Code: 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000001f ret=7e9052e0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,000004fc) ret=7e905468 0009:Ret ntdll.RtlAllocateHeap() retval=017a7508 ret=7e905468 0009:Call ntdll.RtlFreeHeap(00110000,00000000,0179acd0) ret=7e9053d0 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e9053d0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000128) ret=7e907ba6 0009:Ret ntdll.RtlAllocateHeap() retval=017a7a10 ret=7e907ba6 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000e88) ret=7e90ce5f 0009:Ret ntdll.RtlAllocateHeap() retval=017a7b40 ret=7e90ce5f 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000000,017a7b6c L"libnss_nis.so.2",ffffffff,017a8800,00000104,00000000,00000000) ret=7e90c2f5 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000010 ret=7e90c2f5 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7e91a026 0009:Ret ntdll.RtlAllocateHeap() retval=017a89d0 ret=7e91a026 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7e905907 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e905907 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d441c48,0033db98,00000014,00000000) ret=7e905da4 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905da4 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d441c20,0033da98,00000100,00000000) ret=7e905de6 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905de6 0009:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0033da98 "/lib/i686/cmov/libnss_files.so.2",ffffffff,0033d890,00000104) ret=7e905e29 0009:Ret KERNEL32.MultiByteToWideChar() retval=00000021 ret=7e905e29 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/lib/i686/cmov/libnss_files.so.2",ffffffff,00000000,00000000,00000000,00000000) ret=7e90526a 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000021 ret=7e90526a 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000021) ret=7e90528e 0009:Ret ntdll.RtlAllocateHeap() retval=0179acd0 ret=7e90528e 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/lib/i686/cmov/libnss_files.so.2",ffffffff,0179acd0,00000021,00000000,00000000) ret=7e9052e0 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000021 ret=7e9052e0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,000004fc) ret=7e905468 0009:Ret ntdll.RtlAllocateHeap() retval=017a8a18 ret=7e905468 0009:Call ntdll.RtlFreeHeap(00110000,00000000,0179acd0) ret=7e9053d0 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e9053d0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000128) ret=7e907ba6 0009:Ret ntdll.RtlAllocateHeap() retval=017a8f20 ret=7e907ba6 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000e88) ret=7e90ce5f 0009:Ret ntdll.RtlAllocateHeap() retval=017a9050 ret=7e90ce5f 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000000,017a907c L"libnss_files.so.2",ffffffff,017a9d10,00000104,00000000,00000000) ret=7e90c2f5 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000012 ret=7e90c2f5 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7e91a026 0009:Ret ntdll.RtlAllocateHeap() retval=017a9ee0 ret=7e91a026 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7e905907 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e905907 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d442240,0033db98,00000014,00000000) ret=7e905da4 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905da4 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d442210,0033da98,00000100,00000000) ret=7e905de6 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905de6 0009:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0033da98 "/usr/local/bin/../lib/wine/kernel32.dll.so",ffffffff,0033d890,00000104) ret=7e905e29 0009:Ret KERNEL32.MultiByteToWideChar() retval=0000002b ret=7e905e29 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/kernel32.dll.so",ffffffff,00000000,00000000,00000000,00000000) ret=7e90526a 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000002b ret=7e90526a 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,0000002b) ret=7e90528e 0009:Ret ntdll.RtlAllocateHeap() retval=016f3f00 ret=7e90528e 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/kernel32.dll.so",ffffffff,016f3f00,0000002b,00000000,00000000) ret=7e9052e0 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000002b ret=7e9052e0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,000006b4) ret=7e905468 0009:Ret ntdll.RtlAllocateHeap() retval=017a9f28 ret=7e905468 0009:Call ntdll.RtlFreeHeap(00110000,00000000,016f3f00) ret=7e9053d0 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e9053d0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000128) ret=7e907ba6 0009:Ret ntdll.RtlAllocateHeap() retval=017aa5e8 ret=7e907ba6 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000e88) ret=7e90ce5f 0009:Ret ntdll.RtlAllocateHeap() retval=017aa718 ret=7e90ce5f 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000000,017aa744 L"kernel32<elf>",ffffffff,017ab3d8,00000104,00000000,00000000) ret=7e90c2f5 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000000e ret=7e90c2f5 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7e91a026 0009:Ret ntdll.RtlAllocateHeap() retval=017ab5a8 ret=7e91a026 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7e905907 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e905907 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d443068,0033db98,00000014,00000000) ret=7e905da4 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905da4 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d443038,0033da98,00000100,00000000) ret=7e905de6 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905de6 0009:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0033da98 "/usr/local/bin/../lib/wine/ws2_32.dll.so",ffffffff,0033d890,00000104) ret=7e905e29 0009:Ret KERNEL32.MultiByteToWideChar() retval=00000029 ret=7e905e29 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/ws2_32.dll.so",ffffffff,00000000,00000000,00000000,00000000) ret=7e90526a 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000029 ret=7e90526a 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7e90528e 0009:Ret ntdll.RtlAllocateHeap() retval=016f3f00 ret=7e90528e 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/ws2_32.dll.so",ffffffff,016f3f00,00000029,00000000,00000000) ret=7e9052e0 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000029 ret=7e9052e0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000688) ret=7e905468 0009:Ret ntdll.RtlAllocateHeap() retval=017ab5f0 ret=7e905468 0025:Ret KERNEL32.Sleep() retval=00000000 ret=0051993e 0025:Call KERNEL32.GetTickCount() ret=005196ce 0025:Ret KERNEL32.GetTickCount() retval=0005ac8b ret=005196ce 0025:Call ws2_32.ioctlsocket(0000009c,4004667f,01a3ea6c) ret=0051ec12 0025:Call ntdll.wine_server_handle_to_fd(0000009c,00000000,01a3e7dc,00000000) ret=7ee23c24 0025:Ret ntdll.wine_server_handle_to_fd() retval=00000000 ret=7ee23c24 0025:Call ntdll.wine_server_release_fd(0000009c,000000a0) ret=7ee24f26 0025:Ret ntdll.wine_server_release_fd() retval=00000000 ret=7ee24f26 0025:Ret ws2_32.ioctlsocket() retval=00000000 ret=0051ec12 0025:Call KERNEL32.Sleep(00000032) ret=0051993e 0009:Call ntdll.RtlFreeHeap(00110000,00000000,016f3f00) ret=7e9053d0 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e9053d0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000128) ret=7e907ba6 0009:Ret ntdll.RtlAllocateHeap() retval=017abc80 ret=7e907ba6 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000e88) ret=7e90ce5f 0009:Ret ntdll.RtlAllocateHeap() retval=017abdb0 ret=7e90ce5f 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000000,017abddc L"ws2_32<elf>",ffffffff,017aca70,00000104,00000000,00000000) ret=7e90c2f5 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000000c ret=7e90c2f5 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7e91a026 0009:Ret ntdll.RtlAllocateHeap() retval=017acc40 ret=7e91a026 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7e905907 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e905907 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d443448,0033db98,00000014,00000000) ret=7e905da4 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905da4 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d443418,0033da98,00000100,00000000) ret=7e905de6 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905de6 0009:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0033da98 "/usr/local/bin/../lib/wine/winmm.dll.so",ffffffff,0033d890,00000104) ret=7e905e29 0009:Ret KERNEL32.MultiByteToWideChar() retval=00000028 ret=7e905e29 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/winmm.dll.so",ffffffff,00000000,00000000,00000000,00000000) ret=7e90526a 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000028 ret=7e90526a 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000028) ret=7e90528e 0009:Ret ntdll.RtlAllocateHeap() retval=0179acd0 ret=7e90528e 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/winmm.dll.so",ffffffff,0179acd0,00000028,00000000,00000000) ret=7e9052e0 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000028 ret=7e9052e0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000688) ret=7e905468 0009:Ret ntdll.RtlAllocateHeap() retval=017acc88 ret=7e905468 0009:Call ntdll.RtlFreeHeap(00110000,00000000,0179acd0) ret=7e9053d0 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e9053d0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000128) ret=7e907ba6 0009:Ret ntdll.RtlAllocateHeap() retval=017ad318 ret=7e907ba6 0025:Ret KERNEL32.Sleep() retval=00000000 ret=0051993e 0025:Call KERNEL32.GetTickCount() ret=005196ce 0025:Ret KERNEL32.GetTickCount() retval=0005acbd ret=005196ce 0025:Call ws2_32.ioctlsocket(0000009c,4004667f,01a3ea6c) ret=0051ec12 0025:Call ntdll.wine_server_handle_to_fd(0000009c,00000000,01a3e7dc,00000000) ret=7ee23c24 0025:Ret ntdll.wine_server_handle_to_fd() retval=00000000 ret=7ee23c24 0025:Call ntdll.wine_server_release_fd(0000009c,000000a1) ret=7ee24f26 0025:Ret ntdll.wine_server_release_fd() retval=00000000 ret=7ee24f26 0025:Ret ws2_32.ioctlsocket() retval=00000000 ret=0051ec12 0025:Call KERNEL32.Sleep(00000032) ret=0051993e 0009:Call ntdll.RtlAllocateHeap(00110000,00000008,00000e88) ret=7e90ce5f 0009:Ret ntdll.RtlAllocateHeap() retval=017ad448 ret=7e90ce5f 0009:Call KERNEL32.WideCharToMultiByte(00000000,00000000,017ad474 L"winmm<elf>",ffffffff,017ae108,00000104,00000000,00000000) ret=7e90c2f5 0009:Ret KERNEL32.WideCharToMultiByte() retval=0000000b ret=7e90c2f5 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000040) ret=7e91a026 0009:Ret ntdll.RtlAllocateHeap() retval=017ae2d8 ret=7e91a026 0009:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7e905907 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e905907 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d443818,0033db98,00000014,00000000) ret=7e905da4 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905da4 0009:Call KERNEL32.ReadProcessMemory(ffffffff,7d4437e8,0033da98,00000100,00000000) ret=7e905de6 0009:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7e905de6 0009:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0033da98 "/usr/local/bin/../lib/wine/user32.dll.so",ffffffff,0033d890,00000104) ret=7e905e29 0009:Ret KERNEL32.MultiByteToWideChar() retval=00000029 ret=7e905e29 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/user32.dll.so",ffffffff,00000000,00000000,00000000,00000000) ret=7e90526a 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000029 ret=7e90526a 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000029) ret=7e90528e 0009:Ret ntdll.RtlAllocateHeap() retval=016f3f00 ret=7e90528e 0009:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0033d890 L"/usr/local/bin/../lib/wine/user32.dll.so",ffffffff,016f3f00,00000029,00000000,00000000) ret=7e9052e0 0009:Ret KERNEL32.WideCharToMultiByte() retval=00000029 ret=7e9052e0 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,000006b4) ret=7e905468 0009:Ret ntdll.RtlAllocateHeap() retval=017ae320 ret=7e905468 err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea err:seh:raise_exception Unhandled exception code c0000194 flags 0 addr 0x7bc34eea 0022:Ret user32.GetMessageW() retval=00000001 ret=7ee29103 0022:Call user32.DispatchMessageW(0033f64c) ret=7ee290e0 0022:Call window proc 0x7ee29920 (hwnd=0x2002c,msg=WM_PAINT,wp=00000000,lp=00000000) 0022:Call user32.BeginPaint(0002002c,0033f1e0) ret=7ee29a9a 0022:Call window proc 0x7ee29920 (hwnd=0x2002c,msg=WM_ERASEBKGND,wp=000001f8,lp=00000000) 0022:Ret window proc 0x7ee29920 (hwnd=0x2002c,msg=WM_ERASEBKGND,wp=000001f8,lp=00000000) retval=00000001 0022:Ret user32.BeginPaint() retval=000001f8 ret=7ee29a9a 0022:Call user32.EndPaint(0002002c,0033f1e0) ret=7ee29acb 0022:Ret user32.EndPaint() retval=00000001 ret=7ee29acb 0022:Ret window proc 0x7ee29920 (hwnd=0x2002c,msg=WM_PAINT,wp=00000000,lp=00000000) retval=00000000 0022:Ret user32.DispatchMessageW() retval=00000000 ret=7ee290e0 0022:Call user32.GetMessageW(0033f64c,00000000,00000000,00000000) ret=7ee29103 0022:Ret user32.GetMessageW() retval=00000001 ret=7ee29103 0022:Call user32.DispatchMessageW(0033f64c) ret=7ee290e0 0022:Call window proc 0x7ee29920 (hwnd=0x2002c,msg=WM_CLOSE,wp=00000000,lp=00000000) 0022:Call user32.PostQuitMessage(00000000) ret=7ee299be 0022:Ret user32.PostQuitMessage() retval=00000000 ret=7ee299be 0022:Ret window proc 0x7ee29920 (hwnd=0x2002c,msg=WM_CLOSE,wp=00000000,lp=00000000) retval=00000000 0022:Ret user32.DispatchMessageW() retval=00000000 ret=7ee290e0 0022:Call user32.GetMessageW(0033f64c,00000000,00000000,00000000) ret=7ee29103 0022:Ret user32.GetMessageW() retval=00000000 ret=7ee29103 0022:Call KERNEL32.ExitProcess(00000000) ret=7ee29123 0022:Call PE DLL (proc=0x7e592e10,module=0x7e510000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Call comctl32.DPA_DestroyCallback(00137a20,7e53b090,00000000) ret=7e53b3c5 0022:Call ntdll.RtlFreeHeap(00110000,00000000,0013eb00) ret=7e53b0c9 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e53b0c9 0022:Call KERNEL32.GetProcAddress(7e290000,7e5bba1e "CoTaskMemFree") ret=7e592db0 0022:Ret KERNEL32.GetProcAddress() retval=7e293f00 ret=7e592db0 0022:Call ole32.CoTaskMemFree(0013ee90) ret=7e554c79 0022:Call ntdll.RtlFreeHeap(00110000,00000000,0013ee90) ret=7e2bf998 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e2bf998 0022:Ret ole32.CoTaskMemFree() retval=00000000 ret=7e554c79 0022:Call ntdll.RtlFreeHeap(00110000,00000000,0013ed28) ret=7e53b0c9 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e53b0c9 0022:Call ole32.CoTaskMemFree(0013eeb0) ret=7e554c79 0022:Call ntdll.RtlFreeHeap(00110000,00000000,0013eeb0) ret=7e2bf998 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e2bf998 0022:Ret ole32.CoTaskMemFree() retval=00000000 ret=7e554c79 0022:Call ntdll.RtlFreeHeap(00110000,00000000,001372f0) ret=7e3cef31 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e3cef31 0022:Call ntdll.RtlFreeHeap(00110000,00000000,00137a20) ret=7e3cef4f 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e3cef4f 0022:Ret comctl32.DPA_DestroyCallback() retval=00000001 ret=7e53b3c5 0022:Call comctl32.ImageList_Destroy(00138630) ret=7e53b3e0 0022:Call gdi32.DeleteObject(00000368) ret=7e3d70cd 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d70cd 0022:Call gdi32.DeleteObject(0000036c) ret=7e3d70df 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d70df 0022:Call gdi32.DeleteDC(00000248) ret=7e3d70f1 0022:Ret gdi32.DeleteDC() retval=00000001 ret=7e3d70f1 0022:Call gdi32.DeleteDC(0000024c) ret=7e3d7103 0022:Ret gdi32.DeleteDC() retval=00000001 ret=7e3d7103 0022:Call gdi32.DeleteObject(00000260) ret=7e3d7115 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d7115 0022:Call gdi32.DeleteObject(0000026c) ret=7e3d7127 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d7127 0022:Call ntdll.RtlFreeHeap(00110000,00000000,00139e50) ret=7e3d7153 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e3d7153 0022:Call ntdll.RtlFreeHeap(00110000,00000000,00138630) ret=7e3d7173 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e3d7173 0022:Ret comctl32.ImageList_Destroy() retval=00000001 ret=7e53b3e0 0022:Call comctl32.ImageList_Destroy(0013a120) ret=7e53b3fb 0022:Call gdi32.DeleteObject(000003b0) ret=7e3d70cd 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d70cd 0022:Call gdi32.DeleteObject(000003b4) ret=7e3d70df 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d70df 0022:Call gdi32.DeleteDC(00000270) ret=7e3d70f1 0022:Ret gdi32.DeleteDC() retval=00000001 ret=7e3d70f1 0022:Call gdi32.DeleteDC(00000274) ret=7e3d7103 0022:Ret gdi32.DeleteDC() retval=00000001 ret=7e3d7103 0022:Call gdi32.DeleteObject(00000288) ret=7e3d7115 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d7115 0022:Call gdi32.DeleteObject(00000294) ret=7e3d7127 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3d7127 0022:Call ntdll.RtlFreeHeap(00110000,00000000,00141d40) ret=7e3d7153 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e3d7153 0022:Call ntdll.RtlFreeHeap(00110000,00000000,0013a120) ret=7e3d7173 0022:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7e3d7173 0022:Ret comctl32.ImageList_Destroy() retval=00000001 ret=7e53b3fb 0022:Call ntdll.RtlDeleteCriticalSection(7e715da0) ret=7e53b41b 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e53b41b 0022:Call ntdll.RtlDeleteCriticalSection(7e715c40) ret=7e5284c0 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e5284c0 0022:Call KERNEL32.FreeLibrary(7e290000) ret=7e592d41 0022:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7e592d41 0022:Ret PE DLL (proc=0x7e592e10,module=0x7e510000 L"shell32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7e34c130,module=0x7e290000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Call user32.UnregisterClassW(7e350100 L"OleMainThreadWndClass 0x######## ",7e290000) ret=7e2a5ebe 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e2a5ebe 0022:Call ntdll.RtlDeleteCriticalSection(7e37388c) ret=7e2d6104 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e2d6104 0022:Call ntdll.RtlDeleteCriticalSection(7e373860) ret=7e2d6115 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e2d6115 0022:Call ntdll.RtlDeleteCriticalSection(7e373550) ret=7e2a5f74 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e2a5f74 0022:Call ntdll.RtlDeleteCriticalSection(7e373520) ret=7e2a5f85 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e2a5f85 0022:Call ntdll.RtlDeleteCriticalSection(7e373538) ret=7e2a5f96 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7e2a5f96 0022:Ret PE DLL (proc=0x7e34c130,module=0x7e290000 L"ole32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7e451630,module=0x7e3b0000 L"comctl32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Call user32.UnregisterClassW(0033f182 L"SysAnimate32",00000000) ret=7e3bd637 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3bd637 0022:Call user32.UnregisterClassW(0033f182 L"ComboBoxEx32",00000000) ret=7e3c0147 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3c0147 0022:Call user32.UnregisterClassW(0033f178 L"SysDateTimePick32",00000000) ret=7e3ca945 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3ca945 0022:Call user32.UnregisterClassW(0033f17e L"flatsb_class32",00000000) ret=7e3d0fb3 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3d0fb3 0022:Call user32.UnregisterClassW(0033f184 L"SysHeader32",00000000) ret=7e3d1491 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3d1491 0022:Call user32.UnregisterClassW(0033f17c L"msctls_hotkey32",00000000) ret=7e3d5b49 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3d5b49 0022:Call user32.UnregisterClassW(0033f17e L"SysIPAddress32",00000000) ret=7e3defc3 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3defc3 0022:Call user32.UnregisterClassW(0033f180 L"SysListView32",00000000) ret=7e3e09ed 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3e09ed 0022:Call user32.UnregisterClassW(0033f180 L"SysMonthCal32",00000000) ret=7e3fae1d 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e3fae1d 0022:Call user32.UnregisterClassW(0033f180 L"NativeFontCtl",00000000) ret=7e40316d 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e40316d 0022:Call user32.UnregisterClassW(0033f18a L"SysPager",00000000) ret=7e4034ef 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e4034ef 0022:Call user32.UnregisterClassW(0033f178 L"msctls_progress32",00000000) ret=7e406425 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e406425 0022:Call user32.UnregisterClassW(0033f180 L"ReBarWindow32",00000000) ret=7e40fa1d 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e40fa1d 0022:Call user32.UnregisterClassW(0033f176 L"msctls_statusbar32",00000000) ret=7e418e3b 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e418e3b 0022:Call user32.UnregisterClassW(0033f18c L"SysLink",00000000) ret=7e41de09 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e41de09 0022:Call user32.UnregisterClassW(0033f17c L"SysTabControl32",00000000) ret=7e420ca9 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e420ca9 0022:Call user32.UnregisterClassW(0033f17c L"ToolbarWindow32",00000000) ret=7e42ab69 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e42ab69 0022:Call user32.DestroyIcon(0001004e) ret=7e43a840 0022:Ret user32.DestroyIcon() retval=00000001 ret=7e43a840 0022:Call user32.DestroyIcon(00010050) ret=7e43a851 0022:Ret user32.DestroyIcon() retval=00000001 ret=7e43a851 0022:Call user32.DestroyIcon(00010052) ret=7e43a862 0022:Ret user32.DestroyIcon() retval=00000001 ret=7e43a862 0022:Call user32.UnregisterClassW(0033f17a L"tooltips_class32",00000000) ret=7e43a8de 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e43a8de 0022:Call user32.UnregisterClassW(0033f178 L"msctls_trackbar32",00000000) ret=7e43f475 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e43f475 0022:Call user32.UnregisterClassW(0033f180 L"SysTreeView32",00000000) ret=7e4433fd 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e4433fd 0022:Call user32.UnregisterClassW(0033f17c L"msctls_updown32",00000000) ret=7e44f109 0022:Ret user32.UnregisterClassW() retval=00000001 ret=7e44f109 0022:Call gdi32.DeleteObject(00000208) ret=7e3ca693 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3ca693 0022:Call gdi32.DeleteObject(00000200) ret=7e3ca6ae 0022:Ret gdi32.DeleteObject() retval=00000001 ret=7e3ca6ae 0022:Call KERNEL32.GlobalDeleteAtom(0000c016) ret=7e3ca6ca 0022:Ret KERNEL32.GlobalDeleteAtom() retval=00000000 ret=7e3ca6ca 0022:Call KERNEL32.FreeLibrary(7e380000) ret=7e451561 0022:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7e451561 0022:Ret PE DLL (proc=0x7e451630,module=0x7e3b0000 L"comctl32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7e394490,module=0x7e380000 L"uxtheme.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7e394490,module=0x7e380000 L"uxtheme.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7e4e3900,module=0x7e4b0000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) 0022:Call KERNEL32.TlsFree(00000002) ret=7e4d5eb0 0022:Ret KERNEL32.TlsFree() retval=00000001 ret=7e4d5eb0 0022:Ret PE DLL (proc=0x7e4e3900,module=0x7e4b0000 L"shlwapi.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7ecb7b00,module=0x7ec10000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7ecb7b00,module=0x7ec10000 L"user32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7ea7dba0,module=0x7ea10000 L"winex11.drv",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7ea7dba0,module=0x7ea10000 L"winex11.drv",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7e888240,module=0x7e870000 L"imm32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Call KERNEL32.TlsFree(00000000) ret=7e886225 0022:Ret KERNEL32.TlsFree() retval=00000001 ret=7e886225 0022:Ret PE DLL (proc=0x7e888240,module=0x7e870000 L"imm32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7eb45e30,module=0x7eb40000 L"version.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7eb45e30,module=0x7eb40000 L"version.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7ebd70a0,module=0x7eb50000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7ebd70a0,module=0x7eb50000 L"gdi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7edf8bf0,module=0x7edb0000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) 0022:Call ntdll.RtlDeleteCriticalSection(7ee159e0) ret=7edeab51 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edeab51 0022:Call ntdll.RtlDeleteCriticalSection(7ee159c0) ret=7edeab62 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edeab62 0022:Call ntdll.RtlDeleteCriticalSection(7ee159f8) ret=7edea962 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edea962 0022:Call ntdll.RtlDeleteCriticalSection(7ee15ac0) ret=7edf69e9 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edf69e9 0022:Call ntdll.RtlDeleteCriticalSection(7ee15aa0) ret=7edf69fa 0022:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edf69fa 0022:Ret PE DLL (proc=0x7edf8bf0,module=0x7edb0000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7ed8b4a0,module=0x7ed50000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7ed8b4a0,module=0x7ed50000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7b87c480,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7b87c480,module=0x7b810000 L"KERNEL32.dll",reason=PROCESS_DETACH,res=0x1) retval=1 0022:Call PE DLL (proc=0x7bc86d80,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) 0022:Ret PE DLL (proc=0x7bc86d80,module=0x7bc10000 L"ntdll.dll",reason=PROCESS_DETACH,res=0x1) retval=1 001b:Call rpcrt4.NdrClientInitializeNew(0033f8f4,0033f814,7ee1bca0,00000028) ret=7ee09fca 001b:Ret rpcrt4.NdrClientInitializeNew() retval=7ee002e0 ret=7ee09fca 001b:Call rpcrt4.NDRCContextBinding(001178e8) ret=7ee09fdd 001b:Ret rpcrt4.NDRCContextBinding() retval=00117970 ret=7ee09fdd 001b:Call rpcrt4.NdrGetBuffer(0033f814,00000026,00117970) ret=7ee0a001 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7eda1076 001b:Ret ntdll.RtlAllocateHeap() retval=00117630 ret=7eda1076 001b:Ret rpcrt4.NdrGetBuffer() retval=00117630 ret=7ee0a001 001b:Call rpcrt4.NdrClientContextMarshall(0033f814,001178e8,00000000) ret=7ee0a018 001b:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ee0a018 0013:Call rpcrt4.NdrSimpleTypeMarshall(0033f804,0033f934,0000000d) ret=7edff032 0013:Ret rpcrt4.NdrSimpleTypeMarshall() retval=00000000 ret=7edff032 0013:Call rpcrt4.NdrSendReceive(0033f804,0011cfd4) ret=7edff088 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ed4143b 0013:Ret ntdll.RtlAllocateHeap() retval=0011b5e8 ret=7ed4143b 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ed500d9 001b:Ret ntdll.RtlAllocateHeap() retval=00117a60 ret=7eda10d9 0013:Ret ntdll.RtlAllocateHeap() retval=0011d050 ret=7ed500d9 0013:Call KERNEL32.InitializeCriticalSection(0011d058) ret=7ed500ee 0013:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ed500001b:Ret ntdll.RtlAllocateHeap() retval=00117ac0 ret=7ed91eb0 0013:Call ntdll.RtlAllocateHeap(00110000,00000008,00000034) ret=7ed40eb0 0013:Ret ntdll.RtlAllocateHeap() retval=0012e848 ret=7ed40eb0 0013:Call KERNEL32.WriteFile(00000020,0012e848,00000034,0033f49c,00000000) ret=7ed4db42 001b:Ret KERNEL32.WriteFile() retval=00000001 ret=7ed9eb42 0013:Ret KERNEL32.WriteFile() retval=00000001 ret=7ed4db42 7ed91fa6 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed91fa6 001b:Call ntdll.RtlFreeHeap(00110000,00000000,001179c0) ret=7ed92386 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92386 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011b5e8) ret=7ed41386 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed41386 0013:Call KERNEL32.ReadFile(00000020,0033f4e0,00000010,0033f48c,00000000) ret=7ed4dbb5 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 000f:Ret KERNEL32.WaitForSingleObjectEx() retval=00000000 ret=7ee19264 000f:Call KERNEL32.CloseHandle(000000ac) ret=7ee192d6 001e:Ret ntdll.RtlAllocateHeap() retval=00118780 ret=7edd67c8 001e:Call KERNEL32.ReadFile(00000044,00118790,00000008,0053e8cc,00000000) ret=7ede2bb5 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7edd68db 001e:Ret ntdll.RtlAllocateHeap() retval=00118da8 ret=7edd68db 001e:Call KERNEL32.ReadFile(00000044,00118da8,0000001c,0053e8cc,00000000) ret=7ede2bb5 0015:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 0015:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c)001e:Call ntdl0015:Ret ntdll.RtlAllocateHeap() retval=00118dd0 ret=7edd6001e:Ret ntdll.RtlAllocateHeap() retval=00118910 ret=7ede5076 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00118da8) ret=7edd6c4a 0015:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 0015:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=7ede5076 0015:Ret ntdll.RtlAllocateHeap() retval=00118938 ret=7ede5076 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118dd0) ret=7edd6c4a 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6c4a 0015:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eddb3ee 0015:Ret ntdll.RtlAllocateHeap() retval=00118dd0 ret=7eddb3ee 0015:Call KERNEL32.QueueUserWorkItem(7eddbd50,00118dd0,00000010) ret=7eddb42f 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee192d6 000f:Call KERNEL32.WaitForSingleObject(00000058,ffffffff) ret=7ee1e7d9 0015:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7eddb42f 0015:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7eddb4fb 0015:Ret ntdll.RtlAllocateHeap() retval=00118c40 ret=7eddb4fb 001e:Ret ntdll.RtlAllocateHeap() retval=001190e8 ret=7eddb4fb 001e:Call KERNEL32.ReadFile(00000044,0053e920,00000010,0053e8cc,00000000) ret=7ede2bb5 0044:Call PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) 0044:Ret PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 0044:Starting thread proc 0x7bc7bf40 (arg=(nil)) 0043:Call PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) 0044:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ede50d9 0044:Ret ntdll.RtlAllocateHeap() retval=00119120 ret=7ede50d9 0044:Call KERNEL32.InitializeCriticalSection(00119128) ret=7ede50ee 0044:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ede500043:Ret ntdll.RtlAllocateHeap() retval=00118700 ret=7ede50d9 0043:Call KERNEL32.InitializeCriticalSection(00118708) ret=7ede50ee 0043:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ede50ee 0043:Call rpcrt4.NdrServerInitializeNew(00118bf0,0074e748,7ee290a0) ret=7ee22f8c 0043:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ee22f8c 0043:Call rpcrt4.NdrServerContextNewUnmarshall(0074e748,7ee279d2) ret=7ee2306f 0043:Call ntdll.RtlAcquireResourceExclusive(00118e8c,00000001) ret=7edccb0040043:Ret ntdll.RtlAcquireResourceExclusive() retval=00000000044:Ret rpcrt0043:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret0044:Call 0043:Ret ntdll.RtlAllocateHeap() retval=001191f8 ret=7ede5263 0044:Ret rpcrt4.NdrSimpleTypeUnmarshall() retval=00000000 ret=7ee2308c 0044:Call rpcrt4.NdrAllocate(0094e748,00000024) ret=7ee230ea 00000d) ret=7ee2308c 0043:Ret rpcrt4.NdrSimpleTypeUnmarshall() retval=00000000 ret=7ee2308c 0043:Call rpcrt4.NdrAllocate(0074e748,00000024) ret=7ee230ea 0043:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret0044:Ret 0043:Ret ntdll.RtlAllocateHeap() retval=00118af0 ret=7ee18796 0043:Ret rpcrt4.NdrAllocate() retval=00118af0 ret=7ee230ea 0044:Ret rpcrt4.NdrConformantArrayBufferSize() retval=0094e748 ret=7ee23169 0044:Call rpcrt4.I_RpcGetBuffer(001192b8) ret=7ee23180 () retval=0074e748 ret=7ee23169 0043:Call rpcrt4.I_RpcGetBuffer(00118bf0) ret=7ee23180 0043:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ede5076 0043:Ret ntdll.RtlAllocateHeap() retval=00119348 ret=7ede5076 0043:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ee23180 0043:Call rpcrt4.NdrConformantArrayMarshall(0074e748,00118af0,7ee279d6) ret=7ee231b8 0043:Ret rpcrt4.NdrConformantArrayMarshall() retval=00000000 ret=7ee231b8 0043:Call rpcrt4.NdrPointerFree(0074e748,00118af0,7ee279e0) ret=7ee22282 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00118ab0) ret=7ee18656 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee18656 0044:Ret rpcrt4.NdrPointerFree() retval=00000001 ret=7ee22282 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00118c28) ret=7ede51ac 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede51ac 0044:Call ntdll.RtlReleaseResource(0011924c) ret=7edcb8c3 0044:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7edcb8c3 0044:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7edd56cb 0044:Ret ntdll.RtlAllocateHeap() retval=00118ad0 ret=7edd56cb 0044:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7edd5eb0 0044:Ret ntdll.RtlAllocateHeap() retval=00119388 ret=7edd5eb0 0044:Call KERNEL32.WriteFile(00000044,00119388,00000048,0094e76c,00000000) ret=7ede2b42 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ed9ebb5 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ed417c8 0013:Ret ntdll.RtlAllocateHeap() retval=0011b5e8 ret=7ed417c8 001b:Ret ntdll.RtlAllocateHeap() retval=001179c0 ret=7ed927c8 0013:Call KERNEL32.ReadFile(00000020,0011b5f8,00000008,0033f48c,00000000) ret=7ed4dbb5 001b:Call KERNEL32.ReadFile(00000020,001179d0,00000008,0033f49c,00000000) ret=7ed9ebb5 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ed4dbb5 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ed418db 0013:Ret ntdll.RtlAllocateHeap() retval=0012e848 ret=7ed418db =7ed928db 001b:Ret ntdll.RtlAllocateHeap() retval=00117ac0 ret=7ed928db 001b:Call KERNEL32.ReadFile(00000020,00117ac0,00000030,0033f49c,00000000) ret=7ed9ebb5 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ed9ebb5 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7eda1076 001b:Ret ntdll.RtlAllocateHeap() retval=00117af8 ret=7eda1076 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ed92f7d 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92f7d 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117ac0) ret=7ed92c4a 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92c4a 001b:Call ntdll.RtlFreeHeap(00110000,00000000,001179c0) ret=7ed92386 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92386 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117630) ret=7eda0fc6 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eda0fc6 001b:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ee0a088 001b:Call rpcrt4.NdrConformantArrayUnmarshall(0033f814,0033f948,7ee14596,00000000) ret=7ee0a0da 001b:Ret rpcrt4.NdrConformantArrayUnmarshall() retval=00000000 ret=7ee0a0da 001b:Call rpcrt4.NdrFreeBuffer(0033f814) ret=7ee0a141 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117af8) ret=7eda0fc6 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eda0fc6 001b:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ee0a141 001b:Call advapi32.SetServiceStatus(00116410,0033fa34) ret=7ee3282c 001b:Call rpcrt4.NdrClientInitializeNew(0033f824,0033f744,7ee1bca0,00000007) ret=7ee0c26f 001b:Ret rpcrt4.NdrClientInitializeNew() retval=7ee002e0 ret=7ee0c26f 001b:Call rpcrt4.NDRCContextBinding(00116410) ret=7ee0c282 001b:Ret rpcrt4.NDRCContextBinding() retval=00117898 ret=7ee0c282 001b:Call rpcrt4.NdrGetBuffer(0033f744,00000038,00117898) ret=7ee0c2a6 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7eda1076 001b:Ret ntdll.RtlAllocateHeap() retval=001179c0 ret=7eda1076 001b:Ret rpcrt4.NdrGetBuffer() retval=001179c0 ret=7ee0c2a6 001b:Call rpcrt4.NdrClientContextMarshall(0033f744,00116410,00000000) ret=7ee0c2bd 001b:Ret rpcrt4.NdrClientContextMarshall() retval=00000000 ret=7ee0c2bd 001b:Call rpcrt4.NdrSimpleStructMarshall(0033f744,0033fa34,7ee14374) ret=7ee0c2d9 001b:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ee0c2d9 001b:Call rpcrt4.NdrSendReceive(0033f744,001179f0) ret=7ee0c2ee 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ed9243b 001b:Ret ntdll.RtlAllocateHeap() retval=00117630 ret=7ed9243b 001b:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ed91eb0 001b:Ret ntdll.RtlAllocateHeap() retval=00117ac0 ret=7ed91eb0 001b:Call KERNEL32.WriteFile(00000020,00117ac0,00000048,0033f3dc,00000000) ret=7ed9eb42 001b:Ret KERNEL32.WriteFile() retval=00000001 ret=7ed9eb42 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117ac0) ret=7ed91fa6 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed91fa6 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117630) ret=7ed92386 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92386 001b:Call KERNEL32.ReadFile(00000020,0033f420,00000010,0033f3cc,00000000) ret=7ed9ebb5 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7edd67c8 001e:Ret ntdll.RtlAllocateHeap() retval=001193f8 ret=7edd67c8 001e:Call KERNEL32.ReadFile(00000044,00119408,00000008,0053e8cc,00000000) ret=7ede2bb5 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7edd68db 001e:Ret ntdll.RtlAllocateHeap() retval=00119450 ret=7edd68db 001e:Call KERNEL32.ReadFile(00000044,00119450,00000030,0053e8cc,00000000) ret=7ede2bb5 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ede5076 001e:Ret ntdll.RtlAllocateHeap() retval=001194c0 ret=7ede5076 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00119450) ret=7edd6c4a 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6c4a 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eddb3ee 001e:Ret ntdll.RtlAllocateHeap() retval=00119438 ret=7eddb3ee 001e:Call KERNEL32.QueueUserWorkItem(7eddbd50,00119438,00000010) ret=7eddb42f 0044:Ret KERNEL32.WriteFile() retval=00000001 ret=7ede2b42 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00119388) ret=7edd5fa6 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd5fa6 0043:Ret KERNEL32.WriteFile() retval=00000001 ret=7ede2b42 0015:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7eddb42f 0044:Ret KERNEL32.SetEvent() retval=00000001 ret=7ee19776 ret=7eddb4fb 001e:Ret ntdll.RtlAllocateHeap() retval=001192b8 ret=7eddb4fb 0044:Call rpcrt4.I_RpcGetBuffer(00118c40) ret=7ee25ef9 0044:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ede5076 0044:Ret ntdll.RtlAllocateHeap() retval=001188c0 ret=7ede5076 0044:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ee25ef9 0015:Ret ntdll.RtlAllocateHeap() retval=00118bf0 ret=7eddb4fb 0044:Call ntdll.RtlFreeHeap(00110000,00000000,001191f8) ret=7ede51ac 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede51ac 0044:Call ntdll.RtlReleaseResource(00118cac) ret=7edcb8c3 0044:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7edcb8c3 0044:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7edd56cb 0045:Call PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) 0045:Ret PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil)) retval=1 0044:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7edd5eb0 0044:Ret ntdll.RtlAllocateHeap() retval=00118da8 ret=7edd5eb0 0044:Call KERNEL32.WriteFile(00000024,00118da8,0000001c,0094e76c,00000000) ret=7ede2b42 0044:Ret KERNEL32.WriteFile() retval=00000001 ret=7ede2b42 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00118da8) ret=7edd5fa6 0013:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7ed417c8 0013:Ret ntdll.RtlAllocateHeap() retval=0011b5e8 ret=7ed417c8 d6386 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00119488) ret=7ede4fc6 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ed4dbb5 0044:Call ntdll.RtlFreeHeap(00110000,00000000,001188c0) ret=7ede4fc6 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 0044:Call ntdll.RtlFreeHeap(00110000,00000000,001193d8) ret=7edd6386 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0013:Ret KERNEL32.ReadFile() retval=00000001 ret=7ed4dbb5 =7eddbdf2 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbdf2 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eddbe15 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbe15 0044:Call ntdll.RtlFreeHeap(00110000,00000000,00119418) ret=7eddbe35 0044:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbe35 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011cfb8) ret=7ed41c4a 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed41c4a 0013:Call ntdll.RtlFreeHeap(00110000,00000000,0011b5e8) ret=7ed41386 0043:Call KERNEL32.SetEvent(0000007c) ret=7ee19776 0043:Ret KERNEL32.SetEvent() retval=00000001 ret=7ee19776 0043:Call rpcrt4.I_RpcGetBuffer(001190e8) ret=7ee25ef9 00000001 ret=7ed4ffc6 0013:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ee012ee 0013:Call rpcrt4.NdrFreeBuffer(0033f734) ret=7ee01368 0008) ret=7ede5076 0043:Ret ntdll.RtlAllocateHeap() retval=00119418 ret=7ede5076 0043:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ee25ef9 4ffc6 0013:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed4ffc6 0013:Ret rpcrt4.NdrFreeBuffer() retval=00000000 ret=7ee01368 0013:Ret advapi32.SetServiceStatus() retval=00000001 ret=7ee2879400013:Call KERNEL32.SetEvent(00000030) ret=7ee287a5 cb8c3 0043:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7edcb8c3 0043:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7edd56cb 0043:Ret ntdll.RtlAllocateHeap() retval=00118780 ret=7edd56cb 0019:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed946d4 0019:Call ntdll.RtlFreeHeap(00110000,00000000,00130838) ret=7ed946fa 0019:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed946fa 0019:Ret ntoskrnl.exe.wine_ntoskrnl_main_loop() retval=00000000 ret=7ee28681 0019:Call advapi32.SetServiceStatus(001193b8,0053e9d4) ret=7ee2859b 0019:Call rpcrt4.NdrClientInitializeNew(0053e7c4,0053e6e4,7ee10ca0,00000007) ret=7ee0126f 0019:Ret rpcrt4.NdrClientInitializeNew() retval=7edf52e0 ret=7ee0126f 0019:Call rpcrt4.NDRCContextBinding(001193b8) ret=7ee01282 001b:Call KERNEL32.ReadFile(00000020,00117640,00000008,0033f3cc,0000019:Call rpcrt4.NdrGetBuffer(0053e6e4,00000038,0011a840) ret=7ee012a6 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7ed50076 0019:Ret ntdll.RtlAllocateHeap() retval=0012e848 ret=7ed50076 0019:Ret rpcrt4.NdrGetBuffer() retval=0012e848 ret=7ee012a6 0019:Call rpcrt4.NdrClientContextMarshall(0053e6e4,001193b8,00000000) ret=7ee012bd 001b:Ret KERNEL32.ReadFile() retval=00000001 ret=7ed9ebb5 001b:Call ntdll.RtlAllocateHeap(00110000,00000000,00000004) ret=7eda1076 001b:Ret ntdll.RtlAllocateHeap() retval=00117ad8 ret=7eda1076 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ed90019:001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92f7d 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117ac0) ret=7ed92c4a 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92c4a 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117630) ret=7ed92386 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92386 0019:Ret KERNEL32.WriteFile() retval=00000001 ret=7ed4db42 7eda0fc6 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eda0fc6 001b:Ret rpcrt4.NdrSendReceive() retval=00000000 ret=7ee0c2ee 001b:Call rpcrt4.NdrFreeBuffer(0033f744) ret=7ee0c368 001b:Call ntdll.RtlFreeHeap(00110000,00000000,00117ad8) ret=7eda0fc6 001b:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eda0fc6 0019:Call KERNEL32.ReadFile(00000020,0053e3c0,00000010,0053e36001b:Ret advapi32.SetServiceStatus() retval=00000001 ret=7ee3282c 0015:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 0015:Call ntdll.RtlAllocateHeap(00110000,00000000,00000018) ret=7edd67c8 0015:Ret ntdll.RtlAllocateHeap() retval=00118c40 ret=7edd67c8 0015:Call KERNEL32.ReadFile(00000024,00118c50,00000008,0064e8cc,00000000) ret=7ede2bb5 0020:Ret KERNEL32.WaitForSingleObject() retval=00000000 re0015:Call n0020:Call advapi32.SetServiceStatus(00116410,0053e9d4) ret=7ee0015:Ret ntdll.RtlAllocateHeap() retval=00119458 ret=7edd68db 0015:Call KERNEL32.ReadFile(00000024,00119458,00000030,0064e8cc,00000000) ret=7ede2bb5 6f 0020:Ret rpcrt4.NdrClientInitializeNew() retval=7ee002e0 ret=7ee0c26f 0015:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 0020:Ret rpcrt4.NDRCContextBinding() retval=00117898 ret=7ee0c282 0020:Call rpcrt4.NdrGetBuffer(0053e6f4,00000038,00117898) ret=7ee0c2a6 6 0015:Ret ntdll.RtlAllocateHeap() retval=00118da8 ret=7ede5076 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00119458) ret=7edd6c4a 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6c4a 0015:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) r0020:Call rp0015:Ret ntdll.RtlAllocateHeap() retval=00118de0 ret=7eddb3ee 0015:Call KERNEL32.QueueUserWorkItem(7eddbd50,00118de0,00000010) ret=7eddb42f 0020:Call rpcrt4.NdrSimpleStructMarshall(0053e6f4,0053e9d4,7ee14374) ret=7ee0c2d9 0020:Ret rpcrt4.NdrSimpleStructMarshall() retval=00000000 ret=7ee0c2d9 0020:Call rpcrt4.NdrSendReceive(0053e6f4,001179f0) ret=7ee0c2ee 0020:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7ed9243b 0020:Ret ntdll.RtlAllocateHeap() retval=00117630 ret=7ed9243b 0020:Call ntdll.RtlAllocateHeap(00110000,00000008,00000048) ret=7ed91eb0 0020:Ret ntdll.RtlAllocateHeap() retval=00117ac0 ret=7ed91eb0 0020:Call KERNEL32.WriteFile(00000020,00117ac0,00000048,0053e38c,00000000) ret=7ed9eb42 0020:Ret KERNEL32.WriteFile() retval=00000001 ret=7ed9eb42 0020:Call ntdll.RtlFreeHeap(00110000,00000000,00117ac0) ret=7ed91fa6 0020:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed91fa6 ret=7edd67c8 001e:Ret ntdll.RtlAllocateHeap() retval=00118c60 ret=7edd67c8 0020:Call ntdll.RtlFreeHeap(00110000,00000000,00117630) ret=7ed92386 0020:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ed92386 0020:Call KERNEL32.ReadFile(00000020,0053e3d0,00000010,0053001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7edd68db 001e:Ret ntdll.RtlAllocateHeap() retval=00119458 ret=7edd68db 001e:Call KERNEL32.ReadFile(00000044,00119458,00000030,0053e8cc,00000000) ret=7ede2bb5 001e:Ret KERNEL32.ReadFile() retval=00000001 ret=7ede2bb5 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000030) ret=7ede5076 001e:Ret ntdll.RtlAllocateHeap() retval=00118910 ret=7ede5076 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00119458) ret=7edd6c4a 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6c4a 001e:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) ret=7eddb0043001e:Ret ntdll.RtlAllocateHeap() retval=001188c0 ret=7eddb3ee 001e:Call KERNEL32.QueueUserWorkItem(7eddbd50,001188c0,00000010) ret=0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0015:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7eddb42f 0015:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7eddb4fb 001e:Ret KERNEL32.QueueUserWorkItem() retval=00000001 ret=7edd0015:Call KERNEL32.ReadFile(00000024,0064e920,00000010,0064e8cc,00000000) ret=7ede2bb5 001e:Call ntdll.RtlAllocateHeap(00110000,00000008,0000002c) ret=7eddb4fb 001e:Ret ntdll.RtlAllocateHeap() retval=00119308 ret=7eddb4fb 0045:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ede50d9 0045:Ret ntdll.RtlAllocateHeap() retval=00119340 ret=7ede50d9 0046:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7ede0045:0046:Ret ntdll.RtlAllocateHeap() retval=00119378 ret=7ede50d9 0046:Call KERNEL32.InitializeCriticalSection(00119380) ret=7ede50ee 0046:Ret KERNEL32.InitializeCriticalSection() retval=00000001 ret=7ede50ee 0046:Call rpcrt4.NdrServerInitializeNew(001192b8,00b4e758,7ee290a0) ret=7ee25d9000046:Ret rpcrt4.NdrServerInitializeNew() retval=00000000 ret=7ee25d9c 0046:Call rpcrt4.NdrServerContextNewUnmarshall(00b4e758,7ee277b0) ret=7ee25e7800046:Call ntdll.RtlAcquireResourceExclusive(0011918c,00000001) ret=7edcc00450046:Ret ntdll.RtlAcquireResourceExclusive() retval=0000000045:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00118c88 ret=7ee25e78 0045:Call rpcrt4.NdrSimpleStructUnmarshall(00c4e758,00c4e83c,7ee277b4,0000046:Ret ntdll.RtlA0045:Ret rpcrt4.NdrSimpleStructUnmarshall(0046:Ret rpcrt4.NdrServerContextNewUnmarshall() retval=00119168 ret=7ee25e78 0046:Call rpcrt4.NdrSimpleStructUnmarshall(00b4e758,00b4e83c,7ee277b4,00000000) ret=7ee25e9c 0046:Ret rpcrt4.NdrSimpleStructUnmarshall() retval=00000000 ret=7ee25e9c 0043:Call ntdll.RtlFreeHeap(00110000,00000000,001194c0) ret=7ede4fc6 0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7ee1e7d9 0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 0043:Call ntdll.RtlFreeHeap(00110000,00000000,001193f8) ret=7edd6386 0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0043:Call ntdll.RtlFreeHeap(00110000,00000000,001190e8) ret=7eddbdf2 0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbdf2 0043:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eddbe15 0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbe15 0043:Call ntdll.RtlFreeHeap(00110000,00000000,00119438) ret=7eddbe35 0043:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbe35 0015:Ret KERNEL32.ReadFile() retval=00000000 ret=7ede2bb5 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6386 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd66e6 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd66e6 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ede4fc6 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6386 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6f7d 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6f7d 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6c4a 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6c4a 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00119458) ret=7eddb6bc 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddb6bc 0015:Call KERNEL32.FlushFileBuffers(00000024) ret=7ede2aa9 0015:Ret KERNEL32.FlushFileBuffers() retval=00000001 ret=7ede2aa9 0015:Call KERNEL32.CloseHandle(00000024) ret=7ede2ab7 0015:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ede2ab7 0015:Call KERNEL32.CloseHandle(00000030) ret=7ede2ad0 0015:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ede2ad0 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118760) ret=7edcf016 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcf016 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edcf016 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcf016 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ede3561 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede3561 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118bd8) ret=7ee19107 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee19107 0015:Call ntdll.RtlDeleteResource(00118b6c) ret=7edcb798 0015:Ret ntdll.RtlDeleteResource() retval=00000000 ret=7edcb798 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118b48) ret=7edcb7b8 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcb7b8 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118d30) ret=7ee19107 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee19107 0015:Call ntdll.RtlDeleteResource(00118cac) ret=7edcb798 err:ntdll:RtlDeleteResource Deleting active MRSW lock (0x118cac), expect failure 0015:Ret ntdll.RtlDeleteResource() retval=00000000 ret=7edcb798 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118c88) ret=7edcb7b8 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcb7b8 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118d18) ret=7ee19107 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee19107 0015:Call ntdll.RtlDeleteResource(00118e8c) ret=7edcb798 0015:Ret ntdll.RtlDeleteResource() retval=00000000 ret=7edcb798 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118e68) ret=7edcb7b8 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcb7b8 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edcc45a 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcc45a 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118a98) ret=7edcc47d 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcc47d 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edcc4a0 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcc4a0 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118a80) ret=7edcc4c3 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcc4c3 0015:Call ntdll.RtlDeleteCriticalSection(00118a28) ret=7edcc4db 0015:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edcc4db 0015:Call ntdll.RtlFreeHeap(00110000,00000000,001189f8) ret=7edcc4fb 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcc4fb 0015:Call ntdll.RtlFreeHeap(00110000,00000000,001189e0) ret=7edcf016 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcf016 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edcf016 0045:Ret KERNEL32.TerminateProcess() retval=00000000 ret=70015:Cal0045:Call KERNEL32.CloseHandle(00000058) ret=7ee1c2ff dcf016 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcf016 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edcfc2d 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcfc2d 0015:Call ntdll.RtlFreeHeap(00110000,00000000,00118978) ret=7edcfc6b 0045:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c20010045:Call KERNEL32.CloseHandle(0000003c) ret=7ee1c314 et=7ede35ae 0015:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede35ae 0015:Call PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.d0045:Call KERNEL32.CloseHandle(000000015:Call ntdll.RtlDeleteCriticalSection(00118868) ret=7ede5a6d 0015:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7ede5a6d 0045:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c329 0045:Call KERNEL32.CloseHandle(00000034) ret=7ee1c33e 0015:Ret PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=THREAD_DETACH,res=(nil)) retval=1 0045:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c33e 0045:Call KERNEL32.CloseHandle(00000040) ret=7ee1c353 0045:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c353 0045:Call rpcrt4.I_RpcGetBuffer(00118bf0) ret=7ee25ef9 0045:Call ntdll.RtlAllocateHeap(00110000,00000000,00000008) ret=7ede5076 0045:Ret ntdll.RtlAllocateHeap() retval=00118760 ret=7ede5076 0045:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ee25ef9 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118780) ret=7ede51ac 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede51ac 0045:Call ntdll.RtlReleaseResource(00118cac) ret=7edcb8c3 0045:Ret ntdll.RtlReleaseResource() retval=00000000 ret=7edcb8c3 0045:Call ntdll.RtlAllocateHeap(00110000,00000008,00000018) ret=7edd56cb 0045:Ret ntdll.RtlAllocateHeap() retval=001190e8 ret=7edd56cb 0045:Call ntdll.RtlAllocateHeap(00110000,00000008,0000001c) ret=7edd5eb0 0045:Ret ntdll.RtlAllocateHeap() retval=00118860 ret=7edd5eb0 0045:Call KERNEL32.WriteFile(00000000,00118860,0000001c,00c4e76c,00000000) ret=7ede2b42 0045:Ret KERNEL32.WriteFile() retval=00000000 ret=7ede2b42 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118860) ret=7edd5fa6 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd5fa6 0045:Call ntdll.RtlFreeHeap(00110000,00000000,001190e8) ret=7edd6386 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118da8) ret=7ede4fc6 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118760) ret=7ede4fc6 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118c40) ret=7edd6386 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118bf0) ret=7eddbdf2 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbdf2 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7eddbe15 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbe15 0045:Call ntdll.RtlFreeHeap(00110000,00000000,00118de0) ret=7eddbe35 0045:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddbe35 0046:Call KERNEL32.TerminateProcess(00000090,00000000) ret=7ee1c2f1 0046:Ret KERNEL32.TerminateProcess() retval=00000001 ret=7ee1c2f1 0046:Call KERNEL32.CloseHandle(00000090) ret=7ee1c2ff 0046:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c2ff 0046:Call KERNEL32.CloseHandle(00000080) ret=7ee1c314 0046:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c314 0046:Call KERNEL32.CloseHandle(0000007c) ret=7ee1c329 0046:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c329 0046:Call KERNEL32.CloseHandle(00000078) ret=7ee1c33e 0046:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c33e 0046:Call KERNEL32.CloseHandle(00000084) ret=7ee1c353 0046:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ee1c353 000f:Call KERNEL32.CloseHandle(00000000) ret=7ee1e7f5 000f:Ret KERNEL32.CloseHandle() retval=00000000 ret=7ee1e7f5 000f:Call advapi32.RegCloseKey(0000001c) ret=7ee1e3e7 000f:Ret advapi32.RegCloseKey() retval=00000000 ret=7ee1e3e7 000f:Call ntdll.RtlDeleteCriticalSection(00117648) ret=7ee1e3ff 000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7ee1e3ff 000f:Call ntdll.RtlFreeHeap(00110000,00000000,00117638) ret=7ee1e41f 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee1e41f 000f:Call userenv.DestroyEnvironmentBlock(00540000) ret=7ee1e434 000f:Call ntdll.RtlDestroyEnvironment(00540000) ret=7ed2af0b 000f:Ret ntdll.RtlDestroyEnvironment() retval=00000000 ret=7ed2af0b 000f:Ret userenv.DestroyEnvironmentBlock() retval=00000001 ret=7ee1e434 000f:Call KERNEL32.ExitProcess(00000000) ret=7ee26227 000f:Call PE DLL (proc=0x7ed2c520,module=0x7ed20000 L"userenv.dll",reason=PROCESS_DETACH,res=0x1) 000f:Ret PE DLL (proc=0x7ed2c520,module=0x7ed20000 L"userenv.dll",reason=PROCESS_DETACH,res=0x1) retval=1 000f:Call PE DLL (proc=0x7ede7bf0,module=0x7eda0000 L"rpcrt4.dll",reason=PROCESS_DETACH,res=0x1) 000f:Call KERNEL32.WaitForSingleObject(00000028,ffffffff) ret=7edd8c7c 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7edd8c7c 000f:Call KERNEL32.SetEvent(00000020) ret=7edde5d4 0010:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000000 ret=7ede305c 0010:Call ntdll.RtlFreeHeap(00110000,00000000,00118550) ret=7eddd806 0010:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7eddd806 0010:Call KERNEL32.FlushFileBuffers(00000054) ret=7ede2aa9 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6386 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd66e6 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd66e6 0010:Ret KERNEL32.FlushFileBuffers() retval=00000001 ret=7ede2aa9 0010:Call KERNEL32.CloseHandle(00000054) ret=7ede2ab7 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6386 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6f7d 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6f7d 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7edd6c4a 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6c4a 0010:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ede2ab7 0010:Call KERNEL32.CloseHandle(00000088) ret=7ede2ad0 et=7eddb6bc 001e:Call KERNEL32.FlushFileBuffers(00000044) ret=7ede2aa9 000f:Ret KERNEL32.SetEvent() retval=00000001 ret=7edde5d4 000f:Call KERNEL32.WaitForSingleObject(0000002c,ffffffff) ret=7edd8c9a 0010:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ede2ad0 0010:Call KERNEL32.SetEvent(0000002c) ret=7edd92b3 0010:Ret KERNEL32.SetEvent() retval=00000001 ret=7edd92b3 001e:Ret KERNEL32.FlushFileBuffers() retval=00000001 ret=7ede2aa9 001e:Call KERNEL32.CloseHandle(00000044) ret=7ede2ab7 000f:Ret KERNEL32.WaitForSingleObject() retval=00000000 ret=7edd8c9a 000f:Call KERNEL32.ReleaseMutex(00000028) ret=7edd8ca8 001e:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ede2ab7 001f:Ret KERNEL32.ConnectNamedPipe() retval=00000000 ret=7edde4f9 000f:Ret KERNEL32.ReleaseMutex() retval=00000001 ret=7edd8ca8 000f:Call ntdll.RtlFreeHeap(00110000,00000000,001185b0) ret=7edcf016 000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcf016 000f:Call ntdll.RtlDeleteCriticalSection(00118580) ret=7edd9ab8 000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 001e:Call ntd000f:Call KERNEL32.CloseHandle(00000028) ret=7edd9ac6 6 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edcf016 001e:Call ntdll.RtlFreeHeap(00110000,00000000,00000000) ret=7ede3561 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede3561 001e:Call ntdll.RtlFreeHeap(00110000,00000000,001190d0) ret=7ee19107 001e:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ee19107 001e:Call ntdll.RtlDeleteResource(00119064) ret=7edcb798 0046:Call rpcrt4.I_RpcGetBuffer(001192b8) ret=7ee25ef9 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7edd9ac6 000f:Call KERNEL32.CloseHandle(0000002c) ret=7edd9ad4 118550 ret=7ede5076 0046:Ret rpcrt4.I_RpcGetBuffer() retval=00000000 ret=7ee25ef9 0046:Call ntdll.RtlFreeHeap(00110000,00000000,001191f8) ret=7ede51ac 000f:Ret KERNEL32.CloseHandle() retval=00000001 ret=7edd9a004000f:Call ntdll.RtlFreeHeap(00110000,00000000,00118568)0046:Ret ntdl000f:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd9b05 000f:Call ntdll.RtlDeleteCriticalSection(7ee049e0) ret=7edd9b51 000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edd9b51 000f:Call ntdll.RtlDeleteCriticalSection(7ee049c0) ret=7edd9b62 000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edd9b62 0046:Call KERNEL32.WriteFile(00000000,001190d0,0000001c,00b4e76c000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7edd9962 000f:Call ntdll.RtlDeleteCriticalSection(7ee04ac0) ret=7ede59e9 000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7ede59e9 000f:Call ntdll.RtlDeleteCriticalSection(7ee04aa0) ret=7ede59fa 000f:Ret ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7ede59fa 0046:Call ntdll.RtlFreeHeap(00110000,00000000,001190d0) ret=7edd5fa6 0046:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd5fa6 000f:Call PE DLL (proc=0x7ed7a4a0,module=0x7ed40000 L"advapi32.dll",reason=PROCESS_DETACH,res=0x1) 0046:Call ntdll.RtlFreeHeap(00110000,00000000,00119308) ret=7edd6386 000f:Ret PE DLL (proc=0x7ed7a4a0,module=0x7ed40000 L"advap0046:Call ntdll.RtlFreeHeap(00110000,00000000,00118910) ret=7ede4fc6 0046:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ede4fc6 000f:Ret PE DLL (proc=0x7b87c480,module=0x7b810000 L"KERNEL32.dll",r0046:Ret ntdll.RtlFreeHeap() retval=00000f:Call PE DLL (pr0046:Call ntdll.RtlFreeHeap(00110000,00000000,00118c60) ret=7edd6386 0046:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7edd6386 .dll",reason=PROCESS_DETACH,res=0x1) retval=1 regards, Robert
