API tools faq
paste
DarkShadow44

wine DNF

DarkShadow44
Jan 14th, 2024
131
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.30 KB | None | 0 0
raw download clone embed print report
  1. 0120:trace:relay:load_list L"RelayExclude" = L"ntdll.RtlEnterCriticalSection;ntdll.RtlTryEnterCriticalSection;ntdll.RtlLeaveCriticalSection;kernel32.48;kernel32.49;kernel32.94;kernel32.95;kernel32.96;kernel32.97;kernel32.98;kernel32.TlsGetValue;kernel32.TlsSetValue;kernel32.FlsGetValue;kernel32.FlsSetValue;kernel32.SetLastError"
  2. 0120:trace:relay:load_list L"RelayFromExclude" = L"winex11.drv;winemac.drv;user32;gdi32;advapi32;kernel32"
  3. 0120:Call PE DLL (proc=7BE91F88,module=7BE20000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0031FD24)
  4. 0120:Ret PE DLL (proc=7BE91F88,module=7BE20000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0031FD24) retval=1
  5. 0120:Call PE DLL (proc=7B97ED20,module=7B940000 L"kernelbase.dll",reason=PROCESS_ATTACH,res=0031FD24)
  6. 0120:Call ntdll.LdrDisableThreadCalloutsForDll(7b940000) ret=7b9647c0
  7. 0120:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  8. 0120:Call ntdll.NtQueryInformationProcess(ffffffff,0000001a,0031f9b0,00000004,00000000) ret=7b993ef8
  9. 0120:Ret ntdll.NtQueryInformationProcess() retval=00000000 ret=7b993ef8
  10. 0120:Call ntdll.NtAllocateVirtualMemory(ffffffff,0031f978,00000000,0031f98c,00001000,00000004) ret=7b980f70
  11. 0120:Ret ntdll.NtAllocateVirtualMemory() retval=00000000 ret=7b980f70
  12. 0120:Call ntdll.RtlGetLocaleFileMappingAddress(0031f6d0,7b9eb32c,0031f6c8) ret=7b967d64
  13. 0120:Ret ntdll.RtlGetLocaleFileMappingAddress() retval=00000000 ret=7b967d64
  14. 0120:Call ntdll.NtGetNlsSectionPtr(00000009,00000000,00000000,0031f6d8,0031f6d4) ret=7b967e75
  15. 0120:Ret ntdll.NtGetNlsSectionPtr() retval=00000000 ret=7b967e75
  16. 0120:Call ntdll.RtlAllocateHeap(00340000,00000008,000010a0) ret=7b968026
  17. 0120:Ret ntdll.RtlAllocateHeap() retval=0034bac0 ret=7b968026
  18. 0120:Call ntdll.NtQueryDefaultLocale(00000001,7b9eb330) ret=7b96c9a9
  19. 0120:Ret ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b96c9a9
  20. 0120:Call ntdll.RtlInitUnicodeString(0031f6d8,7b9c2066 L"WINEUNIXCP") ret=7b9955a7
  21. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6d8 ret=7b9955a7
  22. 0120:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0031f6d8,0031f6d0) ret=7b9955eb
  23. 0120:Ret ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b9955eb
  24. 0120:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b990e42
  25. 0120:Ret ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b990e42
  26. 0120:Call ntdll.NtGetNlsSectionPtr(0000000c,00000001,00000000,7b9ec964,0031f720) ret=7b96cac5
  27. 0120:Ret ntdll.NtGetNlsSectionPtr() retval=00000000 ret=7b96cac5
  28. 0120:Call ntdll.RtlInitCodePageTable(00360000,7b9eb2c0) ret=7b96cb3d
  29. 0120:Ret ntdll.RtlInitCodePageTable() retval=7b9eb2c0 ret=7b96cb3d
  30. 0120:Call ntdll.RtlInitCodePageTable(00380000,7b9eb300) ret=7b96cb55
  31. 0120:Ret ntdll.RtlInitCodePageTable() retval=7b9eb300 ret=7b96cb55
  32. 0120:Call ntdll.RtlInitUnicodeString(0031f674,7b9c5bc8 L"\\Registry\\Machine") ret=7b9975f1
  33. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f674 ret=7b9975f1
  34. 0120:Call ntdll.NtCreateKey(0031f6ac,02000000,0031f628,00000000,00000000,00000000,00000000) ret=7b9973f9
  35. 0120:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  36. 0120:Call ntdll.RtlInitUnicodeString(0031f6e8,7b9c207c L"System\\CurrentControlSet\\Control\\Nls") ret=7b9979c7
  37. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e8 ret=7b9979c7
  38. 0120:Call ntdll.RtlInitUnicodeString(0031f6e0,00000000) ret=7b9979de
  39. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e0 ret=7b9979de
  40. 0120:Call ntdll.NtCreateKey(7b9eb338,000f003f,0031f694,00000000,0031f6e0,00000000,00000000) ret=7b9973f9
  41. 0120:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  42. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  43. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  44. 0120:Call ntdll.RtlInitUnicodeString(0031f6e8,7b9c20c8 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones") ret=7b9979c7
  45. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e8 ret=7b9979c7
  46. 0120:Call ntdll.RtlInitUnicodeString(0031f6e0,00000000) ret=7b9979de
  47. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e0 ret=7b9979de
  48. 0120:Call ntdll.NtCreateKey(7b9eb33c,000f003f,0031f694,00000000,0031f6e0,00000000,00000000) ret=7b9973f9
  49. 0120:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  50. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  51. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  52. 0120:Call ntdll.RtlOpenCurrentUser(02000000,0031f6ac) ret=7b997573
  53. 0120:Ret ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b997573
  54. 0120:Call ntdll.RtlInitUnicodeString(0031f6e8,7b9c2138 L"Control Panel\\International") ret=7b9979c7
  55. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e8 ret=7b9979c7
  56. 0120:Call ntdll.RtlInitUnicodeString(0031f6e0,00000000) ret=7b9979de
  57. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e0 ret=7b9979de
  58. 0120:Call ntdll.NtCreateKey(7b9eb334,000f003f,0031f694,00000000,0031f6e0,00000000,00000000) ret=7b9973f9
  59. 0120:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  60. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  61. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  62. 0120:Call ntdll.RtlInitUnicodeString(0031f634,7b9c191e L"Sorting\\Ids") ret=7b997c54
  63. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f634 ret=7b997c54
  64. 0120:Call ntdll.NtOpenKeyEx(0031f664,00020019,0031f5e8,00000000) ret=7b997023
  65. 0120:Ret ntdll.NtOpenKeyEx() retval=00000000 ret=7b997023
  66. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997c90
  67. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997c90
  68. 0120:Call ntdll.RtlInitUnicodeString(0031f618,03d1fd18 L"en-US") ret=7b99a47a
  69. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  70. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000005a,0031f614) ret=7b99a4ea
  71. 0120:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  72. 0120:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  73. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  74. 0120:Call ntdll.RtlInitUnicodeString(0031f618,03d1f88c L"en") ret=7b99a47a
  75. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  76. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000005a,0031f614) ret=7b99a4ea
  77. 0120:Ret ntdll.NtQueryValueKey() retval=c0000034 ret=7b99a4ea
  78. 0120:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b99a6a9
  79. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b99a6a9
  80. 0120:Call ntdll.RtlInitUnicodeString(0031f618,03d1f83e L"") ret=7b99a47a
  81. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  82. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000005a,0031f614) ret=7b99a4ea
  83. 0120:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  84. 0120:Call ntdll.memcpy(0031f686,0031f520,0000004e) ret=7b99a5df
  85. 0120:Ret ntdll.memcpy() retval=0031f686 ret=7b99a5df
  86. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  87. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  88. 0120:Call ntdll.RtlInitUnicodeString(0031f67c,0031f686 L"{00000001-57ee-1e5c-00b4-d0000bb1e11e}") ret=7b96871f
  89. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f67c ret=7b96871f
  90. 0120:Call ntdll.RtlGUIDFromString(0031f67c,0031f668) ret=7b968739
  91. 0120:Ret ntdll.RtlGUIDFromString() retval=00000000 ret=7b968739
  92. 0120:Call ntdll.memcmp(0031f668,040896ec,00000010) ret=7b96808d
  93. 0120:Ret ntdll.memcmp() retval=ffffffff ret=7b96808d
  94. 0120:Call ntdll.memcmp(0031f668,04089440,00000010) ret=7b96808d
  95. 0120:Ret ntdll.memcmp() retval=ffffffff ret=7b96808d
  96. 0120:Call ntdll.memcmp(0031f668,040892d8,00000010) ret=7b96808d
  97. 0120:Ret ntdll.memcmp() retval=ffffffff ret=7b96808d
  98. 0120:Call ntdll.memcmp(0031f668,04089224,00000010) ret=7b96808d
  99. 0120:Ret ntdll.memcmp() retval=ffffffff ret=7b96808d
  100. 0120:Call ntdll.memcmp(0031f668,040891dc,00000010) ret=7b96808d
  101. 0120:Ret ntdll.memcmp() retval=ffffffff ret=7b96808d
  102. 0120:Call ntdll.memcmp(0031f668,040891b8,00000010) ret=7b96808d
  103. 0120:Ret ntdll.memcmp() retval=00000000 ret=7b96808d
  104. 0120:Call ntdll.NtClose(00000030) ret=7b998cd1
  105. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  106. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  107. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  108. 0120:Call ntdll.RtlQueryDynamicTimeZoneInformation(0031f728) ret=7b9776e7
  109. 0120:Ret ntdll.RtlQueryDynamicTimeZoneInformation() retval=00000000 ret=7b9776e7
  110. 0120:Call ntdll.RtlInitUnicodeString(0031f69c,0031f7d4 L"Central Europe Standard Time") ret=7b997c54
  111. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f69c ret=7b997c54
  112. 0120:Call ntdll.NtOpenKeyEx(0031f6d4,000f003f,0031f650,00000000) ret=7b997023
  113. 0120:Ret ntdll.NtOpenKeyEx() retval=00000000 ret=7b997023
  114. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997c90
  115. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997c90
  116. 0120:Call ntdll.RtlInitUnicodeString(0031f618,7b9c253e L"MUI_Std") ret=7b99a47a
  117. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  118. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000000c,0031f614) ret=7b99a4ea
  119. 0120:Ret ntdll.NtQueryValueKey() retval=80000005 ret=7b99a4ea
  120. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  121. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  122. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00000022) ret=7b996568
  123. 0120:Ret ntdll.RtlAllocateHeap() retval=00345a90 ret=7b996568
  124. 0120:Call ntdll.RtlInitUnicodeString(0031f618,7b9c253e L"MUI_Std") ret=7b99a47a
  125. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  126. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000002e,0031f614) ret=7b99a4ea
  127. 0120:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  128. 0120:Call ntdll.memcpy(00345a90,0031f520,00000022) ret=7b99a5df
  129. 0120:Ret ntdll.memcpy() retval=00345a90 ret=7b99a5df
  130. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  131. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  132. 0120:Call ntdll.RtlInitUnicodeString(0031f628,00345a90 L"@tzres.dll,-4896") ret=7b994e05
  133. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f628 ret=7b994e05
  134. 0120:Call ntdll.RtlExpandEnvironmentStrings_U(00000000,0031f628,0031f620,0031f61c) ret=7b994e57
  135. 0120:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=c0000023 ret=7b994e57
  136. 0120:Call ntdll.RtlNtStatusToDosError(c0000023) ret=7b990e42
  137. 0120:Ret ntdll.RtlNtStatusToDosError() retval=0000007a ret=7b990e42
  138. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00000022) ret=7b996568
  139. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cb68 ret=7b996568
  140. 0120:Call ntdll.RtlInitUnicodeString(0031f628,00345a90 L"@tzres.dll,-4896") ret=7b994e05
  141. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f628 ret=7b994e05
  142. 0120:Call ntdll.RtlExpandEnvironmentStrings_U(00000000,0031f628,0031f620,0031f61c) ret=7b994e57
  143. 0120:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7b994e57
  144. 0120:Call ntdll.wcsrchr(0034cb68 L"@tzres.dll,-4896",0000002c) ret=7b99d142
  145. 0120:Ret ntdll.wcsrchr() retval=0034cb7c ret=7b99d142
  146. 0120:Call ntdll.wcstol(0034cb80 L"4896",00000000,0000000a) ret=7b99d186
  147. 0120:Ret ntdll.wcstol() retval=00001320 ret=7b99d186
  148. 0120:Call ntdll.RtlReAllocateHeap(00340000,00000000,00345a90,0000003c) ret=7b996617
  149. 0120:Ret ntdll.RtlReAllocateHeap() retval=0034cb98 ret=7b996617
  150. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0034cb98 L"C:\\windows\\system32\\tzres.dll",0031f5a8,00000000,00000000) ret=7b95bf9a
  151. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95bf9a
  152. 0120:Call ntdll.NtQueryAttributesFile(0031f590,0031f5b0) ret=7b95c004
  153. 0120:Ret ntdll.NtQueryAttributesFile() retval=00000000 ret=7b95c004
  154. 0120:Call ntdll.RtlFreeUnicodeString(0031f5a8) ret=7b95c017
  155. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0031f5a8 ret=7b95c017
  156. 0120:Call ntdll.RtlGetFullPathName_U(0034cb98 L"C:\\windows\\system32\\tzres.dll",00000000,00000000,00000000) ret=7b95cdb8
  157. 0120:Ret ntdll.RtlGetFullPathName_U() retval=0000003c ret=7b95cdb8
  158. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003c) ret=7b996568
  159. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cbe0 ret=7b996568
  160. 0120:Call ntdll.RtlGetFullPathName_U(0034cb98 L"C:\\windows\\system32\\tzres.dll",0000003c,0034cbe0,00000000) ret=7b95cdb8
  161. 0120:Ret ntdll.RtlGetFullPathName_U() retval=0000003a ret=7b95cdb8
  162. 0120:Call ntdll.RtlInitUnicodeString(0031f5f0,0034cbe0 L"C:\\windows\\system32\\tzres.dll") ret=7b9650f0
  163. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f5f0 ret=7b9650f0
  164. 0120:Call ntdll.LdrGetDllPath(0034cbe0 L"C:\\windows\\system32\\tzres.dll",00000022,0031f5c0,0031f5bc) ret=7b964536
  165. 0120:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  166. 0120:Call ntdll.LdrGetDllHandleEx(00000000,0034cc28,00000000,0031f5f0,0031f5c4) ret=7b964584
  167. 0120:Ret ntdll.LdrGetDllHandleEx() retval=c0000135 ret=7b964584
  168. 0120:Call ntdll.RtlDetermineDosPathNameType_U(0034cbe0 L"C:\\windows\\system32\\tzres.dll") ret=7b957abe
  169. 0120:Ret ntdll.RtlDetermineDosPathNameType_U() retval=00000002 ret=7b957abe
  170. 0120:Call ntdll.RtlDoesFileExists_U(0034cbe0 L"C:\\windows\\system32\\tzres.dll") ret=7b95f15b
  171. 0120:Ret ntdll.RtlDoesFileExists_U() retval=0031f201 ret=7b95f15b
  172. 0120:Call ntdll.RtlGetFullPathName_U(0034cbe0 L"C:\\windows\\system32\\tzres.dll",00000208,0031f370,00000000) ret=7b95cdb8
  173. 0120:Ret ntdll.RtlGetFullPathName_U() retval=0000003a ret=7b95cdb8
  174. 0120:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  175. 0120:Call ntdll.RtlGetVersion(7b9ecc40) ret=7b9b06e2
  176. 0120:Ret ntdll.RtlGetVersion() retval=00000000 ret=7b9b06e2
  177. 0120:Call ntdll.RtlQueryInformationActivationContext(00000000,7be93040,00000000,00000006,00000000,00000000,0031f060) ret=7b9b07bb
  178. 0120:Ret ntdll.RtlQueryInformationActivationContext() retval=c0000023 ret=7b9b07bb
  179. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00000008) ret=7b9b0801
  180. 0120:Ret ntdll.RtlAllocateHeap() retval=00345a90 ret=7b9b0801
  181. 0120:Call ntdll.RtlQueryInformationActivationContext(00000000,7be93040,00000000,00000006,00345a90,00000008,0031f060) ret=7b9b087f
  182. 0120:Ret ntdll.RtlQueryInformationActivationContext() retval=00000000 ret=7b9b087f
  183. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,00345a90) ret=7b9b0976
  184. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b9b0976
  185. 0120:Call ntdll.RtlImageNtHeader(00400000) ret=7b9b09b0
  186. 0120:Ret ntdll.RtlImageNtHeader() retval=00400120 ret=7b9b09b0
  187. 0120:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  188. 0120:Call ntdll.wcscpy(0031f154,7b9ecc54 L"") ret=7b9b4e4c
  189. 0120:Ret ntdll.wcscpy() retval=0031f154 ret=7b9b4e4c
  190. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0031f370 L"C:\\windows\\system32\\tzres.dll",0031f2c8,00000000,00000000) ret=7b9597c7
  191. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b9597c7
  192. 0120:Call ntdll.NtCreateFile(0031f2bc,80100080,0031f2d0,0031f2c0,00000000,00000000,00000005,00000001,00000060,00000000,00000000) ret=7b959929
  193. 0120:Ret ntdll.NtCreateFile() retval=00000000 ret=7b959929
  194. 0120:Call ntdll.RtlFreeUnicodeString(0031f2c8) ret=7b959ad2
  195. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0031f2c8 ret=7b959ad2
  196. 0120:Call ntdll.NtCreateSection(0031f310,000f0005,0031f2e8,0031f308,00000002,01000000,00000034) ret=7b9ab61c
  197. 0120:Ret ntdll.NtCreateSection() retval=00000000 ret=7b9ab61c
  198. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9ab655
  199. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9ab655
  200. 0120:Call ntdll.NtMapViewOfSection(00000038,ffffffff,0031f348,00000000,00000000,0031f300,0031f344,00000001,00000000,00000002) ret=7b980b3d
  201. 0120:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  202. 0120:Call ntdll.NtClose(00000038) ret=7b992581
  203. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  204. 0120:Call ntdll.NtClose(00000034) ret=7b992581
  205. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  206. 0120:Call ntdll.RtlReleasePath(0034cc28) ret=7b96462d
  207. 0120:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  208. 0120:Call ntdll.LdrFindResource_U(10000002,0031f540,00000003,0031f53c) ret=7b966d5b
  209. 0120:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  210. 0120:Call ntdll.LdrAccessResource(10000002,10008280,0031f59c,00000000) ret=7b966f9d
  211. 0120:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  212. 0120:Call ntdll.RtlAllocateHeap(00340000,00000008,00000018) ret=7b9966af
  213. 0120:Ret ntdll.RtlAllocateHeap() retval=00345a90 ret=7b9966af
  214. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003c) ret=7b996568
  215. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cc28 ret=7b996568
  216. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003a) ret=7b996568
  217. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cc70 ret=7b996568
  218. 0120:Call ntdll.memcpy(0034cc70,1001bb5e,00000038) ret=7b99cb5c
  219. 0120:Ret ntdll.memcpy() retval=0034cc70 ret=7b99cb5c
  220. 0120:Call ntdll.memcpy(0031f72c,1001bb5e,00000038) ret=7b99cec3
  221. 0120:Ret ntdll.memcpy() retval=0031f72c ret=7b99cec3
  222. 0120:Call ntdll.RtlImageNtHeader(10000000) ret=7b964837
  223. 0120:Ret ntdll.RtlImageNtHeader() retval=10000060 ret=7b964837
  224. 0120:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  225. 0120:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  226. 0120:Call ntdll.wcscpy(0031f47c,7b9ecc54 L"") ret=7b9b4e4c
  227. 0120:Ret ntdll.wcscpy() retval=0031f47c ret=7b9b4e4c
  228. 0120:Call ntdll.NtUnmapViewOfSection(ffffffff,10000000) ret=7b980e44
  229. 0120:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  230. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cbe0) ret=7b99664f
  231. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b99664f
  232. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cb98) ret=7b99664f
  233. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b99664f
  234. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cb68) ret=7b99664f
  235. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b99664f
  236. 0120:Call ntdll.RtlInitUnicodeString(0031f618,7b9c254e L"MUI_Dlt") ret=7b99a47a
  237. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  238. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000000c,0031f614) ret=7b99a4ea
  239. 0120:Ret ntdll.NtQueryValueKey() retval=80000005 ret=7b99a4ea
  240. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  241. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  242. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00000022) ret=7b996568
  243. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cb68 ret=7b996568
  244. 0120:Call ntdll.RtlInitUnicodeString(0031f618,7b9c254e L"MUI_Dlt") ret=7b99a47a
  245. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f618 ret=7b99a47a
  246. 0120:Call ntdll.NtQueryValueKey(00000030,0031f618,00000002,0031f514,0000002e,0031f614) ret=7b99a4ea
  247. 0120:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  248. 0120:Call ntdll.memcpy(0034cb68,0031f520,00000022) ret=7b99a5df
  249. 0120:Ret ntdll.memcpy() retval=0034cb68 ret=7b99a5df
  250. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  251. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  252. 0120:Call ntdll.RtlInitUnicodeString(0031f628,0034cb68 L"@tzres.dll,-4897") ret=7b994e05
  253. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f628 ret=7b994e05
  254. 0120:Call ntdll.RtlExpandEnvironmentStrings_U(00000000,0031f628,0031f620,0031f61c) ret=7b994e57
  255. 0120:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=c0000023 ret=7b994e57
  256. 0120:Call ntdll.RtlNtStatusToDosError(c0000023) ret=7b990e42
  257. 0120:Ret ntdll.RtlNtStatusToDosError() retval=0000007a ret=7b990e42
  258. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00000022) ret=7b996568
  259. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cb98 ret=7b996568
  260. 0120:Call ntdll.RtlInitUnicodeString(0031f628,0034cb68 L"@tzres.dll,-4897") ret=7b994e05
  261. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f628 ret=7b994e05
  262. 0120:Call ntdll.RtlExpandEnvironmentStrings_U(00000000,0031f628,0031f620,0031f61c) ret=7b994e57
  263. 0120:Ret ntdll.RtlExpandEnvironmentStrings_U() retval=00000000 ret=7b994e57
  264. 0120:Call ntdll.wcsrchr(0034cb98 L"@tzres.dll,-4897",0000002c) ret=7b99d142
  265. 0120:Ret ntdll.wcsrchr() retval=0034cbac ret=7b99d142
  266. 0120:Call ntdll.wcstol(0034cbb0 L"4897",00000000,0000000a) ret=7b99d186
  267. 0120:Ret ntdll.wcstol() retval=00001321 ret=7b99d186
  268. 0120:Call ntdll.RtlReAllocateHeap(00340000,00000000,0034cb68,0000003c) ret=7b996617
  269. 0120:Ret ntdll.RtlReAllocateHeap() retval=0034cbc8 ret=7b996617
  270. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0034cbc8 L"C:\\windows\\system32\\tzres.dll",0031f5a8,00000000,00000000) ret=7b95bf9a
  271. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95bf9a
  272. 0120:Call ntdll.NtQueryAttributesFile(0031f590,0031f5b0) ret=7b95c004
  273. 0120:Ret ntdll.NtQueryAttributesFile() retval=00000000 ret=7b95c004
  274. 0120:Call ntdll.RtlFreeUnicodeString(0031f5a8) ret=7b95c017
  275. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0031f5a8 ret=7b95c017
  276. 0120:Call ntdll.RtlGetFullPathName_U(0034cbc8 L"C:\\windows\\system32\\tzres.dll",00000000,00000000,00000000) ret=7b95cdb8
  277. 0120:Ret ntdll.RtlGetFullPathName_U() retval=0000003c ret=7b95cdb8
  278. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003c) ret=7b996568
  279. 0120:Ret ntdll.RtlAllocateHeap() retval=0034ccb8 ret=7b996568
  280. 0120:Call ntdll.RtlGetFullPathName_U(0034cbc8 L"C:\\windows\\system32\\tzres.dll",0000003c,0034ccb8,00000000) ret=7b95cdb8
  281. 0120:Ret ntdll.RtlGetFullPathName_U() retval=0000003a ret=7b95cdb8
  282. 0120:Call ntdll.RtlInitUnicodeString(0031f5f0,0034ccb8 L"C:\\windows\\system32\\tzres.dll") ret=7b9650f0
  283. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f5f0 ret=7b9650f0
  284. 0120:Call ntdll.LdrGetDllPath(0034ccb8 L"C:\\windows\\system32\\tzres.dll",00000022,0031f5c0,0031f5bc) ret=7b964536
  285. 0120:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  286. 0120:Call ntdll.LdrGetDllHandleEx(00000000,0034cd00,00000000,0031f5f0,0031f5c4) ret=7b964584
  287. 0120:Ret ntdll.LdrGetDllHandleEx() retval=c0000135 ret=7b964584
  288. 0120:Call ntdll.RtlDetermineDosPathNameType_U(0034ccb8 L"C:\\windows\\system32\\tzres.dll") ret=7b957abe
  289. 0120:Ret ntdll.RtlDetermineDosPathNameType_U() retval=00000002 ret=7b957abe
  290. 0120:Call ntdll.RtlDoesFileExists_U(0034ccb8 L"C:\\windows\\system32\\tzres.dll") ret=7b95f15b
  291. 0120:Ret ntdll.RtlDoesFileExists_U() retval=0031f201 ret=7b95f15b
  292. 0120:Call ntdll.RtlGetFullPathName_U(0034ccb8 L"C:\\windows\\system32\\tzres.dll",00000208,0031f370,00000000) ret=7b95cdb8
  293. 0120:Ret ntdll.RtlGetFullPathName_U() retval=0000003a ret=7b95cdb8
  294. 0120:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  295. 0120:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  296. 0120:Call ntdll.wcscpy(0031f154,7b9ecc54 L"") ret=7b9b4e4c
  297. 0120:Ret ntdll.wcscpy() retval=0031f154 ret=7b9b4e4c
  298. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0031f370 L"C:\\windows\\system32\\tzres.dll",0031f2c8,00000000,00000000) ret=7b9597c7
  299. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b9597c7
  300. 0120:Call ntdll.NtCreateFile(0031f2bc,80100080,0031f2d0,0031f2c0,00000000,00000000,00000005,00000001,00000060,00000000,00000000) ret=7b959929
  301. 0120:Ret ntdll.NtCreateFile() retval=00000000 ret=7b959929
  302. 0120:Call ntdll.RtlFreeUnicodeString(0031f2c8) ret=7b959ad2
  303. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0031f2c8 ret=7b959ad2
  304. 0120:Call ntdll.NtCreateSection(0031f310,000f0005,0031f2e8,0031f308,00000002,01000000,00000034) ret=7b9ab61c
  305. 0120:Ret ntdll.NtCreateSection() retval=00000000 ret=7b9ab61c
  306. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b9ab655
  307. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b9ab655
  308. 0120:Call ntdll.NtMapViewOfSection(00000038,ffffffff,0031f348,00000000,00000000,0031f300,0031f344,00000001,00000000,00000002) ret=7b980b3d
  309. 0120:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=7b980b3d
  310. 0120:Call ntdll.NtClose(00000038) ret=7b992581
  311. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  312. 0120:Call ntdll.NtClose(00000034) ret=7b992581
  313. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  314. 0120:Call ntdll.RtlReleasePath(0034cd00) ret=7b96462d
  315. 0120:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  316. 0120:Call ntdll.LdrFindResource_U(10000002,0031f540,00000003,0031f53c) ret=7b966d5b
  317. 0120:Ret ntdll.LdrFindResource_U() retval=00000000 ret=7b966d5b
  318. 0120:Call ntdll.LdrAccessResource(10000002,10008280,0031f59c,00000000) ret=7b966f9d
  319. 0120:Ret ntdll.LdrAccessResource() retval=00000000 ret=7b966f9d
  320. 0120:Call ntdll.RtlAllocateHeap(00340000,00000008,00000018) ret=7b9966af
  321. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cb68 ret=7b9966af
  322. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003c) ret=7b996568
  323. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cd00 ret=7b996568
  324. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003a) ret=7b996568
  325. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cd48 ret=7b996568
  326. 0120:Call ntdll.memcpy(0034cd48,1001bb98,00000038) ret=7b99cb5c
  327. 0120:Ret ntdll.memcpy() retval=0034cd48 ret=7b99cb5c
  328. 0120:Call ntdll.memcpy(0031f780,1001bb98,00000038) ret=7b99cec3
  329. 0120:Ret ntdll.memcpy() retval=0031f780 ret=7b99cec3
  330. 0120:Call ntdll.RtlImageNtHeader(10000000) ret=7b964837
  331. 0120:Ret ntdll.RtlImageNtHeader() retval=10000060 ret=7b964837
  332. 0120:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  333. 0120:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  334. 0120:Call ntdll.wcscpy(0031f47c,7b9ecc54 L"") ret=7b9b4e4c
  335. 0120:Ret ntdll.wcscpy() retval=0031f47c ret=7b9b4e4c
  336. 0120:Call ntdll.NtUnmapViewOfSection(ffffffff,10000000) ret=7b980e44
  337. 0120:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=7b980e44
  338. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034ccb8) ret=7b99664f
  339. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b99664f
  340. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cbc8) ret=7b99664f
  341. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b99664f
  342. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cb98) ret=7b99664f
  343. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b99664f
  344. 0120:Call ntdll.NtClose(00000030) ret=7b998cd1
  345. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  346. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  347. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  348. 0120:Call ntdll.wcscpy(7b9ec9c4,0031f7d4 L"Central Europe Standard Time") ret=7b97788d
  349. 0120:Ret ntdll.wcscpy() retval=7b9ec9c4 ret=7b97788d
  350. 0120:Call ntdll.wcscpy(7b9ecac4,0031f72c L"Central Europe Standard Time") ret=7b9778a4
  351. 0120:Ret ntdll.wcscpy() retval=7b9ecac4 ret=7b9778a4
  352. 0120:Call ntdll.wcscpy(7b9ecb04,0031f780 L"Central Europe Daylight Time") ret=7b9778bb
  353. 0120:Ret ntdll.wcscpy() retval=7b9ecb04 ret=7b9778bb
  354. 0120:Call ntdll.NtQuerySystemTime(0031f6c8) ret=7b9778e2
  355. 0120:Ret ntdll.NtQuerySystemTime() retval=00000000 ret=7b9778e2
  356. 0120:Call ntdll.RtlTimeToTimeFields(0031f6b0,0031f660) ret=7b973613
  357. 0120:Ret ntdll.RtlTimeToTimeFields() retval=0031f660 ret=7b973613
  358. 0120:Call ntdll.RtlTimeToTimeFields(0031f670,0031f660) ret=7b973671
  359. 0120:Ret ntdll.RtlTimeToTimeFields() retval=0031f660 ret=7b973671
  360. 0120:Call ntdll.RtlTimeToTimeFields(0031f670,0031f660) ret=7b9736fe
  361. 0120:Ret ntdll.RtlTimeToTimeFields() retval=0031f660 ret=7b9736fe
  362. 0120:Call ntdll.RtlInitUnicodeString(0031f6e8,7b9c2170 L"System\\CurrentControlSet\\Control\\TimeZoneInformation") ret=7b9979c7
  363. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e8 ret=7b9979c7
  364. 0120:Call ntdll.RtlInitUnicodeString(0031f6e0,00000000) ret=7b9979de
  365. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e0 ret=7b9979de
  366. 0120:Call ntdll.NtCreateKey(0031f71c,000f003f,0031f694,00000000,0031f6e0,00000000,00000000) ret=7b9973f9
  367. 0120:Ret ntdll.NtCreateKey() retval=00000000 ret=7b9973f9
  368. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b997a27
  369. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b997a27
  370. 0120:Call ntdll.RtlInitUnicodeString(0031f6e4,7b9c21da L"StandardName") ret=7b999037
  371. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e4 ret=7b999037
  372. 0120:Call ntdll.NtSetValueKey(00000030,0031f6e4,00000000,00000001,0031f72c,0000003a) ret=7b99906b
  373. 0120:Ret ntdll.NtSetValueKey() retval=00000000 ret=7b99906b
  374. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b999078
  375. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b999078
  376. 0120:Call ntdll.RtlInitUnicodeString(0031f6e4,7b9c21f4 L"TimeZoneKeyName") ret=7b999037
  377. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6e4 ret=7b999037
  378. 0120:Call ntdll.NtSetValueKey(00000030,0031f6e4,00000000,00000001,0031f7d4,0000003a) ret=7b99906b
  379. 0120:Ret ntdll.NtSetValueKey() retval=00000000 ret=7b99906b
  380. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b999078
  381. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b999078
  382. 0120:Call ntdll.NtClose(00000030) ret=7b998cd1
  383. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b998cd1
  384. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b998cde
  385. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b998cde
  386. 0120:Call ntdll.RtlInitUnicodeString(0031f6cc,7b9c2032 L"LocaleName") ret=7b99a47a
  387. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031f6cc ret=7b99a47a
  388. 0120:Call ntdll.NtQueryValueKey(0000002c,0031f6cc,00000002,0031f5c8,000000b6,0031f6c8) ret=7b99a4ea
  389. 0120:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b99a4ea
  390. 0120:Call ntdll.memcpy(0031f8da,0031f5d4,0000000c) ret=7b99a5df
  391. 0120:Ret ntdll.memcpy() retval=0031f8da ret=7b99a5df
  392. 0120:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b99a6a9
  393. 0120:Ret ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b99a6a9
  394. 0120:Call ntdll.wcscmp(0031f8da L"en-US",03d1fd18 L"en-US") ret=7b96ce03
  395. 0120:Ret ntdll.wcscmp() retval=00000000 ret=7b96ce03
  396. 0120:Call ntdll.RtlUnicodeStringToAnsiString(0031f9b0,003420e8,00000001) ret=7b994806
  397. 0120:Ret ntdll.RtlUnicodeStringToAnsiString() retval=00000000 ret=7b994806
  398. 0120:Call ntdll.RtlGetCurrentPeb() ret=7b952493
  399. 0120:Ret ntdll.RtlGetCurrentPeb() retval=7ffd1000 ret=7b952493
  400. 0120:Ret PE DLL (proc=7B97ED20,module=7B940000 L"kernelbase.dll",reason=PROCESS_ATTACH,res=0031FD24) retval=1
  401. 0120:Call PE DLL (proc=7BD2FD14,module=7BD00000 L"kernel32.dll",reason=PROCESS_ATTACH,res=0031FD24)
  402. 0120:Call ntdll.LdrDisableThreadCalloutsForDll(7bd00000) ret=7b9647c0
  403. 0120:Ret ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b9647c0
  404. 0120:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  405. 0120:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  406. 0120:Call ntdll.wcscpy(0031f90c,7b9ecc54 L"") ret=7b9b4e4c
  407. 0120:Ret ntdll.wcscpy() retval=0031f90c ret=7b9b4e4c
  408. 0120:Call ntdll.NtProtectVirtualMemory(ffffffff,0031f9ac,0031f9b0,00000004,0031f9e0) ret=7b981499
  409. 0120:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=7b981499
  410. 0120:Call ntdll.NtProtectVirtualMemory(ffffffff,0031f9ac,0031f9b0,00000002,0031f9e0) ret=7b981499
  411. 0120:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=7b981499
  412. 0120:Ret PE DLL (proc=7BD2FD14,module=7BD00000 L"kernel32.dll",reason=PROCESS_ATTACH,res=0031FD24) retval=1
  413. 0120:Starting thread proc 02C5A17B (arg=7FFD1000)
  414. 0120:Call KERNEL32.BaseThreadInitThunk(00000000,02c5a17b,7ffd1000) ret=7be7b5b3
  415. 0120:Call KERNEL32.LoadLibraryA(02c5a100 "Kernel32.dll") ret=03cca595
  416. 0120:Call ntdll.RtlInitAnsiString(0031ee38,02c5a100 "Kernel32.dll") ret=7b9585a9
  417. 0120:Ret ntdll.RtlInitAnsiString() retval=0031ee38 ret=7b9585a9
  418. 0120:Call ntdll.RtlAnsiStringToUnicodeString(7ffc2bf8,0031ee38,00000000) ret=7b958618
  419. 0120:Ret ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b958618
  420. 0120:Call ntdll.RtlInitUnicodeString(0031ee48,7ffc2c00 L"Kernel32.dll") ret=7b9650f0
  421. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031ee48 ret=7b9650f0
  422. 0120:Call ntdll.LdrGetDllPath(7ffc2c00 L"Kernel32.dll",00000000,0031ee18,0031ee14) ret=7b964536
  423. 0120:Ret ntdll.LdrGetDllPath() retval=00000000 ret=7b964536
  424. 0120:Call ntdll.LdrLoadDll(0034cd90 L"Z:\\tmp\\ramdisk;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",00000000,0031ee48,0031ee1c) ret=7b9645d6
  425. 0120:Ret ntdll.LdrLoadDll() retval=00000000 ret=7b9645d6
  426. 0120:Call ntdll.RtlReleasePath(0034cd90) ret=7b96462d
  427. 0120:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b96462d
  428. 0120:Ret KERNEL32.LoadLibraryA() retval=7bd00000 ret=03cca595
  429. 0120:Call KERNEL32.GetProcAddress(7bd00000,02c5a10d "FreeLibrary") ret=02c5b48f
  430. 0120:Ret KERNEL32.GetProcAddress() retval=7bd04190 ret=02c5b48f
  431. 0120:Call KERNEL32.GetProcAddress(7bd00000,02c5a119 "VirtualAlloc") ret=02c5b48f
  432. 0120:Ret KERNEL32.GetProcAddress() retval=7bd0a0f0 ret=02c5b48f
  433. 0120:Call KERNEL32.VirtualAlloc(00000000,00551000,00003000,00000040) ret=03cc70ca
  434. 0120:Call ntdll.NtAllocateVirtualMemory(ffffffff,0031ee48,00000000,0031ee5c,00003000,00000040) ret=7b980f70
  435. 0120:Ret ntdll.NtAllocateVirtualMemory() retval=00000000 ret=7b980f70
  436. 0120:Ret KERNEL32.VirtualAlloc() retval=04250000 ret=03cc70ca
  437. 0120:trace:seh:dispatch_exception code=c0000005 flags=0 addr=03CC3C2C ip=03cc3c2c
  438. 0120:trace:seh:dispatch_exception info[0]=00000000
  439. 0120:trace:seh:dispatch_exception info[1]=00000000
  440. 0120:warn:seh:dispatch_exception EXCEPTION_ACCESS_VIOLATION exception (code=c0000005) raised
  441. 0120:trace:seh:dispatch_exception eax=00008700 ebx=7ffd1000 ecx=00000000 edx=00000000 esi=0031ff74 edi=0031ff3c
  442. 0120:trace:seh:dispatch_exception ebp=0031fee4 esp=0031eedc cs=0023 ss=002b ds=002b es=002b fs=0063 gs=006b flags=00010287
  443. 0120:trace:seh:call_stack_handlers calling handler at 7BE9205E code=c0000005 flags=0
  444. 0120:Call ntdll.NtCreateEvent(0031e850,001f0003,0031e854,00000000,00000000) ret=7b9546e3
  445. 0120:Ret ntdll.NtCreateEvent() retval=00000000 ret=7b9546e3
  446. wine: Unhandled page fault on read access to 00000000 at address 03CC3C2C (thread 0120), starting debugger...
  447. 0120:Call ntdll.NtOpenKey(0031e788,00020019,0031e794) ret=7b953e1a
  448. 0120:Ret ntdll.NtOpenKey() retval=00000000 ret=7b953e1a
  449. 0120:Call ntdll.RtlInitUnicodeString(0031e78c,7b9bf018 L"Debugger") ret=7b953e47
  450. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031e78c ret=7b953e47
  451. 0120:Call ntdll.NtQueryValueKey(00000034,0031e78c,00000002,00000000,00000000,0031e62c) ret=7b953e86
  452. 0120:Ret ntdll.NtQueryValueKey() retval=c0000023 ret=7b953e86
  453. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000003a) ret=7b953ec4
  454. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cbb8 ret=7b953ec4
  455. 0120:Call ntdll.NtQueryValueKey(00000034,0031e78c,00000002,0034cbb8,0000003a,0031e62c) ret=7b953f07
  456. 0120:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b953f07
  457. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00000030) ret=7b953f43
  458. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cd90 ret=7b953f43
  459. 0120:Call ntdll.memcpy(0034cd90,0034cbc4,0000002e) ret=7b953f6a
  460. 0120:Ret ntdll.memcpy() retval=0034cd90 ret=7b953f6a
  461. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cbb8) ret=7b95406d
  462. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b95406d
  463. 0120:Call ntdll.RtlInitUnicodeString(0031e78c,7b9bf02a L"Auto") ret=7b954088
  464. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031e78c ret=7b954088
  465. 0120:Call ntdll.NtQueryValueKey(00000034,0031e78c,00000002,0031e630,000000fe,0031e62c) ret=7b9540c9
  466. 0120:Ret ntdll.NtQueryValueKey() retval=00000000 ret=7b9540c9
  467. 0120:Call ntdll.wcstol(0031e63c L"1",00000000,0000000a) ret=7b95413a
  468. 0120:Ret ntdll.wcstol() retval=00000001 ret=7b95413a
  469. 0120:Call ntdll.NtClose(00000034) ret=7b954150
  470. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b954150
  471. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000007c) ret=7b9541a1
  472. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cdc8 ret=7b9541a1
  473. 0120:Call ntdll._vsnwprintf(0034cdc8,0000003e,0034cd90 L"winedbg --auto %ld %ld",0031e608) ret=7b952706
  474. 0120:Ret ntdll._vsnwprintf() retval=00000015 ret=7b952706
  475. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cd90) ret=7b95420a
  476. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b95420a
  477. 0120:Call ntdll.RtlAcquirePebLock() ret=7b994fe0
  478. 0120:Ret ntdll.RtlAcquirePebLock() retval=00000000 ret=7b994fe0
  479. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,00001c12) ret=7b99502f
  480. 0120:Ret ntdll.RtlAllocateHeap() retval=0034ce50 ret=7b99502f
  481. 0120:Call ntdll.memcpy(0034ce50,00340488,00001c12) ret=7b995068
  482. 0120:Ret ntdll.memcpy() retval=0034ce50 ret=7b995068
  483. 0120:Call ntdll.RtlReleasePebLock() ret=7b99506f
  484. 0120:Ret ntdll.RtlReleasePebLock() retval=00000000 ret=7b99506f
  485. 0120:Call ntdll.wcsncmp(0034ce50 L"WINEDEBUG=+relay,+seh",7b9bf084 L"WINEDEBUG=",0000000a) ret=7b9543d4
  486. 0120:Ret ntdll.wcsncmp() retval=00000000 ret=7b9543d4
  487. 0120:Call ntdll.memmove(0034ce64,0034ce7a,00000df4) ret=7b954445
  488. 0120:Ret ntdll.memmove() retval=0034ce64 ret=7b954445
  489. 0120:trace:seh:start_debugger Starting debugger L"winedbg --auto 284 48"
  490. 0120:Call ntdll.memset(0031e730,00000000,00000044) ret=7b9544dd
  491. 0120:Ret ntdll.memset() retval=0031e730 ret=7b9544dd
  492. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,0000002c) ret=7b991588
  493. 0120:Ret ntdll.RtlAllocateHeap() retval=0034cd90 ret=7b991588
  494. 0120:Call ntdll.RtlGetExePath(0034cd90 L"winedbg",0031e22c) ret=7b9912dc
  495. 0120:Ret ntdll.RtlGetExePath() retval=00000000 ret=7b9912dc
  496. 0120:Call ntdll.RtlDetermineDosPathNameType_U(0034cd90 L"winedbg") ret=7b957abe
  497. 0120:Ret ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b957abe
  498. 0120:Call ntdll.RtlDosSearchPath_U(0034ea70 L"Z:\\tmp\\ramdisk;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0",0034cd90 L"winedbg",7b9c5356 L".exe",00000208,0031e308,00000000) ret=7b95f25c
  499. 0120:Ret ntdll.RtlDosSearchPath_U() retval=0000003e ret=7b95f25c
  500. 0120:Call ntdll.RtlRunOnceExecuteOnce(7b9ecd5c,7b9b06bd,00000000,00000000) ret=7b9ad352
  501. 0120:Ret ntdll.RtlRunOnceExecuteOnce() retval=00000000 ret=7b9ad352
  502. 0120:Call ntdll.wcscpy(0031e010,7b9ecc54 L"") ret=7b9b4e4c
  503. 0120:Ret ntdll.wcscpy() retval=0031e010 ret=7b9b4e4c
  504. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0031e308 L"C:\\windows\\system32\\winedbg.exe",0031e184,00000000,00000000) ret=7b9597c7
  505. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b9597c7
  506. 0120:Call ntdll.NtCreateFile(0031e178,80100080,0031e18c,0031e17c,00000000,00000000,00000005,00000001,00000060,00000000,00000000) ret=7b959929
  507. 0120:Ret ntdll.NtCreateFile() retval=00000000 ret=7b959929
  508. 0120:Call ntdll.RtlFreeUnicodeString(0031e184) ret=7b959ad2
  509. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0031e184 ret=7b959ad2
  510. 0120:Call ntdll.NtClose(00000034) ret=7b992581
  511. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  512. 0120:Call ntdll.RtlReleasePath(0034ea70) ret=7b991449
  513. 0120:Ret ntdll.RtlReleasePath() retval=00340001 ret=7b991449
  514. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034cd90) ret=7b991732
  515. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b991732
  516. 0120:Call ntdll.wcspbrk(0031e30c L"\\windows\\system32\\winedbg.exe",7b9bfa68 L"*?") ret=7b95d0ca
  517. 0120:Ret ntdll.wcspbrk() retval=00000000 ret=7b95d0ca
  518. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0031d794 L"C:\\windows",0031d430,0031d438,00000000) ret=7b95a7e0
  519. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95a7e0
  520. 0120:Call ntdll.wcspbrk(0034cd9e L"windows",7b9bfa68 L"*?") ret=7b95aa42
  521. 0120:Ret ntdll.wcspbrk() retval=00000000 ret=7b95aa42
  522. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,000002a6) ret=7b95aacb
  523. 0120:Ret ntdll.RtlAllocateHeap() retval=0034ea70 ret=7b95aacb
  524. 0120:Call ntdll.NtOpenFile(0034ea74,00100001,0031d418,0031d410,00000003,00004021) ret=7b95abfc
  525. 0120:Ret ntdll.NtOpenFile() retval=00000000 ret=7b95abfc
  526. 0120:Call ntdll.RtlInitializeCriticalSection(0034ea78) ret=7b95ac83
  527. 0120:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b95ac83
  528. 0120:Call ntdll.RtlInitUnicodeString(0031d408,0034cd9e L"windows") ret=7b95add6
  529. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031d408 ret=7b95add6
  530. 0120:Call ntdll.NtQueryDirectoryFile(00000034,00000000,00000000,00000000,0031d410,0034eab8,0000025e,00000003,00000000,0031d408,00000001) ret=7b95ae4e
  531. 0120:Ret ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b95ae4e
  532. 0120:Call ntdll.memcpy(0031d570,0034eb16,0000000e) ret=7b95b839
  533. 0120:Ret ntdll.memcpy() retval=0031d570 ret=7b95b839
  534. 0120:Call ntdll.memcpy(0031d778,0034eafe,00000000) ret=7b95b886
  535. 0120:Ret ntdll.memcpy() retval=0031d778 ret=7b95b886
  536. 0120:Call ntdll.NtClose(00000034) ret=7b992581
  537. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  538. 0120:Call ntdll.RtlFreeUnicodeString(0034ea98) ret=7b95baa5
  539. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0034ea98 ret=7b95baa5
  540. 0120:Call ntdll.RtlDeleteCriticalSection(0034ea78) ret=7b95baec
  541. 0120:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b95baec
  542. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034ea70) ret=7b95bb1c
  543. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b95bb1c
  544. 0120:Call ntdll.RtlInitUnicodeString(0031d53c,0031d79a L"windows") ret=7b95d2ea
  545. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031d53c ret=7b95d2ea
  546. 0120:Call ntdll.RtlIsNameLegalDOS8Dot3(0031d53c,00000000,00000000) ret=7b95d30d
  547. 0120:Ret ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b95d30d
  548. 0120:Call ntdll.RtlDosPathNameToNtPathName_U(0031d794 L"C:\\windows\\system32",0031d430,0031d438,00000000) ret=7b95a7e0
  549. 0120:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b95a7e0
  550. 0120:Call ntdll.wcspbrk(0034cbd6 L"system32",7b9bfa68 L"*?") ret=7b95aa42
  551. 0120:Ret ntdll.wcspbrk() retval=00000000 ret=7b95aa42
  552. 0120:Call ntdll.RtlAllocateHeap(00340000,00000000,000002a6) ret=7b95aacb
  553. 0120:Ret ntdll.RtlAllocateHeap() retval=0034ea70 ret=7b95aacb
  554. 0120:Call ntdll.NtOpenFile(0034ea74,00100001,0031d418,0031d410,00000003,00004021) ret=7b95abfc
  555. 0120:Ret ntdll.NtOpenFile() retval=00000000 ret=7b95abfc
  556. 0120:Call ntdll.RtlInitializeCriticalSection(0034ea78) ret=7b95ac83
  557. 0120:Ret ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b95ac83
  558. 0120:Call ntdll.RtlInitUnicodeString(0031d408,0034cbd6 L"system32") ret=7b95add6
  559. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031d408 ret=7b95add6
  560. 0120:Call ntdll.NtQueryDirectoryFile(00000034,00000000,00000000,00000000,0031d410,0034eab8,0000025e,00000003,00000000,0031d408,00000001) ret=7b95ae4e
  561. 0120:Ret ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b95ae4e
  562. 0120:Call ntdll.memcpy(0031d570,0034eb16,00000010) ret=7b95b839
  563. 0120:Ret ntdll.memcpy() retval=0031d570 ret=7b95b839
  564. 0120:Call ntdll.memcpy(0031d778,0034eafe,00000000) ret=7b95b886
  565. 0120:Ret ntdll.memcpy() retval=0031d778 ret=7b95b886
  566. 0120:Call ntdll.NtClose(00000034) ret=7b992581
  567. 0120:Ret ntdll.NtClose() retval=00000000 ret=7b992581
  568. 0120:Call ntdll.RtlFreeUnicodeString(0034ea98) ret=7b95baa5
  569. 0120:Ret ntdll.RtlFreeUnicodeString() retval=0034ea98 ret=7b95baa5
  570. 0120:Call ntdll.RtlDeleteCriticalSection(0034ea78) ret=7b95baec
  571. 0120:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b95baec
  572. 0120:Call ntdll.RtlFreeHeap(00340000,00000000,0034ea70) ret=7b95bb1c
  573. 0120:Ret ntdll.RtlFreeHeap() retval=00340001 ret=7b95bb1c
  574. 0120:Call ntdll.RtlInitUnicodeString(0031d53c,0031d7aa L"system32") ret=7b95d2ea
  575. 0120:Ret ntdll.RtlInitUnicodeString() retval=0031d53c ret=7b95d2ea
  576. 0120:Call ntdll.RtlIsNameLegalDOS8Dot3(0031d53c,00000000,00000000) ret=7b95d30d
  577.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!