Thanks for Backend's hint, without carefully examining the disassembly missed IsolatedAlloc function