86.exe|test eax, eax|eax=0x0 | |
| 0x40f81f handletest_x86.exe|jne 0x40f899|eflags=0x246 | |
| 0x40f821 handletest_x86.exe|cmp dword ptr [ebp - 4], edi|ebp=0x19fd58|edi=0x8000 | |
| 0x40f824 handletest_x86.exe|je 0x40f829|eflags=0x287 | |
| 0x40f826 handletest_x86.exe|or byte ptr [esi], 0x80|esi=0x19fd7c | |
| 0x40f829 handletest_x86.exe|mov ecx, 0x100 | |
| 0x40f82e handletest_x86.exe|test ecx, ebx|ecx=0x100|ebx=0x0 | |
| 0x40f830 handletest_x86.exe|je 0x40f847|eflags=0x246 | |
| 0x40f847 handletest_x86.exe|test bl, 0x40|bl=0x0 | |
| 0x40f84a handletest_x86.exe|je 0x40f85e|eflags=0x246 | |
| 0x40f85e handletest_x86.exe|test ebx, 0x1000|ebx=0x0 | |
| 0x40f864 handletest_x86.exe|je 0x40f869|eflags=0x246 | |
| 0x40f869 handletest_x86.exe|test ebx, 0x2000|ebx=0x0 | |
| 0x40f86f handletest_x86.exe|je 0x40f878|eflags=0x246 | |
| 0x40f878 handletest_x86.exe|test bl, 0x20|bl=0x0 | |
| 0x40f87b handletest_x86.exe|je 0x40f886|eflags=0x246 | |
| 0x40f886 handletest_x86.exe|test bl, 0x10|bl=0x0 | |
| 0x40f889 handletest_x86.exe|je 0x40f892|eflags=0x246 | |
| 0x40f892 handletest_x86.exe|pop edi|edi=0x8000|esp=0x19fd48 | |
| 0x40f893 handletest_x86.exe|mov eax, esi|esi=0x19fd7c | |
| 0x40f895 handletest_x86.exe|pop esi|esi=0x19fd7c|esp=0x19fd4c | |
| 0x40f896 handletest_x86.exe|pop ebx|ebx=0x0|esp=0x19fd50 | |
| 0x40f897 handletest_x86.exe|leave|ebp=0x19fd58|esp=0x19fd54 | |
| 0x40f898 handletest_x86.exe|ret|esp=0x19fd5c | |
| 0x40f9fb handletest_x86.exe|add esp, 0x10|esp=0x19fd60 | |
| 0x40f9fe handletest_x86.exe|lea edi, [ebp - 0x30]|ebp=0x19fdc4 | |
| 0x40fa01 handletest_x86.exe|mov esi, eax|eax=0x19fd7c | |
| 0x40fa03 handletest_x86.exe|push 6|esp=0x19fd70 | |
| 0x40fa05 handletest_x86.exe|pop ecx|ecx=0x100|esp=0x19fd6c | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd94|esi=0x19fd7c|eflags=0x202|ecx=0x6 | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd98|esi=0x19fd80|eflags=0x202|ecx=0x5 | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd9c|esi=0x19fd84|eflags=0x202|ecx=0x4 | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fda0|esi=0x19fd88|eflags=0x202|ecx=0x3 | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fda4|esi=0x19fd8c|eflags=0x202|ecx=0x2 | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fda8|esi=0x19fd90|eflags=0x202|ecx=0x1 | |
| 0x40fa06 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fdac|esi=0x19fd94|eflags=0x202|ecx=0x0 | |
| 0x40fa08 handletest_x86.exe|or esi, 0xffffffff|esi=0x19fd94 | |
| 0x40fa0b handletest_x86.exe|cmp dword ptr [ebp - 0x24], esi|ebp=0x19fdc4|esi=0xffffffff | |
| 0x40fa0e handletest_x86.exe|jne 0x40fa29|eflags=0x213 | |
| 0x40fa29 handletest_x86.exe|call 0x40de71|esp=0x19fd70|eip=0x40fa29 | |
| 0x40de71 handletest_x86.exe|push 0x1c|esp=0x19fd6c | |
| 0x40de73 handletest_x86.exe|push 0x41d460|esp=0x19fd68 | |
| 0x40de78 handletest_x86.exe|call 0x401d60|esp=0x19fd64|eip=0x40de78 | |
| 0x401d60 handletest_x86.exe|push 0x401fd0|esp=0x19fd60 | |
| 0x401d65 handletest_x86.exe|push dword ptr fs:[0]|esp=0x19fd5c | |
| 0x401d6c handletest_x86.exe|mov eax, dword ptr [esp + 0x10]|esp=0x19fd58 | |
| 0x401d70 handletest_x86.exe|mov dword ptr [esp + 0x10], ebp|esp=0x19fd58|ebp=0x19fdc4 | |
| 0x401d74 handletest_x86.exe|lea ebp, [esp + 0x10]|esp=0x19fd58 | |
| 0x401d78 handletest_x86.exe|sub esp, eax|esp=0x19fd58|eax=0x1c | |
| 0x401d7a handletest_x86.exe|push ebx|ebx=0x2a3000|esp=0x19fd3c | |
| 0x401d7b handletest_x86.exe|push esi|esi=0xffffffff|esp=0x19fd38 | |
| 0x401d7c handletest_x86.exe|push edi|edi=0x19fdac|esp=0x19fd34 | |
| 0x401d7d handletest_x86.exe|mov eax, dword ptr [0x41e004] | |
| 0x401d82 handletest_x86.exe|xor dword ptr [ebp - 4], eax|ebp=0x19fd68|eax=0x666841b4 | |
| 0x401d85 handletest_x86.exe|xor eax, ebp|eax=0x666841b4|ebp=0x19fd68 | |
| 0x401d87 handletest_x86.exe|push eax|eax=0x6671bcdc|esp=0x19fd30 | |
| 0x401d88 handletest_x86.exe|mov dword ptr [ebp - 0x18], esp|ebp=0x19fd68|esp=0x19fd2c | |
| 0x401d8b handletest_x86.exe|push dword ptr [ebp - 8]|ebp=0x19fd68|esp=0x19fd2c | |
| 0x401d8e handletest_x86.exe|mov eax, dword ptr [ebp - 4]|ebp=0x19fd68 | |
| 0x401d91 handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fd68 | |
| 0x401d98 handletest_x86.exe|mov dword ptr [ebp - 8], eax|ebp=0x19fd68|eax=0x662995d4 | |
| 0x401d9b handletest_x86.exe|lea eax, [ebp - 0x10]|ebp=0x19fd68 | |
| 0x401d9e handletest_x86.exe|mov dword ptr fs:[0], eax|eax=0x19fd58 | |
| 0x401da4 handletest_x86.exe|ret|esp=0x19fd28 | |
| 0x40de7d handletest_x86.exe|push 7|esp=0x19fd2c | |
| 0x40de7f handletest_x86.exe|call 0x40dbbb|esp=0x19fd28|eip=0x40de7f | |
| 0x40dbbb handletest_x86.exe|mov edi, edi|edi=0x19fdac | |
| 0x40dbbd handletest_x86.exe|push ebp|ebp=0x19fd68|esp=0x19fd24 | |
| 0x40dbbe handletest_x86.exe|mov ebp, esp|esp=0x19fd20 | |
| 0x40dbc0 handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x18|eax=0x19fd58|ebp=0x19fd20 | |
| 0x40dbc4 handletest_x86.exe|add eax, 0x41f2b0|eax=0xa8 | |
| 0x40dbc9 handletest_x86.exe|push eax|eax=0x41f358|esp=0x19fd20 | |
| 0x40dbca handletest_x86.exe|call dword ptr [0x417040]|esp=0x19fd1c | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x19fdac | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19fd20|esp=0x19fd18 | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fd14 | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19fd14 | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19fd14 | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x41f358 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x41f35c | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa03 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x41f358|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x41f358 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19fd14 | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19fd14|esp=0x19fd14 | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19fd18 | |
| 0x40dbd0 handletest_x86.exe|pop ebp|ebp=0x19fd20|esp=0x19fd20 | |
| 0x40dbd1 handletest_x86.exe|ret|esp=0x19fd24 | |
| 0x40de84 handletest_x86.exe|pop ecx|ecx=0x41f358|esp=0x19fd28 | |
| 0x40de85 handletest_x86.exe|or ebx, 0xffffffff|ebx=0x2a3000 | |
| 0x40de88 handletest_x86.exe|mov dword ptr [ebp - 0x1c], ebx|ebp=0x19fd68|ebx=0xffffffff | |
| 0x40de8b handletest_x86.exe|xor edi, edi|edi=0x19fdac | |
| 0x40de8d handletest_x86.exe|mov dword ptr [ebp - 4], edi|ebp=0x19fd68|edi=0x0 | |
| 0x40de90 handletest_x86.exe|mov dword ptr [ebp - 0x2c], edi|ebp=0x19fd68|edi=0x0 | |
| 0x40de93 handletest_x86.exe|cmp edi, 0x80|edi=0x0 | |
| 0x40de99 handletest_x86.exe|jge 0x40dedf|eflags=0x283 | |
| 0x40de9b handletest_x86.exe|mov eax, dword ptr [edi*4 + 0x41efa8]|edi=0x0 | |
| 0x40dea2 handletest_x86.exe|mov dword ptr [ebp - 0x28], eax|ebp=0x19fd68|eax=0x827ed8 | |
| 0x40dea5 handletest_x86.exe|test eax, eax|eax=0x827ed8 | |
| 0x40dea7 handletest_x86.exe|jne 0x40defd|eflags=0x206 | |
| 0x40defd handletest_x86.exe|lea ecx, [eax + 0xe00]|eax=0x827ed8 | |
| 0x40df03 handletest_x86.exe|mov dword ptr [ebp - 0x20], ecx|ebp=0x19fd68|ecx=0x828cd8 | |
| 0x40df06 handletest_x86.exe|mov esi, eax|eax=0x827ed8 | |
| 0x40df08 handletest_x86.exe|push 0x38|esp=0x19fd2c | |
| 0x40df0a handletest_x86.exe|pop eax|eax=0x827ed8|esp=0x19fd28 | |
| 0x40df0b handletest_x86.exe|mov dword ptr [ebp - 0x24], esi|ebp=0x19fd68|esi=0x827ed8 | |
| 0x40df0e handletest_x86.exe|cmp esi, ecx|esi=0x827ed8|ecx=0x828cd8 | |
| 0x40df10 handletest_x86.exe|je 0x40df72|eflags=0x287 | |
| 0x40df12 handletest_x86.exe|test byte ptr [esi + 0x28], 1|esi=0x827ed8 | |
| 0x40df16 handletest_x86.exe|jne 0x40df32|eflags=0x202 | |
| 0x40df32 handletest_x86.exe|add esi, eax|esi=0x827ed8|eax=0x38 | |
| 0x40df34 handletest_x86.exe|jmp 0x40df0b | |
| 0x40df0b handletest_x86.exe|mov dword ptr [ebp - 0x24], esi|ebp=0x19fd68|esi=0x827f10 | |
| 0x40df0e handletest_x86.exe|cmp esi, ecx|esi=0x827f10|ecx=0x828cd8 | |
| 0x40df10 handletest_x86.exe|je 0x40df72|eflags=0x293 | |
| 0x40df12 handletest_x86.exe|test byte ptr [esi + 0x28], 1|esi=0x827f10 | |
| 0x40df16 handletest_x86.exe|jne 0x40df32|eflags=0x202 | |
| 0x40df32 handletest_x86.exe|add esi, eax|esi=0x827f10|eax=0x38 | |
| 0x40df34 handletest_x86.exe|jmp 0x40df0b | |
| 0x40df0b handletest_x86.exe|mov dword ptr [ebp - 0x24], esi|ebp=0x19fd68|esi=0x827f48 | |
| 0x40df0e handletest_x86.exe|cmp esi, ecx|esi=0x827f48|ecx=0x828cd8 | |
| 0x40df10 handletest_x86.exe|je 0x40df72|eflags=0x283 | |
| 0x40df12 handletest_x86.exe|test byte ptr [esi + 0x28], 1|esi=0x827f48 | |
| 0x40df16 handletest_x86.exe|jne 0x40df32|eflags=0x202 | |
| 0x40df32 handletest_x86.exe|add esi, eax|esi=0x827f48|eax=0x38 | |
| 0x40df34 handletest_x86.exe|jmp 0x40df0b | |
| 0x40df0b handletest_x86.exe|mov dword ptr [ebp - 0x24], esi|ebp=0x19fd68|esi=0x827f80 | |
| 0x40df0e handletest_x86.exe|cmp esi, ecx|esi=0x827f80|ecx=0x828cd8 | |
| 0x40df10 handletest_x86.exe|je 0x40df72|eflags=0x293 | |
| 0x40df12 handletest_x86.exe|test byte ptr [esi + 0x28], 1|esi=0x827f80 | |
| 0x40df16 handletest_x86.exe|jne 0x40df32|eflags=0x246 | |
| 0x40df18 handletest_x86.exe|push esi|esi=0x827f80|esp=0x19fd2c | |
| 0x40df19 handletest_x86.exe|call dword ptr [0x417040]|esp=0x19fd28 | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x0 | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19fd68|esp=0x19fd24 | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19fd20 | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19fd20 | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19fd20 | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x827f80 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x827f84 | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa03 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x827f80|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x827f80 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19fd20 | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19fd20|esp=0x19fd20 | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19fd24 | |
| 0x40df1f handletest_x86.exe|test byte ptr [esi + 0x28], 1|esi=0x827f80 | |
| 0x40df23 handletest_x86.exe|je 0x40df36|eflags=0x246 | |
| 0x40df36 handletest_x86.exe|sub esi, dword ptr [ebp - 0x28]|esi=0x827f80|ebp=0x19fd68 | |
| 0x40df39 handletest_x86.exe|mov eax, esi|esi=0xa8 | |
| 0x40df3b handletest_x86.exe|cdq|eax=0xa8 | |
| 0x40df3c handletest_x86.exe|push 0x38|esp=0x19fd2c | |
| 0x40df3e handletest_x86.exe|pop ecx|ecx=0x827f80|esp=0x19fd28 | |
| 0x40df3f handletest_x86.exe|idiv ecx|ecx=0x38|eax=0xa8|edx=0x0 | |
| 0x40df41 handletest_x86.exe|shl edi, 6|edi=0x0 | |
| 0x40df44 handletest_x86.exe|lea esi, [edi + eax]|edi=0x0|eax=0x3 | |
| 0x40df47 handletest_x86.exe|mov edx, esi|esi=0x3 | |
| 0x40df49 handletest_x86.exe|sar edx, 6|edx=0x3 | |
| 0x40df4c handletest_x86.exe|mov ecx, esi|esi=0x3 | |
| 0x40df4e handletest_x86.exe|and ecx, 0x3f|ecx=0x3 | |
| 0x40df51 handletest_x86.exe|imul ecx, ecx, 0x38|ecx=0x3 | |
| 0x40df54 handletest_x86.exe|mov eax, dword ptr [edx*4 + 0x41efa8]|edx=0x0 | |
| 0x40df5b handletest_x86.exe|mov byte ptr [eax + ecx + 0x28], 1|eax=0x827ed8|ecx=0xa8 | |
| 0x40df60 handletest_x86.exe|mov eax, dword ptr [edx*4 + 0x41efa8]|edx=0x0 | |
| 0x40df67 handletest_x86.exe|mov dword ptr [eax + ecx + 0x18], ebx|eax=0x827ed8|ecx=0xa8|ebx=0xffffffff | |
| 0x40df6b handletest_x86.exe|mov ebx, esi|esi=0x3 | |
| 0x40df6d handletest_x86.exe|jmp 0x40dedc | |
| 0x40dedc handletest_x86.exe|mov dword ptr [ebp - 0x1c], ebx|ebp=0x19fd68|ebx=0x3 | |
| 0x40dedf handletest_x86.exe|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19fd68 | |
| 0x40dee6 handletest_x86.exe|call 0x40df7b|esp=0x19fd2c|eip=0x40dee6 | |
| 0x40df7b handletest_x86.exe|push 7|esp=0x19fd28 | |
| 0x40df7d handletest_x86.exe|call 0x40dc03|esp=0x19fd24|eip=0x40df7d | |
| 0x40dc03 handletest_x86.exe|mov edi, edi|edi=0x0 | |
| 0x40dc05 handletest_x86.exe|push ebp|ebp=0x19fd68|esp=0x19fd20 | |
| 0x40dc06 handletest_x86.exe|mov ebp, esp|esp=0x19fd1c | |
| 0x40dc08 handletest_x86.exe|imul eax, dword ptr [ebp + 8], 0x18|eax=0x827ed8|ebp=0x19fd1c | |
| 0x40dc0c handletest_x86.exe|add eax, 0x41f2b0|eax=0xa8 | |
| 0x40dc11 handletest_x86.exe|push eax|eax=0x41f358|esp=0x19fd1c | |
| 0x40dc12 handletest_x86.exe|call dword ptr [0x417044]|esp=0x19fd18 | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x0 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19fd1c|esp=0x19fd14 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19fd10 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19fd10 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0x3|esp=0x19fd08 | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19fd10 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x3|esp=0x19fd04 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x0|esp=0x19fd00 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x41f358 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x41f358 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x41f358 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0xa8 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x41f35c|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x41f35c|esp=0x19fcfc | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19fd00 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x41f358|esp=0x19fd04 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19fd10 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19fd10|esp=0x19fd10 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19fd14 | |
| 0x40dc18 handletest_x86.exe|pop ebp|ebp=0x19fd1c|esp=0x19fd1c | |
| 0x40dc19 handletest_x86.exe|ret|esp=0x19fd20 | |
| 0x40df82 handletest_x86.exe|pop ecx|ecx=0xffffffff|esp=0x19fd24 | |
| 0x40df83 handletest_x86.exe|ret|esp=0x19fd28 | |
| 0x40deeb handletest_x86.exe|mov eax, ebx|ebx=0x3 | |
| 0x40deed handletest_x86.exe|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19fd68 | |
| 0x40def0 handletest_x86.exe|mov dword ptr fs:[0], ecx|ecx=0x19fe48 | |
| 0x40def7 handletest_x86.exe|pop ecx|ecx=0x19fe48|esp=0x19fd2c | |
| 0x40def8 handletest_x86.exe|pop edi|edi=0x0|esp=0x19fd30 | |
| 0x40def9 handletest_x86.exe|pop esi|esi=0x3|esp=0x19fd34 | |
| 0x40defa handletest_x86.exe|pop ebx|ebx=0x3|esp=0x19fd38 | |
| 0x40defb handletest_x86.exe|leave|ebp=0x19fd68|esp=0x19fd3c | |
| 0x40defc handletest_x86.exe|ret|esp=0x19fd6c | |
| 0x40fa2e handletest_x86.exe|mov ebx, dword ptr [ebp + 0xc]|ebp=0x19fdc4 | |
| 0x40fa31 handletest_x86.exe|mov dword ptr [ebx], eax|ebx=0x19feac|eax=0x3 | |
| 0x40fa33 handletest_x86.exe|cmp eax, esi|eax=0x3|esi=0xffffffff | |
| 0x40fa35 handletest_x86.exe|jne 0x40fa4e|eflags=0x213 | |
| 0x40fa4e handletest_x86.exe|mov eax, dword ptr [ebp + 8]|ebp=0x19fdc4 | |
| 0x40fa51 handletest_x86.exe|lea esi, [ebp - 0x30]|ebp=0x19fdc4 | |
| 0x40fa54 handletest_x86.exe|and dword ptr [ebp - 0x14], 0|ebp=0x19fdc4 | |
| 0x40fa58 handletest_x86.exe|xor ecx, ecx|ecx=0x6671bcdc | |
| 0x40fa5a handletest_x86.exe|inc ecx|ecx=0x0 | |
| 0x40fa5b handletest_x86.exe|mov dword ptr [ebp - 0x18], 0xc|ebp=0x19fdc4 | |
| 0x40fa62 handletest_x86.exe|sub esp, 0x18|esp=0x19fd70 | |
| 0x40fa65 handletest_x86.exe|mov dword ptr [eax], ecx|eax=0x19fe38|ecx=0x1 | |
| 0x40fa67 handletest_x86.exe|mov eax, dword ptr [ebp + 0x14]|ebp=0x19fdc4 | |
| 0x40fa6a handletest_x86.exe|shr eax, 7|eax=0x0 | |
| 0x40fa6d handletest_x86.exe|not eax|eax=0x0 | |
| 0x40fa6f handletest_x86.exe|and eax, ecx|eax=0xffffffff|ecx=0x1 | |
| 0x40fa71 handletest_x86.exe|push 6|esp=0x19fd58 | |
| 0x40fa73 handletest_x86.exe|pop ecx|ecx=0x1|esp=0x19fd54 | |
| 0x40fa74 handletest_x86.exe|mov dword ptr [ebp - 0x10], eax|ebp=0x19fdc4|eax=0x1 | |
| 0x40fa77 handletest_x86.exe|mov edi, esp|esp=0x19fd58 | |
| 0x40fa79 handletest_x86.exe|lea eax, [ebp - 0x18]|ebp=0x19fdc4 | |
| 0x40fa7c handletest_x86.exe|push eax|eax=0x19fdac|esp=0x19fd58 | |
| 0x40fa7d handletest_x86.exe|push dword ptr [ebp + 0x10]|ebp=0x19fdc4|esp=0x19fd54 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd58|esi=0x19fd94|eflags=0x202|ecx=0x6 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd5c|esi=0x19fd98|eflags=0x202|ecx=0x5 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd60|esi=0x19fd9c|eflags=0x202|ecx=0x4 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd64|esi=0x19fda0|eflags=0x202|ecx=0x3 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd68|esi=0x19fda4|eflags=0x202|ecx=0x2 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd6c|esi=0x19fda8|eflags=0x202|ecx=0x1 | |
| 0x40fa80 handletest_x86.exe|rep movsd dword ptr es:[edi], dword ptr [esi]|edi=0x19fd70|esi=0x19fdac|eflags=0x202|ecx=0x0 | |
| 0x40fa82 handletest_x86.exe|call 0x40f697|esp=0x19fd50|eip=0x40fa82 | |
| 0x40f697 handletest_x86.exe|mov edi, edi|edi=0x19fd70 | |
| 0x40f699 handletest_x86.exe|push ebp|ebp=0x19fdc4|esp=0x19fd4c | |
| 0x40f69a handletest_x86.exe|mov ebp, esp|esp=0x19fd48 | |
| 0x40f69c handletest_x86.exe|mov eax, dword ptr [ebp + 0x20]|ebp=0x19fd48 | |
| 0x40f69f handletest_x86.exe|or eax, dword ptr [ebp + 0x24]|eax=0x80|ebp=0x19fd48 | |
| 0x40f6a2 handletest_x86.exe|push 0|esp=0x19fd48 | |
| 0x40f6a4 handletest_x86.exe|push eax|eax=0x80|esp=0x19fd44 | |
| 0x40f6a5 handletest_x86.exe|push dword ptr [ebp + 0x18]|ebp=0x19fd48|esp=0x19fd40 | |
| 0x40f6a8 handletest_x86.exe|push dword ptr [ebp + 0xc]|ebp=0x19fd48|esp=0x19fd3c | |
| 0x40f6ab handletest_x86.exe|push dword ptr [ebp + 0x1c]|ebp=0x19fd48|esp=0x19fd38 | |
| 0x40f6ae handletest_x86.exe|push dword ptr [ebp + 0x14]|ebp=0x19fd48|esp=0x19fd34 | |
| 0x40f6b1 handletest_x86.exe|push dword ptr [ebp + 8]|ebp=0x19fd48|esp=0x19fd30 | |
| 0x40f6b4 handletest_x86.exe|call dword ptr [0x4170f4]|esp=0x19fd2c | |
| 0x75c63a90 kernel32.dll:CreateFileW|jmp dword ptr [0x75cc104c] | |
| 0x76f721a0 kernelbase.dll:CreateFileW|mov edi, edi|edi=0x19fd70 | |
| 0x76f721a2 kernelbase.dll:CreateFileW+0x2|push ebp|ebp=0x19fd48|esp=0x19fd28 | |
| 0x76f721a3 kernelbase.dll:CreateFileW+0x3|mov ebp, esp|esp=0x19fd24 | |
| 0x76f721a5 kernelbase.dll:CreateFileW+0x5|and esp, 0xfffffff8|esp=0x19fd24 | |
| 0x76f721a8 kernelbase.dll:CreateFileW+0x8|sub esp, 0x1c|esp=0x19fd20 | |
| 0x76f721ab kernelbase.dll:CreateFileW+0xb|mov ecx, dword ptr [ebp + 0x1c]|ebp=0x19fd24 | |
| 0x76f721ae kernelbase.dll:CreateFileW+0xe|mov eax, ecx|ecx=0x80 | |
| 0x76f721b0 kernelbase.dll:CreateFileW+0x10|and eax, 0x7fb7|eax=0x80 | |
| 0x76f721b5 kernelbase.dll:CreateFileW+0x15|mov dword ptr [esp + 4], 0x18|esp=0x19fd04 | |
| 0x76f721bd kernelbase.dll:CreateFileW+0x1d|mov dword ptr [esp + 8], eax|esp=0x19fd04|eax=0x80 | |
| 0x76f721c1 kernelbase.dll:CreateFileW+0x21|mov eax, ecx|ecx=0x80 | |
| 0x76f721c3 kernelbase.dll:CreateFileW+0x23|and eax, 0xfff00000|eax=0x80 | |
| 0x76f721c8 kernelbase.dll:CreateFileW+0x28|mov dword ptr [esp + 0xc], eax|esp=0x19fd04|eax=0x0 | |
| 0x76f721cc kernelbase.dll:CreateFileW+0x2c|push esi|esi=0x19fdac|esp=0x19fd04 | |
| 0x76f721cd kernelbase.dll:CreateFileW+0x2d|test ecx, 0x100000|ecx=0x80 | |
| 0x76f721d3 kernelbase.dll:CreateFileW+0x33|je 0x76f721e1|eflags=0x246 | |
| 0x76f721e1 kernelbase.dll:CreateFileW+0x41|and dword ptr [esp + 0x14], 0|esp=0x19fd00 | |
| 0x76f721e6 kernelbase.dll:CreateFileW+0x46|mov eax, dword ptr [ebp + 0x14]|ebp=0x19fd24 | |
| 0x76f721e9 kernelbase.dll:CreateFileW+0x49|mov edx, dword ptr [ebp + 0xc]|ebp=0x19fd24 | |
| 0x76f721ec kernelbase.dll:CreateFileW+0x4c|mov ecx, dword ptr [ebp + 8]|ebp=0x19fd24 | |
| 0x76f721ef kernelbase.dll:CreateFileW+0x4f|mov dword ptr [esp + 0x18], eax|esp=0x19fd00|eax=0x19fdac | |
| 0x76f721f3 kernelbase.dll:CreateFileW+0x53|mov eax, dword ptr [ebp + 0x20]|ebp=0x19fd24 | |
| 0x76f721f6 kernelbase.dll:CreateFileW+0x56|push 0|esp=0x19fd00 | |
| 0x76f721f8 kernelbase.dll:CreateFileW+0x58|mov dword ptr [esp + 0x20], eax|esp=0x19fcfc|eax=0x0 | |
| 0x76f721fc kernelbase.dll:CreateFileW+0x5c|lea eax, [esp + 0xc]|esp=0x19fcfc | |
| 0x76f72200 kernelbase.dll:CreateFileW+0x60|push eax|eax=0x19fd08|esp=0x19fcfc | |
| 0x76f72201 kernelbase.dll:CreateFileW+0x61|push dword ptr [ebp + 0x18]|ebp=0x19fd24|esp=0x19fcf8 | |
| 0x76f72204 kernelbase.dll:CreateFileW+0x64|push dword ptr [ebp + 0x10]|ebp=0x19fd24|esp=0x19fcf4 | |
| 0x76f72207 kernelbase.dll:CreateFileW+0x67|call 0x76f72240|esp=0x19fcf0|eip=0x76f72207 | |
| 0x76f72240 kernelbase.dll:CreateFileW+0xa0|mov edi, edi|edi=0x19fd70 | |
| 0x76f72242 kernelbase.dll:CreateFileW+0xa2|push ebp|ebp=0x19fd24|esp=0x19fcec | |
| 0x76f72243 kernelbase.dll:CreateFileW+0xa3|mov ebp, esp|esp=0x19fce8 | |
| 0x76f72245 kernelbase.dll:CreateFileW+0xa5|and esp, 0xfffffff8|esp=0x19fce8 | |
| 0x76f72248 kernelbase.dll:CreateFileW+0xa8|sub esp, 0x84|esp=0x19fce8 | |
| 0x76f7224e kernelbase.dll:CreateFileW+0xae|mov eax, dword ptr [0x77065bd0] | |
| 0x76f72253 kernelbase.dll:CreateFileW+0xb3|xor eax, esp|eax=0x92df5544|esp=0x19fc64 | |
| 0x76f72255 kernelbase.dll:CreateFileW+0xb5|mov dword ptr [esp + 0x80], eax|esp=0x19fc64|eax=0x92c6a920 | |
| 0x76f7225c kernelbase.dll:CreateFileW+0xbc|push ebx|ebx=0x19feac|esp=0x19fc64 | |
| 0x76f7225d kernelbase.dll:CreateFileW+0xbd|push esi|esi=0x19fdac|esp=0x19fc60 | |
| 0x76f7225e kernelbase.dll:CreateFileW+0xbe|push edi|edi=0x19fd70|esp=0x19fc5c | |
| 0x76f7225f kernelbase.dll:CreateFileW+0xbf|mov edi, dword ptr [ebp + 0x10]|ebp=0x19fce8 | |
| 0x76f72262 kernelbase.dll:CreateFileW+0xc2|mov ebx, ecx|ecx=0x82b440 | |
| 0x76f72264 kernelbase.dll:CreateFileW+0xc4|mov dword ptr [esp + 0x1c], edx|esp=0x19fc58|edx=0x80000000 | |
| 0x76f72268 kernelbase.dll:CreateFileW+0xc8|mov dword ptr [esp + 0x20], edi|esp=0x19fc58|edi=0x19fd08 | |
| 0x76f7226c kernelbase.dll:CreateFileW+0xcc|mov dword ptr [esp + 0x3c], 0|esp=0x19fc58 | |
| 0x76f72274 kernelbase.dll:CreateFileW+0xd4|test edi, edi|edi=0x19fd08 | |
| 0x76f72276 kernelbase.dll:CreateFileW+0xd6|je 0x76f72294|eflags=0x202 | |
| 0x76f72278 kernelbase.dll:CreateFileW+0xd8|cmp dword ptr [edi], 0x18|edi=0x19fd08 | |
| 0x76f7227b kernelbase.dll:CreateFileW+0xdb|jb 0x76f7288a|eflags=0x246 | |
| 0x76f72281 kernelbase.dll:CreateFileW+0xe1|mov ecx, dword ptr [edi + 8]|edi=0x19fd08 | |
| 0x76f72284 kernelbase.dll:CreateFileW+0xe4|mov esi, dword ptr [edi + 0xc]|edi=0x19fd08 | |
| 0x76f72287 kernelbase.dll:CreateFileW+0xe7|mov dword ptr [esp + 0x30], ecx|esp=0x19fc58|ecx=0x0 | |
| 0x76f7228b kernelbase.dll:CreateFileW+0xeb|mov ecx, dword ptr [edi + 4]|edi=0x19fd08 | |
| 0x76f7228e kernelbase.dll:CreateFileW+0xee|mov dword ptr [esp + 0x18], ecx|esp=0x19fc58|ecx=0x80 | |
| 0x76f72292 kernelbase.dll:CreateFileW+0xf2|jmp 0x76f722a6 | |
| 0x76f722a6 kernelbase.dll:CreateFileW+0x106|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fce8 | |
| 0x76f722a9 kernelbase.dll:CreateFileW+0x109|dec eax|eax=0x3 | |
| 0x76f722aa kernelbase.dll:CreateFileW+0x10a|cmp eax, 4|eax=0x2 | |
| 0x76f722ad kernelbase.dll:CreateFileW+0x10d|ja 0x76f7288a|eflags=0x293 | |
| 0x76f722b3 kernelbase.dll:CreateFileW+0x113|jmp dword ptr [eax*4 + 0x76f728b0]|eax=0x2 | |
| 0x76f722ce kernelbase.dll:CreateFileW+0x12e|mov dword ptr [esp + 0x14], 1|esp=0x19fc58 | |
| 0x76f722d6 kernelbase.dll:CreateFileW+0x136|jmp 0x76f722f6 | |
| 0x76f722f6 kernelbase.dll:CreateFileW+0x156|push ebx|ebx=0x82b440|esp=0x19fc58 | |
| 0x76f722f7 kernelbase.dll:CreateFileW+0x157|lea eax, [esp + 0x38]|esp=0x19fc54 | |
| 0x76f722fb kernelbase.dll:CreateFileW+0x15b|push eax|eax=0x19fc8c|esp=0x19fc54 | |
| 0x76f722fc kernelbase.dll:CreateFileW+0x15c|call dword ptr [0x77069184]|esp=0x19fc50 | |
| 0x771794d0 ntdll.dll:RtlInitUnicodeStringEx|mov edi, edi|edi=0x19fd08 | |
| 0x771794d2 ntdll.dll:RtlInitUnicodeStringEx+0x2|push ebp|ebp=0x19fce8|esp=0x19fc4c | |
| 0x771794d3 ntdll.dll:RtlInitUnicodeStringEx+0x3|mov ebp, esp|esp=0x19fc48 | |
| 0x771794d5 ntdll.dll:RtlInitUnicodeStringEx+0x5|mov edx, dword ptr [ebp + 8]|ebp=0x19fc48 | |
| 0x771794d8 ntdll.dll:RtlInitUnicodeStringEx+0x8|xor eax, eax|eax=0x19fc8c | |
| 0x771794da ntdll.dll:RtlInitUnicodeStringEx+0xa|mov dword ptr [edx], eax|edx=0x19fc8c|eax=0x0 | |
| 0x771794dc ntdll.dll:RtlInitUnicodeStringEx+0xc|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fc48 | |
| 0x771794df ntdll.dll:RtlInitUnicodeStringEx+0xf|mov dword ptr [edx + 4], eax|edx=0x19fc8c|eax=0x82b440 | |
| 0x771794e2 ntdll.dll:RtlInitUnicodeStringEx+0x12|test eax, eax|eax=0x82b440 | |
| 0x771794e4 ntdll.dll:RtlInitUnicodeStringEx+0x14|je 0x77179513|eflags=0x202 | |
| 0x771794e6 ntdll.dll:RtlInitUnicodeStringEx+0x16|push esi|esi=0x0|esp=0x19fc48 | |
| 0x771794e7 ntdll.dll:RtlInitUnicodeStringEx+0x17|lea esi, [eax + 2]|eax=0x82b440 | |
| 0x771794ea ntdll.dll:RtlInitUnicodeStringEx+0x1a|lea ebx, [ebx]|ebx=0x82b440 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b440 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b440 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x2e | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b442 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b442 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x2f | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x202 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b444 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b444 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b446 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b446 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x65 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b448 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b448 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x73 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x202 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b44a | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b44a | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b44c | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b44c | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x5f | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b44e | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b44e | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x66 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b450 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b450 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x69 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b452 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b452 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x6c | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b454 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b454 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x65 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b456 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b456 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x2e | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b458 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b458 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b45a | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b45a | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x78 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b45c | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b45c | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b45e | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b45e | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x0 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x246 | |
| 0x771794fb ntdll.dll:RtlInitUnicodeStringEx+0x2b|sub eax, esi|eax=0x82b460|esi=0x82b442 | |
| 0x771794fd ntdll.dll:RtlInitUnicodeStringEx+0x2d|sar eax, 1|eax=0x1e | |
| 0x771794ff ntdll.dll:RtlInitUnicodeStringEx+0x2f|pop esi|esi=0x82b442|esp=0x19fc44 | |
| 0x77179500 ntdll.dll:RtlInitUnicodeStringEx+0x30|cmp eax, 0x7ffe|eax=0xf | |
| 0x77179505 ntdll.dll:RtlInitUnicodeStringEx+0x35|ja 0x77179519|eflags=0x287 | |
| 0x77179507 ntdll.dll:RtlInitUnicodeStringEx+0x37|add eax, eax|eax=0xf | |
| 0x77179509 ntdll.dll:RtlInitUnicodeStringEx+0x39|mov word ptr [edx], ax|edx=0x19fc8c|ax=0x1e | |
| 0x7717950c ntdll.dll:RtlInitUnicodeStringEx+0x3c|add eax, 2|eax=0x1e | |
| 0x7717950f ntdll.dll:RtlInitUnicodeStringEx+0x3f|mov word ptr [edx + 2], ax|edx=0x19fc8c|ax=0x20 | |
| 0x77179513 ntdll.dll:RtlInitUnicodeStringEx+0x43|xor eax, eax|eax=0x20 | |
| 0x77179515 ntdll.dll:RtlInitUnicodeStringEx+0x45|pop ebp|ebp=0x19fc48|esp=0x19fc48 | |
| 0x77179516 ntdll.dll:RtlInitUnicodeStringEx+0x46|ret 8|esp=0x19fc4c | |
| 0x76f72302 kernelbase.dll:CreateFileW+0x162|test eax, eax|eax=0x0 | |
| 0x76f72304 kernelbase.dll:CreateFileW+0x164|jns 0x76f7230d|eflags=0x246 | |
| 0x76f7230d kernelbase.dll:CreateFileW+0x16d|mov eax, dword ptr [esp + 0x34]|esp=0x19fc58 | |
| 0x76f72311 kernelbase.dll:CreateFileW+0x171|cmp ax, 1|ax=0x1e | |
| 0x76f72315 kernelbase.dll:CreateFileW+0x175|jbe 0x76f7232c|eflags=0x206 | |
| 0x76f72317 kernelbase.dll:CreateFileW+0x177|movzx eax, ax|ax=0x1e | |
| 0x76f7231a kernelbase.dll:CreateFileW+0x17a|shr eax, 1|eax=0x1e | |
| 0x76f7231c kernelbase.dll:CreateFileW+0x17c|mov dword ptr [esp + 0x44], 1|esp=0x19fc58 | |
| 0x76f72324 kernelbase.dll:CreateFileW+0x184|cmp word ptr [ebx + eax*2 - 2], 0x5c|ebx=0x82b440|eax=0xf | |
| 0x76f7232a kernelbase.dll:CreateFileW+0x18a|je 0x76f72334|eflags=0x216 | |
| 0x76f7232c kernelbase.dll:CreateFileW+0x18c|mov dword ptr [esp + 0x44], 0|esp=0x19fc58 | |
| 0x76f72334 kernelbase.dll:CreateFileW+0x194|lea eax, [esp + 0x50]|esp=0x19fc58 | |
| 0x76f72338 kernelbase.dll:CreateFileW+0x198|mov dword ptr [esp + 0x10], 0|esp=0x19fc58 | |
| 0x76f72340 kernelbase.dll:CreateFileW+0x1a0|push eax|eax=0x19fca8|esp=0x19fc58 | |
| 0x76f72341 kernelbase.dll:CreateFileW+0x1a1|push 0|esp=0x19fc54 | |
| 0x76f72343 kernelbase.dll:CreateFileW+0x1a3|lea eax, [esp + 0x3c]|esp=0x19fc50 | |
| 0x76f72347 kernelbase.dll:CreateFileW+0x1a7|push eax|eax=0x19fc8c|esp=0x19fc50 | |
| 0x76f72348 kernelbase.dll:CreateFileW+0x1a8|push ebx|ebx=0x82b440|esp=0x19fc4c | |
| 0x76f72349 kernelbase.dll:CreateFileW+0x1a9|call dword ptr [0x77069994]|esp=0x19fc48 | |
| 0x77196de0 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus|mov edi, edi|edi=0x19fd08 | |
| 0x77196de2 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x2|push ebp|ebp=0x19fce8|esp=0x19fc44 | |
| 0x77196de3 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x3|mov ebp, esp|esp=0x19fc40 | |
| 0x77196de5 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x5|push ecx|ecx=0x0|esp=0x19fc40 | |
| 0x77196de6 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x6|push ecx|ecx=0x0|esp=0x19fc3c | |
| 0x77196de7 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x7|push dword ptr [ebp + 8]|ebp=0x19fc40|esp=0x19fc38 | |
| 0x77196dea ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0xa|lea eax, [ebp - 8]|ebp=0x19fc40 | |
| 0x77196ded ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0xd|push eax|eax=0x19fc38|esp=0x19fc34 | |
| 0x77196dee ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0xe|call 0x771794d0|esp=0x19fc30|eip=0x77196dee | |
| 0x771794d0 ntdll.dll:RtlInitUnicodeStringEx|mov edi, edi|edi=0x19fd08 | |
| 0x771794d2 ntdll.dll:RtlInitUnicodeStringEx+0x2|push ebp|ebp=0x19fc40|esp=0x19fc2c | |
| 0x771794d3 ntdll.dll:RtlInitUnicodeStringEx+0x3|mov ebp, esp|esp=0x19fc28 | |
| 0x771794d5 ntdll.dll:RtlInitUnicodeStringEx+0x5|mov edx, dword ptr [ebp + 8]|ebp=0x19fc28 | |
| 0x771794d8 ntdll.dll:RtlInitUnicodeStringEx+0x8|xor eax, eax|eax=0x19fc38 | |
| 0x771794da ntdll.dll:RtlInitUnicodeStringEx+0xa|mov dword ptr [edx], eax|edx=0x19fc38|eax=0x0 | |
| 0x771794dc ntdll.dll:RtlInitUnicodeStringEx+0xc|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fc28 | |
| 0x771794df ntdll.dll:RtlInitUnicodeStringEx+0xf|mov dword ptr [edx + 4], eax|edx=0x19fc38|eax=0x82b440 | |
| 0x771794e2 ntdll.dll:RtlInitUnicodeStringEx+0x12|test eax, eax|eax=0x82b440 | |
| 0x771794e4 ntdll.dll:RtlInitUnicodeStringEx+0x14|je 0x77179513|eflags=0x202 | |
| 0x771794e6 ntdll.dll:RtlInitUnicodeStringEx+0x16|push esi|esi=0x0|esp=0x19fc28 | |
| 0x771794e7 ntdll.dll:RtlInitUnicodeStringEx+0x17|lea esi, [eax + 2]|eax=0x82b440 | |
| 0x771794ea ntdll.dll:RtlInitUnicodeStringEx+0x1a|lea ebx, [ebx]|ebx=0x82b440 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b440 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b440 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x2e | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b442 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b442 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x2f | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x202 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b444 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b444 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b446 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b446 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x65 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b448 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b448 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x73 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x202 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b44a | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b44a | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b44c | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b44c | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x5f | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b44e | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b44e | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x66 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b450 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b450 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x69 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b452 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b452 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x6c | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b454 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b454 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x65 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b456 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b456 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x2e | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b458 | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b458 | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b45a | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b45a | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x78 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b45c | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b45c | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x74 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x206 | |
| 0x771794f0 ntdll.dll:RtlInitUnicodeStringEx+0x20|mov cx, word ptr [eax]|eax=0x82b45e | |
| 0x771794f3 ntdll.dll:RtlInitUnicodeStringEx+0x23|add eax, 2|eax=0x82b45e | |
| 0x771794f6 ntdll.dll:RtlInitUnicodeStringEx+0x26|test cx, cx|cx=0x0 | |
| 0x771794f9 ntdll.dll:RtlInitUnicodeStringEx+0x29|jne 0x771794f0|eflags=0x246 | |
| 0x771794fb ntdll.dll:RtlInitUnicodeStringEx+0x2b|sub eax, esi|eax=0x82b460|esi=0x82b442 | |
| 0x771794fd ntdll.dll:RtlInitUnicodeStringEx+0x2d|sar eax, 1|eax=0x1e | |
| 0x771794ff ntdll.dll:RtlInitUnicodeStringEx+0x2f|pop esi|esi=0x82b442|esp=0x19fc24 | |
| 0x77179500 ntdll.dll:RtlInitUnicodeStringEx+0x30|cmp eax, 0x7ffe|eax=0xf | |
| 0x77179505 ntdll.dll:RtlInitUnicodeStringEx+0x35|ja 0x77179519|eflags=0x287 | |
| 0x77179507 ntdll.dll:RtlInitUnicodeStringEx+0x37|add eax, eax|eax=0xf | |
| 0x77179509 ntdll.dll:RtlInitUnicodeStringEx+0x39|mov word ptr [edx], ax|edx=0x19fc38|ax=0x1e | |
| 0x7717950c ntdll.dll:RtlInitUnicodeStringEx+0x3c|add eax, 2|eax=0x1e | |
| 0x7717950f ntdll.dll:RtlInitUnicodeStringEx+0x3f|mov word ptr [edx + 2], ax|edx=0x19fc38|ax=0x20 | |
| 0x77179513 ntdll.dll:RtlInitUnicodeStringEx+0x43|xor eax, eax|eax=0x20 | |
| 0x77179515 ntdll.dll:RtlInitUnicodeStringEx+0x45|pop ebp|ebp=0x19fc28|esp=0x19fc28 | |
| 0x77179516 ntdll.dll:RtlInitUnicodeStringEx+0x46|ret 8|esp=0x19fc2c | |
| 0x77196df3 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x13|test eax, eax|eax=0x0 | |
| 0x77196df5 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x15|js 0x77196e0f|eflags=0x246 | |
| 0x77196df7 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x17|push dword ptr [ebp + 0x14]|ebp=0x19fc40|esp=0x19fc38 | |
| 0x77196dfa ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x1a|lea edx, [ebp - 8]|ebp=0x19fc40 | |
| 0x77196dfd ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x1d|push dword ptr [ebp + 0x10]|ebp=0x19fc40|esp=0x19fc34 | |
| 0x77196e00 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x20|push 0|esp=0x19fc30 | |
| 0x77196e02 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x22|push dword ptr [ebp + 0xc]|ebp=0x19fc40|esp=0x19fc2c | |
| 0x77196e05 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x25|push 0|esp=0x19fc28 | |
| 0x77196e07 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x27|push 2|esp=0x19fc24 | |
| 0x77196e09 ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x29|pop ecx|ecx=0x0|esp=0x19fc20 | |
| 0x77196e0a ntdll.dll:RtlDosPathNameToRelativeNtPathName_U_WithStatus+0x2a|call 0x77173950|esp=0x19fc24|eip=0x77196e0a | |
| 0x77173950 ntdll.dll:RtlDosSearchPath_Ustr+0x12d0|mov edi, edi|edi=0x19fd08 | |
| 0x77173952 ntdll.dll:RtlDosSearchPath_Ustr+0x12d2|push ebp|ebp=0x19fc40|esp=0x19fc20 | |
| 0x77173953 ntdll.dll:RtlDosSearchPath_Ustr+0x12d3|mov ebp, esp|esp=0x19fc1c | |
| 0x77173955 ntdll.dll:RtlDosSearchPath_Ustr+0x12d5|and esp, 0xfffffff8|esp=0x19fc1c | |
| 0x77173958 ntdll.dll:RtlDosSearchPath_Ustr+0x12d8|sub esp, 0x254|esp=0x19fc18 | |
| 0x7717395e ntdll.dll:RtlDosSearchPath_Ustr+0x12de|mov eax, dword ptr [0x7725e360] | |
| 0x77173963 ntdll.dll:RtlDosSearchPath_Ustr+0x12e3|xor eax, esp|eax=0xf9e0af5e|esp=0x19f9c4 | |
| 0x77173965 ntdll.dll:RtlDosSearchPath_Ustr+0x12e5|mov dword ptr [esp + 0x250], eax|esp=0x19f9c4|eax=0xf9f9569a | |
| 0x7717396c ntdll.dll:RtlDosSearchPath_Ustr+0x12ec|mov eax, dword ptr [ebp + 0xc]|ebp=0x19fc1c | |
| 0x7717396f ntdll.dll:RtlDosSearchPath_Ustr+0x12ef|push ebx|ebx=0x82b440|esp=0x19f9c4 | |
| 0x77173970 ntdll.dll:RtlDosSearchPath_Ustr+0x12f0|mov ebx, edx|edx=0x19fc38 | |
| 0x77173972 ntdll.dll:RtlDosSearchPath_Ustr+0x12f2|mov dword ptr [esp + 0x30], ecx|esp=0x19f9c0|ecx=0x2 | |
| 0x77173976 ntdll.dll:RtlDosSearchPath_Ustr+0x12f6|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19fc1c | |
| 0x77173979 ntdll.dll:RtlDosSearchPath_Ustr+0x12f9|mov edx, dword ptr [ebp + 0x18]|ebp=0x19fc1c | |
| 0x7717397c ntdll.dll:RtlDosSearchPath_Ustr+0x12fc|push esi|esi=0x0|esp=0x19f9c0 | |
| 0x7717397d ntdll.dll:RtlDosSearchPath_Ustr+0x12fd|cmp word ptr [ebx], 8|ebx=0x19fc38 | |
| 0x77173981 ntdll.dll:RtlDosSearchPath_Ustr+0x1301|mov esi, dword ptr [ebp + 8]|ebp=0x19fc1c | |
| 0x77173984 ntdll.dll:RtlDosSearchPath_Ustr+0x1304|mov dword ptr [esp + 0x40], ecx|esp=0x19f9bc|ecx=0x0 | |
| 0x77173988 ntdll.dll:RtlDosSearchPath_Ustr+0x1308|mov ecx, dword ptr [ebp + 0x14]|ebp=0x19fc1c | |
| 0x7717398b ntdll.dll:RtlDosSearchPath_Ustr+0x130b|push edi|edi=0x19fd08|esp=0x19f9bc | |
| 0x7717398c ntdll.dll:RtlDosSearchPath_Ustr+0x130c|mov dword ptr [esp + 0x24], eax|esp=0x19f9b8|eax=0x19fc8c | |
| 0x77173990 ntdll.dll:RtlDosSearchPath_Ustr+0x1310|mov dword ptr [esp + 0x1c], ecx|esp=0x19f9b8|ecx=0x0 | |
| 0x77173994 ntdll.dll:RtlDosSearchPath_Ustr+0x1314|mov dword ptr [esp + 0x40], edx|esp=0x19f9b8|edx=0x19fca8 | |
| 0x77173998 ntdll.dll:RtlDosSearchPath_Ustr+0x1318|jbe 0x771739ab|eflags=0x202 | |
| 0x7717399a ntdll.dll:RtlDosSearchPath_Ustr+0x131a|mov ecx, dword ptr [ebx + 4]|ebx=0x19fc38 | |
| 0x7717399d ntdll.dll:RtlDosSearchPath_Ustr+0x131d|cmp word ptr [ecx], 0x5c|ecx=0x82b440 | |
| 0x771739a1 ntdll.dll:RtlDosSearchPath_Ustr+0x1321|je 0x77173cb6|eflags=0x287 | |
| 0x771739a7 ntdll.dll:RtlDosSearchPath_Ustr+0x1327|mov ecx, dword ptr [esp + 0x1c]|esp=0x19f9b8 | |
| 0x771739ab ntdll.dll:RtlDosSearchPath_Ustr+0x132b|test ecx, ecx|ecx=0x0 | |
| 0x771739ad ntdll.dll:RtlDosSearchPath_Ustr+0x132d|jne 0x77173c8a|eflags=0x246 | |
| 0x771739b3 ntdll.dll:RtlDosSearchPath_Ustr+0x1333|test byte ptr [esp + 0x38], 1|esp=0x19f9b8 | |
| 0x771739b8 ntdll.dll:RtlDosSearchPath_Ustr+0x1338|lea edi, [esp + 0x50]|esp=0x19f9b8 | |
| 0x771739bc ntdll.dll:RtlDosSearchPath_Ustr+0x133c|mov eax, 0x208 | |
| 0x771739c1 ntdll.dll:RtlDosSearchPath_Ustr+0x1341|mov dword ptr [esp + 0x28], eax|esp=0x19f9b8|eax=0x208 | |
| 0x771739c5 ntdll.dll:RtlDosSearchPath_Ustr+0x1345|jne 0x77173c3f|eflags=0x246 | |
| 0x771739cb ntdll.dll:RtlDosSearchPath_Ustr+0x134b|lea eax, [esp + 0x48]|esp=0x19f9b8 | |
| 0x771739cf ntdll.dll:RtlDosSearchPath_Ustr+0x134f|mov edx, 0x208 | |
| 0x771739d4 ntdll.dll:RtlDosSearchPath_Ustr+0x1354|push eax|eax=0x19fa00|esp=0x19f9b8 | |
| 0x771739d5 ntdll.dll:RtlDosSearchPath_Ustr+0x1355|lea eax, [esp + 0x1b]|esp=0x19f9b4 | |
| 0x771739d9 ntdll.dll:RtlDosSearchPath_Ustr+0x1359|push eax|eax=0x19f9cf|esp=0x19f9b4 | |
| 0x771739da ntdll.dll:RtlDosSearchPath_Ustr+0x135a|push ecx|ecx=0x0|esp=0x19f9b0 | |
| 0x771739db ntdll.dll:RtlDosSearchPath_Ustr+0x135b|mov eax, edi|edi=0x19fa08 | |
| 0x771739dd ntdll.dll:RtlDosSearchPath_Ustr+0x135d|mov ecx, ebx|ebx=0x19fc38 | |
| 0x771739df ntdll.dll:RtlDosSearchPath_Ustr+0x135f|push eax|eax=0x19fa08|esp=0x19f9ac | |
| 0x771739e0 ntdll.dll:RtlDosSearchPath_Ustr+0x1360|call 0x77172d70|esp=0x19f9a8|eip=0x771739e0 | |
| 0x77172d70 ntdll.dll:RtlDosSearchPath_Ustr+0x6f0|mov edi, edi|edi=0x19fa08 | |
| 0x77172d72 ntdll.dll:RtlDosSearchPath_Ustr+0x6f2|push ebp|ebp=0x19fc1c|esp=0x19f9a4 | |
| 0x77172d73 ntdll.dll:RtlDosSearchPath_Ustr+0x6f3|mov ebp, esp|esp=0x19f9a0 | |
| 0x77172d75 ntdll.dll:RtlDosSearchPath_Ustr+0x6f5|push -2|esp=0x19f9a0 | |
| 0x77172d77 ntdll.dll:RtlDosSearchPath_Ustr+0x6f7|push 0x7723ec08|esp=0x19f99c | |
| 0x77172d7c ntdll.dll:RtlDosSearchPath_Ustr+0x6fc|push 0x771ad210|esp=0x19f998 | |
| 0x77172d81 ntdll.dll:RtlDosSearchPath_Ustr+0x701|mov eax, dword ptr fs:[0] | |
| 0x77172d87 ntdll.dll:RtlDosSearchPath_Ustr+0x707|push eax|eax=0x19fe48|esp=0x19f994 | |
| 0x77172d88 ntdll.dll:RtlDosSearchPath_Ustr+0x708|sub esp, 0x6c|esp=0x19f990 | |
| 0x77172d8b ntdll.dll:RtlDosSearchPath_Ustr+0x70b|mov eax, dword ptr [0x7725e360] | |
| 0x77172d90 ntdll.dll:RtlDosSearchPath_Ustr+0x710|xor dword ptr [ebp - 8], eax|ebp=0x19f9a0|eax=0xf9e0af5e | |
| 0x77172d93 ntdll.dll:RtlDosSearchPath_Ustr+0x713|xor eax, ebp|eax=0xf9e0af5e|ebp=0x19f9a0 | |
| 0x77172d95 ntdll.dll:RtlDosSearchPath_Ustr+0x715|mov dword ptr [ebp - 0x1c], eax|ebp=0x19f9a0|eax=0xf9f956fe | |
| 0x77172d98 ntdll.dll:RtlDosSearchPath_Ustr+0x718|push ebx|ebx=0x19fc38|esp=0x19f924 | |
| 0x77172d99 ntdll.dll:RtlDosSearchPath_Ustr+0x719|push esi|esi=0x0|esp=0x19f920 | |
| 0x77172d9a ntdll.dll:RtlDosSearchPath_Ustr+0x71a|push edi|edi=0x19fa08|esp=0x19f91c | |
| 0x77172d9b ntdll.dll:RtlDosSearchPath_Ustr+0x71b|push eax|eax=0xf9f956fe|esp=0x19f918 | |
| 0x77172d9c ntdll.dll:RtlDosSearchPath_Ustr+0x71c|lea eax, [ebp - 0x10]|ebp=0x19f9a0 | |
| 0x77172d9f ntdll.dll:RtlDosSearchPath_Ustr+0x71f|mov dword ptr fs:[0], eax|eax=0x19f990 | |
| 0x77172da5 ntdll.dll:RtlDosSearchPath_Ustr+0x725|mov eax, edx|edx=0x208 | |
| 0x77172da7 ntdll.dll:RtlDosSearchPath_Ustr+0x727|mov dword ptr [ebp - 0x5c], eax|ebp=0x19f9a0|eax=0x208 | |
| 0x77172daa ntdll.dll:RtlDosSearchPath_Ustr+0x72a|mov edx, ecx|ecx=0x19fc38 | |
| 0x77172dac ntdll.dll:RtlDosSearchPath_Ustr+0x72c|mov dword ptr [ebp - 0x50], edx|ebp=0x19f9a0|edx=0x19fc38 | |
| 0x77172daf ntdll.dll:RtlDosSearchPath_Ustr+0x72f|mov edi, dword ptr [ebp + 8]|ebp=0x19f9a0 | |
| 0x77172db2 ntdll.dll:RtlDosSearchPath_Ustr+0x732|mov ecx, dword ptr [ebp + 0xc]|ebp=0x19f9a0 | |
| 0x77172db5 ntdll.dll:RtlDosSearchPath_Ustr+0x735|mov dword ptr [ebp - 0x70], ecx|ebp=0x19f9a0|ecx=0x0 | |
| 0x77172db8 ntdll.dll:RtlDosSearchPath_Ustr+0x738|mov ebx, dword ptr [ebp + 0x10]|ebp=0x19f9a0 | |
| 0x77172dbb ntdll.dll:RtlDosSearchPath_Ustr+0x73b|mov esi, dword ptr [ebp + 0x14]|ebp=0x19f9a0 | |
| 0x77172dbe ntdll.dll:RtlDosSearchPath_Ustr+0x73e|mov dword ptr [ebp - 0x64], esi|ebp=0x19f9a0|esi=0x19fa00 | |
| 0x77172dc1 ntdll.dll:RtlDosSearchPath_Ustr+0x741|test ecx, ecx|ecx=0x0 | |
| 0x77172dc3 ntdll.dll:RtlDosSearchPath_Ustr+0x743|je 0x77172dcb|eflags=0x246 | |
| 0x77172dcb ntdll.dll:RtlDosSearchPath_Ustr+0x74b|test ebx, ebx|ebx=0x19f9cf | |
| 0x77172dcd ntdll.dll:RtlDosSearchPath_Ustr+0x74d|je 0x77172dd2|eflags=0x206 | |
| 0x77172dcf ntdll.dll:RtlDosSearchPath_Ustr+0x74f|mov byte ptr [ebx], 0|ebx=0x19f9cf | |
| 0x77172dd2 ntdll.dll:RtlDosSearchPath_Ustr+0x752|cmp eax, 0xffff|eax=0x208 | |
| 0x77172dd7 ntdll.dll:RtlDosSearchPath_Ustr+0x757|jbe 0x77172de0|eflags=0x297 | |
| 0x77172de0 ntdll.dll:RtlDosSearchPath_Ustr+0x760|mov dword ptr [esi], 0|esi=0x19fa00 | |
| 0x77172de6 ntdll.dll:RtlDosSearchPath_Ustr+0x766|mov dword ptr [esi + 4], 0|esi=0x19fa00 | |
| 0x77172ded ntdll.dll:RtlDosSearchPath_Ustr+0x76d|movzx eax, word ptr [edx]|edx=0x19fc38 | |
| 0x77172df0 ntdll.dll:RtlDosSearchPath_Ustr+0x770|mov dword ptr [ebp - 0x68], eax|ebp=0x19f9a0|eax=0x1e | |
| 0x77172df3 ntdll.dll:RtlDosSearchPath_Ustr+0x773|mov ecx, eax|eax=0x1e | |
| 0x77172df5 ntdll.dll:RtlDosSearchPath_Ustr+0x775|shr ecx, 1|ecx=0x1e | |
| 0x77172df7 ntdll.dll:RtlDosSearchPath_Ustr+0x777|mov dword ptr [ebp - 0x34], ecx|ebp=0x19f9a0|ecx=0xf | |
| 0x77172dfa ntdll.dll:RtlDosSearchPath_Ustr+0x77a|je 0x771735b8|eflags=0x206 | |
| 0x77172e00 ntdll.dll:RtlDosSearchPath_Ustr+0x780|mov edx, dword ptr [edx + 4]|edx=0x19fc38 | |
| 0x77172e03 ntdll.dll:RtlDosSearchPath_Ustr+0x783|cmp word ptr [edx], 0|edx=0x82b440 | |
| 0x77172e07 ntdll.dll:RtlDosSearchPath_Ustr+0x787|je 0x771735b8|eflags=0x206 | |
| 0x77172e0d ntdll.dll:RtlDosSearchPath_Ustr+0x78d|mov eax, ecx|ecx=0xf | |
| 0x77172e0f ntdll.dll:RtlDosSearchPath_Ustr+0x78f|dec ecx|ecx=0xf | |
| 0x77172e10 ntdll.dll:RtlDosSearchPath_Ustr+0x790|lea ecx, [edx + ecx*2]|edx=0x82b440|ecx=0xe | |
| 0x77172e13 ntdll.dll:RtlDosSearchPath_Ustr+0x793|cmp word ptr [ecx], 0x20|ecx=0x82b45c | |
| 0x77172e17 ntdll.dll:RtlDosSearchPath_Ustr+0x797|jne 0x77172e21|eflags=0x202 | |
| 0x77172e21 ntdll.dll:RtlDosSearchPath_Ustr+0x7a1|test eax, eax|eax=0xf | |
| 0x77172e23 ntdll.dll:RtlDosSearchPath_Ustr+0x7a3|je 0x771735b8|eflags=0x206 | |
| 0x77172e29 ntdll.dll:RtlDosSearchPath_Ustr+0x7a9|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f9a0 | |
| 0x77172e2c ntdll.dll:RtlDosSearchPath_Ustr+0x7ac|movzx eax, word ptr [edx + eax*2 - 2]|edx=0x82b440|eax=0xf | |
| 0x77172e31 ntdll.dll:RtlDosSearchPath_Ustr+0x7b1|cmp eax, 0x5c|eax=0x74 | |
| 0x77172e34 ntdll.dll:RtlDosSearchPath_Ustr+0x7b4|je 0x77172e3f|eflags=0x216 | |
| 0x77172e36 ntdll.dll:RtlDosSearchPath_Ustr+0x7b6|cmp eax, 0x2f|eax=0x74 | |
| 0x77172e39 ntdll.dll:RtlDosSearchPath_Ustr+0x7b9|je 0x77172e3f|eflags=0x212 | |
| 0x77172e3b ntdll.dll:RtlDosSearchPath_Ustr+0x7bb|mov al, 1 | |
| 0x77172e3d ntdll.dll:RtlDosSearchPath_Ustr+0x7bd|jmp 0x77172e41 | |
| 0x77172e41 ntdll.dll:RtlDosSearchPath_Ustr+0x7c1|mov byte ptr [ebp - 0x26], al|ebp=0x19f9a0|al=0x1 | |
| 0x77172e44 ntdll.dll:RtlDosSearchPath_Ustr+0x7c4|mov byte ptr [ebp - 0x25], al|ebp=0x19f9a0|al=0x1 | |
| 0x77172e47 ntdll.dll:RtlDosSearchPath_Ustr+0x7c7|mov eax, dword ptr [ebp - 0x5c]|ebp=0x19f9a0 | |
| 0x77172e4a ntdll.dll:RtlDosSearchPath_Ustr+0x7ca|mov ecx, eax|eax=0x208 | |
| 0x77172e4c ntdll.dll:RtlDosSearchPath_Ustr+0x7cc|shr ecx, 1|ecx=0x208 | |
| 0x77172e4e ntdll.dll:RtlDosSearchPath_Ustr+0x7ce|mov dword ptr [ebp - 0x58], ecx|ebp=0x19f9a0|ecx=0x104 | |
| 0x77172e51 ntdll.dll:RtlDosSearchPath_Ustr+0x7d1|mov dword ptr [ebp - 0x74], ecx|ebp=0x19f9a0|ecx=0x104 | |
| 0x77172e54 ntdll.dll:RtlDosSearchPath_Ustr+0x7d4|push eax|eax=0x208|esp=0x19f914 | |
| 0x77172e55 ntdll.dll:RtlDosSearchPath_Ustr+0x7d5|push 0|esp=0x19f910 | |
| 0x77172e57 ntdll.dll:RtlDosSearchPath_Ustr+0x7d7|push edi|edi=0x19fa08|esp=0x19f90c | |
| 0x77172e58 ntdll.dll:RtlDosSearchPath_Ustr+0x7d8|call 0x771ab3c0|esp=0x19f908|eip=0x77172e58 | |
| 0x771ab3c0 ntdll.dll:memset|mov edx, dword ptr [esp + 0xc]|esp=0x19f904 | |
| 0x771ab3c4 ntdll.dll:memset+0x4|mov ecx, dword ptr [esp + 4]|esp=0x19f904 | |
| 0x771ab3c8 ntdll.dll:memset+0x8|test edx, edx|edx=0x208 | |
| 0x771ab3ca ntdll.dll:memset+0xa|je 0x771ab41b|eflags=0x202 | |
| 0x771ab3cc ntdll.dll:memset+0xc|xor eax, eax|eax=0x208 | |
| 0x771ab3ce ntdll.dll:memset+0xe|mov al, byte ptr [esp + 8]|esp=0x19f904 | |
| 0x771ab3d2 ntdll.dll:memset+0x12|push edi|edi=0x19fa08|esp=0x19f904 | |
| 0x771ab3d3 ntdll.dll:memset+0x13|mov edi, ecx|ecx=0x19fa08 | |
| 0x771ab3d5 ntdll.dll:memset+0x15|cmp edx, 4|edx=0x208 | |
| 0x771ab3d8 ntdll.dll:memset+0x18|jb 0x771ab40b|eflags=0x202 | |
| 0x771ab3da ntdll.dll:memset+0x1a|neg ecx|ecx=0x19fa08 | |
| 0x771ab3dc ntdll.dll:memset+0x1c|and ecx, 3|ecx=0xffe605f8 | |
| 0x771ab3df ntdll.dll:memset+0x1f|je 0x771ab3ed|eflags=0x246 | |
| 0x771ab3ed ntdll.dll:memset+0x2d|mov ecx, eax|eax=0x0 | |
| 0x771ab3ef ntdll.dll:memset+0x2f|shl eax, 8|eax=0x0 | |
| 0x771ab3f2 ntdll.dll:memset+0x32|add eax, ecx|eax=0x0|ecx=0x0 | |
| 0x771ab3f4 ntdll.dll:memset+0x34|mov ecx, eax|eax=0x0 | |
| 0x771ab3f6 ntdll.dll:memset+0x36|shl eax, 0x10|eax=0x0 | |
| 0x771ab3f9 ntdll.dll:memset+0x39|add eax, ecx|eax=0x0|ecx=0x0 | |
| 0x771ab3fb ntdll.dll:memset+0x3b|mov ecx, edx|edx=0x208 | |
| 0x771ab3fd ntdll.dll:memset+0x3d|and edx, 3|edx=0x208 | |
| 0x771ab400 ntdll.dll:memset+0x40|shr ecx, 2|ecx=0x208 | |
| 0x771ab403 ntdll.dll:memset+0x43|je 0x771ab40b|eflags=0x206 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa08|eax=0x0|eflags=0x206|ecx=0x82 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa0c|eax=0x0|eflags=0x206|ecx=0x81 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa10|eax=0x0|eflags=0x206|ecx=0x80 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa14|eax=0x0|eflags=0x206|ecx=0x7f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa18|eax=0x0|eflags=0x206|ecx=0x7e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa1c|eax=0x0|eflags=0x206|ecx=0x7d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa20|eax=0x0|eflags=0x206|ecx=0x7c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa24|eax=0x0|eflags=0x206|ecx=0x7b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa28|eax=0x0|eflags=0x206|ecx=0x7a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa2c|eax=0x0|eflags=0x206|ecx=0x79 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa30|eax=0x0|eflags=0x206|ecx=0x78 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa34|eax=0x0|eflags=0x206|ecx=0x77 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa38|eax=0x0|eflags=0x206|ecx=0x76 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa3c|eax=0x0|eflags=0x206|ecx=0x75 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa40|eax=0x0|eflags=0x206|ecx=0x74 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa44|eax=0x0|eflags=0x206|ecx=0x73 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa48|eax=0x0|eflags=0x206|ecx=0x72 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa4c|eax=0x0|eflags=0x206|ecx=0x71 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa50|eax=0x0|eflags=0x206|ecx=0x70 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa54|eax=0x0|eflags=0x206|ecx=0x6f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa58|eax=0x0|eflags=0x206|ecx=0x6e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa5c|eax=0x0|eflags=0x206|ecx=0x6d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa60|eax=0x0|eflags=0x206|ecx=0x6c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa64|eax=0x0|eflags=0x206|ecx=0x6b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa68|eax=0x0|eflags=0x206|ecx=0x6a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa6c|eax=0x0|eflags=0x206|ecx=0x69 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa70|eax=0x0|eflags=0x206|ecx=0x68 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa74|eax=0x0|eflags=0x206|ecx=0x67 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa78|eax=0x0|eflags=0x206|ecx=0x66 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa7c|eax=0x0|eflags=0x206|ecx=0x65 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa80|eax=0x0|eflags=0x206|ecx=0x64 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa84|eax=0x0|eflags=0x206|ecx=0x63 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa88|eax=0x0|eflags=0x206|ecx=0x62 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa8c|eax=0x0|eflags=0x206|ecx=0x61 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa90|eax=0x0|eflags=0x206|ecx=0x60 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa94|eax=0x0|eflags=0x206|ecx=0x5f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa98|eax=0x0|eflags=0x206|ecx=0x5e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fa9c|eax=0x0|eflags=0x206|ecx=0x5d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faa0|eax=0x0|eflags=0x206|ecx=0x5c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faa4|eax=0x0|eflags=0x206|ecx=0x5b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faa8|eax=0x0|eflags=0x206|ecx=0x5a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faac|eax=0x0|eflags=0x206|ecx=0x59 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fab0|eax=0x0|eflags=0x206|ecx=0x58 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fab4|eax=0x0|eflags=0x206|ecx=0x57 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fab8|eax=0x0|eflags=0x206|ecx=0x56 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fabc|eax=0x0|eflags=0x206|ecx=0x55 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fac0|eax=0x0|eflags=0x206|ecx=0x54 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fac4|eax=0x0|eflags=0x206|ecx=0x53 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fac8|eax=0x0|eflags=0x206|ecx=0x52 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19facc|eax=0x0|eflags=0x206|ecx=0x51 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fad0|eax=0x0|eflags=0x206|ecx=0x50 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fad4|eax=0x0|eflags=0x206|ecx=0x4f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fad8|eax=0x0|eflags=0x206|ecx=0x4e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fadc|eax=0x0|eflags=0x206|ecx=0x4d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fae0|eax=0x0|eflags=0x206|ecx=0x4c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fae4|eax=0x0|eflags=0x206|ecx=0x4b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fae8|eax=0x0|eflags=0x206|ecx=0x4a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faec|eax=0x0|eflags=0x206|ecx=0x49 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faf0|eax=0x0|eflags=0x206|ecx=0x48 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faf4|eax=0x0|eflags=0x206|ecx=0x47 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19faf8|eax=0x0|eflags=0x206|ecx=0x46 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fafc|eax=0x0|eflags=0x206|ecx=0x45 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb00|eax=0x0|eflags=0x206|ecx=0x44 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb04|eax=0x0|eflags=0x206|ecx=0x43 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb08|eax=0x0|eflags=0x206|ecx=0x42 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb0c|eax=0x0|eflags=0x206|ecx=0x41 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb10|eax=0x0|eflags=0x206|ecx=0x40 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb14|eax=0x0|eflags=0x206|ecx=0x3f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb18|eax=0x0|eflags=0x206|ecx=0x3e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb1c|eax=0x0|eflags=0x206|ecx=0x3d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb20|eax=0x0|eflags=0x206|ecx=0x3c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb24|eax=0x0|eflags=0x206|ecx=0x3b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb28|eax=0x0|eflags=0x206|ecx=0x3a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb2c|eax=0x0|eflags=0x206|ecx=0x39 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb30|eax=0x0|eflags=0x206|ecx=0x38 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb34|eax=0x0|eflags=0x206|ecx=0x37 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb38|eax=0x0|eflags=0x206|ecx=0x36 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb3c|eax=0x0|eflags=0x206|ecx=0x35 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb40|eax=0x0|eflags=0x206|ecx=0x34 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb44|eax=0x0|eflags=0x206|ecx=0x33 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb48|eax=0x0|eflags=0x206|ecx=0x32 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb4c|eax=0x0|eflags=0x206|ecx=0x31 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb50|eax=0x0|eflags=0x206|ecx=0x30 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb54|eax=0x0|eflags=0x206|ecx=0x2f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb58|eax=0x0|eflags=0x206|ecx=0x2e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb5c|eax=0x0|eflags=0x206|ecx=0x2d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb60|eax=0x0|eflags=0x206|ecx=0x2c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb64|eax=0x0|eflags=0x206|ecx=0x2b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb68|eax=0x0|eflags=0x206|ecx=0x2a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb6c|eax=0x0|eflags=0x206|ecx=0x29 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb70|eax=0x0|eflags=0x206|ecx=0x28 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb74|eax=0x0|eflags=0x206|ecx=0x27 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb78|eax=0x0|eflags=0x206|ecx=0x26 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb7c|eax=0x0|eflags=0x206|ecx=0x25 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb80|eax=0x0|eflags=0x206|ecx=0x24 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb84|eax=0x0|eflags=0x206|ecx=0x23 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb88|eax=0x0|eflags=0x206|ecx=0x22 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb8c|eax=0x0|eflags=0x206|ecx=0x21 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb90|eax=0x0|eflags=0x206|ecx=0x20 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb94|eax=0x0|eflags=0x206|ecx=0x1f | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb98|eax=0x0|eflags=0x206|ecx=0x1e | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fb9c|eax=0x0|eflags=0x206|ecx=0x1d | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fba0|eax=0x0|eflags=0x206|ecx=0x1c | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fba4|eax=0x0|eflags=0x206|ecx=0x1b | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fba8|eax=0x0|eflags=0x206|ecx=0x1a | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbac|eax=0x0|eflags=0x206|ecx=0x19 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbb0|eax=0x0|eflags=0x206|ecx=0x18 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbb4|eax=0x0|eflags=0x206|ecx=0x17 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbb8|eax=0x0|eflags=0x206|ecx=0x16 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbbc|eax=0x0|eflags=0x206|ecx=0x15 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbc0|eax=0x0|eflags=0x206|ecx=0x14 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbc4|eax=0x0|eflags=0x206|ecx=0x13 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbc8|eax=0x0|eflags=0x206|ecx=0x12 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbcc|eax=0x0|eflags=0x206|ecx=0x11 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbd0|eax=0x0|eflags=0x206|ecx=0x10 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbd4|eax=0x0|eflags=0x206|ecx=0xf | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbd8|eax=0x0|eflags=0x206|ecx=0xe | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbdc|eax=0x0|eflags=0x206|ecx=0xd | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbe0|eax=0x0|eflags=0x206|ecx=0xc | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbe4|eax=0x0|eflags=0x206|ecx=0xb | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbe8|eax=0x0|eflags=0x206|ecx=0xa | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbec|eax=0x0|eflags=0x206|ecx=0x9 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbf0|eax=0x0|eflags=0x206|ecx=0x8 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbf4|eax=0x0|eflags=0x206|ecx=0x7 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbf8|eax=0x0|eflags=0x206|ecx=0x6 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fbfc|eax=0x0|eflags=0x206|ecx=0x5 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fc00|eax=0x0|eflags=0x206|ecx=0x4 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fc04|eax=0x0|eflags=0x206|ecx=0x3 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fc08|eax=0x0|eflags=0x206|ecx=0x2 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fc0c|eax=0x0|eflags=0x206|ecx=0x1 | |
| 0x771ab405 ntdll.dll:memset+0x45|rep stosd dword ptr es:[edi], eax|edi=0x19fc10|eax=0x0|eflags=0x206|ecx=0x0 | |
| 0x771ab407 ntdll.dll:memset+0x47|test edx, edx|edx=0x0 | |
| 0x771ab409 ntdll.dll:memset+0x49|je 0x771ab415|eflags=0x246 | |
| 0x771ab415 ntdll.dll:memset+0x55|mov eax, dword ptr [esp + 8]|esp=0x19f900 | |
| 0x771ab419 ntdll.dll:memset+0x59|pop edi|edi=0x19fc10|esp=0x19f900 | |
| 0x771ab41a ntdll.dll:memset+0x5a|ret|esp=0x19f904 | |
| 0x77172e5d ntdll.dll:RtlDosSearchPath_Ustr+0x7dd|add esp, 0xc|esp=0x19f908 | |
| 0x77172e60 ntdll.dll:RtlDosSearchPath_Ustr+0x7e0|mov dword ptr [ebp - 0x30], 0|ebp=0x19f9a0 | |
| 0x77172e67 ntdll.dll:RtlDosSearchPath_Ustr+0x7e7|mov dword ptr [ebp - 0x2c], 0|ebp=0x19f9a0 | |
| 0x77172e6e ntdll.dll:RtlDosSearchPath_Ustr+0x7ee|mov eax, dword ptr [ebp - 0x58]|ebp=0x19f9a0 | |
| 0x77172e71 ntdll.dll:RtlDosSearchPath_Ustr+0x7f1|add eax, eax|eax=0x104 | |
| 0x77172e73 ntdll.dll:RtlDosSearchPath_Ustr+0x7f3|mov word ptr [ebp - 0x2e], ax|ebp=0x19f9a0|ax=0x208 | |
| 0x77172e77 ntdll.dll:RtlDosSearchPath_Ustr+0x7f7|mov dword ptr [ebp - 0x2c], edi|ebp=0x19f9a0|edi=0x19fa08 | |
| 0x77172e7a ntdll.dll:RtlDosSearchPath_Ustr+0x7fa|mov ecx, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x77172e7d ntdll.dll:RtlDosSearchPath_Ustr+0x7fd|call 0x77173600|esp=0x19f914|eip=0x77172e7d | |
| 0x77173600 ntdll.dll:RtlDosSearchPath_Ustr+0xf80|mov edi, edi|edi=0x19fa08 | |
| 0x77173602 ntdll.dll:RtlDosSearchPath_Ustr+0xf82|push ebp|ebp=0x19f9a0|esp=0x19f910 | |
| 0x77173603 ntdll.dll:RtlDosSearchPath_Ustr+0xf83|mov ebp, esp|esp=0x19f90c | |
| 0x77173605 ntdll.dll:RtlDosSearchPath_Ustr+0xf85|and esp, 0xfffffff8|esp=0x19f90c | |
| 0x77173608 ntdll.dll:RtlDosSearchPath_Ustr+0xf88|movzx eax, word ptr [ecx]|ecx=0x19fc38 | |
| 0x7717360b ntdll.dll:RtlDosSearchPath_Ustr+0xf8b|sub esp, 0x14|esp=0x19f908 | |
| 0x7717360e ntdll.dll:RtlDosSearchPath_Ustr+0xf8e|mov edx, dword ptr [ecx + 4]|ecx=0x19fc38 | |
| 0x77173611 ntdll.dll:RtlDosSearchPath_Ustr+0xf91|push ebx|ebx=0x19f9cf|esp=0x19f8f4 | |
| 0x77173612 ntdll.dll:RtlDosSearchPath_Ustr+0xf92|push esi|esi=0x19fa00|esp=0x19f8f0 | |
| 0x77173613 ntdll.dll:RtlDosSearchPath_Ustr+0xf93|xor ebx, ebx|ebx=0x19f9cf | |
| 0x77173615 ntdll.dll:RtlDosSearchPath_Ustr+0xf95|push edi|edi=0x19fa08|esp=0x19f8ec | |
| 0x77173616 ntdll.dll:RtlDosSearchPath_Ustr+0xf96|cmp eax, 2|eax=0x1e | |
| 0x77173619 ntdll.dll:RtlDosSearchPath_Ustr+0xf99|jb 0x77173658|eflags=0x202 | |
| 0x7717361b ntdll.dll:RtlDosSearchPath_Ustr+0xf9b|movzx esi, word ptr [edx]|edx=0x82b440 | |
| 0x7717361e ntdll.dll:RtlDosSearchPath_Ustr+0xf9e|cmp esi, 0x5c|esi=0x2e | |
| 0x77173621 ntdll.dll:RtlDosSearchPath_Ustr+0xfa1|je 0x77173628|eflags=0x287 | |
| 0x77173623 ntdll.dll:RtlDosSearchPath_Ustr+0xfa3|cmp esi, 0x2f|esi=0x2e | |
| 0x77173626 ntdll.dll:RtlDosSearchPath_Ustr+0xfa6|jne 0x77173658|eflags=0x297 | |
| 0x77173658 ntdll.dll:RtlDosSearchPath_Ustr+0xfd8|mov eax, dword ptr [ecx]|ecx=0x19fc38 | |
| 0x7717365a ntdll.dll:RtlDosSearchPath_Ustr+0xfda|mov esi, dword ptr [ecx + 4]|ecx=0x19fc38 | |
| 0x7717365d ntdll.dll:RtlDosSearchPath_Ustr+0xfdd|movzx edx, ax|ax=0x1e | |
| 0x77173660 ntdll.dll:RtlDosSearchPath_Ustr+0xfe0|mov dword ptr [esp + 0x18], eax|esp=0x19f8e8|eax=0x20001e | |
| 0x77173664 ntdll.dll:RtlDosSearchPath_Ustr+0xfe4|mov ax, dx|dx=0x1e | |
| 0x77173667 ntdll.dll:RtlDosSearchPath_Ustr+0xfe7|shr ax, 1|ax=0x1e | |
| 0x7717366a ntdll.dll:RtlDosSearchPath_Ustr+0xfea|movzx edi, ax|ax=0xf | |
| 0x7717366d ntdll.dll:RtlDosSearchPath_Ustr+0xfed|xor eax, eax|eax=0x20000f | |
| 0x7717366f ntdll.dll:RtlDosSearchPath_Ustr+0xfef|mov dword ptr [esp + 0x1c], esi|esp=0x19f8e8|esi=0x82b440 | |
| 0x77173673 ntdll.dll:RtlDosSearchPath_Ustr+0xff3|mov dword ptr [esp + 0x14], edx|esp=0x19f8e8|edx=0x1e | |
| 0x77173677 ntdll.dll:RtlDosSearchPath_Ustr+0xff7|mov dword ptr [esp + 0xc], eax|esp=0x19f8e8|eax=0x0 | |
| 0x7717367b ntdll.dll:RtlDosSearchPath_Ustr+0xffb|test di, di|di=0xf | |
| 0x7717367e ntdll.dll:RtlDosSearchPath_Ustr+0xffe|je 0x7717369b|eflags=0x206 | |
| 0x77173680 ntdll.dll:RtlDosSearchPath_Ustr+0x1000|cmp word ptr [esi + edi*2 - 2], 0x3a|esi=0x82b440|edi=0xf | |
| 0x77173686 ntdll.dll:RtlDosSearchPath_Ustr+0x1006|jne 0x771736a4|eflags=0x216 | |
| 0x771736a4 ntdll.dll:RtlDosSearchPath_Ustr+0x1024|mov dx, word ptr [esp + 0x18]|esp=0x19f8e8 | |
| 0x771736a9 ntdll.dll:RtlDosSearchPath_Ustr+0x1029|mov eax, 0xfffe | |
| 0x771736ae ntdll.dll:RtlDosSearchPath_Ustr+0x102e|movzx ecx, di|di=0xf | |
| 0x771736b1 ntdll.dll:RtlDosSearchPath_Ustr+0x1031|movzx ecx, word ptr [esi + ecx*2 - 2]|esi=0x82b440|ecx=0xf | |
| 0x771736b6 ntdll.dll:RtlDosSearchPath_Ustr+0x1036|cmp cx, 0x2e|cx=0x74 | |
| 0x771736ba ntdll.dll:RtlDosSearchPath_Ustr+0x103a|je 0x771736c2|eflags=0x212 | |
| 0x771736bc ntdll.dll:RtlDosSearchPath_Ustr+0x103c|cmp cx, 0x20|cx=0x74 | |
| 0x771736c0 ntdll.dll:RtlDosSearchPath_Ustr+0x1040|jne 0x771736d1|eflags=0x202 | |
| 0x771736d1 ntdll.dll:RtlDosSearchPath_Ustr+0x1051|xor ecx, ecx|ecx=0x74 | |
| 0x771736d3 ntdll.dll:RtlDosSearchPath_Ustr+0x1053|mov dword ptr [esp + 0x10], ecx|esp=0x19f8e8|ecx=0x0 | |
| 0x771736d7 ntdll.dll:RtlDosSearchPath_Ustr+0x1057|mov eax, ecx|ecx=0x0 | |
| 0x771736d9 ntdll.dll:RtlDosSearchPath_Ustr+0x1059|test di, di|di=0xf | |
| 0x771736dc ntdll.dll:RtlDosSearchPath_Ustr+0x105c|je 0x7717379f|eflags=0x206 | |
| 0x771736e2 ntdll.dll:RtlDosSearchPath_Ustr+0x1062|movzx edx, di|di=0xf | |
| 0x771736e5 ntdll.dll:RtlDosSearchPath_Ustr+0x1065|dec edx|edx=0xf | |
| 0x771736e6 ntdll.dll:RtlDosSearchPath_Ustr+0x1066|lea edx, [esi + edx*2]|esi=0x82b440|edx=0xe | |
| 0x771736e9 ntdll.dll:RtlDosSearchPath_Ustr+0x1069|cmp edx, esi|edx=0x82b45c|esi=0x82b440 | |
| 0x771736eb ntdll.dll:RtlDosSearchPath_Ustr+0x106b|jb 0x77173778|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b45c | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x74 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x74 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x74 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b45c | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b45a|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b45a | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x78 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x212 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x78 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x78 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x212 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b45a | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b458|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x206 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b458 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x74 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x74 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x74 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b458 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b456|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b456 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x2e | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x287 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x2e | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x297 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x2e | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x283 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b456 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b454|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x206 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b454 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x65 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x65 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x216 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x65 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b454 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b452|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x206 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b452 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x6c | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x202 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x6c | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x6c | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x202 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b452 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b450|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b450 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x69 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x212 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x69 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x216 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x69 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x212 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b450 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b44e|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b44e | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x66 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x66 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x66 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x212 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b44e | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b44c|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x206 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b44c | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x5f | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x206 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x5f | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x206 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x5f | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x202 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b44c | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b44a|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x206 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b44a | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x74 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x74 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x74 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b44a | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b448|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b448 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x73 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x73 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x216 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x73 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b448 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b446|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x206 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b446 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x65 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x65 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x216 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x65 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b446 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b444|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b444 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x74 | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x216 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x74 | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x212 | |
| 0x771736fe ntdll.dll:RtlDosSearchPath_Ustr+0x107e|cmp ecx, 0x3a|ecx=0x74 | |
| 0x77173701 ntdll.dll:RtlDosSearchPath_Ustr+0x1081|jne 0x7717370a|eflags=0x216 | |
| 0x7717370a ntdll.dll:RtlDosSearchPath_Ustr+0x108a|sub edx, 2|edx=0x82b444 | |
| 0x7717370d ntdll.dll:RtlDosSearchPath_Ustr+0x108d|cmp edx, esi|edx=0x82b442|esi=0x82b440 | |
| 0x7717370f ntdll.dll:RtlDosSearchPath_Ustr+0x108f|jae 0x771736f1|eflags=0x202 | |
| 0x771736f1 ntdll.dll:RtlDosSearchPath_Ustr+0x1071|movzx ecx, word ptr [edx]|edx=0x82b442 | |
| 0x771736f4 ntdll.dll:RtlDosSearchPath_Ustr+0x1074|cmp ecx, 0x5c|ecx=0x2f | |
| 0x771736f7 ntdll.dll:RtlDosSearchPath_Ustr+0x1077|je 0x77173713|eflags=0x283 | |
| 0x771736f9 ntdll.dll:RtlDosSearchPath_Ustr+0x1079|cmp ecx, 0x2f|ecx=0x2f | |
| 0x771736fc ntdll.dll:RtlDosSearchPath_Ustr+0x107c|je 0x77173713|eflags=0x246 | |
| 0x77173713 ntdll.dll:RtlDosSearchPath_Ustr+0x1093|mov edi, dword ptr [esp + 0x14]|esp=0x19f8e8 | |
| 0x77173717 ntdll.dll:RtlDosSearchPath_Ustr+0x1097|add edx, 2|edx=0x82b442 | |
| 0x7717371a ntdll.dll:RtlDosSearchPath_Ustr+0x109a|movzx ecx, di|di=0x1e | |
| 0x7717371d ntdll.dll:RtlDosSearchPath_Ustr+0x109d|mov eax, 1 | |
| 0x77173722 ntdll.dll:RtlDosSearchPath_Ustr+0x10a2|and ecx, 0xfffffffe|ecx=0x1e | |
| 0x77173725 ntdll.dll:RtlDosSearchPath_Ustr+0x10a5|mov dword ptr [esp + 0xc], eax|esp=0x19f8e8|eax=0x1 | |
| 0x77173729 ntdll.dll:RtlDosSearchPath_Ustr+0x10a9|add ecx, esi|ecx=0x1e|esi=0x82b440 | |
| 0x7717372b ntdll.dll:RtlDosSearchPath_Ustr+0x10ab|cmp edx, ecx|edx=0x82b444|ecx=0x82b45e | |
| 0x7717372d ntdll.dll:RtlDosSearchPath_Ustr+0x10ad|jae 0x7717369b|eflags=0x293 | |
| 0x77173733 ntdll.dll:RtlDosSearchPath_Ustr+0x10b3|mov cx, word ptr [edx]|edx=0x82b444 | |
| 0x77173736 ntdll.dll:RtlDosSearchPath_Ustr+0x10b6|or cx, 0x20|cx=0x74 | |
| 0x7717373a ntdll.dll:RtlDosSearchPath_Ustr+0x10ba|movzx ecx, cx|cx=0x74 | |
| 0x7717373d ntdll.dll:RtlDosSearchPath_Ustr+0x10bd|cmp ecx, 0x6c|ecx=0x74 | |
| 0x77173740 ntdll.dll:RtlDosSearchPath_Ustr+0x10c0|je 0x7717375a|eflags=0x212 | |
| 0x77173742 ntdll.dll:RtlDosSearchPath_Ustr+0x10c2|cmp ecx, 0x63|ecx=0x74 | |
| 0x77173745 ntdll.dll:RtlDosSearchPath_Ustr+0x10c5|je 0x7717375a|eflags=0x206 | |
| 0x77173747 ntdll.dll:RtlDosSearchPath_Ustr+0x10c7|cmp ecx, 0x70|ecx=0x74 | |
| 0x7717374a ntdll.dll:RtlDosSearchPath_Ustr+0x10ca|je 0x7717375a|eflags=0x202 | |
| 0x7717374c ntdll.dll:RtlDosSearchPath_Ustr+0x10cc|cmp ecx, 0x61|ecx=0x74 | |
| 0x7717374f ntdll.dll:RtlDosSearchPath_Ustr+0x10cf|je 0x7717375a|eflags=0x202 | |
| 0x77173751 ntdll.dll:RtlDosSearchPath_Ustr+0x10d1|cmp ecx, 0x6e|ecx=0x74 | |
| 0x77173754 ntdll.dll:RtlDosSearchPath_Ustr+0x10d4|jne 0x7717369b|eflags=0x216 | |
| 0x7717369b ntdll.dll:RtlDosSearchPath_Ustr+0x101b|xor eax, eax|eax=0x1 | |
| 0x7717369d ntdll.dll:RtlDosSearchPath_Ustr+0x101d|pop edi|edi=0x1e|esp=0x19f8e8 | |
| 0x7717369e ntdll.dll:RtlDosSearchPath_Ustr+0x101e|pop esi|esi=0x82b440|esp=0x19f8ec | |
| 0x7717369f ntdll.dll:RtlDosSearchPath_Ustr+0x101f|pop ebx|ebx=0x0|esp=0x19f8f0 | |
| 0x771736a0 ntdll.dll:RtlDosSearchPath_Ustr+0x1020|mov esp, ebp|ebp=0x19f90c | |
| 0x771736a2 ntdll.dll:RtlDosSearchPath_Ustr+0x1022|pop ebp|ebp=0x19f90c|esp=0x19f90c | |
| 0x771736a3 ntdll.dll:RtlDosSearchPath_Ustr+0x1023|ret|esp=0x19f910 | |
| 0x77172e82 ntdll.dll:RtlDosSearchPath_Ustr+0x802|test eax, eax|eax=0x0 | |
| 0x77172e84 ntdll.dll:RtlDosSearchPath_Ustr+0x804|je 0x77172f04|eflags=0x246 | |
| 0x77172f04 ntdll.dll:RtlDosSearchPath_Ustr+0x884|mov ebx, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x77172f07 ntdll.dll:RtlDosSearchPath_Ustr+0x887|mov eax, dword ptr [ebx + 4]|ebx=0x19fc38 | |
| 0x77172f0a ntdll.dll:RtlDosSearchPath_Ustr+0x88a|movzx ecx, word ptr [ebx]|ebx=0x19fc38 | |
| 0x77172f0d ntdll.dll:RtlDosSearchPath_Ustr+0x88d|cmp ecx, 2|ecx=0x1e | |
| 0x77172f10 ntdll.dll:RtlDosSearchPath_Ustr+0x890|jb 0x77172f7c|eflags=0x202 | |
| 0x77172f12 ntdll.dll:RtlDosSearchPath_Ustr+0x892|movzx edx, word ptr [eax]|eax=0x82b440 | |
| 0x77172f15 ntdll.dll:RtlDosSearchPath_Ustr+0x895|cmp edx, 0x5c|edx=0x2e | |
| 0x77172f18 ntdll.dll:RtlDosSearchPath_Ustr+0x898|je 0x77172f1f|eflags=0x287 | |
| 0x77172f1a ntdll.dll:RtlDosSearchPath_Ustr+0x89a|cmp edx, 0x2f|edx=0x2e | |
| 0x77172f1d ntdll.dll:RtlDosSearchPath_Ustr+0x89d|jne 0x77172f7c|eflags=0x297 | |
| 0x77172f7c ntdll.dll:RtlDosSearchPath_Ustr+0x8fc|cmp ecx, 4|ecx=0x1e | |
| 0x77172f7f ntdll.dll:RtlDosSearchPath_Ustr+0x8ff|jb 0x77172faf|eflags=0x202 | |
| 0x77172f81 ntdll.dll:RtlDosSearchPath_Ustr+0x901|cmp word ptr [eax], 0|eax=0x82b440 | |
| 0x77172f85 ntdll.dll:RtlDosSearchPath_Ustr+0x905|je 0x77172faf|eflags=0x206 | |
| 0x77172f87 ntdll.dll:RtlDosSearchPath_Ustr+0x907|cmp word ptr [eax + 2], 0x3a|eax=0x82b440 | |
| 0x77172f8c ntdll.dll:RtlDosSearchPath_Ustr+0x90c|jne 0x77172faf|eflags=0x287 | |
| 0x77172faf ntdll.dll:RtlDosSearchPath_Ustr+0x92f|mov eax, 5 | |
| 0x77172fb4 ntdll.dll:RtlDosSearchPath_Ustr+0x934|mov dword ptr [esi], eax|esi=0x19fa00|eax=0x5 | |
| 0x77172fb6 ntdll.dll:RtlDosSearchPath_Ustr+0x936|mov dword ptr [ebp - 0x40], 0|ebp=0x19f9a0 | |
| 0x77172fbd ntdll.dll:RtlDosSearchPath_Ustr+0x93d|mov dword ptr [ebp - 0x3c], 0|ebp=0x19f9a0 | |
| 0x77172fc4 ntdll.dll:RtlDosSearchPath_Ustr+0x944|mov dword ptr [ebp - 0x48], 0|ebp=0x19f9a0 | |
| 0x77172fcb ntdll.dll:RtlDosSearchPath_Ustr+0x94b|mov dword ptr [ebp - 0x60], 0|ebp=0x19f9a0 | |
| 0x77172fd2 ntdll.dll:RtlDosSearchPath_Ustr+0x952|mov byte ptr [ebp - 0x27], 0|ebp=0x19f9a0 | |
| 0x77172fd6 ntdll.dll:RtlDosSearchPath_Ustr+0x956|xor esi, esi|esi=0x19fa00 | |
| 0x77172fd8 ntdll.dll:RtlDosSearchPath_Ustr+0x958|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x0 | |
| 0x77172fdb ntdll.dll:RtlDosSearchPath_Ustr+0x95b|mov dword ptr [ebp - 4], esi|ebp=0x19f9a0|esi=0x0 | |
| 0x77172fde ntdll.dll:RtlDosSearchPath_Ustr+0x95e|cmp eax, 2|eax=0x5 | |
| 0x77172fe1 ntdll.dll:RtlDosSearchPath_Ustr+0x961|je 0x771731ff|eflags=0x206 | |
| 0x77172fe7 ntdll.dll:RtlDosSearchPath_Ustr+0x967|dec eax|eax=0x5 | |
| 0x77172fe8 ntdll.dll:RtlDosSearchPath_Ustr+0x968|cmp eax, 6|eax=0x4 | |
| 0x77172feb ntdll.dll:RtlDosSearchPath_Ustr+0x96b|ja 0x77173316|eflags=0x293 | |
| 0x77172ff1 ntdll.dll:RtlDosSearchPath_Ustr+0x971|jmp dword ptr [eax*4 + 0x771735d8]|eax=0x4 | |
| 0x771732c9 ntdll.dll:RtlDosSearchPath_Ustr+0xc49|xor cl, cl|cl=0x1e | |
| 0x771732cb ntdll.dll:RtlDosSearchPath_Ustr+0xc4b|call 0x77155c8b|esp=0x19f914|eip=0x771732cb | |
| 0x77155c8b ntdll.dll:RtlGetCurrentDirectory_U+0x9b|mov edi, edi|edi=0x19fa08 | |
| 0x77155c8d ntdll.dll:RtlGetCurrentDirectory_U+0x9d|push ebp|ebp=0x19f9a0|esp=0x19f910 | |
| 0x77155c8e ntdll.dll:RtlGetCurrentDirectory_U+0x9e|mov ebp, esp|esp=0x19f90c | |
| 0x77155c90 ntdll.dll:RtlGetCurrentDirectory_U+0xa0|and esp, 0xfffffff8|esp=0x19f90c | |
| 0x77155c93 ntdll.dll:RtlGetCurrentDirectory_U+0xa3|sub esp, 0x1c|esp=0x19f908 | |
| 0x77155c96 ntdll.dll:RtlGetCurrentDirectory_U+0xa6|push ebx|ebx=0x19fc38|esp=0x19f8ec | |
| 0x77155c97 ntdll.dll:RtlGetCurrentDirectory_U+0xa7|push esi|esi=0x0|esp=0x19f8e8 | |
| 0x77155c98 ntdll.dll:RtlGetCurrentDirectory_U+0xa8|push edi|edi=0x19fa08|esp=0x19f8e4 | |
| 0x77155c99 ntdll.dll:RtlGetCurrentDirectory_U+0xa9|mov byte ptr [esp + 0xf], cl|esp=0x19f8e0|cl=0x0 | |
| 0x77155c9d ntdll.dll:RtlGetCurrentDirectory_U+0xad|or ebx, 0xffffffff|ebx=0x19fc38 | |
| 0x77155ca0 ntdll.dll:RtlGetCurrentDirectory_U+0xb0|push 0x77258760|esp=0x19f8e0 | |
| 0x77155ca5 ntdll.dll:RtlGetCurrentDirectory_U+0xb5|call 0x7717e680|esp=0x19f8dc|eip=0x77155ca5 | |
| 0x7717e680 ntdll.dll:RtlEnterCriticalSection|mov edi, edi|edi=0x19fa08 | |
| 0x7717e682 ntdll.dll:RtlEnterCriticalSection+0x2|push ebp|ebp=0x19f90c|esp=0x19f8d8 | |
| 0x7717e683 ntdll.dll:RtlEnterCriticalSection+0x3|mov ebp, esp|esp=0x19f8d4 | |
| 0x7717e685 ntdll.dll:RtlEnterCriticalSection+0x5|and esp, 0xfffffff8|esp=0x19f8d4 | |
| 0x7717e688 ntdll.dll:RtlEnterCriticalSection+0x8|mov ecx, dword ptr [ebp + 8]|ebp=0x19f8d4 | |
| 0x7717e68b ntdll.dll:RtlEnterCriticalSection+0xb|mov edx, dword ptr fs:[0x18] | |
| 0x7717e692 ntdll.dll:RtlEnterCriticalSection+0x12|lea eax, [ecx + 4]|ecx=0x77258760 | |
| 0x7717e695 ntdll.dll:RtlEnterCriticalSection+0x15|lock btr dword ptr [eax], 0|eax=0x77258764 | |
| 0x7717e69a ntdll.dll:RtlEnterCriticalSection+0x1a|jae 0x7717e6b1|eflags=0xa03 | |
| 0x7717e69c ntdll.dll:RtlEnterCriticalSection+0x1c|mov eax, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x7717e69f ntdll.dll:RtlEnterCriticalSection+0x1f|mov dword ptr [ecx + 0xc], eax|ecx=0x77258760|eax=0x1fc0 | |
| 0x7717e6a2 ntdll.dll:RtlEnterCriticalSection+0x22|xor eax, eax|eax=0x1fc0 | |
| 0x7717e6a4 ntdll.dll:RtlEnterCriticalSection+0x24|mov dword ptr [ecx + 8], 1|ecx=0x77258760 | |
| 0x7717e6ab ntdll.dll:RtlEnterCriticalSection+0x2b|mov esp, ebp|ebp=0x19f8d4 | |
| 0x7717e6ad ntdll.dll:RtlEnterCriticalSection+0x2d|pop ebp|ebp=0x19f8d4|esp=0x19f8d4 | |
| 0x7717e6ae ntdll.dll:RtlEnterCriticalSection+0x2e|ret 4|esp=0x19f8d8 | |
| 0x77155caa ntdll.dll:RtlGetCurrentDirectory_U+0xba|mov esi, dword ptr [0x77259044] | |
| 0x77155cb0 ntdll.dll:RtlGetCurrentDirectory_U+0xc0|test esi, esi|esi=0x826490 | |
| 0x77155cb2 ntdll.dll:RtlGetCurrentDirectory_U+0xc2|je 0x77155cf4|eflags=0x206 | |
| 0x77155cb4 ntdll.dll:RtlGetCurrentDirectory_U+0xc4|lock inc dword ptr [esi]|esi=0x826490 | |
| 0x77155cb7 ntdll.dll:RtlGetCurrentDirectory_U+0xc7|mov eax, dword ptr [esi + 8]|esi=0x826490 | |
| 0x77155cba ntdll.dll:RtlGetCurrentDirectory_U+0xca|push 0x77258760|esp=0x19f8e0 | |
| 0x77155cbf ntdll.dll:RtlGetCurrentDirectory_U+0xcf|mov dword ptr [esp + 0x18], eax|esp=0x19f8dc|eax=0x0 | |
| 0x77155cc3 ntdll.dll:RtlGetCurrentDirectory_U+0xd3|call 0x77177b20|esp=0x19f8dc|eip=0x77155cc3 | |
| 0x77177b20 ntdll.dll:RtlLeaveCriticalSection|mov edi, edi|edi=0x19fa08 | |
| 0x77177b22 ntdll.dll:RtlLeaveCriticalSection+0x2|push ebp|ebp=0x19f90c|esp=0x19f8d8 | |
| 0x77177b23 ntdll.dll:RtlLeaveCriticalSection+0x3|mov ebp, esp|esp=0x19f8d4 | |
| 0x77177b25 ntdll.dll:RtlLeaveCriticalSection+0x5|sub esp, 8|esp=0x19f8d4 | |
| 0x77177b28 ntdll.dll:RtlLeaveCriticalSection+0x8|push ebx|ebx=0xffffffff|esp=0x19f8cc | |
| 0x77177b29 ntdll.dll:RtlLeaveCriticalSection+0x9|mov ebx, dword ptr [ebp + 8]|ebp=0x19f8d4 | |
| 0x77177b2c ntdll.dll:RtlLeaveCriticalSection+0xc|push esi|esi=0x826490|esp=0x19f8c8 | |
| 0x77177b2d ntdll.dll:RtlLeaveCriticalSection+0xd|push edi|edi=0x19fa08|esp=0x19f8c4 | |
| 0x77177b2e ntdll.dll:RtlLeaveCriticalSection+0xe|add dword ptr [ebx + 8], -1|ebx=0x77258760 | |
| 0x77177b32 ntdll.dll:RtlLeaveCriticalSection+0x12|jne 0x77177bc3|eflags=0x257 | |
| 0x77177b38 ntdll.dll:RtlLeaveCriticalSection+0x18|mov dword ptr [ebx + 0xc], 0|ebx=0x77258760 | |
| 0x77177b3f ntdll.dll:RtlLeaveCriticalSection+0x1f|lea edi, [ebx + 4]|ebx=0x77258760 | |
| 0x77177b42 ntdll.dll:RtlLeaveCriticalSection+0x22|or ecx, 0xffffffff|ecx=0x77258760 | |
| 0x77177b45 ntdll.dll:RtlLeaveCriticalSection+0x25|mov eax, 0xfffffffe | |
| 0x77177b4a ntdll.dll:RtlLeaveCriticalSection+0x2a|lock cmpxchg dword ptr [edi], ecx|edi=0x77258764|ecx=0xffffffff|eax=0xfffffffe | |
| 0x77177b4e ntdll.dll:RtlLeaveCriticalSection+0x2e|mov esi, eax|eax=0xfffffffe | |
| 0x77177b50 ntdll.dll:RtlLeaveCriticalSection+0x30|cmp esi, -2|esi=0xfffffffe | |
| 0x77177b53 ntdll.dll:RtlLeaveCriticalSection+0x33|je 0x77177bc3|eflags=0x246 | |
| 0x77177bc3 ntdll.dll:RtlLeaveCriticalSection+0xa3|pop edi|edi=0x77258764|esp=0x19f8c0 | |
| 0x77177bc4 ntdll.dll:RtlLeaveCriticalSection+0xa4|pop esi|esi=0xfffffffe|esp=0x19f8c4 | |
| 0x77177bc5 ntdll.dll:RtlLeaveCriticalSection+0xa5|xor eax, eax|eax=0xfffffffe | |
| 0x77177bc7 ntdll.dll:RtlLeaveCriticalSection+0xa7|pop ebx|ebx=0x77258760|esp=0x19f8c8 | |
| 0x77177bc8 ntdll.dll:RtlLeaveCriticalSection+0xa8|mov esp, ebp|ebp=0x19f8d4 | |
| 0x77177bca ntdll.dll:RtlLeaveCriticalSection+0xaa|pop ebp|ebp=0x19f8d4|esp=0x19f8d4 | |
| 0x77177bcb ntdll.dll:RtlLeaveCriticalSection+0xab|ret 4|esp=0x19f8d8 | |
| 0x77155cc8 ntdll.dll:RtlGetCurrentDirectory_U+0xd8|cmp byte ptr [esp + 0xf], 0|esp=0x19f8e0 | |
| 0x77155ccd ntdll.dll:RtlGetCurrentDirectory_U+0xdd|jne 0x77155cd8|eflags=0x246 | |
| 0x77155ccf ntdll.dll:RtlGetCurrentDirectory_U+0xdf|mov eax, esi|esi=0x826490 | |
| 0x77155cd1 ntdll.dll:RtlGetCurrentDirectory_U+0xe1|pop edi|edi=0x19fa08|esp=0x19f8e0 | |
| 0x77155cd2 ntdll.dll:RtlGetCurrentDirectory_U+0xe2|pop esi|esi=0x826490|esp=0x19f8e4 | |
| 0x77155cd3 ntdll.dll:RtlGetCurrentDirectory_U+0xe3|pop ebx|ebx=0xffffffff|esp=0x19f8e8 | |
| 0x77155cd4 ntdll.dll:RtlGetCurrentDirectory_U+0xe4|mov esp, ebp|ebp=0x19f90c | |
| 0x77155cd6 ntdll.dll:RtlGetCurrentDirectory_U+0xe6|pop ebp|ebp=0x19f90c|esp=0x19f90c | |
| 0x77155cd7 ntdll.dll:RtlGetCurrentDirectory_U+0xe7|ret|esp=0x19f910 | |
| 0x771732d0 ntdll.dll:RtlDosSearchPath_Ustr+0xc50|mov dword ptr [ebp - 0x60], eax|ebp=0x19f9a0|eax=0x826490 | |
| 0x771732d3 ntdll.dll:RtlDosSearchPath_Ustr+0xc53|mov byte ptr [ebp - 0x27], 1|ebp=0x19f9a0 | |
| 0x771732d7 ntdll.dll:RtlDosSearchPath_Ustr+0xc57|test eax, eax|eax=0x826490 | |
| 0x771732d9 ntdll.dll:RtlDosSearchPath_Ustr+0xc59|je 0x771732e9|eflags=0x206 | |
| 0x771732db ntdll.dll:RtlDosSearchPath_Ustr+0xc5b|lea ecx, [eax + 0xc]|eax=0x826490 | |
| 0x771732de ntdll.dll:RtlDosSearchPath_Ustr+0xc5e|mov eax, dword ptr [eax + 0x14]|eax=0x826490 | |
| 0x771732e1 ntdll.dll:RtlDosSearchPath_Ustr+0xc61|mov edx, dword ptr [ebp - 0x64]|ebp=0x19f9a0 | |
| 0x771732e4 ntdll.dll:RtlDosSearchPath_Ustr+0xc64|mov dword ptr [edx + 4], eax|edx=0x19fa00|eax=0x20020 | |
| 0x771732e7 ntdll.dll:RtlDosSearchPath_Ustr+0xc67|jmp 0x771732fe | |
| 0x771732fe ntdll.dll:RtlDosSearchPath_Ustr+0xc7e|mov eax, dword ptr [ecx]|ecx=0x82649c | |
| 0x77173300 ntdll.dll:RtlDosSearchPath_Ustr+0xc80|mov edx, dword ptr [ecx + 4]|ecx=0x82649c | |
| 0x77173303 ntdll.dll:RtlDosSearchPath_Ustr+0xc83|mov dword ptr [ebp - 0x40], eax|ebp=0x19f9a0|eax=0x2080010 | |
| 0x77173306 ntdll.dll:RtlDosSearchPath_Ustr+0xc86|mov dword ptr [ebp - 0x3c], edx|ebp=0x19f9a0|edx=0x8264a8 | |
| 0x77173309 ntdll.dll:RtlDosSearchPath_Ustr+0xc89|call 0x771575e0|esp=0x19f914|eip=0x77173309 | |
| 0x771575e0 ntdll.dll:RtlProtectHeap+0x190|mov edi, edi|edi=0x19fa08 | |
| 0x771575e2 ntdll.dll:RtlProtectHeap+0x192|push esi|esi=0x0|esp=0x19f910 | |
| 0x771575e3 ntdll.dll:RtlProtectHeap+0x193|mov esi, ecx|ecx=0x82649c | |
| 0x771575e5 ntdll.dll:RtlProtectHeap+0x195|call 0x7717093e|esp=0x19f90c|eip=0x771575e5 | |
| 0x7717093e ntdll.dll:LdrGetDllHandleEx+0xaee|mov edx, dword ptr [ecx + 4]|ecx=0x82649c | |
| 0x77170941 ntdll.dll:LdrGetDllHandleEx+0xaf1|movzx ecx, word ptr [ecx]|ecx=0x82649c | |
| 0x77170944 ntdll.dll:LdrGetDllHandleEx+0xaf4|push ebx|ebx=0x19fc38|esp=0x19f908 | |
| 0x77170945 ntdll.dll:LdrGetDllHandleEx+0xaf5|push esi|esi=0x82649c|esp=0x19f904 | |
| 0x77170946 ntdll.dll:LdrGetDllHandleEx+0xaf6|push edi|edi=0x19fa08|esp=0x19f900 | |
| 0x77170947 ntdll.dll:LdrGetDllHandleEx+0xaf7|push 2|esp=0x19f8fc | |
| 0x77170949 ntdll.dll:LdrGetDllHandleEx+0xaf9|pop eax|eax=0x2080010|esp=0x19f8f8 | |
| 0x7717094a ntdll.dll:LdrGetDllHandleEx+0xafa|cmp cx, ax|cx=0x10|ax=0x2 | |
| 0x7717094d ntdll.dll:LdrGetDllHandleEx+0xafd|jb 0x77170999|eflags=0x212 | |
| 0x7717094f ntdll.dll:LdrGetDllHandleEx+0xaff|movzx esi, word ptr [edx]|edx=0x8264a8 | |
| 0x77170952 ntdll.dll:LdrGetDllHandleEx+0xb02|push 0x2f|esp=0x19f8fc | |
| 0x77170954 ntdll.dll:LdrGetDllHandleEx+0xb04|pop edi|edi=0x19fa08|esp=0x19f8f8 | |
| 0x77170955 ntdll.dll:LdrGetDllHandleEx+0xb05|push 0x5c|esp=0x19f8fc | |
| 0x77170957 ntdll.dll:LdrGetDllHandleEx+0xb07|pop ebx|ebx=0x19fc38|esp=0x19f8f8 | |
| 0x77170958 ntdll.dll:LdrGetDllHandleEx+0xb08|cmp si, bx|si=0x43|bx=0x5c | |
| 0x7717095b ntdll.dll:LdrGetDllHandleEx+0xb0b|je 0x771d2458|eflags=0x297 | |
| 0x77170961 ntdll.dll:LdrGetDllHandleEx+0xb11|cmp si, di|si=0x43|di=0x2f | |
| 0x77170964 ntdll.dll:LdrGetDllHandleEx+0xb14|je 0x771d2458|eflags=0x216 | |
| 0x7717096a ntdll.dll:LdrGetDllHandleEx+0xb1a|cmp ecx, 4|ecx=0x10 | |
| 0x7717096d ntdll.dll:LdrGetDllHandleEx+0xb1d|jb 0x77170999|eflags=0x216 | |
| 0x7717096f ntdll.dll:LdrGetDllHandleEx+0xb1f|cmp word ptr [edx], 0|edx=0x8264a8 | |
| 0x77170973 ntdll.dll:LdrGetDllHandleEx+0xb23|je 0x77170999|eflags=0x202 | |
| 0x77170975 ntdll.dll:LdrGetDllHandleEx+0xb25|cmp word ptr [edx + 2], 0x3a|edx=0x8264a8 | |
| 0x7717097a ntdll.dll:LdrGetDllHandleEx+0xb2a|jne 0x77170999|eflags=0x246 | |
| 0x7717097c ntdll.dll:LdrGetDllHandleEx+0xb2c|cmp ecx, 6|ecx=0x10 | |
| 0x7717097f ntdll.dll:LdrGetDllHandleEx+0xb2f|jb 0x77170992|eflags=0x216 | |
| 0x77170981 ntdll.dll:LdrGetDllHandleEx+0xb31|movzx ecx, word ptr [edx + 4]|edx=0x8264a8 | |
| 0x77170985 ntdll.dll:LdrGetDllHandleEx+0xb35|cmp cx, bx|cx=0x5c|bx=0x5c | |
| 0x77170988 ntdll.dll:LdrGetDllHandleEx+0xb38|jne 0x771d244a|eflags=0x246 | |
| 0x7717098e ntdll.dll:LdrGetDllHandleEx+0xb3e|pop edi|edi=0x2f|esp=0x19f8fc | |
| 0x7717098f ntdll.dll:LdrGetDllHandleEx+0xb3f|pop esi|esi=0x43|esp=0x19f900 | |
| 0x77170990 ntdll.dll:LdrGetDllHandleEx+0xb40|pop ebx|ebx=0x5c|esp=0x19f904 | |
| 0x77170991 ntdll.dll:LdrGetDllHandleEx+0xb41|ret|esp=0x19f908 | |
| 0x771575ea ntdll.dll:RtlProtectHeap+0x19a|cmp eax, 1|eax=0x2 | |
| 0x771575ed ntdll.dll:RtlProtectHeap+0x19d|je 0x771ca9e5|eflags=0x202 | |
| 0x771575f3 ntdll.dll:RtlProtectHeap+0x1a3|push 3|esp=0x19f90c | |
| 0x771575f5 ntdll.dll:RtlProtectHeap+0x1a5|pop eax|eax=0x2|esp=0x19f908 | |
| 0x771575f6 ntdll.dll:RtlProtectHeap+0x1a6|pop esi|esi=0x82649c|esp=0x19f90c | |
| 0x771575f7 ntdll.dll:RtlProtectHeap+0x1a7|ret|esp=0x19f910 | |
| 0x7717330e ntdll.dll:RtlDosSearchPath_Ustr+0xc8e|mov dword ptr [ebp - 0x38], eax|ebp=0x19f9a0|eax=0x3 | |
| 0x77173311 ntdll.dll:RtlDosSearchPath_Ustr+0xc91|jmp 0x77173044 | |
| 0x77173044 ntdll.dll:RtlDosSearchPath_Ustr+0x9c4|lea edx, [ebp - 0x40]|ebp=0x19f9a0 | |
| 0x77173047 ntdll.dll:RtlDosSearchPath_Ustr+0x9c7|lea ecx, [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717304a ntdll.dll:RtlDosSearchPath_Ustr+0x9ca|call 0x77191c8e|esp=0x19f914|eip=0x7717304a | |
| 0x77191c8e ntdll.dll:RtlInitializeSid+0x29e|mov edi, edi|edi=0x19fa08 | |
| 0x77191c90 ntdll.dll:RtlInitializeSid+0x2a0|push ebp|ebp=0x19f9a0|esp=0x19f910 | |
| 0x77191c91 ntdll.dll:RtlInitializeSid+0x2a1|mov ebp, esp|esp=0x19f90c | |
| 0x77191c93 ntdll.dll:RtlInitializeSid+0x2a3|sub esp, 0x14|esp=0x19f90c | |
| 0x77191c96 ntdll.dll:RtlInitializeSid+0x2a6|lea eax, [ebp - 0x10]|ebp=0x19f90c | |
| 0x77191c99 ntdll.dll:RtlInitializeSid+0x2a9|push ebx|ebx=0x19fc38|esp=0x19f8f8 | |
| 0x77191c9a ntdll.dll:RtlInitializeSid+0x2aa|push esi|esi=0x0|esp=0x19f8f4 | |
| 0x77191c9b ntdll.dll:RtlInitializeSid+0x2ab|push edi|edi=0x19fa08|esp=0x19f8f0 | |
| 0x77191c9c ntdll.dll:RtlInitializeSid+0x2ac|push ecx|ecx=0x19f970|esp=0x19f8ec | |
| 0x77191c9d ntdll.dll:RtlInitializeSid+0x2ad|push ecx|ecx=0x19f970|esp=0x19f8e8 | |
| 0x77191c9e ntdll.dll:RtlInitializeSid+0x2ae|xor esi, esi|esi=0x0 | |
| 0x77191ca0 ntdll.dll:RtlInitializeSid+0x2b0|mov ebx, edx|edx=0x19f960 | |
| 0x77191ca2 ntdll.dll:RtlInitializeSid+0x2b2|push esi|esi=0x0|esp=0x19f8e4 | |
| 0x77191ca3 ntdll.dll:RtlInitializeSid+0x2b3|push eax|eax=0x19f8fc|esp=0x19f8e0 | |
| 0x77191ca4 ntdll.dll:RtlInitializeSid+0x2b4|lea edx, [ebp - 0x14]|ebp=0x19f90c | |
| 0x77191ca7 ntdll.dll:RtlInitializeSid+0x2b7|mov edi, ecx|ecx=0x19f970 | |
| 0x77191ca9 ntdll.dll:RtlInitializeSid+0x2b9|call 0x77191d36|esp=0x19f8dc|eip=0x77191ca9 | |
| 0x77191d36 ntdll.dll:RtlInitializeSid+0x346|mov edi, edi|edi=0x19f970 | |
| 0x77191d38 ntdll.dll:RtlInitializeSid+0x348|push ebp|ebp=0x19f90c|esp=0x19f8d8 | |
| 0x77191d39 ntdll.dll:RtlInitializeSid+0x349|mov ebp, esp|esp=0x19f8d4 | |
| 0x77191d3b ntdll.dll:RtlInitializeSid+0x34b|mov eax, dword ptr [ebp + 8]|ebp=0x19f8d4 | |
| 0x77191d3e ntdll.dll:RtlInitializeSid+0x34e|push ebx|ebx=0x19f960|esp=0x19f8d4 | |
| 0x77191d3f ntdll.dll:RtlInitializeSid+0x34f|push esi|esi=0x0|esp=0x19f8d0 | |
| 0x77191d40 ntdll.dll:RtlInitializeSid+0x350|mov ebx, edx|edx=0x19f8f8 | |
| 0x77191d42 ntdll.dll:RtlInitializeSid+0x352|mov esi, ecx|ecx=0x19f970 | |
| 0x77191d44 ntdll.dll:RtlInitializeSid+0x354|xor ecx, ecx|ecx=0x19f970 | |
| 0x77191d46 ntdll.dll:RtlInitializeSid+0x356|push edi|edi=0x19f970|esp=0x19f8cc | |
| 0x77191d47 ntdll.dll:RtlInitializeSid+0x357|mov edi, dword ptr [ebp + 0xc]|ebp=0x19f8d4 | |
| 0x77191d4a ntdll.dll:RtlInitializeSid+0x35a|mov dword ptr [ebx], ecx|ebx=0x19f8f8|ecx=0x0 | |
| 0x77191d4c ntdll.dll:RtlInitializeSid+0x35c|mov dword ptr [eax], ecx|eax=0x19f8fc|ecx=0x0 | |
| 0x77191d4e ntdll.dll:RtlInitializeSid+0x35e|test edi, edi|edi=0x0 | |
| 0x77191d50 ntdll.dll:RtlInitializeSid+0x360|jne 0x77191d81|eflags=0x246 | |
| 0x77191d52 ntdll.dll:RtlInitializeSid+0x362|push ecx|ecx=0x0|esp=0x19f8c8 | |
| 0x77191d53 ntdll.dll:RtlInitializeSid+0x363|mov ecx, esi|esi=0x19f970 | |
| 0x77191d55 ntdll.dll:RtlInitializeSid+0x365|call 0x77191e8b|esp=0x19f8c4|eip=0x77191d55 | |
| 0x77191e8b ntdll.dll:RtlInitializeSid+0x49b|mov edi, edi|edi=0x0 | |
| 0x77191e8d ntdll.dll:RtlInitializeSid+0x49d|push esi|esi=0x19f970|esp=0x19f8c0 | |
| 0x77191e8e ntdll.dll:RtlInitializeSid+0x49e|mov esi, ecx|ecx=0x19f970 | |
| 0x77191e90 ntdll.dll:RtlInitializeSid+0x4a0|xor eax, eax|eax=0x19f8fc | |
| 0x77191e92 ntdll.dll:RtlInitializeSid+0x4a2|movzx ecx, word ptr [esi]|esi=0x19f970 | |
| 0x77191e95 ntdll.dll:RtlInitializeSid+0x4a5|test cl, 1|cl=0x0 | |
| 0x77191e98 ntdll.dll:RtlInitializeSid+0x4a8|jne 0x77191ec7|eflags=0x246 | |
| 0x77191e9a ntdll.dll:RtlInitializeSid+0x4aa|movzx edx, word ptr [esi + 2]|esi=0x19f970 | |
| 0x77191e9e ntdll.dll:RtlInitializeSid+0x4ae|test dl, 1|dl=0x8 | |
| 0x77191ea1 ntdll.dll:RtlInitializeSid+0x4b1|jne 0x77191ec7|eflags=0x246 | |
| 0x77191ea3 ntdll.dll:RtlInitializeSid+0x4b3|cmp cx, dx|cx=0x0|dx=0x208 | |
| 0x77191ea6 ntdll.dll:RtlInitializeSid+0x4b6|ja 0x77191ec7|eflags=0x293 | |
| 0x77191ea8 ntdll.dll:RtlInitializeSid+0x4b8|push edi|edi=0x0|esp=0x19f8bc | |
| 0x77191ea9 ntdll.dll:RtlInitializeSid+0x4b9|mov edi, 0xfffe | |
| 0x77191eae ntdll.dll:RtlInitializeSid+0x4be|cmp dx, di|dx=0x208|di=0xfffe | |
| 0x77191eb1 ntdll.dll:RtlInitializeSid+0x4c1|pop edi|edi=0xfffe|esp=0x19f8b8 | |
| 0x77191eb2 ntdll.dll:RtlInitializeSid+0x4c2|ja 0x77191ec7|eflags=0x217 | |
| 0x77191eb4 ntdll.dll:RtlInitializeSid+0x4c4|cmp dword ptr [esi + 4], eax|esi=0x19f970|eax=0x0 | |
| 0x77191eb7 ntdll.dll:RtlInitializeSid+0x4c7|je 0x77191ebd|eflags=0x202 | |
| 0x77191eb9 ntdll.dll:RtlInitializeSid+0x4c9|pop esi|esi=0x19f970|esp=0x19f8bc | |
| 0x77191eba ntdll.dll:RtlInitializeSid+0x4ca|ret 4|esp=0x19f8c0 | |
| 0x77191d5a ntdll.dll:RtlInitializeSid+0x36a|mov edx, eax|eax=0x0 | |
| 0x77191d5c ntdll.dll:RtlInitializeSid+0x36c|test edx, edx|edx=0x0 | |
| 0x77191d5e ntdll.dll:RtlInitializeSid+0x36e|js 0x77191d78|eflags=0x246 | |
| 0x77191d60 ntdll.dll:RtlInitializeSid+0x370|test esi, esi|esi=0x19f970 | |
| 0x77191d62 ntdll.dll:RtlInitializeSid+0x372|je 0x77191d78|eflags=0x202 | |
| 0x77191d64 ntdll.dll:RtlInitializeSid+0x374|mov ecx, dword ptr [esi + 4]|esi=0x19f970 | |
| 0x77191d67 ntdll.dll:RtlInitializeSid+0x377|mov eax, dword ptr [ebp + 8]|ebp=0x19f8d4 | |
| 0x77191d6a ntdll.dll:RtlInitializeSid+0x37a|mov dword ptr [ebx], ecx|ebx=0x19f8f8|ecx=0x19fa08 | |
| 0x77191d6c ntdll.dll:RtlInitializeSid+0x37c|movzx ecx, word ptr [esi + 2]|esi=0x19f970 | |
| 0x77191d70 ntdll.dll:RtlInitializeSid+0x380|shr ecx, 1|ecx=0x208 | |
| 0x77191d72 ntdll.dll:RtlInitializeSid+0x382|mov dword ptr [eax], ecx|eax=0x19f8fc|ecx=0x104 | |
| 0x77191d74 ntdll.dll:RtlInitializeSid+0x384|test edi, edi|edi=0x0 | |
| 0x77191d76 ntdll.dll:RtlInitializeSid+0x386|jne 0x77191d85|eflags=0x246 | |
| 0x77191d78 ntdll.dll:RtlInitializeSid+0x388|pop edi|edi=0x0|esp=0x19f8c8 | |
| 0x77191d79 ntdll.dll:RtlInitializeSid+0x389|pop esi|esi=0x19f970|esp=0x19f8cc | |
| 0x77191d7a ntdll.dll:RtlInitializeSid+0x38a|mov eax, edx|edx=0x0 | |
| 0x77191d7c ntdll.dll:RtlInitializeSid+0x38c|pop ebx|ebx=0x19f8f8|esp=0x19f8d0 | |
| 0x77191d7d ntdll.dll:RtlInitializeSid+0x38d|pop ebp|ebp=0x19f8d4|esp=0x19f8d4 | |
| 0x77191d7e ntdll.dll:RtlInitializeSid+0x38e|ret 0x10|esp=0x19f8d8 | |
| 0x77191cae ntdll.dll:RtlInitializeSid+0x2be|mov ecx, eax|eax=0x0 | |
| 0x77191cb0 ntdll.dll:RtlInitializeSid+0x2c0|test ecx, ecx|ecx=0x0 | |
| 0x77191cb2 ntdll.dll:RtlInitializeSid+0x2c2|js 0x77191ced|eflags=0x246 | |
| 0x77191cb4 ntdll.dll:RtlInitializeSid+0x2c4|push ecx|ecx=0x0|esp=0x19f8ec | |
| 0x77191cb5 ntdll.dll:RtlInitializeSid+0x2c5|push ecx|ecx=0x0|esp=0x19f8e8 | |
| 0x77191cb6 ntdll.dll:RtlInitializeSid+0x2c6|lea eax, [ebp - 8]|ebp=0x19f90c | |
| 0x77191cb9 ntdll.dll:RtlInitializeSid+0x2c9|mov dword ptr [ebp - 4], esi|ebp=0x19f90c|esi=0x0 | |
| 0x77191cbc ntdll.dll:RtlInitializeSid+0x2cc|push eax|eax=0x19f904|esp=0x19f8e4 | |
| 0x77191cbd ntdll.dll:RtlInitializeSid+0x2cd|lea edx, [ebp - 0xc]|ebp=0x19f90c | |
| 0x77191cc0 ntdll.dll:RtlInitializeSid+0x2d0|mov ecx, ebx|ebx=0x19f960 | |
| 0x77191cc2 ntdll.dll:RtlInitializeSid+0x2d2|call 0x77191cfa|esp=0x19f8e0|eip=0x77191cc2 | |
| 0x77191cfa ntdll.dll:RtlInitializeSid+0x30a|mov edi, edi|edi=0x19f970 | |
| 0x77191cfc ntdll.dll:RtlInitializeSid+0x30c|push ebp|ebp=0x19f90c|esp=0x19f8dc | |
| 0x77191cfd ntdll.dll:RtlInitializeSid+0x30d|mov ebp, esp|esp=0x19f8d8 | |
| 0x77191cff ntdll.dll:RtlInitializeSid+0x30f|push ebx|ebx=0x19f960|esp=0x19f8d8 | |
| 0x77191d00 ntdll.dll:RtlInitializeSid+0x310|mov ebx, dword ptr [ebp + 8]|ebp=0x19f8d8 | |
| 0x77191d03 ntdll.dll:RtlInitializeSid+0x313|push esi|esi=0x0|esp=0x19f8d4 | |
| 0x77191d04 ntdll.dll:RtlInitializeSid+0x314|push edi|edi=0x19f970|esp=0x19f8d0 | |
| 0x77191d05 ntdll.dll:RtlInitializeSid+0x315|mov edi, edx|edx=0x19f900 | |
| 0x77191d07 ntdll.dll:RtlInitializeSid+0x317|mov esi, ecx|ecx=0x19f960 | |
| 0x77191d09 ntdll.dll:RtlInitializeSid+0x319|and dword ptr [ebx], 0|ebx=0x19f904 | |
| 0x77191d0c ntdll.dll:RtlInitializeSid+0x31c|push ecx|ecx=0x19f960|esp=0x19f8cc | |
| 0x77191d0d ntdll.dll:RtlInitializeSid+0x31d|and dword ptr [edi], 0|edi=0x19f900 | |
| 0x77191d10 ntdll.dll:RtlInitializeSid+0x320|call 0x77191e8b|esp=0x19f8c8|eip=0x77191d10 | |
| 0x77191e8b ntdll.dll:RtlInitializeSid+0x49b|mov edi, edi|edi=0x19f900 | |
| 0x77191e8d ntdll.dll:RtlInitializeSid+0x49d|push esi|esi=0x19f960|esp=0x19f8c4 | |
| 0x77191e8e ntdll.dll:RtlInitializeSid+0x49e|mov esi, ecx|ecx=0x19f960 | |
| 0x77191e90 ntdll.dll:RtlInitializeSid+0x4a0|xor eax, eax|eax=0x19f904 | |
| 0x77191e92 ntdll.dll:RtlInitializeSid+0x4a2|movzx ecx, word ptr [esi]|esi=0x19f960 | |
| 0x77191e95 ntdll.dll:RtlInitializeSid+0x4a5|test cl, 1|cl=0x10 | |
| 0x77191e98 ntdll.dll:RtlInitializeSid+0x4a8|jne 0x77191ec7|eflags=0x246 | |
| 0x77191e9a ntdll.dll:RtlInitializeSid+0x4aa|movzx edx, word ptr [esi + 2]|esi=0x19f960 | |
| 0x77191e9e ntdll.dll:RtlInitializeSid+0x4ae|test dl, 1|dl=0x8 | |
| 0x77191ea1 ntdll.dll:RtlInitializeSid+0x4b1|jne 0x77191ec7|eflags=0x246 | |
| 0x77191ea3 ntdll.dll:RtlInitializeSid+0x4b3|cmp cx, dx|cx=0x10|dx=0x208 | |
| 0x77191ea6 ntdll.dll:RtlInitializeSid+0x4b6|ja 0x77191ec7|eflags=0x293 | |
| 0x77191ea8 ntdll.dll:RtlInitializeSid+0x4b8|push edi|edi=0x19f900|esp=0x19f8c0 | |
| 0x77191ea9 ntdll.dll:RtlInitializeSid+0x4b9|mov edi, 0xfffe | |
| 0x77191eae ntdll.dll:RtlInitializeSid+0x4be|cmp dx, di|dx=0x208|di=0xfffe | |
| 0x77191eb1 ntdll.dll:RtlInitializeSid+0x4c1|pop edi|edi=0xfffe|esp=0x19f8bc | |
| 0x77191eb2 ntdll.dll:RtlInitializeSid+0x4c2|ja 0x77191ec7|eflags=0x217 | |
| 0x77191eb4 ntdll.dll:RtlInitializeSid+0x4c4|cmp dword ptr [esi + 4], eax|esi=0x19f960|eax=0x0 | |
| 0x77191eb7 ntdll.dll:RtlInitializeSid+0x4c7|je 0x77191ebd|eflags=0x202 | |
| 0x77191eb9 ntdll.dll:RtlInitializeSid+0x4c9|pop esi|esi=0x19f960|esp=0x19f8c0 | |
| 0x77191eba ntdll.dll:RtlInitializeSid+0x4ca|ret 4|esp=0x19f8c4 | |
| 0x77191d15 ntdll.dll:RtlInitializeSid+0x325|test eax, eax|eax=0x0 | |
| 0x77191d17 ntdll.dll:RtlInitializeSid+0x327|js 0x77191d29|eflags=0x246 | |
| 0x77191d19 ntdll.dll:RtlInitializeSid+0x329|test esi, esi|esi=0x19f960 | |
| 0x77191d1b ntdll.dll:RtlInitializeSid+0x32b|je 0x77191d29|eflags=0x206 | |
| 0x77191d1d ntdll.dll:RtlInitializeSid+0x32d|mov ecx, dword ptr [esi + 4]|esi=0x19f960 | |
| 0x77191d20 ntdll.dll:RtlInitializeSid+0x330|mov dword ptr [edi], ecx|edi=0x19f900|ecx=0x8264a8 | |
| 0x77191d22 ntdll.dll:RtlInitializeSid+0x332|movzx ecx, word ptr [esi]|esi=0x19f960 | |
| 0x77191d25 ntdll.dll:RtlInitializeSid+0x335|shr ecx, 1|ecx=0x10 | |
| 0x77191d27 ntdll.dll:RtlInitializeSid+0x337|mov dword ptr [ebx], ecx|ebx=0x19f904|ecx=0x8 | |
| 0x77191d29 ntdll.dll:RtlInitializeSid+0x339|pop edi|edi=0x19f900|esp=0x19f8cc | |
| 0x77191d2a ntdll.dll:RtlInitializeSid+0x33a|pop esi|esi=0x19f960|esp=0x19f8d0 | |
| 0x77191d2b ntdll.dll:RtlInitializeSid+0x33b|pop ebx|ebx=0x19f904|esp=0x19f8d4 | |
| 0x77191d2c ntdll.dll:RtlInitializeSid+0x33c|pop ebp|ebp=0x19f8d8|esp=0x19f8d8 | |
| 0x77191d2d ntdll.dll:RtlInitializeSid+0x33d|ret 0xc|esp=0x19f8dc | |
| 0x77191cc7 ntdll.dll:RtlInitializeSid+0x2d7|mov ecx, eax|eax=0x0 | |
| 0x77191cc9 ntdll.dll:RtlInitializeSid+0x2d9|test ecx, ecx|ecx=0x0 | |
| 0x77191ccb ntdll.dll:RtlInitializeSid+0x2db|js 0x77191ce7|eflags=0x246 | |
| 0x77191ccd ntdll.dll:RtlInitializeSid+0x2dd|push dword ptr [ebp - 8]|ebp=0x19f90c|esp=0x19f8ec | |
| 0x77191cd0 ntdll.dll:RtlInitializeSid+0x2e0|mov edx, dword ptr [ebp - 0x10]|ebp=0x19f90c | |
| 0x77191cd3 ntdll.dll:RtlInitializeSid+0x2e3|lea eax, [ebp - 4]|ebp=0x19f90c | |
| 0x77191cd6 ntdll.dll:RtlInitializeSid+0x2e6|push dword ptr [ebp - 0xc]|ebp=0x19f90c|esp=0x19f8e8 | |
| 0x77191cd9 ntdll.dll:RtlInitializeSid+0x2e9|mov ecx, dword ptr [ebp - 0x14]|ebp=0x19f90c | |
| 0x77191cdc ntdll.dll:RtlInitializeSid+0x2ec|push eax|eax=0x19f908|esp=0x19f8e4 | |
| 0x77191cdd ntdll.dll:RtlInitializeSid+0x2ed|call 0x77191ed4|esp=0x19f8e0|eip=0x77191cdd | |
| 0x77191ed4 ntdll.dll:RtlInitializeSid+0x4e4|mov edi, edi|edi=0x19f970 | |
| 0x77191ed6 ntdll.dll:RtlInitializeSid+0x4e6|push ebp|ebp=0x19f90c|esp=0x19f8dc | |
| 0x77191ed7 ntdll.dll:RtlInitializeSid+0x4e7|mov ebp, esp|esp=0x19f8d8 | |
| 0x77191ed9 ntdll.dll:RtlInitializeSid+0x4e9|push ecx|ecx=0x19fa08|esp=0x19f8d8 | |
| 0x77191eda ntdll.dll:RtlInitializeSid+0x4ea|push ebx|ebx=0x19f960|esp=0x19f8d4 | |
| 0x77191edb ntdll.dll:RtlInitializeSid+0x4eb|push esi|esi=0x0|esp=0x19f8d0 | |
| 0x77191edc ntdll.dll:RtlInitializeSid+0x4ec|push edi|edi=0x19f970|esp=0x19f8cc | |
| 0x77191edd ntdll.dll:RtlInitializeSid+0x4ed|mov ebx, edx|edx=0x104 | |
| 0x77191edf ntdll.dll:RtlInitializeSid+0x4ef|xor edi, edi|edi=0x19f970 | |
| 0x77191ee1 ntdll.dll:RtlInitializeSid+0x4f1|mov eax, ecx|ecx=0x19fa08 | |
| 0x77191ee3 ntdll.dll:RtlInitializeSid+0x4f3|mov ecx, dword ptr [ebp + 0x10]|ebp=0x19f8d8 | |
| 0x77191ee6 ntdll.dll:RtlInitializeSid+0x4f6|mov esi, edi|edi=0x0 | |
| 0x77191ee8 ntdll.dll:RtlInitializeSid+0x4f8|test ebx, ebx|ebx=0x104 | |
| 0x77191eea ntdll.dll:RtlInitializeSid+0x4fa|je 0x77191f0f|eflags=0x202 | |
| 0x77191eec ntdll.dll:RtlInitializeSid+0x4fc|mov edx, dword ptr [ebp + 0xc]|ebp=0x19f8d8 | |
| 0x77191eef ntdll.dll:RtlInitializeSid+0x4ff|sub eax, edx|eax=0x19fa08|edx=0x8264a8 | |
| 0x77191ef1 ntdll.dll:RtlInitializeSid+0x501|mov dword ptr [ebp - 4], eax|ebp=0x19f8d8|eax=0xff979560 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x8 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x202 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264a8 | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264a8|ax=0x43 | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264a8 | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x8 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x0 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0x104 | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x206 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x7 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x202 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264aa | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264aa|ax=0x3a | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264aa | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x7 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x1 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0x103 | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x202 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x6 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x206 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264ac | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264ac|ax=0x5c | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264ac | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x6 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x2 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0x102 | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x202 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x5 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x206 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264ae | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264ae|ax=0x64 | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264ae | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x5 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x3 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0x101 | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x206 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x4 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x202 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264b0 | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264b0|ax=0x61 | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264b0 | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x4 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x4 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0x100 | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x216 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x3 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x206 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264b2 | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264b2|ax=0x74 | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264b2 | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x3 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x5 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0xff | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x202 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x2 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x202 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264b4 | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264b4|ax=0x61 | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264b4 | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x2 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x6 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0xfe | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x202 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x1 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x202 | |
| 0x77191ef8 ntdll.dll:RtlInitializeSid+0x508|mov edi, dword ptr [ebp - 4]|ebp=0x19f8d8 | |
| 0x77191efb ntdll.dll:RtlInitializeSid+0x50b|mov ax, word ptr [edx]|edx=0x8264b6 | |
| 0x77191efe ntdll.dll:RtlInitializeSid+0x50e|push 0|esp=0x19f8c8 | |
| 0x77191f00 ntdll.dll:RtlInitializeSid+0x510|mov word ptr [edi + edx], ax|edi=0xff979560|edx=0x8264b6|ax=0x5c | |
| 0x77191f04 ntdll.dll:RtlInitializeSid+0x514|add edx, 2|edx=0x8264b6 | |
| 0x77191f07 ntdll.dll:RtlInitializeSid+0x517|dec ecx|ecx=0x1 | |
| 0x77191f08 ntdll.dll:RtlInitializeSid+0x518|inc esi|esi=0x7 | |
| 0x77191f09 ntdll.dll:RtlInitializeSid+0x519|pop edi|edi=0xff979560|esp=0x19f8c4 | |
| 0x77191f0a ntdll.dll:RtlInitializeSid+0x51a|sub ebx, 1|ebx=0xfd | |
| 0x77191f0d ntdll.dll:RtlInitializeSid+0x51d|jne 0x77191ef4|eflags=0x206 | |
| 0x77191ef4 ntdll.dll:RtlInitializeSid+0x504|test ecx, ecx|ecx=0x0 | |
| 0x77191ef6 ntdll.dll:RtlInitializeSid+0x506|je 0x77191f18|eflags=0x246 | |
| 0x77191f18 ntdll.dll:RtlInitializeSid+0x528|mov ecx, dword ptr [ebp + 8]|ebp=0x19f8d8 | |
| 0x77191f1b ntdll.dll:RtlInitializeSid+0x52b|mov eax, edi|edi=0x0 | |
| 0x77191f1d ntdll.dll:RtlInitializeSid+0x52d|pop edi|edi=0x0|esp=0x19f8c8 | |
| 0x77191f1e ntdll.dll:RtlInitializeSid+0x52e|mov dword ptr [ecx], esi|ecx=0x19f908|esi=0x8 | |
| 0x77191f20 ntdll.dll:RtlInitializeSid+0x530|pop esi|esi=0x8|esp=0x19f8cc | |
| 0x77191f21 ntdll.dll:RtlInitializeSid+0x531|pop ebx|ebx=0xfc|esp=0x19f8d0 | |
| 0x77191f22 ntdll.dll:RtlInitializeSid+0x532|leave|ebp=0x19f8d8|esp=0x19f8d4 | |
| 0x77191f23 ntdll.dll:RtlInitializeSid+0x533|ret 0xc|esp=0x19f8dc | |
| 0x77191ce2 ntdll.dll:RtlInitializeSid+0x2f2|mov esi, dword ptr [ebp - 4]|ebp=0x19f90c | |
| 0x77191ce5 ntdll.dll:RtlInitializeSid+0x2f5|mov ecx, eax|eax=0x0 | |
| 0x77191ce7 ntdll.dll:RtlInitializeSid+0x2f7|lea eax, [esi + esi]|esi=0x8 | |
| 0x77191cea ntdll.dll:RtlInitializeSid+0x2fa|mov word ptr [edi], ax|edi=0x19f970|ax=0x10 | |
| 0x77191ced ntdll.dll:RtlInitializeSid+0x2fd|pop edi|edi=0x19f970|esp=0x19f8ec | |
| 0x77191cee ntdll.dll:RtlInitializeSid+0x2fe|pop esi|esi=0x8|esp=0x19f8f0 | |
| 0x77191cef ntdll.dll:RtlInitializeSid+0x2ff|mov eax, ecx|ecx=0x0 | |
| 0x77191cf1 ntdll.dll:RtlInitializeSid+0x301|pop ebx|ebx=0x19f960|esp=0x19f8f4 | |
| 0x77191cf2 ntdll.dll:RtlInitializeSid+0x302|leave|ebp=0x19f90c|esp=0x19f8f8 | |
| 0x77191cf3 ntdll.dll:RtlInitializeSid+0x303|ret|esp=0x19f910 | |
| 0x7717304f ntdll.dll:RtlDosSearchPath_Ustr+0x9cf|mov edi, dword ptr [ebp - 0x2c]|ebp=0x19f9a0 | |
| 0x77173052 ntdll.dll:RtlDosSearchPath_Ustr+0x9d2|mov edx, dword ptr [ebp - 0x38]|ebp=0x19f9a0 | |
| 0x77173055 ntdll.dll:RtlDosSearchPath_Ustr+0x9d5|jmp 0x77173207 | |
| 0x77173207 ntdll.dll:RtlDosSearchPath_Ustr+0xb87|movzx ebx, word ptr [ebp - 0x40]|ebp=0x19f9a0 | |
| 0x7717320b ntdll.dll:RtlDosSearchPath_Ustr+0xb8b|lea eax, [esi + esi]|esi=0x0 | |
| 0x7717320e ntdll.dll:RtlDosSearchPath_Ustr+0xb8e|mov ecx, ebx|ebx=0x10 | |
| 0x77173210 ntdll.dll:RtlDosSearchPath_Ustr+0xb90|sub ecx, eax|ecx=0x10|eax=0x0 | |
| 0x77173212 ntdll.dll:RtlDosSearchPath_Ustr+0xb92|mov eax, dword ptr [ebp - 0x68]|ebp=0x19f9a0 | |
| 0x77173215 ntdll.dll:RtlDosSearchPath_Ustr+0xb95|add eax, ecx|eax=0x1e|ecx=0x10 | |
| 0x77173217 ntdll.dll:RtlDosSearchPath_Ustr+0xb97|mov dword ptr [ebp - 0x68], eax|ebp=0x19f9a0|eax=0x2e | |
| 0x7717321a ntdll.dll:RtlDosSearchPath_Ustr+0xb9a|lea ecx, [eax + 2]|eax=0x2e | |
| 0x7717321d ntdll.dll:RtlDosSearchPath_Ustr+0xb9d|cmp ecx, dword ptr [ebp - 0x5c]|ecx=0x30|ebp=0x19f9a0 | |
| 0x77173220 ntdll.dll:RtlDosSearchPath_Ustr+0xba0|jbe 0x77173342|eflags=0x297 | |
| 0x77173342 ntdll.dll:RtlDosSearchPath_Ustr+0xcc2|xor ecx, ecx|ecx=0x30 | |
| 0x77173344 ntdll.dll:RtlDosSearchPath_Ustr+0xcc4|lea ebx, [ecx + 0x5c]|ecx=0x0 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x0 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x0|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x293 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x0 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x216 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x0 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x1 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x1|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x297 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x1 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x212 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x1 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x2 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x2|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x297 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x2 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x216 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x2 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x3 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x3|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x293 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x3 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x216 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x3 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x4 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x4|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x297 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x4 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x212 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x4 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x5 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x5|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x293 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x5 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x212 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x5 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x6 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x6|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x293 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x6 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x212 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x6 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x7 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x7|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x297 | |
| 0x77173354 ntdll.dll:RtlDosSearchPath_Ustr+0xcd4|cmp word ptr [edi + ecx*2], 0x2f|edi=0x19fa08|ecx=0x7 | |
| 0x77173359 ntdll.dll:RtlDosSearchPath_Ustr+0xcd9|jne 0x7717335f|eflags=0x216 | |
| 0x7717335f ntdll.dll:RtlDosSearchPath_Ustr+0xcdf|inc ecx|ecx=0x7 | |
| 0x77173360 ntdll.dll:RtlDosSearchPath_Ustr+0xce0|jmp 0x77173347 | |
| 0x77173347 ntdll.dll:RtlDosSearchPath_Ustr+0xcc7|mov dword ptr [ebp - 0x54], ecx|ebp=0x19f9a0|ecx=0x8 | |
| 0x7717334a ntdll.dll:RtlDosSearchPath_Ustr+0xcca|movzx eax, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717334e ntdll.dll:RtlDosSearchPath_Ustr+0xcce|shr eax, 1|eax=0x10 | |
| 0x77173350 ntdll.dll:RtlDosSearchPath_Ustr+0xcd0|cmp ecx, eax|ecx=0x8|eax=0x8 | |
| 0x77173352 ntdll.dll:RtlDosSearchPath_Ustr+0xcd2|jae 0x77173388|eflags=0x246 | |
| 0x77173388 ntdll.dll:RtlDosSearchPath_Ustr+0xd08|movzx ecx, word ptr [ebp - 0x30]|ebp=0x19f9a0 | |
| 0x7717338c ntdll.dll:RtlDosSearchPath_Ustr+0xd0c|shr ecx, 1|ecx=0x10 | |
| 0x7717338e ntdll.dll:RtlDosSearchPath_Ustr+0xd0e|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x8 | |
| 0x77173391 ntdll.dll:RtlDosSearchPath_Ustr+0xd11|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f9a0 | |
| 0x77173394 ntdll.dll:RtlDosSearchPath_Ustr+0xd14|cmp esi, eax|esi=0x0|eax=0xf | |
| 0x77173396 ntdll.dll:RtlDosSearchPath_Ustr+0xd16|jae 0x771734cd|eflags=0x293 | |
| 0x7717339c ntdll.dll:RtlDosSearchPath_Ustr+0xd1c|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x7717339f ntdll.dll:RtlDosSearchPath_Ustr+0xd1f|mov ebx, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733a2 ntdll.dll:RtlDosSearchPath_Ustr+0xd22|movzx eax, word ptr [ebx + esi*2]|ebx=0x82b440|esi=0x0 | |
| 0x771733a6 ntdll.dll:RtlDosSearchPath_Ustr+0xd26|cmp eax, 0x5c|eax=0x2e | |
| 0x771733a9 ntdll.dll:RtlDosSearchPath_Ustr+0xd29|je 0x771734ad|eflags=0x287 | |
| 0x771733af ntdll.dll:RtlDosSearchPath_Ustr+0xd2f|sub eax, 0x2e|eax=0x2e | |
| 0x771733b2 ntdll.dll:RtlDosSearchPath_Ustr+0xd32|je 0x771733f2|eflags=0x246 | |
| 0x771733f2 ntdll.dll:RtlDosSearchPath_Ustr+0xd72|lea edx, [esi + 1]|esi=0x0 | |
| 0x771733f5 ntdll.dll:RtlDosSearchPath_Ustr+0xd75|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f9a0 | |
| 0x771733f8 ntdll.dll:RtlDosSearchPath_Ustr+0xd78|cmp edx, eax|edx=0x1|eax=0xf | |
| 0x771733fa ntdll.dll:RtlDosSearchPath_Ustr+0xd7a|je 0x771734c8|eflags=0x293 | |
| 0x77173400 ntdll.dll:RtlDosSearchPath_Ustr+0xd80|movzx eax, word ptr [ebx + esi*2 + 2]|ebx=0x82b440|esi=0x0 | |
| 0x77173405 ntdll.dll:RtlDosSearchPath_Ustr+0xd85|cmp eax, 0x5c|eax=0x2f | |
| 0x77173408 ntdll.dll:RtlDosSearchPath_Ustr+0xd88|je 0x771734a9|eflags=0x283 | |
| 0x7717340e ntdll.dll:RtlDosSearchPath_Ustr+0xd8e|cmp eax, 0x2f|eax=0x2f | |
| 0x77173411 ntdll.dll:RtlDosSearchPath_Ustr+0xd91|je 0x771734a9|eflags=0x246 | |
| 0x771734a9 ntdll.dll:RtlDosSearchPath_Ustr+0xe29|mov esi, edx|edx=0x1 | |
| 0x771734ab ntdll.dll:RtlDosSearchPath_Ustr+0xe2b|jmp 0x77173497 | |
| 0x77173497 ntdll.dll:RtlDosSearchPath_Ustr+0xe17|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x1 | |
| 0x7717349a ntdll.dll:RtlDosSearchPath_Ustr+0xe1a|mov edx, dword ptr [ebp - 0x38]|ebp=0x19f9a0 | |
| 0x7717349d ntdll.dll:RtlDosSearchPath_Ustr+0xe1d|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f9a0 | |
| 0x771734a0 ntdll.dll:RtlDosSearchPath_Ustr+0xe20|inc esi|esi=0x1 | |
| 0x771734a1 ntdll.dll:RtlDosSearchPath_Ustr+0xe21|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x2 | |
| 0x771734a4 ntdll.dll:RtlDosSearchPath_Ustr+0xe24|jmp 0x77173394 | |
| 0x77173394 ntdll.dll:RtlDosSearchPath_Ustr+0xd14|cmp esi, eax|esi=0x2|eax=0xf | |
| 0x77173396 ntdll.dll:RtlDosSearchPath_Ustr+0xd16|jae 0x771734cd|eflags=0x297 | |
| 0x7717339c ntdll.dll:RtlDosSearchPath_Ustr+0xd1c|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x7717339f ntdll.dll:RtlDosSearchPath_Ustr+0xd1f|mov ebx, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733a2 ntdll.dll:RtlDosSearchPath_Ustr+0xd22|movzx eax, word ptr [ebx + esi*2]|ebx=0x82b440|esi=0x2 | |
| 0x771733a6 ntdll.dll:RtlDosSearchPath_Ustr+0xd26|cmp eax, 0x5c|eax=0x74 | |
| 0x771733a9 ntdll.dll:RtlDosSearchPath_Ustr+0xd29|je 0x771734ad|eflags=0x216 | |
| 0x771733af ntdll.dll:RtlDosSearchPath_Ustr+0xd2f|sub eax, 0x2e|eax=0x74 | |
| 0x771733b2 ntdll.dll:RtlDosSearchPath_Ustr+0xd32|je 0x771733f2|eflags=0x212 | |
| 0x771733b4 ntdll.dll:RtlDosSearchPath_Ustr+0xd34|sub eax, 1|eax=0x46 | |
| 0x771733b7 ntdll.dll:RtlDosSearchPath_Ustr+0xd37|je 0x771734ad|eflags=0x202 | |
| 0x771733bd ntdll.dll:RtlDosSearchPath_Ustr+0xd3d|mov edx, dword ptr [ebp - 0x34]|ebp=0x19f9a0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x2|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x2 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x74 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x74 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x8|ax=0x74 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x8 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x9 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x2 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x3 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x3|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x293 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x3 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x65 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x65 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x216 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x9|ax=0x65 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x9 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0xa | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x3 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x4 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x4|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x4 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x73 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x73 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x216 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0xa|ax=0x73 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0xa | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0xb | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x4 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x5 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x5|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x5 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x74 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x74 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0xb|ax=0x74 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0xb | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0xc | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x5 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x6 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x6|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x293 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x6 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x5f | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x206 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x5f | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x206 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0xc|ax=0x5f | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0xc | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0xd | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x6 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x7 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x7|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x293 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x7 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x66 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x66 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0xd|ax=0x66 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0xd | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0xe | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x7 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x8 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x8|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x8 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x69 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x212 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x69 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x216 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0xe|ax=0x69 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0xe | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0xf | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x8 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0x9 | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0x9|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0x9 | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x6c | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x202 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x6c | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0xf|ax=0x6c | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0xf | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x10 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0x9 | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xa | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0xa|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x293 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0xa | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x65 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x65 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x216 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x10|ax=0x65 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x10 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x11 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0xa | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xb | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0xb|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0xb | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x2e | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x287 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x2e | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x297 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x11|ax=0x2e | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x11 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x12 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0xb | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xc | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0xc|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x293 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0xc | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x74 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x74 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x12|ax=0x74 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x12 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x13 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0xc | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xd | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0xd|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x293 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0xd | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x78 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x212 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x78 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x13|ax=0x78 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x13 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x14 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0xd | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xe | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0xe|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x297 | |
| 0x771733c8 ntdll.dll:RtlDosSearchPath_Ustr+0xd48|mov eax, dword ptr [ebp - 0x50]|ebp=0x19f9a0 | |
| 0x771733cb ntdll.dll:RtlDosSearchPath_Ustr+0xd4b|mov eax, dword ptr [eax + 4]|eax=0x19fc38 | |
| 0x771733ce ntdll.dll:RtlDosSearchPath_Ustr+0xd4e|movzx eax, word ptr [eax + esi*2]|eax=0x82b440|esi=0xe | |
| 0x771733d2 ntdll.dll:RtlDosSearchPath_Ustr+0xd52|cmp eax, 0x5c|eax=0x74 | |
| 0x771733d5 ntdll.dll:RtlDosSearchPath_Ustr+0xd55|je 0x77173479|eflags=0x216 | |
| 0x771733db ntdll.dll:RtlDosSearchPath_Ustr+0xd5b|cmp eax, 0x2f|eax=0x74 | |
| 0x771733de ntdll.dll:RtlDosSearchPath_Ustr+0xd5e|je 0x77173479|eflags=0x212 | |
| 0x771733e4 ntdll.dll:RtlDosSearchPath_Ustr+0xd64|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x14|ax=0x74 | |
| 0x771733e8 ntdll.dll:RtlDosSearchPath_Ustr+0xd68|inc ecx|ecx=0x14 | |
| 0x771733e9 ntdll.dll:RtlDosSearchPath_Ustr+0xd69|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x15 | |
| 0x771733ec ntdll.dll:RtlDosSearchPath_Ustr+0xd6c|inc esi|esi=0xe | |
| 0x771733ed ntdll.dll:RtlDosSearchPath_Ustr+0xd6d|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xf | |
| 0x771733f0 ntdll.dll:RtlDosSearchPath_Ustr+0xd70|jmp 0x771733c0 | |
| 0x771733c0 ntdll.dll:RtlDosSearchPath_Ustr+0xd40|cmp esi, edx|esi=0xf|edx=0xf | |
| 0x771733c2 ntdll.dll:RtlDosSearchPath_Ustr+0xd42|jae 0x77173496|eflags=0x246 | |
| 0x77173496 ntdll.dll:RtlDosSearchPath_Ustr+0xe16|dec esi|esi=0xf | |
| 0x77173497 ntdll.dll:RtlDosSearchPath_Ustr+0xe17|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xe | |
| 0x7717349a ntdll.dll:RtlDosSearchPath_Ustr+0xe1a|mov edx, dword ptr [ebp - 0x38]|ebp=0x19f9a0 | |
| 0x7717349d ntdll.dll:RtlDosSearchPath_Ustr+0xe1d|mov eax, dword ptr [ebp - 0x34]|ebp=0x19f9a0 | |
| 0x771734a0 ntdll.dll:RtlDosSearchPath_Ustr+0xe20|inc esi|esi=0xe | |
| 0x771734a1 ntdll.dll:RtlDosSearchPath_Ustr+0xe21|mov dword ptr [ebp - 0x44], esi|ebp=0x19f9a0|esi=0xf | |
| 0x771734a4 ntdll.dll:RtlDosSearchPath_Ustr+0xe24|jmp 0x77173394 | |
| 0x77173394 ntdll.dll:RtlDosSearchPath_Ustr+0xd14|cmp esi, eax|esi=0xf|eax=0xf | |
| 0x77173396 ntdll.dll:RtlDosSearchPath_Ustr+0xd16|jae 0x771734cd|eflags=0x246 | |
| 0x771734cd ntdll.dll:RtlDosSearchPath_Ustr+0xe4d|cmp byte ptr [ebp - 0x25], 0|ebp=0x19f9a0 | |
| 0x771734d1 ntdll.dll:RtlDosSearchPath_Ustr+0xe51|je 0x771734e3|eflags=0x202 | |
| 0x771734d3 ntdll.dll:RtlDosSearchPath_Ustr+0xe53|cmp ecx, edx|ecx=0x15|edx=0x3 | |
| 0x771734d5 ntdll.dll:RtlDosSearchPath_Ustr+0xe55|jbe 0x771734e3|eflags=0x206 | |
| 0x771734d7 ntdll.dll:RtlDosSearchPath_Ustr+0xe57|cmp word ptr [edi + ecx*2 - 2], 0x5c|edi=0x19fa08|ecx=0x15 | |
| 0x771734dd ntdll.dll:RtlDosSearchPath_Ustr+0xe5d|jne 0x771734e3|eflags=0x216 | |
| 0x771734e3 ntdll.dll:RtlDosSearchPath_Ustr+0xe63|cmp ecx, dword ptr [ebp - 0x58]|ecx=0x15|ebp=0x19f9a0 | |
| 0x771734e6 ntdll.dll:RtlDosSearchPath_Ustr+0xe66|jae 0x771734f0|eflags=0x287 | |
| 0x771734e8 ntdll.dll:RtlDosSearchPath_Ustr+0xe68|xor eax, eax|eax=0xf | |
| 0x771734ea ntdll.dll:RtlDosSearchPath_Ustr+0xe6a|mov word ptr [edi + ecx*2], ax|edi=0x19fa08|ecx=0x15|ax=0x0 | |
| 0x771734ee ntdll.dll:RtlDosSearchPath_Ustr+0xe6e|mov edi, edi|edi=0x19fa08 | |
| 0x771734f0 ntdll.dll:RtlDosSearchPath_Ustr+0xe70|test ecx, ecx|ecx=0x15 | |
| 0x771734f2 ntdll.dll:RtlDosSearchPath_Ustr+0xe72|je 0x7717350a|eflags=0x202 | |
| 0x771734f4 ntdll.dll:RtlDosSearchPath_Ustr+0xe74|dec ecx|ecx=0x15 | |
| 0x771734f5 ntdll.dll:RtlDosSearchPath_Ustr+0xe75|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x14 | |
| 0x771734f8 ntdll.dll:RtlDosSearchPath_Ustr+0xe78|movzx eax, word ptr [edi + ecx*2]|edi=0x19fa08|ecx=0x14 | |
| 0x771734fc ntdll.dll:RtlDosSearchPath_Ustr+0xe7c|cmp eax, 0x20|eax=0x74 | |
| 0x771734ff ntdll.dll:RtlDosSearchPath_Ustr+0xe7f|je 0x771734e8|eflags=0x202 | |
| 0x77173501 ntdll.dll:RtlDosSearchPath_Ustr+0xe81|cmp eax, 0x2e|eax=0x74 | |
| 0x77173504 ntdll.dll:RtlDosSearchPath_Ustr+0xe84|je 0x771734e8|eflags=0x212 | |
| 0x77173506 ntdll.dll:RtlDosSearchPath_Ustr+0xe86|inc ecx|ecx=0x14 | |
| 0x77173507 ntdll.dll:RtlDosSearchPath_Ustr+0xe87|mov dword ptr [ebp - 0x4c], ecx|ebp=0x19f9a0|ecx=0x15 | |
| 0x7717350a ntdll.dll:RtlDosSearchPath_Ustr+0xe8a|lea esi, [ecx + ecx]|ecx=0x15 | |
| 0x7717350d ntdll.dll:RtlDosSearchPath_Ustr+0xe8d|mov word ptr [ebp - 0x30], si|ebp=0x19f9a0|si=0x2a | |
| 0x77173511 ntdll.dll:RtlDosSearchPath_Ustr+0xe91|mov ebx, dword ptr [ebp - 0x70]|ebp=0x19f9a0 | |
| 0x77173514 ntdll.dll:RtlDosSearchPath_Ustr+0xe94|test ebx, ebx|ebx=0x0 | |
| 0x77173516 ntdll.dll:RtlDosSearchPath_Ustr+0xe96|je 0x77173541|eflags=0x246 | |
| 0x77173541 ntdll.dll:RtlDosSearchPath_Ustr+0xec1|movzx ebx, si|si=0x2a | |
| 0x77173544 ntdll.dll:RtlDosSearchPath_Ustr+0xec4|mov dword ptr [ebp - 0x48], ebx|ebp=0x19f9a0|ebx=0x2a | |
| 0x77173547 ntdll.dll:RtlDosSearchPath_Ustr+0xec7|mov dword ptr [ebp - 4], 0xfffffffe|ebp=0x19f9a0 | |
| 0x7717354e ntdll.dll:RtlDosSearchPath_Ustr+0xece|call 0x77173563|esp=0x19f914|eip=0x7717354e | |
| 0x77173563 ntdll.dll:RtlDosSearchPath_Ustr+0xee3|cmp byte ptr [ebp - 0x27], 0|ebp=0x19f9a0 | |
| 0x77173567 ntdll.dll:RtlDosSearchPath_Ustr+0xee7|je 0x771735a4|eflags=0x202 | |
| 0x77173569 ntdll.dll:RtlDosSearchPath_Ustr+0xee9|mov esi, dword ptr [ebp - 0x60]|ebp=0x19f9a0 | |
| 0x7717356c ntdll.dll:RtlDosSearchPath_Ustr+0xeec|test esi, esi|esi=0x826490 | |
| 0x7717356e ntdll.dll:RtlDosSearchPath_Ustr+0xeee|jne 0x7717357c|eflags=0x206 | |
| 0x7717357c ntdll.dll:RtlDosSearchPath_Ustr+0xefc|or eax, 0xffffffff|eax=0x74 | |
| 0x7717357f ntdll.dll:RtlDosSearchPath_Ustr+0xeff|lock xadd dword ptr [esi], eax|esi=0x826490|eax=0xffffffff | |
| 0x77173583 ntdll.dll:RtlDosSearchPath_Ustr+0xf03|jne 0x771735a4|eflags=0x213 | |
| 0x771735a4 ntdll.dll:RtlDosSearchPath_Ustr+0xf24|mov ecx, dword ptr [ebp - 0x58]|ebp=0x19f9a0 | |
| 0x771735a7 ntdll.dll:RtlDosSearchPath_Ustr+0xf27|lea eax, [ecx + ecx]|ecx=0x104 | |
| 0x771735aa ntdll.dll:RtlDosSearchPath_Ustr+0xf2a|cmp ebx, eax|ebx=0x2a|eax=0x208 | |
| 0x771735ac ntdll.dll:RtlDosSearchPath_Ustr+0xf2c|jb 0x771735b7|eflags=0x287 | |
| 0x771735b7 ntdll.dll:RtlDosSearchPath_Ustr+0xf37|ret|esp=0x19f910 | |
| 0x77173553 ntdll.dll:RtlDosSearchPath_Ustr+0xed3|mov eax, ebx|ebx=0x2a | |
| 0x77173555 ntdll.dll:RtlDosSearchPath_Ustr+0xed5|jmp 0x771735ba | |
| 0x771735ba ntdll.dll:RtlDosSearchPath_Ustr+0xf3a|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f9a0 | |
| 0x771735bd ntdll.dll:RtlDosSearchPath_Ustr+0xf3d|mov dword ptr fs:[0], ecx|ecx=0x19fe48 | |
| 0x771735c4 ntdll.dll:RtlDosSearchPath_Ustr+0xf44|pop ecx|ecx=0x19fe48|esp=0x19f914 | |
| 0x771735c5 ntdll.dll:RtlDosSearchPath_Ustr+0xf45|pop edi|edi=0x19fa08|esp=0x19f918 | |
| 0x771735c6 ntdll.dll:RtlDosSearchPath_Ustr+0xf46|pop esi|esi=0x826490|esp=0x19f91c | |
| 0x771735c7 ntdll.dll:RtlDosSearchPath_Ustr+0xf47|pop ebx|ebx=0x2a|esp=0x19f920 | |
| 0x771735c8 ntdll.dll:RtlDosSearchPath_Ustr+0xf48|mov ecx, dword ptr [ebp - 0x1c]|ebp=0x19f9a0 | |
| 0x771735cb ntdll.dll:RtlDosSearchPath_Ustr+0xf4b|xor ecx, ebp|ecx=0xf9f956fe|ebp=0x19f9a0 | |
| 0x771735cd ntdll.dll:RtlDosSearchPath_Ustr+0xf4d|call 0x771a6de0|esp=0x19f924|eip=0x771735cd | |
| 0x771a6de0 ntdll.dll:RtlRetrieveNtUserPfn+0x110|cmp ecx, dword ptr [0x7725e360]|ecx=0xf9e0af5e | |
| 0x771a6de6 ntdll.dll:RtlRetrieveNtUserPfn+0x116|jne 0x771a6deb|eflags=0x246 | |
| 0x771a6de8 ntdll.dll:RtlRetrieveNtUserPfn+0x118|ret 0|esp=0x19f920 | |
| 0x771735d2 ntdll.dll:RtlDosSearchPath_Ustr+0xf52|mov esp, ebp|ebp=0x19f9a0 | |
| 0x771735d4 ntdll.dll:RtlDosSearchPath_Ustr+0xf54|pop ebp|ebp=0x19f9a0|esp=0x19f9a0 | |
| 0x771735d5 ntdll.dll:RtlDosSearchPath_Ustr+0xf55|ret 0x10|esp=0x19f9a4 | |
| 0x771739e5 ntdll.dll:RtlDosSearchPath_Ustr+0x1365|mov ecx, eax|eax=0x2a | |
| 0x771739e7 ntdll.dll:RtlDosSearchPath_Ustr+0x1367|mov dword ptr [esp + 0x10], ecx|esp=0x19f9b8|ecx=0x2a | |
| 0x771739eb ntdll.dll:RtlDosSearchPath_Ustr+0x136b|test ecx, ecx|ecx=0x2a | |
| 0x771739ed ntdll.dll:RtlDosSearchPath_Ustr+0x136d|je 0x771d31a9|eflags=0x202 | |
| 0x771739f3 ntdll.dll:RtlDosSearchPath_Ustr+0x1373|cmp byte ptr [esp + 0x17], 0|esp=0x19f9b8 | |
| 0x771739f8 ntdll.dll:RtlDosSearchPath_Ustr+0x1378|jne 0x771d31a9|eflags=0x246 | |
| 0x771739fe ntdll.dll:RtlDosSearchPath_Ustr+0x137e|mov eax, dword ptr [esp + 0x28]|esp=0x19f9b8 | |
| 0x77173a02 ntdll.dll:RtlDosSearchPath_Ustr+0x1382|cmp ecx, eax|ecx=0x2a|eax=0x208 | |
| 0x77173a04 ntdll.dll:RtlDosSearchPath_Ustr+0x1384|ja 0x771d3144|eflags=0x287 | |
| 0x77173a0a ntdll.dll:RtlDosSearchPath_Ustr+0x138a|movzx edx, cx|cx=0x2a | |
| 0x77173a0d ntdll.dll:RtlDosSearchPath_Ustr+0x138d|mov ebx, edi|edi=0x19fa08 | |
| 0x77173a0f ntdll.dll:RtlDosSearchPath_Ustr+0x138f|mov dword ptr [esp + 0x28], edx|esp=0x19f9b8|edx=0x2a | |
| 0x77173a13 ntdll.dll:RtlDosSearchPath_Ustr+0x1393|mov word ptr [esp + 0x30], dx|esp=0x19f9b8|dx=0x2a | |
| 0x77173a18 ntdll.dll:RtlDosSearchPath_Ustr+0x1398|mov word ptr [esp + 0x32], ax|esp=0x19f9b8|ax=0x208 | |
| 0x77173a1d ntdll.dll:RtlDosSearchPath_Ustr+0x139d|mov dword ptr [esp + 0x10], ebx|esp=0x19f9b8|ebx=0x19fa08 | |
| 0x77173a21 ntdll.dll:RtlDosSearchPath_Ustr+0x13a1|mov dword ptr [esp + 0x34], ebx|esp=0x19f9b8|ebx=0x19fa08 | |
| 0x77173a25 ntdll.dll:RtlDosSearchPath_Ustr+0x13a5|cmp edx, 2|edx=0x2a | |
| 0x77173a28 ntdll.dll:RtlDosSearchPath_Ustr+0x13a8|jb 0x771d320d|eflags=0x206 | |
| 0x77173a2e ntdll.dll:RtlDosSearchPath_Ustr+0x13ae|movzx eax, word ptr [edi]|edi=0x19fa08 | |
| 0x77173a31 ntdll.dll:RtlDosSearchPath_Ustr+0x13b1|cmp eax, 0x5c|eax=0x43 | |
| 0x77173a34 ntdll.dll:RtlDosSearchPath_Ustr+0x13b4|je 0x77173d04|eflags=0x297 | |
| 0x77173a3a ntdll.dll:RtlDosSearchPath_Ustr+0x13ba|cmp eax, 0x2f|eax=0x43 | |
| 0x77173a3d ntdll.dll:RtlDosSearchPath_Ustr+0x13bd|je 0x77173d04|eflags=0x216 | |
| 0x77173a43 ntdll.dll:RtlDosSearchPath_Ustr+0x13c3|cmp edx, 4|edx=0x2a | |
| 0x77173a46 ntdll.dll:RtlDosSearchPath_Ustr+0x13c6|jb 0x771d320d|eflags=0x202 | |
| 0x77173a4c ntdll.dll:RtlDosSearchPath_Ustr+0x13cc|cmp word ptr [edi], 0|edi=0x19fa08 | |
| 0x77173a50 ntdll.dll:RtlDosSearchPath_Ustr+0x13d0|je 0x771d320d|eflags=0x202 | |
| 0x77173a56 ntdll.dll:RtlDosSearchPath_Ustr+0x13d6|cmp word ptr [edi + 2], 0x3a|edi=0x19fa08 | |
| 0x77173a5b ntdll.dll:RtlDosSearchPath_Ustr+0x13db|jne 0x771d320d|eflags=0x246 | |
| 0x77173a61 ntdll.dll:RtlDosSearchPath_Ustr+0x13e1|cmp edx, 6|edx=0x2a | |
| 0x77173a64 ntdll.dll:RtlDosSearchPath_Ustr+0x13e4|jb 0x771d31c6|eflags=0x206 | |
| 0x77173a6a ntdll.dll:RtlDosSearchPath_Ustr+0x13ea|movzx eax, word ptr [edi + 4]|edi=0x19fa08 | |
| 0x77173a6e ntdll.dll:RtlDosSearchPath_Ustr+0x13ee|cmp eax, 0x5c|eax=0x5c | |
| 0x77173a71 ntdll.dll:RtlDosSearchPath_Ustr+0x13f1|jne 0x771d31bd|eflags=0x246 | |
| 0x77173a77 ntdll.dll:RtlDosSearchPath_Ustr+0x13f7|mov eax, 2 | |
| 0x77173a7c ntdll.dll:RtlDosSearchPath_Ustr+0x13fc|cmp eax, 2|eax=0x2 | |
| 0x77173a7f ntdll.dll:RtlDosSearchPath_Ustr+0x13ff|jne 0x77173d50|eflags=0x246 | |
| 0x77173a85 ntdll.dll:RtlDosSearchPath_Ustr+0x1405|mov dword ptr [esp + 0x20], 0|esp=0x19f9b8 | |
| 0x77173a8d ntdll.dll:RtlDosSearchPath_Ustr+0x140d|xor eax, eax|eax=0x2 | |
| 0x77173a8f ntdll.dll:RtlDosSearchPath_Ustr+0x140f|mov dword ptr [esp + 0x18], 0x7713129c|esp=0x19f9b8 | |
| 0x77173a97 ntdll.dll:RtlDosSearchPath_Ustr+0x1417|mov ecx, dword ptr [esp + 0x18]|esp=0x19f9b8 | |
| 0x77173a9b ntdll.dll:RtlDosSearchPath_Ustr+0x141b|movzx ebx, dx|dx=0x2a | |
| 0x77173a9e ntdll.dll:RtlDosSearchPath_Ustr+0x141e|add ebx, 2|ebx=0x2a | |
| 0x77173aa1 ntdll.dll:RtlDosSearchPath_Ustr+0x1421|mov dword ptr [esp + 0x2c], eax|esp=0x19f9b8|eax=0x0 | |
| 0x77173aa5 ntdll.dll:RtlDosSearchPath_Ustr+0x1425|movzx ecx, word ptr [ecx]|ecx=0x7713129c | |
| 0x77173aa8 ntdll.dll:RtlDosSearchPath_Ustr+0x1428|sub ecx, eax|ecx=0x8|eax=0x0 | |
| 0x77173aaa ntdll.dll:RtlDosSearchPath_Ustr+0x142a|add ebx, ecx|ebx=0x2c|ecx=0x8 | |
| 0x77173aac ntdll.dll:RtlDosSearchPath_Ustr+0x142c|cmp ebx, 0xfffe|ebx=0x34 | |
| 0x77173ab2 ntdll.dll:RtlDosSearchPath_Ustr+0x1432|ja 0x771d3231|eflags=0x297 | |
| 0x77173ab8 ntdll.dll:RtlDosSearchPath_Ustr+0x1438|test esi, esi|esi=0x0 | |
| 0x77173aba ntdll.dll:RtlDosSearchPath_Ustr+0x143a|jne 0x77173c6b|eflags=0x246 | |
| 0x77173ac0 ntdll.dll:RtlDosSearchPath_Ustr+0x1440|cmp dword ptr [esp + 0x24], esi|esp=0x19f9b8|esi=0x0 | |
| 0x77173ac4 ntdll.dll:RtlDosSearchPath_Ustr+0x1444|je 0x771d32a3|eflags=0x202 | |
| 0x77173aca ntdll.dll:RtlDosSearchPath_Ustr+0x144a|mov eax, dword ptr fs:[0x30] | |
| 0x77173ad0 ntdll.dll:RtlDosSearchPath_Ustr+0x1450|push ebx|ebx=0x34|esp=0x19f9b8 | |
| 0x77173ad1 ntdll.dll:RtlDosSearchPath_Ustr+0x1451|push 0|esp=0x19f9b4 | |
| 0x77173ad3 ntdll.dll:RtlDosSearchPath_Ustr+0x1453|push dword ptr [eax + 0x18]|eax=0x2a3000|esp=0x19f9b0 | |
| 0x77173ad6 ntdll.dll:RtlDosSearchPath_Ustr+0x1456|call 0x77174cf0|esp=0x19f9ac|eip=0x77173ad6 | |
| 0x77174cf0 ntdll.dll:RtlAllocateHeap|mov edi, edi|edi=0x19fa08 | |
| 0x77174cf2 ntdll.dll:RtlAllocateHeap+0x2|push ebp|ebp=0x19fc1c|esp=0x19f9a8 | |
| 0x77174cf3 ntdll.dll:RtlAllocateHeap+0x3|mov ebp, esp|esp=0x19f9a4 | |
| 0x77174cf5 ntdll.dll:RtlAllocateHeap+0x5|and esp, 0xfffffff8|esp=0x19f9a4 | |
| 0x77174cf8 ntdll.dll:RtlAllocateHeap+0x8|push ecx|ecx=0x8|esp=0x19f9a0 | |
| 0x77174cf9 ntdll.dll:RtlAllocateHeap+0x9|push esi|esi=0x0|esp=0x19f99c | |
| 0x77174cfa ntdll.dll:RtlAllocateHeap+0xa|mov esi, dword ptr [ebp + 8]|ebp=0x19f9a4 | |
| 0x77174cfd ntdll.dll:RtlAllocateHeap+0xd|test esi, esi|esi=0x820000 | |
| 0x77174cff ntdll.dll:RtlAllocateHeap+0xf|je 0x771d332b|eflags=0x206 | |
| 0x77174d05 ntdll.dll:RtlAllocateHeap+0x15|cmp dword ptr [esi + 8], 0xddeeddee|esi=0x820000 | |
| 0x77174d0c ntdll.dll:RtlAllocateHeap+0x1c|mov ecx, esi|esi=0x820000 | |
| 0x77174d0e ntdll.dll:RtlAllocateHeap+0x1e|mov edx, dword ptr [ebp + 0x10]|ebp=0x19f9a4 | |
| 0x77174d11 ntdll.dll:RtlAllocateHeap+0x21|je 0x771d3342|eflags=0x206 | |
| 0x77174d17 ntdll.dll:RtlAllocateHeap+0x27|test byte ptr [0x77259164], 2 | |
| 0x77174d1e ntdll.dll:RtlAllocateHeap+0x2e|jne 0x771d334f|eflags=0x246 | |
| 0x77174d24 ntdll.dll:RtlAllocateHeap+0x34|push 0|esp=0x19f998 | |
| 0x77174d26 ntdll.dll:RtlAllocateHeap+0x36|push dword ptr [ebp + 0xc]|ebp=0x19f9a4|esp=0x19f994 | |
| 0x77174d29 ntdll.dll:RtlAllocateHeap+0x39|call 0x77174d40|esp=0x19f990|eip=0x77174d29 | |
| 0x77174d40 ntdll.dll:RtlAllocateHeap+0x50|mov edi, edi|edi=0x19fa08 | |
| 0x77174d42 ntdll.dll:RtlAllocateHeap+0x52|push ebp|ebp=0x19f9a4|esp=0x19f98c | |
| 0x77174d43 ntdll.dll:RtlAllocateHeap+0x53|mov ebp, esp|esp=0x19f988 | |
| 0x77174d45 ntdll.dll:RtlAllocateHeap+0x55|sub esp, 0x6c|esp=0x19f988 | |
| 0x77174d48 ntdll.dll:RtlAllocateHeap+0x58|push ebx|ebx=0x34|esp=0x19f91c | |
| 0x77174d49 ntdll.dll:RtlAllocateHeap+0x59|mov ebx, ecx|ecx=0x820000 | |
| 0x77174d4b ntdll.dll:RtlAllocateHeap+0x5b|mov ecx, dword ptr [ebp + 8]|ebp=0x19f988 | |
| 0x77174d4e ntdll.dll:RtlAllocateHeap+0x5e|push esi|esi=0x820000|esp=0x19f918 | |
| 0x77174d4f ntdll.dll:RtlAllocateHeap+0x5f|push edi|edi=0x19fa08|esp=0x19f914 | |
| 0x77174d50 ntdll.dll:RtlAllocateHeap+0x60|mov edi, edx|edx=0x34 | |
| 0x77174d52 ntdll.dll:RtlAllocateHeap+0x62|mov dword ptr [ebp - 0xc], ebx|ebp=0x19f988|ebx=0x820000 | |
| 0x77174d55 ntdll.dll:RtlAllocateHeap+0x65|cmp dword ptr [ebx + 8], 0xddeeddee|ebx=0x820000 | |
| 0x77174d5c ntdll.dll:RtlAllocateHeap+0x6c|mov dword ptr [ebp - 0x14], edi|ebp=0x19f988|edi=0x34 | |
| 0x77174d5f ntdll.dll:RtlAllocateHeap+0x6f|jne 0x77174e49|eflags=0x206 | |
| 0x77174e49 ntdll.dll:RtlAllocateHeap+0x159|mov eax, dword ptr [ebx + 0x44]|ebx=0x820000 | |
| 0x77174e4c ntdll.dll:RtlAllocateHeap+0x15c|or ecx, eax|ecx=0x0|eax=0x0 | |
| 0x77174e4e ntdll.dll:RtlAllocateHeap+0x15e|mov dword ptr [ebp - 0x2c], 0|ebp=0x19f988 | |
| 0x77174e55 ntdll.dll:RtlAllocateHeap+0x165|mov dword ptr [ebp - 0x10], ecx|ebp=0x19f988|ecx=0x0 | |
| 0x77174e58 ntdll.dll:RtlAllocateHeap+0x168|mov dword ptr [ebp - 0x30], 0|ebp=0x19f988 | |
| 0x77174e5f ntdll.dll:RtlAllocateHeap+0x16f|mov dword ptr [ebp - 0x38], 0|ebp=0x19f988 | |
| 0x77174e66 ntdll.dll:RtlAllocateHeap+0x176|cmp edi, 0x7fffffff|edi=0x34 | |
| 0x77174e6c ntdll.dll:RtlAllocateHeap+0x17c|jbe 0x77174e7a|eflags=0x297 | |
| 0x77174e7a ntdll.dll:RtlAllocateHeap+0x18a|and eax, 0x1000000|eax=0x0 | |
| 0x77174e7f ntdll.dll:RtlAllocateHeap+0x18f|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e81 ntdll.dll:RtlAllocateHeap+0x191|cmp dword ptr [0x772561f4], eax|eax=0x0 | |
| 0x77174e87 ntdll.dll:RtlAllocateHeap+0x197|jne 0x77174ecd|eflags=0x246 | |
| 0x77174e89 ntdll.dll:RtlAllocateHeap+0x199|mov edx, dword ptr [ebx + 0xdc]|ebx=0x820000 | |
| 0x77174e8f ntdll.dll:RtlAllocateHeap+0x19f|mov ecx, edx|edx=0x0 | |
| 0x77174e91 ntdll.dll:RtlAllocateHeap+0x1a1|test ecx, ecx|ecx=0x0 | |
| 0x77174e93 ntdll.dll:RtlAllocateHeap+0x1a3|jne 0x77174e9f|eflags=0x246 | |
| 0x77174e95 ntdll.dll:RtlAllocateHeap+0x1a5|mov ecx, dword ptr [0x77259114] | |
| 0x77174e9b ntdll.dll:RtlAllocateHeap+0x1ab|test ecx, ecx|ecx=0x0 | |
| 0x77174e9d ntdll.dll:RtlAllocateHeap+0x1ad|je 0x77174eca|eflags=0x246 | |
| 0x77174eca ntdll.dll:RtlAllocateHeap+0x1da|mov ecx, dword ptr [ebp - 0x10]|ebp=0x19f988 | |
| 0x77174ecd ntdll.dll:RtlAllocateHeap+0x1dd|mov esi, dword ptr [ebx + 0x58]|ebx=0x820000 | |
| 0x77174ed0 ntdll.dll:RtlAllocateHeap+0x1e0|mov dword ptr [ebp - 0x48], esi|ebp=0x19f988|esi=0x0 | |
| 0x77174ed3 ntdll.dll:RtlAllocateHeap+0x1e3|test esi, esi|esi=0x0 | |
| 0x77174ed5 ntdll.dll:RtlAllocateHeap+0x1e5|je 0x77174f1c|eflags=0x246 | |
| 0x77174f1c ntdll.dll:RtlAllocateHeap+0x22c|mov eax, edi|edi=0x34 | |
| 0x77174f1e ntdll.dll:RtlAllocateHeap+0x22e|test edi, edi|edi=0x34 | |
| 0x77174f20 ntdll.dll:RtlAllocateHeap+0x230|jne 0x77174f27|eflags=0x202 | |
| 0x77174f27 ntdll.dll:RtlAllocateHeap+0x237|lea esi, [eax + 0xf]|eax=0x34 | |
| 0x77174f2a ntdll.dll:RtlAllocateHeap+0x23a|and esi, 0xfffffff8|esi=0x43 | |
| 0x77174f2d ntdll.dll:RtlAllocateHeap+0x23d|mov edx, esi|esi=0x40 | |
| 0x77174f2f ntdll.dll:RtlAllocateHeap+0x23f|mov dword ptr [ebp - 0x2c], esi|ebp=0x19f988|esi=0x40 | |
| 0x77174f32 ntdll.dll:RtlAllocateHeap+0x242|shr edx, 3|edx=0x40 | |
| 0x77174f35 ntdll.dll:RtlAllocateHeap+0x245|test dword ptr [ebp - 0x10], 0x7d810f61|ebp=0x19f988 | |
| 0x77174f3c ntdll.dll:RtlAllocateHeap+0x24c|mov dword ptr [ebp - 0x20], edx|ebp=0x19f988|edx=0x8 | |
| 0x77174f3f ntdll.dll:RtlAllocateHeap+0x24f|jne 0x77175cf9|eflags=0x246 | |
| 0x77174f45 ntdll.dll:RtlAllocateHeap+0x255|cmp edi, dword ptr [0x77256ccc]|edi=0x34 | |
| 0x77174f4b ntdll.dll:RtlAllocateHeap+0x25b|ja 0x77175946|eflags=0x283 | |
| 0x77174f51 ntdll.dll:RtlAllocateHeap+0x261|mov eax, edx|edx=0x8 | |
| 0x77174f53 ntdll.dll:RtlAllocateHeap+0x263|shr eax, 3|eax=0x8 | |
| 0x77174f56 ntdll.dll:RtlAllocateHeap+0x266|mov dl, byte ptr [eax + ebx + 0xf2]|eax=0x1|ebx=0x820000 | |
| 0x77174f5d ntdll.dll:RtlAllocateHeap+0x26d|mov eax, dword ptr [ebp - 0x20]|ebp=0x19f988 | |
| 0x77174f60 ntdll.dll:RtlAllocateHeap+0x270|movzx ecx, al|al=0x8 | |
| 0x77174f63 ntdll.dll:RtlAllocateHeap+0x273|mov eax, 1 | |
| 0x77174f68 ntdll.dll:RtlAllocateHeap+0x278|and ecx, 7|ecx=0x8 | |
| 0x77174f6b ntdll.dll:RtlAllocateHeap+0x27b|shl eax, cl|eax=0x1|cl=0x0 | |
| 0x77174f6d ntdll.dll:RtlAllocateHeap+0x27d|test dl, al|dl=0x0|al=0x1 | |
| 0x77174f6f ntdll.dll:RtlAllocateHeap+0x27f|je 0x77175943|eflags=0x246 | |
| 0x77175943 ntdll.dll:RtlAllocateHeap+0xc53|mov edx, dword ptr [ebp - 0x20]|ebp=0x19f988 | |
| 0x77175946 ntdll.dll:RtlAllocateHeap+0xc56|mov eax, dword ptr [ebx + 0xb4]|ebx=0x820000 | |
| 0x7717594c ntdll.dll:RtlAllocateHeap+0xc5c|cmp edx, dword ptr [eax + 4]|edx=0x8|eax=0x820270 | |
| 0x7717594f ntdll.dll:RtlAllocateHeap+0xc5f|jb 0x77175962|eflags=0x287 | |
| 0x77175962 ntdll.dll:RtlAllocateHeap+0xc72|mov ecx, edx|edx=0x8 | |
| 0x77175964 ntdll.dll:RtlAllocateHeap+0xc74|cmp ecx, dword ptr [eax + 4]|ecx=0x8|eax=0x820270 | |
| 0x77175967 ntdll.dll:RtlAllocateHeap+0xc77|jae 0x77175cf9|eflags=0x287 | |
| 0x7717596d ntdll.dll:RtlAllocateHeap+0xc7d|cmp edx, ecx|edx=0x8|ecx=0x8 | |
| 0x7717596f ntdll.dll:RtlAllocateHeap+0xc7f|jne 0x77175cf9|eflags=0x246 | |
| 0x77175975 ntdll.dll:RtlAllocateHeap+0xc85|sub edx, dword ptr [eax + 0x14]|edx=0x8|eax=0x820270 | |
| 0x77175978 ntdll.dll:RtlAllocateHeap+0xc88|cmp dword ptr [eax + 8], 0|eax=0x820270 | |
| 0x7717597c ntdll.dll:RtlAllocateHeap+0xc8c|je 0x77175980|eflags=0x246 | |
| 0x77175980 ntdll.dll:RtlAllocateHeap+0xc90|mov eax, dword ptr [eax + 0x20]|eax=0x820270 | |
| 0x77175983 ntdll.dll:RtlAllocateHeap+0xc93|lea eax, [eax + edx*4]|eax=0x8202a4|edx=0x8 | |
| 0x77175986 ntdll.dll:RtlAllocateHeap+0xc96|jmp 0x77175cfb | |
| 0x77175cfb ntdll.dll:RtlAllocateHeap+0x100b|mov edx, dword ptr [ebp - 0x10]|ebp=0x19f988 | |
| 0x77175cfe ntdll.dll:RtlAllocateHeap+0x100e|lea ecx, [ebp - 0x30]|ebp=0x19f988 | |
| 0x77175d01 ntdll.dll:RtlAllocateHeap+0x1011|push ecx|ecx=0x19f958|esp=0x19f910 | |
| 0x77175d02 ntdll.dll:RtlAllocateHeap+0x1012|push eax|eax=0x8202c4|esp=0x19f90c | |
| 0x77175d03 ntdll.dll:RtlAllocateHeap+0x1013|push esi|esi=0x40|esp=0x19f908 | |
| 0x77175d04 ntdll.dll:RtlAllocateHeap+0x1014|push edi|edi=0x34|esp=0x19f904 | |
| 0x77175d05 ntdll.dll:RtlAllocateHeap+0x1015|or edx, 2|edx=0x0 | |
| 0x77175d08 ntdll.dll:RtlAllocateHeap+0x1018|mov ecx, ebx|ebx=0x820000 | |
| 0x77175d0a ntdll.dll:RtlAllocateHeap+0x101a|call 0x77175ec0|esp=0x19f900|eip=0x77175d0a | |
| 0x77175ec0 ntdll.dll:RtlAllocateHeap+0x11d0|mov edi, edi|edi=0x34 | |
| 0x77175ec2 ntdll.dll:RtlAllocateHeap+0x11d2|push ebp|ebp=0x19f988|esp=0x19f8fc | |
| 0x77175ec3 ntdll.dll:RtlAllocateHeap+0x11d3|mov ebp, esp|esp=0x19f8f8 | |
| 0x77175ec5 ntdll.dll:RtlAllocateHeap+0x11d5|push -2|esp=0x19f8f8 | |
| 0x77175ec7 ntdll.dll:RtlAllocateHeap+0x11d7|push 0x7723ec48|esp=0x19f8f4 | |
| 0x77175ecc ntdll.dll:RtlAllocateHeap+0x11dc|push 0x771ad210|esp=0x19f8f0 | |
| 0x77175ed1 ntdll.dll:RtlAllocateHeap+0x11e1|mov eax, dword ptr fs:[0] | |
| 0x77175ed7 ntdll.dll:RtlAllocateHeap+0x11e7|push eax|eax=0x19fe48|esp=0x19f8ec | |
| 0x77175ed8 ntdll.dll:RtlAllocateHeap+0x11e8|sub esp, 0x160|esp=0x19f8e8 | |
| 0x77175ede ntdll.dll:RtlAllocateHeap+0x11ee|push ebx|ebx=0x820000|esp=0x19f788 | |
| 0x77175edf ntdll.dll:RtlAllocateHeap+0x11ef|push esi|esi=0x40|esp=0x19f784 | |
| 0x77175ee0 ntdll.dll:RtlAllocateHeap+0x11f0|push edi|edi=0x34|esp=0x19f780 | |
| 0x77175ee1 ntdll.dll:RtlAllocateHeap+0x11f1|mov eax, dword ptr [0x7725e360] | |
| 0x77175ee6 ntdll.dll:RtlAllocateHeap+0x11f6|xor dword ptr [ebp - 8], eax|ebp=0x19f8f8|eax=0xf9e0af5e | |
| 0x77175ee9 ntdll.dll:RtlAllocateHeap+0x11f9|xor eax, ebp|eax=0xf9e0af5e|ebp=0x19f8f8 | |
| 0x77175eeb ntdll.dll:RtlAllocateHeap+0x11fb|push eax|eax=0xf9f957a6|esp=0x19f77c | |
| 0x77175eec ntdll.dll:RtlAllocateHeap+0x11fc|lea eax, [ebp - 0x10]|ebp=0x19f8f8 | |
| 0x77175eef ntdll.dll:RtlAllocateHeap+0x11ff|mov dword ptr fs:[0], eax|eax=0x19f8e8 | |
| 0x77175ef5 ntdll.dll:RtlAllocateHeap+0x1205|mov ebx, edx|edx=0x2 | |
| 0x77175ef7 ntdll.dll:RtlAllocateHeap+0x1207|mov dword ptr [ebp - 0x68], ebx|ebp=0x19f8f8|ebx=0x2 | |
| 0x77175efa ntdll.dll:RtlAllocateHeap+0x120a|mov edi, ecx|ecx=0x820000 | |
| 0x77175efc ntdll.dll:RtlAllocateHeap+0x120c|mov dword ptr [ebp - 0xd8], edi|ebp=0x19f8f8|edi=0x820000 | |
| 0x77175f02 ntdll.dll:RtlAllocateHeap+0x1212|mov dword ptr [ebp - 0xb0], 0|ebp=0x19f8f8 | |
| 0x77175f0c ntdll.dll:RtlAllocateHeap+0x121c|mov dword ptr [ebp - 0x64], 1|ebp=0x19f8f8 | |
| 0x77175f13 ntdll.dll:RtlAllocateHeap+0x1223|mov byte ptr [ebp - 0x29], 0|ebp=0x19f8f8 | |
| 0x77175f17 ntdll.dll:RtlAllocateHeap+0x1227|mov dword ptr [ebp - 0x5c], 0|ebp=0x19f8f8 | |
| 0x77175f1e ntdll.dll:RtlAllocateHeap+0x122e|mov dword ptr [ebp - 0x50], 0|ebp=0x19f8f8 | |
| 0x77175f25 ntdll.dll:RtlAllocateHeap+0x1235|mov dword ptr [ebp - 0x9c], 0|ebp=0x19f8f8 | |
| 0x77175f2f ntdll.dll:RtlAllocateHeap+0x123f|mov esi, dword ptr [ebp + 0xc]|ebp=0x19f8f8 | |
| 0x77175f32 ntdll.dll:RtlAllocateHeap+0x1242|shr esi, 3|esi=0x40 | |
| 0x77175f35 ntdll.dll:RtlAllocateHeap+0x1245|test ebx, 0x7d010f60|ebx=0x2 | |
| 0x77175f3b ntdll.dll:RtlAllocateHeap+0x124b|jne 0x77175f6f|eflags=0x246 | |
| 0x77175f3d ntdll.dll:RtlAllocateHeap+0x124d|cmp dword ptr [ebp + 8], 0x80000000|ebp=0x19f8f8 | |
| 0x77175f44 ntdll.dll:RtlAllocateHeap+0x1254|jae 0x77175f6f|eflags=0xa83 | |
| 0x77175f46 ntdll.dll:RtlAllocateHeap+0x1256|mov cl, 1 | |
| 0x77175f48 ntdll.dll:RtlAllocateHeap+0x1258|mov dword ptr [ebp - 0x34], ecx|ebp=0x19f8f8|ecx=0x820001 | |
| 0x77175f4b ntdll.dll:RtlAllocateHeap+0x125b|mov edx, esi|esi=0x8 | |
| 0x77175f4d ntdll.dll:RtlAllocateHeap+0x125d|mov dword ptr [ebp - 0x30], edx|ebp=0x19f8f8|edx=0x8 | |
| 0x77175f50 ntdll.dll:RtlAllocateHeap+0x1260|cmp edx, 2|edx=0x8 | |
| 0x77175f53 ntdll.dll:RtlAllocateHeap+0x1263|jae 0x77175f61|eflags=0x206 | |
| 0x77175f61 ntdll.dll:RtlAllocateHeap+0x1271|mov eax, dword ptr [ebp + 0x14]|ebp=0x19f8f8 | |
| 0x77175f64 ntdll.dll:RtlAllocateHeap+0x1274|mov dword ptr [eax], 3|eax=0x19f958 | |
| 0x77175f6a ntdll.dll:RtlAllocateHeap+0x127a|jmp 0x7717601c | |
| 0x7717601c ntdll.dll:RtlAllocateHeap+0x132c|and ebx, 0x800000|ebx=0x2 | |
| 0x77176022 ntdll.dll:RtlAllocateHeap+0x1332|je 0x77176039|eflags=0x246 | |
| 0x77176039 ntdll.dll:RtlAllocateHeap+0x1349|mov dword ptr [ebp - 4], 0|ebp=0x19f8f8 | |
| 0x77176040 ntdll.dll:RtlAllocateHeap+0x1350|test byte ptr [ebp - 0x68], 1|ebp=0x19f8f8 | |
| 0x77176044 ntdll.dll:RtlAllocateHeap+0x1354|jne 0x771760d7|eflags=0x246 | |
| 0x7717604a ntdll.dll:RtlAllocateHeap+0x135a|push dword ptr [edi + 0xc8]|edi=0x820000|esp=0x19f778 | |
| 0x77176050 ntdll.dll:RtlAllocateHeap+0x1360|call 0x77193f20|esp=0x19f774|eip=0x77176050 | |
| 0x77193f20 ntdll.dll:RtlTryEnterCriticalSection|mov edi, edi|edi=0x820000 | |
| 0x77193f22 ntdll.dll:RtlTryEnterCriticalSection+0x2|push ebp|ebp=0x19f8f8|esp=0x19f770 | |
| 0x77193f23 ntdll.dll:RtlTryEnterCriticalSection+0x3|mov ebp, esp|esp=0x19f76c | |
| 0x77193f25 ntdll.dll:RtlTryEnterCriticalSection+0x5|mov eax, dword ptr [ebp + 8]|ebp=0x19f76c | |
| 0x77193f28 ntdll.dll:RtlTryEnterCriticalSection+0x8|mov edx, dword ptr fs:[0x18] | |
| 0x77193f2f ntdll.dll:RtlTryEnterCriticalSection+0xf|lea ecx, [eax + 4]|eax=0x820258 | |
| 0x77193f32 ntdll.dll:RtlTryEnterCriticalSection+0x12|lock btr dword ptr [ecx], 0|ecx=0x82025c | |
| 0x77193f37 ntdll.dll:RtlTryEnterCriticalSection+0x17|jae 0x77193f4f|eflags=0x247 | |
| 0x77193f39 ntdll.dll:RtlTryEnterCriticalSection+0x19|mov ecx, dword ptr [edx + 0x24]|edx=0x2a6000 | |
| 0x77193f3c ntdll.dll:RtlTryEnterCriticalSection+0x1c|mov dword ptr [eax + 0xc], ecx|eax=0x820258|ecx=0x1fc0 | |
| 0x77193f3f ntdll.dll:RtlTryEnterCriticalSection+0x1f|mov dword ptr [eax + 8], 1|eax=0x820258 | |
| 0x77193f46 ntdll.dll:RtlTryEnterCriticalSection+0x26|mov eax, 1 | |
| 0x77193f4b ntdll.dll:RtlTryEnterCriticalSection+0x2b|pop ebp|ebp=0x19f76c|esp=0x19f76c | |
| 0x77193f4c ntdll.dll:RtlTryEnterCriticalSection+0x2c|ret 4|esp=0x19f770 | |
| 0x77176055 ntdll.dll:RtlAllocateHeap+0x1365|test eax, eax|eax=0x1 | |
| 0x77176057 ntdll.dll:RtlAllocateHeap+0x1367|jne 0x771760b6|eflags=0x202 | |
| 0x771760b6 ntdll.dll:RtlAllocateHeap+0x13c6|inc dword ptr [edi + 0x214]|edi=0x820000 | |
| 0x771760bc ntdll.dll:RtlAllocateHeap+0x13cc|mov byte ptr [ebp - 0x7d], 1|ebp=0x19f8f8 | |
| 0x771760c0 ntdll.dll:RtlAllocateHeap+0x13d0|mov byte ptr [ebp - 0x29], 1|ebp=0x19f8f8 | |
| 0x771760c4 ntdll.dll:RtlAllocateHeap+0x13d4|test dword ptr [edi + 0x48], 0x30000000|edi=0x820000 | |
| 0x771760cb ntdll.dll:RtlAllocateHeap+0x13db|je 0x771760d4|eflags=0x246 | |
| 0x771760d4 ntdll.dll:RtlAllocateHeap+0x13e4|mov edx, dword ptr [ebp - 0x30]|ebp=0x19f8f8 | |
| 0x771760d7 ntdll.dll:RtlAllocateHeap+0x13e7|cmp edx, dword ptr [edi + 0x5c]|edx=0x8|edi=0x820000 | |
| 0x771760da ntdll.dll:RtlAllocateHeap+0x13ea|ja 0x77177819|eflags=0x283 | |
| 0x771760e0 ntdll.dll:RtlAllocateHeap+0x13f0|test ebx, ebx|ebx=0x0 | |
| 0x771760e2 ntdll.dll:RtlAllocateHeap+0x13f2|jne 0x77176211|eflags=0x246 | |
| 0x771760e8 ntdll.dll:RtlAllocateHeap+0x13f8|movzx eax, word ptr [edi + 0xf0]|edi=0x820000 | |
| 0x771760ef ntdll.dll:RtlAllocateHeap+0x13ff|cmp esi, eax|esi=0x8|eax=0x802 | |
| 0x771760f1 ntdll.dll:RtlAllocateHeap+0x1401|mov eax, dword ptr [ebp + 8]|ebp=0x19f8f8 | |
| 0x771760f4 ntdll.dll:RtlAllocateHeap+0x1404|jb 0x77176130|eflags=0x287 | |
| 0x77176130 ntdll.dll:RtlAllocateHeap+0x1440|cmp eax, dword ptr [0x77256ccc]|eax=0x34 | |
| 0x77176136 ntdll.dll:RtlAllocateHeap+0x1446|ja 0x77176211|eflags=0x283 | |
| 0x7717613c ntdll.dll:RtlAllocateHeap+0x144c|mov eax, esi|esi=0x8 | |
| 0x7717613e ntdll.dll:RtlAllocateHeap+0x144e|shr eax, 3|eax=0x8 | |
| 0x77176141 ntdll.dll:RtlAllocateHeap+0x1451|add eax, 0xf2|eax=0x1 | |
| 0x77176146 ntdll.dll:RtlAllocateHeap+0x1456|add eax, edi|eax=0xf3|edi=0x820000 | |
| 0x77176148 ntdll.dll:RtlAllocateHeap+0x1458|mov dword ptr [ebp - 0x54], eax|ebp=0x19f8f8|eax=0x8200f3 | |
| 0x7717614b ntdll.dll:RtlAllocateHeap+0x145b|mov dl, byte ptr [eax]|eax=0x8200f3 | |
| 0x7717614d ntdll.dll:RtlAllocateHeap+0x145d|mov ebx, esi|esi=0x8 | |
| 0x7717614f ntdll.dll:RtlAllocateHeap+0x145f|and ebx, 7|ebx=0x8 | |
| 0x77176152 ntdll.dll:RtlAllocateHeap+0x1462|mov eax, 1 | |
| 0x77176157 ntdll.dll:RtlAllocateHeap+0x1467|mov ecx, ebx|ebx=0x0 | |
| 0x77176159 ntdll.dll:RtlAllocateHeap+0x1469|shl eax, cl|eax=0x1|cl=0x0 | |
| 0x7717615b ntdll.dll:RtlAllocateHeap+0x146b|test dl, al|dl=0x0|al=0x1 | |
| 0x7717615d ntdll.dll:RtlAllocateHeap+0x146d|jne 0x7717620e|eflags=0x246 | |
| 0x77176163 ntdll.dll:RtlAllocateHeap+0x1473|mov eax, dword ptr [edi + 0xec]|edi=0x820000 | |
| 0x77176169 ntdll.dll:RtlAllocateHeap+0x1479|lea esi, [eax + esi*2]|eax=0x821af0|esi=0x8 | |
| 0x7717616c ntdll.dll:RtlAllocateHeap+0x147c|mov dword ptr [ebp - 0xe0], esi|ebp=0x19f8f8|esi=0x821b00 | |
| 0x77176172 ntdll.dll:RtlAllocateHeap+0x1482|add word ptr [esi], 0x21|esi=0x821b00 | |
| 0x77176176 ntdll.dll:RtlAllocateHeap+0x1486|mov cx, word ptr [esi]|esi=0x821b00 | |
| 0x77176179 ntdll.dll:RtlAllocateHeap+0x1489|cmp dword ptr [ebp - 0x9c], 0|ebp=0x19f8f8 | |
| 0x77176180 ntdll.dll:RtlAllocateHeap+0x1490|jne 0x771761aa|eflags=0x246 | |
| 0x77176182 ntdll.dll:RtlAllocateHeap+0x1492|mov al, cl|cl=0xc6 | |
| 0x77176184 ntdll.dll:RtlAllocateHeap+0x1494|and al, 0x1f|al=0xc6 | |
| 0x77176186 ntdll.dll:RtlAllocateHeap+0x1496|cmp al, 0x10|al=0x6 | |
| 0x77176188 ntdll.dll:RtlAllocateHeap+0x1498|ja 0x771761a0|eflags=0x287 | |
| 0x7717618a ntdll.dll:RtlAllocateHeap+0x149a|mov eax, 0xff00 | |
| 0x7717618f ntdll.dll:RtlAllocateHeap+0x149f|cmp cx, ax|cx=0xc6|ax=0xff00 | |
| 0x77176192 ntdll.dll:RtlAllocateHeap+0x14a2|ja 0x771761a0|eflags=0x207 | |
| 0x77176194 ntdll.dll:RtlAllocateHeap+0x14a4|mov dword ptr [ebp - 0xb4], 0|ebp=0x19f8f8 | |
| 0x7717619e ntdll.dll:RtlAllocateHeap+0x14ae|jmp 0x7717620e | |
| 0x7717620e ntdll.dll:RtlAllocateHeap+0x151e|mov edx, dword ptr [ebp - 0x30]|ebp=0x19f8f8 | |
| 0x77176211 ntdll.dll:RtlAllocateHeap+0x1521|mov esi, dword ptr [ebp + 0x10]|ebp=0x19f8f8 | |
| 0x77176214 ntdll.dll:RtlAllocateHeap+0x1524|test esi, esi|esi=0x8202c4 | |
| 0x77176216 ntdll.dll:RtlAllocateHeap+0x1526|je 0x7717646b|eflags=0x202 | |
| 0x7717621c ntdll.dll:RtlAllocateHeap+0x152c|mov esi, dword ptr [esi]|esi=0x8202c4 | |
| 0x7717621e ntdll.dll:RtlAllocateHeap+0x152e|test esi, esi|esi=0x0 | |
| 0x77176220 ntdll.dll:RtlAllocateHeap+0x1530|je 0x7717646b|eflags=0x246 | |
| 0x7717646b ntdll.dll:RtlAllocateHeap+0x177b|lea eax, [edi + 0xc0]|edi=0x820000 | |
| 0x77176471 ntdll.dll:RtlAllocateHeap+0x1781|mov dword ptr [ebp - 0xc0], eax|ebp=0x19f8f8|eax=0x8200c0 | |
| 0x77176477 ntdll.dll:RtlAllocateHeap+0x1787|mov esi, dword ptr [edi + 0xb4]|edi=0x820000 | |
| 0x7717647d ntdll.dll:RtlAllocateHeap+0x178d|mov dword ptr [ebp - 0x28], esi|ebp=0x19f8f8|esi=0x820270 | |
| 0x77176480 ntdll.dll:RtlAllocateHeap+0x1790|mov ecx, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176483 ntdll.dll:RtlAllocateHeap+0x1793|cmp edx, ecx|edx=0x8|ecx=0x80 | |
| 0x77176485 ntdll.dll:RtlAllocateHeap+0x1795|jae 0x7717648b|eflags=0x287 | |
| 0x77176487 ntdll.dll:RtlAllocateHeap+0x1797|mov eax, edx|edx=0x8 | |
| 0x77176489 ntdll.dll:RtlAllocateHeap+0x1799|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19f8f8|eax=0x8 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x8|esi=0x820270 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19f8f8|eax=0x8 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19f8f8 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x820270 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19f8f8|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82b468 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x293 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82b468 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8f8|eax=0x82b460 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82b460 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19f8f8|ebx=0x571acb7a | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x571acb7a|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19f8f8|ebx=0x73000370 | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x73000370 | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x73000370 | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x73000370 | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x73000370 | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x3 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x3|bl=0x70 | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x73000370 | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x73000370 | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x73|cl=0x73 | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x370 | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19f8f8 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x8|eax=0x370 | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19f8f8|ecx=0xfffffc98 | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0xfffffc98 | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x282 | |
| 0x77176526 ntdll.dll:RtlAllocateHeap+0x1836|mov eax, dword ptr [edx]|edx=0x8200c0 | |
| 0x77176528 ntdll.dll:RtlAllocateHeap+0x1838|add eax, -8|eax=0x8266e8 | |
| 0x7717652b ntdll.dll:RtlAllocateHeap+0x183b|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8f8|eax=0x8266e0 | |
| 0x7717652e ntdll.dll:RtlAllocateHeap+0x183e|mov ebx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176530 ntdll.dll:RtlAllocateHeap+0x1840|mov dword ptr [ebp - 0x140], ebx|ebp=0x19f8f8|ebx=0x261ac808 | |
| 0x77176536 ntdll.dll:RtlAllocateHeap+0x1846|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717653a ntdll.dll:RtlAllocateHeap+0x184a|je 0x77176574|eflags=0x206 | |
| 0x7717653c ntdll.dll:RtlAllocateHeap+0x184c|xor ebx, dword ptr [edi + 0x50]|ebx=0x261ac808|edi=0x820000 | |
| 0x7717653f ntdll.dll:RtlAllocateHeap+0x184f|mov dword ptr [ebp - 0x140], ebx|ebp=0x19f8f8|ebx=0x2000002 | |
| 0x77176545 ntdll.dll:RtlAllocateHeap+0x1855|mov ecx, ebx|ebx=0x2000002 | |
| 0x77176547 ntdll.dll:RtlAllocateHeap+0x1857|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717654a ntdll.dll:RtlAllocateHeap+0x185a|mov eax, ebx|ebx=0x2000002 | |
| 0x7717654c ntdll.dll:RtlAllocateHeap+0x185c|shr eax, 8|eax=0x2000002 | |
| 0x7717654f ntdll.dll:RtlAllocateHeap+0x185f|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176551 ntdll.dll:RtlAllocateHeap+0x1861|xor cl, bl|cl=0x0|bl=0x2 | |
| 0x77176553 ntdll.dll:RtlAllocateHeap+0x1863|mov eax, ebx|ebx=0x2000002 | |
| 0x77176555 ntdll.dll:RtlAllocateHeap+0x1865|shr eax, 0x18|eax=0x2000002 | |
| 0x77176558 ntdll.dll:RtlAllocateHeap+0x1868|cmp al, cl|al=0x2|cl=0x2 | |
| 0x7717655a ntdll.dll:RtlAllocateHeap+0x186a|je 0x77176574|eflags=0x246 | |
| 0x77176574 ntdll.dll:RtlAllocateHeap+0x1884|movzx eax, bx|bx=0x2 | |
| 0x77176577 ntdll.dll:RtlAllocateHeap+0x1887|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19f8f8 | |
| 0x7717657a ntdll.dll:RtlAllocateHeap+0x188a|sub ecx, eax|ecx=0x8|eax=0x2 | |
| 0x7717657c ntdll.dll:RtlAllocateHeap+0x188c|mov dword ptr [ebp - 0xf0], ecx|ebp=0x19f8f8|ecx=0x6 | |
| 0x77176582 ntdll.dll:RtlAllocateHeap+0x1892|test ecx, ecx|ecx=0x6 | |
| 0x77176584 ntdll.dll:RtlAllocateHeap+0x1894|jg 0x7717658d|eflags=0x206 | |
| 0x7717658d ntdll.dll:RtlAllocateHeap+0x189d|cmp dword ptr [esi], 0|esi=0x820270 | |
| 0x77176590 ntdll.dll:RtlAllocateHeap+0x18a0|jne 0x7717662a|eflags=0x206 | |
| 0x7717662a ntdll.dll:RtlAllocateHeap+0x193a|mov ecx, dword ptr [ebp - 0x4c]|ebp=0x19f8f8 | |
| 0x7717662d ntdll.dll:RtlAllocateHeap+0x193d|mov edx, ecx|ecx=0x8 | |
| 0x7717662f ntdll.dll:RtlAllocateHeap+0x193f|shr edx, 5|edx=0x8 | |
| 0x77176632 ntdll.dll:RtlAllocateHeap+0x1942|mov eax, dword ptr [esi + 4]|esi=0x820270 | |
| 0x77176635 ntdll.dll:RtlAllocateHeap+0x1945|sub eax, dword ptr [esi + 0x14]|eax=0x80|esi=0x820270 | |
| 0x77176638 ntdll.dll:RtlAllocateHeap+0x1948|shr eax, 5|eax=0x80 | |
| 0x7717663b ntdll.dll:RtlAllocateHeap+0x194b|dec eax|eax=0x4 | |
| 0x7717663c ntdll.dll:RtlAllocateHeap+0x194c|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8f8|eax=0x3 | |
| 0x7717663f ntdll.dll:RtlAllocateHeap+0x194f|mov eax, dword ptr [esi + 0x1c]|esi=0x820270 | |
| 0x77176642 ntdll.dll:RtlAllocateHeap+0x1952|lea eax, [eax + edx*4]|eax=0x820294|edx=0x0 | |
| 0x77176645 ntdll.dll:RtlAllocateHeap+0x1955|and ecx, 0x1f|ecx=0x8 | |
| 0x77176648 ntdll.dll:RtlAllocateHeap+0x1958|or ebx, 0xffffffff|ebx=0x2000002 | |
| 0x7717664b ntdll.dll:RtlAllocateHeap+0x195b|shl ebx, cl|ebx=0xffffffff|cl=0x8 | |
| 0x7717664d ntdll.dll:RtlAllocateHeap+0x195d|and ebx, dword ptr [eax]|ebx=0xffffff00|eax=0x820294 | |
| 0x7717664f ntdll.dll:RtlAllocateHeap+0x195f|mov ecx, dword ptr [ebp - 0x24]|ebp=0x19f8f8 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x820294 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x0 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x0|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x820294 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x820298 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x0 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x820298 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x1 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x1|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x820298 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x82029c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x1 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x82029c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x2 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x2|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x82029c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x8202a0 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x2 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x8202a0 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x3 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x3|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x246 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x8202a0 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x8202a4 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x3 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x8202a4 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x4 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x4|ecx=0x3 | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x202 | |
| 0x7717666e ntdll.dll:RtlAllocateHeap+0x197e|test ebx, ebx|ebx=0x0 | |
| 0x77176670 ntdll.dll:RtlAllocateHeap+0x1980|je 0x77177802|eflags=0x246 | |
| 0x77177802 ntdll.dll:RtlAllocateHeap+0x2b12|mov esi, dword ptr [esi]|esi=0x820270 | |
| 0x77177804 ntdll.dll:RtlAllocateHeap+0x2b14|mov dword ptr [ebp - 0x28], esi|ebp=0x19f8f8|esi=0x822b00 | |
| 0x77177807 ntdll.dll:RtlAllocateHeap+0x2b17|mov eax, dword ptr [esi + 0x14]|esi=0x822b00 | |
| 0x7717780a ntdll.dll:RtlAllocateHeap+0x2b1a|jmp 0x77176498 | |
| 0x77176498 ntdll.dll:RtlAllocateHeap+0x17a8|mov dword ptr [ebp - 0x3c], eax|ebp=0x19f8f8|eax=0x80 | |
| 0x7717649b ntdll.dll:RtlAllocateHeap+0x17ab|jmp 0x771764a0 | |
| 0x771764a0 ntdll.dll:RtlAllocateHeap+0x17b0|sub eax, dword ptr [esi + 0x14]|eax=0x80|esi=0x822b00 | |
| 0x771764a3 ntdll.dll:RtlAllocateHeap+0x17b3|mov dword ptr [ebp - 0x4c], eax|ebp=0x19f8f8|eax=0x0 | |
| 0x771764a6 ntdll.dll:RtlAllocateHeap+0x17b6|mov dword ptr [ebp - 0x1c], 0|ebp=0x19f8f8 | |
| 0x771764ad ntdll.dll:RtlAllocateHeap+0x17bd|mov edx, dword ptr [esi + 0x18]|esi=0x822b00 | |
| 0x771764b0 ntdll.dll:RtlAllocateHeap+0x17c0|mov dword ptr [ebp - 0x74], edx|ebp=0x19f8f8|edx=0x8200c0 | |
| 0x771764b3 ntdll.dll:RtlAllocateHeap+0x17c3|mov eax, dword ptr [edx + 4]|edx=0x8200c0 | |
| 0x771764b6 ntdll.dll:RtlAllocateHeap+0x17c6|cmp edx, eax|edx=0x8200c0|eax=0x82b468 | |
| 0x771764b8 ntdll.dll:RtlAllocateHeap+0x17c8|jne 0x771764c1|eflags=0x293 | |
| 0x771764c1 ntdll.dll:RtlAllocateHeap+0x17d1|add eax, -8|eax=0x82b468 | |
| 0x771764c4 ntdll.dll:RtlAllocateHeap+0x17d4|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8f8|eax=0x82b460 | |
| 0x771764c7 ntdll.dll:RtlAllocateHeap+0x17d7|mov ebx, dword ptr [eax]|eax=0x82b460 | |
| 0x771764c9 ntdll.dll:RtlAllocateHeap+0x17d9|mov dword ptr [ebp - 0x138], ebx|ebp=0x19f8f8|ebx=0x571acb7a | |
| 0x771764cf ntdll.dll:RtlAllocateHeap+0x17df|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x771764d3 ntdll.dll:RtlAllocateHeap+0x17e3|je 0x7717650d|eflags=0x206 | |
| 0x771764d5 ntdll.dll:RtlAllocateHeap+0x17e5|xor ebx, dword ptr [edi + 0x50]|ebx=0x571acb7a|edi=0x820000 | |
| 0x771764d8 ntdll.dll:RtlAllocateHeap+0x17e8|mov dword ptr [ebp - 0x138], ebx|ebp=0x19f8f8|ebx=0x73000370 | |
| 0x771764de ntdll.dll:RtlAllocateHeap+0x17ee|mov ecx, ebx|ebx=0x73000370 | |
| 0x771764e0 ntdll.dll:RtlAllocateHeap+0x17f0|shr ecx, 0x10|ecx=0x73000370 | |
| 0x771764e3 ntdll.dll:RtlAllocateHeap+0x17f3|mov eax, ebx|ebx=0x73000370 | |
| 0x771764e5 ntdll.dll:RtlAllocateHeap+0x17f5|shr eax, 8|eax=0x73000370 | |
| 0x771764e8 ntdll.dll:RtlAllocateHeap+0x17f8|xor cl, al|cl=0x0|al=0x3 | |
| 0x771764ea ntdll.dll:RtlAllocateHeap+0x17fa|xor cl, bl|cl=0x3|bl=0x70 | |
| 0x771764ec ntdll.dll:RtlAllocateHeap+0x17fc|mov eax, ebx|ebx=0x73000370 | |
| 0x771764ee ntdll.dll:RtlAllocateHeap+0x17fe|shr eax, 0x18|eax=0x73000370 | |
| 0x771764f1 ntdll.dll:RtlAllocateHeap+0x1801|cmp al, cl|al=0x73|cl=0x73 | |
| 0x771764f3 ntdll.dll:RtlAllocateHeap+0x1803|je 0x7717650d|eflags=0x246 | |
| 0x7717650d ntdll.dll:RtlAllocateHeap+0x181d|movzx eax, bx|bx=0x370 | |
| 0x77176510 ntdll.dll:RtlAllocateHeap+0x1820|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19f8f8 | |
| 0x77176513 ntdll.dll:RtlAllocateHeap+0x1823|sub ecx, eax|ecx=0x8|eax=0x370 | |
| 0x77176515 ntdll.dll:RtlAllocateHeap+0x1825|mov dword ptr [ebp - 0xec], ecx|ebp=0x19f8f8|ecx=0xfffffc98 | |
| 0x7717651b ntdll.dll:RtlAllocateHeap+0x182b|test ecx, ecx|ecx=0xfffffc98 | |
| 0x7717651d ntdll.dll:RtlAllocateHeap+0x182d|jle 0x77176526|eflags=0x282 | |
| 0x77176526 ntdll.dll:RtlAllocateHeap+0x1836|mov eax, dword ptr [edx]|edx=0x8200c0 | |
| 0x77176528 ntdll.dll:RtlAllocateHeap+0x1838|add eax, -8|eax=0x8266e8 | |
| 0x7717652b ntdll.dll:RtlAllocateHeap+0x183b|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8f8|eax=0x8266e0 | |
| 0x7717652e ntdll.dll:RtlAllocateHeap+0x183e|mov ebx, dword ptr [eax]|eax=0x8266e0 | |
| 0x77176530 ntdll.dll:RtlAllocateHeap+0x1840|mov dword ptr [ebp - 0x140], ebx|ebp=0x19f8f8|ebx=0x261ac808 | |
| 0x77176536 ntdll.dll:RtlAllocateHeap+0x1846|cmp dword ptr [edi + 0x4c], 0|edi=0x820000 | |
| 0x7717653a ntdll.dll:RtlAllocateHeap+0x184a|je 0x77176574|eflags=0x206 | |
| 0x7717653c ntdll.dll:RtlAllocateHeap+0x184c|xor ebx, dword ptr [edi + 0x50]|ebx=0x261ac808|edi=0x820000 | |
| 0x7717653f ntdll.dll:RtlAllocateHeap+0x184f|mov dword ptr [ebp - 0x140], ebx|ebp=0x19f8f8|ebx=0x2000002 | |
| 0x77176545 ntdll.dll:RtlAllocateHeap+0x1855|mov ecx, ebx|ebx=0x2000002 | |
| 0x77176547 ntdll.dll:RtlAllocateHeap+0x1857|shr ecx, 0x10|ecx=0x2000002 | |
| 0x7717654a ntdll.dll:RtlAllocateHeap+0x185a|mov eax, ebx|ebx=0x2000002 | |
| 0x7717654c ntdll.dll:RtlAllocateHeap+0x185c|shr eax, 8|eax=0x2000002 | |
| 0x7717654f ntdll.dll:RtlAllocateHeap+0x185f|xor cl, al|cl=0x0|al=0x0 | |
| 0x77176551 ntdll.dll:RtlAllocateHeap+0x1861|xor cl, bl|cl=0x0|bl=0x2 | |
| 0x77176553 ntdll.dll:RtlAllocateHeap+0x1863|mov eax, ebx|ebx=0x2000002 | |
| 0x77176555 ntdll.dll:RtlAllocateHeap+0x1865|shr eax, 0x18|eax=0x2000002 | |
| 0x77176558 ntdll.dll:RtlAllocateHeap+0x1868|cmp al, cl|al=0x2|cl=0x2 | |
| 0x7717655a ntdll.dll:RtlAllocateHeap+0x186a|je 0x77176574|eflags=0x246 | |
| 0x77176574 ntdll.dll:RtlAllocateHeap+0x1884|movzx eax, bx|bx=0x2 | |
| 0x77176577 ntdll.dll:RtlAllocateHeap+0x1887|mov ecx, dword ptr [ebp - 0x30]|ebp=0x19f8f8 | |
| 0x7717657a ntdll.dll:RtlAllocateHeap+0x188a|sub ecx, eax|ecx=0x8|eax=0x2 | |
| 0x7717657c ntdll.dll:RtlAllocateHeap+0x188c|mov dword ptr [ebp - 0xf0], ecx|ebp=0x19f8f8|ecx=0x6 | |
| 0x77176582 ntdll.dll:RtlAllocateHeap+0x1892|test ecx, ecx|ecx=0x6 | |
| 0x77176584 ntdll.dll:RtlAllocateHeap+0x1894|jg 0x7717658d|eflags=0x206 | |
| 0x7717658d ntdll.dll:RtlAllocateHeap+0x189d|cmp dword ptr [esi], 0|esi=0x822b00 | |
| 0x77176590 ntdll.dll:RtlAllocateHeap+0x18a0|jne 0x7717662a|eflags=0x246 | |
| 0x77176596 ntdll.dll:RtlAllocateHeap+0x18a6|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176599 ntdll.dll:RtlAllocateHeap+0x18a9|dec eax|eax=0x800 | |
| 0x7717659a ntdll.dll:RtlAllocateHeap+0x18aa|cmp dword ptr [ebp - 0x3c], eax|ebp=0x19f8f8|eax=0x7ff | |
| 0x7717659d ntdll.dll:RtlAllocateHeap+0x18ad|jne 0x7717662a|eflags=0x297 | |
| 0x7717662a ntdll.dll:RtlAllocateHeap+0x193a|mov ecx, dword ptr [ebp - 0x4c]|ebp=0x19f8f8 | |
| 0x7717662d ntdll.dll:RtlAllocateHeap+0x193d|mov edx, ecx|ecx=0x0 | |
| 0x7717662f ntdll.dll:RtlAllocateHeap+0x193f|shr edx, 5|edx=0x0 | |
| 0x77176632 ntdll.dll:RtlAllocateHeap+0x1942|mov eax, dword ptr [esi + 4]|esi=0x822b00 | |
| 0x77176635 ntdll.dll:RtlAllocateHeap+0x1945|sub eax, dword ptr [esi + 0x14]|eax=0x800|esi=0x822b00 | |
| 0x77176638 ntdll.dll:RtlAllocateHeap+0x1948|shr eax, 5|eax=0x780 | |
| 0x7717663b ntdll.dll:RtlAllocateHeap+0x194b|dec eax|eax=0x3c | |
| 0x7717663c ntdll.dll:RtlAllocateHeap+0x194c|mov dword ptr [ebp - 0x24], eax|ebp=0x19f8f8|eax=0x3b | |
| 0x7717663f ntdll.dll:RtlAllocateHeap+0x194f|mov eax, dword ptr [esi + 0x1c]|esi=0x822b00 | |
| 0x77176642 ntdll.dll:RtlAllocateHeap+0x1952|lea eax, [eax + edx*4]|eax=0x822b24|edx=0x0 | |
| 0x77176645 ntdll.dll:RtlAllocateHeap+0x1955|and ecx, 0x1f|ecx=0x0 | |
| 0x77176648 ntdll.dll:RtlAllocateHeap+0x1958|or ebx, 0xffffffff|ebx=0x2000002 | |
| 0x7717664b ntdll.dll:RtlAllocateHeap+0x195b|shl ebx, cl|ebx=0xffffffff|cl=0x0 | |
| 0x7717664d ntdll.dll:RtlAllocateHeap+0x195d|and ebx, dword ptr [eax]|ebx=0xffffffff|eax=0x822b24 | |
| 0x7717664f ntdll.dll:RtlAllocateHeap+0x195f|mov ecx, dword ptr [ebp - 0x24]|ebp=0x19f8f8 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x822b24 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x0 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x0|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b24 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b28 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x0 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x822b28 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x1 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x1|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b28 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b2c | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x1 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x822b2c | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x2 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x2|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b2c | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b30 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x2 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x822b30 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x3 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x3|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x293 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b30 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b34 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x3 | |
| 0x7717666c ntdll.dll:RtlAllocateHeap+0x197c|jmp 0x77176652 | |
| 0x77176652 ntdll.dll:RtlAllocateHeap+0x1962|mov dword ptr [ebp - 0xbc], eax|ebp=0x19f8f8|eax=0x822b34 | |
| 0x77176658 ntdll.dll:RtlAllocateHeap+0x1968|mov dword ptr [ebp - 0xa0], edx|ebp=0x19f8f8|edx=0x4 | |
| 0x7717665e ntdll.dll:RtlAllocateHeap+0x196e|test ebx, ebx|ebx=0x0 | |
| 0x77176660 ntdll.dll:RtlAllocateHeap+0x1970|jne 0x77176676|eflags=0x246 | |
| 0x77176662 ntdll.dll:RtlAllocateHeap+0x1972|cmp edx, ecx|edx=0x4|ecx=0x3b | |
| 0x77176664 ntdll.dll:RtlAllocateHeap+0x1974|ja 0x7717666e|eflags=0x297 | |
| 0x77176666 ntdll.dll:RtlAllocateHeap+0x1976|add eax, 4|eax=0x822b34 | |
| 0x77176669 ntdll.dll:RtlAllocateHeap+0x1979|mov ebx, dword ptr [eax]|eax=0x822b38 | |
| 0x7717666b ntdll.dll:RtlAllocateHeap+0x197b|inc edx|edx=0x4 | |
| 0x7717666c ntdll.dll:R |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment