0:017> kv
ChildEBP RetAddr Args to Child
0770e074 76a24166 000004a4 76a23ce4 00000000 ADVAPI32!RegSetValueExW (FPO: [Non-Fpo])
0770e4b4 76a2440a 0770e4d0 00000410 00000001 SPOOLSS!UpdateUsersDefaultPrinter+0xf7 (FPO: [Non-Fpo])
0770ed1c 76a2423a 00000000 0000048c 01e98ab8 SPOOLSS!UpdatePrinterRegUser+0x120 (FPO: [Non-Fpo])
0770ef50 7873af1e 01e98ab8 00cf8094 00000000 SPOOLSS!UpdatePrinterRegAll+0x7d (FPO: [Non-Fpo])
0770ef60 7873aea0 00cf20e0 01e98ab8 00cf8094 localspl!CheckAndUpdatePrinterRegAll+0x1b (FPO: [4,0,0])
0770ef80 7873d9da 00000000 00cf1f10 00cf20e0 localspl!UpdateWinIni+0x6c (FPO: [Non-Fpo])
0770f420 7873d762 00000000 00000002 01e8bdc0 localspl!SplAddPrinter+0x33e (FPO: [Non-Fpo])
0770f44c 76a2479f 00000000 00000002 01e8bdc0 localspl!LocalAddPrinterEx+0x2c (FPO: [Non-Fpo])
0770f88c 76a246cd 00000000 00000002 01e8bdc0 SPOOLSS!AddPrinterExW+0xff (FPO: [Non-Fpo])
0770f8a4 010057bc 00000000 00000002 01e8bdc0 SPOOLSS!AddPrinterW+0x15 (FPO: [3,0,0])
0770f8c4 01005747 00000000 00cfd3d0 000dd4bc spoolsv!YAddPrinter+0x67 (FPO: [Non-Fpo])
0770f8e4 78786ce8 00000000 00cfd3d0 000dd4bc spoolsv!RpcAddPrinter+0x19 (FPO: [Non-Fpo])
0770f90c 787e3583 0100572e 0770fab0 00000005 RPCRT4!Invoke+0x30
0770fd0c 787e38ea 00000000 00000000 000ac240 RPCRT4!NdrStubCall2+0x655 (FPO: [Non-Fpo])
0770fd28 78786067 000ac240 00077f88 000ac240 RPCRT4!NdrServerCall2+0x17 (FPO: [Non-Fpo])
0770fd60 78785fad 010045fc 000ac240 0770fe0c RPCRT4!DispatchToStubInC+0x84 (FPO: [Non-Fpo])
0770fdb8 78785ebf 00000005 00000000 0770fe0c RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x100 (FPO: [Non-Fpo])
0770fdd8 7878858e 000ac240 00000000 0770fe0c RPCRT4!RPC_INTERFACE::DispatchToStub+0x5e (FPO: [Non-Fpo])
0770fe10 78788123 000a0900 000767d8 834b0005 RPCRT4!LRPC_SCALL::DealWithRequestMessage+0x1dd (FPO: [Non-Fpo])
0770fe28 7878dc26 000ac148 0770fe50 000a0900 RPCRT4!LRPC_ADDRESS::DealWithLRPCRequest+0x10c (FPO: [Non-Fpo]) 
0:017> !handle 000004a4 f
Handle 4a4
Type Key
Attributes 0
GrantedAccess 0x2001f:
ReadControl
QueryValue,SetValue,CreateSubKey,EnumSubKey,Notify
HandleCount 2
PointerCount 3
Name \REGISTRY\USER\S-1-5-21-1343024091-73586283-839522115-500\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Windows
Object Specific Information
Key last write time: 12:59:44. 2/25/2005
Key name Windows
0:017> du 76a23ce4
76a23ce4 “Device”
0:017> du 0770e4f4
0770e4f4 “Client\TKOFUTOW2KP#\RICOH IMAGIO”
0770e534 ” MF160 RPDL,winspool,Ne00:”