API tools faq
paste
DarkShadow44

Untitled

DarkShadow44
Jan 15th, 2024
110
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 326.80 KB | None | 0 0
raw download clone embed print report
  1. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  2. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  3. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  4. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  5. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  6. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  7. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  8. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  9. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  10. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  11. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  12. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  13. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  14. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  15. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  16. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  17. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  18. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  19. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  20. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  21. 0024:Ret ucrtbase._wcsnicmp() retval=00000005 ret=79cc7529
  22. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCache",79d1b452 L"%ProgramData%",0000000d) ret=79cc7529
  23. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  24. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  25. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  26. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  27. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  28. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  29. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  30. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  31. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  32. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  33. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  34. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  35. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  36. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  37. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  38. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  39. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  40. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  41. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  42. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  43. 0024:Ret ucrtbase._wcsnicmp() retval=00000005 ret=79cc7529
  44. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCache",79d1b424 L"%USERPROFILE%",0000000d) ret=79cc7529
  45. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  46. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  47. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  48. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  49. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  50. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  51. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  52. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  53. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  54. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  55. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  56. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  57. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  58. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  59. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  60. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  61. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  62. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  63. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  64. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  65. 0024:Ret ucrtbase._wcsnicmp() retval=00000000 ret=79cc7529
  66. 0024:Call advapi32.GetUserNameW(0031d2b0,0031d4b8) ret=79ccb586
  67. 0024:Call ntdll.RtlInitUnicodeString(0031d01c,7b8b802a L"WINEUSERNAME") ret=7b9955a7
  68. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d01c ret=7b9955a7
  69. 0024:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0031d01c,0031d014) ret=7b9955eb
  70. 0024:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7b9955eb
  71. 0024:Ret advapi32.GetUserNameW() retval=00000001 ret=79ccb586
  72. 0024:Call shlwapi.PathAppendW(0031d92c L"C:\\users",0031d2b0 L"fabian") ret=79ccb5a0
  73. 0024:Call kernelbase.PathAppendW(0031d92c L"C:\\users",0031d2b0 L"fabian") ret=7be6a33c
  74. 0024:Ret kernelbase.PathAppendW() retval=00000001 ret=7be6a33c
  75. 0024:Ret shlwapi.PathAppendW() retval=00000001 ret=79ccb5a0
  76. 0024:Call shlwapi.PathAppendW(0031d92c L"C:\\users\\fabian",0031d6ee L"\\AppData\\Local\\Microsoft\\Windows\\INetCache") ret=79ccb5ce
  77. 0024:Call kernelbase.PathAppendW(0031d92c L"C:\\users\\fabian",0031d6ee L"\\AppData\\Local\\Microsoft\\Windows\\INetCache") ret=7be6a33c
  78. 0024:Ret kernelbase.PathAppendW() retval=00000001 ret=7be6a33c
  79. 0024:Ret shlwapi.PathAppendW() retval=00000001 ret=79ccb5ce
  80. 0024:Call advapi32.RegCloseKey(00000088) ret=79ccb720
  81. 0024:Call ntdll.NtClose(00000088) ret=7b998cd1
  82. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  83. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  84. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  85. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79ccb720
  86. 0024:Call advapi32.RegSetValueExW(00000080,79d17f7e L"Cache",00000000,00000001,0031e05c,00000074) ret=79cca21e
  87. 0024:Call ntdll.RtlInitUnicodeString(0031d8bc,79d17f7e L"Cache") ret=7b999037
  88. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d8bc ret=7b999037
  89. 0024:Call ntdll.NtSetValueKey(00000080,0031d8bc,00000000,00000001,0031e05c,00000074) ret=7b99906b
  90. 0024:Ret ntdll.NtSetValueKey() retval=00000000 ret=7b99906b
  91. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b999078
  92. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b999078
  93. 0024:Ret advapi32.RegSetValueExW() retval=00000000 ret=79cca21e
  94. 0024:Call advapi32.RegCloseKey(00000080) ret=79cca25a
  95. 0024:Call ntdll.NtClose(00000080) ret=7b998cd1
  96. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  97. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  98. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  99. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79cca25a
  100. 0024:Call advapi32.RegCloseKey(00000084) ret=79cca26d
  101. 0024:Call ntdll.NtClose(00000084) ret=7b998cd1
  102. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  103. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  104. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  105. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79cca26d
  106. 0024:Call shlwapi.PathFileExistsW(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCache") ret=79ccc5ee
  107. 0024:Call kernelbase.PathFileExistsW(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCache") ret=7be6a33c
  108. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,0000000c,0031df7c,00000004,00000000) ret=7b99371e
  109. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b99371e
  110. 0024:Call ntdll.NtSetInformationProcess(ffffffff,0000000c,0031dfa4,00000004) ret=7b994315
  111. 0024:Ret ntdll.NtSetInformationProcess() retval=00000000 ret=7b994315
  112. 0024:Call ntdll.RtlDosPathNameToNtPathName_U(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCache",0031df40,00000000,00000000) ret=7b95bf9a
  113. 0024:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95bf9a
  114. 0024:Call ntdll.NtQueryAttributesFile(0031df28,0031df48) ret=7b95c004
  115. 0024:Ret ntdll.NtQueryAttributesFile() retval=00000000 ret=7b95c004
  116. 0024:Call ntdll.RtlFreeUnicodeString(0031df40) ret=7b95c017
  117. 0024:Ret ntdll.RtlFreeUnicodeString() retval=0031df40 ret=7b95c017
  118. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,0000000c,0031df7c,00000004,00000000) ret=7b99371e
  119. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b99371e
  120. 0024:Call ntdll.NtSetInformationProcess(ffffffff,0000000c,0031dfa4,00000004) ret=7b994315
  121. 0024:Ret ntdll.NtSetInformationProcess() retval=00000000 ret=7b994315
  122. 0024:Ret kernelbase.PathFileExistsW() retval=00000001 ret=7be6a33c
  123. 0024:Ret shlwapi.PathFileExistsW() retval=00000001 ret=79ccc5ee
  124. 0024:Ret shell32.SHGetSpecialFolderPathW() retval=00000001 ret=790d4902
  125. 0024:Call ucrtbase.memcpy(0031e5b8,790ededa,00000018) ret=790d4a5b
  126. 0024:Ret ucrtbase.memcpy() retval=0031e5b8 ret=790d4a5b
  127. 0024:Call KERNEL32.WideCharToMultiByte(00000000,00000400,0031e544 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5\\",00000039,00000000,00000000,00000000,0031eb5c) ret=790d4acb
  128. 0024:Ret KERNEL32.WideCharToMultiByte() retval=00000039 ret=790d4acb
  129. 0024:Call ucrtbase.malloc(00000020) ret=790d4698
  130. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000020) ret=7b4e3ed8
  131. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0688 ret=7b4e3ed8
  132. 0024:Ret ucrtbase.malloc() retval=003f0688 ret=790d4698
  133. 0024:Call ucrtbase.strlen(790edef2 "") ret=790d46a8
  134. 0024:Ret ucrtbase.strlen() retval=00000000 ret=790d46a8
  135. 0024:Call ucrtbase._wcsdup(0031e544 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5\\") ret=790d2b94
  136. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000008e) ret=7b4e3ed8
  137. 0024:Ret ntdll.RtlAllocateHeap() retval=003f06b0 ret=7b4e3ed8
  138. 0024:Ret ucrtbase._wcsdup() retval=003f06b0 ret=790d2b94
  139. 0024:Call ucrtbase.malloc(00000001) ret=790d471a
  140. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000001) ret=7b4e3ed8
  141. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0748 ret=7b4e3ed8
  142. 0024:Ret ucrtbase.malloc() retval=003f0748 ret=790d471a
  143. 0024:Call ucrtbase.memcpy(003f0748,790edef2,00000001) ret=790d4776
  144. 0024:Ret ucrtbase.memcpy() retval=003f0748 ret=790d4776
  145. 0024:Call user32.CharLowerW(0031e74c L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") ret=790d4783
  146. 0024:Ret user32.CharLowerW() retval=0031e74c ret=790d4783
  147. 0024:Call KERNEL32.CreateMutexW(00000000,00000000,0031e74c L"c:!users!fabian!appdata!local!microsoft!windows!inetcache!") ret=790d47b6
  148. 0024:Call ntdll.RtlInitUnicodeString(0031e480,0031e74c L"c:!users!fabian!appdata!local!microsoft!windows!inetcache!") ret=7b9a987b
  149. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e480 ret=7b9a987b
  150. 0024:Call ntdll._vsnwprintf(0031e3ac,00000040,7b9c8980 L"\\Sessions\\%u\\BaseNamedObjects",0031e384) ret=7b9a91e1
  151. 0024:Ret ntdll._vsnwprintf() retval=0000001c ret=7b9a91e1
  152. 0024:Call ntdll.RtlInitUnicodeString(0031e3a4,0031e3ac L"\\Sessions\\1\\BaseNamedObjects") ret=7b9a973f
  153. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e3a4 ret=7b9a973f
  154. 0024:Call ntdll.NtOpenDirectoryObject(0031e388,00000006,0031e38c) ret=7b9a97a2
  155. 0024:Ret ntdll.NtOpenDirectoryObject() retval=00000000 ret=7b9a97a2
  156. 0024:Call ntdll.NtCreateMutant(0031e488,001f0001,0031e468,00000000) ret=7b9aac6f
  157. 0024:Ret ntdll.NtCreateMutant() retval=00000000 ret=7b9aac6f
  158. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9aaca8
  159. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9aaca8
  160. 0024:Ret KERNEL32.CreateMutexW() retval=00000084 ret=790d47b6
  161. 0024:Call shell32.SHGetSpecialFolderPathW(00000000,0031e544,00000022,00000001) ret=790d4902
  162. 0024:Call advapi32.RegCreateKeyW(80000001,79d1b2e0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0031db3c) ret=79cca019
  163. 0024:Call ntdll.RtlInitUnicodeString(0031d894,79d1b2e0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7b9979c7
  164. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d894 ret=7b9979c7
  165. 0024:Call ntdll.RtlInitUnicodeString(0031d88c,00000000) ret=7b9979de
  166. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d88c ret=7b9979de
  167. 0024:Call ntdll.NtCreateKey(0031db3c,02000000,0031d840,00000000,0031d88c,00000000,00000000) ret=7b9973f9
  168. 0024:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  169. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  170. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  171. 0024:Ret advapi32.RegCreateKeyW() retval=00000000 ret=79cca019
  172. 0024:Call advapi32.RegCreateKeyW(80000001,79d1b364 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0031db40) ret=79cca099
  173. 0024:Call ntdll.RtlInitUnicodeString(0031d894,79d1b364 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7b9979c7
  174. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d894 ret=7b9979c7
  175. 0024:Call ntdll.RtlInitUnicodeString(0031d88c,00000000) ret=7b9979de
  176. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d88c ret=7b9979de
  177. 0024:Call ntdll.NtCreateKey(0031db40,02000000,0031d840,00000000,0031d88c,00000000,00000000) ret=7b9973f9
  178. 0024:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  179. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  180. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  181. 0024:Ret advapi32.RegCreateKeyW() retval=00000000 ret=79cca099
  182. 0024:Call advapi32.RegQueryValueExW(0000008c,79d18010 L"History",00000000,0031db38,0031e05c,0031db34) ret=79cca152
  183. 0024:Call ntdll.RtlInitUnicodeString(0031d8a4,79d18010 L"History") ret=7b99a47a
  184. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d8a4 ret=7b99a47a
  185. 0024:Call ntdll.NtQueryValueKey(0000008c,0031d8a4,00000002,0031d7a0,00000100,0031d8a0) ret=7b99a4ea
  186. 0024:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  187. 0024:Call ntdll.memcpy(0031e05c,0031d7ac,0000006c) ret=7b99a5df
  188. 0024:Ret ntdll.memcpy() retval=0031e05c ret=7b99a5df
  189. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  190. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  191. 0024:Ret advapi32.RegQueryValueExW() retval=00000000 ret=79cca152
  192. 0024:Call advapi32.RegCreateKeyExW(80000002,79d1b568 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0031d4c8,0031d07c) ret=79ccae04
  193. 0024:Call ntdll.RtlInitUnicodeString(0031d000,79d1b568 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") ret=7b9979c7
  194. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d000 ret=7b9979c7
  195. 0024:Call ntdll.RtlInitUnicodeString(0031cff8,00000000) ret=7b9979de
  196. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031cff8 ret=7b9979de
  197. 0024:Call ntdll.NtCreateKey(0031d4c8,000f003f,0031cfac,00000000,0031cff8,00000000,0031d07c) ret=7b9973f9
  198. 0024:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  199. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  200. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  201. 0024:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=79ccae04
  202. 0024:Call KERNEL32.GetSystemDirectoryW(0031d2b0,00000104) ret=79ccb14f
  203. 0024:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=79ccb14f
  204. 0024:Call advapi32.RegQueryValueExW(00000090,79d1b644 L"ProfilesDirectory",00000000,0031d05c,0031d4cc,0031d058) ret=79ccaec6
  205. 0024:Call ntdll.RtlInitUnicodeString(0031cfc4,79d1b644 L"ProfilesDirectory") ret=7b99a47a
  206. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031cfc4 ret=7b99a47a
  207. 0024:Call ntdll.NtQueryValueKey(00000090,0031cfc4,00000002,0031cec0,00000100,0031cfc0) ret=7b99a4ea
  208. 0024:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  209. 0024:Call ntdll.memcpy(0031d4cc,0031cecc,00000012) ret=7b99a5df
  210. 0024:Ret ntdll.memcpy() retval=0031d4cc ret=7b99a5df
  211. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  212. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  213. 0024:Ret advapi32.RegQueryValueExW() retval=00000000 ret=79ccaec6
  214. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\History",79d1b668 L"%ALLUSERSPROFILE%",00000011) ret=79cc7529
  215. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  216. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  217. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  218. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  219. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  220. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  221. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  222. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  223. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  224. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  225. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  226. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  227. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  228. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  229. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  230. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  231. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  232. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  233. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  234. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  235. 0024:Ret ucrtbase._wcsnicmp() retval=00000014 ret=79cc7529
  236. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\History",79d1b440 L"%PUBLIC%",00000008) ret=79cc7529
  237. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  238. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  239. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  240. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  241. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  242. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  243. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  244. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  245. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  246. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  247. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  248. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  249. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  250. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  251. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  252. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  253. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  254. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  255. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  256. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  257. 0024:Ret ucrtbase._wcsnicmp() retval=00000005 ret=79cc7529
  258. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\History",79d1b452 L"%ProgramData%",0000000d) ret=79cc7529
  259. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  260. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  261. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  262. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  263. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  264. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  265. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  266. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  267. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  268. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  269. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  270. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  271. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  272. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  273. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  274. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  275. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  276. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  277. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  278. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  279. 0024:Ret ucrtbase._wcsnicmp() retval=00000005 ret=79cc7529
  280. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\History",79d1b424 L"%USERPROFILE%",0000000d) ret=79cc7529
  281. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  282. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  283. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  284. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  285. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  286. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  287. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  288. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  289. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  290. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  291. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  292. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  293. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  294. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  295. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  296. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  297. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  298. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  299. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  300. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  301. 0024:Ret ucrtbase._wcsnicmp() retval=00000000 ret=79cc7529
  302. 0024:Call advapi32.GetUserNameW(0031d2b0,0031d4b8) ret=79ccb586
  303. 0024:Call ntdll.RtlInitUnicodeString(0031d01c,7b8b802a L"WINEUSERNAME") ret=7b9955a7
  304. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d01c ret=7b9955a7
  305. 0024:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0031d01c,0031d014) ret=7b9955eb
  306. 0024:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7b9955eb
  307. 0024:Ret advapi32.GetUserNameW() retval=00000001 ret=79ccb586
  308. 0024:Call shlwapi.PathAppendW(0031d92c L"C:\\users",0031d2b0 L"fabian") ret=79ccb5a0
  309. 0024:Call kernelbase.PathAppendW(0031d92c L"C:\\users",0031d2b0 L"fabian") ret=7be6a33c
  310. 0024:Ret kernelbase.PathAppendW() retval=00000001 ret=7be6a33c
  311. 0024:Ret shlwapi.PathAppendW() retval=00000001 ret=79ccb5a0
  312. 0024:Call shlwapi.PathAppendW(0031d92c L"C:\\users\\fabian",0031d6ee L"\\AppData\\Local\\Microsoft\\Windows\\History") ret=79ccb5ce
  313. 0024:Call kernelbase.PathAppendW(0031d92c L"C:\\users\\fabian",0031d6ee L"\\AppData\\Local\\Microsoft\\Windows\\History") ret=7be6a33c
  314. 0024:Ret kernelbase.PathAppendW() retval=00000001 ret=7be6a33c
  315. 0024:Ret shlwapi.PathAppendW() retval=00000001 ret=79ccb5ce
  316. 0024:Call advapi32.RegCloseKey(00000090) ret=79ccb720
  317. 0024:Call ntdll.NtClose(00000090) ret=7b998cd1
  318. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  319. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  320. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  321. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79ccb720
  322. 0024:Call advapi32.RegSetValueExW(00000088,79d18010 L"History",00000000,00000001,0031e05c,00000070) ret=79cca21e
  323. 0024:Call ntdll.RtlInitUnicodeString(0031d8bc,79d18010 L"History") ret=7b999037
  324. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d8bc ret=7b999037
  325. 0024:Call ntdll.NtSetValueKey(00000088,0031d8bc,00000000,00000001,0031e05c,00000070) ret=7b99906b
  326. 0024:Ret ntdll.NtSetValueKey() retval=00000000 ret=7b99906b
  327. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b999078
  328. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b999078
  329. 0024:Ret advapi32.RegSetValueExW() retval=00000000 ret=79cca21e
  330. 0024:Call advapi32.RegCloseKey(00000088) ret=79cca25a
  331. 0024:Call ntdll.NtClose(00000088) ret=7b998cd1
  332. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  333. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  334. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  335. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79cca25a
  336. 0024:Call advapi32.RegCloseKey(0000008c) ret=79cca26d
  337. 0024:Call ntdll.NtClose(0000008c) ret=7b998cd1
  338. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  339. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  340. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  341. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79cca26d
  342. 0024:Call shlwapi.PathFileExistsW(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\History") ret=79ccc5ee
  343. 0024:Call kernelbase.PathFileExistsW(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\History") ret=7be6a33c
  344. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,0000000c,0031df7c,00000004,00000000) ret=7b99371e
  345. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b99371e
  346. 0024:Call ntdll.NtSetInformationProcess(ffffffff,0000000c,0031dfa4,00000004) ret=7b994315
  347. 0024:Ret ntdll.NtSetInformationProcess() retval=00000000 ret=7b994315
  348. 0024:Call ntdll.RtlDosPathNameToNtPathName_U(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\History",0031df40,00000000,00000000) ret=7b95bf9a
  349. 0024:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95bf9a
  350. 0024:Call ntdll.NtQueryAttributesFile(0031df28,0031df48) ret=7b95c004
  351. 0024:Ret ntdll.NtQueryAttributesFile() retval=00000000 ret=7b95c004
  352. 0024:Call ntdll.RtlFreeUnicodeString(0031df40) ret=7b95c017
  353. 0024:Ret ntdll.RtlFreeUnicodeString() retval=0031df40 ret=7b95c017
  354. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,0000000c,0031df7c,00000004,00000000) ret=7b99371e
  355. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b99371e
  356. 0024:Call ntdll.NtSetInformationProcess(ffffffff,0000000c,0031dfa4,00000004) ret=7b994315
  357. 0024:Ret ntdll.NtSetInformationProcess() retval=00000000 ret=7b994315
  358. 0024:Ret kernelbase.PathFileExistsW() retval=00000001 ret=7be6a33c
  359. 0024:Ret shlwapi.PathFileExistsW() retval=00000001 ret=79ccc5ee
  360. 0024:Ret shell32.SHGetSpecialFolderPathW() retval=00000001 ret=790d4902
  361. 0024:Call ucrtbase.memcpy(0031e5b4,790edef4,00000018) ret=790d4a5b
  362. 0024:Ret ucrtbase.memcpy() retval=0031e5b4 ret=790d4a5b
  363. 0024:Call KERNEL32.WideCharToMultiByte(00000000,00000400,0031e544 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\",00000037,00000000,00000000,00000000,0031eb5c) ret=790d4acb
  364. 0024:Ret KERNEL32.WideCharToMultiByte() retval=00000037 ret=790d4acb
  365. 0024:Call ucrtbase.malloc(00000020) ret=790d4698
  366. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000020) ret=7b4e3ed8
  367. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0760 ret=7b4e3ed8
  368. 0024:Ret ucrtbase.malloc() retval=003f0760 ret=790d4698
  369. 0024:Call ucrtbase.strlen(790edf0c "Visited:") ret=790d46a8
  370. 0024:Ret ucrtbase.strlen() retval=00000008 ret=790d46a8
  371. 0024:Call ucrtbase._wcsdup(0031e544 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") ret=790d2b94
  372. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000008a) ret=7b4e3ed8
  373. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0788 ret=7b4e3ed8
  374. 0024:Ret ucrtbase._wcsdup() retval=003f0788 ret=790d2b94
  375. 0024:Call ucrtbase.malloc(00000009) ret=790d471a
  376. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000009) ret=7b4e3ed8
  377. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0820 ret=7b4e3ed8
  378. 0024:Ret ucrtbase.malloc() retval=003f0820 ret=790d471a
  379. 0024:Call ucrtbase.memcpy(003f0820,790edf0c,00000009) ret=790d4776
  380. 0024:Ret ucrtbase.memcpy() retval=003f0820 ret=790d4776
  381. 0024:Call user32.CharLowerW(0031e74c L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\History\\") ret=790d4783
  382. 0024:Ret user32.CharLowerW() retval=0031e74c ret=790d4783
  383. 0024:Call KERNEL32.CreateMutexW(00000000,00000000,0031e74c L"c:!users!fabian!appdata!local!microsoft!windows!history!") ret=790d47b6
  384. 0024:Call ntdll.RtlInitUnicodeString(0031e480,0031e74c L"c:!users!fabian!appdata!local!microsoft!windows!history!") ret=7b9a987b
  385. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e480 ret=7b9a987b
  386. 0024:Call ntdll.NtCreateMutant(0031e488,001f0001,0031e468,00000000) ret=7b9aac6f
  387. 0024:Ret ntdll.NtCreateMutant() retval=00000000 ret=7b9aac6f
  388. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9aaca8
  389. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9aaca8
  390. 0024:Ret KERNEL32.CreateMutexW() retval=00000088 ret=790d47b6
  391. 0024:Call shell32.SHGetSpecialFolderPathW(00000000,0031e544,00000021,00000001) ret=790d4902
  392. 0024:Call advapi32.RegCreateKeyW(80000001,79d1b2e0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0031db3c) ret=79cca019
  393. 0024:Call ntdll.RtlInitUnicodeString(0031d894,79d1b2e0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7b9979c7
  394. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d894 ret=7b9979c7
  395. 0024:Call ntdll.RtlInitUnicodeString(0031d88c,00000000) ret=7b9979de
  396. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d88c ret=7b9979de
  397. 0024:Call ntdll.NtCreateKey(0031db3c,02000000,0031d840,00000000,0031d88c,00000000,00000000) ret=7b9973f9
  398. 0024:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  399. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  400. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  401. 0024:Ret advapi32.RegCreateKeyW() retval=00000000 ret=79cca019
  402. 0024:Call advapi32.RegCreateKeyW(80000001,79d1b364 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0031db40) ret=79cca099
  403. 0024:Call ntdll.RtlInitUnicodeString(0031d894,79d1b364 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7b9979c7
  404. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d894 ret=7b9979c7
  405. 0024:Call ntdll.RtlInitUnicodeString(0031d88c,00000000) ret=7b9979de
  406. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d88c ret=7b9979de
  407. 0024:Call ntdll.NtCreateKey(0031db40,02000000,0031d840,00000000,0031d88c,00000000,00000000) ret=7b9973f9
  408. 0024:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  409. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  410. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  411. 0024:Ret advapi32.RegCreateKeyW() retval=00000000 ret=79cca099
  412. 0024:Call advapi32.RegQueryValueExW(00000090,79d17fc4 L"Cookies",00000000,0031db38,0031e05c,0031db34) ret=79cca152
  413. 0024:Call ntdll.RtlInitUnicodeString(0031d8a4,79d17fc4 L"Cookies") ret=7b99a47a
  414. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d8a4 ret=7b99a47a
  415. 0024:Call ntdll.NtQueryValueKey(00000090,0031d8a4,00000002,0031d7a0,00000100,0031d8a0) ret=7b99a4ea
  416. 0024:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  417. 0024:Call ntdll.memcpy(0031e05c,0031d7ac,00000074) ret=7b99a5df
  418. 0024:Ret ntdll.memcpy() retval=0031e05c ret=7b99a5df
  419. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  420. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  421. 0024:Ret advapi32.RegQueryValueExW() retval=00000000 ret=79cca152
  422. 0024:Call advapi32.RegCreateKeyExW(80000002,79d1b568 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0031d4c8,0031d07c) ret=79ccae04
  423. 0024:Call ntdll.RtlInitUnicodeString(0031d000,79d1b568 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") ret=7b9979c7
  424. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d000 ret=7b9979c7
  425. 0024:Call ntdll.RtlInitUnicodeString(0031cff8,00000000) ret=7b9979de
  426. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031cff8 ret=7b9979de
  427. 0024:Call ntdll.NtCreateKey(0031d4c8,000f003f,0031cfac,00000000,0031cff8,00000000,0031d07c) ret=7b9973f9
  428. 0024:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  429. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  430. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  431. 0024:Ret advapi32.RegCreateKeyExW() retval=00000000 ret=79ccae04
  432. 0024:Call KERNEL32.GetSystemDirectoryW(0031d2b0,00000104) ret=79ccb14f
  433. 0024:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=79ccb14f
  434. 0024:Call advapi32.RegQueryValueExW(00000094,79d1b644 L"ProfilesDirectory",00000000,0031d05c,0031d4cc,0031d058) ret=79ccaec6
  435. 0024:Call ntdll.RtlInitUnicodeString(0031cfc4,79d1b644 L"ProfilesDirectory") ret=7b99a47a
  436. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031cfc4 ret=7b99a47a
  437. 0024:Call ntdll.NtQueryValueKey(00000094,0031cfc4,00000002,0031cec0,00000100,0031cfc0) ret=7b99a4ea
  438. 0024:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  439. 0024:Call ntdll.memcpy(0031d4cc,0031cecc,00000012) ret=7b99a5df
  440. 0024:Ret ntdll.memcpy() retval=0031d4cc ret=7b99a5df
  441. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  442. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  443. 0024:Ret advapi32.RegQueryValueExW() retval=00000000 ret=79ccaec6
  444. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCookies",79d1b668 L"%ALLUSERSPROFILE%",00000011) ret=79cc7529
  445. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  446. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  447. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  448. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  449. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  450. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  451. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  452. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  453. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  454. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  455. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  456. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  457. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  458. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  459. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  460. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  461. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  462. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  463. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  464. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  465. 0024:Ret ucrtbase._wcsnicmp() retval=00000014 ret=79cc7529
  466. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCookies",79d1b440 L"%PUBLIC%",00000008) ret=79cc7529
  467. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  468. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  469. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  470. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  471. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  472. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  473. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  474. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  475. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  476. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  477. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  478. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  479. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  480. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  481. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  482. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  483. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  484. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  485. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  486. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  487. 0024:Ret ucrtbase._wcsnicmp() retval=00000005 ret=79cc7529
  488. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCookies",79d1b452 L"%ProgramData%",0000000d) ret=79cc7529
  489. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  490. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  491. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  492. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  493. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  494. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  495. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  496. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  497. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  498. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  499. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  500. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  501. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  502. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  503. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  504. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  505. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  506. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  507. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  508. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  509. 0024:Ret ucrtbase._wcsnicmp() retval=00000005 ret=79cc7529
  510. 0024:Call ucrtbase._wcsnicmp(0031d6d4 L"%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\INetCookies",79d1b424 L"%USERPROFILE%",0000000d) ret=79cc7529
  511. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  512. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  513. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  514. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  515. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  516. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  517. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  518. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  519. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  520. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  521. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  522. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  523. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  524. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  525. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  526. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  527. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  528. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  529. 0024:Call KERNEL32.HeapFree(003f0000,00000000,00000000) ret=7b4e40c5
  530. 0024:Ret KERNEL32.HeapFree() retval=00000001 ret=7b4e40c5
  531. 0024:Ret ucrtbase._wcsnicmp() retval=00000000 ret=79cc7529
  532. 0024:Call advapi32.GetUserNameW(0031d2b0,0031d4b8) ret=79ccb586
  533. 0024:Call ntdll.RtlInitUnicodeString(0031d01c,7b8b802a L"WINEUSERNAME") ret=7b9955a7
  534. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d01c ret=7b9955a7
  535. 0024:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0031d01c,0031d014) ret=7b9955eb
  536. 0024:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=00000000 ret=7b9955eb
  537. 0024:Ret advapi32.GetUserNameW() retval=00000001 ret=79ccb586
  538. 0024:Call shlwapi.PathAppendW(0031d92c L"C:\\users",0031d2b0 L"fabian") ret=79ccb5a0
  539. 0024:Call kernelbase.PathAppendW(0031d92c L"C:\\users",0031d2b0 L"fabian") ret=7be6a33c
  540. 0024:Ret kernelbase.PathAppendW() retval=00000001 ret=7be6a33c
  541. 0024:Ret shlwapi.PathAppendW() retval=00000001 ret=79ccb5a0
  542. 0024:Call shlwapi.PathAppendW(0031d92c L"C:\\users\\fabian",0031d6ee L"\\AppData\\Local\\Microsoft\\Windows\\INetCookies") ret=79ccb5ce
  543. 0024:Call kernelbase.PathAppendW(0031d92c L"C:\\users\\fabian",0031d6ee L"\\AppData\\Local\\Microsoft\\Windows\\INetCookies") ret=7be6a33c
  544. 0024:Ret kernelbase.PathAppendW() retval=00000001 ret=7be6a33c
  545. 0024:Ret shlwapi.PathAppendW() retval=00000001 ret=79ccb5ce
  546. 0024:Call advapi32.RegCloseKey(00000094) ret=79ccb720
  547. 0024:Call ntdll.NtClose(00000094) ret=7b998cd1
  548. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  549. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  550. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  551. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79ccb720
  552. 0024:Call advapi32.RegSetValueExW(0000008c,79d17fc4 L"Cookies",00000000,00000001,0031e05c,00000078) ret=79cca21e
  553. 0024:Call ntdll.RtlInitUnicodeString(0031d8bc,79d17fc4 L"Cookies") ret=7b999037
  554. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031d8bc ret=7b999037
  555. 0024:Call ntdll.NtSetValueKey(0000008c,0031d8bc,00000000,00000001,0031e05c,00000078) ret=7b99906b
  556. 0024:Ret ntdll.NtSetValueKey() retval=00000000 ret=7b99906b
  557. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b999078
  558. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b999078
  559. 0024:Ret advapi32.RegSetValueExW() retval=00000000 ret=79cca21e
  560. 0024:Call advapi32.RegCloseKey(0000008c) ret=79cca25a
  561. 0024:Call ntdll.NtClose(0000008c) ret=7b998cd1
  562. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  563. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  564. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  565. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79cca25a
  566. 0024:Call advapi32.RegCloseKey(00000090) ret=79cca26d
  567. 0024:Call ntdll.NtClose(00000090) ret=7b998cd1
  568. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  569. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  570. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  571. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=79cca26d
  572. 0024:Call shlwapi.PathFileExistsW(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCookies") ret=79ccc5ee
  573. 0024:Call kernelbase.PathFileExistsW(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCookies") ret=7be6a33c
  574. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,0000000c,0031df7c,00000004,00000000) ret=7b99371e
  575. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b99371e
  576. 0024:Call ntdll.NtSetInformationProcess(ffffffff,0000000c,0031dfa4,00000004) ret=7b994315
  577. 0024:Ret ntdll.NtSetInformationProcess() retval=00000000 ret=7b994315
  578. 0024:Call ntdll.RtlDosPathNameToNtPathName_U(0031e264 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCookies",0031df40,00000000,00000000) ret=7b95bf9a
  579. 0024:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95bf9a
  580. 0024:Call ntdll.NtQueryAttributesFile(0031df28,0031df48) ret=7b95c004
  581. 0024:Ret ntdll.NtQueryAttributesFile() retval=00000000 ret=7b95c004
  582. 0024:Call ntdll.RtlFreeUnicodeString(0031df40) ret=7b95c017
  583. 0024:Ret ntdll.RtlFreeUnicodeString() retval=0031df40 ret=7b95c017
  584. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,0000000c,0031df7c,00000004,00000000) ret=7b99371e
  585. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b99371e
  586. 0024:Call ntdll.NtSetInformationProcess(ffffffff,0000000c,0031dfa4,00000004) ret=7b994315
  587. 0024:Ret ntdll.NtSetInformationProcess() retval=00000000 ret=7b994315
  588. 0024:Ret kernelbase.PathFileExistsW() retval=00000001 ret=7be6a33c
  589. 0024:Ret shlwapi.PathFileExistsW() retval=00000001 ret=79ccc5ee
  590. 0024:Ret shell32.SHGetSpecialFolderPathW() retval=00000001 ret=790d4902
  591. 0024:Call KERNEL32.WideCharToMultiByte(00000000,00000400,0031e544 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\",0000003b,00000000,00000000,00000000,0031eb5c) ret=790d4acb
  592. 0024:Ret KERNEL32.WideCharToMultiByte() retval=0000003b ret=790d4acb
  593. 0024:Call ucrtbase.malloc(00000020) ret=790d4698
  594. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000020) ret=7b4e3ed8
  595. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0838 ret=7b4e3ed8
  596. 0024:Ret ucrtbase.malloc() retval=003f0838 ret=790d4698
  597. 0024:Call ucrtbase.strlen(790edf18 "Cookie:") ret=790d46a8
  598. 0024:Ret ucrtbase.strlen() retval=00000007 ret=790d46a8
  599. 0024:Call ucrtbase._wcsdup(0031e544 L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") ret=790d2b94
  600. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000007a) ret=7b4e3ed8
  601. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2b18 ret=7b4e3ed8
  602. 0024:Ret ucrtbase._wcsdup() retval=003f2b18 ret=790d2b94
  603. 0024:Call ucrtbase.malloc(00000008) ret=790d471a
  604. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000008) ret=7b4e3ed8
  605. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0860 ret=7b4e3ed8
  606. 0024:Ret ucrtbase.malloc() retval=003f0860 ret=790d471a
  607. 0024:Call ucrtbase.memcpy(003f0860,790edf18,00000008) ret=790d4776
  608. 0024:Ret ucrtbase.memcpy() retval=003f0860 ret=790d4776
  609. 0024:Call user32.CharLowerW(0031e74c L"C:\\users\\fabian\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") ret=790d4783
  610. 0024:Ret user32.CharLowerW() retval=0031e74c ret=790d4783
  611. 0024:Call KERNEL32.CreateMutexW(00000000,00000000,0031e74c L"c:!users!fabian!appdata!local!microsoft!windows!inetcookies!") ret=790d47b6
  612. 0024:Call ntdll.RtlInitUnicodeString(0031e480,0031e74c L"c:!users!fabian!appdata!local!microsoft!windows!inetcookies!") ret=7b9a987b
  613. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e480 ret=7b9a987b
  614. 0024:Call ntdll.NtCreateMutant(0031e488,001f0001,0031e468,00000000) ret=7b9aac6f
  615. 0024:Ret ntdll.NtCreateMutant() retval=00000000 ret=7b9aac6f
  616. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9aaca8
  617. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9aaca8
  618. 0024:Ret KERNEL32.CreateMutexW() retval=0000008c ret=790d47b6
  619. 0024:Ret PE DLL (proc=790E28D8,module=790A0000 L"WININET.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  620. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  621. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  622. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  623. 0024:Ret KERNEL32.LoadLibraryA() retval=790a0000 ret=03ccc40e
  624. 0024:Call KERNEL32.GetProcAddress(790a0000,043b07da "InternetReadFile") ret=03cc3d81
  625. 0024:Ret KERNEL32.GetProcAddress() retval=790a27c8 ret=03cc3d81
  626. 0024:Call KERNEL32.GetProcAddress(790a0000,043b07c6 "InternetConnectA") ret=03cc3d81
  627. 0024:Ret KERNEL32.GetProcAddress() retval=790a2268 ret=03cc3d81
  628. 0024:Call KERNEL32.GetProcAddress(790a0000,043b073e "InternetCloseHandle") ret=03cc3d81
  629. 0024:Ret KERNEL32.GetProcAddress() retval=790a21a8 ret=03cc3d81
  630. 0024:Call KERNEL32.GetProcAddress(790a0000,043b0754 "InternetOpenUrlA") ret=03cc3d81
  631. 0024:Ret KERNEL32.GetProcAddress() retval=790a26e8 ret=03cc3d81
  632. 0024:Call KERNEL32.GetProcAddress(790a0000,043b0768 "InternetSetOptionW") ret=03cc3d81
  633. 0024:Ret KERNEL32.GetProcAddress() retval=790a2928 ret=03cc3d81
  634. 0024:Call KERNEL32.GetProcAddress(790a0000,043b077e "InternetOpenW") ret=03cc3d81
  635. 0024:Ret KERNEL32.GetProcAddress() retval=790a2728 ret=03cc3d81
  636. 0024:Call KERNEL32.GetProcAddress(790a0000,043b078e "InternetOpenA") ret=03cc3d81
  637. 0024:Ret KERNEL32.GetProcAddress() retval=790a26c8 ret=03cc3d81
  638. 0024:Call KERNEL32.GetProcAddress(790a0000,043b079e "HttpSendRequestA") ret=03cc3d81
  639. 0024:Ret KERNEL32.GetProcAddress() retval=790a2008 ret=03cc3d81
  640. 0024:Call KERNEL32.GetProcAddress(790a0000,043b07b2 "HttpOpenRequestA") ret=03cc3d81
  641. 0024:Ret KERNEL32.GetProcAddress() retval=790a1f88 ret=03cc3d81
  642. 0024:Call KERNEL32.LoadLibraryA(043b0806 "MSIMG32.dll") ret=03ccc40e
  643. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b0806 "MSIMG32.dll") ret=7b9585a9
  644. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  645. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  646. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  647. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"MSIMG32.dll") ret=7b9650f0
  648. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  649. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"MSIMG32.dll",00000000,0031ee38,0031ee34) ret=7b964536
  650. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  651. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  652. 0024:Call PE DLL (proc=790211D4,module=79020000 L"MSIMG32.dll",reason=PROCESS_ATTACH,res=00000000)
  653. 0024:Call KERNEL32.DisableThreadLibraryCalls(79020000) ret=79021c59
  654. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(79020000) ret=7b9647c0
  655. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  656. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=79021c59
  657. 0024:Ret PE DLL (proc=790211D4,module=79020000 L"MSIMG32.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  658. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  659. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  660. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  661. 0024:Ret KERNEL32.LoadLibraryA() retval=79020000 ret=03ccc40e
  662. 0024:Call KERNEL32.GetProcAddress(79020000,043b07fa "AlphaBlend") ret=03cc3d81
  663. 0024:Ret KERNEL32.GetProcAddress() retval=7aa6260c ret=03cc3d81
  664. 0024:Call KERNEL32.LoadLibraryA(043b0868 "SHLWAPI.dll") ret=03ccc40e
  665. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b0868 "SHLWAPI.dll") ret=7b9585a9
  666. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  667. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  668. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  669. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"SHLWAPI.dll") ret=7b9650f0
  670. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  671. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"SHLWAPI.dll",00000000,0031ee38,0031ee34) ret=7b964536
  672. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  673. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  674. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  675. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  676. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  677. 0024:Ret KERNEL32.LoadLibraryA() retval=79bb0000 ret=03ccc40e
  678. 0024:Call KERNEL32.GetProcAddress(79bb0000,043b0814 "PathFileExistsW") ret=03cc3d81
  679. 0024:Ret KERNEL32.GetProcAddress() retval=79bb410c ret=03cc3d81
  680. 0024:Call KERNEL32.GetProcAddress(79bb0000,043b0826 "PathCombineW") ret=03cc3d81
  681. 0024:Ret KERNEL32.GetProcAddress() retval=79bb3fac ret=03cc3d81
  682. 0024:Call KERNEL32.GetProcAddress(79bb0000,043b085a "PathCombineA") ret=03cc3d81
  683. 0024:Ret KERNEL32.GetProcAddress() retval=79bb3f8c ret=03cc3d81
  684. 0024:Call KERNEL32.GetProcAddress(79bb0000,043b0836 "PathAppendW") ret=03cc3d81
  685. 0024:Ret KERNEL32.GetProcAddress() retval=79bb3eec ret=03cc3d81
  686. 0024:Call KERNEL32.GetProcAddress(79bb0000,043b0844 "PathRemoveFileSpecW") ret=03cc3d81
  687. 0024:Ret KERNEL32.GetProcAddress() retval=79bb49cc ret=03cc3d81
  688. 0024:Call KERNEL32.LoadLibraryA(043b08b6 "VERSION.dll") ret=03ccc40e
  689. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b08b6 "VERSION.dll") ret=7b9585a9
  690. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  691. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  692. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  693. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"VERSION.dll") ret=7b9650f0
  694. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  695. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"VERSION.dll",00000000,0031ee38,0031ee34) ret=7b964536
  696. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  697. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  698. 0024:Call PE DLL (proc=78FF2860,module=78FF0000 L"VERSION.dll",reason=PROCESS_ATTACH,res=00000000)
  699. 0024:Call KERNEL32.DisableThreadLibraryCalls(78ff0000) ret=78ff32e5
  700. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(78ff0000) ret=7b9647c0
  701. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  702. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=78ff32e5
  703. 0024:Ret PE DLL (proc=78FF2860,module=78FF0000 L"VERSION.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  704. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  705. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  706. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  707. 0024:Ret KERNEL32.LoadLibraryA() retval=78ff0000 ret=03ccc40e
  708. 0024:Call KERNEL32.GetProcAddress(78ff0000,043b089e "GetFileVersionInfoSizeW") ret=03cc3d81
  709. 0024:Ret KERNEL32.GetProcAddress() retval=78ff10cc ret=03cc3d81
  710. 0024:Call KERNEL32.GetProcAddress(78ff0000,043b0888 "GetFileVersionInfoW") ret=03cc3d81
  711. 0024:Ret KERNEL32.GetProcAddress() retval=78ff10ec ret=03cc3d81
  712. 0024:Call KERNEL32.GetProcAddress(78ff0000,043b0876 "VerQueryValueW") ret=03cc3d81
  713. 0024:Ret KERNEL32.GetProcAddress() retval=78ff11a8 ret=03cc3d81
  714. 0024:Call KERNEL32.LoadLibraryA(043b091e "PSAPI.DLL") ret=03ccc40e
  715. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b091e "PSAPI.DLL") ret=7b9585a9
  716. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  717. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  718. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  719. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"PSAPI.DLL") ret=7b9650f0
  720. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  721. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"PSAPI.DLL",00000000,0031ee38,0031ee34) ret=7b964536
  722. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  723. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  724. 0024:Call PE DLL (proc=78FD157C,module=78FD0000 L"PSAPI.DLL",reason=PROCESS_ATTACH,res=00000000)
  725. 0024:Call KERNEL32.DisableThreadLibraryCalls(78fd0000) ret=78fd15bd
  726. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(78fd0000) ret=7b9647c0
  727. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  728. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=78fd15bd
  729. 0024:Ret PE DLL (proc=78FD157C,module=78FD0000 L"PSAPI.DLL",reason=PROCESS_ATTACH,res=00000000) retval=1
  730. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  731. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  732. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  733. 0024:Ret KERNEL32.LoadLibraryA() retval=78fd0000 ret=03ccc40e
  734. 0024:Call KERNEL32.GetProcAddress(78fd0000,043b08f4 "GetModuleBaseNameW") ret=03cc3d81
  735. 0024:Ret KERNEL32.GetProcAddress() retval=78fd11c8 ret=03cc3d81
  736. 0024:Call KERNEL32.GetProcAddress(78fd0000,043b08dc "GetModuleFileNameExW") ret=03cc3d81
  737. 0024:Ret KERNEL32.GetProcAddress() retval=78fd1208 ret=03cc3d81
  738. 0024:Call KERNEL32.GetProcAddress(78fd0000,043b08c4 "GetModuleInformation") ret=03cc3d81
  739. 0024:Ret KERNEL32.GetProcAddress() retval=78fd1228 ret=03cc3d81
  740. 0024:Call KERNEL32.GetProcAddress(78fd0000,043b090a "EnumProcessModules") ret=03cc3d81
  741. 0024:Ret KERNEL32.GetProcAddress() retval=78fd108c ret=03cc3d81
  742. 0024:Call KERNEL32.LoadLibraryA(043b0a08 "WINTRUST.dll") ret=03ccc40e
  743. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b0a08 "WINTRUST.dll") ret=7b9585a9
  744. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  745. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  746. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  747. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"WINTRUST.dll") ret=7b9650f0
  748. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  749. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"WINTRUST.dll",00000000,0031ee38,0031ee34) ret=7b964536
  750. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  751. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  752. 0024:Call PE DLL (proc=78D1B2A4,module=78D10000 L"bcrypt.dll",reason=PROCESS_ATTACH,res=00000000)
  753. 0024:Call KERNEL32.DisableThreadLibraryCalls(78d10000) ret=78d19822
  754. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(78d10000) ret=7b9647c0
  755. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  756. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=78d19822
  757. 0024:Call KERNEL32.GetModuleHandleW(78d1fd3c L"ntdll.dll") ret=78d1bd72
  758. 0024:Call ntdll.RtlInitUnicodeString(0031ea24,78d1fd3c L"ntdll.dll") ret=7b964e60
  759. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ea24 ret=7b964e60
  760. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031ea24,0031ea30) ret=7b964e8e
  761. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  762. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=78d1bd72
  763. 0024:Call KERNEL32.GetProcAddress(7be20000,78d1fd50 "__wine_unix_call_dispatcher") ret=78d1bd8d
  764. 0024:Ret KERNEL32.GetProcAddress() retval=7be93230 ret=78d1bd8d
  765. 0024:Call ntdll.NtQueryVirtualMemory(ffffffff,78d10000,000003e8,78d220a0,00000008,00000000) ret=78d1bdd8
  766. 0024:Ret ntdll.NtQueryVirtualMemory() retval=00000000 ret=78d1bdd8
  767. 0024:Ret PE DLL (proc=78D1B2A4,module=78D10000 L"bcrypt.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  768. 0024:Call PE DLL (proc=78DBC770,module=78D50000 L"crypt32.dll",reason=PROCESS_ATTACH,res=00000000)
  769. 0024:Call KERNEL32.DisableThreadLibraryCalls(78d50000) ret=78d90a07
  770. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(78d50000) ret=7b9647c0
  771. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  772. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=78d90a07
  773. 0024:Call user32.LoadStringW(78d50000,00000475,78de0c80,00000100) ret=78da5df7
  774. 0024:Call ntdll.LdrFindResource_U(78d50000,0031e9e4,00000003,0031e9e0) ret=7b966d5b
  775. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  776. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea40,00000000) ret=7b966f9d
  777. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  778. 0024:Ret user32.LoadStringW() retval=00000026 ret=78da5df7
  779. 0024:Call user32.LoadStringW(78d50000,00000476,78de0e80,00000100) ret=78da5df7
  780. 0024:Call ntdll.LdrFindResource_U(78d50000,0031e9e4,00000003,0031e9e0) ret=7b966d5b
  781. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  782. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea40,00000000) ret=7b966f9d
  783. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  784. 0024:Ret user32.LoadStringW() retval=00000008 ret=78da5df7
  785. 0024:Call user32.LoadStringW(78d50000,00000477,78de1080,00000100) ret=78da5df7
  786. 0024:Call ntdll.LdrFindResource_U(78d50000,0031e9e4,00000003,0031e9e0) ret=7b966d5b
  787. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  788. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea40,00000000) ret=7b966f9d
  789. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  790. 0024:Ret user32.LoadStringW() retval=00000026 ret=78da5df7
  791. 0024:Call user32.LoadStringW(78d50000,00000478,78de1280,00000100) ret=78da5df7
  792. 0024:Call ntdll.LdrFindResource_U(78d50000,0031e9e4,00000003,0031e9e0) ret=7b966d5b
  793. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  794. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea40,00000000) ret=7b966f9d
  795. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  796. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da5df7
  797. 0024:Call user32.LoadStringW(78d50000,00000479,78de1480,00000100) ret=78da5df7
  798. 0024:Call ntdll.LdrFindResource_U(78d50000,0031e9e4,00000003,0031e9e0) ret=7b966d5b
  799. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  800. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea40,00000000) ret=7b966f9d
  801. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  802. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da5df7
  803. 0024:Call user32.LoadStringW(78d50000,0000047a,78de1680,00000100) ret=78da5df7
  804. 0024:Call ntdll.LdrFindResource_U(78d50000,0031e9e4,00000003,0031e9e0) ret=7b966d5b
  805. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  806. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea40,00000000) ret=7b966f9d
  807. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  808. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da5df7
  809. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  810. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  811. 0024:Ret ntdll.RtlAllocateHeap() retval=003f0878 ret=7b4e3ed8
  812. 0024:Ret ucrtbase.malloc() retval=003f0878 ret=78d90dd2
  813. 0024:Call ucrtbase.memset(003f0878,00000000,0000002c) ret=78da6501
  814. 0024:Ret ucrtbase.memset() retval=003f0878 ret=78da6501
  815. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  816. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  817. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2ba0 ret=7b4e3ed8
  818. 0024:Ret ucrtbase.malloc() retval=003f2ba0 ret=78d90dd2
  819. 0024:Call ucrtbase.memset(003f2ba0,00000000,0000002c) ret=78da6501
  820. 0024:Ret ucrtbase.memset() retval=003f2ba0 ret=78da6501
  821. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  822. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  823. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2bd8 ret=7b4e3ed8
  824. 0024:Ret ucrtbase.malloc() retval=003f2bd8 ret=78d90dd2
  825. 0024:Call ucrtbase.memset(003f2bd8,00000000,0000002c) ret=78da6501
  826. 0024:Ret ucrtbase.memset() retval=003f2bd8 ret=78da6501
  827. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  828. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  829. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2c10 ret=7b4e3ed8
  830. 0024:Ret ucrtbase.malloc() retval=003f2c10 ret=78d90dd2
  831. 0024:Call ucrtbase.memset(003f2c10,00000000,0000002c) ret=78da6501
  832. 0024:Ret ucrtbase.memset() retval=003f2c10 ret=78da6501
  833. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  834. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  835. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2c48 ret=7b4e3ed8
  836. 0024:Ret ucrtbase.malloc() retval=003f2c48 ret=78d90dd2
  837. 0024:Call ucrtbase.memset(003f2c48,00000000,0000002c) ret=78da6501
  838. 0024:Ret ucrtbase.memset() retval=003f2c48 ret=78da6501
  839. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  840. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  841. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2c80 ret=7b4e3ed8
  842. 0024:Ret ucrtbase.malloc() retval=003f2c80 ret=78d90dd2
  843. 0024:Call ucrtbase.memset(003f2c80,00000000,0000002c) ret=78da6501
  844. 0024:Ret ucrtbase.memset() retval=003f2c80 ret=78da6501
  845. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  846. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  847. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2cb8 ret=7b4e3ed8
  848. 0024:Ret ucrtbase.malloc() retval=003f2cb8 ret=78d90dd2
  849. 0024:Call ucrtbase.memset(003f2cb8,00000000,0000002c) ret=78da6501
  850. 0024:Ret ucrtbase.memset() retval=003f2cb8 ret=78da6501
  851. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  852. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  853. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2cf0 ret=7b4e3ed8
  854. 0024:Ret ucrtbase.malloc() retval=003f2cf0 ret=78d90dd2
  855. 0024:Call ucrtbase.memset(003f2cf0,00000000,0000002c) ret=78da6501
  856. 0024:Ret ucrtbase.memset() retval=003f2cf0 ret=78da6501
  857. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  858. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  859. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2d28 ret=7b4e3ed8
  860. 0024:Ret ucrtbase.malloc() retval=003f2d28 ret=78d90dd2
  861. 0024:Call ucrtbase.memset(003f2d28,00000000,0000002c) ret=78da6501
  862. 0024:Ret ucrtbase.memset() retval=003f2d28 ret=78da6501
  863. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  864. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  865. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2d60 ret=7b4e3ed8
  866. 0024:Ret ucrtbase.malloc() retval=003f2d60 ret=78d90dd2
  867. 0024:Call ucrtbase.memset(003f2d60,00000000,0000002c) ret=78da6501
  868. 0024:Ret ucrtbase.memset() retval=003f2d60 ret=78da6501
  869. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  870. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  871. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2d98 ret=7b4e3ed8
  872. 0024:Ret ucrtbase.malloc() retval=003f2d98 ret=78d90dd2
  873. 0024:Call ucrtbase.memset(003f2d98,00000000,0000002c) ret=78da6501
  874. 0024:Ret ucrtbase.memset() retval=003f2d98 ret=78da6501
  875. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  876. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  877. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2dd0 ret=7b4e3ed8
  878. 0024:Ret ucrtbase.malloc() retval=003f2dd0 ret=78d90dd2
  879. 0024:Call ucrtbase.memset(003f2dd0,00000000,0000002c) ret=78da6501
  880. 0024:Ret ucrtbase.memset() retval=003f2dd0 ret=78da6501
  881. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  882. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  883. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2e08 ret=7b4e3ed8
  884. 0024:Ret ucrtbase.malloc() retval=003f2e08 ret=78d90dd2
  885. 0024:Call ucrtbase.memset(003f2e08,00000000,0000002c) ret=78da6501
  886. 0024:Ret ucrtbase.memset() retval=003f2e08 ret=78da6501
  887. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  888. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  889. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2e40 ret=7b4e3ed8
  890. 0024:Ret ucrtbase.malloc() retval=003f2e40 ret=78d90dd2
  891. 0024:Call ucrtbase.memset(003f2e40,00000000,0000002c) ret=78da6501
  892. 0024:Ret ucrtbase.memset() retval=003f2e40 ret=78da6501
  893. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  894. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  895. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2e78 ret=7b4e3ed8
  896. 0024:Ret ucrtbase.malloc() retval=003f2e78 ret=78d90dd2
  897. 0024:Call ucrtbase.memset(003f2e78,00000000,0000002c) ret=78da6501
  898. 0024:Ret ucrtbase.memset() retval=003f2e78 ret=78da6501
  899. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  900. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  901. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2eb0 ret=7b4e3ed8
  902. 0024:Ret ucrtbase.malloc() retval=003f2eb0 ret=78d90dd2
  903. 0024:Call ucrtbase.memset(003f2eb0,00000000,0000002c) ret=78da6501
  904. 0024:Ret ucrtbase.memset() retval=003f2eb0 ret=78da6501
  905. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  906. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  907. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2f00 ret=7b4e3ed8
  908. 0024:Ret ucrtbase.malloc() retval=003f2f00 ret=78d90dd2
  909. 0024:Call ucrtbase.memset(003f2f00,00000000,0000002c) ret=78da6501
  910. 0024:Ret ucrtbase.memset() retval=003f2f00 ret=78da6501
  911. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  912. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  913. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2f40 ret=7b4e3ed8
  914. 0024:Ret ucrtbase.malloc() retval=003f2f40 ret=78d90dd2
  915. 0024:Call ucrtbase.memset(003f2f40,00000000,0000002c) ret=78da6501
  916. 0024:Ret ucrtbase.memset() retval=003f2f40 ret=78da6501
  917. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  918. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  919. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2f80 ret=7b4e3ed8
  920. 0024:Ret ucrtbase.malloc() retval=003f2f80 ret=78d90dd2
  921. 0024:Call ucrtbase.memset(003f2f80,00000000,0000002c) ret=78da6501
  922. 0024:Ret ucrtbase.memset() retval=003f2f80 ret=78da6501
  923. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  924. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  925. 0024:Ret ntdll.RtlAllocateHeap() retval=003f2fc0 ret=7b4e3ed8
  926. 0024:Ret ucrtbase.malloc() retval=003f2fc0 ret=78d90dd2
  927. 0024:Call ucrtbase.memset(003f2fc0,00000000,0000002c) ret=78da6501
  928. 0024:Ret ucrtbase.memset() retval=003f2fc0 ret=78da6501
  929. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  930. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  931. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3000 ret=7b4e3ed8
  932. 0024:Ret ucrtbase.malloc() retval=003f3000 ret=78d90dd2
  933. 0024:Call ucrtbase.memset(003f3000,00000000,0000002c) ret=78da6501
  934. 0024:Ret ucrtbase.memset() retval=003f3000 ret=78da6501
  935. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  936. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  937. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3040 ret=7b4e3ed8
  938. 0024:Ret ucrtbase.malloc() retval=003f3040 ret=78d90dd2
  939. 0024:Call ucrtbase.memset(003f3040,00000000,0000002c) ret=78da6501
  940. 0024:Ret ucrtbase.memset() retval=003f3040 ret=78da6501
  941. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  942. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  943. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3080 ret=7b4e3ed8
  944. 0024:Ret ucrtbase.malloc() retval=003f3080 ret=78d90dd2
  945. 0024:Call ucrtbase.memset(003f3080,00000000,0000002c) ret=78da6501
  946. 0024:Ret ucrtbase.memset() retval=003f3080 ret=78da6501
  947. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  948. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  949. 0024:Ret ntdll.RtlAllocateHeap() retval=003f30c0 ret=7b4e3ed8
  950. 0024:Ret ucrtbase.malloc() retval=003f30c0 ret=78d90dd2
  951. 0024:Call ucrtbase.memset(003f30c0,00000000,0000002c) ret=78da6501
  952. 0024:Ret ucrtbase.memset() retval=003f30c0 ret=78da6501
  953. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  954. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  955. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3100 ret=7b4e3ed8
  956. 0024:Ret ucrtbase.malloc() retval=003f3100 ret=78d90dd2
  957. 0024:Call ucrtbase.memset(003f3100,00000000,0000002c) ret=78da6501
  958. 0024:Ret ucrtbase.memset() retval=003f3100 ret=78da6501
  959. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  960. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  961. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3140 ret=7b4e3ed8
  962. 0024:Ret ucrtbase.malloc() retval=003f3140 ret=78d90dd2
  963. 0024:Call ucrtbase.memset(003f3140,00000000,0000002c) ret=78da6501
  964. 0024:Ret ucrtbase.memset() retval=003f3140 ret=78da6501
  965. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  966. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  967. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3180 ret=7b4e3ed8
  968. 0024:Ret ucrtbase.malloc() retval=003f3180 ret=78d90dd2
  969. 0024:Call ucrtbase.memset(003f3180,00000000,0000002c) ret=78da6501
  970. 0024:Ret ucrtbase.memset() retval=003f3180 ret=78da6501
  971. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  972. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  973. 0024:Ret ntdll.RtlAllocateHeap() retval=003f31c0 ret=7b4e3ed8
  974. 0024:Ret ucrtbase.malloc() retval=003f31c0 ret=78d90dd2
  975. 0024:Call ucrtbase.memset(003f31c0,00000000,0000002c) ret=78da6501
  976. 0024:Ret ucrtbase.memset() retval=003f31c0 ret=78da6501
  977. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  978. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  979. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3200 ret=7b4e3ed8
  980. 0024:Ret ucrtbase.malloc() retval=003f3200 ret=78d90dd2
  981. 0024:Call ucrtbase.memset(003f3200,00000000,0000002c) ret=78da6501
  982. 0024:Ret ucrtbase.memset() retval=003f3200 ret=78da6501
  983. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  984. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  985. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3240 ret=7b4e3ed8
  986. 0024:Ret ucrtbase.malloc() retval=003f3240 ret=78d90dd2
  987. 0024:Call ucrtbase.memset(003f3240,00000000,0000002c) ret=78da6501
  988. 0024:Ret ucrtbase.memset() retval=003f3240 ret=78da6501
  989. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  990. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  991. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3280 ret=7b4e3ed8
  992. 0024:Ret ucrtbase.malloc() retval=003f3280 ret=78d90dd2
  993. 0024:Call ucrtbase.memset(003f3280,00000000,0000002c) ret=78da6501
  994. 0024:Ret ucrtbase.memset() retval=003f3280 ret=78da6501
  995. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  996. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  997. 0024:Ret ntdll.RtlAllocateHeap() retval=003f32c0 ret=7b4e3ed8
  998. 0024:Ret ucrtbase.malloc() retval=003f32c0 ret=78d90dd2
  999. 0024:Call ucrtbase.memset(003f32c0,00000000,0000002c) ret=78da6501
  1000. 0024:Ret ucrtbase.memset() retval=003f32c0 ret=78da6501
  1001. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1002. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1003. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3300 ret=7b4e3ed8
  1004. 0024:Ret ucrtbase.malloc() retval=003f3300 ret=78d90dd2
  1005. 0024:Call ucrtbase.memset(003f3300,00000000,0000002c) ret=78da6501
  1006. 0024:Ret ucrtbase.memset() retval=003f3300 ret=78da6501
  1007. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1008. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1009. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3340 ret=7b4e3ed8
  1010. 0024:Ret ucrtbase.malloc() retval=003f3340 ret=78d90dd2
  1011. 0024:Call ucrtbase.memset(003f3340,00000000,0000002c) ret=78da6501
  1012. 0024:Ret ucrtbase.memset() retval=003f3340 ret=78da6501
  1013. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1014. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1015. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3380 ret=7b4e3ed8
  1016. 0024:Ret ucrtbase.malloc() retval=003f3380 ret=78d90dd2
  1017. 0024:Call ucrtbase.memset(003f3380,00000000,0000002c) ret=78da6501
  1018. 0024:Ret ucrtbase.memset() retval=003f3380 ret=78da6501
  1019. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1020. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1021. 0024:Ret ntdll.RtlAllocateHeap() retval=003f33c0 ret=7b4e3ed8
  1022. 0024:Ret ucrtbase.malloc() retval=003f33c0 ret=78d90dd2
  1023. 0024:Call ucrtbase.memset(003f33c0,00000000,0000002c) ret=78da6501
  1024. 0024:Ret ucrtbase.memset() retval=003f33c0 ret=78da6501
  1025. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1026. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1027. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3400 ret=7b4e3ed8
  1028. 0024:Ret ucrtbase.malloc() retval=003f3400 ret=78d90dd2
  1029. 0024:Call ucrtbase.memset(003f3400,00000000,0000002c) ret=78da6501
  1030. 0024:Ret ucrtbase.memset() retval=003f3400 ret=78da6501
  1031. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1032. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1033. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3440 ret=7b4e3ed8
  1034. 0024:Ret ucrtbase.malloc() retval=003f3440 ret=78d90dd2
  1035. 0024:Call ucrtbase.memset(003f3440,00000000,0000002c) ret=78da6501
  1036. 0024:Ret ucrtbase.memset() retval=003f3440 ret=78da6501
  1037. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1038. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1039. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3480 ret=7b4e3ed8
  1040. 0024:Ret ucrtbase.malloc() retval=003f3480 ret=78d90dd2
  1041. 0024:Call ucrtbase.memset(003f3480,00000000,0000002c) ret=78da6501
  1042. 0024:Ret ucrtbase.memset() retval=003f3480 ret=78da6501
  1043. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1044. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1045. 0024:Ret ntdll.RtlAllocateHeap() retval=003f34c0 ret=7b4e3ed8
  1046. 0024:Ret ucrtbase.malloc() retval=003f34c0 ret=78d90dd2
  1047. 0024:Call ucrtbase.memset(003f34c0,00000000,0000002c) ret=78da6501
  1048. 0024:Ret ucrtbase.memset() retval=003f34c0 ret=78da6501
  1049. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1050. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1051. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3500 ret=7b4e3ed8
  1052. 0024:Ret ucrtbase.malloc() retval=003f3500 ret=78d90dd2
  1053. 0024:Call ucrtbase.memset(003f3500,00000000,0000002c) ret=78da6501
  1054. 0024:Ret ucrtbase.memset() retval=003f3500 ret=78da6501
  1055. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1056. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1057. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3540 ret=7b4e3ed8
  1058. 0024:Ret ucrtbase.malloc() retval=003f3540 ret=78d90dd2
  1059. 0024:Call ucrtbase.memset(003f3540,00000000,0000002c) ret=78da6501
  1060. 0024:Ret ucrtbase.memset() retval=003f3540 ret=78da6501
  1061. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1062. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1063. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3580 ret=7b4e3ed8
  1064. 0024:Ret ucrtbase.malloc() retval=003f3580 ret=78d90dd2
  1065. 0024:Call ucrtbase.memset(003f3580,00000000,0000002c) ret=78da6501
  1066. 0024:Ret ucrtbase.memset() retval=003f3580 ret=78da6501
  1067. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1068. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1069. 0024:Ret ntdll.RtlAllocateHeap() retval=003f35c0 ret=7b4e3ed8
  1070. 0024:Ret ucrtbase.malloc() retval=003f35c0 ret=78d90dd2
  1071. 0024:Call ucrtbase.memset(003f35c0,00000000,0000002c) ret=78da6501
  1072. 0024:Ret ucrtbase.memset() retval=003f35c0 ret=78da6501
  1073. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1074. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1075. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3600 ret=7b4e3ed8
  1076. 0024:Ret ucrtbase.malloc() retval=003f3600 ret=78d90dd2
  1077. 0024:Call ucrtbase.memset(003f3600,00000000,0000002c) ret=78da6501
  1078. 0024:Ret ucrtbase.memset() retval=003f3600 ret=78da6501
  1079. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1080. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1081. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3640 ret=7b4e3ed8
  1082. 0024:Ret ucrtbase.malloc() retval=003f3640 ret=78d90dd2
  1083. 0024:Call ucrtbase.memset(003f3640,00000000,0000002c) ret=78da6501
  1084. 0024:Ret ucrtbase.memset() retval=003f3640 ret=78da6501
  1085. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1086. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1087. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3680 ret=7b4e3ed8
  1088. 0024:Ret ucrtbase.malloc() retval=003f3680 ret=78d90dd2
  1089. 0024:Call ucrtbase.memset(003f3680,00000000,0000002c) ret=78da6501
  1090. 0024:Ret ucrtbase.memset() retval=003f3680 ret=78da6501
  1091. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1092. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1093. 0024:Ret ntdll.RtlAllocateHeap() retval=003f36d8 ret=7b4e3ed8
  1094. 0024:Ret ucrtbase.malloc() retval=003f36d8 ret=78d90dd2
  1095. 0024:Call ucrtbase.memset(003f36d8,00000000,0000002c) ret=78da6501
  1096. 0024:Ret ucrtbase.memset() retval=003f36d8 ret=78da6501
  1097. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1098. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1099. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3718 ret=7b4e3ed8
  1100. 0024:Ret ucrtbase.malloc() retval=003f3718 ret=78d90dd2
  1101. 0024:Call ucrtbase.memset(003f3718,00000000,0000002c) ret=78da6501
  1102. 0024:Ret ucrtbase.memset() retval=003f3718 ret=78da6501
  1103. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1104. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1105. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3758 ret=7b4e3ed8
  1106. 0024:Ret ucrtbase.malloc() retval=003f3758 ret=78d90dd2
  1107. 0024:Call ucrtbase.memset(003f3758,00000000,0000002c) ret=78da6501
  1108. 0024:Ret ucrtbase.memset() retval=003f3758 ret=78da6501
  1109. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1110. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1111. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3798 ret=7b4e3ed8
  1112. 0024:Ret ucrtbase.malloc() retval=003f3798 ret=78d90dd2
  1113. 0024:Call ucrtbase.memset(003f3798,00000000,0000002c) ret=78da6501
  1114. 0024:Ret ucrtbase.memset() retval=003f3798 ret=78da6501
  1115. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1116. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1117. 0024:Ret ntdll.RtlAllocateHeap() retval=003f37d8 ret=7b4e3ed8
  1118. 0024:Ret ucrtbase.malloc() retval=003f37d8 ret=78d90dd2
  1119. 0024:Call ucrtbase.memset(003f37d8,00000000,0000002c) ret=78da6501
  1120. 0024:Ret ucrtbase.memset() retval=003f37d8 ret=78da6501
  1121. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1122. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1123. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3818 ret=7b4e3ed8
  1124. 0024:Ret ucrtbase.malloc() retval=003f3818 ret=78d90dd2
  1125. 0024:Call ucrtbase.memset(003f3818,00000000,0000002c) ret=78da6501
  1126. 0024:Ret ucrtbase.memset() retval=003f3818 ret=78da6501
  1127. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1128. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1129. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3858 ret=7b4e3ed8
  1130. 0024:Ret ucrtbase.malloc() retval=003f3858 ret=78d90dd2
  1131. 0024:Call ucrtbase.memset(003f3858,00000000,0000002c) ret=78da6501
  1132. 0024:Ret ucrtbase.memset() retval=003f3858 ret=78da6501
  1133. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1134. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1135. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3898 ret=7b4e3ed8
  1136. 0024:Ret ucrtbase.malloc() retval=003f3898 ret=78d90dd2
  1137. 0024:Call ucrtbase.memset(003f3898,00000000,0000002c) ret=78da6501
  1138. 0024:Ret ucrtbase.memset() retval=003f3898 ret=78da6501
  1139. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1140. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1141. 0024:Ret ntdll.RtlAllocateHeap() retval=003f38d8 ret=7b4e3ed8
  1142. 0024:Ret ucrtbase.malloc() retval=003f38d8 ret=78d90dd2
  1143. 0024:Call ucrtbase.memset(003f38d8,00000000,0000002c) ret=78da6501
  1144. 0024:Ret ucrtbase.memset() retval=003f38d8 ret=78da6501
  1145. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1146. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1147. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3918 ret=7b4e3ed8
  1148. 0024:Ret ucrtbase.malloc() retval=003f3918 ret=78d90dd2
  1149. 0024:Call ucrtbase.memset(003f3918,00000000,0000002c) ret=78da6501
  1150. 0024:Ret ucrtbase.memset() retval=003f3918 ret=78da6501
  1151. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1152. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1153. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3958 ret=7b4e3ed8
  1154. 0024:Ret ucrtbase.malloc() retval=003f3958 ret=78d90dd2
  1155. 0024:Call ucrtbase.memset(003f3958,00000000,0000002c) ret=78da6501
  1156. 0024:Ret ucrtbase.memset() retval=003f3958 ret=78da6501
  1157. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1158. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1159. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3998 ret=7b4e3ed8
  1160. 0024:Ret ucrtbase.malloc() retval=003f3998 ret=78d90dd2
  1161. 0024:Call ucrtbase.memset(003f3998,00000000,0000002c) ret=78da6501
  1162. 0024:Ret ucrtbase.memset() retval=003f3998 ret=78da6501
  1163. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1164. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1165. 0024:Ret ntdll.RtlAllocateHeap() retval=003f39d8 ret=7b4e3ed8
  1166. 0024:Ret ucrtbase.malloc() retval=003f39d8 ret=78d90dd2
  1167. 0024:Call ucrtbase.memset(003f39d8,00000000,0000002c) ret=78da6501
  1168. 0024:Ret ucrtbase.memset() retval=003f39d8 ret=78da6501
  1169. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1170. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1171. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3a18 ret=7b4e3ed8
  1172. 0024:Ret ucrtbase.malloc() retval=003f3a18 ret=78d90dd2
  1173. 0024:Call ucrtbase.memset(003f3a18,00000000,0000002c) ret=78da6501
  1174. 0024:Ret ucrtbase.memset() retval=003f3a18 ret=78da6501
  1175. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1176. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1177. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3a58 ret=7b4e3ed8
  1178. 0024:Ret ucrtbase.malloc() retval=003f3a58 ret=78d90dd2
  1179. 0024:Call ucrtbase.memset(003f3a58,00000000,0000002c) ret=78da6501
  1180. 0024:Ret ucrtbase.memset() retval=003f3a58 ret=78da6501
  1181. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1182. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1183. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3a98 ret=7b4e3ed8
  1184. 0024:Ret ucrtbase.malloc() retval=003f3a98 ret=78d90dd2
  1185. 0024:Call ucrtbase.memset(003f3a98,00000000,0000002c) ret=78da6501
  1186. 0024:Ret ucrtbase.memset() retval=003f3a98 ret=78da6501
  1187. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1188. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1189. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3ad8 ret=7b4e3ed8
  1190. 0024:Ret ucrtbase.malloc() retval=003f3ad8 ret=78d90dd2
  1191. 0024:Call ucrtbase.memset(003f3ad8,00000000,0000002c) ret=78da6501
  1192. 0024:Ret ucrtbase.memset() retval=003f3ad8 ret=78da6501
  1193. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1194. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1195. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3b18 ret=7b4e3ed8
  1196. 0024:Ret ucrtbase.malloc() retval=003f3b18 ret=78d90dd2
  1197. 0024:Call ucrtbase.memset(003f3b18,00000000,0000002c) ret=78da6501
  1198. 0024:Ret ucrtbase.memset() retval=003f3b18 ret=78da6501
  1199. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1200. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1201. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3b58 ret=7b4e3ed8
  1202. 0024:Ret ucrtbase.malloc() retval=003f3b58 ret=78d90dd2
  1203. 0024:Call ucrtbase.memset(003f3b58,00000000,0000002c) ret=78da6501
  1204. 0024:Ret ucrtbase.memset() retval=003f3b58 ret=78da6501
  1205. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1206. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1207. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3b98 ret=7b4e3ed8
  1208. 0024:Ret ucrtbase.malloc() retval=003f3b98 ret=78d90dd2
  1209. 0024:Call ucrtbase.memset(003f3b98,00000000,0000002c) ret=78da6501
  1210. 0024:Ret ucrtbase.memset() retval=003f3b98 ret=78da6501
  1211. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1212. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1213. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3bd8 ret=7b4e3ed8
  1214. 0024:Ret ucrtbase.malloc() retval=003f3bd8 ret=78d90dd2
  1215. 0024:Call ucrtbase.memset(003f3bd8,00000000,0000002c) ret=78da6501
  1216. 0024:Ret ucrtbase.memset() retval=003f3bd8 ret=78da6501
  1217. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1218. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1219. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3c18 ret=7b4e3ed8
  1220. 0024:Ret ucrtbase.malloc() retval=003f3c18 ret=78d90dd2
  1221. 0024:Call ucrtbase.memset(003f3c18,00000000,0000002c) ret=78da6501
  1222. 0024:Ret ucrtbase.memset() retval=003f3c18 ret=78da6501
  1223. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1224. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1225. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3c58 ret=7b4e3ed8
  1226. 0024:Ret ucrtbase.malloc() retval=003f3c58 ret=78d90dd2
  1227. 0024:Call ucrtbase.memset(003f3c58,00000000,0000002c) ret=78da6501
  1228. 0024:Ret ucrtbase.memset() retval=003f3c58 ret=78da6501
  1229. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1230. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1231. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3c98 ret=7b4e3ed8
  1232. 0024:Ret ucrtbase.malloc() retval=003f3c98 ret=78d90dd2
  1233. 0024:Call ucrtbase.memset(003f3c98,00000000,0000002c) ret=78da6501
  1234. 0024:Ret ucrtbase.memset() retval=003f3c98 ret=78da6501
  1235. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1236. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1237. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3cd8 ret=7b4e3ed8
  1238. 0024:Ret ucrtbase.malloc() retval=003f3cd8 ret=78d90dd2
  1239. 0024:Call ucrtbase.memset(003f3cd8,00000000,0000002c) ret=78da6501
  1240. 0024:Ret ucrtbase.memset() retval=003f3cd8 ret=78da6501
  1241. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1242. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1243. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3d18 ret=7b4e3ed8
  1244. 0024:Ret ucrtbase.malloc() retval=003f3d18 ret=78d90dd2
  1245. 0024:Call ucrtbase.memset(003f3d18,00000000,0000002c) ret=78da6501
  1246. 0024:Ret ucrtbase.memset() retval=003f3d18 ret=78da6501
  1247. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1248. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1249. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3d58 ret=7b4e3ed8
  1250. 0024:Ret ucrtbase.malloc() retval=003f3d58 ret=78d90dd2
  1251. 0024:Call ucrtbase.memset(003f3d58,00000000,0000002c) ret=78da6501
  1252. 0024:Ret ucrtbase.memset() retval=003f3d58 ret=78da6501
  1253. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1254. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1255. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3d98 ret=7b4e3ed8
  1256. 0024:Ret ucrtbase.malloc() retval=003f3d98 ret=78d90dd2
  1257. 0024:Call ucrtbase.memset(003f3d98,00000000,0000002c) ret=78da6501
  1258. 0024:Ret ucrtbase.memset() retval=003f3d98 ret=78da6501
  1259. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1260. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1261. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3dd8 ret=7b4e3ed8
  1262. 0024:Ret ucrtbase.malloc() retval=003f3dd8 ret=78d90dd2
  1263. 0024:Call ucrtbase.memset(003f3dd8,00000000,0000002c) ret=78da6501
  1264. 0024:Ret ucrtbase.memset() retval=003f3dd8 ret=78da6501
  1265. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1266. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1267. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3e18 ret=7b4e3ed8
  1268. 0024:Ret ucrtbase.malloc() retval=003f3e18 ret=78d90dd2
  1269. 0024:Call ucrtbase.memset(003f3e18,00000000,0000002c) ret=78da6501
  1270. 0024:Ret ucrtbase.memset() retval=003f3e18 ret=78da6501
  1271. 0024:Call user32.LoadStringW(78d50000,000003e8,0031eb1c,00000000) ret=78da6604
  1272. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1273. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1274. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1275. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1276. 0024:Ret user32.LoadStringW() retval=00000018 ret=78da6604
  1277. 0024:Call ucrtbase.malloc(0000005e) ret=78d90dd2
  1278. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005e) ret=7b4e3ed8
  1279. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3e98 ret=7b4e3ed8
  1280. 0024:Ret ucrtbase.malloc() retval=003f3e98 ret=78d90dd2
  1281. 0024:Call ucrtbase.memset(003f3e98,00000000,0000002c) ret=78da6651
  1282. 0024:Ret ucrtbase.memset() retval=003f3e98 ret=78da6651
  1283. 0024:Call ucrtbase.memcpy(003f3ec4,78ded6c2,00000030) ret=78da66c0
  1284. 0024:Ret ucrtbase.memcpy() retval=003f3ec4 ret=78da66c0
  1285. 0024:Call user32.LoadStringW(78d50000,000003e8,0031eb1c,00000000) ret=78da6604
  1286. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1287. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1288. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1289. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1290. 0024:Ret user32.LoadStringW() retval=00000018 ret=78da6604
  1291. 0024:Call ucrtbase.malloc(0000005e) ret=78d90dd2
  1292. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005e) ret=7b4e3ed8
  1293. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3f00 ret=7b4e3ed8
  1294. 0024:Ret ucrtbase.malloc() retval=003f3f00 ret=78d90dd2
  1295. 0024:Call ucrtbase.memset(003f3f00,00000000,0000002c) ret=78da6651
  1296. 0024:Ret ucrtbase.memset() retval=003f3f00 ret=78da6651
  1297. 0024:Call ucrtbase.memcpy(003f3f2c,78ded6c2,00000030) ret=78da66c0
  1298. 0024:Ret ucrtbase.memcpy() retval=003f3f2c ret=78da66c0
  1299. 0024:Call user32.LoadStringW(78d50000,000003e9,0031eb1c,00000000) ret=78da6604
  1300. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1301. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1302. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1303. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1304. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  1305. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  1306. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  1307. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3f68 ret=7b4e3ed8
  1308. 0024:Ret ucrtbase.malloc() retval=003f3f68 ret=78d90dd2
  1309. 0024:Call ucrtbase.memset(003f3f68,00000000,0000002c) ret=78da6651
  1310. 0024:Ret ucrtbase.memset() retval=003f3f68 ret=78da6651
  1311. 0024:Call ucrtbase.memcpy(003f3f94,78ded6f4,0000001c) ret=78da66c0
  1312. 0024:Ret ucrtbase.memcpy() retval=003f3f94 ret=78da66c0
  1313. 0024:Call user32.LoadStringW(78d50000,000003ea,0031eb1c,00000000) ret=78da6604
  1314. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1315. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1316. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1317. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1318. 0024:Ret user32.LoadStringW() retval=00000015 ret=78da6604
  1319. 0024:Call ucrtbase.malloc(00000058) ret=78d90dd2
  1320. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000058) ret=7b4e3ed8
  1321. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3fc0 ret=7b4e3ed8
  1322. 0024:Ret ucrtbase.malloc() retval=003f3fc0 ret=78d90dd2
  1323. 0024:Call ucrtbase.memset(003f3fc0,00000000,0000002c) ret=78da6651
  1324. 0024:Ret ucrtbase.memset() retval=003f3fc0 ret=78da6651
  1325. 0024:Call ucrtbase.memcpy(003f3fec,78ded712,0000002a) ret=78da66c0
  1326. 0024:Ret ucrtbase.memcpy() retval=003f3fec ret=78da66c0
  1327. 0024:Call user32.LoadStringW(78d50000,000003eb,0031eb1c,00000000) ret=78da6604
  1328. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1329. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1330. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1331. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1332. 0024:Ret user32.LoadStringW() retval=00000018 ret=78da6604
  1333. 0024:Call ucrtbase.malloc(0000005e) ret=78d90dd2
  1334. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005e) ret=7b4e3ed8
  1335. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4020 ret=7b4e3ed8
  1336. 0024:Ret ucrtbase.malloc() retval=003f4020 ret=78d90dd2
  1337. 0024:Call ucrtbase.memset(003f4020,00000000,0000002c) ret=78da6651
  1338. 0024:Ret ucrtbase.memset() retval=003f4020 ret=78da6651
  1339. 0024:Call ucrtbase.memcpy(003f404c,78ded73e,00000030) ret=78da66c0
  1340. 0024:Ret ucrtbase.memcpy() retval=003f404c ret=78da66c0
  1341. 0024:Call user32.LoadStringW(78d50000,000003eb,0031eb1c,00000000) ret=78da6604
  1342. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1343. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1344. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1345. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1346. 0024:Ret user32.LoadStringW() retval=00000018 ret=78da6604
  1347. 0024:Call ucrtbase.malloc(0000005e) ret=78d90dd2
  1348. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005e) ret=7b4e3ed8
  1349. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4088 ret=7b4e3ed8
  1350. 0024:Ret ucrtbase.malloc() retval=003f4088 ret=78d90dd2
  1351. 0024:Call ucrtbase.memset(003f4088,00000000,0000002c) ret=78da6651
  1352. 0024:Ret ucrtbase.memset() retval=003f4088 ret=78da6651
  1353. 0024:Call ucrtbase.memcpy(003f40b4,78ded73e,00000030) ret=78da66c0
  1354. 0024:Ret ucrtbase.memcpy() retval=003f40b4 ret=78da66c0
  1355. 0024:Call user32.LoadStringW(78d50000,000003ec,0031eb1c,00000000) ret=78da6604
  1356. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1357. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1358. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1359. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1360. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  1361. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  1362. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  1363. 0024:Ret ntdll.RtlAllocateHeap() retval=003f40f0 ret=7b4e3ed8
  1364. 0024:Ret ucrtbase.malloc() retval=003f40f0 ret=78d90dd2
  1365. 0024:Call ucrtbase.memset(003f40f0,00000000,0000002c) ret=78da6651
  1366. 0024:Ret ucrtbase.memset() retval=003f40f0 ret=78da6651
  1367. 0024:Call ucrtbase.memcpy(003f411c,78ded770,0000002e) ret=78da66c0
  1368. 0024:Ret ucrtbase.memcpy() retval=003f411c ret=78da66c0
  1369. 0024:Call user32.LoadStringW(78d50000,000003ec,0031eb1c,00000000) ret=78da6604
  1370. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1371. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1372. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1373. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1374. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  1375. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  1376. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  1377. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4158 ret=7b4e3ed8
  1378. 0024:Ret ucrtbase.malloc() retval=003f4158 ret=78d90dd2
  1379. 0024:Call ucrtbase.memset(003f4158,00000000,0000002c) ret=78da6651
  1380. 0024:Ret ucrtbase.memset() retval=003f4158 ret=78da6651
  1381. 0024:Call ucrtbase.memcpy(003f4184,78ded770,0000002e) ret=78da66c0
  1382. 0024:Ret ucrtbase.memcpy() retval=003f4184 ret=78da66c0
  1383. 0024:Call user32.LoadStringW(78d50000,000003ed,0031eb1c,00000000) ret=78da6604
  1384. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1385. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1386. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1387. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1388. 0024:Ret user32.LoadStringW() retval=00000011 ret=78da6604
  1389. 0024:Call ucrtbase.malloc(00000050) ret=78d90dd2
  1390. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000050) ret=7b4e3ed8
  1391. 0024:Ret ntdll.RtlAllocateHeap() retval=003f41c0 ret=7b4e3ed8
  1392. 0024:Ret ucrtbase.malloc() retval=003f41c0 ret=78d90dd2
  1393. 0024:Call ucrtbase.memset(003f41c0,00000000,0000002c) ret=78da6651
  1394. 0024:Ret ucrtbase.memset() retval=003f41c0 ret=78da6651
  1395. 0024:Call ucrtbase.memcpy(003f41ec,78ded7a0,00000022) ret=78da66c0
  1396. 0024:Ret ucrtbase.memcpy() retval=003f41ec ret=78da66c0
  1397. 0024:Call user32.LoadStringW(78d50000,000003ed,0031eb1c,00000000) ret=78da6604
  1398. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1399. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1400. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1401. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1402. 0024:Ret user32.LoadStringW() retval=00000011 ret=78da6604
  1403. 0024:Call ucrtbase.malloc(00000050) ret=78d90dd2
  1404. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000050) ret=7b4e3ed8
  1405. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4218 ret=7b4e3ed8
  1406. 0024:Ret ucrtbase.malloc() retval=003f4218 ret=78d90dd2
  1407. 0024:Call ucrtbase.memset(003f4218,00000000,0000002c) ret=78da6651
  1408. 0024:Ret ucrtbase.memset() retval=003f4218 ret=78da6651
  1409. 0024:Call ucrtbase.memcpy(003f4244,78ded7a0,00000022) ret=78da66c0
  1410. 0024:Ret ucrtbase.memcpy() retval=003f4244 ret=78da66c0
  1411. 0024:Call user32.LoadStringW(78d50000,000003ee,0031eb1c,00000000) ret=78da6604
  1412. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1413. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1414. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1415. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1416. 0024:Ret user32.LoadStringW() retval=00000009 ret=78da6604
  1417. 0024:Call ucrtbase.malloc(00000040) ret=78d90dd2
  1418. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000040) ret=7b4e3ed8
  1419. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4270 ret=7b4e3ed8
  1420. 0024:Ret ucrtbase.malloc() retval=003f4270 ret=78d90dd2
  1421. 0024:Call ucrtbase.memset(003f4270,00000000,0000002c) ret=78da6651
  1422. 0024:Ret ucrtbase.memset() retval=003f4270 ret=78da6651
  1423. 0024:Call ucrtbase.memcpy(003f429c,78ded7c4,00000012) ret=78da66c0
  1424. 0024:Ret ucrtbase.memcpy() retval=003f429c ret=78da66c0
  1425. 0024:Call user32.LoadStringW(78d50000,000003ef,0031eb1c,00000000) ret=78da6604
  1426. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1427. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1428. 0024:Call ntdll.LdrAccessResource(78d50000,78de9270,0031ea60,00000000) ret=7b966f9d
  1429. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1430. 0024:Ret user32.LoadStringW() retval=00000014 ret=78da6604
  1431. 0024:Call ucrtbase.malloc(00000056) ret=78d90dd2
  1432. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000056) ret=7b4e3ed8
  1433. 0024:Ret ntdll.RtlAllocateHeap() retval=003f42b8 ret=7b4e3ed8
  1434. 0024:Ret ucrtbase.malloc() retval=003f42b8 ret=78d90dd2
  1435. 0024:Call ucrtbase.memset(003f42b8,00000000,0000002c) ret=78da6651
  1436. 0024:Ret ucrtbase.memset() retval=003f42b8 ret=78da6651
  1437. 0024:Call ucrtbase.memcpy(003f42e4,78ded7d8,00000028) ret=78da66c0
  1438. 0024:Ret ucrtbase.memcpy() retval=003f42e4 ret=78da66c0
  1439. 0024:Call user32.LoadStringW(78d50000,000003f0,0031eb1c,00000000) ret=78da6604
  1440. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1441. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1442. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1443. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1444. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  1445. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  1446. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  1447. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4318 ret=7b4e3ed8
  1448. 0024:Ret ucrtbase.malloc() retval=003f4318 ret=78d90dd2
  1449. 0024:Call ucrtbase.memset(003f4318,00000000,0000002c) ret=78da6651
  1450. 0024:Ret ucrtbase.memset() retval=003f4318 ret=78da6651
  1451. 0024:Call ucrtbase.memcpy(003f4344,78df2326,0000002c) ret=78da66c0
  1452. 0024:Ret ucrtbase.memcpy() retval=003f4344 ret=78da66c0
  1453. 0024:Call user32.LoadStringW(78d50000,000003f1,0031eb1c,00000000) ret=78da6604
  1454. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1455. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1456. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1457. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1458. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  1459. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  1460. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  1461. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4380 ret=7b4e3ed8
  1462. 0024:Ret ucrtbase.malloc() retval=003f4380 ret=78d90dd2
  1463. 0024:Call ucrtbase.memset(003f4380,00000000,0000002c) ret=78da6651
  1464. 0024:Ret ucrtbase.memset() retval=003f4380 ret=78da6651
  1465. 0024:Call ucrtbase.memcpy(003f43ac,78df2354,0000001e) ret=78da66c0
  1466. 0024:Ret ucrtbase.memcpy() retval=003f43ac ret=78da66c0
  1467. 0024:Call user32.LoadStringW(78d50000,000003f2,0031eb1c,00000000) ret=78da6604
  1468. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1469. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1470. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1471. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1472. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  1473. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  1474. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  1475. 0024:Ret ntdll.RtlAllocateHeap() retval=003f43d8 ret=7b4e3ed8
  1476. 0024:Ret ucrtbase.malloc() retval=003f43d8 ret=78d90dd2
  1477. 0024:Call ucrtbase.memset(003f43d8,00000000,0000002c) ret=78da6651
  1478. 0024:Ret ucrtbase.memset() retval=003f43d8 ret=78da6651
  1479. 0024:Call ucrtbase.memcpy(003f4404,78df2374,0000002e) ret=78da66c0
  1480. 0024:Ret ucrtbase.memcpy() retval=003f4404 ret=78da66c0
  1481. 0024:Call user32.LoadStringW(78d50000,000003f3,0031eb1c,00000000) ret=78da6604
  1482. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1483. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1484. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1485. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1486. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  1487. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  1488. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  1489. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4440 ret=7b4e3ed8
  1490. 0024:Ret ucrtbase.malloc() retval=003f4440 ret=78d90dd2
  1491. 0024:Call ucrtbase.memset(003f4440,00000000,0000002c) ret=78da6651
  1492. 0024:Ret ucrtbase.memset() retval=003f4440 ret=78da6651
  1493. 0024:Call ucrtbase.memcpy(003f446c,78df23a4,00000024) ret=78da66c0
  1494. 0024:Ret ucrtbase.memcpy() retval=003f446c ret=78da66c0
  1495. 0024:Call user32.LoadStringW(78d50000,000003f4,0031eb1c,00000000) ret=78da6604
  1496. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1497. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1498. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1499. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1500. 0024:Ret user32.LoadStringW() retval=0000001c ret=78da6604
  1501. 0024:Call ucrtbase.malloc(00000066) ret=78d90dd2
  1502. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000066) ret=7b4e3ed8
  1503. 0024:Ret ntdll.RtlAllocateHeap() retval=003f44a0 ret=7b4e3ed8
  1504. 0024:Ret ucrtbase.malloc() retval=003f44a0 ret=78d90dd2
  1505. 0024:Call ucrtbase.memset(003f44a0,00000000,0000002c) ret=78da6651
  1506. 0024:Ret ucrtbase.memset() retval=003f44a0 ret=78da6651
  1507. 0024:Call ucrtbase.memcpy(003f44cc,78df23ca,00000038) ret=78da66c0
  1508. 0024:Ret ucrtbase.memcpy() retval=003f44cc ret=78da66c0
  1509. 0024:Call user32.LoadStringW(78d50000,000003f5,0031eb1c,00000000) ret=78da6604
  1510. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1511. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1512. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1513. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1514. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  1515. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  1516. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  1517. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4510 ret=7b4e3ed8
  1518. 0024:Ret ucrtbase.malloc() retval=003f4510 ret=78d90dd2
  1519. 0024:Call ucrtbase.memset(003f4510,00000000,0000002c) ret=78da6651
  1520. 0024:Ret ucrtbase.memset() retval=003f4510 ret=78da6651
  1521. 0024:Call ucrtbase.memcpy(003f453c,78df2404,0000002c) ret=78da66c0
  1522. 0024:Ret ucrtbase.memcpy() retval=003f453c ret=78da66c0
  1523. 0024:Call user32.LoadStringW(78d50000,000003f5,0031eb1c,00000000) ret=78da6604
  1524. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1525. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1526. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1527. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1528. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  1529. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  1530. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  1531. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4578 ret=7b4e3ed8
  1532. 0024:Ret ucrtbase.malloc() retval=003f4578 ret=78d90dd2
  1533. 0024:Call ucrtbase.memset(003f4578,00000000,0000002c) ret=78da6651
  1534. 0024:Ret ucrtbase.memset() retval=003f4578 ret=78da6651
  1535. 0024:Call ucrtbase.memcpy(003f45a4,78df2404,0000002c) ret=78da66c0
  1536. 0024:Ret ucrtbase.memcpy() retval=003f45a4 ret=78da66c0
  1537. 0024:Call user32.LoadStringW(78d50000,000003f6,0031eb1c,00000000) ret=78da6604
  1538. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1539. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1540. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1541. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1542. 0024:Ret user32.LoadStringW() retval=00000014 ret=78da6604
  1543. 0024:Call ucrtbase.malloc(00000056) ret=78d90dd2
  1544. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000056) ret=7b4e3ed8
  1545. 0024:Ret ntdll.RtlAllocateHeap() retval=003f45e0 ret=7b4e3ed8
  1546. 0024:Ret ucrtbase.malloc() retval=003f45e0 ret=78d90dd2
  1547. 0024:Call ucrtbase.memset(003f45e0,00000000,0000002c) ret=78da6651
  1548. 0024:Ret ucrtbase.memset() retval=003f45e0 ret=78da6651
  1549. 0024:Call ucrtbase.memcpy(003f460c,78df2432,00000028) ret=78da66c0
  1550. 0024:Ret ucrtbase.memcpy() retval=003f460c ret=78da66c0
  1551. 0024:Call user32.LoadStringW(78d50000,000003f7,0031eb1c,00000000) ret=78da6604
  1552. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1553. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1554. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1555. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1556. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  1557. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  1558. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  1559. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4640 ret=7b4e3ed8
  1560. 0024:Ret ucrtbase.malloc() retval=003f4640 ret=78d90dd2
  1561. 0024:Call ucrtbase.memset(003f4640,00000000,0000002c) ret=78da6651
  1562. 0024:Ret ucrtbase.memset() retval=003f4640 ret=78da6651
  1563. 0024:Call ucrtbase.memcpy(003f466c,78df245c,0000001e) ret=78da66c0
  1564. 0024:Ret ucrtbase.memcpy() retval=003f466c ret=78da66c0
  1565. 0024:Call user32.LoadStringW(78d50000,000003f8,0031eb1c,00000000) ret=78da6604
  1566. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1567. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1568. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1569. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1570. 0024:Ret user32.LoadStringW() retval=0000000d ret=78da6604
  1571. 0024:Call ucrtbase.malloc(00000048) ret=78d90dd2
  1572. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000048) ret=7b4e3ed8
  1573. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4698 ret=7b4e3ed8
  1574. 0024:Ret ucrtbase.malloc() retval=003f4698 ret=78d90dd2
  1575. 0024:Call ucrtbase.memset(003f4698,00000000,0000002c) ret=78da6651
  1576. 0024:Ret ucrtbase.memset() retval=003f4698 ret=78da6651
  1577. 0024:Call ucrtbase.memcpy(003f46c4,78df247c,0000001a) ret=78da66c0
  1578. 0024:Ret ucrtbase.memcpy() retval=003f46c4 ret=78da66c0
  1579. 0024:Call user32.LoadStringW(78d50000,000003f9,0031eb1c,00000000) ret=78da6604
  1580. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1581. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1582. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1583. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1584. 0024:Ret user32.LoadStringW() retval=00000011 ret=78da6604
  1585. 0024:Call ucrtbase.malloc(00000050) ret=78d90dd2
  1586. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000050) ret=7b4e3ed8
  1587. 0024:Ret ntdll.RtlAllocateHeap() retval=003f46e8 ret=7b4e3ed8
  1588. 0024:Ret ucrtbase.malloc() retval=003f46e8 ret=78d90dd2
  1589. 0024:Call ucrtbase.memset(003f46e8,00000000,0000002c) ret=78da6651
  1590. 0024:Ret ucrtbase.memset() retval=003f46e8 ret=78da6651
  1591. 0024:Call ucrtbase.memcpy(003f4714,78df2498,00000022) ret=78da66c0
  1592. 0024:Ret ucrtbase.memcpy() retval=003f4714 ret=78da66c0
  1593. 0024:Call user32.LoadStringW(78d50000,000003fa,0031eb1c,00000000) ret=78da6604
  1594. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1595. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1596. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1597. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1598. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  1599. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  1600. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  1601. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4740 ret=7b4e3ed8
  1602. 0024:Ret ucrtbase.malloc() retval=003f4740 ret=78d90dd2
  1603. 0024:Call ucrtbase.memset(003f4740,00000000,0000002c) ret=78da6651
  1604. 0024:Ret ucrtbase.memset() retval=003f4740 ret=78da6651
  1605. 0024:Call ucrtbase.memcpy(003f476c,78df24bc,00000018) ret=78da66c0
  1606. 0024:Ret ucrtbase.memcpy() retval=003f476c ret=78da66c0
  1607. 0024:Call user32.LoadStringW(78d50000,000003fb,0031eb1c,00000000) ret=78da6604
  1608. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1609. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1610. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1611. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1612. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  1613. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  1614. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  1615. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4790 ret=7b4e3ed8
  1616. 0024:Ret ucrtbase.malloc() retval=003f4790 ret=78d90dd2
  1617. 0024:Call ucrtbase.memset(003f4790,00000000,0000002c) ret=78da6651
  1618. 0024:Ret ucrtbase.memset() retval=003f4790 ret=78da6651
  1619. 0024:Call ucrtbase.memcpy(003f47bc,78df24d6,0000001c) ret=78da66c0
  1620. 0024:Ret ucrtbase.memcpy() retval=003f47bc ret=78da66c0
  1621. 0024:Call user32.LoadStringW(78d50000,000003fc,0031eb1c,00000000) ret=78da6604
  1622. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1623. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1624. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1625. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1626. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  1627. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  1628. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  1629. 0024:Ret ntdll.RtlAllocateHeap() retval=003f47e8 ret=7b4e3ed8
  1630. 0024:Ret ucrtbase.malloc() retval=003f47e8 ret=78d90dd2
  1631. 0024:Call ucrtbase.memset(003f47e8,00000000,0000002c) ret=78da6651
  1632. 0024:Ret ucrtbase.memset() retval=003f47e8 ret=78da6651
  1633. 0024:Call ucrtbase.memcpy(003f4814,78df24f4,00000018) ret=78da66c0
  1634. 0024:Ret ucrtbase.memcpy() retval=003f4814 ret=78da66c0
  1635. 0024:Call user32.LoadStringW(78d50000,000003fd,0031eb1c,00000000) ret=78da6604
  1636. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1637. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1638. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1639. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1640. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  1641. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  1642. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  1643. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4838 ret=7b4e3ed8
  1644. 0024:Ret ucrtbase.malloc() retval=003f4838 ret=78d90dd2
  1645. 0024:Call ucrtbase.memset(003f4838,00000000,0000002c) ret=78da6651
  1646. 0024:Ret ucrtbase.memset() retval=003f4838 ret=78da6651
  1647. 0024:Call ucrtbase.memcpy(003f4864,78df250e,00000018) ret=78da66c0
  1648. 0024:Ret ucrtbase.memcpy() retval=003f4864 ret=78da66c0
  1649. 0024:Call user32.LoadStringW(78d50000,000003fe,0031eb1c,00000000) ret=78da6604
  1650. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1651. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1652. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1653. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1654. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  1655. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  1656. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  1657. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4888 ret=7b4e3ed8
  1658. 0024:Ret ucrtbase.malloc() retval=003f4888 ret=78d90dd2
  1659. 0024:Call ucrtbase.memset(003f4888,00000000,0000002c) ret=78da6651
  1660. 0024:Ret ucrtbase.memset() retval=003f4888 ret=78da6651
  1661. 0024:Call ucrtbase.memcpy(003f48b4,78df2528,00000024) ret=78da66c0
  1662. 0024:Ret ucrtbase.memcpy() retval=003f48b4 ret=78da66c0
  1663. 0024:Call user32.LoadStringW(78d50000,000003ff,0031eb1c,00000000) ret=78da6604
  1664. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1665. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1666. 0024:Call ntdll.LdrAccessResource(78d50000,78de9480,0031ea60,00000000) ret=7b966f9d
  1667. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1668. 0024:Ret user32.LoadStringW() retval=00000014 ret=78da6604
  1669. 0024:Call ucrtbase.malloc(00000056) ret=78d90dd2
  1670. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000056) ret=7b4e3ed8
  1671. 0024:Ret ntdll.RtlAllocateHeap() retval=003f48e8 ret=7b4e3ed8
  1672. 0024:Ret ucrtbase.malloc() retval=003f48e8 ret=78d90dd2
  1673. 0024:Call ucrtbase.memset(003f48e8,00000000,0000002c) ret=78da6651
  1674. 0024:Ret ucrtbase.memset() retval=003f48e8 ret=78da6651
  1675. 0024:Call ucrtbase.memcpy(003f4914,78df254e,00000028) ret=78da66c0
  1676. 0024:Ret ucrtbase.memcpy() retval=003f4914 ret=78da66c0
  1677. 0024:Call user32.LoadStringW(78d50000,00000400,0031eb1c,00000000) ret=78da6604
  1678. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1679. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1680. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1681. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1682. 0024:Ret user32.LoadStringW() retval=00000013 ret=78da6604
  1683. 0024:Call ucrtbase.malloc(00000054) ret=78d90dd2
  1684. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000054) ret=7b4e3ed8
  1685. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4948 ret=7b4e3ed8
  1686. 0024:Ret ucrtbase.malloc() retval=003f4948 ret=78d90dd2
  1687. 0024:Call ucrtbase.memset(003f4948,00000000,0000002c) ret=78da6651
  1688. 0024:Ret ucrtbase.memset() retval=003f4948 ret=78da6651
  1689. 0024:Call ucrtbase.memcpy(003f4974,78df847e,00000026) ret=78da66c0
  1690. 0024:Ret ucrtbase.memcpy() retval=003f4974 ret=78da66c0
  1691. 0024:Call user32.LoadStringW(78d50000,00000401,0031eb1c,00000000) ret=78da6604
  1692. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1693. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1694. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1695. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1696. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  1697. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  1698. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  1699. 0024:Ret ntdll.RtlAllocateHeap() retval=003f49a8 ret=7b4e3ed8
  1700. 0024:Ret ucrtbase.malloc() retval=003f49a8 ret=78d90dd2
  1701. 0024:Call ucrtbase.memset(003f49a8,00000000,0000002c) ret=78da6651
  1702. 0024:Ret ucrtbase.memset() retval=003f49a8 ret=78da6651
  1703. 0024:Call ucrtbase.memcpy(003f49d4,78df84a6,00000024) ret=78da66c0
  1704. 0024:Ret ucrtbase.memcpy() retval=003f49d4 ret=78da66c0
  1705. 0024:Call user32.LoadStringW(78d50000,00000402,0031eb1c,00000000) ret=78da6604
  1706. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1707. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1708. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1709. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1710. 0024:Ret user32.LoadStringW() retval=00000003 ret=78da6604
  1711. 0024:Call ucrtbase.malloc(00000034) ret=78d90dd2
  1712. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000034) ret=7b4e3ed8
  1713. 0024:Ret ntdll.RtlAllocateHeap() retval=003f3e58 ret=7b4e3ed8
  1714. 0024:Ret ucrtbase.malloc() retval=003f3e58 ret=78d90dd2
  1715. 0024:Call ucrtbase.memset(003f3e58,00000000,0000002c) ret=78da6651
  1716. 0024:Ret ucrtbase.memset() retval=003f3e58 ret=78da6651
  1717. 0024:Call ucrtbase.memcpy(003f3e84,78df84cc,00000006) ret=78da66c0
  1718. 0024:Ret ucrtbase.memcpy() retval=003f3e84 ret=78da66c0
  1719. 0024:Call user32.LoadStringW(78d50000,00000403,0031eb1c,00000000) ret=78da6604
  1720. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1721. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1722. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1723. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1724. 0024:Ret user32.LoadStringW() retval=0000000b ret=78da6604
  1725. 0024:Call ucrtbase.malloc(00000044) ret=78d90dd2
  1726. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000044) ret=7b4e3ed8
  1727. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4a08 ret=7b4e3ed8
  1728. 0024:Ret ucrtbase.malloc() retval=003f4a08 ret=78d90dd2
  1729. 0024:Call ucrtbase.memset(003f4a08,00000000,0000002c) ret=78da6651
  1730. 0024:Ret ucrtbase.memset() retval=003f4a08 ret=78da6651
  1731. 0024:Call ucrtbase.memcpy(003f4a34,78df84d4,00000016) ret=78da66c0
  1732. 0024:Ret ucrtbase.memcpy() retval=003f4a34 ret=78da66c0
  1733. 0024:Call user32.LoadStringW(78d50000,00000404,0031eb1c,00000000) ret=78da6604
  1734. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1735. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1736. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1737. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1738. 0024:Ret user32.LoadStringW() retval=00000023 ret=78da6604
  1739. 0024:Call ucrtbase.malloc(00000074) ret=78d90dd2
  1740. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000074) ret=7b4e3ed8
  1741. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4a58 ret=7b4e3ed8
  1742. 0024:Ret ucrtbase.malloc() retval=003f4a58 ret=78d90dd2
  1743. 0024:Call ucrtbase.memset(003f4a58,00000000,0000002c) ret=78da6651
  1744. 0024:Ret ucrtbase.memset() retval=003f4a58 ret=78da6651
  1745. 0024:Call ucrtbase.memcpy(003f4a84,78df84ec,00000046) ret=78da66c0
  1746. 0024:Ret ucrtbase.memcpy() retval=003f4a84 ret=78da66c0
  1747. 0024:Call user32.LoadStringW(78d50000,00000405,0031eb1c,00000000) ret=78da6604
  1748. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1749. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1750. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1751. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1752. 0024:Ret user32.LoadStringW() retval=0000001e ret=78da6604
  1753. 0024:Call ucrtbase.malloc(0000006a) ret=78d90dd2
  1754. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000006a) ret=7b4e3ed8
  1755. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4ad8 ret=7b4e3ed8
  1756. 0024:Ret ucrtbase.malloc() retval=003f4ad8 ret=78d90dd2
  1757. 0024:Call ucrtbase.memset(003f4ad8,00000000,0000002c) ret=78da6651
  1758. 0024:Ret ucrtbase.memset() retval=003f4ad8 ret=78da6651
  1759. 0024:Call ucrtbase.memcpy(003f4b04,78df8534,0000003c) ret=78da66c0
  1760. 0024:Ret ucrtbase.memcpy() retval=003f4b04 ret=78da66c0
  1761. 0024:Call user32.LoadStringW(78d50000,00000406,0031eb1c,00000000) ret=78da6604
  1762. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1763. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1764. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1765. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1766. 0024:Ret user32.LoadStringW() retval=0000001b ret=78da6604
  1767. 0024:Call ucrtbase.malloc(00000064) ret=78d90dd2
  1768. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000064) ret=7b4e3ed8
  1769. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4b50 ret=7b4e3ed8
  1770. 0024:Ret ucrtbase.malloc() retval=003f4b50 ret=78d90dd2
  1771. 0024:Call ucrtbase.memset(003f4b50,00000000,0000002c) ret=78da6651
  1772. 0024:Ret ucrtbase.memset() retval=003f4b50 ret=78da6651
  1773. 0024:Call ucrtbase.memcpy(003f4b7c,78df8572,00000036) ret=78da66c0
  1774. 0024:Ret ucrtbase.memcpy() retval=003f4b7c ret=78da66c0
  1775. 0024:Call user32.LoadStringW(78d50000,00000407,0031eb1c,00000000) ret=78da6604
  1776. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1777. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1778. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1779. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1780. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  1781. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  1782. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  1783. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4bc0 ret=7b4e3ed8
  1784. 0024:Ret ucrtbase.malloc() retval=003f4bc0 ret=78d90dd2
  1785. 0024:Call ucrtbase.memset(003f4bc0,00000000,0000002c) ret=78da6651
  1786. 0024:Ret ucrtbase.memset() retval=003f4bc0 ret=78da6651
  1787. 0024:Call ucrtbase.memcpy(003f4bec,78df85aa,00000020) ret=78da66c0
  1788. 0024:Ret ucrtbase.memcpy() retval=003f4bec ret=78da66c0
  1789. 0024:Call user32.LoadStringW(78d50000,00000408,0031eb1c,00000000) ret=78da6604
  1790. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1791. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1792. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1793. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1794. 0024:Ret user32.LoadStringW() retval=00000014 ret=78da6604
  1795. 0024:Call ucrtbase.malloc(00000056) ret=78d90dd2
  1796. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000056) ret=7b4e3ed8
  1797. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4c18 ret=7b4e3ed8
  1798. 0024:Ret ucrtbase.malloc() retval=003f4c18 ret=78d90dd2
  1799. 0024:Call ucrtbase.memset(003f4c18,00000000,0000002c) ret=78da6651
  1800. 0024:Ret ucrtbase.memset() retval=003f4c18 ret=78da6651
  1801. 0024:Call ucrtbase.memcpy(003f4c44,78df85cc,00000028) ret=78da66c0
  1802. 0024:Ret ucrtbase.memcpy() retval=003f4c44 ret=78da66c0
  1803. 0024:Call user32.LoadStringW(78d50000,00000409,0031eb1c,00000000) ret=78da6604
  1804. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1805. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1806. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1807. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1808. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  1809. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  1810. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  1811. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4c90 ret=7b4e3ed8
  1812. 0024:Ret ucrtbase.malloc() retval=003f4c90 ret=78d90dd2
  1813. 0024:Call ucrtbase.memset(003f4c90,00000000,0000002c) ret=78da6651
  1814. 0024:Ret ucrtbase.memset() retval=003f4c90 ret=78da6651
  1815. 0024:Call ucrtbase.memcpy(003f4cbc,78df85f6,00000024) ret=78da66c0
  1816. 0024:Ret ucrtbase.memcpy() retval=003f4cbc ret=78da66c0
  1817. 0024:Call user32.LoadStringW(78d50000,0000040a,0031eb1c,00000000) ret=78da6604
  1818. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1819. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1820. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1821. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1822. 0024:Ret user32.LoadStringW() retval=00000011 ret=78da6604
  1823. 0024:Call ucrtbase.malloc(00000050) ret=78d90dd2
  1824. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000050) ret=7b4e3ed8
  1825. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4cf0 ret=7b4e3ed8
  1826. 0024:Ret ucrtbase.malloc() retval=003f4cf0 ret=78d90dd2
  1827. 0024:Call ucrtbase.memset(003f4cf0,00000000,0000002c) ret=78da6651
  1828. 0024:Ret ucrtbase.memset() retval=003f4cf0 ret=78da6651
  1829. 0024:Call ucrtbase.memcpy(003f4d1c,78df861c,00000022) ret=78da66c0
  1830. 0024:Ret ucrtbase.memcpy() retval=003f4d1c ret=78da66c0
  1831. 0024:Call user32.LoadStringW(78d50000,0000040b,0031eb1c,00000000) ret=78da6604
  1832. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1833. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1834. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1835. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1836. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  1837. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  1838. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  1839. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5830 ret=7b4e3ed8
  1840. 0024:Ret ucrtbase.malloc() retval=003f5830 ret=78d90dd2
  1841. 0024:Call ucrtbase.memset(003f5830,00000000,0000002c) ret=78da6651
  1842. 0024:Ret ucrtbase.memset() retval=003f5830 ret=78da6651
  1843. 0024:Call ucrtbase.memcpy(003f585c,78df8640,0000002e) ret=78da66c0
  1844. 0024:Ret ucrtbase.memcpy() retval=003f585c ret=78da66c0
  1845. 0024:Call user32.LoadStringW(78d50000,0000040c,0031eb1c,00000000) ret=78da6604
  1846. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1847. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1848. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1849. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1850. 0024:Ret user32.LoadStringW() retval=0000001a ret=78da6604
  1851. 0024:Call ucrtbase.malloc(00000062) ret=78d90dd2
  1852. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000062) ret=7b4e3ed8
  1853. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5898 ret=7b4e3ed8
  1854. 0024:Ret ucrtbase.malloc() retval=003f5898 ret=78d90dd2
  1855. 0024:Call ucrtbase.memset(003f5898,00000000,0000002c) ret=78da6651
  1856. 0024:Ret ucrtbase.memset() retval=003f5898 ret=78da6651
  1857. 0024:Call ucrtbase.memcpy(003f58c4,78df8670,00000034) ret=78da66c0
  1858. 0024:Ret ucrtbase.memcpy() retval=003f58c4 ret=78da66c0
  1859. 0024:Call user32.LoadStringW(78d50000,0000040d,0031eb1c,00000000) ret=78da6604
  1860. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1861. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1862. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1863. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1864. 0024:Ret user32.LoadStringW() retval=00000019 ret=78da6604
  1865. 0024:Call ucrtbase.malloc(00000060) ret=78d90dd2
  1866. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000060) ret=7b4e3ed8
  1867. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5908 ret=7b4e3ed8
  1868. 0024:Ret ucrtbase.malloc() retval=003f5908 ret=78d90dd2
  1869. 0024:Call ucrtbase.memset(003f5908,00000000,0000002c) ret=78da6651
  1870. 0024:Ret ucrtbase.memset() retval=003f5908 ret=78da6651
  1871. 0024:Call ucrtbase.memcpy(003f5934,78df86a6,00000032) ret=78da66c0
  1872. 0024:Ret ucrtbase.memcpy() retval=003f5934 ret=78da66c0
  1873. 0024:Call user32.LoadStringW(78d50000,0000040e,0031eb1c,00000000) ret=78da6604
  1874. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1875. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1876. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1877. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1878. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  1879. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  1880. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  1881. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5970 ret=7b4e3ed8
  1882. 0024:Ret ucrtbase.malloc() retval=003f5970 ret=78d90dd2
  1883. 0024:Call ucrtbase.memset(003f5970,00000000,0000002c) ret=78da6651
  1884. 0024:Ret ucrtbase.memset() retval=003f5970 ret=78da6651
  1885. 0024:Call ucrtbase.memcpy(003f599c,78df86da,0000002c) ret=78da66c0
  1886. 0024:Ret ucrtbase.memcpy() retval=003f599c ret=78da66c0
  1887. 0024:Call user32.LoadStringW(78d50000,0000040f,0031eb1c,00000000) ret=78da6604
  1888. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1889. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1890. 0024:Call ntdll.LdrAccessResource(78d50000,78de96a0,0031ea60,00000000) ret=7b966f9d
  1891. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1892. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  1893. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  1894. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  1895. 0024:Ret ntdll.RtlAllocateHeap() retval=003f59d8 ret=7b4e3ed8
  1896. 0024:Ret ucrtbase.malloc() retval=003f59d8 ret=78d90dd2
  1897. 0024:Call ucrtbase.memset(003f59d8,00000000,0000002c) ret=78da6651
  1898. 0024:Ret ucrtbase.memset() retval=003f59d8 ret=78da6651
  1899. 0024:Call ucrtbase.memcpy(003f5a04,78df8708,0000002e) ret=78da66c0
  1900. 0024:Ret ucrtbase.memcpy() retval=003f5a04 ret=78da66c0
  1901. 0024:Call user32.LoadStringW(78d50000,00000410,0031eb1c,00000000) ret=78da6604
  1902. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1903. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1904. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  1905. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1906. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  1907. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  1908. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  1909. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4d50 ret=7b4e3ed8
  1910. 0024:Ret ucrtbase.malloc() retval=003f4d50 ret=78d90dd2
  1911. 0024:Call ucrtbase.memset(003f4d50,00000000,0000002c) ret=78da6651
  1912. 0024:Ret ucrtbase.memset() retval=003f4d50 ret=78da6651
  1913. 0024:Call ucrtbase.memcpy(003f4d7c,78dfb8b2,00000020) ret=78da66c0
  1914. 0024:Ret ucrtbase.memcpy() retval=003f4d7c ret=78da66c0
  1915. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1916. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1917. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5a58 ret=7b4e3ed8
  1918. 0024:Ret ucrtbase.malloc() retval=003f5a58 ret=78d90dd2
  1919. 0024:Call ucrtbase.memset(003f5a58,00000000,0000002c) ret=78da6501
  1920. 0024:Ret ucrtbase.memset() retval=003f5a58 ret=78da6501
  1921. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1922. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1923. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5a98 ret=7b4e3ed8
  1924. 0024:Ret ucrtbase.malloc() retval=003f5a98 ret=78d90dd2
  1925. 0024:Call ucrtbase.memset(003f5a98,00000000,0000002c) ret=78da6501
  1926. 0024:Ret ucrtbase.memset() retval=003f5a98 ret=78da6501
  1927. 0024:Call ucrtbase.malloc(0000002c) ret=78d90dd2
  1928. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000002c) ret=7b4e3ed8
  1929. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5ad8 ret=7b4e3ed8
  1930. 0024:Ret ucrtbase.malloc() retval=003f5ad8 ret=78d90dd2
  1931. 0024:Call ucrtbase.memset(003f5ad8,00000000,0000002c) ret=78da6501
  1932. 0024:Ret ucrtbase.memset() retval=003f5ad8 ret=78da6501
  1933. 0024:Call user32.LoadStringW(78d50000,00000414,0031eb1c,00000000) ret=78da6604
  1934. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1935. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1936. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  1937. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1938. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  1939. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  1940. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  1941. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4db0 ret=7b4e3ed8
  1942. 0024:Ret ucrtbase.malloc() retval=003f4db0 ret=78d90dd2
  1943. 0024:Call ucrtbase.memset(003f4db0,00000000,0000002c) ret=78da6651
  1944. 0024:Ret ucrtbase.memset() retval=003f4db0 ret=78da6651
  1945. 0024:Call ucrtbase.memcpy(003f4ddc,78dfb8da,0000001c) ret=78da66c0
  1946. 0024:Ret ucrtbase.memcpy() retval=003f4ddc ret=78da66c0
  1947. 0024:Call user32.LoadStringW(78d50000,00000415,0031eb1c,00000000) ret=78da6604
  1948. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1949. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1950. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  1951. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1952. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  1953. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  1954. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  1955. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6218 ret=7b4e3ed8
  1956. 0024:Ret ucrtbase.malloc() retval=003f6218 ret=78d90dd2
  1957. 0024:Call ucrtbase.memset(003f6218,00000000,0000002c) ret=78da6651
  1958. 0024:Ret ucrtbase.memset() retval=003f6218 ret=78da6651
  1959. 0024:Call ucrtbase.memcpy(003f6244,78dfb8f8,00000018) ret=78da66c0
  1960. 0024:Ret ucrtbase.memcpy() retval=003f6244 ret=78da66c0
  1961. 0024:Call user32.LoadStringW(78d50000,00000416,0031eb1c,00000000) ret=78da6604
  1962. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1963. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1964. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  1965. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1966. 0024:Ret user32.LoadStringW() retval=00000013 ret=78da6604
  1967. 0024:Call ucrtbase.malloc(00000054) ret=78d90dd2
  1968. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000054) ret=7b4e3ed8
  1969. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4e10 ret=7b4e3ed8
  1970. 0024:Ret ucrtbase.malloc() retval=003f4e10 ret=78d90dd2
  1971. 0024:Call ucrtbase.memset(003f4e10,00000000,0000002c) ret=78da6651
  1972. 0024:Ret ucrtbase.memset() retval=003f4e10 ret=78da6651
  1973. 0024:Call ucrtbase.memcpy(003f4e3c,78dfb912,00000026) ret=78da66c0
  1974. 0024:Ret ucrtbase.memcpy() retval=003f4e3c ret=78da66c0
  1975. 0024:Call user32.LoadStringW(78d50000,00000417,0031eb1c,00000000) ret=78da6604
  1976. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1977. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1978. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  1979. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1980. 0024:Ret user32.LoadStringW() retval=0000000b ret=78da6604
  1981. 0024:Call ucrtbase.malloc(00000044) ret=78d90dd2
  1982. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000044) ret=7b4e3ed8
  1983. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6268 ret=7b4e3ed8
  1984. 0024:Ret ucrtbase.malloc() retval=003f6268 ret=78d90dd2
  1985. 0024:Call ucrtbase.memset(003f6268,00000000,0000002c) ret=78da6651
  1986. 0024:Ret ucrtbase.memset() retval=003f6268 ret=78da6651
  1987. 0024:Call ucrtbase.memcpy(003f6294,78dfb93a,00000016) ret=78da66c0
  1988. 0024:Ret ucrtbase.memcpy() retval=003f6294 ret=78da66c0
  1989. 0024:Call user32.LoadStringW(78d50000,00000418,0031eb1c,00000000) ret=78da6604
  1990. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  1991. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  1992. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  1993. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  1994. 0024:Ret user32.LoadStringW() retval=00000008 ret=78da6604
  1995. 0024:Call ucrtbase.malloc(0000003e) ret=78d90dd2
  1996. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000003e) ret=7b4e3ed8
  1997. 0024:Ret ntdll.RtlAllocateHeap() retval=003f62b8 ret=7b4e3ed8
  1998. 0024:Ret ucrtbase.malloc() retval=003f62b8 ret=78d90dd2
  1999. 0024:Call ucrtbase.memset(003f62b8,00000000,0000002c) ret=78da6651
  2000. 0024:Ret ucrtbase.memset() retval=003f62b8 ret=78da6651
  2001. 0024:Call ucrtbase.memcpy(003f62e4,78dfb952,00000010) ret=78da66c0
  2002. 0024:Ret ucrtbase.memcpy() retval=003f62e4 ret=78da66c0
  2003. 0024:Call user32.LoadStringW(78d50000,00000419,0031eb1c,00000000) ret=78da6604
  2004. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2005. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2006. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2007. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2008. 0024:Ret user32.LoadStringW() retval=00000011 ret=78da6604
  2009. 0024:Call ucrtbase.malloc(00000050) ret=78d90dd2
  2010. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000050) ret=7b4e3ed8
  2011. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4e70 ret=7b4e3ed8
  2012. 0024:Ret ucrtbase.malloc() retval=003f4e70 ret=78d90dd2
  2013. 0024:Call ucrtbase.memset(003f4e70,00000000,0000002c) ret=78da6651
  2014. 0024:Ret ucrtbase.memset() retval=003f4e70 ret=78da6651
  2015. 0024:Call ucrtbase.memcpy(003f4e9c,78dfb964,00000022) ret=78da66c0
  2016. 0024:Ret ucrtbase.memcpy() retval=003f4e9c ret=78da66c0
  2017. 0024:Call user32.LoadStringW(78d50000,0000041a,0031eb1c,00000000) ret=78da6604
  2018. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2019. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2020. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2021. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2022. 0024:Ret user32.LoadStringW() retval=00000005 ret=78da6604
  2023. 0024:Call ucrtbase.malloc(00000038) ret=78d90dd2
  2024. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000038) ret=7b4e3ed8
  2025. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5b18 ret=7b4e3ed8
  2026. 0024:Ret ucrtbase.malloc() retval=003f5b18 ret=78d90dd2
  2027. 0024:Call ucrtbase.memset(003f5b18,00000000,0000002c) ret=78da6651
  2028. 0024:Ret ucrtbase.memset() retval=003f5b18 ret=78da6651
  2029. 0024:Call ucrtbase.memcpy(003f5b44,78dfb988,0000000a) ret=78da66c0
  2030. 0024:Ret ucrtbase.memcpy() retval=003f5b44 ret=78da66c0
  2031. 0024:Call user32.LoadStringW(78d50000,0000041b,0031eb1c,00000000) ret=78da6604
  2032. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2033. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2034. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2035. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2036. 0024:Ret user32.LoadStringW() retval=0000000a ret=78da6604
  2037. 0024:Call ucrtbase.malloc(00000042) ret=78d90dd2
  2038. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000042) ret=7b4e3ed8
  2039. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6300 ret=7b4e3ed8
  2040. 0024:Ret ucrtbase.malloc() retval=003f6300 ret=78d90dd2
  2041. 0024:Call ucrtbase.memset(003f6300,00000000,0000002c) ret=78da6651
  2042. 0024:Ret ucrtbase.memset() retval=003f6300 ret=78da6651
  2043. 0024:Call ucrtbase.memcpy(003f632c,78dfb994,00000014) ret=78da66c0
  2044. 0024:Ret ucrtbase.memcpy() retval=003f632c ret=78da66c0
  2045. 0024:Call user32.LoadStringW(78d50000,0000041c,0031eb1c,00000000) ret=78da6604
  2046. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2047. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2048. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2049. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2050. 0024:Ret user32.LoadStringW() retval=00000008 ret=78da6604
  2051. 0024:Call ucrtbase.malloc(0000003e) ret=78d90dd2
  2052. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000003e) ret=7b4e3ed8
  2053. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6350 ret=7b4e3ed8
  2054. 0024:Ret ucrtbase.malloc() retval=003f6350 ret=78d90dd2
  2055. 0024:Call ucrtbase.memset(003f6350,00000000,0000002c) ret=78da6651
  2056. 0024:Ret ucrtbase.memset() retval=003f6350 ret=78da6651
  2057. 0024:Call ucrtbase.memcpy(003f637c,78dfb9aa,00000010) ret=78da66c0
  2058. 0024:Ret ucrtbase.memcpy() retval=003f637c ret=78da66c0
  2059. 0024:Call user32.LoadStringW(78d50000,0000041d,0031eb1c,00000000) ret=78da6604
  2060. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2061. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2062. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2063. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2064. 0024:Ret user32.LoadStringW() retval=00000007 ret=78da6604
  2065. 0024:Call ucrtbase.malloc(0000003c) ret=78d90dd2
  2066. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000003c) ret=7b4e3ed8
  2067. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6398 ret=7b4e3ed8
  2068. 0024:Ret ucrtbase.malloc() retval=003f6398 ret=78d90dd2
  2069. 0024:Call ucrtbase.memset(003f6398,00000000,0000002c) ret=78da6651
  2070. 0024:Ret ucrtbase.memset() retval=003f6398 ret=78da6651
  2071. 0024:Call ucrtbase.memcpy(003f63c4,78dfb9bc,0000000e) ret=78da66c0
  2072. 0024:Ret ucrtbase.memcpy() retval=003f63c4 ret=78da66c0
  2073. 0024:Call user32.LoadStringW(78d50000,0000041e,0031eb1c,00000000) ret=78da6604
  2074. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2075. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2076. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2077. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2078. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  2079. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  2080. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  2081. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4ed0 ret=7b4e3ed8
  2082. 0024:Ret ucrtbase.malloc() retval=003f4ed0 ret=78d90dd2
  2083. 0024:Call ucrtbase.memset(003f4ed0,00000000,0000002c) ret=78da6651
  2084. 0024:Ret ucrtbase.memset() retval=003f4ed0 ret=78da6651
  2085. 0024:Call ucrtbase.memcpy(003f4efc,78dfb9cc,00000020) ret=78da66c0
  2086. 0024:Ret ucrtbase.memcpy() retval=003f4efc ret=78da66c0
  2087. 0024:Call user32.LoadStringW(78d50000,0000041f,0031eb1c,00000000) ret=78da6604
  2088. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2089. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2090. 0024:Call ntdll.LdrAccessResource(78d50000,78de98c0,0031ea60,00000000) ret=7b966f9d
  2091. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2092. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2093. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2094. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2095. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4f30 ret=7b4e3ed8
  2096. 0024:Ret ucrtbase.malloc() retval=003f4f30 ret=78d90dd2
  2097. 0024:Call ucrtbase.memset(003f4f30,00000000,0000002c) ret=78da6651
  2098. 0024:Ret ucrtbase.memset() retval=003f4f30 ret=78da6651
  2099. 0024:Call ucrtbase.memcpy(003f4f5c,78dfb9ee,0000001c) ret=78da66c0
  2100. 0024:Ret ucrtbase.memcpy() retval=003f4f5c ret=78da66c0
  2101. 0024:Call user32.LoadStringW(78d50000,00000420,0031eb1c,00000000) ret=78da6604
  2102. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2103. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2104. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2105. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2106. 0024:Ret user32.LoadStringW() retval=0000000d ret=78da6604
  2107. 0024:Call ucrtbase.malloc(00000048) ret=78d90dd2
  2108. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000048) ret=7b4e3ed8
  2109. 0024:Ret ntdll.RtlAllocateHeap() retval=003f63e0 ret=7b4e3ed8
  2110. 0024:Ret ucrtbase.malloc() retval=003f63e0 ret=78d90dd2
  2111. 0024:Call ucrtbase.memset(003f63e0,00000000,0000002c) ret=78da6651
  2112. 0024:Ret ucrtbase.memset() retval=003f63e0 ret=78da6651
  2113. 0024:Call ucrtbase.memcpy(003f640c,78e0038a,0000001a) ret=78da66c0
  2114. 0024:Ret ucrtbase.memcpy() retval=003f640c ret=78da66c0
  2115. 0024:Call user32.LoadStringW(78d50000,00000421,0031eb1c,00000000) ret=78da6604
  2116. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2117. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2118. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2119. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2120. 0024:Ret user32.LoadStringW() retval=0000000a ret=78da6604
  2121. 0024:Call ucrtbase.malloc(00000042) ret=78d90dd2
  2122. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000042) ret=7b4e3ed8
  2123. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6430 ret=7b4e3ed8
  2124. 0024:Ret ucrtbase.malloc() retval=003f6430 ret=78d90dd2
  2125. 0024:Call ucrtbase.memset(003f6430,00000000,0000002c) ret=78da6651
  2126. 0024:Ret ucrtbase.memset() retval=003f6430 ret=78da6651
  2127. 0024:Call ucrtbase.memcpy(003f645c,78e003a6,00000014) ret=78da66c0
  2128. 0024:Ret ucrtbase.memcpy() retval=003f645c ret=78da66c0
  2129. 0024:Call user32.LoadStringW(78d50000,00000422,0031eb1c,00000000) ret=78da6604
  2130. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2131. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2132. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2133. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2134. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  2135. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  2136. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  2137. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4f90 ret=7b4e3ed8
  2138. 0024:Ret ucrtbase.malloc() retval=003f4f90 ret=78d90dd2
  2139. 0024:Call ucrtbase.memset(003f4f90,00000000,0000002c) ret=78da6651
  2140. 0024:Ret ucrtbase.memset() retval=003f4f90 ret=78da6651
  2141. 0024:Call ucrtbase.memcpy(003f4fbc,78e003bc,00000020) ret=78da66c0
  2142. 0024:Ret ucrtbase.memcpy() retval=003f4fbc ret=78da66c0
  2143. 0024:Call user32.LoadStringW(78d50000,00000423,0031eb1c,00000000) ret=78da6604
  2144. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2145. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2146. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2147. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2148. 0024:Ret user32.LoadStringW() retval=00000022 ret=78da6604
  2149. 0024:Call ucrtbase.malloc(00000072) ret=78d90dd2
  2150. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000072) ret=7b4e3ed8
  2151. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6480 ret=7b4e3ed8
  2152. 0024:Ret ucrtbase.malloc() retval=003f6480 ret=78d90dd2
  2153. 0024:Call ucrtbase.memset(003f6480,00000000,0000002c) ret=78da6651
  2154. 0024:Ret ucrtbase.memset() retval=003f6480 ret=78da6651
  2155. 0024:Call ucrtbase.memcpy(003f64ac,78e003de,00000044) ret=78da66c0
  2156. 0024:Ret ucrtbase.memcpy() retval=003f64ac ret=78da66c0
  2157. 0024:Call user32.LoadStringW(78d50000,00000424,0031eb1c,00000000) ret=78da6604
  2158. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2159. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2160. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2161. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2162. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2163. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2164. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2165. 0024:Ret ntdll.RtlAllocateHeap() retval=003f4ff0 ret=7b4e3ed8
  2166. 0024:Ret ucrtbase.malloc() retval=003f4ff0 ret=78d90dd2
  2167. 0024:Call ucrtbase.memset(003f4ff0,00000000,0000002c) ret=78da6651
  2168. 0024:Ret ucrtbase.memset() retval=003f4ff0 ret=78da6651
  2169. 0024:Call ucrtbase.memcpy(003f501c,78e00424,0000001c) ret=78da66c0
  2170. 0024:Ret ucrtbase.memcpy() retval=003f501c ret=78da66c0
  2171. 0024:Call user32.LoadStringW(78d50000,00000425,0031eb1c,00000000) ret=78da6604
  2172. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2173. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2174. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2175. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2176. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  2177. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  2178. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  2179. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6518 ret=7b4e3ed8
  2180. 0024:Ret ucrtbase.malloc() retval=003f6518 ret=78d90dd2
  2181. 0024:Call ucrtbase.memset(003f6518,00000000,0000002c) ret=78da6651
  2182. 0024:Ret ucrtbase.memset() retval=003f6518 ret=78da6651
  2183. 0024:Call ucrtbase.memcpy(003f6544,78e00442,0000002c) ret=78da66c0
  2184. 0024:Ret ucrtbase.memcpy() retval=003f6544 ret=78da66c0
  2185. 0024:Call user32.LoadStringW(78d50000,00000426,0031eb1c,00000000) ret=78da6604
  2186. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2187. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2188. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2189. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2190. 0024:Ret user32.LoadStringW() retval=0000001a ret=78da6604
  2191. 0024:Call ucrtbase.malloc(00000062) ret=78d90dd2
  2192. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000062) ret=7b4e3ed8
  2193. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6588 ret=7b4e3ed8
  2194. 0024:Ret ucrtbase.malloc() retval=003f6588 ret=78d90dd2
  2195. 0024:Call ucrtbase.memset(003f6588,00000000,0000002c) ret=78da6651
  2196. 0024:Ret ucrtbase.memset() retval=003f6588 ret=78da6651
  2197. 0024:Call ucrtbase.memcpy(003f65b4,78e00470,00000034) ret=78da66c0
  2198. 0024:Ret ucrtbase.memcpy() retval=003f65b4 ret=78da66c0
  2199. 0024:Call user32.LoadStringW(78d50000,00000427,0031eb1c,00000000) ret=78da6604
  2200. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2201. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2202. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2203. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2204. 0024:Ret user32.LoadStringW() retval=0000000a ret=78da6604
  2205. 0024:Call ucrtbase.malloc(00000042) ret=78d90dd2
  2206. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000042) ret=7b4e3ed8
  2207. 0024:Ret ntdll.RtlAllocateHeap() retval=003f72a8 ret=7b4e3ed8
  2208. 0024:Ret ucrtbase.malloc() retval=003f72a8 ret=78d90dd2
  2209. 0024:Call ucrtbase.memset(003f72a8,00000000,0000002c) ret=78da6651
  2210. 0024:Ret ucrtbase.memset() retval=003f72a8 ret=78da6651
  2211. 0024:Call ucrtbase.memcpy(003f72d4,78e004a6,00000014) ret=78da66c0
  2212. 0024:Ret ucrtbase.memcpy() retval=003f72d4 ret=78da66c0
  2213. 0024:Call user32.LoadStringW(78d50000,00000428,0031eb1c,00000000) ret=78da6604
  2214. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2215. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2216. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2217. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2218. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2219. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2220. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2221. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5050 ret=7b4e3ed8
  2222. 0024:Ret ucrtbase.malloc() retval=003f5050 ret=78d90dd2
  2223. 0024:Call ucrtbase.memset(003f5050,00000000,0000002c) ret=78da6651
  2224. 0024:Ret ucrtbase.memset() retval=003f5050 ret=78da6651
  2225. 0024:Call ucrtbase.memcpy(003f507c,78e004bc,0000001c) ret=78da66c0
  2226. 0024:Ret ucrtbase.memcpy() retval=003f507c ret=78da66c0
  2227. 0024:Call user32.LoadStringW(78d50000,00000429,0031eb1c,00000000) ret=78da6604
  2228. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2229. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2230. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2231. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2232. 0024:Ret user32.LoadStringW() retval=0000000a ret=78da6604
  2233. 0024:Call ucrtbase.malloc(00000042) ret=78d90dd2
  2234. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000042) ret=7b4e3ed8
  2235. 0024:Ret ntdll.RtlAllocateHeap() retval=003f72f8 ret=7b4e3ed8
  2236. 0024:Ret ucrtbase.malloc() retval=003f72f8 ret=78d90dd2
  2237. 0024:Call ucrtbase.memset(003f72f8,00000000,0000002c) ret=78da6651
  2238. 0024:Ret ucrtbase.memset() retval=003f72f8 ret=78da6651
  2239. 0024:Call ucrtbase.memcpy(003f7324,78e004da,00000014) ret=78da66c0
  2240. 0024:Ret ucrtbase.memcpy() retval=003f7324 ret=78da66c0
  2241. 0024:Call user32.LoadStringW(78d50000,0000042a,0031eb1c,00000000) ret=78da6604
  2242. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2243. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2244. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2245. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2246. 0024:Ret user32.LoadStringW() retval=00000013 ret=78da6604
  2247. 0024:Call ucrtbase.malloc(00000054) ret=78d90dd2
  2248. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000054) ret=7b4e3ed8
  2249. 0024:Ret ntdll.RtlAllocateHeap() retval=003f50b0 ret=7b4e3ed8
  2250. 0024:Ret ucrtbase.malloc() retval=003f50b0 ret=78d90dd2
  2251. 0024:Call ucrtbase.memset(003f50b0,00000000,0000002c) ret=78da6651
  2252. 0024:Ret ucrtbase.memset() retval=003f50b0 ret=78da6651
  2253. 0024:Call ucrtbase.memcpy(003f50dc,78e004f0,00000026) ret=78da66c0
  2254. 0024:Ret ucrtbase.memcpy() retval=003f50dc ret=78da66c0
  2255. 0024:Call user32.LoadStringW(78d50000,0000042b,0031eb1c,00000000) ret=78da6604
  2256. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2257. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2258. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2259. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2260. 0024:Ret user32.LoadStringW() retval=0000001a ret=78da6604
  2261. 0024:Call ucrtbase.malloc(00000062) ret=78d90dd2
  2262. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000062) ret=7b4e3ed8
  2263. 0024:Ret ntdll.RtlAllocateHeap() retval=003f65f8 ret=7b4e3ed8
  2264. 0024:Ret ucrtbase.malloc() retval=003f65f8 ret=78d90dd2
  2265. 0024:Call ucrtbase.memset(003f65f8,00000000,0000002c) ret=78da6651
  2266. 0024:Ret ucrtbase.memset() retval=003f65f8 ret=78da6651
  2267. 0024:Call ucrtbase.memcpy(003f6624,78e00518,00000034) ret=78da66c0
  2268. 0024:Ret ucrtbase.memcpy() retval=003f6624 ret=78da66c0
  2269. 0024:Call user32.LoadStringW(78d50000,0000042c,0031eb1c,00000000) ret=78da6604
  2270. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2271. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2272. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2273. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2274. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  2275. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  2276. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  2277. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7348 ret=7b4e3ed8
  2278. 0024:Ret ucrtbase.malloc() retval=003f7348 ret=78d90dd2
  2279. 0024:Call ucrtbase.memset(003f7348,00000000,0000002c) ret=78da6651
  2280. 0024:Ret ucrtbase.memset() retval=003f7348 ret=78da6651
  2281. 0024:Call ucrtbase.memcpy(003f7374,78e0054e,00000018) ret=78da66c0
  2282. 0024:Ret ucrtbase.memcpy() retval=003f7374 ret=78da66c0
  2283. 0024:Call user32.LoadStringW(78d50000,0000042d,0031eb1c,00000000) ret=78da6604
  2284. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2285. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2286. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2287. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2288. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  2289. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  2290. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  2291. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5110 ret=7b4e3ed8
  2292. 0024:Ret ucrtbase.malloc() retval=003f5110 ret=78d90dd2
  2293. 0024:Call ucrtbase.memset(003f5110,00000000,0000002c) ret=78da6651
  2294. 0024:Ret ucrtbase.memset() retval=003f5110 ret=78da6651
  2295. 0024:Call ucrtbase.memcpy(003f513c,78e00568,00000020) ret=78da66c0
  2296. 0024:Ret ucrtbase.memcpy() retval=003f513c ret=78da66c0
  2297. 0024:Call user32.LoadStringW(78d50000,0000042e,0031eb1c,00000000) ret=78da6604
  2298. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2299. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2300. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2301. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2302. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  2303. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  2304. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  2305. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5170 ret=7b4e3ed8
  2306. 0024:Ret ucrtbase.malloc() retval=003f5170 ret=78d90dd2
  2307. 0024:Call ucrtbase.memset(003f5170,00000000,0000002c) ret=78da6651
  2308. 0024:Ret ucrtbase.memset() retval=003f5170 ret=78da6651
  2309. 0024:Call ucrtbase.memcpy(003f519c,78e0058a,0000001e) ret=78da66c0
  2310. 0024:Ret ucrtbase.memcpy() retval=003f519c ret=78da66c0
  2311. 0024:Call user32.LoadStringW(78d50000,0000042e,0031eb1c,00000000) ret=78da6604
  2312. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2313. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2314. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2315. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2316. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  2317. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  2318. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  2319. 0024:Ret ntdll.RtlAllocateHeap() retval=003f51d0 ret=7b4e3ed8
  2320. 0024:Ret ucrtbase.malloc() retval=003f51d0 ret=78d90dd2
  2321. 0024:Call ucrtbase.memset(003f51d0,00000000,0000002c) ret=78da6651
  2322. 0024:Ret ucrtbase.memset() retval=003f51d0 ret=78da6651
  2323. 0024:Call ucrtbase.memcpy(003f51fc,78e0058a,0000001e) ret=78da66c0
  2324. 0024:Ret ucrtbase.memcpy() retval=003f51fc ret=78da66c0
  2325. 0024:Call user32.LoadStringW(78d50000,0000042f,0031eb1c,00000000) ret=78da6604
  2326. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2327. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2328. 0024:Call ntdll.LdrAccessResource(78d50000,78de9ae0,0031ea60,00000000) ret=7b966f9d
  2329. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2330. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  2331. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  2332. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  2333. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5230 ret=7b4e3ed8
  2334. 0024:Ret ucrtbase.malloc() retval=003f5230 ret=78d90dd2
  2335. 0024:Call ucrtbase.memset(003f5230,00000000,0000002c) ret=78da6651
  2336. 0024:Ret ucrtbase.memset() retval=003f5230 ret=78da6651
  2337. 0024:Call ucrtbase.memcpy(003f525c,78e005aa,00000024) ret=78da66c0
  2338. 0024:Ret ucrtbase.memcpy() retval=003f525c ret=78da66c0
  2339. 0024:Call user32.LoadStringW(78d50000,00000430,0031eb1c,00000000) ret=78da6604
  2340. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2341. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2342. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2343. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2344. 0024:Ret user32.LoadStringW() retval=00000025 ret=78da6604
  2345. 0024:Call ucrtbase.malloc(00000078) ret=78d90dd2
  2346. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000078) ret=7b4e3ed8
  2347. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7398 ret=7b4e3ed8
  2348. 0024:Ret ucrtbase.malloc() retval=003f7398 ret=78d90dd2
  2349. 0024:Call ucrtbase.memset(003f7398,00000000,0000002c) ret=78da6651
  2350. 0024:Ret ucrtbase.memset() retval=003f7398 ret=78da6651
  2351. 0024:Call ucrtbase.memcpy(003f73c4,78e0541e,0000004a) ret=78da66c0
  2352. 0024:Ret ucrtbase.memcpy() retval=003f73c4 ret=78da66c0
  2353. 0024:Call user32.LoadStringW(78d50000,00000431,0031eb1c,00000000) ret=78da6604
  2354. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2355. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2356. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2357. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2358. 0024:Ret user32.LoadStringW() retval=00000014 ret=78da6604
  2359. 0024:Call ucrtbase.malloc(00000056) ret=78d90dd2
  2360. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000056) ret=7b4e3ed8
  2361. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5290 ret=7b4e3ed8
  2362. 0024:Ret ucrtbase.malloc() retval=003f5290 ret=78d90dd2
  2363. 0024:Call ucrtbase.memset(003f5290,00000000,0000002c) ret=78da6651
  2364. 0024:Ret ucrtbase.memset() retval=003f5290 ret=78da6651
  2365. 0024:Call ucrtbase.memcpy(003f52bc,78e0546a,00000028) ret=78da66c0
  2366. 0024:Ret ucrtbase.memcpy() retval=003f52bc ret=78da66c0
  2367. 0024:Call user32.LoadStringW(78d50000,00000432,0031eb1c,00000000) ret=78da6604
  2368. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2369. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2370. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2371. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2372. 0024:Ret user32.LoadStringW() retval=0000001b ret=78da6604
  2373. 0024:Call ucrtbase.malloc(00000064) ret=78d90dd2
  2374. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000064) ret=7b4e3ed8
  2375. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6668 ret=7b4e3ed8
  2376. 0024:Ret ucrtbase.malloc() retval=003f6668 ret=78d90dd2
  2377. 0024:Call ucrtbase.memset(003f6668,00000000,0000002c) ret=78da6651
  2378. 0024:Ret ucrtbase.memset() retval=003f6668 ret=78da6651
  2379. 0024:Call ucrtbase.memcpy(003f6694,78e05494,00000036) ret=78da66c0
  2380. 0024:Ret ucrtbase.memcpy() retval=003f6694 ret=78da66c0
  2381. 0024:Call user32.LoadStringW(78d50000,00000433,0031eb1c,00000000) ret=78da6604
  2382. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2383. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2384. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2385. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2386. 0024:Ret user32.LoadStringW() retval=0000001e ret=78da6604
  2387. 0024:Call ucrtbase.malloc(0000006a) ret=78d90dd2
  2388. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000006a) ret=7b4e3ed8
  2389. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7418 ret=7b4e3ed8
  2390. 0024:Ret ucrtbase.malloc() retval=003f7418 ret=78d90dd2
  2391. 0024:Call ucrtbase.memset(003f7418,00000000,0000002c) ret=78da6651
  2392. 0024:Ret ucrtbase.memset() retval=003f7418 ret=78da6651
  2393. 0024:Call ucrtbase.memcpy(003f7444,78e054cc,0000003c) ret=78da66c0
  2394. 0024:Ret ucrtbase.memcpy() retval=003f7444 ret=78da66c0
  2395. 0024:Call user32.LoadStringW(78d50000,00000434,0031eb1c,00000000) ret=78da6604
  2396. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2397. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2398. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2399. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2400. 0024:Ret user32.LoadStringW() retval=00000008 ret=78da6604
  2401. 0024:Call ucrtbase.malloc(0000003e) ret=78d90dd2
  2402. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000003e) ret=7b4e3ed8
  2403. 0024:Ret ntdll.RtlAllocateHeap() retval=003f74a8 ret=7b4e3ed8
  2404. 0024:Ret ucrtbase.malloc() retval=003f74a8 ret=78d90dd2
  2405. 0024:Call ucrtbase.memset(003f74a8,00000000,0000002c) ret=78da6651
  2406. 0024:Ret ucrtbase.memset() retval=003f74a8 ret=78da6651
  2407. 0024:Call ucrtbase.memcpy(003f74d4,78e0550a,00000010) ret=78da66c0
  2408. 0024:Ret ucrtbase.memcpy() retval=003f74d4 ret=78da66c0
  2409. 0024:Call user32.LoadStringW(78d50000,00000435,0031eb1c,00000000) ret=78da6604
  2410. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2411. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2412. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2413. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2414. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  2415. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  2416. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  2417. 0024:Ret ntdll.RtlAllocateHeap() retval=003f74f8 ret=7b4e3ed8
  2418. 0024:Ret ucrtbase.malloc() retval=003f74f8 ret=78d90dd2
  2419. 0024:Call ucrtbase.memset(003f74f8,00000000,0000002c) ret=78da6651
  2420. 0024:Ret ucrtbase.memset() retval=003f74f8 ret=78da6651
  2421. 0024:Call ucrtbase.memcpy(003f7524,78e0551c,00000018) ret=78da66c0
  2422. 0024:Ret ucrtbase.memcpy() retval=003f7524 ret=78da66c0
  2423. 0024:Call user32.LoadStringW(78d50000,00000436,0031eb1c,00000000) ret=78da6604
  2424. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2425. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2426. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2427. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2428. 0024:Ret user32.LoadStringW() retval=00000014 ret=78da6604
  2429. 0024:Call ucrtbase.malloc(00000056) ret=78d90dd2
  2430. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000056) ret=7b4e3ed8
  2431. 0024:Ret ntdll.RtlAllocateHeap() retval=003f52f0 ret=7b4e3ed8
  2432. 0024:Ret ucrtbase.malloc() retval=003f52f0 ret=78d90dd2
  2433. 0024:Call ucrtbase.memset(003f52f0,00000000,0000002c) ret=78da6651
  2434. 0024:Ret ucrtbase.memset() retval=003f52f0 ret=78da6651
  2435. 0024:Call ucrtbase.memcpy(003f531c,78e05536,00000028) ret=78da66c0
  2436. 0024:Ret ucrtbase.memcpy() retval=003f531c ret=78da66c0
  2437. 0024:Call user32.LoadStringW(78d50000,00000437,0031eb1c,00000000) ret=78da6604
  2438. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2439. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2440. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2441. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2442. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  2443. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  2444. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  2445. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5350 ret=7b4e3ed8
  2446. 0024:Ret ucrtbase.malloc() retval=003f5350 ret=78d90dd2
  2447. 0024:Call ucrtbase.memset(003f5350,00000000,0000002c) ret=78da6651
  2448. 0024:Ret ucrtbase.memset() retval=003f5350 ret=78da6651
  2449. 0024:Call ucrtbase.memcpy(003f537c,78e05560,0000001e) ret=78da66c0
  2450. 0024:Ret ucrtbase.memcpy() retval=003f537c ret=78da66c0
  2451. 0024:Call user32.LoadStringW(78d50000,00000438,0031eb1c,00000000) ret=78da6604
  2452. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2453. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2454. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2455. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2456. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2457. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2458. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2459. 0024:Ret ntdll.RtlAllocateHeap() retval=003f53b0 ret=7b4e3ed8
  2460. 0024:Ret ucrtbase.malloc() retval=003f53b0 ret=78d90dd2
  2461. 0024:Call ucrtbase.memset(003f53b0,00000000,0000002c) ret=78da6651
  2462. 0024:Ret ucrtbase.memset() retval=003f53b0 ret=78da6651
  2463. 0024:Call ucrtbase.memcpy(003f53dc,78e05580,0000001c) ret=78da66c0
  2464. 0024:Ret ucrtbase.memcpy() retval=003f53dc ret=78da66c0
  2465. 0024:Call user32.LoadStringW(78d50000,00000439,0031eb1c,00000000) ret=78da6604
  2466. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2467. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2468. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2469. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2470. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2471. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2472. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2473. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5410 ret=7b4e3ed8
  2474. 0024:Ret ucrtbase.malloc() retval=003f5410 ret=78d90dd2
  2475. 0024:Call ucrtbase.memset(003f5410,00000000,0000002c) ret=78da6651
  2476. 0024:Ret ucrtbase.memset() retval=003f5410 ret=78da6651
  2477. 0024:Call ucrtbase.memcpy(003f543c,78e0559e,0000001c) ret=78da66c0
  2478. 0024:Ret ucrtbase.memcpy() retval=003f543c ret=78da66c0
  2479. 0024:Call user32.LoadStringW(78d50000,0000043a,0031eb1c,00000000) ret=78da6604
  2480. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2481. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2482. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2483. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2484. 0024:Ret user32.LoadStringW() retval=0000000b ret=78da6604
  2485. 0024:Call ucrtbase.malloc(00000044) ret=78d90dd2
  2486. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000044) ret=7b4e3ed8
  2487. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7548 ret=7b4e3ed8
  2488. 0024:Ret ucrtbase.malloc() retval=003f7548 ret=78d90dd2
  2489. 0024:Call ucrtbase.memset(003f7548,00000000,0000002c) ret=78da6651
  2490. 0024:Ret ucrtbase.memset() retval=003f7548 ret=78da6651
  2491. 0024:Call ucrtbase.memcpy(003f7574,78e055bc,00000016) ret=78da66c0
  2492. 0024:Ret ucrtbase.memcpy() retval=003f7574 ret=78da66c0
  2493. 0024:Call user32.LoadStringW(78d50000,0000043b,0031eb1c,00000000) ret=78da6604
  2494. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2495. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2496. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2497. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2498. 0024:Ret user32.LoadStringW() retval=0000000d ret=78da6604
  2499. 0024:Call ucrtbase.malloc(00000048) ret=78d90dd2
  2500. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000048) ret=7b4e3ed8
  2501. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7598 ret=7b4e3ed8
  2502. 0024:Ret ucrtbase.malloc() retval=003f7598 ret=78d90dd2
  2503. 0024:Call ucrtbase.memset(003f7598,00000000,0000002c) ret=78da6651
  2504. 0024:Ret ucrtbase.memset() retval=003f7598 ret=78da6651
  2505. 0024:Call ucrtbase.memcpy(003f75c4,78e055d4,0000001a) ret=78da66c0
  2506. 0024:Ret ucrtbase.memcpy() retval=003f75c4 ret=78da66c0
  2507. 0024:Call user32.LoadStringW(78d50000,0000043c,0031eb1c,00000000) ret=78da6604
  2508. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2509. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2510. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2511. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2512. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  2513. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  2514. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  2515. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5470 ret=7b4e3ed8
  2516. 0024:Ret ucrtbase.malloc() retval=003f5470 ret=78d90dd2
  2517. 0024:Call ucrtbase.memset(003f5470,00000000,0000002c) ret=78da6651
  2518. 0024:Ret ucrtbase.memset() retval=003f5470 ret=78da6651
  2519. 0024:Call ucrtbase.memcpy(003f549c,78e055f0,00000020) ret=78da66c0
  2520. 0024:Ret ucrtbase.memcpy() retval=003f549c ret=78da66c0
  2521. 0024:Call user32.LoadStringW(78d50000,0000043d,0031eb1c,00000000) ret=78da6604
  2522. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2523. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2524. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2525. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2526. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  2527. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  2528. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  2529. 0024:Ret ntdll.RtlAllocateHeap() retval=003f66d8 ret=7b4e3ed8
  2530. 0024:Ret ucrtbase.malloc() retval=003f66d8 ret=78d90dd2
  2531. 0024:Call ucrtbase.memset(003f66d8,00000000,0000002c) ret=78da6651
  2532. 0024:Ret ucrtbase.memset() retval=003f66d8 ret=78da6651
  2533. 0024:Call ucrtbase.memcpy(003f6704,78e05612,0000002e) ret=78da66c0
  2534. 0024:Ret ucrtbase.memcpy() retval=003f6704 ret=78da66c0
  2535. 0024:Call user32.LoadStringW(78d50000,0000043e,0031eb1c,00000000) ret=78da6604
  2536. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2537. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2538. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2539. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2540. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  2541. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  2542. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  2543. 0024:Ret ntdll.RtlAllocateHeap() retval=003f54d0 ret=7b4e3ed8
  2544. 0024:Ret ucrtbase.malloc() retval=003f54d0 ret=78d90dd2
  2545. 0024:Call ucrtbase.memset(003f54d0,00000000,0000002c) ret=78da6651
  2546. 0024:Ret ucrtbase.memset() retval=003f54d0 ret=78da6651
  2547. 0024:Call ucrtbase.memcpy(003f54fc,78e05642,0000001e) ret=78da66c0
  2548. 0024:Ret ucrtbase.memcpy() retval=003f54fc ret=78da66c0
  2549. 0024:Call user32.LoadStringW(78d50000,0000043f,0031eb1c,00000000) ret=78da6604
  2550. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2551. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2552. 0024:Call ntdll.LdrAccessResource(78d50000,78de9cf0,0031ea60,00000000) ret=7b966f9d
  2553. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2554. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  2555. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  2556. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  2557. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5530 ret=7b4e3ed8
  2558. 0024:Ret ucrtbase.malloc() retval=003f5530 ret=78d90dd2
  2559. 0024:Call ucrtbase.memset(003f5530,00000000,0000002c) ret=78da6651
  2560. 0024:Ret ucrtbase.memset() retval=003f5530 ret=78da6651
  2561. 0024:Call ucrtbase.memcpy(003f555c,78e05662,00000020) ret=78da66c0
  2562. 0024:Ret ucrtbase.memcpy() retval=003f555c ret=78da66c0
  2563. 0024:Call user32.LoadStringW(78d50000,00000440,0031eb1c,00000000) ret=78da6604
  2564. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2565. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2566. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2567. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2568. 0024:Ret user32.LoadStringW() retval=0000001c ret=78da6604
  2569. 0024:Call ucrtbase.malloc(00000066) ret=78d90dd2
  2570. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000066) ret=7b4e3ed8
  2571. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6748 ret=7b4e3ed8
  2572. 0024:Ret ucrtbase.malloc() retval=003f6748 ret=78d90dd2
  2573. 0024:Call ucrtbase.memset(003f6748,00000000,0000002c) ret=78da6651
  2574. 0024:Ret ucrtbase.memset() retval=003f6748 ret=78da6651
  2575. 0024:Call ucrtbase.memcpy(003f6774,78e0afae,00000038) ret=78da66c0
  2576. 0024:Ret ucrtbase.memcpy() retval=003f6774 ret=78da66c0
  2577. 0024:Call user32.LoadStringW(78d50000,00000441,0031eb1c,00000000) ret=78da6604
  2578. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2579. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2580. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2581. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2582. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  2583. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  2584. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  2585. 0024:Ret ntdll.RtlAllocateHeap() retval=003f67b8 ret=7b4e3ed8
  2586. 0024:Ret ucrtbase.malloc() retval=003f67b8 ret=78d90dd2
  2587. 0024:Call ucrtbase.memset(003f67b8,00000000,0000002c) ret=78da6651
  2588. 0024:Ret ucrtbase.memset() retval=003f67b8 ret=78da6651
  2589. 0024:Call ucrtbase.memcpy(003f67e4,78e0afe8,0000002e) ret=78da66c0
  2590. 0024:Ret ucrtbase.memcpy() retval=003f67e4 ret=78da66c0
  2591. 0024:Call user32.LoadStringW(78d50000,00000442,0031eb1c,00000000) ret=78da6604
  2592. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2593. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2594. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2595. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2596. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  2597. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  2598. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  2599. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5590 ret=7b4e3ed8
  2600. 0024:Ret ucrtbase.malloc() retval=003f5590 ret=78d90dd2
  2601. 0024:Call ucrtbase.memset(003f5590,00000000,0000002c) ret=78da6651
  2602. 0024:Ret ucrtbase.memset() retval=003f5590 ret=78da6651
  2603. 0024:Call ucrtbase.memcpy(003f55bc,78e0b018,00000020) ret=78da66c0
  2604. 0024:Ret ucrtbase.memcpy() retval=003f55bc ret=78da66c0
  2605. 0024:Call user32.LoadStringW(78d50000,00000443,0031eb1c,00000000) ret=78da6604
  2606. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2607. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2608. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2609. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2610. 0024:Ret user32.LoadStringW() retval=00000019 ret=78da6604
  2611. 0024:Call ucrtbase.malloc(00000060) ret=78d90dd2
  2612. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000060) ret=7b4e3ed8
  2613. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6828 ret=7b4e3ed8
  2614. 0024:Ret ucrtbase.malloc() retval=003f6828 ret=78d90dd2
  2615. 0024:Call ucrtbase.memset(003f6828,00000000,0000002c) ret=78da6651
  2616. 0024:Ret ucrtbase.memset() retval=003f6828 ret=78da6651
  2617. 0024:Call ucrtbase.memcpy(003f6854,78e0b03a,00000032) ret=78da66c0
  2618. 0024:Ret ucrtbase.memcpy() retval=003f6854 ret=78da66c0
  2619. 0024:Call user32.LoadStringW(78d50000,00000444,0031eb1c,00000000) ret=78da6604
  2620. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2621. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2622. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2623. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2624. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  2625. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  2626. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  2627. 0024:Ret ntdll.RtlAllocateHeap() retval=003f55f0 ret=7b4e3ed8
  2628. 0024:Ret ucrtbase.malloc() retval=003f55f0 ret=78d90dd2
  2629. 0024:Call ucrtbase.memset(003f55f0,00000000,0000002c) ret=78da6651
  2630. 0024:Ret ucrtbase.memset() retval=003f55f0 ret=78da6651
  2631. 0024:Call ucrtbase.memcpy(003f561c,78e0b06e,00000024) ret=78da66c0
  2632. 0024:Ret ucrtbase.memcpy() retval=003f561c ret=78da66c0
  2633. 0024:Call user32.LoadStringW(78d50000,00000445,0031eb1c,00000000) ret=78da6604
  2634. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2635. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2636. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2637. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2638. 0024:Ret user32.LoadStringW() retval=00000020 ret=78da6604
  2639. 0024:Call ucrtbase.malloc(0000006e) ret=78d90dd2
  2640. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000006e) ret=7b4e3ed8
  2641. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7e58 ret=7b4e3ed8
  2642. 0024:Ret ucrtbase.malloc() retval=003f7e58 ret=78d90dd2
  2643. 0024:Call ucrtbase.memset(003f7e58,00000000,0000002c) ret=78da6651
  2644. 0024:Ret ucrtbase.memset() retval=003f7e58 ret=78da6651
  2645. 0024:Call ucrtbase.memcpy(003f7e84,78e0b094,00000040) ret=78da66c0
  2646. 0024:Ret ucrtbase.memcpy() retval=003f7e84 ret=78da66c0
  2647. 0024:Call user32.LoadStringW(78d50000,00000446,0031eb1c,00000000) ret=78da6604
  2648. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2649. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2650. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2651. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2652. 0024:Ret user32.LoadStringW() retval=00000013 ret=78da6604
  2653. 0024:Call ucrtbase.malloc(00000054) ret=78d90dd2
  2654. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000054) ret=7b4e3ed8
  2655. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5650 ret=7b4e3ed8
  2656. 0024:Ret ucrtbase.malloc() retval=003f5650 ret=78d90dd2
  2657. 0024:Call ucrtbase.memset(003f5650,00000000,0000002c) ret=78da6651
  2658. 0024:Ret ucrtbase.memset() retval=003f5650 ret=78da6651
  2659. 0024:Call ucrtbase.memcpy(003f567c,78e0b0d6,00000026) ret=78da66c0
  2660. 0024:Ret ucrtbase.memcpy() retval=003f567c ret=78da66c0
  2661. 0024:Call user32.LoadStringW(78d50000,00000447,0031eb1c,00000000) ret=78da6604
  2662. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2663. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2664. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2665. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2666. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  2667. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  2668. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  2669. 0024:Ret ntdll.RtlAllocateHeap() retval=003f75e8 ret=7b4e3ed8
  2670. 0024:Ret ucrtbase.malloc() retval=003f75e8 ret=78d90dd2
  2671. 0024:Call ucrtbase.memset(003f75e8,00000000,0000002c) ret=78da6651
  2672. 0024:Ret ucrtbase.memset() retval=003f75e8 ret=78da6651
  2673. 0024:Call ucrtbase.memcpy(003f7614,78e0b0fe,00000018) ret=78da66c0
  2674. 0024:Ret ucrtbase.memcpy() retval=003f7614 ret=78da66c0
  2675. 0024:Call user32.LoadStringW(78d50000,00000448,0031eb1c,00000000) ret=78da6604
  2676. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2677. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2678. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2679. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2680. 0024:Ret user32.LoadStringW() retval=00000015 ret=78da6604
  2681. 0024:Call ucrtbase.malloc(00000058) ret=78d90dd2
  2682. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000058) ret=7b4e3ed8
  2683. 0024:Ret ntdll.RtlAllocateHeap() retval=003f56b0 ret=7b4e3ed8
  2684. 0024:Ret ucrtbase.malloc() retval=003f56b0 ret=78d90dd2
  2685. 0024:Call ucrtbase.memset(003f56b0,00000000,0000002c) ret=78da6651
  2686. 0024:Ret ucrtbase.memset() retval=003f56b0 ret=78da6651
  2687. 0024:Call ucrtbase.memcpy(003f56dc,78e0b118,0000002a) ret=78da66c0
  2688. 0024:Ret ucrtbase.memcpy() retval=003f56dc ret=78da66c0
  2689. 0024:Call user32.LoadStringW(78d50000,00000449,0031eb1c,00000000) ret=78da6604
  2690. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2691. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2692. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2693. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2694. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  2695. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  2696. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  2697. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6898 ret=7b4e3ed8
  2698. 0024:Ret ucrtbase.malloc() retval=003f6898 ret=78d90dd2
  2699. 0024:Call ucrtbase.memset(003f6898,00000000,0000002c) ret=78da6651
  2700. 0024:Ret ucrtbase.memset() retval=003f6898 ret=78da6651
  2701. 0024:Call ucrtbase.memcpy(003f68c4,78e0b144,0000002e) ret=78da66c0
  2702. 0024:Ret ucrtbase.memcpy() retval=003f68c4 ret=78da66c0
  2703. 0024:Call user32.LoadStringW(78d50000,0000044a,0031eb1c,00000000) ret=78da6604
  2704. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2705. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2706. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2707. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2708. 0024:Ret user32.LoadStringW() retval=00000020 ret=78da6604
  2709. 0024:Call ucrtbase.malloc(0000006e) ret=78d90dd2
  2710. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000006e) ret=7b4e3ed8
  2711. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7ed0 ret=7b4e3ed8
  2712. 0024:Ret ucrtbase.malloc() retval=003f7ed0 ret=78d90dd2
  2713. 0024:Call ucrtbase.memset(003f7ed0,00000000,0000002c) ret=78da6651
  2714. 0024:Ret ucrtbase.memset() retval=003f7ed0 ret=78da6651
  2715. 0024:Call ucrtbase.memcpy(003f7efc,78e0b174,00000040) ret=78da66c0
  2716. 0024:Ret ucrtbase.memcpy() retval=003f7efc ret=78da66c0
  2717. 0024:Call user32.LoadStringW(78d50000,0000044b,0031eb1c,00000000) ret=78da6604
  2718. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2719. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2720. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2721. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2722. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2723. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2724. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2725. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5710 ret=7b4e3ed8
  2726. 0024:Ret ucrtbase.malloc() retval=003f5710 ret=78d90dd2
  2727. 0024:Call ucrtbase.memset(003f5710,00000000,0000002c) ret=78da6651
  2728. 0024:Ret ucrtbase.memset() retval=003f5710 ret=78da6651
  2729. 0024:Call ucrtbase.memcpy(003f573c,78e0b1b6,0000001c) ret=78da66c0
  2730. 0024:Ret ucrtbase.memcpy() retval=003f573c ret=78da66c0
  2731. 0024:Call user32.LoadStringW(78d50000,0000044c,0031eb1c,00000000) ret=78da6604
  2732. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2733. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2734. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2735. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2736. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  2737. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  2738. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  2739. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7638 ret=7b4e3ed8
  2740. 0024:Ret ucrtbase.malloc() retval=003f7638 ret=78d90dd2
  2741. 0024:Call ucrtbase.memset(003f7638,00000000,0000002c) ret=78da6651
  2742. 0024:Ret ucrtbase.memset() retval=003f7638 ret=78da6651
  2743. 0024:Call ucrtbase.memcpy(003f7664,78e0b1d4,00000018) ret=78da66c0
  2744. 0024:Ret ucrtbase.memcpy() retval=003f7664 ret=78da66c0
  2745. 0024:Call user32.LoadStringW(78d50000,0000044d,0031eb1c,00000000) ret=78da6604
  2746. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2747. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2748. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2749. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2750. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  2751. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  2752. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  2753. 0024:Ret ntdll.RtlAllocateHeap() retval=003f5770 ret=7b4e3ed8
  2754. 0024:Ret ucrtbase.malloc() retval=003f5770 ret=78d90dd2
  2755. 0024:Call ucrtbase.memset(003f5770,00000000,0000002c) ret=78da6651
  2756. 0024:Ret ucrtbase.memset() retval=003f5770 ret=78da6651
  2757. 0024:Call ucrtbase.memcpy(003f579c,78e0b1ee,0000001e) ret=78da66c0
  2758. 0024:Ret ucrtbase.memcpy() retval=003f579c ret=78da66c0
  2759. 0024:Call user32.LoadStringW(78d50000,0000044e,0031eb1c,00000000) ret=78da6604
  2760. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2761. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2762. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2763. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2764. 0024:Ret user32.LoadStringW() retval=00000008 ret=78da6604
  2765. 0024:Call ucrtbase.malloc(0000003e) ret=78d90dd2
  2766. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000003e) ret=7b4e3ed8
  2767. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7688 ret=7b4e3ed8
  2768. 0024:Ret ucrtbase.malloc() retval=003f7688 ret=78d90dd2
  2769. 0024:Call ucrtbase.memset(003f7688,00000000,0000002c) ret=78da6651
  2770. 0024:Ret ucrtbase.memset() retval=003f7688 ret=78da6651
  2771. 0024:Call ucrtbase.memcpy(003f76b4,78e0b20e,00000010) ret=78da66c0
  2772. 0024:Ret ucrtbase.memcpy() retval=003f76b4 ret=78da66c0
  2773. 0024:Call user32.LoadStringW(78d50000,0000044f,0031eb1c,00000000) ret=78da6604
  2774. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2775. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2776. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  2777. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2778. 0024:Ret user32.LoadStringW() retval=0000000f ret=78da6604
  2779. 0024:Call ucrtbase.malloc(0000004c) ret=78d90dd2
  2780. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004c) ret=7b4e3ed8
  2781. 0024:Ret ntdll.RtlAllocateHeap() retval=003f57d0 ret=7b4e3ed8
  2782. 0024:Ret ucrtbase.malloc() retval=003f57d0 ret=78d90dd2
  2783. 0024:Call ucrtbase.memset(003f57d0,00000000,0000002c) ret=78da6651
  2784. 0024:Ret ucrtbase.memset() retval=003f57d0 ret=78da6651
  2785. 0024:Call ucrtbase.memcpy(003f57fc,78e0b220,0000001e) ret=78da66c0
  2786. 0024:Ret ucrtbase.memcpy() retval=003f57fc ret=78da66c0
  2787. 0024:Call user32.LoadStringW(78d50000,00000450,0031eb1c,00000000) ret=78da6604
  2788. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2789. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2790. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2791. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2792. 0024:Ret user32.LoadStringW() retval=00000007 ret=78da6604
  2793. 0024:Call ucrtbase.malloc(0000003c) ret=78d90dd2
  2794. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000003c) ret=7b4e3ed8
  2795. 0024:Ret ntdll.RtlAllocateHeap() retval=003f76d8 ret=7b4e3ed8
  2796. 0024:Ret ucrtbase.malloc() retval=003f76d8 ret=78d90dd2
  2797. 0024:Call ucrtbase.memset(003f76d8,00000000,0000002c) ret=78da6651
  2798. 0024:Ret ucrtbase.memset() retval=003f76d8 ret=78da6651
  2799. 0024:Call ucrtbase.memcpy(003f7704,78e109de,0000000e) ret=78da66c0
  2800. 0024:Ret ucrtbase.memcpy() retval=003f7704 ret=78da66c0
  2801. 0024:Call user32.LoadStringW(78d50000,00000451,0031eb1c,00000000) ret=78da6604
  2802. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2803. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2804. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2805. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2806. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  2807. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  2808. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  2809. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7f60 ret=7b4e3ed8
  2810. 0024:Ret ucrtbase.malloc() retval=003f7f60 ret=78d90dd2
  2811. 0024:Call ucrtbase.memset(003f7f60,00000000,0000002c) ret=78da6651
  2812. 0024:Ret ucrtbase.memset() retval=003f7f60 ret=78da6651
  2813. 0024:Call ucrtbase.memcpy(003f7f8c,78e109ee,0000001c) ret=78da66c0
  2814. 0024:Ret ucrtbase.memcpy() retval=003f7f8c ret=78da66c0
  2815. 0024:Call user32.LoadStringW(78d50000,00000452,0031eb1c,00000000) ret=78da6604
  2816. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2817. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2818. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2819. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2820. 0024:Ret user32.LoadStringW() retval=0000000d ret=78da6604
  2821. 0024:Call ucrtbase.malloc(00000048) ret=78d90dd2
  2822. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000048) ret=7b4e3ed8
  2823. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7728 ret=7b4e3ed8
  2824. 0024:Ret ucrtbase.malloc() retval=003f7728 ret=78d90dd2
  2825. 0024:Call ucrtbase.memset(003f7728,00000000,0000002c) ret=78da6651
  2826. 0024:Ret ucrtbase.memset() retval=003f7728 ret=78da6651
  2827. 0024:Call ucrtbase.memcpy(003f7754,78e10a0c,0000001a) ret=78da66c0
  2828. 0024:Ret ucrtbase.memcpy() retval=003f7754 ret=78da66c0
  2829. 0024:Call user32.LoadStringW(78d50000,00000453,0031eb1c,00000000) ret=78da6604
  2830. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2831. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2832. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2833. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2834. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  2835. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  2836. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  2837. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6908 ret=7b4e3ed8
  2838. 0024:Ret ucrtbase.malloc() retval=003f6908 ret=78d90dd2
  2839. 0024:Call ucrtbase.memset(003f6908,00000000,0000002c) ret=78da6651
  2840. 0024:Ret ucrtbase.memset() retval=003f6908 ret=78da6651
  2841. 0024:Call ucrtbase.memcpy(003f6934,78e10a28,0000002c) ret=78da66c0
  2842. 0024:Ret ucrtbase.memcpy() retval=003f6934 ret=78da66c0
  2843. 0024:Call user32.LoadStringW(78d50000,00000454,0031eb1c,00000000) ret=78da6604
  2844. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2845. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2846. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2847. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2848. 0024:Ret user32.LoadStringW() retval=0000001d ret=78da6604
  2849. 0024:Call ucrtbase.malloc(00000068) ret=78d90dd2
  2850. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000068) ret=7b4e3ed8
  2851. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6978 ret=7b4e3ed8
  2852. 0024:Ret ucrtbase.malloc() retval=003f6978 ret=78d90dd2
  2853. 0024:Call ucrtbase.memset(003f6978,00000000,0000002c) ret=78da6651
  2854. 0024:Ret ucrtbase.memset() retval=003f6978 ret=78da6651
  2855. 0024:Call ucrtbase.memcpy(003f69a4,78e10a56,0000003a) ret=78da66c0
  2856. 0024:Ret ucrtbase.memcpy() retval=003f69a4 ret=78da66c0
  2857. 0024:Call user32.LoadStringW(78d50000,00000455,0031eb1c,00000000) ret=78da6604
  2858. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2859. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2860. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2861. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2862. 0024:Ret user32.LoadStringW() retval=00000018 ret=78da6604
  2863. 0024:Call ucrtbase.malloc(0000005e) ret=78d90dd2
  2864. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005e) ret=7b4e3ed8
  2865. 0024:Ret ntdll.RtlAllocateHeap() retval=003f69e8 ret=7b4e3ed8
  2866. 0024:Ret ucrtbase.malloc() retval=003f69e8 ret=78d90dd2
  2867. 0024:Call ucrtbase.memset(003f69e8,00000000,0000002c) ret=78da6651
  2868. 0024:Ret ucrtbase.memset() retval=003f69e8 ret=78da6651
  2869. 0024:Call ucrtbase.memcpy(003f6a14,78e10a92,00000030) ret=78da66c0
  2870. 0024:Ret ucrtbase.memcpy() retval=003f6a14 ret=78da66c0
  2871. 0024:Call user32.LoadStringW(78d50000,00000456,0031eb1c,00000000) ret=78da6604
  2872. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2873. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2874. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2875. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2876. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  2877. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  2878. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  2879. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7fc0 ret=7b4e3ed8
  2880. 0024:Ret ucrtbase.malloc() retval=003f7fc0 ret=78d90dd2
  2881. 0024:Call ucrtbase.memset(003f7fc0,00000000,0000002c) ret=78da6651
  2882. 0024:Ret ucrtbase.memset() retval=003f7fc0 ret=78da6651
  2883. 0024:Call ucrtbase.memcpy(003f7fec,78e10ac4,00000024) ret=78da66c0
  2884. 0024:Ret ucrtbase.memcpy() retval=003f7fec ret=78da66c0
  2885. 0024:Call user32.LoadStringW(78d50000,00000457,0031eb1c,00000000) ret=78da6604
  2886. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2887. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2888. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2889. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2890. 0024:Ret user32.LoadStringW() retval=00000015 ret=78da6604
  2891. 0024:Call ucrtbase.malloc(00000058) ret=78d90dd2
  2892. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000058) ret=7b4e3ed8
  2893. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8020 ret=7b4e3ed8
  2894. 0024:Ret ucrtbase.malloc() retval=003f8020 ret=78d90dd2
  2895. 0024:Call ucrtbase.memset(003f8020,00000000,0000002c) ret=78da6651
  2896. 0024:Ret ucrtbase.memset() retval=003f8020 ret=78da6651
  2897. 0024:Call ucrtbase.memcpy(003f804c,78e10aea,0000002a) ret=78da66c0
  2898. 0024:Ret ucrtbase.memcpy() retval=003f804c ret=78da66c0
  2899. 0024:Call user32.LoadStringW(78d50000,00000458,0031eb1c,00000000) ret=78da6604
  2900. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2901. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2902. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2903. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2904. 0024:Ret user32.LoadStringW() retval=00000015 ret=78da6604
  2905. 0024:Call ucrtbase.malloc(00000058) ret=78d90dd2
  2906. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000058) ret=7b4e3ed8
  2907. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8080 ret=7b4e3ed8
  2908. 0024:Ret ucrtbase.malloc() retval=003f8080 ret=78d90dd2
  2909. 0024:Call ucrtbase.memset(003f8080,00000000,0000002c) ret=78da6651
  2910. 0024:Ret ucrtbase.memset() retval=003f8080 ret=78da6651
  2911. 0024:Call ucrtbase.memcpy(003f80ac,78e10b16,0000002a) ret=78da66c0
  2912. 0024:Ret ucrtbase.memcpy() retval=003f80ac ret=78da66c0
  2913. 0024:Call user32.LoadStringW(78d50000,00000459,0031eb1c,00000000) ret=78da6604
  2914. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2915. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2916. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2917. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2918. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  2919. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  2920. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  2921. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7778 ret=7b4e3ed8
  2922. 0024:Ret ucrtbase.malloc() retval=003f7778 ret=78d90dd2
  2923. 0024:Call ucrtbase.memset(003f7778,00000000,0000002c) ret=78da6651
  2924. 0024:Ret ucrtbase.memset() retval=003f7778 ret=78da6651
  2925. 0024:Call ucrtbase.memcpy(003f77a4,78e10b42,00000018) ret=78da66c0
  2926. 0024:Ret ucrtbase.memcpy() retval=003f77a4 ret=78da66c0
  2927. 0024:Call user32.LoadStringW(78d50000,0000045a,0031eb1c,00000000) ret=78da6604
  2928. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2929. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2930. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2931. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2932. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  2933. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  2934. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  2935. 0024:Ret ntdll.RtlAllocateHeap() retval=003f77c8 ret=7b4e3ed8
  2936. 0024:Ret ucrtbase.malloc() retval=003f77c8 ret=78d90dd2
  2937. 0024:Call ucrtbase.memset(003f77c8,00000000,0000002c) ret=78da6651
  2938. 0024:Ret ucrtbase.memset() retval=003f77c8 ret=78da6651
  2939. 0024:Call ucrtbase.memcpy(003f77f4,78e10b5c,00000018) ret=78da66c0
  2940. 0024:Ret ucrtbase.memcpy() retval=003f77f4 ret=78da66c0
  2941. 0024:Call user32.LoadStringW(78d50000,0000045b,0031eb1c,00000000) ret=78da6604
  2942. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2943. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2944. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2945. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2946. 0024:Ret user32.LoadStringW() retval=0000000d ret=78da6604
  2947. 0024:Call ucrtbase.malloc(00000048) ret=78d90dd2
  2948. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000048) ret=7b4e3ed8
  2949. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7818 ret=7b4e3ed8
  2950. 0024:Ret ucrtbase.malloc() retval=003f7818 ret=78d90dd2
  2951. 0024:Call ucrtbase.memset(003f7818,00000000,0000002c) ret=78da6651
  2952. 0024:Ret ucrtbase.memset() retval=003f7818 ret=78da6651
  2953. 0024:Call ucrtbase.memcpy(003f7844,78e10b76,0000001a) ret=78da66c0
  2954. 0024:Ret ucrtbase.memcpy() retval=003f7844 ret=78da66c0
  2955. 0024:Call user32.LoadStringW(78d50000,0000045c,0031eb1c,00000000) ret=78da6604
  2956. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2957. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2958. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2959. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2960. 0024:Ret user32.LoadStringW() retval=0000001c ret=78da6604
  2961. 0024:Call ucrtbase.malloc(00000066) ret=78d90dd2
  2962. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000066) ret=7b4e3ed8
  2963. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6a58 ret=7b4e3ed8
  2964. 0024:Ret ucrtbase.malloc() retval=003f6a58 ret=78d90dd2
  2965. 0024:Call ucrtbase.memset(003f6a58,00000000,0000002c) ret=78da6651
  2966. 0024:Ret ucrtbase.memset() retval=003f6a58 ret=78da6651
  2967. 0024:Call ucrtbase.memcpy(003f6a84,78e10b92,00000038) ret=78da66c0
  2968. 0024:Ret ucrtbase.memcpy() retval=003f6a84 ret=78da66c0
  2969. 0024:Call user32.LoadStringW(78d50000,0000045d,0031eb1c,00000000) ret=78da6604
  2970. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2971. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2972. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2973. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2974. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  2975. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  2976. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  2977. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6ac8 ret=7b4e3ed8
  2978. 0024:Ret ucrtbase.malloc() retval=003f6ac8 ret=78d90dd2
  2979. 0024:Call ucrtbase.memset(003f6ac8,00000000,0000002c) ret=78da6651
  2980. 0024:Ret ucrtbase.memset() retval=003f6ac8 ret=78da6651
  2981. 0024:Call ucrtbase.memcpy(003f6af4,78e10bcc,0000002e) ret=78da66c0
  2982. 0024:Ret ucrtbase.memcpy() retval=003f6af4 ret=78da66c0
  2983. 0024:Call user32.LoadStringW(78d50000,0000045e,0031eb1c,00000000) ret=78da6604
  2984. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2985. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  2986. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  2987. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  2988. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  2989. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  2990. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  2991. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6b38 ret=7b4e3ed8
  2992. 0024:Ret ucrtbase.malloc() retval=003f6b38 ret=78d90dd2
  2993. 0024:Call ucrtbase.memset(003f6b38,00000000,0000002c) ret=78da6651
  2994. 0024:Ret ucrtbase.memset() retval=003f6b38 ret=78da6651
  2995. 0024:Call ucrtbase.memcpy(003f6b64,78e10bfc,0000002c) ret=78da66c0
  2996. 0024:Ret ucrtbase.memcpy() retval=003f6b64 ret=78da66c0
  2997. 0024:Call user32.LoadStringW(78d50000,0000045f,0031eb1c,00000000) ret=78da6604
  2998. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  2999. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3000. 0024:Call ntdll.LdrAccessResource(78d50000,78dea110,0031ea60,00000000) ret=7b966f9d
  3001. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3002. 0024:Ret user32.LoadStringW() retval=0000001e ret=78da6604
  3003. 0024:Call ucrtbase.malloc(0000006a) ret=78d90dd2
  3004. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000006a) ret=7b4e3ed8
  3005. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8b00 ret=7b4e3ed8
  3006. 0024:Ret ucrtbase.malloc() retval=003f8b00 ret=78d90dd2
  3007. 0024:Call ucrtbase.memset(003f8b00,00000000,0000002c) ret=78da6651
  3008. 0024:Ret ucrtbase.memset() retval=003f8b00 ret=78da6651
  3009. 0024:Call ucrtbase.memcpy(003f8b2c,78e10c2a,0000003c) ret=78da66c0
  3010. 0024:Ret ucrtbase.memcpy() retval=003f8b2c ret=78da66c0
  3011. 0024:Call user32.LoadStringW(78d50000,00000460,0031eb1c,00000000) ret=78da6604
  3012. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3013. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3014. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3015. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3016. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  3017. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  3018. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  3019. 0024:Ret ntdll.RtlAllocateHeap() retval=003f80e0 ret=7b4e3ed8
  3020. 0024:Ret ucrtbase.malloc() retval=003f80e0 ret=78d90dd2
  3021. 0024:Call ucrtbase.memset(003f80e0,00000000,0000002c) ret=78da6651
  3022. 0024:Ret ucrtbase.memset() retval=003f80e0 ret=78da6651
  3023. 0024:Call ucrtbase.memcpy(003f810c,78e175ce,00000020) ret=78da66c0
  3024. 0024:Ret ucrtbase.memcpy() retval=003f810c ret=78da66c0
  3025. 0024:Call user32.LoadStringW(78d50000,00000461,0031eb1c,00000000) ret=78da6604
  3026. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3027. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3028. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3029. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3030. 0024:Ret user32.LoadStringW() retval=00000016 ret=78da6604
  3031. 0024:Call ucrtbase.malloc(0000005a) ret=78d90dd2
  3032. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005a) ret=7b4e3ed8
  3033. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6ba8 ret=7b4e3ed8
  3034. 0024:Ret ucrtbase.malloc() retval=003f6ba8 ret=78d90dd2
  3035. 0024:Call ucrtbase.memset(003f6ba8,00000000,0000002c) ret=78da6651
  3036. 0024:Ret ucrtbase.memset() retval=003f6ba8 ret=78da6651
  3037. 0024:Call ucrtbase.memcpy(003f6bd4,78e175f0,0000002c) ret=78da66c0
  3038. 0024:Ret ucrtbase.memcpy() retval=003f6bd4 ret=78da66c0
  3039. 0024:Call user32.LoadStringW(78d50000,00000462,0031eb1c,00000000) ret=78da6604
  3040. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3041. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3042. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3043. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3044. 0024:Ret user32.LoadStringW() retval=00000024 ret=78da6604
  3045. 0024:Call ucrtbase.malloc(00000076) ret=78d90dd2
  3046. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000076) ret=7b4e3ed8
  3047. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8b78 ret=7b4e3ed8
  3048. 0024:Ret ucrtbase.malloc() retval=003f8b78 ret=78d90dd2
  3049. 0024:Call ucrtbase.memset(003f8b78,00000000,0000002c) ret=78da6651
  3050. 0024:Ret ucrtbase.memset() retval=003f8b78 ret=78da6651
  3051. 0024:Call ucrtbase.memcpy(003f8ba4,78e1761e,00000048) ret=78da66c0
  3052. 0024:Ret ucrtbase.memcpy() retval=003f8ba4 ret=78da66c0
  3053. 0024:Call user32.LoadStringW(78d50000,00000463,0031eb1c,00000000) ret=78da6604
  3054. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3055. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3056. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3057. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3058. 0024:Ret user32.LoadStringW() retval=00000025 ret=78da6604
  3059. 0024:Call ucrtbase.malloc(00000078) ret=78d90dd2
  3060. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000078) ret=7b4e3ed8
  3061. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8bf8 ret=7b4e3ed8
  3062. 0024:Ret ucrtbase.malloc() retval=003f8bf8 ret=78d90dd2
  3063. 0024:Call ucrtbase.memset(003f8bf8,00000000,0000002c) ret=78da6651
  3064. 0024:Ret ucrtbase.memset() retval=003f8bf8 ret=78da6651
  3065. 0024:Call ucrtbase.memcpy(003f8c24,78e17668,0000004a) ret=78da66c0
  3066. 0024:Ret ucrtbase.memcpy() retval=003f8c24 ret=78da66c0
  3067. 0024:Call user32.LoadStringW(78d50000,00000464,0031eb1c,00000000) ret=78da6604
  3068. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3069. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3070. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3071. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3072. 0024:Ret user32.LoadStringW() retval=00000029 ret=78da6604
  3073. 0024:Call ucrtbase.malloc(00000080) ret=78d90dd2
  3074. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000080) ret=7b4e3ed8
  3075. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8c78 ret=7b4e3ed8
  3076. 0024:Ret ucrtbase.malloc() retval=003f8c78 ret=78d90dd2
  3077. 0024:Call ucrtbase.memset(003f8c78,00000000,0000002c) ret=78da6651
  3078. 0024:Ret ucrtbase.memset() retval=003f8c78 ret=78da6651
  3079. 0024:Call ucrtbase.memcpy(003f8ca4,78e176b4,00000052) ret=78da66c0
  3080. 0024:Ret ucrtbase.memcpy() retval=003f8ca4 ret=78da66c0
  3081. 0024:Call user32.LoadStringW(78d50000,00000465,0031eb1c,00000000) ret=78da6604
  3082. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3083. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3084. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3085. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3086. 0024:Ret user32.LoadStringW() retval=0000002e ret=78da6604
  3087. 0024:Call ucrtbase.malloc(0000008a) ret=78d90dd2
  3088. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000008a) ret=7b4e3ed8
  3089. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8d00 ret=7b4e3ed8
  3090. 0024:Ret ucrtbase.malloc() retval=003f8d00 ret=78d90dd2
  3091. 0024:Call ucrtbase.memset(003f8d00,00000000,0000002c) ret=78da6651
  3092. 0024:Ret ucrtbase.memset() retval=003f8d00 ret=78da6651
  3093. 0024:Call ucrtbase.memcpy(003f8d2c,78e17708,0000005c) ret=78da66c0
  3094. 0024:Ret ucrtbase.memcpy() retval=003f8d2c ret=78da66c0
  3095. 0024:Call user32.LoadStringW(78d50000,00000466,0031eb1c,00000000) ret=78da6604
  3096. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3097. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3098. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3099. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3100. 0024:Ret user32.LoadStringW() retval=00000011 ret=78da6604
  3101. 0024:Call ucrtbase.malloc(00000050) ret=78d90dd2
  3102. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000050) ret=7b4e3ed8
  3103. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8140 ret=7b4e3ed8
  3104. 0024:Ret ucrtbase.malloc() retval=003f8140 ret=78d90dd2
  3105. 0024:Call ucrtbase.memset(003f8140,00000000,0000002c) ret=78da6651
  3106. 0024:Ret ucrtbase.memset() retval=003f8140 ret=78da6651
  3107. 0024:Call ucrtbase.memcpy(003f816c,78e17766,00000022) ret=78da66c0
  3108. 0024:Ret ucrtbase.memcpy() retval=003f816c ret=78da66c0
  3109. 0024:Call user32.LoadStringW(78d50000,00000467,0031eb1c,00000000) ret=78da6604
  3110. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3111. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3112. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3113. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3114. 0024:Ret user32.LoadStringW() retval=0000001b ret=78da6604
  3115. 0024:Call ucrtbase.malloc(00000064) ret=78d90dd2
  3116. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000064) ret=7b4e3ed8
  3117. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6c18 ret=7b4e3ed8
  3118. 0024:Ret ucrtbase.malloc() retval=003f6c18 ret=78d90dd2
  3119. 0024:Call ucrtbase.memset(003f6c18,00000000,0000002c) ret=78da6651
  3120. 0024:Ret ucrtbase.memset() retval=003f6c18 ret=78da6651
  3121. 0024:Call ucrtbase.memcpy(003f6c44,78e1778a,00000036) ret=78da66c0
  3122. 0024:Ret ucrtbase.memcpy() retval=003f6c44 ret=78da66c0
  3123. 0024:Call user32.LoadStringW(78d50000,00000468,0031eb1c,00000000) ret=78da6604
  3124. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3125. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3126. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3127. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3128. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  3129. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  3130. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  3131. 0024:Ret ntdll.RtlAllocateHeap() retval=003f81a0 ret=7b4e3ed8
  3132. 0024:Ret ucrtbase.malloc() retval=003f81a0 ret=78d90dd2
  3133. 0024:Call ucrtbase.memset(003f81a0,00000000,0000002c) ret=78da6651
  3134. 0024:Ret ucrtbase.memset() retval=003f81a0 ret=78da6651
  3135. 0024:Call ucrtbase.memcpy(003f81cc,78e177c2,00000020) ret=78da66c0
  3136. 0024:Ret ucrtbase.memcpy() retval=003f81cc ret=78da66c0
  3137. 0024:Call user32.LoadStringW(78d50000,00000469,0031eb1c,00000000) ret=78da6604
  3138. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3139. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3140. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3141. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3142. 0024:Ret user32.LoadStringW() retval=0000000e ret=78da6604
  3143. 0024:Call ucrtbase.malloc(0000004a) ret=78d90dd2
  3144. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004a) ret=7b4e3ed8
  3145. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8200 ret=7b4e3ed8
  3146. 0024:Ret ucrtbase.malloc() retval=003f8200 ret=78d90dd2
  3147. 0024:Call ucrtbase.memset(003f8200,00000000,0000002c) ret=78da6651
  3148. 0024:Ret ucrtbase.memset() retval=003f8200 ret=78da6651
  3149. 0024:Call ucrtbase.memcpy(003f822c,78e177e4,0000001c) ret=78da66c0
  3150. 0024:Ret ucrtbase.memcpy() retval=003f822c ret=78da66c0
  3151. 0024:Call user32.LoadStringW(78d50000,0000046a,0031eb1c,00000000) ret=78da6604
  3152. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3153. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3154. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3155. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3156. 0024:Ret user32.LoadStringW() retval=00000017 ret=78da6604
  3157. 0024:Call ucrtbase.malloc(0000005c) ret=78d90dd2
  3158. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005c) ret=7b4e3ed8
  3159. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6c88 ret=7b4e3ed8
  3160. 0024:Ret ucrtbase.malloc() retval=003f6c88 ret=78d90dd2
  3161. 0024:Call ucrtbase.memset(003f6c88,00000000,0000002c) ret=78da6651
  3162. 0024:Ret ucrtbase.memset() retval=003f6c88 ret=78da6651
  3163. 0024:Call ucrtbase.memcpy(003f6cb4,78e17802,0000002e) ret=78da66c0
  3164. 0024:Ret ucrtbase.memcpy() retval=003f6cb4 ret=78da66c0
  3165. 0024:Call user32.LoadStringW(78d50000,0000046b,0031eb1c,00000000) ret=78da6604
  3166. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3167. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3168. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3169. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3170. 0024:Ret user32.LoadStringW() retval=0000000c ret=78da6604
  3171. 0024:Call ucrtbase.malloc(00000046) ret=78d90dd2
  3172. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000046) ret=7b4e3ed8
  3173. 0024:Ret ntdll.RtlAllocateHeap() retval=003f7868 ret=7b4e3ed8
  3174. 0024:Ret ucrtbase.malloc() retval=003f7868 ret=78d90dd2
  3175. 0024:Call ucrtbase.memset(003f7868,00000000,0000002c) ret=78da6651
  3176. 0024:Ret ucrtbase.memset() retval=003f7868 ret=78da6651
  3177. 0024:Call ucrtbase.memcpy(003f7894,78e17832,00000018) ret=78da66c0
  3178. 0024:Ret ucrtbase.memcpy() retval=003f7894 ret=78da66c0
  3179. 0024:Call user32.LoadStringW(78d50000,0000046c,0031eb1c,00000000) ret=78da6604
  3180. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3181. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3182. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3183. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3184. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  3185. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  3186. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  3187. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8260 ret=7b4e3ed8
  3188. 0024:Ret ucrtbase.malloc() retval=003f8260 ret=78d90dd2
  3189. 0024:Call ucrtbase.memset(003f8260,00000000,0000002c) ret=78da6651
  3190. 0024:Ret ucrtbase.memset() retval=003f8260 ret=78da6651
  3191. 0024:Call ucrtbase.memcpy(003f828c,78e1784c,00000020) ret=78da66c0
  3192. 0024:Ret ucrtbase.memcpy() retval=003f828c ret=78da66c0
  3193. 0024:Call user32.LoadStringW(78d50000,0000046d,0031eb1c,00000000) ret=78da6604
  3194. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3195. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3196. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3197. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3198. 0024:Ret user32.LoadStringW() retval=0000001c ret=78da6604
  3199. 0024:Call ucrtbase.malloc(00000066) ret=78d90dd2
  3200. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000066) ret=7b4e3ed8
  3201. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6cf8 ret=7b4e3ed8
  3202. 0024:Ret ucrtbase.malloc() retval=003f6cf8 ret=78d90dd2
  3203. 0024:Call ucrtbase.memset(003f6cf8,00000000,0000002c) ret=78da6651
  3204. 0024:Ret ucrtbase.memset() retval=003f6cf8 ret=78da6651
  3205. 0024:Call ucrtbase.memcpy(003f6d24,78e1786e,00000038) ret=78da66c0
  3206. 0024:Ret ucrtbase.memcpy() retval=003f6d24 ret=78da66c0
  3207. 0024:Call user32.LoadStringW(78d50000,0000046e,0031eb1c,00000000) ret=78da6604
  3208. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3209. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3210. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3211. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3212. 0024:Ret user32.LoadStringW() retval=0000000d ret=78da6604
  3213. 0024:Call ucrtbase.malloc(00000048) ret=78d90dd2
  3214. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000048) ret=7b4e3ed8
  3215. 0024:Ret ntdll.RtlAllocateHeap() retval=003f78b8 ret=7b4e3ed8
  3216. 0024:Ret ucrtbase.malloc() retval=003f78b8 ret=78d90dd2
  3217. 0024:Call ucrtbase.memset(003f78b8,00000000,0000002c) ret=78da6651
  3218. 0024:Ret ucrtbase.memset() retval=003f78b8 ret=78da6651
  3219. 0024:Call ucrtbase.memcpy(003f78e4,78e178a8,0000001a) ret=78da66c0
  3220. 0024:Ret ucrtbase.memcpy() retval=003f78e4 ret=78da66c0
  3221. 0024:Call user32.LoadStringW(78d50000,0000046f,0031eb1c,00000000) ret=78da6604
  3222. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3223. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3224. 0024:Call ntdll.LdrAccessResource(78d50000,78dea330,0031ea60,00000000) ret=7b966f9d
  3225. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3226. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  3227. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  3228. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  3229. 0024:Ret ntdll.RtlAllocateHeap() retval=003f82c0 ret=7b4e3ed8
  3230. 0024:Ret ucrtbase.malloc() retval=003f82c0 ret=78d90dd2
  3231. 0024:Call ucrtbase.memset(003f82c0,00000000,0000002c) ret=78da6651
  3232. 0024:Ret ucrtbase.memset() retval=003f82c0 ret=78da6651
  3233. 0024:Call ucrtbase.memcpy(003f82ec,78e178c4,00000020) ret=78da66c0
  3234. 0024:Ret ucrtbase.memcpy() retval=003f82ec ret=78da66c0
  3235. 0024:Call user32.LoadStringW(78d50000,00000470,0031eb1c,00000000) ret=78da6604
  3236. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3237. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3238. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea60,00000000) ret=7b966f9d
  3239. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3240. 0024:Ret user32.LoadStringW() retval=00000018 ret=78da6604
  3241. 0024:Call ucrtbase.malloc(0000005e) ret=78d90dd2
  3242. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000005e) ret=7b4e3ed8
  3243. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6d68 ret=7b4e3ed8
  3244. 0024:Ret ucrtbase.malloc() retval=003f6d68 ret=78d90dd2
  3245. 0024:Call ucrtbase.memset(003f6d68,00000000,0000002c) ret=78da6651
  3246. 0024:Ret ucrtbase.memset() retval=003f6d68 ret=78da6651
  3247. 0024:Call ucrtbase.memcpy(003f6d94,78e1c6c6,00000030) ret=78da66c0
  3248. 0024:Ret ucrtbase.memcpy() retval=003f6d94 ret=78da66c0
  3249. 0024:Call user32.LoadStringW(78d50000,00000471,0031eb1c,00000000) ret=78da6604
  3250. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3251. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3252. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea60,00000000) ret=7b966f9d
  3253. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3254. 0024:Ret user32.LoadStringW() retval=00000023 ret=78da6604
  3255. 0024:Call ucrtbase.malloc(00000074) ret=78d90dd2
  3256. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000074) ret=7b4e3ed8
  3257. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8d98 ret=7b4e3ed8
  3258. 0024:Ret ucrtbase.malloc() retval=003f8d98 ret=78d90dd2
  3259. 0024:Call ucrtbase.memset(003f8d98,00000000,0000002c) ret=78da6651
  3260. 0024:Ret ucrtbase.memset() retval=003f8d98 ret=78da6651
  3261. 0024:Call ucrtbase.memcpy(003f8dc4,78e1c6f8,00000046) ret=78da66c0
  3262. 0024:Ret ucrtbase.memcpy() retval=003f8dc4 ret=78da66c0
  3263. 0024:Call user32.LoadStringW(78d50000,00000472,0031eb1c,00000000) ret=78da6604
  3264. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3265. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3266. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea60,00000000) ret=7b966f9d
  3267. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3268. 0024:Ret user32.LoadStringW() retval=00000019 ret=78da6604
  3269. 0024:Call ucrtbase.malloc(00000060) ret=78d90dd2
  3270. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000060) ret=7b4e3ed8
  3271. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6dd8 ret=7b4e3ed8
  3272. 0024:Ret ucrtbase.malloc() retval=003f6dd8 ret=78d90dd2
  3273. 0024:Call ucrtbase.memset(003f6dd8,00000000,0000002c) ret=78da6651
  3274. 0024:Ret ucrtbase.memset() retval=003f6dd8 ret=78da6651
  3275. 0024:Call ucrtbase.memcpy(003f6e04,78e1c740,00000032) ret=78da66c0
  3276. 0024:Ret ucrtbase.memcpy() retval=003f6e04 ret=78da66c0
  3277. 0024:Call user32.LoadStringW(78d50000,00000444,0031eb1c,00000000) ret=78da6604
  3278. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3279. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3280. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  3281. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3282. 0024:Ret user32.LoadStringW() retval=00000012 ret=78da6604
  3283. 0024:Call ucrtbase.malloc(00000052) ret=78d90dd2
  3284. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000052) ret=7b4e3ed8
  3285. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8320 ret=7b4e3ed8
  3286. 0024:Ret ucrtbase.malloc() retval=003f8320 ret=78d90dd2
  3287. 0024:Call ucrtbase.memset(003f8320,00000000,0000002c) ret=78da6651
  3288. 0024:Ret ucrtbase.memset() retval=003f8320 ret=78da6651
  3289. 0024:Call ucrtbase.memcpy(003f834c,78e0b06e,00000024) ret=78da66c0
  3290. 0024:Ret ucrtbase.memcpy() retval=003f834c ret=78da66c0
  3291. 0024:Call user32.LoadStringW(78d50000,00000443,0031eb1c,00000000) ret=78da6604
  3292. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3293. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3294. 0024:Call ntdll.LdrAccessResource(78d50000,78de9f00,0031ea60,00000000) ret=7b966f9d
  3295. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3296. 0024:Ret user32.LoadStringW() retval=00000019 ret=78da6604
  3297. 0024:Call ucrtbase.malloc(00000060) ret=78d90dd2
  3298. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000060) ret=7b4e3ed8
  3299. 0024:Ret ntdll.RtlAllocateHeap() retval=003f6e48 ret=7b4e3ed8
  3300. 0024:Ret ucrtbase.malloc() retval=003f6e48 ret=78d90dd2
  3301. 0024:Call ucrtbase.memset(003f6e48,00000000,0000002c) ret=78da6651
  3302. 0024:Ret ucrtbase.memset() retval=003f6e48 ret=78da6651
  3303. 0024:Call ucrtbase.memcpy(003f6e74,78e0b03a,00000032) ret=78da66c0
  3304. 0024:Ret ucrtbase.memcpy() retval=003f6e74 ret=78da66c0
  3305. 0024:Call user32.LoadStringW(78d50000,00000473,0031eb1c,00000000) ret=78da6604
  3306. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3307. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3308. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea60,00000000) ret=7b966f9d
  3309. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3310. 0024:Ret user32.LoadStringW() retval=00000010 ret=78da6604
  3311. 0024:Call ucrtbase.malloc(0000004e) ret=78d90dd2
  3312. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,0000004e) ret=7b4e3ed8
  3313. 0024:Ret ntdll.RtlAllocateHeap() retval=003f8380 ret=7b4e3ed8
  3314. 0024:Ret ucrtbase.malloc() retval=003f8380 ret=78d90dd2
  3315. 0024:Call ucrtbase.memset(003f8380,00000000,0000002c) ret=78da6651
  3316. 0024:Ret ucrtbase.memset() retval=003f8380 ret=78da6651
  3317. 0024:Call ucrtbase.memcpy(003f83ac,78e1c774,00000020) ret=78da66c0
  3318. 0024:Ret ucrtbase.memcpy() retval=003f83ac ret=78da66c0
  3319. 0024:Call user32.LoadStringW(78d50000,00000474,0031eb1c,00000000) ret=78da6604
  3320. 0024:Call ntdll.LdrFindResource_U(78d50000,0031ea04,00000003,0031ea00) ret=7b966d5b
  3321. 0024:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  3322. 0024:Call ntdll.LdrAccessResource(78d50000,78dea560,0031ea60,00000000) ret=7b966f9d
  3323. 0024:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  3324. 0024:Ret user32.LoadStringW() retval=00000015 ret=78da6604
  3325. 0024:Call ucrtbase.malloc(00000058) ret=78d90dd2
  3326. 0024:Call ntdll.RtlAllocateHeap(003f0000,00000000,00000058) ret=7b4e3ed8
  3327. 0024:Ret ntdll.RtlAllocateHeap() retval=003f83e0 ret=7b4e3ed8
  3328. 0024:Ret ucrtbase.malloc() retval=003f83e0 ret=78d90dd2
  3329. 0024:Call ucrtbase.memset(003f83e0,00000000,0000002c) ret=78da6651
  3330. 0024:Ret ucrtbase.memset() retval=003f83e0 ret=78da6651
  3331. 0024:Call ucrtbase.memcpy(003f840c,78e1c796,0000002a) ret=78da66c0
  3332. 0024:Ret ucrtbase.memcpy() retval=003f840c ret=78da66c0
  3333. 0024:Call advapi32.RegOpenKeyExW(80000002,78dc954c L"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo",00000000,000f003f,0031eb0c) ret=78da62e8
  3334. 0024:Call ntdll.RtlInitUnicodeString(0031e980,78dc954c L"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo") ret=7b997c54
  3335. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e980 ret=7b997c54
  3336. 0024:Call ntdll.NtOpenKeyEx(0031eb0c,000f003f,0031e934,00000000) ret=7b997023
  3337. 0024:Ret ntdll.NtOpenKeyEx() retval=c0000034 ret=7b997023
  3338. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b997c90
  3339. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b997c90
  3340. 0024:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=78da62e8
  3341. 0024:Call KERNEL32.GetModuleHandleW(78dd0db0 L"ntdll.dll") ret=78dbd542
  3342. 0024:Call ntdll.RtlInitUnicodeString(0031ea94,78dd0db0 L"ntdll.dll") ret=7b964e60
  3343. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ea94 ret=7b964e60
  3344. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031ea94,0031eaa0) ret=7b964e8e
  3345. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  3346. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=78dbd542
  3347. 0024:Call KERNEL32.GetProcAddress(7be20000,78dd0dc4 "__wine_unix_call_dispatcher") ret=78dbd55d
  3348. 0024:Ret KERNEL32.GetProcAddress() retval=7be93230 ret=78dbd55d
  3349. 0024:Call ntdll.NtQueryVirtualMemory(ffffffff,78d50000,000003e8,78de2180,00000008,00000000) ret=78dbd5a8
  3350. 0024:Ret ntdll.NtQueryVirtualMemory() retval=00000000 ret=78dbd5a8
  3351. 0024:Ret PE DLL (proc=78DBC770,module=78D50000 L"crypt32.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  3352. 0024:Call PE DLL (proc=78F690F8,module=78F50000 L"WINTRUST.dll",reason=PROCESS_ATTACH,res=00000000)
  3353. 0024:Call KERNEL32.DisableThreadLibraryCalls(78f50000) ret=78f69bcd
  3354. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(78f50000) ret=7b9647c0
  3355. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  3356. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=78f69bcd
  3357. 0024:Ret PE DLL (proc=78F690F8,module=78F50000 L"WINTRUST.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  3358. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  3359. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  3360. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  3361. 0024:Ret KERNEL32.LoadLibraryA() retval=78f50000 ret=03ccc40e
  3362. 0024:Call KERNEL32.GetProcAddress(78f50000,043b092a "CryptCATAdminReleaseCatalogContext") ret=03cc3d81
  3363. 0024:Ret KERNEL32.GetProcAddress() retval=78f5156c ret=03cc3d81
  3364. 0024:Call KERNEL32.GetProcAddress(78f50000,043b09ec "CryptCATAdminAcquireContext") ret=03cc3d81
  3365. 0024:Ret KERNEL32.GetProcAddress() retval=78f514cc ret=03cc3d81
  3366. 0024:Call KERNEL32.GetProcAddress(78f50000,043b09ce "CryptCATAdminReleaseContext") ret=03cc3d81
  3367. 0024:Ret KERNEL32.GetProcAddress() retval=78f5158c ret=03cc3d81
  3368. 0024:Call KERNEL32.GetProcAddress(78f50000,043b09a8 "CryptCATAdminCalcHashFromFileHandle") ret=03cc3d81
  3369. 0024:Ret KERNEL32.GetProcAddress() retval=78f5152c ret=03cc3d81
  3370. 0024:Call KERNEL32.GetProcAddress(78f50000,043b0984 "CryptCATAdminEnumCatalogFromHash") ret=03cc3d81
  3371. 0024:Ret KERNEL32.GetProcAddress() retval=78f5154c ret=03cc3d81
  3372. 0024:Call KERNEL32.GetProcAddress(78f50000,043b0962 "CryptCATCatalogInfoFromContext") ret=03cc3d81
  3373. 0024:Ret KERNEL32.GetProcAddress() retval=78f5166c ret=03cc3d81
  3374. 0024:Call KERNEL32.GetProcAddress(78f50000,043b0950 "WinVerifyTrust") ret=03cc3d81
  3375. 0024:Ret KERNEL32.GetProcAddress() retval=78f51e28 ret=03cc3d81
  3376. 0024:Call KERNEL32.LoadLibraryA(043b0dc2 "ADVAPI32.dll") ret=03ccc40e
  3377. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b0dc2 "ADVAPI32.dll") ret=7b9585a9
  3378. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  3379. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  3380. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  3381. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"ADVAPI32.dll") ret=7b9650f0
  3382. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  3383. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"ADVAPI32.dll",00000000,0031ee38,0031ee34) ret=7b964536
  3384. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  3385. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  3386. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  3387. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  3388. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  3389. 0024:Ret KERNEL32.LoadLibraryA() retval=7b890000 ret=03ccc40e
  3390. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0cfa "RegCloseKey") ret=03cc3d81
  3391. 0024:Ret KERNEL32.GetProcAddress() retval=7b893f48 ret=03cc3d81
  3392. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d1a "RegQueryValueExA") ret=03cc3d81
  3393. 0024:Ret KERNEL32.GetProcAddress() retval=7b894608 ret=03cc3d81
  3394. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d2e "RegCreateKeyExA") ret=03cc3d81
  3395. 0024:Ret KERNEL32.GetProcAddress() retval=7b894008 ret=03cc3d81
  3396. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d40 "StartServiceW") ret=03cc3d81
  3397. 0024:Ret KERNEL32.GetProcAddress() retval=7b894da8 ret=03cc3d81
  3398. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d50 "CloseServiceHandle") ret=03cc3d81
  3399. 0024:Ret KERNEL32.GetProcAddress() retval=7b891b2c ret=03cc3d81
  3400. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d66 "ChangeServiceConfigA") ret=03cc3d81
  3401. 0024:Ret KERNEL32.GetProcAddress() retval=7b891a4c ret=03cc3d81
  3402. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d7e "OpenServiceA") ret=03cc3d81
  3403. 0024:Ret KERNEL32.GetProcAddress() retval=7b893a88 ret=03cc3d81
  3404. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d8e "CreateServiceA") ret=03cc3d81
  3405. 0024:Ret KERNEL32.GetProcAddress() retval=7b891dec ret=03cc3d81
  3406. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0da0 "OpenSCManagerW") ret=03cc3d81
  3407. 0024:Ret KERNEL32.GetProcAddress() retval=7b893a68 ret=03cc3d81
  3408. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0db2 "ControlService") ret=03cc3d81
  3409. 0024:Ret KERNEL32.GetProcAddress() retval=7b891b8c ret=03cc3d81
  3410. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0ce2 "LookupPrivilegeValueW") ret=03cc3d81
  3411. 0024:Ret KERNEL32.GetProcAddress() retval=7b893388 ret=03cc3d81
  3412. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0cce "OpenProcessToken") ret=03cc3d81
  3413. 0024:Ret KERNEL32.GetProcAddress() retval=7b893a28 ret=03cc3d81
  3414. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0cb6 "AdjustTokenPrivileges") ret=03cc3d81
  3415. 0024:Ret KERNEL32.GetProcAddress() retval=7b89178c ret=03cc3d81
  3416. 0024:Call KERNEL32.GetProcAddress(7b890000,043b0d08 "RegSetValueExA") ret=03cc3d81
  3417. 0024:Ret KERNEL32.GetProcAddress() retval=7b894808 ret=03cc3d81
  3418. 0024:Call KERNEL32.LoadLibraryA(043b154a "NETAPI32.dll") ret=03ccc40e
  3419. 0024:Call ntdll.RtlInitAnsiString(0031ee58,043b154a "NETAPI32.dll") ret=7b9585a9
  3420. 0024:Ret ntdll.RtlInitAnsiString() retval=0031ee58 ret=7b9585a9
  3421. 0024:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee58,00000000) ret=7b958618
  3422. 0024:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  3423. 0024:Call ntdll.RtlInitUnicodeString(0031ee68,7ffc2c00 L"NETAPI32.dll") ret=7b9650f0
  3424. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031ee68 ret=7b9650f0
  3425. 0024:Call ntdll.LdrGetDllPath(7ffc2c00 L"NETAPI32.dll",00000000,0031ee38,0031ee34) ret=7b964536
  3426. 0024:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  3427. 0024:Call ntdll.LdrLoadDll(0034fa98 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee68,0031ee3c) ret=7b9645d6
  3428. 0024:Call PE DLL (proc=78CB2184,module=78CA0000 L"NETAPI32.dll",reason=PROCESS_ATTACH,res=00000000)
  3429. 0024:Call KERNEL32.GetModuleHandleW(78cb7f48 L"ntdll.dll") ret=78cb22fc
  3430. 0024:Call ntdll.RtlInitUnicodeString(0031eaa4,78cb7f48 L"ntdll.dll") ret=7b964e60
  3431. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031eaa4 ret=7b964e60
  3432. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031eaa4,0031eab0) ret=7b964e8e
  3433. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  3434. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=78cb22fc
  3435. 0024:Call KERNEL32.GetProcAddress(7be20000,78cb7fc8 "__wine_dbg_header") ret=78cb2316
  3436. 0024:Ret KERNEL32.GetProcAddress() retval=7be80dc5 ret=78cb2316
  3437. 0024:Call KERNEL32.GetModuleHandleW(78cb7fdc L"ntdll.dll") ret=78cb2f06
  3438. 0024:Call ntdll.RtlInitUnicodeString(0031eb04,78cb7fdc L"ntdll.dll") ret=7b964e60
  3439. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031eb04 ret=7b964e60
  3440. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031eb04,0031eb10) ret=7b964e8e
  3441. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  3442. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=78cb2f06
  3443. 0024:Call KERNEL32.GetProcAddress(7be20000,78cb7ff0 "__wine_unix_call_dispatcher") ret=78cb2f21
  3444. 0024:Ret KERNEL32.GetProcAddress() retval=7be93230 ret=78cb2f21
  3445. 0024:Call ntdll.NtQueryVirtualMemory(ffffffff,78ca0000,000003e8,78cbd2a0,00000008,00000000) ret=78cb2f6c
  3446. 0024:Ret ntdll.NtQueryVirtualMemory() retval=00000000 ret=78cb2f6c
  3447. 0024:Call KERNEL32.DisableThreadLibraryCalls(78ca0000) ret=78ca8303
  3448. 0024:Call ntdll.LdrDisableThreadCalloutsForDll(78ca0000) ret=7b9647c0
  3449. 0024:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  3450. 0024:Ret KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=78ca8303
  3451. 0024:Call ucrtbase.memset(78cbd1c0,00000000,00000028) ret=78caeeba
  3452. 0024:Ret ucrtbase.memset() retval=78cbd1c0 ret=78caeeba
  3453. 0024:Call ntdll.RtlInitializeCriticalSection(78cbd1c0) ret=78caeec8
  3454. 0024:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=78caeec8
  3455. 0024:Call ws2_32.WSAStartup(00000202,0031e9f4) ret=78ca726a
  3456. 0024:Call KERNEL32.GetModuleHandleW(7b45c748 L"ntdll.dll") ret=7b45543c
  3457. 0024:Call ntdll.RtlInitUnicodeString(0031e834,7b45c748 L"ntdll.dll") ret=7b964e60
  3458. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e834 ret=7b964e60
  3459. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031e834,0031e840) ret=7b964e8e
  3460. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  3461. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=7b45543c
  3462. 0024:Call KERNEL32.GetProcAddress(7be20000,7b45c7c8 "__wine_dbg_header") ret=7b455456
  3463. 0024:Ret KERNEL32.GetProcAddress() retval=7be80dc5 ret=7b455456
  3464. 0024:Ret ws2_32.WSAStartup() retval=00000000 ret=78ca726a
  3465. 0024:Call ucrtbase.memset(78cbd018,00000000,00000008) ret=78ca72c7
  3466. 0024:Ret ucrtbase.memset() retval=78cbd018 ret=78ca72c7
  3467. 0024:Call advapi32.RegOpenKeyExW(80000002,78cb63c0 L"SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP",00000000,00020019,0031e9f0) ret=78ca7308
  3468. 0024:Call ntdll.RtlInitUnicodeString(0031e950,78cb63c0 L"SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP") ret=7b997c54
  3469. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e950 ret=7b997c54
  3470. 0024:Call ntdll.NtOpenKeyEx(0031e9f0,00020019,0031e904,00000000) ret=7b997023
  3471. 0024:Ret ntdll.NtOpenKeyEx() retval=00000000 ret=7b997023
  3472. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997c90
  3473. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997c90
  3474. 0024:Ret advapi32.RegOpenKeyExW() retval=00000000 ret=78ca7308
  3475. 0024:Call advapi32.RegQueryValueExW(00000090,78cb647e L"EnableDNS",00000000,00000000,0031e9c8,0031e9c4) ret=78ca739a
  3476. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb647e L"EnableDNS") ret=7b99a47a
  3477. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3478. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000010,0031e920) ret=7b99a4ea
  3479. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3480. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3481. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3482. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca739a
  3483. 0024:Call advapi32.RegQueryValueExW(00000090,78cb6494 L"BcastNameQueryCount",00000000,00000000,0031e9c8,0031e9c4) ret=78ca73f2
  3484. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb6494 L"BcastNameQueryCount") ret=7b99a47a
  3485. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3486. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000010,0031e920) ret=7b99a4ea
  3487. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3488. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3489. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3490. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca73f2
  3491. 0024:Call advapi32.RegQueryValueExW(00000090,78cb64bc L"BcastNameQueryTimeout",00000000,00000000,0031e9c8,0031e9c4) ret=78ca7461
  3492. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb64bc L"BcastNameQueryTimeout") ret=7b99a47a
  3493. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3494. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000010,0031e920) ret=7b99a4ea
  3495. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3496. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3497. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3498. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca7461
  3499. 0024:Call advapi32.RegQueryValueExW(00000090,78cb64e8 L"NameSrvQueryCount",00000000,00000000,0031e9c8,0031e9c4) ret=78ca74c4
  3500. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb64e8 L"NameSrvQueryCount") ret=7b99a47a
  3501. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3502. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000010,0031e920) ret=7b99a4ea
  3503. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3504. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3505. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3506. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca74c4
  3507. 0024:Call advapi32.RegQueryValueExW(00000090,78cb650c L"NameSrvQueryTimeout",00000000,00000000,0031e9c8,0031e9c4) ret=78ca7533
  3508. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb650c L"NameSrvQueryTimeout") ret=7b99a47a
  3509. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3510. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000010,0031e920) ret=7b99a4ea
  3511. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3512. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3513. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3514. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca7533
  3515. 0024:Call advapi32.RegQueryValueExW(00000090,78cb6534 L"ScopeID",00000000,00000000,78cbd041,0031e9c4) ret=78ca7595
  3516. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb6534 L"ScopeID") ret=7b99a47a
  3517. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3518. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000100,0031e920) ret=7b99a4ea
  3519. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3520. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3521. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3522. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca7595
  3523. 0024:Call advapi32.RegQueryValueExW(00000090,78cb6544 L"CacheTimeout",00000000,00000000,0031e9c8,0031e9c4) ret=78ca762d
  3524. 0024:Call ntdll.RtlInitUnicodeString(0031e924,78cb6544 L"CacheTimeout") ret=7b99a47a
  3525. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e924 ret=7b99a47a
  3526. 0024:Call ntdll.NtQueryValueKey(00000090,0031e924,00000002,0031e820,00000100,0031e920) ret=7b99a4ea
  3527. 0024:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  3528. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  3529. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  3530. 0024:Ret advapi32.RegQueryValueExW() retval=00000002 ret=78ca762d
  3531. 0024:Call advapi32.RegCloseKey(00000090) ret=78ca765c
  3532. 0024:Call ntdll.NtClose(00000090) ret=7b998cd1
  3533. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  3534. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  3535. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  3536. 0024:Ret advapi32.RegCloseKey() retval=00000000 ret=78ca765c
  3537. 0024:Call advapi32.RegOpenKeyW(80000001,78cb6560 L"Software\\Wine\\Network",0031e9f0) ret=78ca767f
  3538. 0024:Call ntdll.RtlInitUnicodeString(0031e934,78cb6560 L"Software\\Wine\\Network") ret=7b997c54
  3539. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e934 ret=7b997c54
  3540. 0024:Call ntdll.NtOpenKeyEx(0031e9f0,02000000,0031e8e8,00000000) ret=7b997023
  3541. 0024:Ret ntdll.NtOpenKeyEx() retval=c0000034 ret=7b997023
  3542. 0024:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b997c90
  3543. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b997c90
  3544. 0024:Ret advapi32.RegOpenKeyW() retval=00000002 ret=78ca767f
  3545. 0024:Call ucrtbase.memcpy(78cbd184,0031e9cc,00000024) ret=78caf20e
  3546. 0024:Ret ucrtbase.memcpy() retval=78cbd184 ret=78caf20e
  3547. 0024:Ret PE DLL (proc=78CB2184,module=78CA0000 L"NETAPI32.dll",reason=PROCESS_ATTACH,res=00000000) retval=1
  3548. 0024:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  3549. 0024:Call ntdll.RtlReleasePath(0034fa98) ret=7b96462d
  3550. 0024:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  3551. 0024:Ret KERNEL32.LoadLibraryA() retval=78ca0000 ret=03ccc40e
  3552. 0024:Call KERNEL32.GetProcAddress(78ca0000,043b1542 "Netbios") ret=03cc3d81
  3553. 0024:Ret KERNEL32.GetProcAddress() retval=78ca3448 ret=03cc3d81
  3554. 0024:Call msvcrt.malloc(00000080) ret=042f2ce6
  3555. 0024:Call ntdll.RtlAllocateHeap(003b0000,00000000,00000080) ret=7b736eec
  3556. 0024:Ret ntdll.RtlAllocateHeap() retval=003b1fc8 ret=7b736eec
  3557. 0024:Ret msvcrt.malloc() retval=003b1fc8 ret=042f2ce6
  3558. 0024:Call msvcrt._initterm(043b2000,043b3538) ret=042f2d10
  3559. 0024:Call msvcrt.__dllonexit(04253dd0,04409370,0440936c) ret=042f2c34
  3560. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000004) ret=7b73704b
  3561. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3562. 0024:Ret msvcrt.__dllonexit() retval=04253dd0 ret=042f2c34
  3563. 0024:Call msvcrt.__dllonexit(042548e7,04409370,0440936c) ret=042f2c34
  3564. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000008) ret=7b73704b
  3565. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3566. 0024:Ret msvcrt.__dllonexit() retval=042548e7 ret=042f2c34
  3567. 0024:Call msvcrt.__dllonexit(0425948b,04409370,0440936c) ret=042f2c34
  3568. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,0000000c) ret=7b73704b
  3569. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3570. 0024:Ret msvcrt.__dllonexit() retval=0425948b ret=042f2c34
  3571. 0024:Call msvcrt.__dllonexit(0425d297,04409370,0440936c) ret=042f2c34
  3572. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000010) ret=7b73704b
  3573. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3574. 0024:Ret msvcrt.__dllonexit() retval=0425d297 ret=042f2c34
  3575. 0024:Call msvcrt.__dllonexit(0425d2dd,04409370,0440936c) ret=042f2c34
  3576. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000014) ret=7b73704b
  3577. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3578. 0024:Ret msvcrt.__dllonexit() retval=0425d2dd ret=042f2c34
  3579. 0024:Call msvcrt.__dllonexit(0425d323,04409370,0440936c) ret=042f2c34
  3580. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000018) ret=7b73704b
  3581. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3582. 0024:Ret msvcrt.__dllonexit() retval=0425d323 ret=042f2c34
  3583. 0024:Call msvcrt.__dllonexit(0425d369,04409370,0440936c) ret=042f2c34
  3584. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,0000001c) ret=7b73704b
  3585. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3586. 0024:Ret msvcrt.__dllonexit() retval=0425d369 ret=042f2c34
  3587. 0024:Call msvcrt.__dllonexit(04260967,04409370,0440936c) ret=042f2c34
  3588. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000020) ret=7b73704b
  3589. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3590. 0024:Ret msvcrt.__dllonexit() retval=04260967 ret=042f2c34
  3591. 0024:Call msvcrt.__dllonexit(042609ad,04409370,0440936c) ret=042f2c34
  3592. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000024) ret=7b73704b
  3593. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3594. 0024:Ret msvcrt.__dllonexit() retval=042609ad ret=042f2c34
  3595. 0024:Call msvcrt.??2@YAPAXI@Z(00000018) ret=04263c09
  3596. 0024:Call ntdll.RtlAllocateHeap(003b0000,00000000,00000018) ret=7b736eec
  3597. 0024:Ret ntdll.RtlAllocateHeap() retval=003b1ff8 ret=7b736eec
  3598. 0024:Ret msvcrt.??2@YAPAXI@Z() retval=003b1ff8 ret=04263c09
  3599. 0024:Call msvcp60.??0_Lockit@std@@QAE@XZ(0031ede4) ret=04262786
  3600. 0024:Ret msvcp60.??0_Lockit@std@@QAE@XZ() retval=0031ede4 ret=04262786
  3601. 0024:Call msvcp60.??1_Lockit@std@@QAE@XZ(0031ede4) ret=042627ec
  3602. 0024:Ret msvcp60.??1_Lockit@std@@QAE@XZ() retval=00000000 ret=042627ec
  3603. 0024:Call msvcrt.??2@YAPAXI@Z(00000018) ret=04263c09
  3604. 0024:Call ntdll.RtlAllocateHeap(003b0000,00000000,00000018) ret=7b736eec
  3605. 0024:Ret ntdll.RtlAllocateHeap() retval=003b2018 ret=7b736eec
  3606. 0024:Ret msvcrt.??2@YAPAXI@Z() retval=003b2018 ret=04263c09
  3607. 0024:Call msvcrt.__dllonexit(042609f9,04409370,0440936c) ret=042f2c34
  3608. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,00000028) ret=7b73704b
  3609. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b1fc8 ret=7b73704b
  3610. 0024:Ret msvcrt.__dllonexit() retval=042609f9 ret=042f2c34
  3611. 0024:Call msvcrt.__dllonexit(04264936,04409370,0440936c) ret=042f2c34
  3612. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b1fc8,0000002c) ret=7b73704b
  3613. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3614. 0024:Ret msvcrt.__dllonexit() retval=04264936 ret=042f2c34
  3615. 0024:Call msvcp60.??0Init@ios_base@std@@QAE@XZ(04400da5) ret=0426699d
  3616. 0024:Ret msvcp60.??0Init@ios_base@std@@QAE@XZ() retval=04400da5 ret=0426699d
  3617. 0024:Call msvcrt.__dllonexit(042669b1,04409370,0440936c) ret=042f2c34
  3618. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000030) ret=7b73704b
  3619. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3620. 0024:Ret msvcrt.__dllonexit() retval=042669b1 ret=042f2c34
  3621. 0024:Call msvcp60.??0_Winit@std@@QAE@XZ(04400da4) ret=042669de
  3622. 0024:Ret msvcp60.??0_Winit@std@@QAE@XZ() retval=04400da4 ret=042669de
  3623. 0024:Call msvcrt.__dllonexit(042669f2,04409370,0440936c) ret=042f2c34
  3624. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000034) ret=7b73704b
  3625. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3626. 0024:Ret msvcrt.__dllonexit() retval=042669f2 ret=042f2c34
  3627. 0024:Call ntdll.RtlInitializeCriticalSection(04409340) ret=042670f1
  3628. 0024:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=042670f1
  3629. 0024:Call msvcrt.__dllonexit(04267100,04409370,0440936c) ret=042f2c34
  3630. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000038) ret=7b73704b
  3631. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3632. 0024:Ret msvcrt.__dllonexit() retval=04267100 ret=042f2c34
  3633. 0024:Call msvcrt.__dllonexit(04267757,04409370,0440936c) ret=042f2c34
  3634. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,0000003c) ret=7b73704b
  3635. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3636. 0024:Ret msvcrt.__dllonexit() retval=04267757 ret=042f2c34
  3637. 0024:Call msvcrt.__dllonexit(04267d20,04409370,0440936c) ret=042f2c34
  3638. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000040) ret=7b73704b
  3639. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3640. 0024:Ret msvcrt.__dllonexit() retval=04267d20 ret=042f2c34
  3641. 0024:Call msvcp60.??0Init@ios_base@std@@QAE@XZ(04401039) ret=0426987d
  3642. 0024:Ret msvcp60.??0Init@ios_base@std@@QAE@XZ() retval=04401039 ret=0426987d
  3643. 0024:Call msvcrt.__dllonexit(04269891,04409370,0440936c) ret=042f2c34
  3644. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000044) ret=7b73704b
  3645. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3646. 0024:Ret msvcrt.__dllonexit() retval=04269891 ret=042f2c34
  3647. 0024:Call msvcp60.??0_Winit@std@@QAE@XZ(04401038) ret=042698be
  3648. 0024:Ret msvcp60.??0_Winit@std@@QAE@XZ() retval=04401038 ret=042698be
  3649. 0024:Call msvcrt.__dllonexit(042698d2,04409370,0440936c) ret=042f2c34
  3650. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000048) ret=7b73704b
  3651. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3652. 0024:Ret msvcrt.__dllonexit() retval=042698d2 ret=042f2c34
  3653. 0024:Call msvcrt.__dllonexit(04269912,04409370,0440936c) ret=042f2c34
  3654. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,0000004c) ret=7b73704b
  3655. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3656. 0024:Ret msvcrt.__dllonexit() retval=04269912 ret=042f2c34
  3657. 0024:Call msvcrt.__dllonexit(04273587,04409370,0440936c) ret=042f2c34
  3658. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000050) ret=7b73704b
  3659. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b2038 ret=7b73704b
  3660. 0024:Ret msvcrt.__dllonexit() retval=04273587 ret=042f2c34
  3661. 0024:Call msvcrt.??2@YAPAXI@Z(00000014) ret=04263c09
  3662. 0024:Call ntdll.RtlAllocateHeap(003b0000,00000000,00000014) ret=7b736eec
  3663. 0024:Ret ntdll.RtlAllocateHeap() retval=003b1fc8 ret=7b736eec
  3664. 0024:Ret msvcrt.??2@YAPAXI@Z() retval=003b1fc8 ret=04263c09
  3665. 0024:Call msvcp60.??0_Lockit@std@@QAE@XZ(0031ede4) ret=0427c876
  3666. 0024:Ret msvcp60.??0_Lockit@std@@QAE@XZ() retval=0031ede4 ret=0427c876
  3667. 0024:Call msvcp60.??1_Lockit@std@@QAE@XZ(0031ede4) ret=0427c8dc
  3668. 0024:Ret msvcp60.??1_Lockit@std@@QAE@XZ() retval=00000000 ret=0427c8dc
  3669. 0024:Call msvcrt.??2@YAPAXI@Z(00000014) ret=04263c09
  3670. 0024:Call ntdll.RtlAllocateHeap(003b0000,00000000,00000014) ret=7b736eec
  3671. 0024:Ret ntdll.RtlAllocateHeap() retval=003b2090 ret=7b736eec
  3672. 0024:Ret msvcrt.??2@YAPAXI@Z() retval=003b2090 ret=04263c09
  3673. 0024:Call msvcrt.__dllonexit(04278c4b,04409370,0440936c) ret=042f2c34
  3674. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b2038,00000054) ret=7b73704b
  3675. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3676. 0024:Ret msvcrt.__dllonexit() retval=04278c4b ret=042f2c34
  3677. 0024:Call msvcrt.__dllonexit(0427e4e7,04409370,0440936c) ret=042f2c34
  3678. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000058) ret=7b73704b
  3679. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3680. 0024:Ret msvcrt.__dllonexit() retval=0427e4e7 ret=042f2c34
  3681. 0024:Call msvcp60.??0Init@ios_base@std@@QAE@XZ(04406e6d) ret=04284d9d
  3682. 0024:Ret msvcp60.??0Init@ios_base@std@@QAE@XZ() retval=04406e6d ret=04284d9d
  3683. 0024:Call msvcrt.__dllonexit(04284db1,04409370,0440936c) ret=042f2c34
  3684. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,0000005c) ret=7b73704b
  3685. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3686. 0024:Ret msvcrt.__dllonexit() retval=04284db1 ret=042f2c34
  3687. 0024:Call msvcp60.??0_Winit@std@@QAE@XZ(04406e6c) ret=04284dde
  3688. 0024:Ret msvcp60.??0_Winit@std@@QAE@XZ() retval=04406e6c ret=04284dde
  3689. 0024:Call msvcrt.__dllonexit(04284df2,04409370,0440936c) ret=042f2c34
  3690. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000060) ret=7b73704b
  3691. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3692. 0024:Ret msvcrt.__dllonexit() retval=04284df2 ret=042f2c34
  3693. 0024:Call msvcrt.__dllonexit(04296490,04409370,0440936c) ret=042f2c34
  3694. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000064) ret=7b73704b
  3695. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3696. 0024:Ret msvcrt.__dllonexit() retval=04296490 ret=042f2c34
  3697. 0024:Call msvcp60.??0Init@ios_base@std@@QAE@XZ(04407e69) ret=04298325
  3698. 0024:Ret msvcp60.??0Init@ios_base@std@@QAE@XZ() retval=04407e69 ret=04298325
  3699. 0024:Call msvcrt.__dllonexit(04298350,04409370,0440936c) ret=042f2c34
  3700. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000068) ret=7b73704b
  3701. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3702. 0024:Ret msvcrt.__dllonexit() retval=04298350 ret=042f2c34
  3703. 0024:Call msvcp60.??0_Winit@std@@QAE@XZ(04407e68) ret=04298365
  3704. 0024:Ret msvcp60.??0_Winit@std@@QAE@XZ() retval=04407e68 ret=04298365
  3705. 0024:Call msvcrt.__dllonexit(04298390,04409370,0440936c) ret=042f2c34
  3706. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,0000006c) ret=7b73704b
  3707. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3708. 0024:Ret msvcrt.__dllonexit() retval=04298390 ret=042f2c34
  3709. 0024:Call msvcp60.?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z(04407e70,00000001) ret=04297c00
  3710. 0024:Call msvcrt.memset(04407e70,00000000,00000010) ret=793b1488
  3711. 0024:Ret msvcrt.memset() retval=04407e70 ret=793b1488
  3712. 0024:Ret msvcp60.?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z() retval=04407e70 ret=04297c00
  3713. 0024:Call msvcp60.?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z(04407e70,00000040) ret=04297c0c
  3714. 0024:Call msvcrt.??2@YAPAXI@Z(00000042) ret=793ac5cc
  3715. 0024:Call ntdll.RtlAllocateHeap(003b0000,00000000,00000042) ret=7b736eec
  3716. 0024:Ret ntdll.RtlAllocateHeap() retval=003b2038 ret=7b736eec
  3717. 0024:Ret msvcrt.??2@YAPAXI@Z() retval=003b2038 ret=793ac5cc
  3718. 0024:Call msvcrt.memset(04407e70,00000000,00000010) ret=793b1488
  3719. 0024:Ret msvcrt.memset() retval=04407e70 ret=793b1488
  3720. 0024:Ret msvcp60.?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z() retval=003b2000 ret=04297c0c
  3721. 0024:Call msvcrt.__dllonexit(04297c50,04409370,0440936c) ret=042f2c34
  3722. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000070) ret=7b73704b
  3723. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3724. 0024:Ret msvcrt.__dllonexit() retval=04297c50 ret=042f2c34
  3725. 0024:Call msvcrt.__dllonexit(0429a350,04409370,0440936c) ret=042f2c34
  3726. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000074) ret=7b73704b
  3727. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3728. 0024:Ret msvcrt.__dllonexit() retval=0429a350 ret=042f2c34
  3729. 0024:Call msvcrt.__dllonexit(042f4be0,04409370,0440936c) ret=042f2c34
  3730. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,00000078) ret=7b73704b
  3731. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3732. 0024:Ret msvcrt.__dllonexit() retval=042f4be0 ret=042f2c34
  3733. 0024:Call ntdll.RtlInitializeCriticalSection(04407f80) ret=0438581b
  3734. 0024:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=0438581b
  3735. 0024:Call msvcrt.__dllonexit(04385830,04409370,0440936c) ret=042f2c34
  3736. 0024:Call ntdll.RtlReAllocateHeap(003b0000,00000000,003b20b0,0000007c) ret=7b73704b
  3737. 0024:Ret ntdll.RtlReAllocateHeap() retval=003b20b0 ret=7b73704b
  3738. 0024:Ret msvcrt.__dllonexit() retval=04385830 ret=042f2c34
  3739. 0024:Ret msvcrt._initterm() retval=043b3538 ret=042f2d10
  3740. 0024:Call KERNEL32.GetProcessId(ffffffff) ret=04693ef0
  3741. 0024:Call ntdll.NtQueryInformationProcess(ffffffff,00000000,0031ee90,00000018,00000000) ret=7b993a18
  3742. 0024:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b993a18
  3743. 0024:Ret KERNEL32.GetProcessId() retval=00000020 ret=04693ef0
  3744. 0024:Call ntdll.RtlInitializeCriticalSection(04401040) ret=0454501f
  3745. 0024:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=0454501f
  3746. 0024:Call ntdll.RtlInitializeCriticalSection(04406cd0) ret=045a4189
  3747. 0024:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=045a4189
  3748. 0024:Call KERNEL32.CreateToolhelp32Snapshot(00000004,00000000) ret=046c18c4
  3749. 0024:Call ntdll.NtCreateSection(0031ed98,000f0007,0031ed70,0031ed90,00000004,08000000,00000000) ret=7b9ab61c
  3750. 0024:Ret ntdll.NtCreateSection() retval=00000000 ret=7b9ab61c
  3751. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9ab655
  3752. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9ab655
  3753. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031edd4,00000000,00000000,0031ed88,0031edd0,00000001,00000000,00000004) ret=7b980b3d
  3754. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3755. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3756. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3757. 0024:Call ntdll.wcscpy(0031ec94,7b9ecc54 L"") ret=7b9b4e4c
  3758. 0024:Ret ntdll.wcscpy() retval=0031ec94 ret=7b9b4e4c
  3759. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3760. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3761. 0024:Ret KERNEL32.CreateToolhelp32Snapshot() retval=00000090 ret=046c18c4
  3762. 0024:Call KERNEL32.Thread32First(00000090,0031eeb4) ret=04661ce4
  3763. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3764. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3765. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3766. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3767. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3768. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3769. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3770. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3771. 0024:Ret KERNEL32.Thread32First() retval=00000001 ret=04661ce4
  3772. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3773. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3774. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3775. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3776. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3777. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3778. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3779. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3780. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3781. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3782. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3783. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3784. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3785. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3786. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3787. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3788. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3789. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3790. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3791. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3792. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3793. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3794. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3795. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3796. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3797. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3798. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3799. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3800. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3801. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3802. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3803. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3804. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3805. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3806. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3807. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3808. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3809. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3810. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3811. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3812. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3813. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3814. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3815. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3816. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3817. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3818. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3819. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3820. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3821. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3822. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3823. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3824. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3825. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3826. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3827. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3828. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3829. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3830. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3831. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3832. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3833. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3834. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3835. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3836. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3837. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3838. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3839. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3840. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3841. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3842. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3843. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3844. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3845. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3846. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3847. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3848. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3849. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3850. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3851. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3852. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3853. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3854. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3855. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3856. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3857. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3858. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3859. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3860. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3861. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3862. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3863. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3864. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3865. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3866. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3867. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3868. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3869. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3870. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3871. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3872. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3873. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3874. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3875. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3876. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3877. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3878. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3879. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3880. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3881. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3882. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3883. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3884. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3885. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3886. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3887. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3888. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3889. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3890. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3891. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3892. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3893. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3894. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3895. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3896. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3897. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3898. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3899. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3900. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3901. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3902. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3903. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3904. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3905. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3906. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3907. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3908. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3909. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3910. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3911. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3912. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3913. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3914. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3915. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3916. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3917. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3918. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3919. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3920. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3921. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3922. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3923. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3924. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3925. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3926. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3927. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3928. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3929. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3930. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3931. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3932. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3933. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3934. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3935. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3936. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3937. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3938. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3939. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3940. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3941. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3942. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3943. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3944. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3945. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3946. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3947. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3948. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3949. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3950. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3951. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3952. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3953. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3954. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3955. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3956. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3957. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3958. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3959. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3960. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3961. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3962. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3963. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3964. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3965. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3966. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3967. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3968. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3969. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3970. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3971. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3972. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3973. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3974. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3975. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3976. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3977. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3978. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3979. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3980. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3981. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3982. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3983. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3984. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3985. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3986. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3987. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3988. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3989. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  3990. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  3991. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  3992. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  3993. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  3994. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  3995. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  3996. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  3997. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  3998. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  3999. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4000. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4001. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4002. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4003. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4004. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4005. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4006. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4007. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4008. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4009. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4010. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4011. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4012. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4013. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4014. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4015. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4016. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4017. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4018. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4019. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4020. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4021. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4022. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4023. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4024. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4025. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4026. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4027. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4028. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4029. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4030. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4031. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4032. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4033. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4034. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4035. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4036. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4037. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4038. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4039. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4040. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4041. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4042. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4043. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4044. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4045. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4046. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4047. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4048. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4049. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4050. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4051. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4052. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4053. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4054. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4055. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4056. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4057. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4058. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4059. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4060. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4061. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4062. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4063. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4064. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4065. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4066. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4067. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4068. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4069. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4070. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4071. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4072. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4073. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4074. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4075. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4076. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4077. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4078. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4079. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4080. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4081. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4082. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4083. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4084. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4085. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4086. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4087. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4088. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4089. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4090. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4091. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4092. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4093. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4094. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4095. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4096. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4097. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4098. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4099. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4100. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4101. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4102. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4103. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4104. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4105. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4106. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4107. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4108. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4109. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4110. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4111. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4112. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4113. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4114. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4115. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4116. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4117. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4118. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4119. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4120. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4121. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4122. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4123. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4124. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4125. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4126. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4127. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4128. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4129. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4130. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4131. 0024:Ret KERNEL32.Thread32Next() retval=00000001 ret=0442da92
  4132. 0024:Call KERNEL32.Thread32Next(00000090,0031eeb4) ret=0442da92
  4133. 0024:Call ntdll.NtMapViewOfSection(00000090,ffffffff,0031ee00,00000000,00000000,0031edb8,0031edfc,00000001,00000000,00000004) ret=7b980b3d
  4134. 0024:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  4135. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4136. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4137. 0024:Call ntdll.wcscpy(0031ecc0,7b9ecc54 L"") ret=7b9b4e4c
  4138. 0024:Ret ntdll.wcscpy() retval=0031ecc0 ret=7b9b4e4c
  4139. 0024:Call ntdll.NtUnmapViewOfSection(ffffffff,04990000) ret=7b980e44
  4140. 0024:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  4141. 0024:Ret KERNEL32.Thread32Next() retval=00000000 ret=0442da92
  4142. 0024:Call KERNEL32.CloseHandle(00000090) ret=0443af87
  4143. 0024:Call ntdll.NtClose(00000090) ret=7b992581
  4144. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  4145. 0024:Ret KERNEL32.CloseHandle() retval=00000001 ret=0443af87
  4146. 0024:Call KERNEL32.GetModuleFileNameW(00000000,044068b4,00000200) ret=0427dc06
  4147. 0024:Call ntdll.LdrGetDllFullName(00000000,0031ebb0) ret=7b964b91
  4148. 0024:Ret ntdll.LdrGetDllFullName() retval=00000000 ret=7b964b91
  4149. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b964bc0
  4150. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b964bc0
  4151. 0024:Ret KERNEL32.GetModuleFileNameW() retval=00000016 ret=0427dc06
  4152. 0024:Call ntdll.wcsrchr(044068b4 L"Z:\\tmp\\ramdisk\\DNF.exe",0000005c) ret=04264b32
  4153. 0024:Ret ntdll.wcsrchr() retval=044068d0 ret=04264b32
  4154. 0024:Call KERNEL32.CreateMutexW(00000000,00000000,043bd69c L"TpLoaderInitializeMutexName") ret=0429325e
  4155. 0024:Call ntdll.RtlInitUnicodeString(0031eb70,043bd69c L"TpLoaderInitializeMutexName") ret=7b9a987b
  4156. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031eb70 ret=7b9a987b
  4157. 0024:Call ntdll.NtCreateMutant(0031eb78,001f0001,0031eb58,00000000) ret=7b9aac6f
  4158. 0024:Ret ntdll.NtCreateMutant() retval=00000000 ret=7b9aac6f
  4159. 0024:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9aaca8
  4160. 0024:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9aaca8
  4161. 0024:Ret KERNEL32.CreateMutexW() retval=00000090 ret=0429325e
  4162. 0024:Call KERNEL32.WaitForSingleObject(00000090,00000000) ret=04293275
  4163. 0024:Call ntdll.NtWaitForMultipleObjects(00000001,0031ea68,00000001,00000000,0031ea60) ret=7b9aa26e
  4164. 0024:Ret ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b9aa26e
  4165. 0024:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=04293275
  4166. 0024:Call ntdll.RtlInitializeCriticalSection(04407b70) ret=0429328c
  4167. 0024:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=0429328c
  4168. 0024:Call KERNEL32.GetVersionExW(04407b98) ret=042932a3
  4169. 0024:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  4170. 0024:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  4171. 0024:Call ntdll.wcscpy(04407bac,7b9ecc54 L"") ret=7b9b4e4c
  4172. 0024:Ret ntdll.wcscpy() retval=04407bac ret=7b9b4e4c
  4173. 0024:Ret KERNEL32.GetVersionExW() retval=00000001 ret=042932a3
  4174. 0024:Call KERNEL32.GetSystemDirectoryA(04407cd8,00000104) ret=042932c8
  4175. 0024:Ret KERNEL32.GetSystemDirectoryA() retval=00000013 ret=042932c8
  4176. 0024:Call KERNEL32.GetModuleHandleW(043bbcf0 L"kernel32.dll") ret=042932db
  4177. 0024:Call ntdll.RtlInitUnicodeString(0031eb64,043bbcf0 L"kernel32.dll") ret=7b964e60
  4178. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031eb64 ret=7b964e60
  4179. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031eb64,0031eb70) ret=7b964e8e
  4180. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  4181. 0024:Ret KERNEL32.GetModuleHandleW() retval=7bd00000 ret=042932db
  4182. 0024:Call KERNEL32.GetProcAddress(7bd00000,043bd68c "CreateActCtxA") ret=04293300
  4183. 0024:Ret KERNEL32.GetProcAddress() retval=7bd027b0 ret=04293300
  4184. 0024:Call KERNEL32.GetProcAddress(7bd00000,043bd67c "ActivateActCtx") ret=0429330d
  4185. 0024:Ret KERNEL32.GetProcAddress() retval=7bd01f2c ret=0429330d
  4186. 0024:Call KERNEL32.GetProcAddress(7bd00000,043bd668 "DeactivateActCtx") ret=0429331a
  4187. 0024:Ret KERNEL32.GetProcAddress() retval=7bd030b0 ret=0429331a
  4188. 0024:Call KERNEL32.GetProcAddress(7bd00000,043bd658 "ReleaseActCtx") ret=04293327
  4189. 0024:Ret KERNEL32.GetProcAddress() retval=7bd08990 ret=04293327
  4190. 0024:Call KERNEL32.GetModuleHandleW(043bbec8 L"ntdll.dll") ret=0429335c
  4191. 0024:Call ntdll.RtlInitUnicodeString(0031eb64,043bbec8 L"ntdll.dll") ret=7b964e60
  4192. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031eb64 ret=7b964e60
  4193. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031eb64,0031eb70) ret=7b964e8e
  4194. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  4195. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=0429335c
  4196. 0024:Call KERNEL32.GetProcAddress(7be20000,043bd644 "RtlRbInsertNodeEx") ret=042933aa
  4197. 0024:Ret KERNEL32.GetProcAddress() retval=7be27230 ret=042933aa
  4198. 0024:Call KERNEL32.GetModuleHandleW(043bbec8 L"ntdll.dll") ret=04292b4f
  4199. 0024:Call ntdll.RtlInitUnicodeString(0031e904,043bbec8 L"ntdll.dll") ret=7b964e60
  4200. 0024:Ret ntdll.RtlInitUnicodeString() retval=0031e904 ret=7b964e60
  4201. 0024:Call ntdll.LdrGetDllHandleEx(00000001,00000000,00000000,0031e904,0031e910) ret=7b964e8e
  4202. 0024:Ret ntdll.LdrGetDllHandleEx() retval=00000000 ret=7b964e8e
  4203. 0024:Ret KERNEL32.GetModuleHandleW() retval=7be20000 ret=04292b4f
  4204. 0024:Call KERNEL32.GetProcAddress(7be20000,043bd620 "RtlImageNtHeaderEx") ret=04292b67
  4205. 0024:Ret KERNEL32.GetProcAddress() retval=7be2618c ret=04292b67
  4206. 0024:Call KERNEL32.GetProcAddress(7be20000,043bd604 "LdrGetDllHandleByMapping") ret=04292b71
  4207. 0024:Ret KERNEL32.GetProcAddress() retval=7be223cc ret=04292b71
  4208. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4209. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4210. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4211. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4212. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4213. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4214. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4215. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4216. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4217. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4218. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4219. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4220. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4221. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4222. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4223. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4224. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4225. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4226. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4227. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4228. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4229. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4230. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4231. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4232. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4233. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4234. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4235. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4236. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4237. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4238. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4239. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4240. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4241. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4242. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4243. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4244. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4245. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4246. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4247. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4248. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4249. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4250. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4251. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4252. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4253. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4254. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4255. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4256. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4257. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4258. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4259. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4260. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4261. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4262. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4263. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4264. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4265. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4266. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4267. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4268. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4269. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4270. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4271. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4272. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4273. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4274. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4275. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4276. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4277. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4278. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4279. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4280. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4281. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4282. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4283. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4284. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4285. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4286. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4287. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4288. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4289. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4290. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4291. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4292. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4293. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4294. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4295. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4296. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4297. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4298. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4299. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4300. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4301. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4302. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4303. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4304. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4305. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4306. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4307. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4308. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4309. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4310. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4311. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4312. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4313. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4314. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4315. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4316. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4317. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4318. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4319. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4320. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4321. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4322. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4323. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4324. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4325. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4326. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4327. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4328. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4329. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4330. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4331. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4332. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4333. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4334. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4335. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4336. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4337. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4338. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4339. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4340. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4341. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4342. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4343. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4344. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4345. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4346. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4347. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4348. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4349. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4350. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4351. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4352. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4353. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4354. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4355. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4356. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4357. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4358. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4359. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4360. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4361. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4362. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4363. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4364. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4365. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4366. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4367. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4368. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4369. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4370. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4371. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4372. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4373. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4374. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4375. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4376. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4377. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4378. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4379. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4380. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4381. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4382. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4383. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4384. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4385. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4386. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4387. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4388. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4389. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4390. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4391. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4392. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4393. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4394. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4395. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4396. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4397. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4398. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4399. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4400. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4401. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4402. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4403. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4404. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4405. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4406. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4407. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4408. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4409. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4410. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4411. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4412. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4413. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4414. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4415. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4416. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4417. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4418. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4419. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4420. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4421. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4422. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4423. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4424. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4425. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4426. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4427. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4428. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4429. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4430. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4431. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4432. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4433. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4434. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4435. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4436. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4437. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4438. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4439. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4440. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4441. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4442. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4443. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4444. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4445. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4446. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4447. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4448. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4449. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4450. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4451. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4452. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4453. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4454. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4455. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4456. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4457. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4458. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4459. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4460. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4461. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4462. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4463. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4464. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4465. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4466. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4467. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4468. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4469. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4470. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4471. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4472. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4473. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4474. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4475. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4476. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4477. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4478. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4479. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4480. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4481. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4482. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4483. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4484. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4485. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4486. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4487. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4488. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4489. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4490. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4491. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4492. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4493. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4494. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4495. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4496. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4497. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4498. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4499. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4500. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4501. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4502. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4503. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4504. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4505. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4506. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4507. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4508. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4509. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4510. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4511. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4512. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4513. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4514. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4515. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4516. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4517. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4518. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4519. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4520. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4521. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4522. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4523. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4524. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4525. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4526. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4527. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4528. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4529. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4530. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4531. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4532. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4533. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4534. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4535. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4536. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4537. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4538. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4539. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4540. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4541. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4542. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4543. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4544. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4545. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4546. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4547. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4548. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4549. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4550. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4551. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4552. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4553. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4554. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4555. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4556. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4557. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4558. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4559. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4560. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4561. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4562. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4563. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4564. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4565. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4566. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4567. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4568. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4569. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4570. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4571. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4572. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4573. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4574. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4575. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4576. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4577. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4578. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4579. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4580. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4581. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4582. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4583. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4584. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4585. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4586. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4587. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4588. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4589. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4590. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4591. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4592. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4593. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4594. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4595. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4596. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4597. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4598. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4599. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4600. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4601. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4602. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4603. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4604. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4605. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4606. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4607. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4608. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4609. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4610. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4611. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4612. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4613. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4614. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4615. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4616. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4617. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4618. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4619. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4620. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4621. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4622. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4623. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4624. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4625. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4626. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4627. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4628. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4629. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4630. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4631. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4632. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4633. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4634. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4635. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4636. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4637. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4638. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4639. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4640. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4641. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4642. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4643. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4644. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4645. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4646. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4647. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4648. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4649. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4650. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4651. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4652. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4653. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4654. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4655. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4656. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4657. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4658. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4659. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4660. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4661. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4662. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4663. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4664. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4665. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4666. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4667. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4668. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4669. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4670. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4671. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4672. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4673. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4674. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4675. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4676. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4677. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4678. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4679. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4680. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4681. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4682. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4683. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4684. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4685. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4686. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4687. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4688. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4689. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4690. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4691. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4692. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4693. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4694. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4695. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4696. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4697. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4698. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f8) ret=042b2d47
  4699. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4700. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4701. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4702. 0024:Call ntdll.vsprintf(0031e9a5,043bd7dc "%s",0031e6f8) ret=042b2d47
  4703. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4704. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4705. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4706. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4707. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4708. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4709. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4710. 0024:Call ntdll.vsprintf(0031e9a1,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4711. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4712. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4713. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4714. 0024:Call ntdll.vsprintf(0031e9a0,043bd7dc "%s",0031e6f4) ret=042b2d47
  4715. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4716. 0024:Call ntdll.vsprintf(0031e9a3,043e7f64 ", ",0031e704) ret=042b2d47
  4717. 0024:Ret ntdll.vsprintf() retval=00000002 ret=042b2d47
  4718. 0024:Call ntdll.vsprintf(0031e9a5,043e8208 "0x%08x",0031e6ec) ret=042b2d47
  4719. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4720. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4721. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4722. 0024:Call ntdll.vsprintf(0031e9a1,043bd7dc "%s",0031e6f4) ret=042b2d47
  4723. 0024:Ret ntdll.vsprintf() retval=00000003 ret=042b2d47
  4724. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4725. 0024:Ret ntdll.vsprintf() retval=00000005 ret=042b2d47
  4726. 0024:Call ntdll.vsprintf(0031e9a1,043e7fbc "dword ptr ",0031e6b8) ret=042b2d47
  4727. 0024:Ret ntdll.vsprintf() retval=0000000a ret=042b2d47
  4728. 0024:Call ntdll.vsprintf(0031e9ab,043e7fec "%s:[%s+0x%x]",0031e6b4) ret=042b2d47
  4729. 0024:Ret ntdll.vsprintf() retval=0000000c ret=042b2d47
  4730. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4731. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4732. 0024:Call ntdll.vsprintf(0031e9a0,043e81b8 "0x%04x",0031e6f4) ret=042b2d47
  4733. 0024:Ret ntdll.vsprintf() retval=00000006 ret=042b2d47
  4734. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4735. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4736. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4737. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4738. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4739. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4740. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4741. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4742. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4743. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4744. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4745. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4746. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4747. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4748. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4749. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4750. 0024:Call ntdll.vsprintf(0031e99c,043bd7e8 "%s ",0031e700) ret=042b2d47
  4751. 0024:Ret ntdll.vsprintf() retval=00000004 ret=042b2d47
  4752. 0024:Call KERNEL32.ReleaseMutex(00000090) ret=04293471
  4753. 0024:Call ntdll.NtReleaseMutant(00000090,00000000) ret=7b9aad82
  4754. 0024:Ret ntdll.NtReleaseMutant() retval=00000000 ret=7b9aad82
  4755. 0024:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=04293471
  4756. 0024:Call KERNEL32.CloseHandle(00000090) ret=04293478
  4757. 0024:Call ntdll.NtClose(00000090) ret=7b992581
  4758. 0024:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  4759. 0024:Ret KERNEL32.CloseHandle() retval=00000001 ret=04293478
  4760. 0024:Call user32.MessageBoxW(00000000,031a9f38 L"\81ea\52a0\8f7d\521d\59cb\5316\5931\8d25",031a96b8 L"DNFProtect \8f09\5165\63d0\793a",00010010) ret=0473fd3b
  4761.  
  4762.  
  4763. ----------------
  4764.  
  4765. Assembly results
  4766. 0024:err:ntdll:vsprintf start str: push ebp
  4767. 0024:err:ntdll:vsprintf start str: mov ebp, esp
  4768. 0024:err:ntdll:vsprintf start str: sub esp, 0x00000020
  4769. 0024:err:ntdll:vsprintf start str: mov eax, 0x7be934e0
  4770. 0024:err:ntdll:vsprintf start str: movzx eax, byte ptr ds:[eax]
  4771. 0024:err:ntdll:vsprintf start str: movzx eax, al
  4772. 0024:err:ntdll:vsprintf start str: and eax, 0x00000001
  4773. 0024:err:ntdll:vsprintf start str: test eax, eax
  4774. 0024:err:ntdll:vsprintf start str: jz .+0x0000003e (0x7be70fe0)
  4775. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[ebp+0xfffffffc], 0x7be934e0
  4776. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[ebp+0xfffffff8], 0x00000000
  4777. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0xc]
  4778. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x14], eax
  4779. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x8]
  4780. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x10], eax
  4781. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0xc], 0x7be9fdaa
  4782. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x8], 0x7bea0180
  4783. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0xfffffffc]
  4784. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x4], eax
  4785. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0xfffffff8]
  4786. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp], eax
  4787. 0024:err:ntdll:vsprintf start str: call .+0xffffbe14 (0x7be6cdf4)
  4788. 0024:err:ntdll:vsprintf start str: leave
  4789. 0024:err:ntdll:vsprintf start str: ret 0x0008
  4790. 0024:err:ntdll:vsprintf start str: push ebp
  4791. 0024:err:ntdll:vsprintf start str: mov ebp, esp
  4792. 0024:err:ntdll:vsprintf start str: sub esp, 0x0000002c
  4793. 0024:err:ntdll:vsprintf start str: mov eax, 0x7be934e0
  4794. 0024:err:ntdll:vsprintf start str: movzx eax, byte ptr ds:[eax]
  4795. 0024:err:ntdll:vsprintf start str: movzx eax, al
  4796. 0024:err:ntdll:vsprintf start str: and eax, 0x00000001
  4797. 0024:err:ntdll:vsprintf start str: test eax, eax
  4798. 0024:err:ntdll:vsprintf start str: jz .+0x00000057 (0x7be71058)
  4799. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x28], 0x7be934e0
  4800. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x24], 0x00000000
  4801. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x18]
  4802. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x20], eax
  4803. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x10]
  4804. 0024:err:ntdll:vsprintf start str: mov edx, dword ptr ss:[ebp+0x14]
  4805. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x18], eax
  4806. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x1c], edx
  4807. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0xc]
  4808. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x14], eax
  4809. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x8]
  4810. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x10], eax
  4811. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0xc], 0x7be9fdba
  4812. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x8], 0x7bea019c
  4813. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[esp+0x28]
  4814. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x4], eax
  4815. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[esp+0x24]
  4816. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp], eax
  4817. 0024:err:ntdll:vsprintf start str: call .+0xffffbd9c (0x7be6cdf4)
  4818. 0024:err:ntdll:vsprintf start str: mov eax, 0xc0000002
  4819. 0024:err:ntdll:vsprintf start str: leave
  4820. 0024:err:ntdll:vsprintf start str: ret 0x0014
  4821. 0024:err:ntdll:vsprintf start str: nop
  4822. 0024:err:ntdll:vsprintf start str: nop
  4823. 0024:err:ntdll:vsprintf start str: nop
  4824. 0024:err:ntdll:vsprintf start str: push ebp
  4825. 0024:err:ntdll:vsprintf start str: mov ebp, esp
  4826. 0024:err:ntdll:vsprintf start str: sub esp, 0x00000010
  4827. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x14]
  4828. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0xc], eax
  4829. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x10]
  4830. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x8], eax
  4831. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0xc]
  4832. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp+0x4], eax
  4833. 0024:err:ntdll:vsprintf start str: mov eax, dword ptr ss:[ebp+0x8]
  4834. 0024:err:ntdll:vsprintf start str: mov dword ptr ss:[esp], eax
  4835. 0024:err:ntdll:vsprintf start str: call .+0xffff4b5e (0x7be65be8)
  4836.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!