Connected to Windows Server 2003 3790 x64 SP1

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE671Ah
LastExceptionToIP=0000000078EE63D0h

...

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE4D9Bh
LastExceptionToIP=0000000078EE4E19h

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE4E5Eh
LastExceptionToIP=0000000078EE62CBh

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=FFFFF80001040067h
LastExceptionToIP=0000000078EE6307h

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE6319h
LastExceptionToIP=0000000078EE6351h

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE63B7h
LastExceptionToIP=0000000078EE6329h

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE6350h
LastExceptionToIP=0000000078EE676Ch

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE67B5h
LastExceptionToIP=0000000078EE6030h

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE6097h
LastExceptionToIP=0000000078EE6099h
S
LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE60E7h
LastExceptionToIP=0000000078EE612Dh

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE6141h
LastExceptionToIP=0000000078EE6148h

LastBranchFromIP=FFFFF8000103F3D9h
LastBranchToIP=FFFFF80001041740h
LastExceptionFromIP=0000000078EE614Eh
LastExceptionToIP=0000000078EE6160h

LastBranchFromIP=FFFFF800010411AAh
LastBranchToIP=0000000078EE5ED0h
0000000078EE614E
0000000078EE6160
0000000078EE61C1
0000000078EE5ED0
0000000078EE5F33
0000000078EE5F97
0000000078EE5FEE
0000000078EE61C6
0000000078EE61E5
0000000078EE65E2
0000000078EE65EB
0000000078EE65F0
0000000078EE660C
0000000078EE61ED
0000000078EE6219
0000000078EE67BA
0000000078EE67F6



0000000078EE5ED0:
0000000078EE5ED0	488BC4			mov rax,rsp
0000000078EE5ED3	4883EC48		sub rsp,48
0000000078EE5ED7	4C8B5C2470		mov r11,[rsp+70]
0000000078EE5EDC	488958F8		mov [rax-08],rbx
0000000078EE5EE0	488B5C2478		mov rbx,[rsp+78]
0000000078EE5EE5	488970E8		mov [rax-18],rsi
0000000078EE5EE9	4C8960D8		mov [rax-28],r12
0000000078EE5EED	4C8968D0		mov [rax-30],r13
0000000078EE5EF1	4C8970C8		mov [rax-38],r14
0000000078EE5EF5	4C8978C0		mov [rax-40],r15
0000000078EE5EF9	488968F0		mov [rax-10],rbp
0000000078EE5EFD	488978E0		mov [rax-20],rdi
0000000078EE5F01	498BF1			mov rsi,r9
0000000078EE5F04	4D8BE0			mov r12,r8
0000000078EE5F07	4C8BF2			mov r14,rdx
0000000078EE5F0A	4C8BE9			mov r13,rcx
rax			0000000000000000
rbx			0000000100001007
rcx			0000000100000000	module_base
rdx			0000000100001007	exception_address
rsp			000000000006F278
rbp			0000000000000000
rsi			0000000000000001
rdi			000000000006F3C0
 r8			000000000006FF50	? Context
 r9			0000000100002000	? _RUNTIME_FUNCTION thanks to IMAGE_DIRECTORY_ENTRY_EXCEPTION
r10			0000000000000007
r11			000000010000200C
r12			000000000006F3C0
r13			000000000006F358
r14			0000000100000000
r15			0000000100002000
000000000006F278	0000000078EE61C6	ret addr
000000000006F280	0000000000200000
000000000006F288	000000000006F2D0
000000000006F290	000000000006F2D0
000000000006F298	000000000006F890
000000000006F2A0	000000000006F3C0	? 5th param
000000000006F2A8	0000000000000000	? 6th param
000000000006F2B0	0000000100001007
000000000006F2B8	000000000006F890
000000000006F2C0	0000000100000000
000000000006F2C8	0000000100002000
000000000006F2D0	0000000100001007
000000000006F2D8	0000000000000000
000000000006F2E0	000000000006FE80
000000000006F2E8	0000000000000000
000000000006F2F0	0000000000000000



0000000078EE5F0D	4C8D3DECA0FDFF		lea r15,[0000000078EC0000] ; [=ntdll.dll]=0000000300905A4D
0000000078EE5F14	6690			nop
0000000078EE5F16	6690			nop
0000000078EE5F18	6690			nop
0000000078EE5F1A	448B4E08		mov r9d,[rsi+08]	; _RUNTIME_FUNCTION.UnwindData
0000000078EE5F1E	418BFE			mov edi,r14d		; ExceptionAddress and 0FFFFFFFFh
0000000078EE5F21	4032ED			xor bpl,bpl
0000000078EE5F24	2B3E			sub edi,[rsi]		; offset of exception
0000000078EE5F26	4D03CD			add r9,r13
0000000078EE5F29	4533D2			xor r10d,r10d
0000000078EE5F2C	412BFD			sub edi,r13d
0000000078EE5F2F	41386902		cmp [r9+02],bpl
0000000078EE5F33	7662			jbe 0000000078EE5F97
0000000078EE5F35	90			nop
0000000078EE5F36	470FB6445105		movzx r8d,byte [r9+r10*2+05]
0000000078EE5F3C	430FB6445104		movzx eax,byte [r9+r10*2+04]
0000000078EE5F42	418BC8			mov ecx,r8d
0000000078EE5F45	41C1E804		shr r8d,04
0000000078EE5F49	83E10F			and ecx,0F
0000000078EE5F4C	3BF8			cmp edi,eax
0000000078EE5F4E	0F82B53F0500		jc 0000000078F39F09
0000000078EE5F54	83F90A			cmp ecx,0A
0000000078EE5F57	772F			jnbe 0000000078EE5F88
0000000078EE5F59	8BC1			mov eax,ecx
0000000078EE5F5B	418B8C8FF05F0200	mov ecx,[r15+rcx*4+00025FF0]
0000000078EE5F63	4903CF			add rcx,r15
0000000078EE5F66	FFE1			jmp rcx
0000000078EE5F68	41FFC2			inc r10d
0000000078EE5F6B	430FB7545104		movzx edx,word [r9+r10*2+04]
0000000078EE5F71	C1E203			shl edx,03
0000000078EE5F74	4903D4			add rdx,r12
0000000078EE5F77	4885DB			test rbx,rbx
0000000078EE5F7A	488B02			mov rax,[rdx]
0000000078EE5F7D	4B8944C378		mov [r11+r8*8+78],rax
0000000078EE5F82	0F85D93E0500		jnz 0000000078F39E61
0000000078EE5F88	41FFC2			inc r10d
0000000078EE5F8B	EB00			jmp 0000000078EE5F8D
0000000078EE5F8D	410FB64102		movzx eax,byte [r9+02]
0000000078EE5F92	443BD0			cmp r10d,eax
0000000078EE5F95	729F			jc 0000000078EE5F36



0000000078EE5F97	41F60120		test byte [r9],20 ; [000000010000200C]=19	; test whether _UNWIND_INFO.Flags = UNW_FLAG_CHAININFO
0000000078EE5F9B	0F8566100000		jnz 0000000078EE7007
0000000078EE5FA1	4C8B7C2408		mov r15,[rsp+08]
0000000078EE5FA6	4C8B742410		mov r14,[rsp+10]
0000000078EE5FAB	4C8B6C2418		mov r13,[rsp+18]
0000000078EE5FB0	4C8B642420		mov r12,[rsp+20]
0000000078EE5FB5	488B7C2428		mov rdi,[rsp+28]
0000000078EE5FBA	488B5C2440		mov rbx,[rsp+40]
0000000078EE5FBF	4084ED			test bpl,bpl
0000000078EE5FC2	488B6C2438		mov rbp,[rsp+38]
0000000078EE5FC7	7519			jnz 0000000078EE5FE2
0000000078EE5FC9	498B8398000000		mov rax,[r11+00000098] ; [000000000006F458]=000000000006FF50
0000000078EE5FD0	488B08			mov rcx,[rax] ; [000000000006FF50]=0000000000000000
0000000078EE5FD3	4983839800000008	add qword [r11+00000098],08 ; [000000000006F458]=000000000006FF50
0000000078EE5FDB	49898BF8000000		mov [r11+000000F8],rcx ; [000000000006F4B8]=0000000100001007
0000000078EE5FE2	488BC6			mov rax,rsi
0000000078EE5FE5	488B742430		mov rsi,[rsp+30]
0000000078EE5FEA	4883C448		add rsp,48
0000000078EE5FEE	C3			ret 
000000000006F230			0000000002080000
000000000006F238			0000000100002000
000000000006F240			0000000100000000
000000000006F248			000000000006F358
000000000006F250			000000000006F3C0
000000000006F258			000000000006F3C0
000000000006F260			0000000000000001
000000000006F268			0000000000000000
000000000006F270			0000000100001007
000000000006F278			0000000078EE61C6
000000000006F280			0000000000200000
000000000006F288			000000000006F2D0
000000000006F290			000000000006F2D0
000000000006F298			000000000006F890
000000000006F2A0			000000000006F3C0
000000000006F2A8			0000000000000000
