Jump to content

Need help with application failure in ntdll.dll

autoidiot
 Share

Recommended Posts

autoidiot Seeker

autoidiot

Posted
Posted (edited)

Hello,

I have an issue with a medium-complex application I have written. Since my programming knowledge with regards to Windows is limited (stopped programming about 10 years ago and never got around to OOP), any help is greatly appreciated.

The error

Application Failure gaia.exe 3.3.8.1 in ntdll.dll 5.1.2600.5755 at offset 000012b0.

With what little I know and could Google (correct me if something is wrong), ntdll.dll seems to be the interface to the Native API, which means a lot of the commands I use could be the offender.

The application

The application is written to complement a first-party software that is no longer supported. The first party SW runs on a measurement system and saves a TIF image and XML file for each measurement it does. The TIF and XML files for all measurements are saved in one directory. The load of files saved per hour can be up to 10,000. What my program is supposed to do is

  • It's a resident application, meaning it's supposed to run continuously.
  • Move all XML and TIF images to a temporary directory at beginning of process to avoid access problems (1st party SW still writing and my program reading at the same time)
  • Read basic information about the measurement form the XML file
  • Sort XMLs and TIFs into a subfolder structure according to measurement parameters
  • Before doing so, all images get converted from TIF to JPG to save HDD space (using the library FreeImage)
  • In addition, there are the BoxLabel.TIF files that get sorted into a separate folder
  • Lastly, every file older than an hour gets sorted into a folder Rest
  • Application then sleeps for a defined time and starts over
  • The intervals and paths are read from an INI file, but have hardcoded default values
History

I've tested the application on my own laptop, which has AutoIT installed. During alpha testing, I sorted over 50,000 files over the course of one night without any crashes. In fact, I have never encountered the error on my laptop.

For beta testing I copied the compiled EXE, the INI and the FreeImage.dll to the measurement computer (no AutoIT installed) and started it. The crash will always eventually occur, sometimes after 1 minute, sometimes after over 24h. It seems to always occur during the sorting/converting part, not during the idle "sleep" period.

Attachments

  • Source code
  • INI file
  • Windows error log
#Region
#AutoIt3Wrapper_Res_requestedExecutionLevel=asInvoker
#AutoIt3Wrapper_icon=gaia_icon.ico
#EndRegion
#include
#include
#include

; Setting of runtime variables
Opt("TrayAutoPause", 0)
Opt("TrayMenuMode", 0)

; setup variables
Global $appname = 'Image Archiver v0.8 alpha'
Global $disclaimer = $appname & @CRLF & @CRLF & "Written by a.b@c.com" & @CRLF & @CRLF & "By clicking [OK] or not cancelling" & @CRLF & "the application within 30 seconds," & @CRLF & "you agree to not redistributing" & @CRLF & "this application without the authors consent!"
Global $source_path = IniRead("gaia.ini","paths","source_path","c:temp")
If (StringRight ( $source_path, 1 ) <> "") Then
$source_path = $source_path & ""
EndIf
Global $temp_path = $source_path & "temp"
Global $target_path = IniRead("gaia.ini","paths","target_path","c:temparchive")
If (StringRight ( $target_path, 1 ) <> "") Then
$target_path = $target_path & ""
EndIf
Global $zzz = Number(IniRead("gaia.ini","intervals","sleep_time","300"))
Global $BoxL_grace = Number(IniRead("gaia.ini","intervals","grace_period","180"))
Global $loops = 1
Global $count = 0
Global $Temp, $Temp2, $CDate, $BoxL_CDate, $TimeDiff
Global $AppName, $BoxID, $PieceID, $SiteXY, $ElementXY, $Location


Func _FileListToArrayEx($s_path, $s_mask = "*.*", $i_flag = 0, $s_exclude = -1, $f_recurse = True, $f_full_path = True)
; functions
;===============================================================================
;
; Description: lists all or preferred files and or folders in a specified path (Similar to using Dir with the /B Switch)
; Syntax: _FileListToArrayEx($sPath, $sFilter = '*.*', $iFlag = 0, $sExclude = '')
; Parameter(s): $sPath = Path to generate filelist for
; $sFilter = The filter to use. Search the Autoit3 manual for the word "WildCards" For details, support now for multiple searches
; Example *.exe; *.txt will find all .exe and .txt files
; $iFlag = determines weather to return file or folders or both.
; $sExclude = exclude a file from the list by all or part of its name
; Example: Unins* will remove all files/folders that start with Unins
; $iFlag=0(Default) Return both files and folders
; $iFlag=1 Return files Only
; $iFlag=2 Return Folders Only
;
; Requirement(s): None
; Return Value(s): On Success - Returns an array containing the list of files and folders in the specified path
; On Failure - Returns the an empty string "" if no files are found and sets @Error on errors
; @Error or @extended = 1 Path not found or invalid
; @Error or @extended = 2 Invalid $sFilter or Invalid $sExclude
; @Error or @extended = 3 Invalid $iFlag
; @Error or @extended = 4 No File(s) Found
;
; Author(s): SmOke_N
; Note(s): The array returned is one-dimensional and is made up as follows:
; $array[0] = Number of FilesFolders returned
; $array[1] = 1st FileFolder
; $array[2] = 2nd FileFolder
; $array[3] = 3rd FileFolder
; $array[n] = nth FileFolder
;
; All files are written to a "reserved" .tmp file (Thanks to gafrost) for the example
; The Reserved file is then read into an array, then deleted
;===============================================================================
If FileExists($s_path) = 0 Then Return SetError(1, 1, 0)

; Strip trailing backslash, and add one after to make sure there's only one
$s_path = StringRegExpReplace($s_path, "[/]+z", "") & ""

; Set all defaults
If $s_mask = -1 Or $s_mask = Default Then $s_mask = "*.*"
If $i_flag = -1 Or $i_flag = Default Then $i_flag = 0
If $s_exclude = -1 Or $s_exclude = Default Then $s_exclude = ""

; Look for bad chars
If StringRegExp($s_mask, "[/:><|]") Or StringRegExp($s_exclude, "[/:><|]") Then
Return SetError(2, 2, 0)
EndIf

; Strip leading spaces between semi colon delimiter
$s_mask = StringRegExpReplace($s_mask, "s*;s*", ";")
If $s_exclude Then $s_exclude = StringRegExpReplace($s_exclude, "s*;s*", ";")

; Confirm mask has something in it
If StringStripWS($s_mask, 8) = "" Then Return SetError(2, 2, 0)
If $i_flag < 0 Or $i_flag > 2 Then Return SetError(3, 3, 0)

; Validate and create path + mask params
Local $a_split = StringSplit($s_mask, ";"), $s_hold_split = ""
For $i = 1 To $a_split[0]
If StringStripWS($a_split[$i], 8) = "" Then ContinueLoop
If StringRegExp($a_split[$i], "^..*?..*?z") Then
$a_split[$i] &= "*" & $a_split[$i]
EndIf
$s_hold_split &= '"' & $s_path & $a_split[$i] & '" '
Next
$s_hold_split = StringTrimRight($s_hold_split, 1)
If $s_hold_split = "" Then $s_hold_split = '"' & $s_path & '*.*"'

Local $i_pid, $s_stdout, $s_hold_out, $s_dir_file_only = "", $s_recurse = "/s "
If $i_flag = 1 Then $s_dir_file_only = ":-d"
If $i_flag = 2 Then $s_dir_file_only = ":D"
If Not $f_recurse Then $s_recurse = ""

$i_pid = Run(@ComSpec & " /c dir /b " & $s_recurse & "/a" & $s_dir_file_only & " " & $s_hold_split, "", @SW_HIDE, 4 + 2)

While 1
$s_stdout = StdoutRead($i_pid)
If @error Then ExitLoop
$s_hold_out &= $s_stdout
WEnd

$s_hold_out = StringRegExpReplace($s_hold_out, "v+z", "")
If Not $s_hold_out Then Return SetError(4, 4, 0)

; Parse data and find matches based on flags
Local $a_fsplit = StringSplit(StringStripCR($s_hold_out), @LF), $s_hold_ret
$s_hold_out = ""

If $s_exclude Then $s_exclude = StringReplace(StringReplace($s_exclude, "*", ".*?"), ";", "|")

For $i = 1 To $a_fsplit[0]
If $s_exclude And StringRegExp(StringRegExpReplace( _
$a_fsplit[$i], "(.*?[/]+)*(.*?z)", "2"), "(?i)Q" & $s_exclude & "E") Then ContinueLoop
If StringRegExp($a_fsplit[$i], "^w:[/]+") = 0 Then $a_fsplit[$i] = $s_path & $a_fsplit[$i]
If $f_full_path Then
$s_hold_ret &= $a_fsplit[$i] & Chr(1)
Else
$s_hold_ret &= StringRegExpReplace($a_fsplit[$i], "((?:.*?[/]+)*)(.*?z)", "$2") & Chr(1)
EndIf
Next

$s_hold_ret = StringTrimRight($s_hold_ret, 1)
If $s_hold_ret = "" Then Return SetError(5, 5, 0)

Return StringSplit($s_hold_ret, Chr(1))
EndFunc

Func _ReadXML($Path,$Element)
; by 1234hotmaster
; http://www.***.com/Thread-AutoIt-Read-XML-Elements-from-file
Local $aRet = StringRegExp(FileRead($Path), '<' & $Element & '>([^:]*?)', 3)
If IsArray($aRet) Then
Return $aRet
Else
Return SetError(-1)
EndIf
EndFunc

Func _Replace_TIF_By_JPEG($image_in, $image_out, $error_code)
Local $FIF
Local $hImage
Local $hImage2
$FIF = _FreeImage_GetFileTypeU($image_in)
if @error then
msgbox(0,'Error','#10 ' & $error_code)
EndIf
If $FIF = $FIF_UNKNOWN Then
$FIF = _FreeImage_GetFIFFromFilenameU($image_in)
if @error then
msgbox(0,'Error','#11 ' & $error_code)
EndIf
EndIf
$hImage = _FreeImage_Load($FIF, $image_in, 0)
if @error then
msgbox(0,'Error','#12 ' & $error_code)
EndIf
$hImage2=_FreeImage_ConvertToStandardType($hImage,TRUE)
if @error then
msgbox(0,'Error','#13 ' & $error_code)
EndIf
_FreeImage_Save($FIF_JPEG, $hImage2, $image_out, 0)
if @error then
msgbox(0,'Error','#14 ' & $error_code)
EndIf
_FreeImage_Unload($hImage)
if @error then
msgbox(0,'Error','#15 ' & $error_code)
EndIf
_FreeImage_Unload($hImage2)
if @error then
msgbox(0,'Error','#16 ' & $error_code)
EndIf
If (FileGetSize($image_out) > 0) Then
FileDelete($image_in)
EndIf
EndFunc

Func _Sort_XML_and_images($path, $mask, $BoxL_yn)
; Make list of XML files and work through them
$list = _FileListToArrayEx($path, $mask)
if (NOT @error) Then
For $i1 = 1 to $list[0]
$AppName=_ReadXML($list[$i1],"AppName")
$BoxID=_ReadXML($list[$i1],"BoxID")
$PieceID=_ReadXML($list[$i1],"PieceID")
$SiteXY=_ReadXML($list[$i1],"SiteXY")
$ElementXY=_ReadXML($list[$i1],"ElementXY")
$Location=_ReadXML($list[$i1],"Location")
$Temp=StringRight($list[$i1],21)
$CDate= "20" & StringMid($Temp,5,2) & "/" & StringMid($Temp,1,2) & "/" & StringMid($Temp,3,2) & " " & StringMid($Temp,8,2) & ":" & StringMid($Temp,10,2) & ":" & StringMid($Temp,12,2)
_Replace_TIF_By_JPEG(StringReplace($list[$i1],".xml",".tif"),StringReplace($list[$i1],".xml",".jpg"), "XML")
FileMove(StringReplace($list[$i1],".xml",".*"),$target_path & $AppName[0] & "" & $BoxID[0] & "" & $PieceID[0] & "",9)

; Create sites.csv file if it doesn't exist and add filename and corresponding location information to it
if (NOT FileExists ($target_path & $AppName[0] & "" & $BoxID[0] & "" & $PieceID[0] & "sites.csv")) Then
FileWriteLine ($target_path & $AppName[0] & "" & $BoxID[0] & "" & $PieceID[0] & "sites.csv","File,DieI,DieJ,ElementI,ElementJ,LocationI,LocationJ" & @CRLF)
EndIf
FileWriteLine($target_path & $AppName[0] & "" & $BoxID[0] & "" & $PieceID[0] & "sites.csv", StringReplace(StringReplace($list[$i1],$temp_path,""),".xml","") & "," & $SiteXY[0] & "," & $ElementXY[0] & "," & $Location[0] & @CRLF)
Next
EndIf
EndFunc

; main part

If (MsgBox (33, $appname , $disclaimer, 30))= 2 then
Exit
EndIf

Do

; initialize FreeImage
_FreeImage_LoadDLL(@ScriptDir&"FreeImage.dll")
if @error Then
msgbox(0,'Error','#0')
EndIf
_FreeImage_Initialise()
if @error Then
msgbox(0,'Error','#1')
EndIf

; Set tooltip and tray popup message
TraySetToolTip("IMAGE ARCHIVER - Archiving image files.")

; Move all files to temp folder to work without new files being added
FileMove($source_path & "*.*",$temp_path,9)

; Sort all XML and respective image files
_Sort_XML_and_images($temp_path, "BIG_*.xml", 1)
_Sort_XML_and_images($temp_path, "MEDIUM_*.xml", 1)
_Sort_XML_and_images($temp_path, "SMALL_*.xml", 1)

; Replace all BoxLabel TIF files by JPG files and move them to archive
$BoxL_list = _FileListToArrayEx($temp_path, 'BoxLabel*.tif')
if (NOT @error) Then
For $i2 = 1 to $BoxL_list[0]
_Replace_TIF_By_JPEG($BoxL_list[$i2],StringReplace($BoxL_list[$i2],".tif",".jpg"), "BoxL")
FileMove(StringReplace($BoxL_list[$i2],".tif",".jpg"),$target_path & "BoxLabels",9)
Next
EndIf


; Replace all remaining TIF files by JPG files
$TIF_list = _FileListToArrayEx($temp_path, '*.tif')
if (NOT @error) Then
For $i0 = 1 to $TIF_list[0]
_Replace_TIF_By_JPEG($TIF_list[$i0],StringReplace($TIF_list[$i0],".tif",".jpg"), "Rest")
Next
EndIf

; deinitialize FreeImage
_FreeImage_DeInitialise()

; Moving all unsorted files older than an hour into $target_pathUnsorted
$current_date = @YEAR & '/' & @MON & '/' & @MDAY & ' ' & @HOUR & ':' & @MIN & ':' & @SEC
$Rest_list = _FileListToArrayEx($temp_path, '*.*')
if (NOT @error) Then
For $i3 = 1 to $Rest_list[0]
$temp_date = FileGetTime($Rest_list[$i3],1,0)
$rest_date = $temp_date[0] & '/' & $temp_date[1] & '/' & $temp_date[2] & ' ' & $temp_date[3] & ':' & $temp_date[4] & ':' & $temp_date[5]
$TimeDiff=_DateDiff('s', $rest_date, $current_date)
If ($TimeDiff >= 3600) Then
FileMove($Rest_list[$i3],$target_path & "Unsorted" ,9)
EndIf
Next
EndIf

; Move left over files from temp back to source folder
FileMove($temp_path & "*.*",$source_path,9)
DirRemove($temp_path,1)

$i4 = $zzz
Do
TraySetToolTip("IMAGE ARCHIVER - Hibernating for " & $i4 & "s.")
Sleep(10000)
$i4 = $i4-10
Until $i4 = 0
Until $count = $loops

[paths]
source_path=c:temp
target_path=c:temparchive
[intervals]
sleep_time=600
grace_period=180

<?xml version="1.0" encoding="UTF-16"?><DATABASE><EXE NAME="gaia.exe" FILTER="GRABMI_FILTER_PRIVACY"><MATCHING_FILE NAME="FreeImage.dll" SIZE="2805760" CHECKSUM="0xAEACC956" BIN_FILE_VERSION="3.15.0.0" BIN_PRODUCT_VERSION="3.15.0.0" PRODUCT_VERSION="3, 15, 0, 0" FILE_DESCRIPTION="FreeImage library" COMPANY_NAME="FreeImage" PRODUCT_NAME="FreeImage" FILE_VERSION="3, 15, 0, 0" ORIGINAL_FILENAME="FreeImage.dll" INTERNAL_NAME="FreeImage" LEGAL_COPYRIGHT="Copyright © 2003-2010 by FreeImage" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x2B04A3" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="3.15.0.0" UPTO_BIN_PRODUCT_VERSION="3.15.0.0" LINK_DATE="01/23/2011 19:09:12" UPTO_LINK_DATE="01/23/2011 19:09:12" VER_LANGUAGE="English (United States) [0x409]" /><MATCHING_FILE NAME="gaia.exe" SIZE="410931" CHECKSUM="0x5AA1CC" BIN_FILE_VERSION="3.3.8.1" BIN_PRODUCT_VERSION="3.3.8.1" FILE_DESCRIPTION="" FILE_VERSION="3, 3, 8, 1" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x0" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="3.3.8.1" UPTO_BIN_PRODUCT_VERSION="3.3.8.1" LINK_DATE="01/29/2012 21:32:28" UPTO_LINK_DATE="01/29/2012 21:32:28" VER_LANGUAGE="English (United Kingdom) [0x809]" /></EXE><EXE NAME="ntdll.dll" FILTER="GRABMI_FILTER_THISFILEONLY"><MATCHING_FILE NAME="ntdll.dll" SIZE="714752" CHECKSUM="0xC695BA95" BIN_FILE_VERSION="5.1.2600.5755" BIN_PRODUCT_VERSION="5.1.2600.5755" PRODUCT_VERSION="5.1.2600.5755" FILE_DESCRIPTION="NT Layer DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)" ORIGINAL_FILENAME="ntdll.dll" INTERNAL_NAME="ntdll.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xBC674" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5755" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5755" LINK_DATE="02/09/2009 12:10:48" UPTO_LINK_DATE="02/09/2009 12:10:48" VER_LANGUAGE="English (United States) [0x409]" /></EXE><EXE NAME="kernel32.dll" FILTER="GRABMI_FILTER_THISFILEONLY"><MATCHING_FILE NAME="kernel32.dll" SIZE="989696" CHECKSUM="0x2D998938" BIN_FILE_VERSION="5.1.2600.5781" BIN_PRODUCT_VERSION="5.1.2600.5781" PRODUCT_VERSION="5.1.2600.5781" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5781 (xpsp_sp3_gdr.090321-1317)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFE572" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5781" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5781" LINK_DATE="03/21/2009 14:06:58" UPTO_LINK_DATE="03/21/2009 14:06:58" VER_LANGUAGE="English (United States) [0x409]" /></EXE></DATABASE>

Alright, that's all I have I think. As I said, any help is greatly appreciated and I'll try to answer questions ASAP.

Thanks in advance,

AutoIT (self-proclaimed)

Edited by autoidiot
Tripredacus Universalist

Tripredacus

Posted
Posted

Well you could attach a ProcMon to your app and/or the DLL to compare a working trace to a crash trace. For this case, I would turn on the advanced info.

I wouldn't be surprised if your app encounters a locked or otherwise permissioned file during its trip.

For advanced work, you could attach the Windows Debugger to the gaia.exe to see what was being done at that offset the error mentioned.

Twitter | MSFN | VGCollect
jBU1ixT.jpg

  • 3 weeks later...
autoidiot Seeker

autoidiot

Posted
  • Author
Posted (edited)

Thanks for the ideas, Tripredacus. I read up on both Windows Debugger and ProcMon and it seems both of those need for the computer on which the troubleshooting is done to be online, so it can load the symbol table(s). The computer the error is occurring on does not have internet access. Let's see if I can work around that.

I did however get a drwtsn32 readout off the latest crash, maybe that helps someone help me. :)

Application exception occurred:
        App: E:GAIAgaia.exe (pid=11076)
        When: 8/5/2012 @ 19:25:04.458
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: XXX
        User Name: XXX
        Terminal Session Id: 0
        Number of Processors: 2
        Processor Type: x86 Family 6 Model 23 Stepping 10
        Windows Version: 5.1
        Current Build: 2600
        Service Pack: 3
        Current Type: Multiprocessor Free
        Registered Organization: XXX
        Registered Owner: XXX
*----> Task List <----*
REDACTED

*----> Module List <----*
(0000000000400000 - 00000000004c6000: E:GAIAgaia.exe
(0000000001050000 - 000000000105b000: C:Program FilesCommon FilesLogitechScrollingLgMsgHk.dll
(00000000013e0000 - 0000000001693000: E:GAIAFreeImage.dll
(0000000010000000 - 0000000010007000: C:Program FilesLogitechMouseWareSystemLgWndHk.dll
(000000005ad70000 - 000000005ada8000: C:\Windows\System32\uxtheme.dll
(0000000071aa0000 - 0000000071aa8000: C:\Windows\System32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac7000: C:\Windows\System32\WS2_32.dll
(0000000071ad0000 - 0000000071ad9000: C:\Windows\System32\WSOCK32.dll
(0000000071b20000 - 0000000071b32000: C:\Windows\System32\MPR.dll
(0000000076080000 - 00000000760e5000: C:\Windows\System32\MSVCP60.dll
(00000000763b0000 - 00000000763f9000: C:\Windows\System32\COMDLG32.dll
(00000000769c0000 - 0000000076a74000: C:\Windows\System32\USERENV.dll
(0000000076b40000 - 0000000076b6d000: C:\Windows\System32\WINMM.dll
(0000000076bf0000 - 0000000076bfb000: C:\Windows\System32\PSAPI.DLL
(0000000077120000 - 00000000771ab000: C:\Windows\System32\OLEAUT32.dll
(00000000771b0000 - 000000007725a000: C:\Windows\System32\WININET.dll
(00000000773d0000 - 00000000774d3000: C:WINDOWSWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83COMCTL32.dll
(00000000774e0000 - 000000007761d000: C:\Windows\System32\ole32.dll
(0000000077920000 - 0000000077a13000: C:\Windows\System32\SETUPAPI.dll
(0000000077a80000 - 0000000077b15000: C:\Windows\System32\CRYPT32.dll
(0000000077b20000 - 0000000077b32000: C:\Windows\System32\MSASN1.dll
(0000000077b40000 - 0000000077b62000: C:\Windows\System32\Apphelp.dll
(0000000077c00000 - 0000000077c08000: C:\Windows\System32\VERSION.dll
(0000000077c10000 - 0000000077c68000: C:\Windows\System32\msvcrt.dll
(0000000077dd0000 - 0000000077e6b000: C:\Windows\System32\ADVAPI32.dll
(0000000077e70000 - 0000000077f02000: C:\Windows\System32\RPCRT4.dll
(0000000077f10000 - 0000000077f59000: C:\Windows\System32\GDI32.dll
(0000000077f60000 - 0000000077fd6000: C:\Windows\System32\SHLWAPI.dll
(0000000077fe0000 - 0000000077ff1000: C:\Windows\System32\Secur32.dll
(000000007c800000 - 000000007c8f6000: C:\Windows\System32\kernel32.dll
(000000007c900000 - 000000007c9b2000: C:\Windows\System32\ntdll.dll
(000000007c9c0000 - 000000007d1d7000: C:\Windows\System32\SHELL32.dll
(000000007e410000 - 000000007e4a1000: C:\Windows\System32\USER32.dll

*----> State Dump for Thread Id 0x2898 <----*
eax=00000000 ebx=00000000 ecx=ffff7803 edx=008ce8b8 esi=01ebe008 edi=01ecf000
eip=7c9012b0 esp=008ce860 ebp=008ce8d0 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\ntdll.dll -
function: ntdll!RtlInitUnicodeString
        ntdll!RtlInitUnicodeString:
        7c901295 57               push    edi
        7c901296 8b7c240c         mov     edi,[esp+0xc]
        7c90129a 8b542408         mov     edx,[esp+0x8]
        7c90129e c70200000000     mov     dword ptr [edx],0x0
        7c9012a4 897a04           mov     [edx+0x4],edi
        7c9012a7 0bff             or      edi,edi
        7c9012a9 7422             jz      ntdll!RtlInitUnicodeString+0x38 (7c9012cd)
        7c9012ab 83c9ff           or      ecx,0xffffffff
        7c9012ae 33c0             xor     eax,eax
FAULT ->7c9012b0 66f2af           repne   scasw                      es:01ecf000=????
        7c9012b3 f7d1             not     ecx
        7c9012b5 d1e1             shl     ecx,1
        7c9012b7 81f9feff0000     cmp     ecx,0xfffe
        7c9012bd 7605             jbe     ntdll!RtlInitUnicodeString+0x2f (7c9012c4)
        7c9012bf b9feff0000       mov     ecx,0xfffe
        7c9012c4 66894a02         mov     [edx+0x2],cx
        7c9012c8 49               dec     ecx
        7c9012c9 49               dec     ecx
        7c9012ca 66890a           mov     [edx],cx
        7c9012cd 5f               pop     edi

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for E:GAIAFreeImage.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
*** WARNING: Unable to verify checksum for E:GAIAgaia.exe
*** ERROR: Module load completed but symbols could not be loaded for E:GAIAgaia.exe
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\kernel32.dll -
ChildEBP RetAddr  Args to Child             
008ce8d0 015534b1 01ebe008 80000000 00000003 ntdll!RtlInitUnicodeString+0x1b
008ce934 01553a17 008ce968 01ebe008 00008000 FreeImage+0x1734b1
008ce984 01553a87 01ebe008 00008000 00000040 FreeImage+0x173a17
008ce9a4 01545277 008ce9e8 01ebe008 00008000 FreeImage+0x173a87
008ce9dc 01538262 01ebe008 00000003 00000040 FreeImage+0x165277
008cea20 01538299 0167dad0 0155e980 00000040 FreeImage+0x158262
008cea34 013e605c 01ebe008 0155e980 008cea4c FreeImage+0x158299
008cea9c 004753b4 008ceb08 004a8178 008cf0a8 FreeImage!FreeImage_GetFileTypeU+0x1c
008cee38 004755c0 004a8178 008cee88 008cf0a8 gaia+0x753b4
008cee50 00403d76 008cee88 008cf0a8 004a85f4 gaia+0x755c0
008cee6c 00408d3d 0000003a 008cee88 008cf0a8 gaia+0x3d76
008ceea4 0040add1 008cf0a8 008cf114 00000003 gaia+0x8d3d
008cef40 00480fa5 010f15ec 008cf114 008cf0a8 gaia+0xadd1
008cf0c8 0042d14f 004a8178 010f15ec 008cf114 gaia+0x80fa5
008cf11c 00409379 004a8178 010f15ec 008cf294 gaia+0x2d14f
008cf28c 0040a0a7 0000115b 004a95f0 004a8178 gaia+0x9379
008cf378 0042b177 004a8178 010f507c 008cf448 gaia+0xa0a7
008cf420 004090b3 010f507c 008cf46c 008cf448 gaia+0x2b177
008cf474 00409470 004a8178 004a82e4 004a8178 gaia+0x90b3
008cf5dc 0040a0a7 00001504 004a8178 010f536c gaia+0x9470
008cf6c8 004093dc 004a8178 010f536c 008cf728 gaia+0xa0a7
008cf83c 0040a0a7 00001533 004a8178 010f555c gaia+0x93dc
008cf928 004093dc 004a8178 010f555c 008cf988 gaia+0xa0a7
008cfa9c 0040d675 00001552 00000001 008cff04 gaia+0x93dc
008cfef0 0040d767 03780bc0 00000000 7ffda000 gaia+0xd675
008cff30 0041656e 00400000 00000000 00020994 gaia+0xd767
008cffc0 7c817077 03780bc0 0160f0dc 7ffda000 gaia+0x1656e
008cfff0 00000000 004bae70 00000000 000000c8 kernel32!RegisterWaitForInputIdle+0x49

*----> Raw Stack Dump <----*
00000000008ce860  00 08 81 7c 37 08 81 7c - b8 e8 8c 00 08 e0 eb 01  ...|7..|........
00000000008ce870  00 08 81 7c e8 e9 8c 00 - d1 f8 53 01 67 ca bf 2c  ...|......S.g..,
00000000008ce880  00 00 00 00 e8 e9 8c 00 - 00 00 00 00 01 00 00 00  ................
00000000008ce890  7c e8 8c 00 00 00 00 00 - a0 0f 00 00 16 f8 53 01  |.............S.
00000000008ce8a0  40 55 07 01 ec e8 8c 00 - b4 24 55 01 0b 00 00 00  @U.......$U.....
00000000008ce8b0  ac 24 55 01 23 ca bf 2c - 00 00 00 00 08 e0 eb 01  .$U.#..,........
00000000008ce8c0  00 00 00 00 00 00 00 00 - 01 00 00 00 78 28 07 01  ............x(..
00000000008ce8d0  34 e9 8c 00 b1 34 55 01 - 08 e0 eb 01 00 00 00 80  4....4U.........
00000000008ce8e0  03 00 00 00 00 e9 8c 00 - 03 00 00 00 80 00 00 00  ................
00000000008ce8f0  00 00 00 00 e8 e9 8c 00 - 00 00 00 00 00 80 00 00  ................
00000000008ce900  0c 00 00 00 00 00 00 00 - 01 00 00 00 00 00 00 00  ................
00000000008ce910  01 00 00 00 00 00 00 00 - 00 00 00 00 01 00 00 00  ................
00000000008ce920  03 00 00 00 03 00 00 00 - 80 00 00 00 00 00 00 80  ................
00000000008ce930  50 e9 00 00 84 e9 8c 00 - 17 3a 55 01 68 e9 8c 00  P........:U.h...
00000000008ce940  08 e0 eb 01 00 80 00 00 - 40 00 00 00 80 01 00 00  ........@.......
00000000008ce950  4b cb bf 2c 00 00 00 00 - 84 e9 55 01 00 80 00 00  K..,......U.....
00000000008ce960  b8 00 91 7c c0 b4 39 01 - 01 00 00 00 50 e9 8c 00  ...|..9.....P...
00000000008ce970  74 e4 8c 00 10 ea 8c 00 - 30 04 54 01 c7 da 51 2d  t.......0.T...Q-
00000000008ce980  00 00 00 00 a4 e9 8c 00 - 87 3a 55 01 08 e0 eb 01  .........:U.....
00000000008ce990  00 80 00 00 40 00 00 00 - 80 01 00 00 e8 e9 8c 00  ....@...........

*----> Symbol Table <----*
C:\Windows\System32\ntdll.dll
7c901000  ntdll!RtlEnterCriticalSection
7c9010e0  ntdll!RtlLeaveCriticalSection
7c901118  ntdll!RtlTryEnterCriticalSection
7c901166  ntdll!LdrInitializeThunk
7c901198  ntdll!RtlActivateActivationContextUnsafeFast
7c9011dd  ntdll!RtlDeactivateActivationContextUnsafeFast
7c90120e  ntdll!DbgBreakPoint
7c901212  ntdll!DbgUserBreakPoint
7c90121e  ntdll!NtCurrentTeb
7c901225  ntdll!RtlInitString
7c90125d  ntdll!RtlInitAnsiString
7c901295  ntdll!RtlInitUnicodeString
7c9012d1  ntdll!CIsin
7c9012e5  ntdll!sin
7c90137f  ntdll!CIsqrt
7c901393  ntdll!sqrt
7c90143b  ntdll!alldiv
7c9014e5  ntdll!alldvrm
7c9015c4  ntdll!allmul
7c9015f8  ntdll!chkstk
7c9015f8  ntdll!alloca_probe
7c901635  ntdll!allrem
7c9016e9  ntdll!allshl
7c901708  ntdll!allshr
7c901729  ntdll!aulldiv
7c901791  ntdll!aulldvrm
7c901826  ntdll!aullrem
7c90189b  ntdll!aullshr
7c9018ba  ntdll!ftol
7c9018e1  ntdll!memccpy
7c901934  ntdll!atan
7c9019d7  ntdll!ceil
7c901b18  ntdll!floor
7c901c60  ntdll!memchr
7c901d07  ntdll!memcmp
7c901db3  ntdll!memcpy
7c9020f5  ntdll!memmove
7c902435  ntdll!memset
7c90248d  ntdll!strcpy
7c90249d  ntdll!strcat
7c902583  ntdll!strcmp
7c902608  ntdll!strcspn
7c902645  ntdll!strlen
7c9026c0  ntdll!strncat
7c9027e5  ntdll!strncmp
7c90281d  ntdll!strncpy
7c90291d  ntdll!strpbrk
7c902956  ntdll!strrchr
7c90297d  ntdll!strspn
7c9029ce  ntdll!tan
7c902ad0  ntdll!RtlInterlockedPushListSList
7c902af8  ntdll!RtlFirstEntrySList
7c902b20  ntdll!RtlUshortByteSwap
7c902b30  ntdll!RtlUlongByteSwap
7c902b40  ntdll!RtlUlonglongByteSwap
7c902b53  ntdll!RtlCompareMemory
7c902ba3  ntdll!RtlCompareMemoryUlong
7c902bd3  ntdll!RtlFillMemory
7c902c43  ntdll!RtlFillMemoryUlong
7c902c64  ntdll!RtlZeroMemory
7c902c94  ntdll!RtlMoveMemory
7c903002  ntdll!RtlLargeIntegerAdd
7c903016  ntdll!RtlEnlargedIntegerMultiply
7c903022  ntdll!RtlEnlargedUnsignedMultiply
7c90302e  ntdll!RtlEnlargedUnsignedDivide
7c90304e  ntdll!RtlExtendedLargeIntegerDivide
7c9030aa  ntdll!RtlExtendedMagicDivide
7c90313a  ntdll!RtlExtendedIntegerMultiply
7c903192  ntdll!RtlLargeIntegerShiftLeft
7c9031ba  ntdll!RtlLargeIntegerShiftRight
7c9031e2  ntdll!RtlLargeIntegerArithmeticShift
7c90320e  ntdll!RtlLargeIntegerNegate
7c903222  ntdll!RtlLargeIntegerSubtract
7c903236  ntdll!RtlConvertLongToLargeInteger
7c90323e  ntdll!RtlConvertUlongToLargeInteger
7c90331a  ntdll!RtlCaptureContext
7c90ce5e  ntdll!ZwAcceptConnectPort
7c90ce5e  ntdll!NtAcceptConnectPort
7c90ce6e  ntdll!ZwAccessCheck
7c90ce6e  ntdll!NtAccessCheck
7c90ce7e  ntdll!ZwAccessCheckAndAuditAlarm
7c90ce7e  ntdll!NtAccessCheckAndAuditAlarm
7c90ce8e  ntdll!ZwAccessCheckByType
7c90ce8e  ntdll!NtAccessCheckByType
7c90ce9e  ntdll!NtAccessCheckByTypeAndAuditAlarm
7c90ce9e  ntdll!ZwAccessCheckByTypeAndAuditAlarm
7c90ceae  ntdll!NtAccessCheckByTypeResultList
7c90ceae  ntdll!ZwAccessCheckByTypeResultList
7c90cebe  ntdll!NtAccessCheckByTypeResultListAndAuditAlarm
7c90cebe  ntdll!ZwAccessCheckByTypeResultListAndAuditAlarm
7c90cece  ntdll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
7c90cece  ntdll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
7c90cede  ntdll!ZwAddAtom
7c90cede  ntdll!NtAddAtom
7c90ceee  ntdll!NtAddBootEntry
7c90ceee  ntdll!ZwAddBootEntry
7c90cefe  ntdll!NtAdjustGroupsToken
7c90cefe  ntdll!ZwAdjustGroupsToken
7c90cf0e  ntdll!ZwAdjustPrivilegesToken
7c90cf0e  ntdll!NtAdjustPrivilegesToken
7c90cf1e  ntdll!NtAlertResumeThread
7c90cf1e  ntdll!ZwAlertResumeThread
7c90cf2e  ntdll!ZwAlertThread
7c90cf2e  ntdll!NtAlertThread
7c90cf3e  ntdll!ZwAllocateLocallyUniqueId
7c90cf3e  ntdll!NtAllocateLocallyUniqueId
7c90cf4e  ntdll!ZwAllocateUserPhysicalPages
7c90cf4e  ntdll!NtAllocateUserPhysicalPages
7c90cf5e  ntdll!NtAllocateUuids
7c90cf5e  ntdll!ZwAllocateUuids
7c90cf6e  ntdll!ZwAllocateVirtualMemory
7c90cf6e  ntdll!NtAllocateVirtualMemory
7c90cf7e  ntdll!ZwAreMappedFilesTheSame
7c90cf7e  ntdll!NtAreMappedFilesTheSame
7c90cf8e  ntdll!ZwAssignProcessToJobObject
7c90cf8e  ntdll!NtAssignProcessToJobObject
7c90cf9e  ntdll!NtCallbackReturn
7c90cf9e  ntdll!ZwCallbackReturn
7c90cfae  ntdll!NtCancelDeviceWakeupRequest
7c90cfae  ntdll!ZwCancelDeviceWakeupRequest
7c90cfbe  ntdll!NtCancelIoFile
7c90cfbe  ntdll!ZwCancelIoFile
7c90cfce  ntdll!NtCancelTimer
7c90cfce  ntdll!ZwCancelTimer
7c90cfde  ntdll!NtClearEvent
7c90cfde  ntdll!ZwClearEvent
7c90cfee  ntdll!ZwClose
7c90cfee  ntdll!NtClose
7c90cffe  ntdll!NtCloseObjectAuditAlarm
7c90cffe  ntdll!ZwCloseObjectAuditAlarm
7c90d00e  ntdll!ZwCompactKeys
7c90d00e  ntdll!NtCompactKeys
7c90d01e  ntdll!NtCompareTokens
7c90d01e  ntdll!ZwCompareTokens
7c90d02e  ntdll!ZwCompleteConnectPort
7c90d02e  ntdll!NtCompleteConnectPort
7c90d03e  ntdll!ZwCompressKey
7c90d03e  ntdll!NtCompressKey
7c90d04e  ntdll!NtConnectPort
7c90d04e  ntdll!ZwConnectPort
7c90d05e  ntdll!ZwContinue
7c90d05e  ntdll!NtContinue
7c90d06e  ntdll!NtCreateDebugObject
7c90d06e  ntdll!ZwCreateDebugObject
7c90d07e  ntdll!ZwCreateDirectoryObject
7c90d07e  ntdll!NtCreateDirectoryObject
7c90d08e  ntdll!ZwCreateEvent
7c90d08e  ntdll!NtCreateEvent
7c90d09e  ntdll!NtCreateEventPair
7c90d09e  ntdll!ZwCreateEventPair
7c90d0ae  ntdll!ZwCreateFile
7c90d0ae  ntdll!NtCreateFile
7c90d0be  ntdll!ZwCreateIoCompletion
7c90d0be  ntdll!NtCreateIoCompletion
7c90d0ce  ntdll!ZwCreateJobObject
7c90d0ce  ntdll!NtCreateJobObject
7c90d0de  ntdll!ZwCreateJobSet
7c90d0de  ntdll!NtCreateJobSet
7c90d0ee  ntdll!ZwCreateKey
7c90d0ee  ntdll!NtCreateKey
7c90d0fe  ntdll!ZwCreateMailslotFile
7c90d0fe  ntdll!NtCreateMailslotFile
7c90d10e  ntdll!ZwCreateMutant
7c90d10e  ntdll!NtCreateMutant
7c90d11e  ntdll!NtCreateNamedPipeFile
7c90d11e  ntdll!ZwCreateNamedPipeFile
7c90d12e  ntdll!NtCreatePagingFile
7c90d12e  ntdll!ZwCreatePagingFile
7c90d13e  ntdll!ZwCreatePort
7c90d13e  ntdll!NtCreatePort
7c90d14e  ntdll!ZwCreateProcess
7c90d14e  ntdll!NtCreateProcess
7c90d15e  ntdll!NtCreateProcessEx
7c90d15e  ntdll!ZwCreateProcessEx
7c90d16e  ntdll!NtCreateProfile
7c90d16e  ntdll!ZwCreateProfile
7c90d17e  ntdll!NtCreateSection
7c90d17e  ntdll!ZwCreateSection
7c90d18e  ntdll!NtCreateSemaphore
7c90d18e  ntdll!ZwCreateSemaphore
7c90d19e  ntdll!ZwCreateSymbolicLinkObject
7c90d19e  ntdll!NtCreateSymbolicLinkObject
7c90d1ae  ntdll!ZwCreateThread
7c90d1ae  ntdll!NtCreateThread
7c90d1be  ntdll!NtCreateTimer
7c90d1be  ntdll!ZwCreateTimer
7c90d1ce  ntdll!NtCreateToken
7c90d1ce  ntdll!ZwCreateToken
7c90d1de  ntdll!ZwCreateWaitablePort
7c90d1de  ntdll!NtCreateWaitablePort
7c90d1ee  ntdll!ZwDebugActiveProcess
7c90d1ee  ntdll!NtDebugActiveProcess
7c90d1fe  ntdll!NtDebugContinue
7c90d1fe  ntdll!ZwDebugContinue
7c90d20e  ntdll!NtDelayExecution
7c90d20e  ntdll!ZwDelayExecution
7c90d21e  ntdll!NtDeleteAtom
7c90d21e  ntdll!ZwDeleteAtom
7c90d22e  ntdll!ZwDeleteBootEntry
7c90d22e  ntdll!NtDeleteBootEntry
7c90d23e  ntdll!ZwDeleteFile
7c90d23e  ntdll!NtDeleteFile
7c90d24e  ntdll!ZwDeleteKey
7c90d24e  ntdll!NtDeleteKey
7c90d25e  ntdll!ZwDeleteObjectAuditAlarm
7c90d25e  ntdll!NtDeleteObjectAuditAlarm
7c90d26e  ntdll!NtDeleteValueKey
7c90d26e  ntdll!ZwDeleteValueKey
7c90d27e  ntdll!ZwDeviceIoControlFile
7c90d27e  ntdll!NtDeviceIoControlFile
7c90d28e  ntdll!NtDisplayString
7c90d28e  ntdll!ZwDisplayString
7c90d29e  ntdll!ZwDuplicateObject
7c90d29e  ntdll!NtDuplicateObject
7c90d2ae  ntdll!ZwDuplicateToken
7c90d2ae  ntdll!NtDuplicateToken
7c90d2be  ntdll!ZwEnumerateBootEntries
7c90d2be  ntdll!NtEnumerateBootEntries
7c90d2ce  ntdll!NtEnumerateKey
7c90d2ce  ntdll!ZwEnumerateKey
7c90d2de  ntdll!NtEnumerateSystemEnvironmentValuesEx
7c90d2de  ntdll!ZwEnumerateSystemEnvironmentValuesEx
7c90d2ee  ntdll!NtEnumerateValueKey
7c90d2ee  ntdll!ZwEnumerateValueKey
7c90d2fe  ntdll!ZwExtendSection
7c90d2fe  ntdll!NtExtendSection
7c90d30e  ntdll!ZwFilterToken
7c90d30e  ntdll!NtFilterToken
7c90d31e  ntdll!ZwFindAtom
7c90d31e  ntdll!NtFindAtom
7c90d32e  ntdll!ZwFlushBuffersFile
7c90d32e  ntdll!NtFlushBuffersFile
7c90d33e  ntdll!ZwFlushInstructionCache
7c90d33e  ntdll!NtFlushInstructionCache
7c90d34e  ntdll!ZwFlushKey
7c90d34e  ntdll!NtFlushKey
7c90d35e  ntdll!ZwFlushVirtualMemory
7c90d35e  ntdll!NtFlushVirtualMemory
7c90d36e  ntdll!NtFlushWriteBuffer
7c90d36e  ntdll!ZwFlushWriteBuffer
7c90d37e  ntdll!ZwFreeUserPhysicalPages
7c90d37e  ntdll!NtFreeUserPhysicalPages
7c90d38e  ntdll!NtFreeVirtualMemory
7c90d38e  ntdll!ZwFreeVirtualMemory
7c90d39e  ntdll!ZwFsControlFile
7c90d39e  ntdll!NtFsControlFile
7c90d3ae  ntdll!ZwGetContextThread
7c90d3ae  ntdll!NtGetContextThread
7c90d3be  ntdll!ZwGetDevicePowerState
7c90d3be  ntdll!NtGetDevicePowerState
7c90d3ce  ntdll!ZwGetPlugPlayEvent
7c90d3ce  ntdll!NtGetPlugPlayEvent
7c90d3de  ntdll!ZwGetWriteWatch
7c90d3de  ntdll!NtGetWriteWatch
7c90d3ee  ntdll!ZwImpersonateAnonymousToken
7c90d3ee  ntdll!NtImpersonateAnonymousToken
7c90d3fe  ntdll!ZwImpersonateClientOfPort
7c90d3fe  ntdll!NtImpersonateClientOfPort
7c90d40e  ntdll!NtImpersonateThread
7c90d40e  ntdll!ZwImpersonateThread
7c90d41e  ntdll!ZwInitializeRegistry
7c90d41e  ntdll!NtInitializeRegistry
7c90d42e  ntdll!NtInitiatePowerAction
7c90d42e  ntdll!ZwInitiatePowerAction
7c90d43e  ntdll!NtIsProcessInJob
7c90d43e  ntdll!ZwIsProcessInJob
7c90d44e  ntdll!ZwIsSystemResumeAutomatic
7c90d44e  ntdll!NtIsSystemResumeAutomatic
7c90d45e  ntdll!ZwListenPort
7c90d45e  ntdll!NtListenPort
7c90d46e  ntdll!ZwLoadDriver
7c90d46e  ntdll!NtLoadDriver
7c90d47e  ntdll!NtLoadKey
7c90d47e  ntdll!ZwLoadKey
7c90d48e  ntdll!ZwLoadKey2
7c90d48e  ntdll!NtLoadKey2
7c90d49e  ntdll!NtLockFile
7c90d49e  ntdll!ZwLockFile
7c90d4ae  ntdll!NtLockProductActivationKeys
7c90d4ae  ntdll!ZwLockProductActivationKeys
7c90d4be  ntdll!NtLockRegistryKey
7c90d4be  ntdll!ZwLockRegistryKey
7c90d4ce  ntdll!ZwLockVirtualMemory
7c90d4ce  ntdll!NtLockVirtualMemory
7c90d4de  ntdll!NtMakePermanentObject
7c90d4de  ntdll!ZwMakePermanentObject
7c90d4ee  ntdll!NtMakeTemporaryObject
7c90d4ee  ntdll!ZwMakeTemporaryObject
7c90d4fe  ntdll!NtMapUserPhysicalPages
7c90d4fe  ntdll!ZwMapUserPhysicalPages
7c90d50e  ntdll!ZwMapUserPhysicalPagesScatter
7c90d50e  ntdll!NtMapUserPhysicalPagesScatter
7c90d51e  ntdll!NtMapViewOfSection
7c90d51e  ntdll!ZwMapViewOfSection
7c90d52e  ntdll!NtModifyBootEntry
7c90d52e  ntdll!ZwModifyBootEntry
7c90d53e  ntdll!NtNotifyChangeDirectoryFile
7c90d53e  ntdll!ZwNotifyChangeDirectoryFile
7c90d54e  ntdll!NtNotifyChangeKey
7c90d54e  ntdll!ZwNotifyChangeKey
7c90d55e  ntdll!NtNotifyChangeMultipleKeys
7c90d55e  ntdll!ZwNotifyChangeMultipleKeys
7c90d56e  ntdll!ZwOpenDirectoryObject
7c90d56e  ntdll!NtOpenDirectoryObject
7c90d57e  ntdll!ZwOpenEvent
7c90d57e  ntdll!NtOpenEvent
7c90d58e  ntdll!ZwOpenEventPair
7c90d58e  ntdll!NtOpenEventPair
7c90d59e  ntdll!ZwOpenFile
7c90d59e  ntdll!NtOpenFile
7c90d5ae  ntdll!NtOpenIoCompletion
7c90d5ae  ntdll!ZwOpenIoCompletion
7c90d5be  ntdll!NtOpenJobObject
7c90d5be  ntdll!ZwOpenJobObject
7c90d5ce  ntdll!NtOpenKey
7c90d5ce  ntdll!ZwOpenKey
7c90d5de  ntdll!ZwOpenMutant
7c90d5de  ntdll!NtOpenMutant
7c90d5ee  ntdll!ZwOpenObjectAuditAlarm
7c90d5ee  ntdll!NtOpenObjectAuditAlarm
7c90d5fe  ntdll!NtOpenProcess
7c90d5fe  ntdll!ZwOpenProcess
7c90d60e  ntdll!ZwOpenProcessToken
7c90d60e  ntdll!NtOpenProcessToken
7c90d61e  ntdll!NtOpenProcessTokenEx
7c90d61e  ntdll!ZwOpenProcessTokenEx
7c90d62e  ntdll!ZwOpenSection
7c90d62e  ntdll!NtOpenSection
7c90d63e  ntdll!NtOpenSemaphore
7c90d63e  ntdll!ZwOpenSemaphore
7c90d64e  ntdll!NtOpenSymbolicLinkObject
7c90d64e  ntdll!ZwOpenSymbolicLinkObject
7c90d65e  ntdll!ZwOpenThread
7c90d65e  ntdll!NtOpenThread
7c90d66e  ntdll!NtOpenThreadToken
7c90d66e  ntdll!ZwOpenThreadToken
7c90d67e  ntdll!NtOpenThreadTokenEx
7c90d67e  ntdll!ZwOpenThreadTokenEx
7c90d68e  ntdll!NtOpenTimer
7c90d68e  ntdll!ZwOpenTimer
7c90d69e  ntdll!NtPlugPlayControl
7c90d69e  ntdll!ZwPlugPlayControl
7c90d6ae  ntdll!ZwPowerInformation
7c90d6ae  ntdll!NtPowerInformation
7c90d6be  ntdll!ZwPrivilegeCheck
7c90d6be  ntdll!NtPrivilegeCheck
7c90d6ce  ntdll!NtPrivilegeObjectAuditAlarm
7c90d6ce  ntdll!ZwPrivilegeObjectAuditAlarm
7c90d6de  ntdll!ZwPrivilegedServiceAuditAlarm
7c90d6de  ntdll!NtPrivilegedServiceAuditAlarm
7c90d6ee  ntdll!NtProtectVirtualMemory
7c90d6ee  ntdll!ZwProtectVirtualMemory
7c90d6fe  ntdll!ZwPulseEvent
7c90d6fe  ntdll!NtPulseEvent
7c90d70e  ntdll!NtQueryAttributesFile
7c90d70e  ntdll!ZwQueryAttributesFile
7c90d71e  ntdll!NtQueryBootEntryOrder
7c90d71e  ntdll!ZwQueryBootEntryOrder
7c90d72e  ntdll!NtQueryBootOptions
7c90d72e  ntdll!ZwQueryBootOptions
7c90d73e  ntdll!NtQueryDebugFilterState
7c90d73e  ntdll!ZwQueryDebugFilterState
7c90d74e  ntdll!NtQueryDefaultLocale
7c90d74e  ntdll!ZwQueryDefaultLocale
7c90d75e  ntdll!ZwQueryDefaultUILanguage
7c90d75e  ntdll!NtQueryDefaultUILanguage
7c90d76e  ntdll!NtQueryDirectoryFile
7c90d76e  ntdll!ZwQueryDirectoryFile
7c90d77e  ntdll!ZwQueryDirectoryObject
7c90d77e  ntdll!NtQueryDirectoryObject
7c90d78e  ntdll!NtQueryEaFile
7c90d78e  ntdll!ZwQueryEaFile
7c90d79e  ntdll!NtQueryEvent
7c90d79e  ntdll!ZwQueryEvent
7c90d7ae  ntdll!NtQueryFullAttributesFile
7c90d7ae  ntdll!ZwQueryFullAttributesFile
7c90d7be  ntdll!ZwQueryInformationAtom
7c90d7be  ntdll!NtQueryInformationAtom
7c90d7ce  ntdll!ZwQueryInformationFile
7c90d7ce  ntdll!NtQueryInformationFile
7c90d7de  ntdll!NtQueryInformationJobObject
7c90d7de  ntdll!ZwQueryInformationJobObject
7c90d7ee  ntdll!NtQueryInformationPort
7c90d7ee  ntdll!ZwQueryInformationPort
7c90d7fe  ntdll!ZwQueryInformationProcess
7c90d7fe  ntdll!NtQueryInformationProcess
7c90d80e  ntdll!NtQueryInformationThread
7c90d80e  ntdll!ZwQueryInformationThread
7c90d81e  ntdll!NtQueryInformationToken
7c90d81e  ntdll!ZwQueryInformationToken
7c90d82e  ntdll!ZwQueryInstallUILanguage
7c90d82e  ntdll!NtQueryInstallUILanguage
7c90d83e  ntdll!NtQueryIntervalProfile
7c90d83e  ntdll!ZwQueryIntervalProfile
7c90d84e  ntdll!NtQueryIoCompletion
7c90d84e  ntdll!ZwQueryIoCompletion
7c90d85e  ntdll!ZwQueryKey
7c90d85e  ntdll!NtQueryKey
7c90d86e  ntdll!ZwQueryMultipleValueKey
7c90d86e  ntdll!NtQueryMultipleValueKey
7c90d87e  ntdll!ZwQueryMutant
7c90d87e  ntdll!NtQueryMutant
7c90d88e  ntdll!NtQueryObject
7c90d88e  ntdll!ZwQueryObject
7c90d89e  ntdll!ZwQueryOpenSubKeys
7c90d89e  ntdll!NtQueryOpenSubKeys
7c90d8ae  ntdll!ZwQueryPerformanceCounter
7c90d8ae  ntdll!NtQueryPerformanceCounter
7c90d8be  ntdll!ZwQueryQuotaInformationFile
7c90d8be  ntdll!NtQueryQuotaInformationFile
7c90d8ce  ntdll!NtQuerySection
7c90d8ce  ntdll!ZwQuerySection
7c90d8de  ntdll!NtQuerySecurityObject
7c90d8de  ntdll!ZwQuerySecurityObject
7c90d8ee  ntdll!ZwQuerySemaphore
7c90d8ee  ntdll!NtQuerySemaphore
7c90d8fe  ntdll!ZwQuerySymbolicLinkObject
7c90d8fe  ntdll!NtQuerySymbolicLinkObject
7c90d90e  ntdll!ZwQuerySystemEnvironmentValue
7c90d90e  ntdll!NtQuerySystemEnvironmentValue
7c90d91e  ntdll!NtQuerySystemEnvironmentValueEx
7c90d91e  ntdll!ZwQuerySystemEnvironmentValueEx
7c90d92e  ntdll!NtQuerySystemInformation
7c90d92e  ntdll!ZwQuerySystemInformation
7c90d92e  ntdll!RtlGetNativeSystemInformation
7c90d93e  ntdll!ZwQuerySystemTime
7c90d93e  ntdll!NtQuerySystemTime
7c90d94e  ntdll!ZwQueryTimer
7c90d94e  ntdll!NtQueryTimer
7c90d95e  ntdll!ZwQueryTimerResolution
7c90d95e  ntdll!NtQueryTimerResolution
7c90d96e  ntdll!NtQueryValueKey
7c90d96e  ntdll!ZwQueryValueKey
7c90d97e  ntdll!ZwQueryVirtualMemory
7c90d97e  ntdll!NtQueryVirtualMemory
7c90d98e  ntdll!ZwQueryVolumeInformationFile
7c90d98e  ntdll!NtQueryVolumeInformationFile
7c90d99e  ntdll!ZwQueueApcThread
7c90d99e  ntdll!NtQueueApcThread
7c90d9ae  ntdll!ZwRaiseException
7c90d9ae  ntdll!NtRaiseException
7c90d9be  ntdll!NtRaiseHardError
7c90d9be  ntdll!ZwRaiseHardError
7c90d9ce  ntdll!ZwReadFile
7c90d9ce  ntdll!NtReadFile
7c90d9de  ntdll!ZwReadFileScatter
7c90d9de  ntdll!NtReadFileScatter
7c90d9ee  ntdll!NtReadRequestData
7c90d9ee  ntdll!ZwReadRequestData
7c90d9fe  ntdll!NtReadVirtualMemory
7c90d9fe  ntdll!ZwReadVirtualMemory
7c90da0e  ntdll!NtRegisterThreadTerminatePort
7c90da0e  ntdll!ZwRegisterThreadTerminatePort
7c90da1e  ntdll!NtReleaseMutant
7c90da1e  ntdll!ZwReleaseMutant
7c90da2e  ntdll!NtReleaseSemaphore
7c90da2e  ntdll!ZwReleaseSemaphore
7c90da3e  ntdll!ZwRemoveIoCompletion
7c90da3e  ntdll!NtRemoveIoCompletion
7c90da4e  ntdll!ZwRemoveProcessDebug
7c90da4e  ntdll!NtRemoveProcessDebug
7c90da5e  ntdll!NtRenameKey
7c90da5e  ntdll!ZwRenameKey
7c90da6e  ntdll!NtReplaceKey
7c90da6e  ntdll!ZwReplaceKey
7c90da7e  ntdll!ZwReplyPort
7c90da7e  ntdll!NtReplyPort
7c90da8e  ntdll!NtReplyWaitReceivePort
7c90da8e  ntdll!ZwReplyWaitReceivePort
7c90da9e  ntdll!NtReplyWaitReceivePortEx
7c90da9e  ntdll!ZwReplyWaitReceivePortEx
7c90daae  ntdll!ZwReplyWaitReplyPort
7c90daae  ntdll!NtReplyWaitReplyPort
7c90dabe  ntdll!ZwRequestDeviceWakeup
7c90dabe  ntdll!NtRequestDeviceWakeup
7c90dace  ntdll!ZwRequestPort
7c90dace  ntdll!NtRequestPort
7c90dade  ntdll!ZwRequestWaitReplyPort
7c90dade  ntdll!NtRequestWaitReplyPort
7c90daee  ntdll!ZwRequestWakeupLatency
7c90daee  ntdll!NtRequestWakeupLatency
7c90dafe  ntdll!NtResetEvent
7c90dafe  ntdll!ZwResetEvent
7c90db0e  ntdll!NtResetWriteWatch
7c90db0e  ntdll!ZwResetWriteWatch
7c90db1e  ntdll!ZwRestoreKey
7c90db1e  ntdll!NtRestoreKey
7c90db2e  ntdll!NtResumeProcess
7c90db2e  ntdll!ZwResumeProcess
7c90db3e  ntdll!NtResumeThread
7c90db3e  ntdll!ZwResumeThread
7c90db4e  ntdll!ZwSaveKey
7c90db4e  ntdll!NtSaveKey
7c90db5e  ntdll!ZwSaveKeyEx
7c90db5e  ntdll!NtSaveKeyEx
7c90db6e  ntdll!ZwSaveMergedKeys
7c90db6e  ntdll!NtSaveMergedKeys
7c90db7e  ntdll!ZwSecureConnectPort
7c90db7e  ntdll!NtSecureConnectPort
7c90db8e  ntdll!NtSetBootEntryOrder
7c90db8e  ntdll!ZwSetBootEntryOrder
7c90db9e  ntdll!ZwSetBootOptions
7c90db9e  ntdll!NtSetBootOptions
7c90dbae  ntdll!ZwSetContextThread
7c90dbae  ntdll!NtSetContextThread
7c90dbbe  ntdll!NtSetDebugFilterState
7c90dbbe  ntdll!ZwSetDebugFilterState
7c90dbce  ntdll!ZwSetDefaultHardErrorPort
7c90dbce  ntdll!NtSetDefaultHardErrorPort
7c90dbde  ntdll!ZwSetDefaultLocale
7c90dbde  ntdll!NtSetDefaultLocale
7c90dbee  ntdll!ZwSetDefaultUILanguage
7c90dbee  ntdll!NtSetDefaultUILanguage
7c90dbfe  ntdll!ZwSetEaFile
7c90dbfe  ntdll!NtSetEaFile
7c90dc0e  ntdll!NtSetEvent
7c90dc0e  ntdll!ZwSetEvent
7c90dc1e  ntdll!NtSetEventBoostPriority
7c90dc1e  ntdll!ZwSetEventBoostPriority
7c90dc2e  ntdll!ZwSetHighEventPair
7c90dc2e  ntdll!NtSetHighEventPair
7c90dc3e  ntdll!ZwSetHighWaitLowEventPair
7c90dc3e  ntdll!NtSetHighWaitLowEventPair
7c90dc4e  ntdll!ZwSetInformationDebugObject
7c90dc4e  ntdll!NtSetInformationDebugObject
7c90dc5e  ntdll!NtSetInformationFile
7c90dc5e  ntdll!ZwSetInformationFile
7c90dc6e  ntdll!ZwSetInformationJobObject
7c90dc6e  ntdll!NtSetInformationJobObject
7c90dc7e  ntdll!ZwSetInformationKey
7c90dc7e  ntdll!NtSetInformationKey
7c90dc8e  ntdll!ZwSetInformationObject
7c90dc8e  ntdll!NtSetInformationObject
7c90dc9e  ntdll!ZwSetInformationProcess
7c90dc9e  ntdll!NtSetInformationProcess
7c90dcae  ntdll!ZwSetInformationThread
7c90dcae  ntdll!NtSetInformationThread
7c90dcbe  ntdll!NtSetInformationToken
7c90dcbe  ntdll!ZwSetInformationToken
7c90dcce  ntdll!NtSetIntervalProfile
7c90dcce  ntdll!ZwSetIntervalProfile
7c90dcde  ntdll!ZwSetIoCompletion
7c90dcde  ntdll!NtSetIoCompletion
7c90dcee  ntdll!ZwSetLdtEntries
7c90dcee  ntdll!NtSetLdtEntries
7c90dcfe  ntdll!ZwSetLowEventPair
7c90dcfe  ntdll!NtSetLowEventPair
7c90dd0e  ntdll!NtSetLowWaitHighEventPair
7c90dd0e  ntdll!ZwSetLowWaitHighEventPair
7c90dd1e  ntdll!NtSetQuotaInformationFile
7c90dd1e  ntdll!ZwSetQuotaInformationFile
7c90dd2e  ntdll!NtSetSecurityObject
7c90dd2e  ntdll!ZwSetSecurityObject
7c90dd3e  ntdll!ZwSetSystemEnvironmentValue
7c90dd3e  ntdll!NtSetSystemEnvironmentValue
7c90dd4e  ntdll!ZwSetSystemEnvironmentValueEx
7c90dd4e  ntdll!NtSetSystemEnvironmentValueEx
7c90dd5e  ntdll!NtSetSystemInformation
7c90dd5e  ntdll!ZwSetSystemInformation
7c90dd6e  ntdll!NtSetSystemPowerState
7c90dd6e  ntdll!ZwSetSystemPowerState
7c90dd7e  ntdll!NtSetSystemTime
7c90dd7e  ntdll!ZwSetSystemTime
7c90dd8e  ntdll!NtSetThreadExecutionState
7c90dd8e  ntdll!ZwSetThreadExecutionState
7c90dd9e  ntdll!ZwSetTimer
7c90dd9e  ntdll!NtSetTimer
7c90ddae  ntdll!ZwSetTimerResolution
7c90ddae  ntdll!NtSetTimerResolution
7c90ddbe  ntdll!ZwSetUuidSeed
7c90ddbe  ntdll!NtSetUuidSeed
7c90ddce  ntdll!NtSetValueKey
7c90ddce  ntdll!ZwSetValueKey
7c90ddde  ntdll!ZwSetVolumeInformationFile
7c90ddde  ntdll!NtSetVolumeInformationFile
7c90ddee  ntdll!NtShutdownSystem
7c90ddee  ntdll!ZwShutdownSystem
7c90ddfe  ntdll!NtSignalAndWaitForSingleObject
7c90ddfe  ntdll!ZwSignalAndWaitForSingleObject
7c90de0e  ntdll!NtStartProfile
7c90de0e  ntdll!ZwStartProfile
7c90de1e  ntdll!NtStopProfile
7c90de1e  ntdll!ZwStopProfile
7c90de2e  ntdll!ZwSuspendProcess
7c90de2e  ntdll!NtSuspendProcess
7c90de3e  ntdll!NtSuspendThread
7c90de3e  ntdll!ZwSuspendThread
7c90de4e  ntdll!NtSystemDebugControl
7c90de4e  ntdll!ZwSystemDebugControl
7c90de5e  ntdll!ZwTerminateJobObject
7c90de5e  ntdll!NtTerminateJobObject
7c90de6e  ntdll!ZwTerminateProcess
7c90de6e  ntdll!NtTerminateProcess
7c90de7e  ntdll!ZwTerminateThread
7c90de7e  ntdll!NtTerminateThread
7c90de8e  ntdll!NtTestAlert
7c90de8e  ntdll!ZwTestAlert
7c90de9e  ntdll!NtTraceEvent
7c90de9e  ntdll!ZwTraceEvent
7c90deae  ntdll!ZwTranslateFilePath
7c90deae  ntdll!NtTranslateFilePath
7c90debe  ntdll!NtUnloadDriver
7c90debe  ntdll!ZwUnloadDriver
7c90dece  ntdll!ZwUnloadKey
7c90dece  ntdll!NtUnloadKey
7c90dede  ntdll!NtUnloadKeyEx
7c90dede  ntdll!ZwUnloadKeyEx
7c90deee  ntdll!NtUnlockFile
7c90deee  ntdll!ZwUnlockFile
7c90defe  ntdll!NtUnlockVirtualMemory
7c90defe  ntdll!ZwUnlockVirtualMemory
7c90df0e  ntdll!NtUnmapViewOfSection
7c90df0e  ntdll!ZwUnmapViewOfSection
7c90df1e  ntdll!ZwVdmControl
7c90df1e  ntdll!NtVdmControl
7c90df2e  ntdll!NtWaitForDebugEvent
7c90df2e  ntdll!ZwWaitForDebugEvent
7c90df3e  ntdll!ZwWaitForMultipleObjects
7c90df3e  ntdll!NtWaitForMultipleObjects
7c90df4e  ntdll!NtWaitForSingleObject
7c90df4e  ntdll!ZwWaitForSingleObject
7c90df5e  ntdll!ZwWaitHighEventPair
7c90df5e  ntdll!NtWaitHighEventPair
7c90df6e  ntdll!ZwWaitLowEventPair
7c90df6e  ntdll!NtWaitLowEventPair
7c90df7e  ntdll!ZwWriteFile
7c90df7e  ntdll!NtWriteFile
7c90df8e  ntdll!NtWriteFileGather
7c90df8e  ntdll!ZwWriteFileGather
7c90df9e  ntdll!NtWriteRequestData
7c90df9e  ntdll!ZwWriteRequestData
7c90dfae  ntdll!ZwWriteVirtualMemory
7c90dfae  ntdll!NtWriteVirtualMemory
7c90dfbe  ntdll!ZwYieldExecution
7c90dfbe  ntdll!NtYieldExecution
7c90dfce  ntdll!ZwCreateKeyedEvent
7c90dfce  ntdll!NtCreateKeyedEvent
7c90dfde  ntdll!ZwOpenKeyedEvent
7c90dfde  ntdll!NtOpenKeyedEvent
7c90dfee  ntdll!ZwReleaseKeyedEvent
7c90dfee  ntdll!NtReleaseKeyedEvent
7c90dffe  ntdll!ZwWaitForKeyedEvent
7c90dffe  ntdll!NtWaitForKeyedEvent
7c90e00e  ntdll!NtQueryPortInformationProcess
7c90e00e  ntdll!ZwQueryPortInformationProcess
7c90e01b  ntdll!pow
7c90e020  ntdll!CIpow
7c90e450  ntdll!KiUserApcDispatcher
7c90e460  ntdll!KiUserCallbackDispatcher
7c90e47c  ntdll!KiUserExceptionDispatcher
7c90e4c8  ntdll!KiRaiseUserExceptionDispatcher
7c90e510  ntdll!KiFastSystemCall
7c90e514  ntdll!KiFastSystemCallRet
7c90e520  ntdll!KiIntSystemCall
7c90e528  ntdll!RtlRaiseException
7c90e5e6  ntdll!CIcos
7c90e5fa  ntdll!cos
7c90e69e  ntdll!log
7c90e6a2  ntdll!CIlog
7c90e77e  ntdll!strstr
7c90e80d  ntdll!strchr
7c90eb3b  ntdll!RtlAnsiStringToUnicodeString
7c90ecba  ntdll!RtlMultiByteToUnicodeN
7c90f62d  ntdll!RtlNtStatusToDosError
7c90f679  ntdll!RtlNtStatusToDosErrorNoTeb
7c90fbd2  ntdll!RtlAddRefActivationContext
7c90fcd2  ntdll!RtlQueryInformationActivationContext
7c90fe21  ntdll!RtlGetLastWin32Error
7c90fe30  ntdll!RtlSetLastWin32Error
7c90fe30  ntdll!RtlRestoreLastWin32Error
7c90fe4a  ntdll!wcslen
7c90fe95  ntdll!RtlInitUnicodeStringEx
7c90ff1b  ntdll!RtlGetNtGlobalFlags
7c90ff2d  ntdll!RtlFreeHeap
7c9100c4  ntdll!RtlAllocateHeap
7c910339  ntdll!RtlImageNtHeader
7c910346  ntdll!RtlImageDirectoryEntryToData
7c9103e0  ntdll!RtlUpcaseUnicodeChar
7c91040d  ntdll!RtlAcquirePebLock
7c910451  ntdll!RtlReleasePebLock
7c910466  ntdll!RtlFreeUnicodeString
7c910466  ntdll!RtlFreeAnsiString
7c9104dd  ntdll!RtlSizeHeap
7c910547  ntdll!RtlReleaseActivationContext
7c91057f  ntdll!wcsncpy
7c91137a  ntdll!RtlDeleteCriticalSection
7c91151a  ntdll!RtlInitializeCriticalSectionAndSpinCount
7c9115d4  ntdll!RtlLogStackBackTrace
7c91161d  ntdll!RtlInitializeCriticalSection
7c911efd  ntdll!RtlTimeToTimeFields
7c912787  ntdll!LdrFindResource_U
7c9127a8  ntdll!LdrAccessResource
7c912808  ntdll!LdrLoadAlternateResourceModule
7c9128a5  ntdll!RtlAddressInSectionTable
7c9128d7  ntdll!RtlImageRvaToSection
7c912a8d  ntdll!RtlUnicodeToMultiByteN
7c912bb8  ntdll!RtlUnicodeStringToAnsiString
7c912c63  ntdll!LdrLockLoaderLock
7c912d19  ntdll!LdrUnlockLoaderLock
7c912d91  ntdll!CsrClientCallServer
7c912e64  ntdll!strcmpi
7c912e64  ntdll!stricmp
7c912ebb  ntdll!RtlEqualUnicodeString
7c912f60  ntdll!wcscpy
7c912f84  ntdll!RtlValidSid
7c913079  ntdll!RtlCreateUnicodeStringFromAsciiz
7c9130a8  ntdll!RtlIsDosDeviceName_U
7c91314c  ntdll!RtlCopyLuid
7c91316a  ntdll!RtlCopySid
7c91319e  ntdll!RtlLengthSid
7c9131ba  ntdll!RtlUnicodeToMultiByteSize
7c91320b  ntdll!RtlLockHeap
7c913273  ntdll!RtlUnlockHeap
7c9132dd  ntdll!RtlIsValidHandle
7c91333f  ntdll!RtlFreeHandle
7c913378  ntdll!wcsicmp
7c9133ce  ntdll!RtlIsValidIndexHandle
7c9133ff  ntdll!RtlEncodePointer
7c913425  ntdll!RtlDecodePointer
7c913432  ntdll!RtlCreateUnicodeString
7c9135b1  ntdll!RtlQueryInformationActiveActivationContext
7c9135d6  ntdll!RtlEqualString
7c9136b8  ntdll!RtlLengthRequiredSid
7c9136d0  ntdll!RtlDllShutdownInProgress
7c9136e0  ntdll!RtlSubAuthorityCountSid
7c91379f  ntdll!RtlGetDaclSecurityDescriptor
7c913862  ntdll!RtlGetUserInfoHeap
7c91392d  ntdll!RtlFreeThreadActivationContextStack
7c913956  ntdll!LdrShutdownThread
7c913ab3  ntdll!RtlCheckForOrphanedCriticalSections
7c913b8a  ntdll!RtlDetermineDosPathNameType_U
7c9142f5  ntdll!RtlDosPathNameToNtPathName_U
7c9143a9  ntdll!RtlGetFullPathName_U
7c914408  ntdll!RtlPrefixUnicodeString
7c914506  ntdll!RtlGetCurrentDirectory_U
7c914599  ntdll!RtlQueryEnvironmentVariable_U
7c914691  ntdll!wcsrchr
7c9146ca  ntdll!RtlExpandEnvironmentStrings_U
7c914982  ntdll!wcschr
7c9149d9  ntdll!RtlGetLongestNtPathLength
7c914c55  ntdll!RtlConvertSidToUnicodeString
7c914ed9  ntdll!RtlCopyUnicodeString
7c914f3a  ntdll!RtlAppendUnicodeToString
7c914faf  ntdll!RtlAppendUnicodeStringToString
7c915019  ntdll!RtlFormatCurrentUserKeyPath
7c9151f3  ntdll!bsearch
7c915511  ntdll!RtlFindActivationContextSectionString
7c91565d  ntdll!RtlHashUnicodeString
7c91599b  ntdll!RtlDosApplyFileIsolationRedirection_Ustr
7c915d61  ntdll!RtlFindCharInUnicodeString
7c915e6a  ntdll!RtlValidateUnicodeString
7c9163c3  ntdll!LdrLoadDll
7c9166a0  ntdll!LdrGetDllHandle
7c9166c1  ntdll!LdrGetDllHandleEx
7c916915  ntdll!RtlMultiAppendUnicodeStringBuffer
7c916ff9  ntdll!RtlDosSearchPath_U
7c91738b  ntdll!LdrUnloadDll
7c91767d  ntdll!RtlActivateActivationContextEx
7c917803  ntdll!RtlActivateActivationContext
7c9178df  ntdll!RtlDeactivateActivationContext
7c9179a8  ntdll!RtlCompareUnicodeString
7c917ea8  ntdll!LdrGetProcedureAddress
7c918132  ntdll!wcscat
7c918199  ntdll!RtlAnsiCharToUnicodeChar
7c9181ed  ntdll!wcsnicmp
7c91824c  ntdll!RtlEqualSid
7c918278  ntdll!RtlSubAuthoritySid
7c918295  ntdll!RtlInitializeSid
7c9184db  ntdll!swprintf
7c9185cd  ntdll!RtlValidAcl
7c918651  ntdll!RtlCreateSecurityDescriptor
7c91867f  ntdll!RtlSetDaclSecurityDescriptor
7c9186da  ntdll!RtlFirstFreeAce
7c9187e9  ntdll!RtlCreateAcl
7c91883b  ntdll!RtlAddAccessAllowedAce
7c91885e  ntdll!RtlFreeSid
7c91888b  ntdll!RtlAllocateAndInitializeSid
7c9189e8  ntdll!RtlSetOwnerSecurityDescriptor
7c918a32  ntdll!RtlSetGroupSecurityDescriptor
7c918a7c  ntdll!RtlInitializeBitMap
7c918a98  ntdll!RtlEncodeSystemPointer
7c918a98  ntdll!RtlDecodeSystemPointer
7c918ad9  ntdll!RtlOpenCurrentUser
7c918b44  ntdll!wcsncat
7c918b9a  ntdll!RtlInitializeHandleTable
7c918c11  ntdll!RtlDosSearchPath_Ustr
7c919394  ntdll!RtlAllocateHandle
7c9193e9  ntdll!RtlSetUserValueHeap
7c91966b  ntdll!RtlGetVersion
7c919758  ntdll!RtlGetNtProductType
7c91989d  ntdll!strnicmp
7c919951  ntdll!LdrUnloadAlternateResourceModule
7c9199d8  ntdll!RtlDoesFileExists_U
7c919ae0  ntdll!RtlPopFrame
7c919b00  ntdll!RtlPushFrame
7c919ba0  ntdll!RtlReAllocateHeap
7c91ab39  ntdll!RtlTimeFieldsToTime
7c91ad08  ntdll!RtlIntegerToChar
7c91ae2e  ntdll!RtlIntegerToUnicodeString
7c91ae91  ntdll!RtlUnicodeStringToInteger
7c91b0aa  ntdll!CsrNewThread
7c91b1bf  ntdll!RtlpWaitForCriticalSection
7c91b287  ntdll!RtlpUnWaitCriticalSection
7c91bbea  ntdll!snwprintf
7c91c26d  ntdll!LdrFindResourceDirectory_U
7c91c5cb  ntdll!RtlGetActiveActivationContext
7c91cca3  ntdll!LdrQueryImageFileExecutionOptions
7c91d4dd  ntdll!RtlAppendPathElement
7c91d6fb  ntdll!LdrDisableThreadCalloutsForDll
7c91e287  ntdll!RtlpEnsureBufferSize
7c91e314  ntdll!RtlEnumerateGenericTableWithoutSplaying
7c91e356  ntdll!RtlRealSuccessor
7c91e38c  ntdll!RtlIsGenericTableEmpty
7c91e3cf  ntdll!CsrCaptureMessageBuffer
7c91e42b  ntdll!wcsncmp
7c91e6fb  ntdll!RtlInitializeResource
7c91e7aa  ntdll!RtlSetCurrentDirectory_U
7c91ea7b  ntdll!vDbgPrintExWithPrefix
7c91eaf5  ntdll!DbgPrintEx
7c91eb1f  ntdll!CsrFreeCaptureBuffer
7c91eb78  ntdll!CsrAllocateCaptureBuffer
7c91ebd9  ntdll!CsrAllocateMessagePointer
7c91fe25  ntdll!LdrFindCreateProcessManifest
7c9201c3  ntdll!LdrCreateOutOfProcessImage
7c9202dd  ntdll!LdrDestroyOutOfProcessImage
7c920324  ntdll!vDbgPrintEx
7c92034f  ntdll!RtlReleaseMemoryStream
7c9203d8  ntdll!qsort
7c9204a1  ntdll!RtlGetFrame
7c9204d6  ntdll!RtlpApplyLengthFunction
7c92053f  ntdll!RtlReadOutOfProcessMemoryStream
7c9205a1  ntdll!RtlAddRefMemoryStream
7c9205bd  ntdll!RtlQueryInterfaceMemoryStream
7c92064d  ntdll!CsrCaptureMessageMultiUnicodeStringsInPlace
7c92070e  ntdll!CsrCaptureMessageString
7c920779  ntdll!RtlGetLengthWithoutLastFullDosOrNtPathElement
7c9209b8  ntdll!LdrAccessOutOfProcessResource
7c9209f2  ntdll!RtlInitOutOfProcessMemoryStream
7c920a55  ntdll!RtlStatMemoryStream
7c920ad5  ntdll!RtlCreateActivationContext
7c920e3e  ntdll!RtlFinalReleaseOutOfProcessMemoryStream
7c920ed8  ntdll!RtlSplay
7c920f3b  ntdll!RtlDuplicateUnicodeString
7c92102f  ntdll!RtlLookupElementGenericTable
7c921207  ntdll!CsrClientConnectToServer
7c92132f  ntdll!RtlGetNtVersionNumbers
7c921405  ntdll!LdrEnumerateLoadedModules
7c9214b1  ntdll!RtlInitializeGenericTable
7c9214ef  ntdll!RtlReadMemoryStream
7c921534  ntdll!RtlInitMemoryStream
7c92221f  ntdll!LdrSetDllManifestProber
7c92223c  ntdll!RtlInitializeAtomPackage
7c922254  ntdll!RtlCreateTagHeap
7c922299  ntdll!RtlSetThreadPoolStartFunc
7c922336  ntdll!RtlNormalizeProcessParams
7c9224fb  ntdll!RtlResetRtlTranslations
7c922645  ntdll!RtlInitNlsTables
7c922676  ntdll!RtlInitCodePageTable
7c922dc4  ntdll!RtlDestroyProcessParameters
7c922deb  ntdll!RtlDeNormalizeProcessParams
7c922e99  ntdll!RtlCreateProcessParameters
7c92382f  ntdll!wcsstr
7c923962  ntdll!RtlDestroyEnvironment
7c923b45  ntdll!RtlDestroyHandleTable
7c923b79  ntdll!RtlNumberGenericTableElements
7c923bd8  ntdll!LdrShutdownProcess
7c923cfb  ntdll!RtlDeleteResource
7c923d33  ntdll!toupper
7c9241dd  ntdll!RtlUpcaseUnicodeToMultiByteN
7c92441c  ntdll!RtlNtPathNameToDosPathName
7c924869  ntdll!wcslwr
7c9248a9  ntdll!atoi
7c9248b6  ntdll!atol
7c92492c  ntdll!mbstowcs
7c924a3f  ntdll!RtlInsertElementGenericTable
7c924c5d  ntdll!RtlSubtreePredecessor
7c924c80  ntdll!RtlDeleteElementGenericTable
7c924ce1  ntdll!RtlDelete
7c924ea5  ntdll!RtlConsoleMultiByteToUnicodeN
7c925bc4  ntdll!sprintf
7c925c82  ntdll!RtlCreateHeap
7c92635d  ntdll!RtlFindClearBits
7c926425  ntdll!RtlFindClearBitsAndSet
7c926458  ntdll!RtlSetBits
7c9264ee  ntdll!RtlDestroyHeap
7c9266c1  ntdll!RtlClearBits
7c926707  ntdll!RtlAreBitsSet
7c9269f1  ntdll!iswctype
7c926a95  ntdll!iswdigit
7c926b83  ntdll!RtlUpcaseUnicodeString
7c926ca0  ntdll!RtlGUIDFromString
7c9270e8  ntdll!RtlUnicodeToOemN
7c92720a  ntdll!RtlUnicodeStringToOemString
7c92735c  ntdll!RtlOemToUnicodeN
7c927485  ntdll!RtlOemStringToUnicodeString
7c9277b8  ntdll!RtlSetEnvironmentVariable
7c927c58  ntdll!RtlQueueWorkItem
7c9284aa  ntdll!RtlLookupAtomInAtomTable
7c928d0e  ntdll!RtlFindActivationContextSectionGuid
7c928eb6  ntdll!RtlStringFromGUID
7c92906b  ntdll!RtlIsTextUnicode
7c92939a  ntdll!RtlMultiByteToUnicodeSize
7c9293c2  ntdll!RtlUpperChar
7c9293e4  ntdll!RtlFormatMessage
7c9297a6  ntdll!RtlpNtQueryValueKey
7c929867  ntdll!RtlpNtOpenKey
7c92994f  ntdll!RtlMakeSelfRelativeSD
7c929a19  ntdll!RtlAbsoluteToSelfRelativeSD
7c929a49  ntdll!RtlAddAccessAllowedAceEx
7c929a6d  ntdll!RtlAdjustPrivilege
7c929b1a  ntdll!RtlDowncaseUnicodeString
7c929da7  ntdll!RtlImpersonateSelf
7c929f23  ntdll!wcstol
7c929f84  ntdll!RtlReleaseResource
7c929fbf  ntdll!RtlAcquireResourceShared
7c929ffd  ntdll!RtlMapGenericMask
7c92a04b  ntdll!RtlAreAllAccessesGranted
7c92a067  ntdll!RtlSetCriticalSectionSpinCount
7c92a096  ntdll!RtlAcquireResourceExclusive
7c92a164  ntdll!RtlTimeToSecondsSince1980
7c92a1b5  ntdll!RtlGetControlSecurityDescriptor
7c92a1e3  ntdll!RtlDeleteSecurityObject
7c92a26c  ntdll!RtlIdentifierAuthoritySid
7c92a846  ntdll!towlower
7c92abc5  ntdll!RtlUnwind
7c92af05  ntdll!RtlUpdateTimer
7c92b15e  ntdll!RtlStartRXact
7c92b1b1  ntdll!RtlAbortRXact
7c92b1f1  ntdll!RtlTimeToSecondsSince1970
7c92b2cb  ntdll!RtlLengthSecurityDescriptor
7c92b3e5  ntdll!RtlGetOwnerSecurityDescriptor
7c92b427  ntdll!RtlGetGroupSecurityDescriptor
7c92b466  ntdll!RtlEqualDomainName
7c92b4c3  ntdll!RtlFreeOemString
7c92b580  ntdll!RtlAddAce
7c92bda5  ntdll!RtlUpcaseUnicodeToOemN
7c92c0c9  ntdll!RtlUpcaseUnicodeStringToOemString
7c92c1cb  ntdll!RtlClearAllBits
7c92c1fc  ntdll!RtlSetAllBits
7c92c3e4  ntdll!RtlCopySecurityDescriptor
7c92c49c  ntdll!RtlSetSecurityObject
7c92c8a9  ntdll!isdigit
7c92c8d2  ntdll!_isascii
7c92c981  ntdll!RtlIpv4StringToAddressA
7c92ca99  ntdll!RtlCreateEnvironment
7c92cb05  ntdll!LdrAddRefDll
7c92cbce  ntdll!RtlConvertSharedToExclusive
7c92cc10  ntdll!RtlConvertExclusiveToShared
7c92cd60  ntdll!RtlCreateTimer
7c92ced5  ntdll!RtlQueryInformationAcl
7c92cf46  ntdll!RtlSetSaclSecurityDescriptor
7c92cfd7  ntdll!RtlSelfRelativeToAbsoluteSD
7c92d1de  ntdll!RtlCopyString
7c92d229  ntdll!RtlValidRelativeSecurityDescriptor
7c92d795  ntdll!RtlRunEncodeUnicodeString
7c92d7e3  ntdll!RtlRunDecodeUnicodeString
7c92d982  ntdll!RtlIpv4AddressToStringExW
7c92d9fa  ntdll!RtlIpv4AddressToStringW
7c92db03  ntdll!RtlCreateTimerQueue
7c92dbeb  ntdll!RtlAddAccessDeniedAce
7c92dc55  ntdll!RtlPrefixString
7c92dcb1  ntdll!itow
7c92dd99  ntdll!RtlSetIoCompletionCallback
7c92df9a  ntdll!RtlCreateUserThread
7c92e0d9  ntdll!RtlInitializeContext
7c92e5a1  ntdll!RtlpNtEnumerateSubKey
7c92e65e  ntdll!RtlAddAttributeActionToRXact
7c92e839  ntdll!RtlApplyRXact
7c92e8bd  ntdll!RtlAddActionToRXact
7c92e957  ntdll!RtlNewSecurityObject
7c92e994  ntdll!itoa
7c92eb9c  ntdll!RtlSetProcessIsCritical
7c92ebf0  ntdll!RtlSetThreadIsCritical
7c92ec31  ntdll!RtlUniform
7c92ed52  ntdll!LdrFlushAlternateResourceModules
7c92edf0  ntdll!RtlApplyRXactNoFlush
7c92ee2e  ntdll!RtlEraseUnicodeString
7c92ee71  ntdll!RtlCreateUserSecurityObject
7c92eee9  ntdll!RtlCreateAndSetSD
7c92f30d  ntdll!RtlGetLengthWithoutTrailingPathSeperators
7c92f3fe  ntdll!RtlQueryRegistryValues
7c92fab3  ntdll!RtlCheckRegistryKey
7c92fae0  ntdll!RtlSetControlSecurityDescriptor
7c92fb6f  ntdll!DbgPrint
7c92fb97  ntdll!vsnprintf
7c92fe4a  ntdll!RtlInitializeRXact
7c93002d  ntdll!RtlAddAuditAccessAce
7c930064  ntdll!RtlEnumerateGenericTableAvl
7c930089  ntdll!RtlEnumerateGenericTableWithoutSplayingAvl
7c930191  ntdll!RtlInitializeGenericTableAvl
7c9301c7  ntdll!RtlCheckProcessParameters
7c9302e3  ntdll!RtlLockBootStatusData
7c9303fb  ntdll!RtlUnlockBootStatusData
7c930441  ntdll!RtlGetSetBootStatusData
7c9305ab  ntdll!RtlCreateUserProcess
7c930a3c  ntdll!LdrVerifyImageMatchesChecksum
7c930b6a  ntdll!RtlImageRvaToVa
7c930ed3  ntdll!RtlDnsHostNameToComputerName
7c930fa0  ntdll!RtlWriteRegistryValue
7c930ffc  ntdll!RtlDeleteRegistryValue
7c9312b2  ntdll!RtlDeregisterWaitEx
7c9315da  ntdll!RtlDeregisterWait
7c931a7d  ntdll!RtlCutoverTimeToSystemTime
7c932720  ntdll!RtlNewSecurityObjectEx
7c932f94  ntdll!RtlEqualPrefixSid
7c933233  ntdll!RtlRegisterWait
7c933462  ntdll!RtlDeleteTimer
7c933bc0  ntdll!RtlCharToInteger
7c933c71  ntdll!RtlInterlockedPushEntrySList
7c933cb3  ntdll!RtlInterlockedPopEntrySList
7c933d20  ntdll!RtlQueryDepthSList
7c93407e  ntdll!RtlDeleteAtomFromAtomTable
7c934393  ntdll!RtlPcToFileHeader
7c93472a  ntdll!RtlAddAtomToAtomTable
7c93491a  ntdll!RtlCreateAtomTable
7c9349bd  ntdll!RtlQueryAtomInAtomTable
7c934ab9  ntdll!VerSetConditionMask
7c934af7  ntdll!RtlVerifyVersionInfo
7c934dc1  ntdll!wcstoul
7c934e12  ntdll!RtlValidSecurityDescriptor
7c934ee9  ntdll!RtlGetAce
7c934fc3  ntdll!RtlInitializeSListHead
7c935029  ntdll!RtlFindMessage
7c935454  ntdll!wcscmp
7c93571e  ntdll!wcscspn
7c935a58  ntdll!RtlSystemTimeToLocalTime
7c935a94  ntdll!RtlIpv4StringToAddressW
7c9361d7  ntdll!RtlCompactHeap
7c93687a  ntdll!wtol
7c936b9f  ntdll!RtlIpv4StringToAddressExW
7c936c2a  ntdll!RtlAddVectoredExceptionHandler
7c936c96  ntdll!RtlRemoveVectoredExceptionHandler
7c937ce5  ntdll!RtlSetHeapInformation
7c937d38  ntdll!RtlRandomEx
7c938124  ntdll!RtlAreAnyAccessesGranted
7c938151  ntdll!RtlDeleteAce
7c94888f  ntdll!LdrAlternateResourcesEnabled
7c951bda  ntdll!CsrIdentifyAlertableThread
7c951c16  ntdll!CsrSetPriorityClass
7c951c5f  ntdll!CsrGetProcessId
7c951c6a  ntdll!CsrCaptureTimeout
7c951c9d  ntdll!CsrProbeForWrite
7c951ceb  ntdll!CsrProbeForRead
7c951d21  ntdll!DbgUiConnectToDbg
7c951d76  ntdll!DbgUiGetThreadDebugObject
7c951d88  ntdll!DbgUiSetThreadDebugObject
7c951da5  ntdll!DbgUiWaitStateChange
7c951dcc  ntdll!DbgUiContinue
7c951df1  ntdll!DbgUiStopDebugging
7c951e13  ntdll!DbgUiRemoteBreakin
7c951e71  ntdll!DbgUiIssueRemoteBreakin
7c951eb2  ntdll!DbgUiDebugActiveProcess
7c951ef4  ntdll!DbgUiConvertStateChangeStructure
7c9521de  ntdll!LdrHotPatchRoutine
7c9524cb  ntdll!RtlGetUnloadEventTrace
7c952a31  ntdll!LdrQueryProcessModuleInformation
7c952a51  ntdll!LdrSetAppCompatDllRedirectionCallback
7c952ac1  ntdll!RtlIsThreadWithinLoaderCallout
7c952cc2  ntdll!LdrInitShimEngineDynamic
7c9532fb  ntdll!RtlComputePrivatizedDllName_U
7c953603  ntdll!RtlWriteMemoryStream
7c953610  ntdll!RtlSeekMemoryStream
7c953672  ntdll!RtlSetMemoryStreamSize
7c95367f  ntdll!RtlCopyMemoryStreamTo
7c9536f3  ntdll!RtlRevertMemoryStream
7c953700  ntdll!RtlUnlockMemoryStreamRegion
7c953700  ntdll!RtlLockMemoryStreamRegion
7c953700  ntdll!RtlCopyOutOfProcessMemoryStreamTo
7c95370d  ntdll!RtlCloneMemoryStream
7c95370d  ntdll!RtlCommitMemoryStream
7c953724  ntdll!RtlDumpResource
7c9537dd  ntdll!RtlEnableEarlyCriticalSectionEventCreation
7c9537f0  ntdll!RtlpNotOwnerCriticalSection
7c9538b1  ntdll!RtlNewSecurityObjectWithMultipleInheritance
7c9538c1  ntdll!RtlSetSecurityObjectEx
7c9538ea  ntdll!RtlQuerySecurityObject
7c953aec  ntdll!RtlNewInstanceSecurityObject
7c953b62  ntdll!RtlNewSecurityGrantedAccess
7c953cc0  ntdll!RtlConvertToAutoInheritSecurityObject
7c953cd0  ntdll!RtlDefaultNpAcl
7c953fd2  ntdll!RtlConvertUiListToApiList
7c954570  ntdll!RtlCreateQueryDebugBuffer
7c954658  ntdll!RtlDestroyQueryDebugBuffer
7c954739  ntdll!RtlQueryProcessBackTraceInformation
7c9548e1  ntdll!RtlQueryProcessHeapInformation
7c954e0d  ntdll!RtlQueryProcessLockInformation
7c954f83  ntdll!RtlQueryProcessDebugInformation
7c9566e5  ntdll!RtlApplicationVerifierStop
7c958095  ntdll!RtlQueueApcWow64Thread
7c9580a5  ntdll!RtlZombifyActivationContext
7c9580f6  ntdll!RtlIsActivationContextActive
7c9596cf  ntdll!RtlComputeImportTableHash
7c959bf5  ntdll!RtlConvertVariantToProperty
7c959c93  ntdll!RtlConvertPropertyToVariant
7c959d2b  ntdll!PropertyLengthAsVariant
7c959dc1  ntdll!RtlSetUnicodeCallouts
7c959eb2  ntdll!DbgPrintReturnControlC
7c959fa1  ntdll!DbgPrompt
7c959fe7  ntdll!DbgQueryDebugFilterState
7c959ff7  ntdll!DbgSetDebugFilterState
7c95a07b  ntdll!LdrFindEntryForAddress
7c95a110  ntdll!LdrEnumResources
7c95ae3e  ntdll!LdrFindResourceEx_U
7c95b52c  ntdll!LdrProcessRelocationBlock
7c95b54e  ntdll!RtlCustomCPToUnicodeN
7c95b732  ntdll!RtlUnicodeToCustomCPN
7c95b8e1  ntdll!RtlUpcaseUnicodeToCustomCPN
7c95c151  ntdll!PfxInitialize
7c95c16f  ntdll!PfxRemovePrefix
7c95c3b6  ntdll!PfxInsertPrefix
7c95c499  ntdll!PfxFindPrefix
7c95c538  ntdll!RtlSelfRelativeToAbsoluteSD2
7c95c5b7  ntdll!RtlSetInformationAcl
7c95c603  ntdll!RtlAddCompoundAce
7c95c847  ntdll!RtlAddAccessDeniedAceEx
7c95c86b  ntdll!RtlAddAuditAccessAceEx
7c95c8a3  ntdll!RtlAddAccessAllowedObjectAce
7c95c8f0  ntdll!RtlAddAccessDeniedObjectAce
7c95c93e  ntdll!RtlAddAuditAccessObjectAce
7c95c9d2  ntdll!RtlDestroyAtomTable
7c95caa9  ntdll!RtlEmptyAtomTable
7c95cb71  ntdll!RtlPinAtomInAtomTable
7c95cc29  ntdll!RtlInitializeRangeList
7c95ce44  ntdll!RtlFreeRangeList
7c95ce89  ntdll!RtlGetFirstRange
7c95cf41  ntdll!RtlGetNextRange
7c95d0ad  ntdll!RtlCopyRangeList
7c95d200  ntdll!RtlFindRange
7c95d583  ntdll!RtlIsRangeAvailable
7c95d7b6  ntdll!RtlMergeRangeLists
7c95d896  ntdll!RtlAddRange
7c95d921  ntdll!RtlDeleteRange
7c95da5e  ntdll!RtlDeleteOwnersRanges
7c95db0f  ntdll!RtlInvertRangeList
7c95dc01  ntdll!RtlCopySidAndAttributesArray
7c95dc95  ntdll!RtlCreateServiceSid
7c95dd9a  ntdll!RtlEqualLuid
7c95ddc3  ntdll!RtlCopyLuidAndAttributesArray
7c95ddf2  ntdll!RtlGetSaclSecurityDescriptor
7c95e04d  ntdll!RtlGetSecurityDescriptorRMControl
7c95e0af  ntdll!RtlSetSecurityDescriptorRMControl
7c95e0da  ntdll!RtlMapSecurityErrorToNtStatus
7c95e1c5  ntdll!RtlSetAttributesSecurityDescriptor
7c95f193  ntdll!RtlZeroHeap
7c95f446  ntdll!RtlDowncaseUnicodeChar
7c95f4a3  ntdll!RtlxUnicodeStringToAnsiSize
7c95f4a3  ntdll!RtlUnicodeStringToOemSize
7c95f4a3  ntdll!RtlxUnicodeStringToOemSize
7c95f4a3  ntdll!RtlUnicodeStringToAnsiSize
7c95f4c8  ntdll!RtlOemStringToUnicodeSize
7c95f4c8  ntdll!RtlxOemStringToUnicodeSize
7c95f4c8  ntdll!RtlxAnsiStringToUnicodeSize
7c95f4c8  ntdll!RtlAnsiStringToUnicodeSize
7c95f4ef  ntdll!RtlUpcaseUnicodeStringToAnsiString
7c95f59e  ntdll!RtlUnicodeStringToCountedOemString
7c95f672  ntdll!RtlUpcaseUnicodeStringToCountedOemString
7c95f746  ntdll!RtlEqualComputerName
7c95f756  ntdll!RtlCompareString
7c95f7e9  ntdll!RtlUpperString
7c95f832  ntdll!RtlAppendAsciizToString
7c95f88d  ntdll!RtlAppendStringToString
7c95f8e1  ntdll!RtlFindSetBits
7c95fb92  ntdll!RtlFindClearRuns
7c95fdd9  ntdll!RtlFindLongestRunClear
7c95fe10  ntdll!RtlNumberOfClearBits
7c95fe60  ntdll!RtlNumberOfSetBits
7c95feb7  ntdll!RtlAreBitsClear
7c95ff3a  ntdll!RtlFindNextForwardRunClear
7c960034  ntdll!RtlFindLastBackwardRunClear
7c960104  ntdll!RtlFindMostSignificantBit
7c9601af  ntdll!RtlFindLeastSignificantBit
7c960258  ntdll!RtlFindSetBitsAndClear
7c96028b  ntdll!RtlAssert2
7c960499  ntdll!RtlAssert
7c9604fc  ntdll!RtlDebugPrintTimes
7c9605b1  ntdll!RtlDeleteTimerQueueEx
7c9606b9  ntdll!RtlDeleteTimerQueue
7c9606d1  ntdll!RtlSetTimer
7c9606e1  ntdll!RtlCancelTimer
7c96072a  ntdll!RtlWalkFrameChain
7c9608a1  ntdll!RtlCaptureStackContext
7c9609a1  ntdll!RtlCaptureStackBackTrace
7c960a5a  ntdll!RtlGetCallersAddress
7c960aa4  ntdll!RtlLargeIntegerToChar
7c960e71  ntdll!RtlInt64ToUnicodeString
7c960ee1  ntdll!RtlGetCurrentPeb
7c960ef0  ntdll!RtlCreateRegistryKey
7c960f71  ntdll!RtlQueryTimeZoneInformation
7c961099  ntdll!RtlSetTimeZoneInformation
7c9611b2  ntdll!RtlProtectHeap
7c961315  ntdll!RtlSetUserFlagsHeap
7c961465  ntdll!RtlQueryTagHeap
7c9615c9  ntdll!RtlExtendHeap
7c9617d1  ntdll!RtlGetProcessHeaps
7c961889  ntdll!RtlEnumProcessHeaps
7c961911  ntdll!RtlWalkHeap
7c96219b  ntdll!RtlQueryHeapInformation
7c962208  ntdll!RtlValidateHeap
7c96242b  ntdll!RtlValidateProcessHeaps
7c9624d8  ntdll!RtlUsageHeap
7c962a31  ntdll!RtlGetCompressionWorkSpaceSize
7c962a9d  ntdll!RtlCompressBuffer
7c962b19  ntdll!RtlDecompressBuffer
7c962b85  ntdll!RtlDecompressFragment
7c962ce1  ntdll!RtlComputeCrc32
7c96311d  ntdll!RtlCreateBootStatusDataFile
7c9632f5  ntdll!RtlSetCurrentEnvironment
7c9633d3  ntdll!RtlExitUserThread
7c9633fd  ntdll!RtlFreeUserThreadStack
7c9638e9  ntdll!RtlCreateSystemVolumeInformationFolder
7c963ae3  ntdll!RtlTimeToElapsedTimeFields
7c963b4a  ntdll!RtlSecondsSince1980ToTime
7c963b81  ntdll!RtlSecondsSince1970ToTime
7c963bb8  ntdll!RtlLocalTimeToSystemTime
7c963bf4  ntdll!RtlSubtreeSuccessor
7c963c17  ntdll!RtlRealPredecessor
7c963c54  ntdll!RtlDeleteNoSplay
7c963cd4  ntdll!RtlGetElementGenericTable
7c963d5d  ntdll!RtlEnumerateGenericTable
7c9640ae  ntdll!RtlIsGenericTableEmptyAvl
7c9640c7  ntdll!RtlGetElementGenericTableAvl
7c96419c  ntdll!RtlNumberGenericTableElementsAvl
7c964209  ntdll!RtlInsertElementGenericTableAvl
7c96423c  ntdll!RtlDeleteElementGenericTableAvl
7c9642c6  ntdll!RtlEnumerateGenericTableLikeADirectory
7c964395  ntdll!RtlLookupElementGenericTableAvl
7c9643b6  ntdll!RtlRegisterSecureMemoryCacheCallback
7c9643f2  ntdll!RtlFlushSecureMemoryCache
7c9646df  ntdll!RtlIsNameLegalDOS8Dot3
7c964860  ntdll!RtlGenerate8dot3Name
7c964c4d  ntdll!RtlGetLastNtStatus
7c964c5f  ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus
7c964c80  ntdll!RtlRemoteCall
7c964ded  ntdll!RtlInterlockedFlushSList
7c964ecf  ntdll!RtlInitializeStackTraceDataBase
7c9650a1  ntdll!RtlIpv6AddressToStringA
7c9652cd  ntdll!RtlIpv6AddressToStringExA
7c9653b3  ntdll!RtlIpv4AddressToStringA
7c965401  ntdll!RtlIpv4AddressToStringExA
7c9654a7  ntdll!RtlIpv6AddressToStringW
7c96570f  ntdll!RtlIpv6AddressToStringExW
7c965803  ntdll!RtlIpv6StringToAddressA
7c965b22  ntdll!RtlIpv6StringToAddressExA
7c965d5f  ntdll!RtlIpv4StringToAddressExA
7c965ef8  ntdll!RtlIpv6StringToAddressW
7c9661f6  ntdll!RtlIpv6StringToAddressExW
7c966459  ntdll!RtlLargeIntegerDivide
7c9666a0  ntdll!RtlRaiseStatus
7c9666cf  ntdll!RtlRandom
7c9668fa  ntdll!RtlTraceDatabaseEnumerate
7c966982  ntdll!RtlTraceDatabaseCreate
7c966a74  ntdll!RtlTraceDatabaseDestroy
7c966b11  ntdll!RtlTraceDatabaseValidate
7c966b5b  ntdll!RtlTraceDatabaseFind
7c966d2f  ntdll!RtlTraceDatabaseLock
7c966d3f  ntdll!RtlTraceDatabaseUnlock
7c966d4f  ntdll!RtlTraceDatabaseAdd
7c966f61  ntdll!RtlUnhandledExceptionFilter2
7c9678e7  ntdll!RtlUnhandledExceptionFilter
7c9679ab  ntdll!RtlpNtCreateKey
7c9679d8  ntdll!RtlpNtSetValueKey
7c967a04  ntdll!RtlpNtMakeTemporaryKey
7c971314  ntdll!isalpha
7c97134c  ntdll!isupper
7c97137f  ntdll!islower
7c9713b2  ntdll!isxdigit
7c9713ea  ntdll!isspace
7c97141d  ntdll!ispunct
7c971450  ntdll!isalnum
7c971488  ntdll!isprint
7c9714c0  ntdll!isgraph
7c9714f8  ntdll!iscntrl
7c97152b  ntdll!_toascii
7c97153d  ntdll!_iscsymf
7c971583  ntdll!_iscsym
7c9715c9  ntdll!atoi64
7c971686  ntdll!ltoa
7c9716b2  ntdll!ultoa
7c971745  ntdll!i64toa
7c97177d  ntdll!ui64toa
7c97179f  ntdll!ltow
7c9717cb  ntdll!ultow
7c971867  ntdll!i64tow
7c97189f  ntdll!ui64tow
7c9718c1  ntdll!lfind
7c9718fa  ntdll!memicmp
7c97190a  ntdll!snprintf
7c971968  ntdll!splitpath
7c971ab0  ntdll!strlwr
7c971add  ntdll!strupr
7c971b0a  ntdll!tolower
7c971b1c  ntdll!tolower
7c971b57  ntdll!toupper
7c971b69  ntdll!vsnwprintf
7c971bdf  ntdll!wcsupr
7c971c15  ntdll!wtoi
7c971c25  ntdll!wtoi64
7c971cc2  ntdll!abs
7c971cc2  ntdll!labs
7c971cd7  ntdll!fabs
7c971d8f  ntdll!iswalpha
7c971daa  ntdll!iswlower
7c971dc2  ntdll!iswxdigit
7c971ddd  ntdll!iswspace
7c971df5  ntdll!sscanf
7c971fea  ntdll!strtol
7c972009  ntdll!strtoul
7c972028  ntdll!towupper
7c97203c  ntdll!vsprintf
7c97209a  ntdll!wcspbrk
7c9720e3  ntdll!wcsspn
7c972131  ntdll!wcstombs
7c97e048  ntdll!fltused
7c97e098  ntdll!NlsAnsiCodePage
7c97e0a0  ntdll!NlsMbCodePageTag
7c97e0a8  ntdll!NlsMbOemCodePageTag
Edited by autoidiot
JohnOne Universalist

JohnOne

Posted
Posted

How about you run your application from the code, and get more direct information.

The error is that of an access violation, meaning it tried to access memory which it no permission to

or perhaps out of range, unaddressable or something else.

AutoIt Absolute Beginners    Require a serial    Pause Script    Video Tutorials by Morthawt   ipify 

Monkey's are, like, natures humans.

rover Universalist

rover

Posted
Posted (edited)

The answer might be what was pointed out by Tripredacus and in your own statement:

Move all XML and TIF images to a temporary directory at beginning of process to avoid access problems (1st party SW still writing and my program reading at the same time)

You don't have access checking for permissions/file locking before you run: FileMove($source_path & "*.*", $temp_path, 9)

Just as it would be trial and error with a lot of error logging code and runtime to find out what function fails and just what conditions are causing it (permissions/file locking).

It would also be trial and error to find out how soon after the files are written that they are no longer locked and any restricting permissions removed.

As a workaround to adding file permissions or file locking testing code,

get an array of files and exclude moving the most recently generated tif/xml file sets

with a Modified/Accessed time within a few minutes or so of a time sample baseline taken when the run starts.

If you still get errors move back the time from a few minutes to 10/20 minutes (strike that, just checked how frequent your processing runs are - 10mins)

If you still get errors move the time back a few more minutes.

The idea is to try to eliminate file permissions/locking as an issue.

The software generating these files may sometimes not release files when its processing is done. (then add file locking/permissions testing if issue not resolved elsewhere)

Do you have the most recent FreeImage dll?

Check the FreeImage forum for possible issues with crashes.

Why do you load/initialize/close the FreeImage dll every processing run?

Try loading/initializing it once when your script starts and only close it on exit

See if that is the issue.

I don't have the freeimage include to check this.

Is there an 'unload' function that should be called after_FreeImage_DeInitialise()?

Edited by rover

I see fascists...

rover Universalist

rover

Posted
Posted (edited)

I had a look into this dll.

Just a suggestion regarding dll load/initialise:

You are missing _FreeImage_UnLoadDLL(), so you are getting an inconsequential memory leak when _FreeImage_LoadDLL() is run in a loop.

The dll handle reference count ($__g_hFREEIMAGEDLL) doesn't increment because Prog@ndy coded _FreeImage_LoadDLL() to prevent that,

but the global variable $__g_hFREEIMAGEDLL_RefCount increments by 1 with every processing run. (current version of FreeImage.au3 from ProgAndy's site)

I don't see any memory leak issues with the dll (ran a loop test with _Replace_TIF_By_JPEG()) so you could

move _FreeImage_LoadDLL()/_FreeImage_Initialise() to script start and call _FreeImage_UnLoadDLL()/_FreeImage_DeInitialise() on exit.

I noticed _FreeImage_Save() returned a zero byte jpg file when I initially tested with a low-res 4bpp sample tif in one of the freeimage dll download archive folders,

but it worked fine with an 11meg tif image.

Checking return error from those functions in _Replace_TIF_By_JPEG() did not catch this.

You could add code to check that written jpgs exist, are within an expected size range and check some image parameters*, and log errors and popup an alert maybe with sound if something happens.

As this is a measurement logging machine you don't want a logging error to go unnoticed for too long...

*Use _FreeImage_Get* or _GDIPlus_ImageGet* functions to check jpg image type, size, resolution, bit depth, etc.

Edit: The usual things: typos, rewording

Edited by rover

I see fascists...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...