Today I looked at a virtual memory usage bug. I determined that the function to set a breakpoint on is {,,ntdll}_ZwAllocateVirtualMemory@24. This function is called by the heap APIs, and by the VirtualAlloc APIs.