CoTaskMemAlloc

CoTaskMemAlloc

//----- (1011EF30) --------------------------------------------------------
void *__stdcall Windows::COM::CoTaskMemAlloc(Windows::COM *this, unsigned __int32 a2)
{
  void *result; // eax@2
  int v3; // ST00_4@3
  int (__stdcall *v4)(int, Windows::COM *); // esi@3

  if ( (unsigned int)this <= 0xFFFFFFFF )
  {
    v3 = `anonymous namespace'::g_pIMalloc;
    v4 = *(int (__stdcall **)(int, Windows::COM *))(*(_DWORD *)`anonymous namespace'::g_pIMalloc + 12);
    __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)`anonymous namespace'::g_pIMalloc + 12));
    result = (void *)v4(v3, this);
  }
  else
  {
    result = 0;
  }
  return result;
}

从上一篇可知：
g_pIMalloc + 12，即加 3，CRetailMalloc_Alloc(IMalloc *, unsigned long)
而函数中的 this 实际为 a2