winefail.log

gistfile1.txt

Sending build context to Docker daemon  275.8MB

Step 1/62 : FROM alpine:3.7
 ---> 3fd9065eaf02
Step 2/62 : WORKDIR /build
 ---> Using cache
 ---> cba93be3da31
Step 3/62 : RUN apk --no-cache update && apk --no-cache upgrade && apk add --no-cache git
 ---> Using cache
 ---> 9ca3a1069aee
Step 4/62 : RUN git config --global user.name "Mingw" &&     git config --global user.email root@localhost
 ---> Using cache
 ---> b4481dbfc328
Step 5/62 : RUN git clone -b release_60 https://github.com/llvm-mirror/llvm.git &&     cd llvm/tools &&     git clone -b release_60 https://github.com/llvm-mirror/clang.git &&     git clone -b release_60 https://github.com/llvm-mirror/lld.git
 ---> Using cache
 ---> 2f395b9a10f6
Step 6/62 : RUN apk add --no-cache clang clang-dev linux-headers cmake     build-base ninja make python2 python2-dev tar
 ---> Using cache
 ---> dcb8f61d09cd
Step 7/62 : ENV TOOLCHAIN_PREFIX=/build/prefix
 ---> Using cache
 ---> 9ff0be6c645f
Step 8/62 : RUN cd llvm && mkdir build && cd build && cmake -G"Ninja"     -DCMAKE_C_COMPILER=clang     -DCMAKE_CXX_COMPILER=clang++     -DCMAKE_INSTALL_PREFIX=$TOOLCHAIN_PREFIX     -DCMAKE_BUILD_TYPE=Release     -DLLVM_ENABLE_ASSERTIONS=ON     -DLLVM_TARGETS_TO_BUILD="ARM;X86"     -DCLANG_DEFAULT_CXX_STDLIB=libc++     -DCLANG_DEFAULT_LINKER=lld     -DCLANG_DEFAULT_RTLIB=compiler-rt     ../ && ninja && ninja install &&     cp bin/clang-tblgen $TOOLCHAIN_PREFIX/bin/clang-tblgen &&     cd .. && rm -rf build
 ---> Using cache
 ---> 17efa692078b
Step 9/62 : ENV ORIG_PATH=$PATH
 ---> Using cache
 ---> 6d2a3642aeeb
Step 10/62 : ENV PATH=$TOOLCHAIN_PREFIX/bin:$ORIG_PATH
 ---> Using cache
 ---> 9d47034ad22a
Step 11/62 : RUN git clone git://git.code.sf.net/p/mingw-w64/mingw-w64
 ---> Using cache
 ---> e2fd72489506
Step 12/62 : ENV TOOLCHAIN_ARCHS="i686 x86_64 armv7"
 ---> Using cache
 ---> ea5754d37f58
Step 13/62 : RUN cd mingw-w64/mingw-w64-headers &&     for arch in $TOOLCHAIN_ARCHS; do         mkdir build-$arch && cd build-$arch &&         ../configure --host=$arch-w64-mingw32             --enable-secure-api --enable-idl --prefix=             --with-default-win32-winnt=0x600 &&         DESTDIR=$TOOLCHAIN_PREFIX/$arch-w64-mingw32 make install && cd .. || exit 1;     done
 ---> Using cache
 ---> 309801b12cf1
Step 14/62 : COPY wrappers/clang-target-wrapper /build/prefix/bin
 ---> Using cache
 ---> 0109f3309d35
Step 15/62 : RUN cd $TOOLCHAIN_PREFIX/bin &&     for arch in $TOOLCHAIN_ARCHS; do         for exec in clang clang++; do             ln -s clang-target-wrapper $arch-w64-mingw32-$exec;         done;     done
 ---> Using cache
 ---> 791434072e77
Step 16/62 : RUN apk --no-cache update && apk --no-cache upgrade && apk add --no-cache bash
 ---> Using cache
 ---> b53b2f4fd1b1
Step 17/62 : RUN cd mingw-w64/mingw-w64-crt &&     for arch in $TOOLCHAIN_ARCHS; do         mkdir build-$arch && cd build-$arch &&         case $arch in         armv7)             FLAGS="--disable-lib32 --disable-lib64 --enable-libarm32"             ;;         i686)             FLAGS="--enable-lib32 --disable-lib64"             ;;         x86_64)             FLAGS="--disable-lib32 --enable-lib64"             ;;         esac &&         CC=$arch-w64-mingw32-clang CXX=$arch-w64-mingw32-clang++         AS=llvm-as AR=llvm-ar RANLIB=llvm-ranlib DLLTOOL=llvm-dlltool         ../configure --prefix= --host=$arch-w64-mingw32 $FLAGS &&         make && DESTDIR=$TOOLCHAIN_PREFIX/$arch-w64-mingw32 make install &&         cd .. || exit 1;     done
 ---> Using cache
 ---> 591057b3467a
Step 18/62 : RUN git clone -b release_60 https://github.com/llvm-mirror/compiler-rt.git
 ---> Using cache
 ---> ad357cff5157
Step 19/62 : RUN cd $TOOLCHAIN_PREFIX && ln -s i686-w64-mingw32 i386-w64-mingw32
 ---> Using cache
 ---> 9285e2f7abee
Step 20/62 : RUN cd compiler-rt &&     for arch in $TOOLCHAIN_ARCHS; do         buildarchname=$arch &&         libarchname=$arch &&         case $arch in         armv7)             libarchname=arm             ;;         i686)             buildarchname=i386             libarchname=i386             ;;         esac &&         mkdir build-$arch && cd build-$arch && cmake -G"Ninja"             -DCMAKE_C_COMPILER=$arch-w64-mingw32-clang             -DCMAKE_SYSTEM_NAME=Windows             -DCMAKE_AR=$TOOLCHAIN_PREFIX/bin/llvm-ar             -DCMAKE_RANLIB=$TOOLCHAIN_PREFIX/bin/llvm-ranlib             -DCMAKE_C_COMPILER_WORKS=1             -DCMAKE_C_COMPILER_TARGET=$buildarchname-windows-gnu             -DCOMPILER_RT_DEFAULT_TARGET_ONLY=TRUE             ../lib/builtins &&         ninja &&         mkdir -p $TOOLCHAIN_PREFIX/lib/clang/6.0.0/lib/windows &&         cp lib/windows/libclang_rt.builtins-$buildarchname.a $TOOLCHAIN_PREFIX/lib/clang/6.0.0/lib/windows/libclang_rt.builtins-$libarchname.a &&         cd .. && rm -rf build-$arch || exit 1;     done
 ---> Using cache
 ---> 63ee6f8cf371
Step 21/62 : COPY tests/test.c tests/test-tors.c /build/test/
 ---> Using cache
 ---> 2de55705a942
Step 22/62 : RUN cd test &&     for arch in $TOOLCHAIN_ARCHS; do         $arch-w64-mingw32-clang test.c -o test-c-$arch.exe || exit 1;     done
 ---> Using cache
 ---> c057290e9e99
Step 23/62 : RUN cd test &&     for arch in $TOOLCHAIN_ARCHS; do         $arch-w64-mingw32-clang test-tors.c -o test-tors-$arch.exe || exit 1;     done
 ---> Using cache
 ---> 05bafa22c638
Step 24/62 : RUN git clone -b release_60 https://github.com/llvm-mirror/libcxx.git &&     git clone -b release_60 https://github.com/llvm-mirror/libcxxabi.git &&     git clone -b release_60 https://github.com/llvm-mirror/libunwind.git
 ---> Using cache
 ---> 867ba523cbfb
Step 25/62 : RUN cd libunwind &&     for arch in $TOOLCHAIN_ARCHS; do         mkdir build-$arch && cd build-$arch && cmake -G"Ninja"             -DCMAKE_BUILD_TYPE=Release             -DCMAKE_INSTALL_PREFIX=$TOOLCHAIN_PREFIX/$arch-w64-mingw32             -DCMAKE_C_COMPILER=$arch-w64-mingw32-clang             -DCMAKE_CXX_COMPILER=$arch-w64-mingw32-clang++             -DCMAKE_CROSSCOMPILING=TRUE             -DCMAKE_SYSTEM_NAME=Windows             -DCMAKE_C_COMPILER_WORKS=TRUE             -DCMAKE_CXX_COMPILER_WORKS=TRUE             -DCMAKE_AR=$TOOLCHAIN_PREFIX/bin/llvm-ar             -DCMAKE_RANLIB=$TOOLCHAIN_PREFIX/bin/llvm-ranlib             -DLLVM_NO_OLD_LIBSTDCXX=TRUE             -DCXX_SUPPORTS_CXX11=TRUE             -DLIBUNWIND_USE_COMPILER_RT=TRUE             -DLIBUNWIND_ENABLE_THREADS=TRUE             -DLIBUNWIND_ENABLE_SHARED=FALSE             -DLIBUNWIND_ENABLE_CROSS_UNWINDING=FALSE             -DCMAKE_CXX_FLAGS="-I/build/libcxx/include"             .. &&         ninja && ninja install &&         cd .. && rm -rf build-$arch || exit 1;     done
 ---> Using cache
 ---> 2e26eccd6c42
Step 26/62 : RUN cd libcxxabi &&     for arch in $TOOLCHAIN_ARCHS; do         mkdir build-$arch && cd build-$arch && cmake -G"Ninja"             -DCMAKE_BUILD_TYPE=Release             -DCMAKE_INSTALL_PREFIX=$TOOLCHAIN_PREFIX/$arch-w64-mingw32             -DCMAKE_C_COMPILER=$arch-w64-mingw32-clang             -DCMAKE_CXX_COMPILER=$arch-w64-mingw32-clang++             -DCMAKE_CROSSCOMPILING=TRUE             -DCMAKE_SYSTEM_NAME=Windows             -DCMAKE_C_COMPILER_WORKS=TRUE             -DCMAKE_CXX_COMPILER_WORKS=TRUE             -DCMAKE_AR=$TOOLCHAIN_PREFIX/bin/llvm-ar             -DCMAKE_RANLIB=$TOOLCHAIN_PREFIX/bin/llvm-ranlib             -DLIBCXXABI_USE_COMPILER_RT=ON             -DLIBCXXABI_ENABLE_EXCEPTIONS=ON             -DLIBCXXABI_ENABLE_THREADS=ON             -DLIBCXXABI_INCLUDE_TESTS=OFF             -DLIBCXXABI_TARGET_TRIPLE=$arch-w64-mingw32             -DLIBCXXABI_ENABLE_SHARED=OFF             -DLIBCXXABI_LIBCXX_INCLUDES=../../libcxx/include             -DLLVM_NO_OLD_LIBSTDCXX=TRUE             -DCXX_SUPPORTS_CXX11=TRUE             -DCMAKE_CXX_FLAGS="-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS"             .. &&         ninja &&         cd .. || exit 1;     done
 ---> Using cache
 ---> 0717f6a86ab6
Step 27/62 : COPY patches/libcxx/0001-libcxx-Move-Windows-threading-support-into-a-.cpp-fi.patch /build/
 ---> Using cache
 ---> 6c632997cda1
Step 28/62 : RUN cd libcxx && git am ../0001-libcxx-Move-Windows-threading-support-into-a-.cpp-fi.patch
 ---> Using cache
 ---> af1a1589da63
Step 29/62 : RUN cd libcxx &&     for arch in $TOOLCHAIN_ARCHS; do         mkdir build-$arch && cd build-$arch && cmake -G"Ninja"             -DCMAKE_BUILD_TYPE=Release             -DCMAKE_INSTALL_PREFIX=$TOOLCHAIN_PREFIX/$arch-w64-mingw32             -DCMAKE_C_COMPILER=$arch-w64-mingw32-clang             -DCMAKE_CXX_COMPILER=$arch-w64-mingw32-clang++             -DCMAKE_CROSSCOMPILING=TRUE             -DCMAKE_SYSTEM_NAME=Windows             -DCMAKE_C_COMPILER_WORKS=TRUE             -DCMAKE_CXX_COMPILER_WORKS=TRUE             -DCMAKE_AR=$TOOLCHAIN_PREFIX/bin/llvm-ar             -DCMAKE_RANLIB=$TOOLCHAIN_PREFIX/bin/llvm-ranlib             -DLIBCXX_USE_COMPILER_RT=ON             -DLIBCXX_INSTALL_HEADERS=ON             -DLIBCXX_ENABLE_EXCEPTIONS=ON             -DLIBCXX_ENABLE_THREADS=ON             -DLIBCXX_ENABLE_MONOTONIC_CLOCK=ON             -DLIBCXX_ENABLE_SHARED=OFF             -DLIBCXX_SUPPORTS_STD_EQ_CXX11_FLAG=TRUE             -DLIBCXX_HAVE_CXX_ATOMICS_WITHOUT_LIB=TRUE             -DLIBCXX_ENABLE_EXPERIMENTAL_LIBRARY=OFF             -DLIBCXX_ENABLE_FILESYSTEM=OFF             -DLIBCXX_ENABLE_STATIC_ABI_LIBRARY=TRUE             -DLIBCXX_CXX_ABI=libcxxabi             -DLIBCXX_CXX_ABI_INCLUDE_PATHS=../../libcxxabi/include             -DLIBCXX_CXX_ABI_LIBRARY_PATH=../../libcxxabi/build-$arch/lib             -DCMAKE_CXX_FLAGS="-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS"             .. &&         ninja && ninja install &&         ../utils/merge_archives.py             --ar llvm-ar             -o $TOOLCHAIN_PREFIX/$arch-w64-mingw32/lib/libc++.a             $TOOLCHAIN_PREFIX/$arch-w64-mingw32/lib/libc++.a             $TOOLCHAIN_PREFIX/$arch-w64-mingw32/lib/libunwind.a &&         cd .. && rm -rf build-$arch || exit 1;     done
 ---> Using cache
 ---> a2e0c26dddac
Step 30/62 : RUN cd $TOOLCHAIN_PREFIX/include && ln -s ../$(echo $TOOLCHAIN_ARCHS | awk '{print $1}')-w64-mingw32/include/c++ .
 ---> Using cache
 ---> 36ada5dcf976
Step 31/62 : COPY tests/test.cpp tests/test-exception.cpp /build/test/
 ---> Using cache
 ---> 0e772cc1cc1e
Step 32/62 : RUN cd test &&     for arch in $TOOLCHAIN_ARCHS; do         $arch-w64-mingw32-clang++ test.cpp -o test-cpp-$arch.exe -fno-exceptions -lpsapi || exit 1;     done
 ---> Using cache
 ---> 41718eebfbff
Step 33/62 : RUN cd test &&     for arch in $TOOLCHAIN_ARCHS; do         $arch-w64-mingw32-clang++ test-exception.cpp -o test-exception-$arch.exe -lpsapi || exit 1;     done
 ---> Using cache
 ---> d08f215caa8a
Step 34/62 : ENV CROSS_TOOLCHAIN_PREFIX=/build/cross
 ---> Using cache
 ---> 832a5b489870
Step 35/62 : ENV AR=llvm-ar
 ---> Using cache
 ---> 78326f8578aa
Step 36/62 : ENV RANLIB=llvm-ranlib
 ---> Using cache
 ---> 58f9c3927066
Step 37/62 : ENV AS=llvm-as
 ---> Using cache
 ---> 03b20c9b6bd3
Step 38/62 : ENV NM=llvm-nm
 ---> Using cache
 ---> 84b3676b2076
Step 39/62 : RUN apk --no-cache update && apk --no-cache upgrade && apk add --no-cache wine
 ---> Using cache
 ---> 70e1703818ae
Step 40/62 : COPY patches/llvm/0001-cmake-Don-t-build-Native-llvm-config-when-cross-comp.patch /build/
 ---> Using cache
 ---> e33d237e463f
Step 41/62 : RUN cd llvm && git am ../0001-cmake-Don-t-build-Native-llvm-config-when-cross-comp.patch
 ---> Using cache
 ---> 9f603a76866b
Step 42/62 : COPY patches/llvm/0002-CMAKE-apply-O3-for-mingw-clang.patch /build/
 ---> Using cache
 ---> 1e82d29687ad
Step 43/62 : RUN cd llvm && git am ../0002-CMAKE-apply-O3-for-mingw-clang.patch
 ---> Using cache
 ---> f3b13a85058c
Step 44/62 : COPY patches/llvm/0003-CMAKE-disable-mbig-obj-for-mingw-clang-asm.patch /build/
 ---> Using cache
 ---> 51fe9f0f8c4b
Step 45/62 : RUN cd llvm && git am ../0003-CMAKE-disable-mbig-obj-for-mingw-clang-asm.patch
 ---> Using cache
 ---> f55f2324e6c1
Step 46/62 : ENV HOST_TOOLCHAIN_ARCHS="x86_64"
 ---> Using cache
 ---> 5cdbc626543c
Step 47/62 : RUN cd llvm &&     for arch in $HOST_TOOLCHAIN_ARCHS; do         mkdir build-cross-$arch && cd build-cross-$arch && cmake -G"Ninja"         -DCMAKE_C_COMPILER=$TOOLCHAIN_PREFIX/bin/$arch-w64-mingw32-clang         -DCMAKE_CXX_COMPILER=$TOOLCHAIN_PREFIX/bin/$arch-w64-mingw32-clang++         -DCMAKE_INSTALL_PREFIX=$CROSS_TOOLCHAIN_PREFIX-$arch         -DCMAKE_BUILD_TYPE=Release         -DCMAKE_CROSSCOMPILING=TRUE         -DCMAKE_SYSTEM_NAME=Windows         -DCMAKE_AR=$TOOLCHAIN_PREFIX/bin/llvm-ar         -DCMAKE_RANLIB=$TOOLCHAIN_PREFIX/bin/llvm-ranlib         -DLLVM_ENABLE_ASSERTIONS=ON         -DLLVM_TARGETS_TO_BUILD="ARM;X86"         -DCLANG_DEFAULT_CXX_STDLIB=libc++         -DCLANG_DEFAULT_LINKER=lld         -DCLANG_DEFAULT_RTLIB=compiler-rt         -DBUILD_SHARED_LIBS=OFF         -DCMAKE_CXX_FLAGS="-D_GNU_SOURCE -Wl,-lpsapi"         -DLLVM_CONFIG_PATH=$TOOLCHAIN_PREFIX/bin/llvm-config         -DLLVM_TABLEGEN=$TOOLCHAIN_PREFIX/bin/llvm-tblgen         -DCLANG_TABLEGEN=$TOOLCHAIN_PREFIX/bin/clang-tblgen         -DCMAKE_SYSTEM_PROGRAM_PATH=$TOOLCHAIN_PREFIX/bin         -DCMAKE_FIND_ROOT_PATH=$TOOLCHAIN_PREFIX         -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=NEVER         -DCMAKE_FIND_ROOT_PATH_MODE_LIBRARY=ONLY         -DCMAKE_FIND_ROOT_PATH_MODE_INCLUDE=ONLY         ../ && ninja && ninja install &&         cd .. && rm -rf build-cross-$arch || exit 1;     done
 ---> Using cache
 ---> f19eabe4dcf9
Step 48/62 : RUN cd mingw-w64/mingw-w64-headers &&     for host in $HOST_TOOLCHAIN_ARCHS; do         for arch in $TOOLCHAIN_ARCHS; do             cd build-$arch &&             DESTDIR=$CROSS_TOOLCHAIN_PREFIX-$host/$arch-w64-mingw32             make install && cd .. || exit 1;         done;     done
 ---> Using cache
 ---> a99d910deb0b
Step 49/62 : COPY wrappers/clang-target-wrapper $CROSS_TOOLCHAIN_PREFIX-i686/bin
 ---> Using cache
 ---> 3c6db7e745f6
Step 50/62 : RUN for host in $HOST_TOOLCHAIN_ARCHS; do         cd $CROSS_TOOLCHAIN_PREFIX-$host/bin &&         for arch in $TOOLCHAIN_ARCHS; do             for exec in clang clang++; do                 ln -s clang-target-wrapper $arch-w64-mingw32-$exec;             done;         done;     done
 ---> Using cache
 ---> d4a3e838ffe4
Step 51/62 : RUN cd mingw-w64/mingw-w64-crt &&     for host in $HOST_TOOLCHAIN_ARCHS; do         for arch in $TOOLCHAIN_ARCHS; do             cd build-$arch &&             DESTDIR=$CROSS_TOOLCHAIN_PREFIX-$host/$arch-w64-mingw32             make install && cd .. || exit 1;         done;     done
 ---> Using cache
 ---> 5a9c6b947d07
Step 52/62 : RUN cd compiler-rt &&     for host in $HOST_TOOLCHAIN_ARCHS; do         for arch in $TOOLCHAIN_ARCHS; do             buildarchname=$arch &&             libarchname=$arch &&             case $arch in             armv7)                 libarchname=arm                 ;;             i686)                 buildarchname=i386                 libarchname=i386                 ;;             esac &&             mkdir -p $CROSS_TOOLCHAIN_PREFIX-$host/lib/clang/6.0.0/lib/windows &&             cp $TOOLCHAIN_PREFIX/lib/clang/6.0.0/lib/windows/libclang_rt.builtins-$libarchname.a $CROSS_TOOLCHAIN_PREFIX-$host/lib/clang/6.0.0/lib/windows/libclang_rt.builtins-$libarchname.a &&             cd .. && rm -rf build-$arch || exit 1;         done;     done
 ---> Using cache
 ---> 22a5f14f854f
Step 53/62 : RUN apk add --no-cache p7zip
 ---> Using cache
 ---> 83c5c3a0e25b
Step 54/62 : RUN 7z a mingw-w64-clang-x86_64 ./cross-x86_64/*
 ---> Using cache
 ---> d14980852078
Step 55/62 : RUN mkdir -p /build/output && mv /build/mingw-w64-clang-x86_64.7z /build/output/mingw-w64-clang-x86_64.7z
 ---> Using cache
 ---> 4c1f15bc3450
Step 56/62 : RUN 7z a mingw-w64-clang-x86_64-tests /build/test/
 ---> Using cache
 ---> eeffd2cd291a
Step 57/62 : RUN mkdir -p /build/output && mv /build/mingw-w64-clang-x86_64-tests.7z /build/output/mingw-w64-clang-x86_64-tests.7z
 ---> Using cache
 ---> 8de806845b57
Step 58/62 : RUN apk add --no-cache wine freetype
 ---> Using cache
 ---> f7638cbf2909
Step 59/62 : RUN WINEARCH=win64 winecfg
 ---> Using cache
 ---> f4eb945a6754
Step 60/62 : COPY tests/test.c tests/test-tors.c /build/test/
 ---> Using cache
 ---> d36d817cec66
Step 61/62 : RUN cd test &&     for arch in $TOOLCHAIN_ARCHS; do         WINEDEBUG=+relay wine64 $CROSS_TOOLCHAIN_PREFIX-x86_64/bin/clang -target x86_64-windows-gnu test.c -o test-c-$arch.exe || exit 1;     done
 ---> Running in 15b74c7cda77
0009:Call KERNEL32.__wine_kernel_init() ret=7bc58f7d
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93918,7b4a85f0 L"kernel32") ret=7b4662b0
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b4662b0
0009:Call ntdll.LdrGetDllHandle(00000000,00000000,7ffc96f93918,7ffc96f93908) ret=7b4662c3
0009:Ret  ntdll.LdrGetDllHandle() retval=00000000 ret=7b4662c3
0009:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001a,7ffc96f93a10,00000008,00000000) ret=7b47487e
0009:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b47487e
0009:Call ntdll.LdrFindResourceDirectory_U(7b420000,00000000,00000000,7ffc96f93368) ret=7b47e2a5
0009:Ret  ntdll.LdrFindResourceDirectory_U() retval=00000000 ret=7b47e2a5
0009:Call ntdll.LdrFindResourceDirectory_U(7b420000,7ffc96f93398,00000002,7ffc96f93370) ret=7b47e327
0009:Ret  ntdll.LdrFindResourceDirectory_U() retval=00000000 ret=7b47e327
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6677c0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6677d0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6677e0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6677f0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667800,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667810,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667820,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667830,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667840,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667850,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667860,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667870,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667880,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667890,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6678a0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6678b0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6678c0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6678d0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6678e0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6678f0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667900,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667910,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667920,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667930,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667940,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667950,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667960,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667970,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667980,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667990,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6679a0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6679b0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6679c0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6679d0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6679e0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6679f0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a00,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a10,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a20,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a30,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a40,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a50,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a60,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a70,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a80,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667a90,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667aa0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ab0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ac0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ad0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ae0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667af0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b00,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b10,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b20,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b30,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b40,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b50,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b60,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b70,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b80,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667b90,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ba0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667bb0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667bc0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667bd0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667be0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667bf0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c00,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c10,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c20,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c30,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c40,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c50,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c60,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c70,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c80,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667c90,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ca0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667cb0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667cc0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667cd0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ce0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667cf0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d00,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d10,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d20,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d30,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d40,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d50,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d60,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d70,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d80,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667d90,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667da0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667db0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667dc0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667dd0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667de0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667df0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e00,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e10,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e20,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e30,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e40,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e50,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e60,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e70,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e80,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667e90,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ea0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667eb0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ec0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ed0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ee0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ef0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f00,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f10,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f20,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f30,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f40,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f50,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f60,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f70,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f80,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667f90,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667fa0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667fb0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667fc0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667fd0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667fe0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b667ff0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668000,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668010,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668020,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668030,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668040,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668050,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668060,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668070,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668080,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b668090,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6680a0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6680b0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6680c0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f92d58,00000003,7ffc96f92d30) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6680d0,7ffc96f92eb0,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.NtSetDefaultUILanguage(00000409) ret=7b4610ef
0009:Ret  ntdll.NtSetDefaultUILanguage() retval=00000000 ret=7b4610ef
0009:Call ntdll.NtSetDefaultLocale(00000001,00000409) ret=7b4610ff
0009:Ret  ntdll.NtSetDefaultLocale() retval=00000000 ret=7b4610ff
0009:Call ntdll.NtSetDefaultLocale(00000000,00000409) ret=7b46110c
0009:Ret  ntdll.NtSetDefaultLocale() retval=00000000 ret=7b46110c
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f936e8,00000003,7ffc96f936c0) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b6693b0,7ffc96f93840,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000a) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f93708,00000003,7ffc96f936e0) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b669cd0,7ffc96f93860,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000c) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.LdrFindResource_U(7b420000,7ffc96f93708,00000003,7ffc96f936e0) ret=7b47b93e
0009:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
0009:Call ntdll.LdrAccessResource(7b420000,7b664ab0,7ffc96f93860,00000000) ret=7b47e5b0
0009:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.__wine_init_codepages(7b652b00,7b653200,00000000) ret=7b46123d
0009:Ret  ntdll.__wine_init_codepages() retval=7bcea5e4 ret=7b46123d
0009:Call ntdll.NtAllocateVirtualMemory(ffffffffffffffff,7ffc96f93bb8,00000000,7ffc96f93b98,00003000,00000004) ret=7b474a95
0009:Ret  ntdll.NtAllocateVirtualMemory() retval=00000000 ret=7b474a95
0009:Call ntdll.RtlCreateUnicodeStringFromAsciiz(7ffc96f93918,7b4a6560 "\\Registry\\Machine\\HARDWARE") ret=7b467e49
0009:Ret  ntdll.RtlCreateUnicodeStringFromAsciiz() retval=00000001 ret=7b467e49
0009:Call ntdll.NtCreateKey(7ffc96f939b8,000f003f,7ffc96f93928,00000000,00000000,00000001,7ffc96f939b4) ret=7b467e74
0009:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b467e74
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f93918) ret=7b467eb7
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b467eb7
0009:Call ntdll.NtClose(00000014) ret=7b468517
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b468517
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93a78,7b4a83e0 L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Environment") ret=7b46e841
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000009e ret=7b46e841
0009:Call ntdll.NtOpenKey(7ffc96f93a70,00020019,7ffc96f93a88) ret=7b46e868
0009:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b46e868
0009:Call ntdll.RtlOpenCurrentUser(00020019,7ffc96f93a90) ret=7b46e8b6
0009:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b46e8b6
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93a78,7b4a83b0 L"Environment") ret=7b46e8d5
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b46e8d5
0009:Call ntdll.NtOpenKey(7ffc96f93a70,00020019,7ffc96f93a88) ret=7b46e8f5
0009:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b46e8f5
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93a78,7b4a8380 L"Volatile Environment") ret=7b46e93e
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7b46e93e
0009:Call ntdll.NtOpenKey(7ffc96f93a70,00020019,7ffc96f93a88) ret=7b46e94e
0009:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b46e94e
0009:Call ntdll.NtClose(00000014) ret=7b46e992
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b46e992
0009:Call ntdll.RtlInitUnicodeString(7ffc96f938d8,7b499f40 L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName") ret=7b43b7dc
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000080 ret=7b43b7dc
0009:Call ntdll.NtOpenKey(7ffc96f938c8,00020019,7ffc96f938e8) ret=7b43b7ee
0009:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b43b7ee
0009:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b43b871
0009:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b43b871
0009:Call ntdll.NtClose(ffffffffffffffff) ret=7b43b917
0009:Ret  ntdll.NtClose() retval=c0000008 ret=7b43b917
0009:Call ntdll.NtClose(00000000) ret=7b43b921
0009:Ret  ntdll.NtClose() retval=c0000008 ret=7b43b921
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93a68,7b4a82a0 L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") ret=7b46ebf2
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000096 ret=7b46ebf2
0009:Call ntdll.NtOpenKey(7ffc96f93a60,00020019,7ffc96f93a78) ret=7b46ec0e
0009:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b46ec0e
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlInitUnicodeString(7ffc96f939e8,7b4a85a8 L"windir") ret=7b448658
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b448658
0009:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffc96f939e8,7ffc96f939f8) ret=7b448686
0009:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
0009:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
0009:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
0009:Call ntdll.RtlInitUnicodeString(7ffc96f939e8,7b4a8570 L"winsysdir") ret=7b448658
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b448658
0009:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffc96f939e8,7ffc96f939f8) ret=7b448686
0009:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
0009:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
0009:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
0009:Call ntdll.RtlDosPathNameToNtPathName_U(7b4a8590 L"C:\\windows",7ffc96f939c8,00000000,00000000) ret=7b46b82b
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
0009:Call ntdll.NtCreateFile(7ffc96f939c0,80100000,7ffc96f939e8,7ffc96f939d8,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
0009:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
0009:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
0009:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f939c8) ret=7b46b910
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
0009:Call ntdll.RtlDosPathNameToNtPathName_U(00019930 L"C:\\windows\\system32",7ffc96f939c8,00000000,00000000) ret=7b46b82b
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
0009:Call ntdll.NtCreateFile(7ffc96f939c0,80100000,7ffc96f939e8,7ffc96f939d8,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
0009:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
0009:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
0009:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f939c8) ret=7b46b910
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019970 ret=7b453b54
0009:Call ntdll.RtlDosPathNameToNtPathName_U(00019970 L"C:\\windows\\syswow64",7ffc96f939c8,00000000,00000000) ret=7b46b82b
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
0009:Call ntdll.NtCreateFile(7ffc96f939c0,80100000,7ffc96f939e8,7ffc96f939d8,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
0009:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
0009:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
0009:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f939c8) ret=7b46b910
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
0009:Call ntdll.__wine_init_windows_dir(7b4a8590 L"C:\\windows",00019930 L"C:\\windows\\system32") ret=7b474ea4
0009:Ret  ntdll.__wine_init_windows_dir() retval=0000001a ret=7b474ea4
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000100) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019aa0 ret=7b453b54
0009:Call ntdll.RtlInitAnsiString(7ffc96f93b80,7ffc96f95fa1 "/build/test") ret=7b474faa
0009:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b474faa
0009:Call ntdll.wine_unix_to_nt_file_name(7ffc96f93b80,7ffc96f93b98) ret=7b474fb5
0009:Ret  ntdll.wine_unix_to_nt_file_name() retval=00000000 ret=7b474fb5
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93bb8,00019bb8 L"Z:\\build\\test") ret=7b474fd5
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b474fd5
0009:Call ntdll.RtlSetCurrentDirectory_U(7ffc96f93bb8) ret=7b474fdd
0009:Ret  ntdll.RtlSetCurrentDirectory_U() retval=00000000 ret=7b474fdd
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f93b98) ret=7b474fe5
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b474fe5
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019aa0) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,000000de) ret=7b47520e
0009:Ret  ntdll.RtlAllocateHeap() retval=00019aa0 ret=7b47520e
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,0000008b) ret=7b4752c0
0009:Ret  ntdll.RtlAllocateHeap() retval=00019b90 ret=7b4752c0
0009:Call ntdll.RtlDetermineDosPathNameType_U(00019ad8 L"/build/cross-x86_64/bin/clang") ret=7b469eb5
0009:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000004 ret=7b469eb5
0009:Call ntdll.RtlDoesFileExists_U(00019ad8 L"/build/cross-x86_64/bin/clang") ret=7b46a41e
0009:Ret  ntdll.RtlDoesFileExists_U() retval=00000000 ret=7b46a41e
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000044) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019c30 ret=7b453b54
0009:Call ntdll.RtlDoesFileExists_U(00019c30 L"/build/cross-x86_64/bin/clang.exe") ret=7b46a46d
0009:Ret  ntdll.RtlDoesFileExists_U() retval=00000001 ret=7b46a46d
0009:Call ntdll.RtlGetFullPathName_U(00019c30 L"/build/cross-x86_64/bin/clang.exe",00000208,7ffc96f93e38,00000000) ret=7b4695e7
0009:Ret  ntdll.RtlGetFullPathName_U() retval=00000046 ret=7b4695e7
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019c30) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000048) ret=7b475424
0009:Ret  ntdll.RtlAllocateHeap() retval=00019c30 ret=7b475424
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000024) ret=7b4754a5
0009:Ret  ntdll.RtlAllocateHeap() retval=00019c90 ret=7b4754a5
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,000000b2) ret=7b47559c
0009:Ret  ntdll.RtlAllocateHeap() retval=00019cd0 ret=7b47559c
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93998,7b4a84c0 L"__wineboot_event") ret=7b48076d
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7b48076d
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93878,7ffc96f938b8 L"\\Sessions\\1\\BaseNamedObjects") ret=7b47fc02
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000003a ret=7b47fc02
0009:Call ntdll.NtOpenDirectoryObject(7ffc96f93870,00000006,7ffc96f93888) ret=7b47fc4c
0009:Ret  ntdll.NtOpenDirectoryObject() retval=00000000 ret=7b47fc4c
0009:Call ntdll.NtCreateEvent(7ffc96f93990,001f0003,7ffc96f939a8,00000000,00000000) ret=7b4807a4
0009:Ret  ntdll.NtCreateEvent() retval=00000000 ret=7b4807a4
0009:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b4807b9
0009:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b4807b9
0009:Call ntdll.RtlWow64EnableFsRedirectionEx(00000001,7ffc96f93b78) ret=7b46c922
0009:Ret  ntdll.RtlWow64EnableFsRedirectionEx() retval=c0000002 ret=7b46c922
0009:Call ntdll.RtlNtStatusToDosError(c0000002) ret=7b46c92f
0009:Ret  ntdll.RtlNtStatusToDosError() retval=00000001 ret=7b46c92f
0009:Call ntdll.RtlIsDosDeviceName_U(7ffc96f935b8 L"C:\\windows\\system32\\wineboot.exe") ret=7b44e081
0009:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
0009:Call ntdll.RtlDosPathNameToNtPathName_U(7ffc96f935b8 L"C:\\windows\\system32\\wineboot.exe",7ffc96f93168,00000000,00000000) ret=7b44e162
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
0009:Call ntdll.NtCreateFile(7ffc96f93160,80100000,7ffc96f93188,7ffc96f93178,00000000,00000000,7ffc00000005,7fd600000001,30303000000060,00000000,00000000) ret=7b44e2a4
0009:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f93168) ret=7b44e3c9
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
0009:Call ntdll.NtSetInformationFile(00000020,7ffc96f92f28,7ffc96f92f20,00000008,0000000e) ret=7b44d2b0
0009:Ret  ntdll.NtSetInformationFile() retval=00000000 ret=7b44d2b0
0009:Call ntdll.NtReadFile(00000020,00000000,00000000,00000000,7ffc96f92ff8,7ffc96f93158,00000040,00000000,00000000) ret=7b44b9b6
0009:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
0009:Call ntdll.NtSetInformationFile(00000020,7ffc96f92f28,7ffc96f92f20,00000008,0000000e) ret=7b44d2b0
0009:Ret  ntdll.NtSetInformationFile() retval=00000000 ret=7b44d2b0
0009:Call ntdll.NtReadFile(00000020,00000000,00000000,00000000,7ffc96f92ff8,7ffc96f93198,000000f8,00000000,00000000) ret=7b44b9b6
0009:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
0009:Call ntdll.NtSetInformationFile(00000020,7ffc96f92f28,7ffc96f92f20,00000008,0000000e) ret=7b44d2b0
0009:Ret  ntdll.NtSetInformationFile() retval=00000000 ret=7b44d2b0
0009:Call ntdll.NtReadFile(00000020,00000000,00000000,00000000,7ffc96f92ff8,7ffc96f93293,00000015,00000000,00000000) ret=7b44b9b6
0009:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
0009:Call ntdll.RtlGetCurrentDirectory_U(00000208,7ffc96f937c0) ret=7b46be1f
0009:Ret  ntdll.RtlGetCurrentDirectory_U() retval=0000001a ret=7b46be1f
0009:Call ntdll.RtlDosPathNameToNtPathName_U(7ffc96f937c0 L"Z:\\build\\test",7ffc96f93408,00000000,00000000) ret=7b46cbca
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
0009:Call ntdll.wine_nt_to_unix_file_name(7ffc96f93408,7ffc96f93418,00000003,00000000) ret=7b46cbe6
0009:Ret  ntdll.wine_nt_to_unix_file_name() retval=00000000 ret=7b46cbe6
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f93408) ret=7b46cbf0
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
0009:Call ntdll.RtlAcquirePebLock() ret=7b470574
0009:Ret  ntdll.RtlAcquirePebLock() retval=00000000 ret=7b470574
0009:Call ntdll.RtlDosPathNameToNtPathName_U(7ffc96f928b8 L"C:\\windows",7ffc96f92478,7ffc96f92470,00000000) ret=7b44fa74
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,000002c2) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019f20 ret=7b453b54
0009:Call ntdll.NtOpenFile(00019f28,80100000,7ffc96f924a8,7ffc96f92488,00000003,00000021) ret=7b44fced
0009:Ret  ntdll.NtOpenFile() retval=00000000 ret=7b44fced
0009:Call ntdll.RtlInitializeCriticalSection(00019f30) ret=7b44fd23
0009:Ret  ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b44fd23
0009:Call ntdll.RtlInitUnicodeString(7ffc96f92498,00019dae L"windows") ret=7b44fdc4
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b44fdc4
0009:Call ntdll.NtQueryDirectoryFile(00000024,00000000,00000000,00000000,7ffc96f92488,00019f84,0000025e,00000003,00000000,7ffc96f92498,00000001) ret=7b44fe0d
0009:Ret  ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b44fe0d
0009:Call ntdll.RtlEnterCriticalSection(00019f30) ret=7b44f3f2
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f3f2
0009:Call ntdll.RtlLeaveCriticalSection(00019f30) ret=7b44f636
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f636
0009:Call ntdll.NtClose(00000024) ret=7b4701d0
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
0009:Call ntdll.RtlEnterCriticalSection(00019f30) ret=7b44f770
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f770
0009:Call ntdll.RtlFreeUnicodeString(00019f60) ret=7b44f7a2
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44f7a2
0009:Call ntdll.RtlLeaveCriticalSection(00019f30) ret=7b44f7bd
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f7bd
0009:Call ntdll.RtlDeleteCriticalSection(00019f30) ret=7b44f7d6
0009:Ret  ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b44f7d6
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019f20) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlInitUnicodeString(7ffc96f92508,7ffc96f928be L"windows") ret=7b46d271
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b46d271
0009:Call ntdll.RtlIsNameLegalDOS8Dot3(7ffc96f92508,00000000,7ffc96f924f7) ret=7b46d29b
0009:Ret  ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b46d29b
0009:Call ntdll.RtlDosPathNameToNtPathName_U(7ffc96f928b8 L"C:\\windows\\system32",7ffc96f92478,7ffc96f92470,00000000) ret=7b44fa74
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,000002c2) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=0001aac0 ret=7b453b54
0009:Call ntdll.NtOpenFile(0001aac8,80100000,7ffc96f924a8,7ffc96f92488,00000003,00000021) ret=7b44fced
0009:Ret  ntdll.NtOpenFile() retval=00000000 ret=7b44fced
0009:Call ntdll.RtlInitializeCriticalSection(0001aad0) ret=7b44fd23
0009:Ret  ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b44fd23
0009:Call ntdll.RtlInitUnicodeString(7ffc96f92498,00019f3e L"system32") ret=7b44fdc4
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b44fdc4
0009:Call ntdll.NtQueryDirectoryFile(00000024,00000000,00000000,00000000,7ffc96f92488,0001ab24,0000025e,00000003,00000000,7ffc96f92498,7ffc00000001) ret=7b44fe0d
0009:Ret  ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b44fe0d
0009:Call ntdll.RtlEnterCriticalSection(0001aad0) ret=7b44f3f2
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f3f2
0009:Call ntdll.RtlLeaveCriticalSection(0001aad0) ret=7b44f636
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f636
0009:Call ntdll.NtClose(00000024) ret=7b4701d0
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
0009:Call ntdll.RtlEnterCriticalSection(0001aad0) ret=7b44f770
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f770
0009:Call ntdll.RtlFreeUnicodeString(0001ab00) ret=7b44f7a2
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44f7a2
0009:Call ntdll.RtlLeaveCriticalSection(0001aad0) ret=7b44f7bd
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f7bd
0009:Call ntdll.RtlDeleteCriticalSection(0001aad0) ret=7b44f7d6
0009:Ret  ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b44f7d6
0009:Call ntdll.RtlFreeHeap(00010000,00000000,0001aac0) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlInitUnicodeString(7ffc96f92508,7ffc96f928ce L"system32") ret=7b46d271
0009:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b46d271
0009:Call ntdll.RtlIsNameLegalDOS8Dot3(7ffc96f92508,00000000,7ffc96f924f7) ret=7b46d29b
0009:Ret  ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b46d29b
0009:Call ntdll.RtlDosPathNameToNtPathName_U(7ffc96f928b8 L"C:\\windows\\system32\\wineboot.exe",7ffc96f92478,7ffc96f92470,00000000) ret=7b44fa74
0009:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,000002c2) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019f20 ret=7b453b54
0009:Call ntdll.NtOpenFile(00019f28,80100000,7ffc96f924a8,7ffc96f92488,00000003,00000021) ret=7b44fced
0009:Ret  ntdll.NtOpenFile() retval=00000000 ret=7b44fced
0009:Call ntdll.RtlInitializeCriticalSection(00019f30) ret=7b44fd23
0009:Ret  ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b44fd23
0009:Call ntdll.RtlInitUnicodeString(7ffc96f92498,0001aaf0 L"wineboot.exe") ret=7b44fdc4
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b44fdc4
0009:Call ntdll.NtQueryDirectoryFile(00000024,00000000,00000000,00000000,7ffc96f92488,00019f84,0000025e,00000003,00000000,7ffc96f92498,7ffc00000001) ret=7b44fe0d
0009:Ret  ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b44fe0d
0009:Call ntdll.RtlEnterCriticalSection(00019f30) ret=7b44f3f2
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f3f2
0009:Call ntdll.RtlLeaveCriticalSection(00019f30) ret=7b44f636
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f636
0009:Call ntdll.NtClose(00000024) ret=7b4701d0
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
0009:Call ntdll.RtlEnterCriticalSection(00019f30) ret=7b44f770
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f770
0009:Call ntdll.RtlFreeUnicodeString(00019f60) ret=7b44f7a2
0009:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44f7a2
0009:Call ntdll.RtlLeaveCriticalSection(00019f30) ret=7b44f7bd
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f7bd
0009:Call ntdll.RtlDeleteCriticalSection(00019f30) ret=7b44f7d6
0009:Ret  ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b44f7d6
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019f20) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlInitUnicodeString(7ffc96f92508,7ffc96f928e0 L"wineboot.exe") ret=7b46d271
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b46d271
0009:Call ntdll.RtlIsNameLegalDOS8Dot3(7ffc96f92508,00000000,7ffc96f924f7) ret=7b46d29b
0009:Ret  ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b46d29b
0009:Call ntdll.RtlGetFullPathName_U(7ffc96f93290 L"C:\\windows\\system32\\wineboot.exe",00000208,7ffc96f93290,00000000) ret=7b4695e7
0009:Ret  ntdll.RtlGetFullPathName_U() retval=00000040 ret=7b4695e7
0009:Call ntdll.RtlAllocateHeap(00010000,00000008,00000146) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019f20 ret=7b453b54
0009:Call ntdll.RtlFreeUnicodeString(7ffc96f93278) ret=7b470944
0009:Ret  ntdll.RtlFreeUnicodeString() retval=7bc7069f ret=7b470944
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000011) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=0001aa50 ret=7b453b54
0009:Call ntdll.wine_server_send_fd(0000000b) ret=7b470a57
0009:Ret  ntdll.wine_server_send_fd() retval=00000000 ret=7b470a57
0009:Call ntdll.RtlReleasePebLock() ret=7b470bf6
0009:Ret  ntdll.RtlReleasePebLock() retval=00000000 ret=7b470bf6
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019f20) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=0001aa80 ret=7b453b54
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,00000048) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=0001aac0 ret=7b453b54
0009:Call ntdll.RtlFreeHeap(00010000,00000000,0001aa80) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlFreeHeap(00010000,00000000,0001aac0) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.RtlFreeHeap(00010000,00000000,0001aa50) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.NtWaitForMultipleObjects(00000001,7ffc96f92e78,00000001,00000000,00000000) ret=7b47fb17
000b:Call KERNEL32.__wine_kernel_init() ret=7bc58f7d
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c17c8,7b4a85f0 L"kernel32") ret=7b4662b0
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b4662b0
000b:Call ntdll.LdrGetDllHandle(00000000,00000000,7ffdb48c17c8,7ffdb48c17b8) ret=7b4662c3
000b:Ret  ntdll.LdrGetDllHandle() retval=00000000 ret=7b4662c3
000b:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001a,7ffdb48c18c0,00000008,00000000) ret=7b47487e
000b:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b47487e
000b:Call ntdll.LdrFindResourceDirectory_U(7b420000,00000000,00000000,7ffdb48c1218) ret=7b47e2a5
000b:Ret  ntdll.LdrFindResourceDirectory_U() retval=00000000 ret=7b47e2a5
000b:Call ntdll.LdrFindResourceDirectory_U(7b420000,7ffdb48c1248,00000002,7ffdb48c1220) ret=7b47e327
000b:Ret  ntdll.LdrFindResourceDirectory_U() retval=00000000 ret=7b47e327
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6677c0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6677d0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6677e0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6677f0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667800,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667810,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667820,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667830,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667840,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667850,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667860,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667870,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667880,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667890,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6678a0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6678b0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6678c0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6678d0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6678e0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6678f0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667900,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667910,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667920,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667930,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667940,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667950,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667960,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667970,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667980,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667990,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6679a0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6679b0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6679c0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6679d0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6679e0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6679f0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a00,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a10,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a20,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a30,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a40,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a50,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a60,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a70,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a80,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667a90,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667aa0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ab0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ac0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ad0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ae0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667af0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b00,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b10,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b20,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b30,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b40,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b50,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b60,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b70,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b80,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667b90,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ba0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667bb0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667bc0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667bd0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667be0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667bf0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c00,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c10,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c20,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c30,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c40,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c50,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c60,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c70,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c80,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667c90,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ca0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667cb0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667cc0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667cd0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ce0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667cf0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d00,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d10,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d20,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d30,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d40,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d50,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d60,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d70,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d80,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667d90,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667da0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667db0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667dc0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667dd0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667de0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667df0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e00,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e10,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e20,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e30,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e40,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e50,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e60,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e70,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e80,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667e90,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ea0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667eb0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ec0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ed0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ee0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ef0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f00,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f10,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f20,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f30,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f40,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f50,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f60,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f70,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f80,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667f90,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667fa0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667fb0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667fc0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667fd0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667fe0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667ff0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668000,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668010,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668020,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668030,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668040,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668050,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668060,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668070,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668080,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b668090,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6680a0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6680b0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6680c0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c0c08,00000003,7ffdb48c0be0) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6680d0,7ffdb48c0d60,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.NtSetDefaultUILanguage(00000409) ret=7b4610ef
000b:Ret  ntdll.NtSetDefaultUILanguage() retval=00000000 ret=7b4610ef
000b:Call ntdll.NtSetDefaultLocale(00000001,00000409) ret=7b4610ff
000b:Ret  ntdll.NtSetDefaultLocale() retval=00000000 ret=7b4610ff
000b:Call ntdll.NtSetDefaultLocale(00000000,00000409) ret=7b46110c
000b:Ret  ntdll.NtSetDefaultLocale() retval=00000000 ret=7b46110c
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c1598,00000003,7ffdb48c1570) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,7ffdb48c16f0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c15b8,00000003,7ffdb48c1590) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b669cd0,7ffdb48c1710,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.LdrFindResource_U(7b420000,7ffdb48c15b8,00000003,7ffdb48c1590) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,7ffdb48c1710,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.__wine_init_codepages(7b652b00,7b653200,00000000) ret=7b46123d
000b:Ret  ntdll.__wine_init_codepages() retval=7bcea5e4 ret=7b46123d
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c1898,7b4a85a8 L"windir") ret=7b448658
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b448658
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c1898,7ffdb48c18a8) ret=7b448686
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000b:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c1898,7b4a8570 L"winsysdir") ret=7b448658
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b448658
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c1898,7ffdb48c18a8) ret=7b448686
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000b:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000b:Call ntdll.RtlDosPathNameToNtPathName_U(7b4a8590 L"C:\\windows",7ffdb48c1878,00000000,00000000) ret=7b46b82b
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
000b:Call ntdll.NtCreateFile(7ffdb48c1870,80100000,7ffdb48c1898,7ffdb48c1888,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
000b:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
000b:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
000b:Call ntdll.RtlFreeUnicodeString(7ffdb48c1878) ret=7b46b910
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
000b:Call ntdll.RtlDosPathNameToNtPathName_U(00019930 L"C:\\windows\\system32",7ffdb48c1878,00000000,00000000) ret=7b46b82b
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
000b:Call ntdll.NtCreateFile(7ffdb48c1870,80100000,7ffdb48c1898,7ffdb48c1888,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
000b:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
000b:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
000b:Call ntdll.RtlFreeUnicodeString(7ffdb48c1878) ret=7b46b910
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019970 ret=7b453b54
000b:Call ntdll.RtlDosPathNameToNtPathName_U(00019970 L"C:\\windows\\syswow64",7ffdb48c1878,00000000,00000000) ret=7b46b82b
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
000b:Call ntdll.NtCreateFile(7ffdb48c1870,80100000,7ffdb48c1898,7ffdb48c1888,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
000b:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
000b:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
000b:Call ntdll.RtlFreeUnicodeString(7ffdb48c1878) ret=7b46b910
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
000b:Call ntdll.__wine_init_windows_dir(7b4a8590 L"C:\\windows",00019930 L"C:\\windows\\system32") ret=7b474ea4
000b:Ret  ntdll.__wine_init_windows_dir() retval=0000001a ret=7b474ea4
000b:Call ntdll.RtlSetCurrentDirectory_U(00120038) ret=7b474ebd
000b:Ret  ntdll.RtlSetCurrentDirectory_U() retval=00000000 ret=7b474ebd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000068) ret=7b47520e
000b:Ret  ntdll.RtlAllocateHeap() retval=00019aa0 ret=7b47520e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7b4752c0
000b:Ret  ntdll.RtlAllocateHeap() retval=00019b20 ret=7b4752c0
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000006c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019b70 ret=7b453b54
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c1938,7b4a1308 L"PATH") ret=7b466ac8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c1938,7ffdb48c1948) ret=7b466b02
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000b:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019bf0 ret=7b453b54
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c1938,7ffdb48c1948) ret=7b466c3a
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000b:Call ntdll.RtlInitUnicodeString(00120050,00019bf0 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;") ret=7b475825
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000090 ret=7b475825
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c1898,7b4a81e0 L"PROCESSOR_ARCHITEW6432") ret=7b448658
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7b448658
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c1898,7ffdb48c18a8) ret=7b448686
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000b:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c1898,7b4a81a0 L"PROCESSOR_ARCHITECTURE") ret=7b448658
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7b448658
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c1898,7ffdb48c18a8) ret=7b448686
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000b:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000b:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c1a48,7b4a8120 L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion") ret=7b4759a8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000078 ret=7b4759a8
000b:Call ntdll.NtOpenKey(7ffdb48c1a30,00020119,7ffdb48c1a68) ret=7b4759d4
000b:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b4759d4
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c18b8,7ffdb48c1ce8 L"C:\\windows\\system32\\wineboot.exe") ret=7b466f2a
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000042 ret=7b466f2a
000b:Call ntdll.RtlInitUnicodeString(7ffdb48c17c8,7b4a1308 L"PATH") ret=7b466ac8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c17c8,7ffdb48c17d8) ret=7b466b02
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000b:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=00019c90 ret=7b453b54
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffdb48c17c8,7ffdb48c17d8) ret=7b466c3a
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000b:Call ntdll.LdrLoadDll(00019c90 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;",00000001,7ffdb48c18b8,7ffdb48c1838) ret=7b466ddc
000b:Ret  ntdll.LdrLoadDll() retval=00000000 ret=7b466ddc
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00019c90) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.LdrInitializeThunk(7b46f102,00000000,00000000,00000000) ret=7b475f4f
0009:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
0009:Call ntdll.NtClose(00000024) ret=7b4701d0
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
0009:Call ntdll.NtClose(00000020) ret=7b4701d0
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
0009:Call ntdll.RtlFreeHeap(00010000,00000000,00019de0) ret=7b453b67
0009:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
0009:Call ntdll.NtClose(0000002c) ret=7b4701d0
0009:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
0009:Call ntdll.RtlWow64EnableFsRedirection(00000001) ret=7b46c95f
0009:Ret  ntdll.RtlWow64EnableFsRedirection() retval=c0000002 ret=7b46c95f
0009:Call ntdll.RtlNtStatusToDosError(c0000002) ret=7b46c96c
0009:Ret  ntdll.RtlNtStatusToDosError() retval=00000001 ret=7b46c96c
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,0000006c) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=0001aa50 ret=7b453b54
0009:Call ntdll.RtlInitUnicodeString(7ffc96f93a88,7b4a1308 L"PATH") ret=7b466ac8
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
0009:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffc96f93a88,7ffc96f93a98) ret=7b466b02
0009:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
0009:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
0009:Call ntdll.RtlAllocateHeap(00010000,00000000,0000009c) ret=7b453b54
0009:Ret  ntdll.RtlAllocateHeap() retval=00019de0 ret=7b453b54
0009:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
0009:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7ffc96f93a88,7ffc96f93a98) ret=7b466c3a
0009:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
0009:Call ntdll.RtlInitUnicodeString(7bcfbdb0,00019de0 L"Z:\\build\\cross-x86_64\\bin;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;") ret=7b475825
0009:Ret  ntdll.RtlInitUnicodeString() retval=0000009c ret=7b475825
0009:Call ntdll.NtWaitForMultipleObjects(00000002,7ffc96f93788,00000001,00000000,7ffc96f93780) ret=7b47fb17
000b:Call PE DLL (proc=0x7bc9a7de,module=0x7bc20000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1)
000b:Ret  PE DLL (proc=0x7bc9a7de,module=0x7bc20000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000b:Call PE DLL (proc=0x7b494bcf,module=0x7b420000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1)
000b:Call ntdll.LdrDisableThreadCalloutsForDll(7b420000) ret=7b465737
000b:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000b:Call ntdll.NtQuerySystemInformation(00000000,7b7fbb00,00000040,00000000) ret=7b4556f9
000b:Ret  ntdll.NtQuerySystemInformation() retval=00000000 ret=7b4556f9
000b:Call ntdll.NtQueryDefaultLocale(00000001,0023f8f4) ret=7b45b28e
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b28e
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f970) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f978,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f968,000f003f,0023f988,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000008) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f978,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f970,000f003f,0023f988,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000014) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e508 L"Locale") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c1b0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c1f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c230 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c270 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c2b0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c2f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c330 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c370 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c3b0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c3f0 ret=7b453b54
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,00000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000026) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c430 ret=7b453b54
000b:Call ntdll.NtQueryInformationFile(00000014,0023ef40,0023ef50,00000018,00000005) ret=7b44cb69
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44cb69
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000253) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c470 ret=7b453b54
000b:Call ntdll.NtReadFile(00000014,00000000,00000000,00000000,0023f028,0001c470,00000253,00000000,00000000) ret=7b44b9b6
000b:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
000b:Call ntdll.RtlIsTextUnicode(0001c470,00000253,0023f1b4) ret=7b4785ca
000b:Ret  ntdll.RtlIsTextUnicode() retval=00000000 ret=7b4785ca
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000004a6) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c6e0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000018) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cba0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000020) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cbd0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cc00 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cc40 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cc70 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ccb0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cce0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cd20 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cd50 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cd90 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cdc0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ce00 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ce30 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ce70 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002e) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cea0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cee0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000024) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cf10 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cf50 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000034) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cf80 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001cfd0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000030) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d000 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d040 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000036) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d070 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d0c0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d0f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d130 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d160 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d1a0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000026) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d1d0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d210 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d240 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d280 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000032) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d2b0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d300 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d330 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d370 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000032) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d3a0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d3f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000032) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d420 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000002) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d470 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d4a0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d4e0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d510 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000006) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d550 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d580 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000006) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d5c0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d5f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d630 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d660 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d6a0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000026) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d6d0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d710 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d740 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000012) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d780 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d7b0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d7f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d820 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d860 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000024) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d8a0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d8e0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d910 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d950 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002e) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d980 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d9c0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000032) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001d9f0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001da40 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000036) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001da70 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dac0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000038) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001daf0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001db40 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002e) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001db70 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dbb0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dbe0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dc20 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dc50 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dc90 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dcc0 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dd00 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002c) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dd30 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000004) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dd70 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c6e0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c470) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0c30 L"sLanguage") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000008) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0cc0 L"sCountry") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,0000001c) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0c18 L"sList") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e4e0 L"LC_MONETARY") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ca0 L"sCurrency") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0e60 L"iCurrency") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0d80 L"iNegCurr") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0e80 L"iCurrDigits") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0db8 L"iLZero") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0be0 L"sMonDecimalSep") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0bc0 L"sMonGrouping") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000008) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ba0 L"sMonThousandSep") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e490 L"LC_NUMERIC") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0c70 L"sDecimal") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0af0 L"sThousand") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0e40 L"iDigits") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b669cd0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0a80 L"Numshape") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0b70 L"sNativeDigits") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000016) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b669cd0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0d60 L"iNegNumber") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667850,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0b50 L"sNegativeSign") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b667850,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0b30 L"sPositiveSign") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000002) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0c50 L"sGrouping") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000008) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e440 L"LC_TIME") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b665cf0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ce8 L"s1159") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000006) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b665cf0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0cd8 L"s2359") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000006) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ab8 L"sTime") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b665cf0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0cf8 L"iTime") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b665cf0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0d30 L"iTLZero") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0b10 L"sShortDate") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000012) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000018,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000018) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0e50 L"iDate") ret=7b45ba9b
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45ba9b
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f7f4,00000004) ret=7b45babc
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45babc
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45baca
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45baca
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45baf6
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45baf6
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b665cf0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0c00 L"sLongDate") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000028) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000018,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000018) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0dc8 L"iLDate") ret=7b45ba9b
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b45ba9b
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f7f4,00000004) ret=7b45babc
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45babc
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45baca
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45baca
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45baf6
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45baf6
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6653d0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0c88 L"sDate") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0d10 L"iTimePrefix") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ec0 L"iCalendarType") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0e20 L"iFirstDayOfWeek") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0de0 L"iFirstWeekOfYear") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ad0 L"sTimeFormat") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000016) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0aa0 L"sYearMonth") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000016) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b665cf0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e3e0 L"LC_MEASUREMENT") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.NtQueryDefaultLocale(00000001,0023f664) ret=7b45b28e
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b28e
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0da0 L"iMeasure") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e3c0 L"LC_TELEPHONE") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.NtQueryDefaultLocale(00000001,0023f664) ret=7b45b28e
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b28e
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0ea0 L"iCountry") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e3a0 L"LC_PAPER") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.NtQueryDefaultLocale(00000001,0023f664) ret=7b45b28e
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b28e
000b:Call ntdll.LdrFindResource_U(7b420000,0023f558,00000003,0023f530) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f6b0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479f7c
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479f7c
000b:Call ntdll.RtlDetermineDosPathNameType_U(7b4a8b50 L"win.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023f228 L"C:\\windows\\win.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023f228 L"C:\\windows\\win.ini",0023f078,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023f070,c0100000,0023f098,0023f088,00000000,7f3200000080,00000007,7f3200000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023f078) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtQueryInformationFile(00000014,0023f0d0,0023f0e0,00000028,00000004) ret=7b44d5fa
000b:Ret  ntdll.NtQueryInformationFile() retval=00000000 ret=7b44d5fa
000b:Call ntdll.NtQuerySystemTime(0023f100) ret=7b489601
000b:Ret  ntdll.NtQuerySystemTime() retval=00000000 ret=7b489601
000b:Call ntdll.NtClose(00000014) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b47a000
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b47a000
000b:Call ntdll.RtlOpenCurrentUser(000f003f,0023f740) ret=7b459fdb
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e2b0 L"Control Panel") ret=7b45a032
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000b:Call ntdll.NtCreateKey(0023f738,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a05e
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000b:Call ntdll.NtClose(00000014) ret=7b45a074
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000b:Call ntdll.RtlInitUnicodeString(0023f748,7b49e290 L"International") ret=7b45a08d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000b:Call ntdll.NtCreateKey(0023f740,000f003f,0023f758,00000000,00000000,00000000,00000000) ret=7b45a0ae
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000b:Call ntdll.NtClose(00000018) ret=7b45a0cd
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000b:Call ntdll.RtlInitUnicodeString(0023f7e0,7b4a0d40 L"iPaperSize") ret=7b45b959
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b45b959
000b:Call ntdll.NtSetValueKey(00000014,0023f7e0,00000000,00000001,0023f948,00000004) ret=7b45b97f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45b97f
000b:Call ntdll.RtlEnterCriticalSection(7b7faee0) ret=7b45b98d
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b45b98d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlLeaveCriticalSection(7b7faee0) ret=7b45b9b9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b45b9b9
000b:Call ntdll.NtClose(00000014) ret=7b45bafe
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45bafe
000b:Call ntdll.RtlInitUnicodeString(0023f938,7b49e380 L"LC_CTYPE") ret=7b45c815
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45c815
000b:Call ntdll.NtQueryValueKey(00000008,0023f938,00000002,0023f948,00000050,0023f934) ret=7b45c846
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b45c846
000b:Call ntdll.NtSetValueKey(00000008,0023f938,00000000,00000001,0023f948,00000012) ret=7b45c92f
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45c92f
000b:Call ntdll.RtlInitUnicodeString(0023f9f8,7b49e300 L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Codepage") ret=7b45cb19
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000080 ret=7b45cb19
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cb8c
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cb8c
000b:Call ntdll.NtClose(00000014) ret=7b45cbe5
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cbe5
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cb8c
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cb8c
000b:Call ntdll.NtClose(00000014) ret=7b45cbe5
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cbe5
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cb8c
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cb8c
000b:Call ntdll.NtClose(00000014) ret=7b45cbe5
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cbe5
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cb8c
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cb8c
000b:Call ntdll.NtClose(00000014) ret=7b45cbe5
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cbe5
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cb8c
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cb8c
000b:Call ntdll.NtClose(00000014) ret=7b45cbe5
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cbe5
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cb8c
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cb8c
000b:Call ntdll.NtClose(00000014) ret=7b45cbe5
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cbe5
000b:Call ntdll.NtCreateKey(0023f9f0,000f003f,0023fa08,00000000,00000000,00000000,00000000) ret=7b45cbbe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45cbbe
000b:Call ntdll.LdrFindResource_U(7b420000,0023f628,00000003,0023f600) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023f780,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlInitUnicodeString(0023f9f8,7b49e2d0 L"ACP") ret=7b45cc4e
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000008 ret=7b45cc4e
000b:Call ntdll.NtSetValueKey(00000014,0023f9f8,00000000,00000001,0023fa38,0000000a) ret=7b45cc70
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45cc70
000b:Call ntdll.LdrFindResource_U(7b420000,0023f628,00000003,0023f600) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023f780,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlInitUnicodeString(0023f9f8,7b49e2d8 L"OEMCP") ret=7b45cc4e
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45cc4e
000b:Call ntdll.NtSetValueKey(00000014,0023f9f8,00000000,00000001,0023fa38,00000008) ret=7b45cc70
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45cc70
000b:Call ntdll.LdrFindResource_U(7b420000,0023f628,00000003,0023f600) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b669cd0,0023f780,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlInitUnicodeString(0023f9f8,7b49e2e8 L"MACCP") ret=7b45cc4e
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b45cc4e
000b:Call ntdll.NtSetValueKey(00000014,0023f9f8,00000000,00000001,0023fa38,0000000c) ret=7b45cc70
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b45cc70
000b:Call ntdll.NtClose(00000014) ret=7b45cc88
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cc88
000b:Call ntdll.NtClose(00000008) ret=7b45cc98
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b45cc98
000b:Call ntdll.RtlInitUnicodeString(0023f968,7b499f40 L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName") ret=7b43b317
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000080 ret=7b43b317
000b:Call ntdll.NtCreateKey(0023f958,000f003f,0023f978,00000000,00000000,00000000,00000000) ret=7b43b343
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b43b343
000b:Call ntdll.RtlInitUnicodeString(0023f968,7b499ed0 L"ComputerName") ret=7b43b36e
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b43b36e
000b:Call ntdll.NtCreateKey(0023f960,000f003f,0023f978,00000000,00000000,00000000,00000000) ret=7b43b398
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b43b398
000b:Call ntdll.NtQueryValueKey(00000014,0023f968,00000002,0023f9ac,0000002c,0023f954) ret=7b43b3d0
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b43b3d0
000b:Call ntdll.NtSetValueKey(00000014,0023f968,00000000,00000001,0023f9b8,0000001a) ret=7b43b4e0
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b43b4e0
000b:Call ntdll.NtClose(00000014) ret=7b43b54a
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b43b54a
000b:Call ntdll.RtlInitUnicodeString(0023f968,7b499f00 L"ActiveComputerName") ret=7b43b5aa
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7b43b5aa
000b:Call ntdll.NtCreateKey(0023f960,000f003f,0023f978,00000000,00000000,00000001,00000000) ret=7b43b5cb
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b43b5cb
000b:Call ntdll.RtlInitUnicodeString(0023f968,7b499ed0 L"ComputerName") ret=7b43b5ec
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b43b5ec
000b:Call ntdll.NtSetValueKey(00000014,0023f968,00000000,00000001,0023f9b8,0000001a) ret=7b43b611
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b43b611
000b:Call ntdll.NtClose(00000014) ret=7b43b625
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b43b625
000b:Call ntdll.NtClose(00000008) ret=7b43b62f
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b43b62f
000b:Call ntdll.RtlAcquirePebLock() ret=7b448fe9
000b:Ret  ntdll.RtlAcquirePebLock() retval=00000000 ret=7b448fe9
000b:Call ntdll.RtlUnicodeStringToAnsiString(0023fae8,001200c0,00000001) ret=7b44912c
000b:Ret  ntdll.RtlUnicodeStringToAnsiString() retval=00000000 ret=7b44912c
000b:Call ntdll.RtlUnicodeStringToAnsiString(0023fae8,001200b0,00000001) ret=7b44915b
000b:Ret  ntdll.RtlUnicodeStringToAnsiString() retval=00000000 ret=7b44915b
000b:Call ntdll.RtlReleasePebLock() ret=7b449244
000b:Ret  ntdll.RtlReleasePebLock() retval=00000000 ret=7b449244
000b:Call ntdll.RtlImageDirectoryEntryToData(7b420000,00000001,00000000,0023fb60) ret=7b455732
000b:Ret  ntdll.RtlImageDirectoryEntryToData() retval=7b654110 ret=7b455732
000b:Call ntdll.__wine_set_signal_handler(00000002,7b443cea) ret=7b455883
000b:Ret  ntdll.__wine_set_signal_handler() retval=00000000 ret=7b455883
000b:Ret  PE DLL (proc=0x7b494bcf,module=0x7b420000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000b:Call PE DLL (proc=0x7f328fda615a,module=0x7f328fd60000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1)
000b:Call KERNEL32.DisableThreadLibraryCalls(7f328fd60000) ret=7f328fda626e
000b:Call ntdll.LdrDisableThreadCalloutsForDll(7f328fd60000) ret=7b465737
000b:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000b:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7f328fda626e
000b:Ret  PE DLL (proc=0x7f328fda615a,module=0x7f328fd60000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000b:Starting process L"C:\\windows\\system32\\wineboot.exe" (entryproc=0x7f328ffe940c)
000b:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,00000007,0023fc80,00000008,00000000) ret=7b4469c5
000b:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b4469c5
000b:Call KERNEL32.GetWindowsDirectoryW(7f32901fa020,00000104) ret=7f328ffe554e
000b:Ret  KERNEL32.GetWindowsDirectoryW() retval=0000000a ret=7f328ffe554e
000b:Call KERNEL32.SetCurrentDirectoryW(7f32901fa020 L"C:\\windows") ret=7f328ffe555a
000b:Call ntdll.RtlInitUnicodeString(0023eb08,7f32901fa020 L"C:\\windows") ret=7b46bfbd
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b46bfbd
000b:Call ntdll.RtlSetCurrentDirectory_U(0023eb08) ret=7b46bfc5
000b:Ret  ntdll.RtlSetCurrentDirectory_U() retval=00000000 ret=7b46bfc5
000b:Ret  KERNEL32.SetCurrentDirectoryW() retval=00000001 ret=7f328ffe555a
000b:Call KERNEL32.IsWow64Process(ffffffffffffffff,0023ecd8) ret=7f328ffe55c0
000b:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001a,0023eb10,00000008,00000000) ret=7b47487e
000b:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b47487e
000b:Ret  KERNEL32.IsWow64Process() retval=00000001 ret=7f328ffe55c0
000b:Call KERNEL32.CreateEventW(0023ed00,00000001,00000000,7f328ffeac20 L"__wineboot_event") ret=7f328ffe5893
000b:Call ntdll.RtlInitUnicodeString(0023ea98,7f328ffeac20 L"__wineboot_event") ret=7b48076d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7b48076d
000b:Call ntdll.RtlInitUnicodeString(0023e978,0023e9b8 L"\\Sessions\\1\\BaseNamedObjects") ret=7b47fc02
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000003a ret=7b47fc02
000b:Call ntdll.NtOpenDirectoryObject(0023e970,00000006,0023e988) ret=7b47fc4c
000b:Ret  ntdll.NtOpenDirectoryObject() retval=00000000 ret=7b47fc4c
000b:Call ntdll.NtCreateEvent(0023ea90,001f0003,0023eaa8,00000000,00000000) ret=7b4807a4
000b:Ret  ntdll.NtCreateEvent() retval=40000000 ret=7b4807a4
000b:Ret  KERNEL32.CreateEventW() retval=00000014 ret=7f328ffe5893
000b:Call KERNEL32.ResetEvent(00000014) ret=7f328ffe58a2
000b:Call ntdll.NtResetEvent(00000014,00000000) ret=7b480ddf
000b:Ret  ntdll.NtResetEvent() retval=00000000 ret=7b480ddf
000b:Ret  KERNEL32.ResetEvent() retval=00000001 ret=7f328ffe58a2
000b:Call ntdll.NtQuerySystemInformation(00000001,0023ed30,0000000c,00000000) ret=7f328ffe58dd
000b:Ret  ntdll.NtQuerySystemInformation() retval=00000000 ret=7f328ffe58dd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000030) ret=7f328ffe58f4
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c4e0 ret=7f328ffe58f4
000b:Call ntdll.NtPowerInformation(0000000b,00000000,00000000,0001c4e0,00000030) ret=7f328ffe5928
000b:Ret  ntdll.NtPowerInformation() retval=00000000 ret=7f328ffe5928
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328ffeaae0 L"Hardware\\Description\\System",00000000,00000000,00000001,000f003f,00000000,0023ecf0,00000000) ret=7f328ffe59b6
000b:Call ntdll.RtlInitUnicodeString(0023e9b8,7f328fdaaa80 L"\\Registry\\Machine") ret=7f328fd7d97f
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7d97f
000b:Call ntdll.NtCreateKey(0023e940,02000000,0023e9c8,00000000,00000000,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlInitUnicodeString(0023ea68,7f328ffeaae0 L"Hardware\\Description\\System") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000038 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000001c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe59b6
000b:Call advapi32.RegSetValueExW(0000001c,7f328ffeaab0 L"Identifier",00000000,00000001,7f328ffeaa50,0000001c) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffeaab0 L"Identifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000001c,0023eac8,00000000,00000001,7f328ffeaa50,0000001c) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegCreateKeyExW(0000001c,7f328ffeaa20 L"FloatingPointProcessor",00000000,00000000,00000001,000f003f,00000000,0023ed18,00000000) ret=7f328ffe5a5d
000b:Call ntdll.RtlInitUnicodeString(0023ea68,7f328ffeaa20 L"FloatingPointProcessor") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5a5d
000b:Call advapi32.RegCreateKeyExW(0000001c,7f328ffea9e0 L"CentralProcessor",00000000,00000000,00000001,000f003f,00000000,0023ecf8,00000000) ret=7f328ffe5a98
000b:Call ntdll.RtlInitUnicodeString(0023ea68,7f328ffea9e0 L"CentralProcessor") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5a98
000b:Call advapi32.RegCreateKeyExW(00000024,0023f1a8 L"0",00000000,00000000,00000001,000f003f,00000000,0023ece8,00000000) ret=7f328ffe5b12
000b:Call ntdll.RtlInitUnicodeString(0023ea68,0023f1a8 L"0") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000004 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5b12
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea9b0 L"FeatureSet",00000000,00000004,0023ed38,00000004) ret=7f328ffe5b47
000b:Call ntdll.RtlInitUnicodeString(0023ead8,7f328ffea9b0 L"FeatureSet") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023ead8,00000000,00000004,0023ed38,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe5b47
000b:Call advapi32.RegSetValueExW(00000028,7f328ffeaab0 L"Identifier",00000000,00000001,0023f3b0,00000042) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffeaab0 L"Identifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,0023f3b0,00000042) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea980 L"ProcessorNameString",00000000,00000001,7f328ffea920,00000044) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea980 L"ProcessorNameString") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,7f328ffea920,00000044) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea8e0 L"VendorIdentifier",00000000,00000001,7f328ffea8c0,0000001a) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea8e0 L"VendorIdentifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,7f328ffea8c0,0000001a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea8a8 L"~MHz",00000000,00000004,0001c4e4,00000004) ret=7f328ffe5bbf
000b:Call ntdll.RtlInitUnicodeString(0023ead8,7f328ffea8a8 L"~MHz") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023ead8,00000000,00000004,0001c4e4,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe5bbf
000b:Call advapi32.RegCloseKey(00000028) ret=7f328ffe5bcd
000b:Call ntdll.NtClose(00000028) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5bcd
000b:Call advapi32.RegCreateKeyExW(00000020,0023f1a8 L"0",00000000,00000000,00000001,000f003f,00000000,0023ece8,00000000) ret=7f328ffe5c0f
000b:Call ntdll.RtlInitUnicodeString(0023ea68,0023f1a8 L"0") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000004 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5c0f
000b:Call advapi32.RegSetValueExW(00000028,7f328ffeaab0 L"Identifier",00000000,00000001,0023f3b0,00000042) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffeaab0 L"Identifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,0023f3b0,00000042) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegCloseKey(00000028) ret=7f328ffe5c39
000b:Call ntdll.NtClose(00000028) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5c39
000b:Call advapi32.RegCreateKeyExW(00000024,0023f1a8 L"1",00000000,00000000,00000001,000f003f,00000000,0023ece8,00000000) ret=7f328ffe5b12
000b:Call ntdll.RtlInitUnicodeString(0023ea68,0023f1a8 L"1") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000004 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5b12
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea9b0 L"FeatureSet",00000000,00000004,0023ed38,00000004) ret=7f328ffe5b47
000b:Call ntdll.RtlInitUnicodeString(0023ead8,7f328ffea9b0 L"FeatureSet") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023ead8,00000000,00000004,0023ed38,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe5b47
000b:Call advapi32.RegSetValueExW(00000028,7f328ffeaab0 L"Identifier",00000000,00000001,0023f3b0,00000042) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffeaab0 L"Identifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,0023f3b0,00000042) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea980 L"ProcessorNameString",00000000,00000001,7f328ffea920,00000044) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea980 L"ProcessorNameString") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,7f328ffea920,00000044) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea8e0 L"VendorIdentifier",00000000,00000001,7f328ffea8c0,0000001a) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea8e0 L"VendorIdentifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,7f328ffea8c0,0000001a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000028,7f328ffea8a8 L"~MHz",00000000,00000004,0001c4fc,00000004) ret=7f328ffe5bbf
000b:Call ntdll.RtlInitUnicodeString(0023ead8,7f328ffea8a8 L"~MHz") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023ead8,00000000,00000004,0001c4fc,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe5bbf
000b:Call advapi32.RegCloseKey(00000028) ret=7f328ffe5bcd
000b:Call ntdll.NtClose(00000028) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5bcd
000b:Call advapi32.RegCreateKeyExW(00000020,0023f1a8 L"1",00000000,00000000,00000001,000f003f,00000000,0023ece8,00000000) ret=7f328ffe5c0f
000b:Call ntdll.RtlInitUnicodeString(0023ea68,0023f1a8 L"1") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000004 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5c0f
000b:Call advapi32.RegSetValueExW(00000028,7f328ffeaab0 L"Identifier",00000000,00000001,0023f3b0,00000042) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffeaab0 L"Identifier") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023eac8,00000000,00000001,0023f3b0,00000042) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegCloseKey(00000028) ret=7f328ffe5c39
000b:Call ntdll.NtClose(00000028) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5c39
000b:Call advapi32.RegCloseKey(00000020) ret=7f328ffe5c56
000b:Call ntdll.NtClose(00000020) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5c56
000b:Call advapi32.RegCloseKey(00000024) ret=7f328ffe5c63
000b:Call ntdll.NtClose(00000024) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5c63
000b:Call advapi32.RegCloseKey(0000001c) ret=7f328ffe5c70
000b:Call ntdll.NtClose(0000001c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5c70
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c4e0) ret=7f328ffe5c87
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe5c87
000b:Call advapi32.RegCreateKeyExW(ffffffff80000006,7f328ffea880 L"PerfStats\\StatData",00000000,00000000,00000000,00020006,00000000,0023ed30,00000000) ret=7f328ffe5cb9
000b:Call ntdll.RtlInitUnicodeString(0023e9b8,7f328fdaa940 L"\\Registry\\DynData") ret=7f328fd7d97f
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7d97f
000b:Call ntdll.NtCreateKey(0023e940,02000000,0023e9c8,00000000,00000000,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlInitUnicodeString(0023ea68,7f328ffea880 L"PerfStats\\StatData") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,00020006,0023ea88,00000000,0023ea78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023e9d0,00020006,0023ea88,00000000,0023ea78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023e9d0,00020006,0023ea88,00000000,0023ea78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5cb9
000b:Call advapi32.RegCloseKey(00000024) ret=7f328ffe5cd2
000b:Call ntdll.NtClose(00000024) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5cd2
000b:Call advapi32.RegCreateKeyExW(ffffffff80000006,7f328ffea840 L"Config Manager\\Enum",00000000,00000000,00000000,00020006,00000000,0023ed30,00000000) ret=7f328ffe5d04
000b:Call ntdll.RtlInitUnicodeString(0023ea68,7f328ffea840 L"Config Manager\\Enum") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,00020006,0023ea88,00000000,0023ea78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023e9d0,00020006,0023ea88,00000000,0023ea78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023e9d0,00020006,0023ea88,00000000,0023ea78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe5d04
000b:Call advapi32.RegCloseKey(00000024) ret=7f328ffe5d1d
000b:Call ntdll.NtClose(00000024) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5d1d
000b:Call advapi32.RegCreateKeyW(ffffffff80000002,7f328ffea7c0 L"System\\CurrentControlSet\\Control\\Session Manager\\Environment",0023ed18) ret=7f328ffe5d4a
000b:Call ntdll.RtlInitUnicodeString(0023ea58,7f328ffea7c0 L"System\\CurrentControlSet\\Control\\Session Manager\\Environment") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000007a ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea68,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9c0,02000000,0023ea78,00000000,0023ea68,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023e9c0,02000000,0023ea78,00000000,0023ea68,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023e9c0,02000000,0023ea78,00000000,0023ea68,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023e9c0,02000000,0023ea78,00000000,0023ea68,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000024) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023e9c0,02000000,0023ea78,00000000,0023ea68,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023e9c0,02000000,0023ea78,00000000,0023ea68,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000024) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328ffe5d4a
000b:Call ntdll.NtQuerySystemInformation(00000001,0023ed30,0000000c,00000000) ret=7f328ffe5d77
000b:Ret  ntdll.NtQuerySystemInformation() retval=00000000 ret=7f328ffe5d77
000b:Call advapi32.RegSetValueExW(00000020,7f328ffea780 L"NUMBER_OF_PROCESSORS",00000000,00000001,0023f3b0,00000004) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea780 L"NUMBER_OF_PROCESSORS") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000020,0023eac8,00000000,00000001,0023f3b0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000020,7f328ffea720 L"PROCESSOR_ARCHITECTURE",00000000,00000001,7f328ffea770,0000000c) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea720 L"PROCESSOR_ARCHITECTURE") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000020,0023eac8,00000000,00000001,7f328ffea770,0000000c) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000020,7f328ffea620 L"PROCESSOR_IDENTIFIER",00000000,00000001,0023f3b0,00000062) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea620 L"PROCESSOR_IDENTIFIER") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000020,0023eac8,00000000,00000001,0023f3b0,00000062) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000020,7f328ffea600 L"PROCESSOR_LEVEL",00000000,00000001,0023f3b0,00000004) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea600 L"PROCESSOR_LEVEL") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000020,0023eac8,00000000,00000001,0023f3b0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000020,7f328ffea5c0 L"PROCESSOR_REVISION",00000000,00000001,0023f3b0,0000000a) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea5c0 L"PROCESSOR_REVISION") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000020,0023eac8,00000000,00000001,0023f3b0,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegCloseKey(00000020) ret=7f328ffe5ee1
000b:Call ntdll.NtClose(00000020) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe5ee1
000b:Call KERNEL32.GetPrivateProfileSectionW(7f328ffea5a8 L"rename",0023f3b0,00000400,7f328ffea590 L"wininit.ini") ret=7f328ffe5f11
000b:Call ntdll.RtlEnterCriticalSection(7b7fb440) ret=7b479c54
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b479c54
000b:Call ntdll.RtlDetermineDosPathNameType_U(7f328ffea590 L"wininit.ini") ret=7b478cb8
000b:Ret  ntdll.RtlDetermineDosPathNameType_U() retval=00000005 ret=7b478cb8
000b:Call ntdll.RtlIsDosDeviceName_U(0023e688 L"C:\\windows\\wininit.ini") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023e688 L"C:\\windows\\wininit.ini",0023e4d8,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023e4d0,80100000,0023e4f8,0023e4e8,00000000,7f3200000080,00000007,7f3200000001,30303000000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=c0000034 ret=7b44e2a4
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7b44e389
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7b44e389
000b:Call ntdll.RtlFreeUnicodeString(0023e4d8) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002e) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c4e0 ret=7b453b54
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb440) ret=7b479c8c
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b479c8c
000b:Ret  KERNEL32.GetPrivateProfileSectionW() retval=00000000 ret=7f328ffe5f11
000b:Call advapi32.RegOpenKeyExW(ffffffff80000002,7f328ffea4e0 L"System\\CurrentControlSet\\Control\\Session Manager",00000000,000f003f,0023ed30) ret=7f328ffe60b9
000b:Call ntdll.RtlInitUnicodeString(0023eab8,7f328ffea4e0 L"System\\CurrentControlSet\\Control\\Session Manager") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000062 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023ed30,000f003f,0023eac8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyExW() retval=00000000 ret=7f328ffe60b9
000b:Call advapi32.RegQueryValueExW(00000020,7f328ffea4a0 L"PendingFileRenameOperations",00000000,00000000,00000000,0023ed18) ret=7f328ffe6118
000b:Call ntdll.RtlInitUnicodeString(0023e898,7f328ffea4a0 L"PendingFileRenameOperations") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000038 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000020,0023e898,00000002,0023e8a8,0000000c,0023e894) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328ffe6118
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328ffe640a
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe640a
000b:Call advapi32.RegCloseKey(00000020) ret=7f328ffe6424
000b:Call ntdll.NtClose(00000020) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe6424
000b:Call advapi32.RegOpenKeyW(ffffffff80000002,7f328ffea420 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",0023ed30) ret=7f328ffe6444
000b:Call ntdll.RtlInitUnicodeString(0023ea88,7f328ffea420 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000006c ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023ed30,02000000,0023ea98,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=c0000034 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000002 ret=7f328ffe6444
000b:Call advapi32.RegCloseKey(00000000) ret=7f328ffe6502
000b:Ret  advapi32.RegCloseKey() retval=00000006 ret=7f328ffe6502
000b:Call KERNEL32.GetSystemDirectoryW(00000000,00000000) ret=7f328ffe6518
000b:Ret  KERNEL32.GetSystemDirectoryW() retval=00000014 ret=7f328ffe6518
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ffe6536
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c520 ret=7f328ffe6536
000b:Call KERNEL32.GetSystemDirectoryW(0001c520,00000014) ret=7f328ffe6544
000b:Ret  KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7f328ffe6544
000b:Call KERNEL32.FindFirstFileW(0001c520 L"C:\\windows\\system32\\dllcache\\*",0023f3b0) ret=7f328ffe6566
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0001c520 L"C:\\windows\\system32\\dllcache\\*",0023ea58,0023ea50,00000000) ret=7b44fa74
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00002064) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001dda0 ret=7b453b54
000b:Call ntdll.NtOpenFile(0001dda8,80100000,0023ea88,0023ea68,00000003,00000021) ret=7b44fced
000b:Ret  ntdll.NtOpenFile() retval=c0000034 ret=7b44fced
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001dda0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlFreeUnicodeString(0023ea58) ret=7b44ff08
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44ff08
000b:Ret  KERNEL32.FindFirstFileW() retval=ffffffffffffffff ret=7f328ffe6566
000b:Call KERNEL32.FindClose(ffffffffffffffff) ret=7f328ffe67b6
000b:Ret  KERNEL32.FindClose() retval=00000000 ret=7f328ffe67b6
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c520) ret=7f328ffe67cd
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe67cd
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328ffea040 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0023ebb8,00000000) ret=7f328ffe8c19
000b:Call ntdll.RtlInitUnicodeString(0023e948,7f328ffea040 L"Software\\Microsoft\\Windows\\CurrentVersion") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000054 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023e958,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000024) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000020) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe8c19
000b:Call advapi32.RegCreateKeyExW(00000024,7f328ffeac00 L"RunServicesOnce",00000000,00000000,00000000,000f003f,00000000,0023ebc0,0023eb98) ret=7f328ffe8c64
000b:Call ntdll.RtlInitUnicodeString(0023e948,7f328ffeac00 L"RunServicesOnce") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023e958,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e8b0,000f003f,0023e968,00000000,0023e958,00000000,0023eb98) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe8c64
000b:Call advapi32.RegCloseKey(00000024) ret=7f328ffe8c8c
000b:Call ntdll.NtClose(00000024) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe8c8c
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328ffe90dc
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe90dc
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328ffe90f3
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe90f3
000b:Call advapi32.RegCloseKey(00000020) ret=7f328ffe910a
000b:Call ntdll.NtClose(00000020) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe910a
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328ffea040 L"Software\\Microsoft\\Windows\\CurrentVersion",00000000,00000000,00000000,00020019,00000000,0023ebb8,00000000) ret=7f328ffe8c19
000b:Call ntdll.RtlInitUnicodeString(0023e948,7f328ffea040 L"Software\\Microsoft\\Windows\\CurrentVersion") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000054 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023e958,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe8c19
000b:Call advapi32.RegCreateKeyExW(00000020,7f328ffeabe0 L"RunServices",00000000,00000000,00000000,00020019,00000000,0023ebc0,0023eb98) ret=7f328ffe8c64
000b:Call ntdll.RtlInitUnicodeString(0023e948,7f328ffeabe0 L"RunServices") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023e958,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e8b0,00020019,0023e968,00000000,0023e958,00000000,0023eb98) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe8c64
000b:Call advapi32.RegCloseKey(00000020) ret=7f328ffe8c8c
000b:Call ntdll.NtClose(00000020) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe8c8c
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328ffe90dc
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe90dc
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328ffe90f3
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe90f3
000b:Call advapi32.RegCloseKey(00000024) ret=7f328ffe910a
000b:Call ntdll.NtClose(00000024) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328ffe910a
000b:Call KERNEL32.GetSystemDirectoryW(0023f3b0,000000f7) ret=7f328ffe6841
000b:Ret  KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7f328ffe6841
000b:Call KERNEL32.CreateProcessW(0023f3b0 L"C:\\windows\\system32\\services.exe",0023f3b0 L"C:\\windows\\system32\\services.exe",00000000,00000000,00000001,00000008,00000000,00000000,0023ed30,0023ed18) ret=7f328ffe68a2
000b:Call ntdll.RtlIsDosDeviceName_U(0023e658 L"C:\\windows\\system32\\services.exe") ret=7b44e081
000b:Ret  ntdll.RtlIsDosDeviceName_U() retval=00000000 ret=7b44e081
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023e658 L"C:\\windows\\system32\\services.exe",0023e208,00000000,00000000) ret=7b44e162
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44e162
000b:Call ntdll.NtCreateFile(0023e200,80100000,0023e228,0023e218,00000000,7f3200000000,00000005,00000001,00000060,00000000,00000000) ret=7b44e2a4
000b:Ret  ntdll.NtCreateFile() retval=00000000 ret=7b44e2a4
000b:Call ntdll.RtlFreeUnicodeString(0023e208) ret=7b44e3c9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44e3c9
000b:Call ntdll.NtSetInformationFile(00000020,0023dfc8,0023dfc0,00000008,0000000e) ret=7b44d2b0
000b:Ret  ntdll.NtSetInformationFile() retval=00000000 ret=7b44d2b0
000b:Call ntdll.NtReadFile(00000020,00000000,00000000,00000000,0023e098,0023e1f8,00000040,00000000,00000000) ret=7b44b9b6
000b:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
000b:Call ntdll.NtSetInformationFile(00000020,0023dfc8,0023dfc0,00000008,0000000e) ret=7b44d2b0
000b:Ret  ntdll.NtSetInformationFile() retval=00000000 ret=7b44d2b0
000b:Call ntdll.NtReadFile(00000020,00000000,00000000,00000000,0023e098,0023e238,000000f8,00000000,00000000) ret=7b44b9b6
000b:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
000b:Call ntdll.NtSetInformationFile(00000020,0023dfc8,0023dfc0,00000008,0000000e) ret=7b44d2b0
000b:Ret  ntdll.NtSetInformationFile() retval=00000000 ret=7b44d2b0
000b:Call ntdll.NtReadFile(00000020,00000000,00000000,00000000,0023e098,0023e333,00000015,00000000,00000000) ret=7b44b9b6
000b:Ret  ntdll.NtReadFile() retval=00000000 ret=7b44b9b6
000b:Call ntdll.RtlGetCurrentDirectory_U(00000208,0023e860) ret=7b46be1f
000b:Ret  ntdll.RtlGetCurrentDirectory_U() retval=00000014 ret=7b46be1f
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023e860 L"C:\\windows",0023e4a8,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023e4a8,0023e4b8,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=00000000 ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023e4a8) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Call ntdll.RtlAcquirePebLock() ret=7b470574
000b:Ret  ntdll.RtlAcquirePebLock() retval=00000000 ret=7b470574
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023d958 L"C:\\windows",0023d518,0023d510,00000000) ret=7b44fa74
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000002c2) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c6a0 ret=7b453b54
000b:Call ntdll.NtOpenFile(0001c6a8,80100000,0023d548,0023d528,00000003,00000021) ret=7b44fced
000b:Ret  ntdll.NtOpenFile() retval=00000000 ret=7b44fced
000b:Call ntdll.RtlInitializeCriticalSection(0001c6b0) ret=7b44fd23
000b:Ret  ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b44fd23
000b:Call ntdll.RtlInitUnicodeString(0023d538,0001c52e L"windows") ret=7b44fdc4
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b44fdc4
000b:Call ntdll.NtQueryDirectoryFile(00000024,00000000,00000000,00000000,0023d528,0001c704,0000025e,00000003,00000000,0023d538,00000001) ret=7b44fe0d
000b:Ret  ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b44fe0d
000b:Call ntdll.RtlEnterCriticalSection(0001c6b0) ret=7b44f3f2
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f3f2
000b:Call ntdll.RtlLeaveCriticalSection(0001c6b0) ret=7b44f636
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f636
000b:Call ntdll.NtClose(00000024) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlEnterCriticalSection(0001c6b0) ret=7b44f770
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f770
000b:Call ntdll.RtlFreeUnicodeString(0001c6e0) ret=7b44f7a2
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44f7a2
000b:Call ntdll.RtlLeaveCriticalSection(0001c6b0) ret=7b44f7bd
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f7bd
000b:Call ntdll.RtlDeleteCriticalSection(0001c6b0) ret=7b44f7d6
000b:Ret  ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b44f7d6
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c6a0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlInitUnicodeString(0023d5a8,0023d95e L"windows") ret=7b46d271
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b46d271
000b:Call ntdll.RtlIsNameLegalDOS8Dot3(0023d5a8,00000000,0023d597) ret=7b46d29b
000b:Ret  ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b46d29b
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023d958 L"C:\\windows\\system32",0023d518,0023d510,00000000) ret=7b44fa74
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000002c2) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c6a0 ret=7b453b54
000b:Call ntdll.NtOpenFile(0001c6a8,80100000,0023d548,0023d528,00000003,00000021) ret=7b44fced
000b:Ret  ntdll.NtOpenFile() retval=00000000 ret=7b44fced
000b:Call ntdll.RtlInitializeCriticalSection(0001c6b0) ret=7b44fd23
000b:Ret  ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b44fd23
000b:Call ntdll.RtlInitUnicodeString(0023d538,0001ca1e L"system32") ret=7b44fdc4
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b44fdc4
000b:Call ntdll.NtQueryDirectoryFile(00000024,00000000,00000000,00000000,0023d528,0001c704,0000025e,00000003,00000000,0023d538,00000001) ret=7b44fe0d
000b:Ret  ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b44fe0d
000b:Call ntdll.RtlEnterCriticalSection(0001c6b0) ret=7b44f3f2
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f3f2
000b:Call ntdll.RtlLeaveCriticalSection(0001c6b0) ret=7b44f636
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f636
000b:Call ntdll.NtClose(00000024) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlEnterCriticalSection(0001c6b0) ret=7b44f770
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f770
000b:Call ntdll.RtlFreeUnicodeString(0001c6e0) ret=7b44f7a2
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44f7a2
000b:Call ntdll.RtlLeaveCriticalSection(0001c6b0) ret=7b44f7bd
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f7bd
000b:Call ntdll.RtlDeleteCriticalSection(0001c6b0) ret=7b44f7d6
000b:Ret  ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b44f7d6
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c6a0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlInitUnicodeString(0023d5a8,0023d96e L"system32") ret=7b46d271
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b46d271
000b:Call ntdll.RtlIsNameLegalDOS8Dot3(0023d5a8,00000000,0023d597) ret=7b46d29b
000b:Ret  ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b46d29b
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023d958 L"C:\\windows\\system32\\services.exe",0023d518,0023d510,00000000) ret=7b44fa74
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b44fa74
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000002c2) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c6a0 ret=7b453b54
000b:Call ntdll.NtOpenFile(0001c6a8,80100000,0023d548,0023d528,00000003,00000021) ret=7b44fced
000b:Ret  ntdll.NtOpenFile() retval=00000000 ret=7b44fced
000b:Call ntdll.RtlInitializeCriticalSection(0001c6b0) ret=7b44fd23
000b:Ret  ntdll.RtlInitializeCriticalSection() retval=00000000 ret=7b44fd23
000b:Call ntdll.RtlInitUnicodeString(0023d538,0001ca30 L"services.exe") ret=7b44fdc4
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b44fdc4
000b:Call ntdll.NtQueryDirectoryFile(00000024,00000000,00000000,00000000,0023d528,0001c704,0000025e,00000003,00000000,0023d538,00000001) ret=7b44fe0d
000b:Ret  ntdll.NtQueryDirectoryFile() retval=00000000 ret=7b44fe0d
000b:Call ntdll.RtlEnterCriticalSection(0001c6b0) ret=7b44f3f2
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f3f2
000b:Call ntdll.RtlLeaveCriticalSection(0001c6b0) ret=7b44f636
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f636
000b:Call ntdll.NtClose(00000024) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlEnterCriticalSection(0001c6b0) ret=7b44f770
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b44f770
000b:Call ntdll.RtlFreeUnicodeString(0001c6e0) ret=7b44f7a2
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b44f7a2
000b:Call ntdll.RtlLeaveCriticalSection(0001c6b0) ret=7b44f7bd
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b44f7bd
000b:Call ntdll.RtlDeleteCriticalSection(0001c6b0) ret=7b44f7d6
000b:Ret  ntdll.RtlDeleteCriticalSection() retval=00000000 ret=7b44f7d6
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c6a0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlInitUnicodeString(0023d5a8,0023d980 L"services.exe") ret=7b46d271
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b46d271
000b:Call ntdll.RtlIsNameLegalDOS8Dot3(0023d5a8,00000000,0023d597) ret=7b46d29b
000b:Ret  ntdll.RtlIsNameLegalDOS8Dot3() retval=00000001 ret=7b46d29b
000b:Call ntdll.RtlGetFullPathName_U(0023e330 L"C:\\windows\\system32\\services.exe",00000208,0023e330,00000000) ret=7b4695e7
000b:Ret  ntdll.RtlGetFullPathName_U() retval=00000040 ret=7b4695e7
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,000001c0) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c6a0 ret=7b453b54
000b:Call ntdll.RtlFreeUnicodeString(0023e318) ret=7b470944
000b:Ret  ntdll.RtlFreeUnicodeString() retval=7bc7069f ret=7b470944
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000011) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001c520 ret=7b453b54
000b:Call ntdll.wine_server_send_fd(0000000b) ret=7b470a57
000b:Ret  ntdll.wine_server_send_fd() retval=00000000 ret=7b470a57
000b:Call ntdll.RtlReleasePebLock() ret=7b470bf6
000b:Ret  ntdll.RtlReleasePebLock() retval=00000000 ret=7b470bf6
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c6a0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000021) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ca00 ret=7b453b54
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000039) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ca40 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ca00) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ca40) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c520) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Call ntdll.NtWaitForMultipleObjects(00000001,0023df18,00000001,00000000,00000000) ret=7b47fb17
000d:Call KERNEL32.__wine_kernel_init() ret=7bc58f7d
000d:Call ntdll.RtlInitUnicodeString(7fff543c0e68,7b4a85f0 L"kernel32") ret=7b4662b0
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b4662b0
000d:Call ntdll.LdrGetDllHandle(00000000,00000000,7fff543c0e68,7fff543c0e58) ret=7b4662c3
000d:Ret  ntdll.LdrGetDllHandle() retval=00000000 ret=7b4662c3
000d:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001a,7fff543c0f60,00000008,00000000) ret=7b47487e
000d:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b47487e
000d:Call ntdll.LdrFindResourceDirectory_U(7b420000,00000000,00000000,7fff543c08b8) ret=7b47e2a5
000d:Ret  ntdll.LdrFindResourceDirectory_U() retval=00000000 ret=7b47e2a5
000d:Call ntdll.LdrFindResourceDirectory_U(7b420000,7fff543c08e8,00000002,7fff543c08c0) ret=7b47e327
000d:Ret  ntdll.LdrFindResourceDirectory_U() retval=00000000 ret=7b47e327
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6677c0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6677d0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6677e0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6677f0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667800,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667810,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667820,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667830,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667840,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667850,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667860,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667870,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667880,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667890,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6678a0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6678b0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6678c0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6678d0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6678e0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6678f0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667900,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667910,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667920,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667930,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667940,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667950,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667960,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667970,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667980,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667990,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6679a0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6679b0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6679c0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6679d0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6679e0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6679f0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a00,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a10,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a20,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a30,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a40,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a50,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a60,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a70,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a80,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667a90,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667aa0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ab0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ac0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ad0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ae0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667af0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b00,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b10,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b20,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b30,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b40,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b50,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b60,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b70,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b80,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667b90,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ba0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667bb0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667bc0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667bd0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667be0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667bf0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c00,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c10,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c20,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c30,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c40,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c50,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c60,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c70,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c80,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667c90,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ca0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667cb0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667cc0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667cd0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ce0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667cf0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d00,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d10,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d20,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d30,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d40,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d50,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d60,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d70,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d80,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667d90,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667da0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667db0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667dc0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667dd0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667de0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667df0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e00,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e10,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e20,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e30,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e40,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e50,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e60,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e70,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e80,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667e90,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ea0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667eb0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ec0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ed0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ee0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ef0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f00,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f10,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f20,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f30,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f40,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f50,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f60,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f70,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f80,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667f90,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667fa0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667fb0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667fc0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667fd0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667fe0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b667ff0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668000,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668010,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668020,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668030,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668040,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668050,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668060,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668070,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668080,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b668090,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6680a0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6680b0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6680c0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c02a8,00000003,7fff543c0280) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6680d0,7fff543c0400,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.NtSetDefaultUILanguage(00000409) ret=7b4610ef
000d:Ret  ntdll.NtSetDefaultUILanguage() retval=00000000 ret=7b4610ef
000d:Call ntdll.NtSetDefaultLocale(00000001,00000409) ret=7b4610ff
000d:Ret  ntdll.NtSetDefaultLocale() retval=00000000 ret=7b4610ff
000d:Call ntdll.NtSetDefaultLocale(00000000,00000409) ret=7b46110c
000d:Ret  ntdll.NtSetDefaultLocale() retval=00000000 ret=7b46110c
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c0c38,00000003,7fff543c0c10) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b6693b0,7fff543c0d90,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000a) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000d:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c0c58,00000003,7fff543c0c30) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b669cd0,7fff543c0db0,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000c) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000d:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000d:Call ntdll.LdrFindResource_U(7b420000,7fff543c0c58,00000003,7fff543c0c30) ret=7b47b93e
000d:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000d:Call ntdll.LdrAccessResource(7b420000,7b664ab0,7fff543c0db0,00000000) ret=7b47e5b0
000d:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000d:Call ntdll.RtlFreeHeap(00010000,00000000,00019930) ret=7b453b67
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000d:Call ntdll.__wine_init_codepages(7b652b00,7b653200,00000000) ret=7b46123d
000d:Ret  ntdll.__wine_init_codepages() retval=7bcea5e4 ret=7b46123d
000d:Call ntdll.RtlInitUnicodeString(7fff543c0f38,7b4a85a8 L"windir") ret=7b448658
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b448658
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0f38,7fff543c0f48) ret=7b448686
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000d:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000d:Call ntdll.RtlInitUnicodeString(7fff543c0f38,7b4a8570 L"winsysdir") ret=7b448658
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b448658
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0f38,7fff543c0f48) ret=7b448686
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000d:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019930 ret=7b453b54
000d:Call ntdll.RtlDosPathNameToNtPathName_U(7b4a8590 L"C:\\windows",7fff543c0f18,00000000,00000000) ret=7b46b82b
000d:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
000d:Call ntdll.NtCreateFile(7fff543c0f10,80100000,7fff543c0f38,7fff543c0f28,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
000d:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
000d:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
000d:Call ntdll.RtlFreeUnicodeString(7fff543c0f18) ret=7b46b910
000d:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
000d:Call ntdll.RtlDosPathNameToNtPathName_U(00019930 L"C:\\windows\\system32",7fff543c0f18,00000000,00000000) ret=7b46b82b
000d:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
000d:Call ntdll.NtCreateFile(7fff543c0f10,80100000,7fff543c0f38,7fff543c0f28,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
000d:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
000d:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
000d:Call ntdll.RtlFreeUnicodeString(7fff543c0f18) ret=7b46b910
000d:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019970 ret=7b453b54
000d:Call ntdll.RtlDosPathNameToNtPathName_U(00019970 L"C:\\windows\\syswow64",7fff543c0f18,00000000,00000000) ret=7b46b82b
000d:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46b82b
000d:Call ntdll.NtCreateFile(7fff543c0f10,80100000,7fff543c0f38,7fff543c0f28,00000000,00000080,00000001,00000002,00000021,00000000,00000000) ret=7b46b8e2
000d:Ret  ntdll.NtCreateFile() retval=c0000035 ret=7b46b8e2
000d:Call ntdll.RtlNtStatusToDosError(c0000035) ret=7b46b8fe
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000b7 ret=7b46b8fe
000d:Call ntdll.RtlFreeUnicodeString(7fff543c0f18) ret=7b46b910
000d:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46b910
000d:Call ntdll.__wine_init_windows_dir(7b4a8590 L"C:\\windows",00019930 L"C:\\windows\\system32") ret=7b474ea4
000d:Ret  ntdll.__wine_init_windows_dir() retval=0000001a ret=7b474ea4
000d:Call ntdll.RtlSetCurrentDirectory_U(00120038) ret=7b474ebd
000d:Ret  ntdll.RtlSetCurrentDirectory_U() retval=00000000 ret=7b474ebd
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000052) ret=7b47520e
000d:Ret  ntdll.RtlAllocateHeap() retval=00019aa0 ret=7b47520e
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000031) ret=7b4752c0
000d:Ret  ntdll.RtlAllocateHeap() retval=00019b10 ret=7b4752c0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,0000006c) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019b60 ret=7b453b54
000d:Call ntdll.RtlInitUnicodeString(7fff543c0fd8,7b4a1308 L"PATH") ret=7b466ac8
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0fd8,7fff543c0fe8) ret=7b466b02
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000d:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019be0 ret=7b453b54
000d:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0fd8,7fff543c0fe8) ret=7b466c3a
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000d:Call ntdll.RtlInitUnicodeString(00120050,00019be0 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;") ret=7b475825
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000090 ret=7b475825
000d:Call ntdll.RtlInitUnicodeString(7fff543c0f38,7b4a81e0 L"PROCESSOR_ARCHITEW6432") ret=7b448658
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7b448658
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0f38,7fff543c0f48) ret=7b448686
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000d:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000d:Call ntdll.RtlInitUnicodeString(7fff543c0f38,7b4a81a0 L"PROCESSOR_ARCHITECTURE") ret=7b448658
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7b448658
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0f38,7fff543c0f48) ret=7b448686
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b448686
000d:Call ntdll.RtlNtStatusToDosError(c0000100) ret=7b44869d
000d:Ret  ntdll.RtlNtStatusToDosError() retval=000000cb ret=7b44869d
000d:Call ntdll.RtlInitUnicodeString(7fff543c10e8,7b4a8120 L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion") ret=7b4759a8
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000078 ret=7b4759a8
000d:Call ntdll.NtOpenKey(7fff543c10d0,00020119,7fff543c1108) ret=7b4759d4
000d:Ret  ntdll.NtOpenKey() retval=00000000 ret=7b4759d4
000d:Call ntdll.RtlInitUnicodeString(7fff543c07d8,7b4a8100 L"ProgramFilesDir") ret=7b46e9f6
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7b46e9f6
000d:Call ntdll.NtQueryValueKey(00000018,7fff543c07d8,00000002,7fff543c0808,00000810,7fff543c07d4) ret=7b46ea22
000d:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b46ea22
000d:Call ntdll.RtlInitUnicodeString(7fff543c07d8,7b4a8050 L"CommonFilesDir") ret=7b46e9f6
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7b46e9f6
000d:Call ntdll.NtQueryValueKey(00000018,7fff543c07d8,00000002,7fff543c0808,00000810,7fff543c07d4) ret=7b46ea22
000d:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7b46ea22
000d:Call ntdll.NtClose(00000018) ret=7b475b29
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b475b29
000d:Call ntdll.RtlInitUnicodeString(7fff543c0f58,7fff543c1388 L"C:\\windows\\system32\\services.exe") ret=7b466f2a
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000042 ret=7b466f2a
000d:Call ntdll.RtlInitUnicodeString(7fff543c0e68,7b4a1308 L"PATH") ret=7b466ac8
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0e68,7fff543c0e78) ret=7b466b02
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000d:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000d:Ret  ntdll.RtlAllocateHeap() retval=00019c80 ret=7b453b54
000d:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000d:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,7fff543c0e68,7fff543c0e78) ret=7b466c3a
000d:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000d:Call ntdll.LdrLoadDll(00019c80 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;",00000001,7fff543c0f58,7fff543c0ed8) ret=7b466ddc
000d:Ret  ntdll.LdrLoadDll() retval=00000000 ret=7b466ddc
000d:Call ntdll.RtlFreeHeap(00010000,00000000,00019c80) ret=7b453b67
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000d:Call ntdll.LdrInitializeThunk(7b46f102,00000000,00000000,00000000) ret=7b475f4f
000b:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
000b:Call ntdll.NtClose(00000024) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.NtClose(00000020) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001c560) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Ret  KERNEL32.CreateProcessW() retval=00000001 ret=7f328ffe68a2
000b:Call KERNEL32.CloseHandle(0000002c) ret=7f328ffe68f5
000b:Call ntdll.NtClose(0000002c) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Ret  KERNEL32.CloseHandle() retval=00000001 ret=7f328ffe68f5
000b:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7f328ffea340 L"__wine_SvcctlStarted") ret=7f328ffe690b
000b:Call ntdll.RtlInitUnicodeString(0023ea98,7f328ffea340 L"__wine_SvcctlStarted") ret=7b48076d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7b48076d
000b:Call ntdll.NtCreateEvent(0023ea90,001f0003,0023eaa8,00000000,00000000) ret=7b4807a4
000b:Ret  ntdll.NtCreateEvent() retval=00000000 ret=7b4807a4
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b4807b9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b4807b9
000b:Ret  KERNEL32.CreateEventW() retval=00000020 ret=7f328ffe690b
000b:Call KERNEL32.WaitForMultipleObjects(00000002,0023f1a8,00000000,ffffffff) ret=7f328ffe6944
000b:Call ntdll.NtWaitForMultipleObjects(00000002,0023e888,00000001,00000000,00000000) ret=7b47fb17
000d:Call PE DLL (proc=0x7bc9a7de,module=0x7bc20000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1)
000d:Ret  PE DLL (proc=0x7bc9a7de,module=0x7bc20000 L"ntdll.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000d:Call PE DLL (proc=0x7b494bcf,module=0x7b420000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1)
000d:Call ntdll.LdrDisableThreadCalloutsForDll(7b420000) ret=7b465737
000d:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000d:Call ntdll.NtQuerySystemInformation(00000000,7b7fbb00,00000040,00000000) ret=7b4556f9
000d:Ret  ntdll.NtQuerySystemInformation() retval=00000000 ret=7b4556f9
000d:Call ntdll.NtQueryDefaultLocale(00000001,0023f8b4) ret=7b45b28e
000d:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b28e
000d:Call ntdll.RtlOpenCurrentUser(000f003f,0023f930) ret=7b459fdb
000d:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b459fdb
000d:Call ntdll.RtlInitUnicodeString(0023f938,7b49e2b0 L"Control Panel") ret=7b45a032
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a032
000d:Call ntdll.NtCreateKey(0023f928,000f003f,0023f948,00000000,00000000,00000000,00000000) ret=7b45a05e
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a05e
000d:Call ntdll.NtClose(00000008) ret=7b45a074
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b45a074
000d:Call ntdll.RtlInitUnicodeString(0023f938,7b49e290 L"International") ret=7b45a08d
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7b45a08d
000d:Call ntdll.NtCreateKey(0023f930,000f003f,0023f948,00000000,00000000,00000000,00000000) ret=7b45a0ae
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b45a0ae
000d:Call ntdll.NtClose(00000018) ret=7b45a0cd
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b45a0cd
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e508 L"Locale") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e4e0 L"LC_MONETARY") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e490 L"LC_NUMERIC") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e440 L"LC_TIME") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e3e0 L"LC_MEASUREMENT") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e3c0 L"LC_TELEPHONE") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e3a0 L"LC_PAPER") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.RtlInitUnicodeString(0023f8f8,7b49e380 L"LC_CTYPE") ret=7b45c815
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7b45c815
000d:Call ntdll.NtQueryValueKey(00000008,0023f8f8,00000002,0023f908,00000050,0023f8f4) ret=7b45c846
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b45c846
000d:Call ntdll.NtClose(00000008) ret=7b45cc98
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b45cc98
000d:Call ntdll.RtlInitUnicodeString(0023f928,7b499f40 L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName") ret=7b43b317
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000080 ret=7b43b317
000d:Call ntdll.NtCreateKey(0023f918,000f003f,0023f938,00000000,00000000,00000000,00000000) ret=7b43b343
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b43b343
000d:Call ntdll.RtlInitUnicodeString(0023f928,7b499ed0 L"ComputerName") ret=7b43b36e
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b43b36e
000d:Call ntdll.NtCreateKey(0023f920,000f003f,0023f938,00000000,00000000,00000000,00000000) ret=7b43b398
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b43b398
000d:Call ntdll.NtQueryValueKey(00000018,0023f928,00000002,0023f96c,0000002c,0023f914) ret=7b43b3d0
000d:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7b43b3d0
000d:Call ntdll.RtlOpenCurrentUser(00020019,0023f838) ret=7b43aeb5
000d:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7b43aeb5
000d:Call ntdll.RtlInitUnicodeString(0023f848,7b499e80 L"Software\\Wine\\Network") ret=7b43aece
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000002c ret=7b43aece
000d:Call ntdll.NtOpenKey(0023f840,00020019,0023f858) ret=7b43aeea
000d:Ret  ntdll.NtOpenKey() retval=c0000034 ret=7b43aeea
000d:Call ntdll.NtClose(0000001c) ret=7b43af7d
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b43af7d
000d:Call ntdll.NtSetValueKey(00000018,0023f928,00000000,00000001,0023f978,0000001a) ret=7b43b4e0
000d:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b43b4e0
000d:Call ntdll.NtClose(00000018) ret=7b43b54a
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b43b54a
000d:Call ntdll.RtlInitUnicodeString(0023f928,7b499f00 L"ActiveComputerName") ret=7b43b5aa
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7b43b5aa
000d:Call ntdll.NtCreateKey(0023f920,000f003f,0023f938,00000000,00000000,00000001,00000000) ret=7b43b5cb
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7b43b5cb
000d:Call ntdll.RtlInitUnicodeString(0023f928,7b499ed0 L"ComputerName") ret=7b43b5ec
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7b43b5ec
000d:Call ntdll.NtSetValueKey(00000018,0023f928,00000000,00000001,0023f978,0000001a) ret=7b43b611
000d:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7b43b611
000d:Call ntdll.NtClose(00000018) ret=7b43b625
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b43b625
000d:Call ntdll.NtClose(00000008) ret=7b43b62f
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b43b62f
000d:Call ntdll.RtlAcquirePebLock() ret=7b448fe9
000d:Ret  ntdll.RtlAcquirePebLock() retval=00000000 ret=7b448fe9
000d:Call ntdll.RtlUnicodeStringToAnsiString(0023faa8,001200c0,00000001) ret=7b44912c
000d:Ret  ntdll.RtlUnicodeStringToAnsiString() retval=00000000 ret=7b44912c
000d:Call ntdll.RtlUnicodeStringToAnsiString(0023faa8,001200b0,00000001) ret=7b44915b
000d:Ret  ntdll.RtlUnicodeStringToAnsiString() retval=00000000 ret=7b44915b
000d:Call ntdll.RtlReleasePebLock() ret=7b449244
000d:Ret  ntdll.RtlReleasePebLock() retval=00000000 ret=7b449244
000d:Call ntdll.RtlImageDirectoryEntryToData(7b420000,00000001,00000000,0023fb20) ret=7b455732
000d:Ret  ntdll.RtlImageDirectoryEntryToData() retval=7b654110 ret=7b455732
000d:Call ntdll.__wine_set_signal_handler(00000002,7b443cea) ret=7b455883
000d:Ret  ntdll.__wine_set_signal_handler() retval=00000000 ret=7b455883
000d:Ret  PE DLL (proc=0x7b494bcf,module=0x7b420000 L"KERNEL32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000d:Call PE DLL (proc=0x7fc35bb1b15a,module=0x7fc35bad0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1)
000d:Call KERNEL32.DisableThreadLibraryCalls(7fc35bad0000) ret=7fc35bb1b26e
000d:Call ntdll.LdrDisableThreadCalloutsForDll(7fc35bad0000) ret=7b465737
000d:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000d:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7fc35bb1b26e
000d:Ret  PE DLL (proc=0x7fc35bb1b15a,module=0x7fc35bad0000 L"advapi32.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000d:Call PE DLL (proc=0x7fc35bda174d,module=0x7fc35bd60000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1)
000d:Ret  PE DLL (proc=0x7fc35bda174d,module=0x7fc35bd60000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000d:Call PE DLL (proc=0x7fc35b8b6d21,module=0x7fc35b8b0000 L"userenv.dll",reason=PROCESS_ATTACH,res=0x1)
000d:Call KERNEL32.DisableThreadLibraryCalls(7fc35b8b0000) ret=7fc35b8b48fa
000d:Call ntdll.LdrDisableThreadCalloutsForDll(7fc35b8b0000) ret=7b465737
000d:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000d:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7fc35b8b48fa
000d:Ret  PE DLL (proc=0x7fc35b8b6d21,module=0x7fc35b8b0000 L"userenv.dll",reason=PROCESS_ATTACH,res=0x1) retval=1
000d:Starting process L"C:\\windows\\system32\\services.exe" (entryproc=0x7fc35bffd071)
000d:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,00000007,0023fc80,00000008,00000000) ret=7b4469c5
000d:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b4469c5
000d:Call KERNEL32.CreateEventW(00000000,00000001,00000000,7fc35bffe400 L"__wine_SvcctlStarted") ret=7fc35bfe637a
000d:Call ntdll.RtlInitUnicodeString(0023f968,7fc35bffe400 L"__wine_SvcctlStarted") ret=7b48076d
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7b48076d
000d:Call ntdll.RtlInitUnicodeString(0023f848,0023f888 L"\\Sessions\\1\\BaseNamedObjects") ret=7b47fc02
000d:Ret  ntdll.RtlInitUnicodeString() retval=0000003a ret=7b47fc02
000d:Call ntdll.NtOpenDirectoryObject(0023f840,00000006,0023f858) ret=7b47fc4c
000d:Ret  ntdll.NtOpenDirectoryObject() retval=00000000 ret=7b47fc4c
000d:Call ntdll.NtCreateEvent(0023f960,001f0003,0023f978,00000000,00000000) ret=7b4807a4
000d:Ret  ntdll.NtCreateEvent() retval=40000000 ret=7b4807a4
000d:Ret  KERNEL32.CreateEventW() retval=00000018 ret=7fc35bfe637a
000d:Call advapi32.RegCreateKeyExW(ffffffff80000002,7fc35bffe3a0 L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent",00000000,00000000,00000001,00000003,00000000,7fc35c207298,00000000) ret=7fc35bfe63b0
000d:Call ntdll.RtlInitUnicodeString(0023f888,7fc35bb1fa80 L"\\Registry\\Machine") ret=7fc35baf297f
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7fc35baf297f
000d:Call ntdll.NtCreateKey(0023f810,02000000,0023f898,00000000,00000000,00000000,00000000) ret=7fc35baf25fe
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7fc35baf25fe
000d:Call ntdll.RtlInitUnicodeString(0023f938,7fc35bffe3a0 L"SYSTEM\\CurrentControlSet\\Control\\ServiceCurrent") ret=7fc35baf3cc1
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000060 ret=7fc35baf3cc1
000d:Call ntdll.RtlInitUnicodeString(0023f948,00000000) ret=7fc35baf3ccc
000d:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7fc35baf3ccc
000d:Call ntdll.NtCreateKey(0023f8a0,00000003,0023f958,00000000,0023f948,00000001,00000000) ret=7fc35baf25fe
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7fc35baf25fe
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7fc35baf3cea
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7fc35baf3cea
000d:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7fc35bfe63b0
000d:Call advapi32.RegOpenKeyW(ffffffff80000002,7fc35bffe340 L"System\\CurrentControlSet\\Control",0023fb88) ret=7fc35bfe63e2
000d:Call ntdll.RtlInitUnicodeString(0023f958,7fc35bffe340 L"System\\CurrentControlSet\\Control") ret=7fc35baf438d
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000042 ret=7fc35baf438d
000d:Call ntdll.NtOpenKeyEx(0023fb88,02000000,0023f968,00000000) ret=7fc35baf234a
000d:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7fc35baf234a
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7fc35baf43a1
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7fc35baf43a1
000d:Ret  advapi32.RegOpenKeyW() retval=00000000 ret=7fc35bfe63e2
000d:Call advapi32.RegQueryValueExW(00000024,7fc35bffe300 L"ServicesPipeTimeout",00000000,0023fb80,0023fb98,0023fb84) ret=7fc35bfe6423
000d:Call ntdll.RtlInitUnicodeString(0023f768,7fc35bffe300 L"ServicesPipeTimeout") ret=7fc35baf3011
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7fc35baf3011
000d:Call ntdll.NtQueryValueKey(00000024,0023f768,00000002,0023f778,0000008c,0023f764) ret=7fc35baf3075
000d:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7fc35baf3075
000d:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7fc35baf3186
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7fc35baf3186
000d:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7fc35bfe6423
000d:Call advapi32.RegQueryValueExW(00000024,7fc35bffe2c0 L"WaitToKillServiceTimeout",00000000,0023fb80,0023fb98,0023fb84) ret=7fc35bfe6474
000d:Call ntdll.RtlInitUnicodeString(0023f768,7fc35bffe2c0 L"WaitToKillServiceTimeout") ret=7fc35baf3011
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000032 ret=7fc35baf3011
000d:Call ntdll.NtQueryValueKey(00000024,0023f768,00000002,0023f778,0000008c,0023f764) ret=7fc35baf3075
000d:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7fc35baf3075
000d:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7fc35baf3186
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7fc35baf3186
000d:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7fc35bfe6474
000d:Call advapi32.RegCloseKey(00000024) ret=7fc35bfe64ad
000d:Call ntdll.NtClose(00000024) ret=7fc35baf5453
000d:Ret  ntdll.NtClose() retval=00000000 ret=7fc35baf5453
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7fc35baf545a
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7fc35baf545a
000d:Ret  advapi32.RegCloseKey() retval=00000000 ret=7fc35bfe64ad
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000058) ret=7fc35bfe64cf
000d:Ret  ntdll.RtlAllocateHeap() retval=0001e7c0 ret=7fc35bfe64cf
000d:Call KERNEL32.InitializeCriticalSection(0001e7f0) ret=7fc35bfe6512
000d:Call ntdll.RtlInitializeCriticalSectionEx(0001e7f0,00000000,00000000) ret=7b480484
000d:Ret  ntdll.RtlInitializeCriticalSectionEx() retval=00000000 ret=7b480484
000d:Ret  KERNEL32.InitializeCriticalSection() retval=00000001 ret=7fc35bfe6512
000d:Call advapi32.RegCreateKeyExW(ffffffff80000002,7fc35bffe6e0 L"System\\CurrentControlSet\\Services",00000000,00000000,00000000,02000000,00000000,0001e7c0,00000000) ret=7fc35bfe6551
000d:Call ntdll.RtlInitUnicodeString(0023f938,7fc35bffe6e0 L"System\\CurrentControlSet\\Services") ret=7fc35baf3cc1
000d:Ret  ntdll.RtlInitUnicodeString() retval=00000044 ret=7fc35baf3cc1
000d:Call ntdll.RtlInitUnicodeString(0023f948,00000000) ret=7fc35baf3ccc
000d:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7fc35baf3ccc
000d:Call ntdll.NtCreateKey(0023f8a0,02000000,0023f958,00000000,0023f948,00000000,00000000) ret=7fc35baf25fe
000d:Ret  ntdll.NtCreateKey() retval=00000000 ret=7fc35baf25fe
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7fc35baf3cea
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7fc35baf3cea
000d:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7fc35bfe6551
000d:Call advapi32.RegEnumKeyW(00000024,00000000,0023f910,00000104) ret=7fc35bfeced0
000d:Call ntdll.NtEnumerateKey(00000024,00000000,00000001,0023f4b8,00000100,0023f4b4) ret=7fc35baf2b2c
000d:Ret  ntdll.NtEnumerateKey() retval=8000001a ret=7fc35baf2b2c
000d:Call ntdll.RtlNtStatusToDosError(8000001a) ret=7fc35baf2c40
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000103 ret=7fc35baf2c40
000d:Ret  advapi32.RegEnumKeyW() retval=00000103 ret=7fc35bfeced0
000d:Call KERNEL32.CreateThreadpoolCleanupGroup() ret=7fc35bfec180
000d:Call ntdll.TpAllocCleanupGroup(0023f9a0) ret=7b488a52
000d:Ret  ntdll.TpAllocCleanupGroup() retval=00000000 ret=7b488a52
000d:Ret  KERNEL32.CreateThreadpoolCleanupGroup() retval=0001e870 ret=7fc35bfec180
000d:Call rpcrt4.RpcServerUseProtseqEpW(0023fb1c L"ncacn_np",00000000,0023fb2e L"\\pipe\\svcctl",00000000) ret=7fc35bfec1e6
000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0023fb1c L"ncacn_np",ffffffff,00000000,00000000,00000000,00000000) ret=7fc35bd887f0
000d:Ret  KERNEL32.WideCharToMultiByte() retval=00000009 ret=7fc35bd887f0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000009) ret=7fc35bd8880e
000d:Ret  ntdll.RtlAllocateHeap() retval=0001e900 ret=7fc35bd8880e
000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0023fb1c L"ncacn_np",ffffffff,0001e900,00000009,00000000,00000000) ret=7fc35bd88830
000d:Ret  KERNEL32.WideCharToMultiByte() retval=00000009 ret=7fc35bd88830
000d:Call ntdll.RtlEnterCriticalSection(7fc35bfd1540) ret=7fc35bd93be7
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd93be7
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000078) ret=7fc35bd97435
000d:Ret  ntdll.RtlAllocateHeap() retval=0001e930 ret=7fc35bd97435
000d:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7fc35bd97454
000d:Call ntdll.NtCreateEvent(0023f5a0,001f0003,0023f5b8,00000001,00000000) ret=7b4807a4
000d:Ret  ntdll.NtCreateEvent() retval=00000000 ret=7b4807a4
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b4807b9
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b4807b9
000d:Ret  KERNEL32.CreateEventW() retval=00000028 ret=7fc35bd97454
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000009) ret=7fc35bd887b0
000d:Ret  ntdll.RtlAllocateHeap() retval=0001e9c0 ret=7fc35bd887b0
000d:Call KERNEL32.InitializeCriticalSection(0001e960) ret=7fc35bd93d0c
000d:Call ntdll.RtlInitializeCriticalSectionEx(0001e960,00000000,00000000) ret=7b480484
000d:Ret  ntdll.RtlInitializeCriticalSectionEx() retval=00000000 ret=7b480484
000d:Ret  KERNEL32.InitializeCriticalSection() retval=00000001 ret=7fc35bd93d0c
000d:Call ntdll.RtlLeaveCriticalSection(7fc35bfd1540) ret=7fc35bd93d9d
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd93d9d
000d:Call ntdll.RtlFreeHeap(00010000,00000000,0001e900) ret=7fc35bd88e16
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7fc35bd88e16
000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0023fb2e L"\\pipe\\svcctl",ffffffff,00000000,00000000,00000000,00000000) ret=7fc35bd887f0
000d:Ret  KERNEL32.WideCharToMultiByte() retval=0000000d ret=7fc35bd887f0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000d) ret=7fc35bd8880e
000d:Ret  ntdll.RtlAllocateHeap() retval=0001e900 ret=7fc35bd8880e
000d:Call KERNEL32.WideCharToMultiByte(00000000,00000000,0023fb2e L"\\pipe\\svcctl",ffffffff,0001e900,0000000d,00000000,00000000) ret=7fc35bd88830
000d:Ret  KERNEL32.WideCharToMultiByte() retval=0000000d ret=7fc35bd88830
000d:Call ntdll.RtlEnterCriticalSection(0001e960) ret=7fc35bd92f93
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd92f93
000d:Call ntdll.RtlEnterCriticalSection(0001e960) ret=7fc35bd92f9b
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd92f9b
000d:Call ntdll.RtlLeaveCriticalSection(0001e960) ret=7fc35bd92fd2
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd92fd2
000d:Call ntdll.RtlAllocateHeap(00010000,00000008,000000e0) ret=7fc35bd97055
000d:Ret  ntdll.RtlAllocateHeap() retval=0001ea30 ret=7fc35bd97055
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000d) ret=7fc35bd887b0
000d:Ret  ntdll.RtlAllocateHeap() retval=0001eb20 ret=7fc35bd887b0
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7fc35bd9edbd
000d:Ret  ntdll.RtlAllocateHeap() retval=0001eb50 ret=7fc35bd9edbd
000d:Call KERNEL32.CreateNamedPipeA(0001eb50 "\\\\.\\pipe\\svcctl",00000003,00000006,000000ff,000016d0,000016d0,00001388,00000000) ret=7fc35bd9865c
000d:Call ntdll.RtlDosPathNameToNtPathName_U(0023f350 L"\\\\.\\pipe\\svcctl",0023f1c8,00000000,00000000) ret=7b482c3c
000d:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b482c3c
000d:Call ntdll.NtCreateNamedPipeFile(0023f1b8,c0100000,0023f1e8,0023f1d8,3363663700000003,00000005,3363663700000020,6335363800000001,3363663700000001,7fc300000000,ffffffff,000016d0,000016d0,0023f1c0) ret=7b482e0e
000d:Ret  ntdll.NtCreateNamedPipeFile() retval=00000000 ret=7b482e0e
000d:Call ntdll.RtlFreeUnicodeString(0023f1c8) ret=7b482e18
000d:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b482e18
000d:Ret  KERNEL32.CreateNamedPipeA() retval=0000002c ret=7fc35bd9865c
000d:Call ntdll.RtlFreeHeap(00010000,00000000,0001eb50) ret=7fc35bd9ede2
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7fc35bd9ede2
000d:Call ntdll.RtlEnterCriticalSection(0001e960) ret=7fc35bd9c653
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd9c653
000d:Call ntdll.RtlLeaveCriticalSection(0001e960) ret=7fc35bd9c66f
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd9c66f
000d:Call ntdll.RtlLeaveCriticalSection(0001e960) ret=7fc35bd92ff9
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd92ff9
000d:Call ntdll.RtlFreeHeap(00010000,00000000,0001e900) ret=7fc35bd88e16
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7fc35bd88e16
000d:Ret  rpcrt4.RpcServerUseProtseqEpW() retval=00000000 ret=7fc35bfec1e6
000d:Call rpcrt4.RpcServerRegisterIf(7fc35c205a60,00000000,00000000) ret=7fc35bfec221
000d:Call ntdll.RtlAllocateHeap(00010000,00000008,00000060) ret=7fc35bd94cd0
000d:Ret  ntdll.RtlAllocateHeap() retval=0001eb50 ret=7fc35bd94cd0
000d:Call ntdll.RtlEnterCriticalSection(7fc35bfd1540) ret=7fc35bd94d29
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd94d29
000d:Call ntdll.RtlLeaveCriticalSection(7fc35bfd1540) ret=7fc35bd94d5c
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd94d5c
000d:Ret  rpcrt4.RpcServerRegisterIf() retval=00000000 ret=7fc35bfec221
000d:Call rpcrt4.RpcServerListen(00000001,000004d2,00000001) ret=7fc35bfec259
000d:Call ntdll.RtlEnterCriticalSection(7fc35bfd14c0) ret=7fc35bd92eae
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd92eae
000d:Call ntdll.RtlLeaveCriticalSection(7fc35bfd14c0) ret=7fc35bd92f00
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd92f00
000d:Call ntdll.RtlEnterCriticalSection(7fc35bfd1540) ret=7fc35bd92f24
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd92f24
000d:Call ntdll.RtlEnterCriticalSection(7fc35bfd14c0) ret=7fc35bd92dc4
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd92dc4
000d:Call KERNEL32.CreateMutexW(00000000,00000000,00000000) ret=7fc35bd92de9
000d:Call ntdll.NtCreateMutant(0023f750,001f0001,0023f768,00000000) ret=7b480f2c
000d:Ret  ntdll.NtCreateMutant() retval=00000000 ret=7b480f2c
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b480f41
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b480f41
000d:Ret  KERNEL32.CreateMutexW() retval=00000030 ret=7fc35bd92de9
000d:Call KERNEL32.CreateEventW(00000000,00000000,00000000,00000000) ret=7fc35bd92e0b
000d:Call ntdll.NtCreateEvent(0023f740,001f0003,0023f758,00000001,00000000) ret=7b4807a4
000d:Ret  ntdll.NtCreateEvent() retval=00000000 ret=7b4807a4
000d:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b4807b9
000d:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b4807b9
000d:Ret  KERNEL32.CreateEventW() retval=00000034 ret=7fc35bd92e0b
000d:Call KERNEL32.CreateThread(00000000,00000000,7fc35bd9267b,0001e930,00000000,00000000) ret=7fc35bd92e33
000d:Call ntdll.RtlCreateUserThread(ffffffffffffffff,00000000,00000001,00000000,00000000,00000000,7fc35bd9267b,0001e930,0023f740,0023f748) ret=7b4872ed
000d:Ret  ntdll.RtlCreateUserThread() retval=00000000 ret=7b4872ed
000d:Call ntdll.NtResumeThread(00000038,0023f73c) ret=7b487337
000d:Ret  ntdll.NtResumeThread() retval=00000000 ret=7b487337
000d:Ret  KERNEL32.CreateThread() retval=00000038 ret=7fc35bd92e33
000d:Call KERNEL32.CloseHandle(00000038) ret=7fc35bd92e4f
000d:Call ntdll.NtClose(00000038) ret=7b4701d0
000d:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000d:Ret  KERNEL32.CloseHandle() retval=00000001 ret=7fc35bd92e4f
000d:Call ntdll.RtlLeaveCriticalSection(7fc35bfd14c0) ret=7fc35bd92e65
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd92e65
000d:Call KERNEL32.WaitForSingleObject(00000030,ffffffff) ret=7fc35bd9283c
000d:Call ntdll.NtWaitForMultipleObjects(00000001,0023f548,00000001,00000000,00000000) ret=7b47fb17
000d:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
000d:Ret  KERNEL32.WaitForSingleObject() retval=00000000 ret=7fc35bd9283c
000d:Call KERNEL32.SetEvent(00000028) ret=7fc35bd973fc
000d:Call ntdll.NtSetEvent(00000028,00000000) ret=7b480d81
000d:Ret  ntdll.NtSetEvent() retval=00000000 ret=7b480d81
000d:Ret  KERNEL32.SetEvent() retval=00000001 ret=7fc35bd973fc
000d:Call KERNEL32.WaitForSingleObject(00000034,ffffffff) ret=7fc35bd92859
000d:Call ntdll.NtWaitForMultipleObjects(00000001,0023f548,00000001,00000000,00000000) ret=7b47fb17
000e:Call PE DLL (proc=0x7fc35bda174d,module=0x7fc35bd60000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=0)
000e:Ret  PE DLL (proc=0x7fc35bda174d,module=0x7fc35bd60000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=0) retval=1
000e:Starting thread proc 0x7fc35bd9267b (arg=0x1e930)
000e:Call ntdll.RtlEnterCriticalSection(0001e960) ret=7fc35bd97258
000e:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd97258
000e:Call KERNEL32.CreateThread(00000000,00000000,7fc35bd98802,0001ea30,00000000,00000000) ret=7fc35bd9729b
000e:Call ntdll.RtlCreateUserThread(ffffffffffffffff,00000000,00000001,00000000,00000000,00000000,7fc35bd98802,0001ea30,0033ed80,0033ed88) ret=7b4872ed
000e:Ret  ntdll.RtlCreateUserThread() retval=00000000 ret=7b4872ed
000e:Call ntdll.NtResumeThread(00000038,0033ed7c) ret=7b487337
000e:Ret  ntdll.NtResumeThread() retval=00000000 ret=7b487337
000e:Ret  KERNEL32.CreateThread() retval=00000038 ret=7fc35bd9729b
000e:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7fc35bd97349
000e:Ret  ntdll.RtlAllocateHeap() retval=0001e900 ret=7fc35bd97349
000f:Call PE DLL (proc=0x7fc35bda174d,module=0x7fc35bd60000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=0)
000f:Ret  PE DLL (proc=0x7fc35bda174d,module=0x7fc35bd60000 L"rpcrt4.dll",reason=THREAD_ATTACH,res=0) retval=1
000f:Starting thread proc 0x7fc35bd98802 (arg=0x1ea30)
000f:Call KERNEL32.ConnectNamedPipe(0000002c,00000000) ret=7fc35bd98865
000f:Call ntdll.NtFsControlFile(0000002c,00000000,00000000,00000000,0043ee88,00110008,00000000,7fc300000000,00000000,00000000) ret=7b483757
000e:Call ntdll.RtlLeaveCriticalSection(0001e960) ret=7fc35bd973d7
000e:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd973d7
000e:Call KERNEL32.WaitForMultipleObjectsEx(00000002,0001e900,00000000,ffffffff,00000001) ret=7fc35bd9c331
000e:Call ntdll.NtWaitForMultipleObjects(00000002,0033eb98,00000001,00000001,00000000) ret=7b47fb17
000e:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
000e:Ret  KERNEL32.WaitForMultipleObjectsEx() retval=00000000 ret=7fc35bd9c331
000e:Call ntdll.RtlEnterCriticalSection(0001e960) ret=7fc35bd97258
000e:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bd97258
000e:Call ntdll.RtlReAllocateHeap(00010000,00000000,0001e900,00000010) ret=7fc35bd9732b
000e:Ret  ntdll.RtlReAllocateHeap() retval=0001e900 ret=7fc35bd9732b
000e:Call ntdll.RtlLeaveCriticalSection(0001e960) ret=7fc35bd973d7
000e:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd973d7
000e:Call KERNEL32.SetEvent(00000034) ret=7fc35bd9273f
000e:Call ntdll.NtSetEvent(00000034,00000000) ret=7b480d81
000e:Ret  ntdll.NtSetEvent() retval=00000000 ret=7b480d81
000d:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
000d:Ret  KERNEL32.WaitForSingleObject() retval=00000000 ret=7fc35bd92859
000d:Call KERNEL32.ReleaseMutex(00000030) ret=7fc35bd92862
000d:Call ntdll.NtReleaseMutant(00000030,00000000) ret=7b481494
000e:Ret  KERNEL32.SetEvent() retval=00000001 ret=7fc35bd9273f
000d:Ret  ntdll.NtReleaseMutant() retval=00000000 ret=7b481494
000d:Ret  KERNEL32.ReleaseMutex() retval=00000001 ret=7fc35bd92862
000d:Call ntdll.RtlLeaveCriticalSection(7fc35bfd1540) ret=7fc35bd92f6c
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bd92f6c
000d:Ret  rpcrt4.RpcServerListen() retval=00000000 ret=7fc35bfec259
000d:Call ntdll.__wine_make_process_system() ret=7fc35bfec29b
000d:Ret  ntdll.__wine_make_process_system() retval=00000040 ret=7fc35bfec29b
000d:Call ntdll.RtlAllocateHeap(00010000,00000000,00000100) ret=7fc35bfe65ca
000d:Ret  ntdll.RtlAllocateHeap() retval=0001ec10 ret=7fc35bfe65ca
000d:Call ntdll.RtlEnterCriticalSection(0001e7f0) ret=7fc35bfecc16
000d:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7fc35bfecc16
000d:Call ntdll.RtlLeaveCriticalSection(0001e7f0) ret=7fc35bfecc28
000d:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7fc35bfecc28
000d:Call ntdll.RtlFreeHeap(00010000,00000000,0001ec10) ret=7fc35bfe6732
000d:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7fc35bfe6732
000d:Call KERNEL32.SetEvent(00000018) ret=7fc35bfe6744
000d:Call ntdll.NtSetEvent(00000018,00000000) ret=7b480d81
000b:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
000b:Ret  KERNEL32.WaitForMultipleObjects() retval=00000000 ret=7f328ffe6944
000b:Call KERNEL32.CloseHandle(00000028) ret=7f328ffe69ac
000b:Call ntdll.NtClose(00000028) ret=7b4701d0
000d:Ret  ntdll.NtSetEvent() retval=00000000 ret=7b480d81
000d:Ret  KERNEL32.SetEvent() retval=00000001 ret=7fc35bfe6744
000d:Call KERNEL32.WaitForSingleObject(00000040,ffffffff) ret=7fc35bfe6756
000d:Call ntdll.NtWaitForMultipleObjects(00000001,0023f758,00000001,00000000,00000000) ret=7b47fb17
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Ret  KERNEL32.CloseHandle() retval=00000001 ret=7f328ffe69ac
000b:Call KERNEL32.CloseHandle(00000020) ret=7f328ffe69b9
000b:Call ntdll.NtClose(00000020) ret=7b4701d0
000b:Ret  ntdll.NtClose() retval=00000000 ret=7b4701d0
000b:Ret  KERNEL32.CloseHandle() retval=00000001 ret=7f328ffe69b9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000020) ret=7f328ffe6a0f
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ca00 ret=7f328ffe6a0f
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001e) ret=7f328ffe6b26
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ca30 ret=7f328ffe6b26
000e:Call KERNEL32.WaitForMultipleObjectsEx(00000002,0001e900,00000000,ffffffff,00000001) ret=7fc35bd9c331
000e:Call ntdll.NtWaitForMultipleObjects(00000002,0033eb98,00000001,00000001,00000000) ret=7b47fb17
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ca30) ret=7f328ffe6c9b
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe6c9b
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ca00) ret=7f328ffe6e81
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328ffe6e81
000b:Call advapi32.RegCreateKeyExW(ffffffff80000001,7f328ffea220 L"Volatile Environment",00000000,00000000,00000001,000f003f,00000000,0023ed30,00000000) ret=7f328ffe6eba
000b:Call ntdll.RtlOpenCurrentUser(02000000,0023e9b0) ret=7f328fd7d8e1
000b:Ret  ntdll.RtlOpenCurrentUser() retval=00000000 ret=7f328fd7d8e1
000b:Call ntdll.RtlInitUnicodeString(0023ea68,7f328ffea220 L"Volatile Environment") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ea78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023e9d0,000f003f,0023ea88,00000000,0023ea78,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328ffe6eba
000b:Call KERNEL32.LoadLibraryA(7f32901f2c70 "shell32.dll") ret=7f328ffe93c7
000b:Call ntdll.RtlInitAnsiString(0023e9c8,7f32901f2c70 "shell32.dll") ret=7b44b379
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b44b379
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023e9c8,00000000) ret=7b44b3c3
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b44b3c3
000b:Call ntdll.RtlInitUnicodeString(0023e928,7fffff7e9268 L"shell32.dll") ret=7b466f2a
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7b466f2a
000b:Call ntdll.RtlInitUnicodeString(0023e838,7b4a1308 L"PATH") ret=7b466ac8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0023e838,0023e848) ret=7b466b02
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000b:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ca00 ret=7b453b54
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0023e838,0023e848) ret=7b466c3a
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000b:Call ntdll.LdrLoadDll(0001ca00 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;",00000000,0023e928,0023e8a8) ret=7b466ddc
000b:Call PE DLL (proc=0x7f328efe1ba8,module=0x7f328ef60000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0)
000b:Call KERNEL32.DisableThreadLibraryCalls(7f328ef60000) ret=7f328efcaf0b
000b:Call ntdll.LdrDisableThreadCalloutsForDll(7f328ef60000) ret=7b465737
000b:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000b:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7f328efcaf0b
000b:Call advapi32.RegOpenKeyA(ffffffff80000002,7f328efeb891 "System\\CurrentControlSet\\Hardware Profiles\\Current\\Software\\Fonts",0023e128) ret=7f328efc82b7
000b:Call KERNEL32.GetVersion() ret=7f328fd7f4d3
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7f4d3
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efeb891 "System\\CurrentControlSet\\Hardware Profiles\\Current\\Software\\Fonts") ret=7f328fd7f558
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7f558
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023dec8,00000000) ret=7f328fd7f566
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7f566
000b:Call ntdll.NtOpenKeyEx(0023e128,02000000,0023ded8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=c0000034 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7f584
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7f584
000b:Ret  advapi32.RegOpenKeyA() retval=00000002 ret=7f328efc82b7
000b:Call advapi32.RegCreateKeyExA(ffffffff80000001,7f328efeb0c2 "Software\\Wine\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e128,00000000) ret=7f328efc8314
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de98,7f328efeb0c2 "Software\\Wine\\Fonts") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023dea8,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de98,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de88,0023dea8,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023ddf0,000f003f,0023deb8,00000000,0023de88,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023ddf0,000f003f,0023deb8,00000000,0023de88,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023ddf0,000f003f,0023deb8,00000000,0023de88,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000028) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023ddf0,000f003f,0023deb8,00000000,0023de88,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlFreeUnicodeString(0023de88) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyExA() retval=00000000 ret=7f328efc8314
000b:Call advapi32.RegQueryValueExW(00000028,7f328efed510 L"LogPixels",00000000,0023e0b0,0023e120,0023e0b4) ret=7f328efbcf30
000b:Call ntdll.RtlInitUnicodeString(0023dcb8,7f328efed510 L"LogPixels") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000028,0023dcb8,00000002,0023dcc8,00000010,0023dcb4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328efbcf30
000b:Call KERNEL32.GetLocaleInfoW(00000400,a0001004,0023e114,00000002) ret=7f328efc8354
000b:Call ntdll.LdrFindResource_U(7b420000,0023dc98,00000003,0023dc70) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b6693b0,0023ddf0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000a) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Ret  KERNEL32.GetLocaleInfoW() retval=00000002 ret=7f328efc8354
000b:Call KERNEL32.GetLocaleInfoW(00000400,a000000b,0023e118,00000002) ret=7f328efc836e
000b:Call ntdll.LdrFindResource_U(7b420000,0023dc98,00000003,0023dc70) ret=7b47b93e
000b:Ret  ntdll.LdrFindResource_U() retval=00000000 ret=7b47b93e
000b:Call ntdll.LdrAccessResource(7b420000,7b664ab0,0023ddf0,00000000) ret=7b47e5b0
000b:Ret  ntdll.LdrAccessResource() retval=00000000 ret=7b47e5b0
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000008) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7b453b54
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Ret  KERNEL32.GetLocaleInfoW() retval=00000002 ret=7f328efc836e
000b:Call advapi32.RegQueryValueExA(00000028,7f328efeb8d9 "Codepages",00000000,0023e110,0023e168,0023e10c) ret=7f328efc83f4
000b:Call ntdll.RtlInitAnsiString(0023dcc8,7f328efeb8d9 "Codepages") ret=7f328fd7e309
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7e309
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023dcd8,0023dcc8,00000001) ret=7f328fd7e324
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7e324
000b:Call ntdll.NtQueryValueKey(00000028,0023dcd8,00000002,0023dce8,7ffffffa00000100,0023dcc0) ret=7f328fd7e36c
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e36c
000b:Call ntdll.RtlFreeUnicodeString(0023dcd8) ret=7f328fd7e4e9
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7e4e9
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e4f0
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e4f0
000b:Ret  advapi32.RegQueryValueExA() retval=00000002 ret=7f328efc83f4
000b:Call advapi32.RegSetValueExA(00000028,7f328efeb8d9 "Codepages",00000000,00000001,0023e190,00000009) ret=7f328efc84f0
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023df08,0023e190 "1252,437",00000009) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000012) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000012,00000000,0023e190,00000009) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023def8,7f328efeb8d9 "Codepages") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023def8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(00000028,0023df08,00000000,00000001,0001e830,7f3200000012) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efc84f0
000b:Call advapi32.RegSetValueExW(00000028,7f328efed510 L"LogPixels",00000000,00000004,0023e11c,00000004) ret=7f328efc851d
000b:Call ntdll.RtlInitUnicodeString(0023df18,7f328efed510 L"LogPixels") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000028,0023df18,00000000,00000004,0023e11c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc851d
000b:Call advapi32.RegCloseKey(00000028) ret=7f328efc8531
000b:Call ntdll.NtClose(00000028) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8531
000b:Call advapi32.RegCreateKeyExW(ffffffff80000005,7f328efedef0 L"Software\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e138,00000000) ret=7f328efc859e
000b:Call ntdll.RtlInitUnicodeString(0023ddf8,7f328fdaa980 L"\\Registry\\Machine\\System\\CurrentControlSet\\Hardware Profiles\\Current") ret=7f328fd7d97f
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000008a ret=7f328fd7d97f
000b:Call ntdll.NtCreateKey(0023dd80,02000000,0023de08,00000000,00000000,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023dd80,02000000,0023de08,00000000,00000000,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023dd80,02000000,0023de08,00000000,00000000,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000028) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dd80,02000000,0023de08,00000000,00000000,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dd80,02000000,0023de08,00000000,00000000,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000028) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dd80,02000000,0023de08,00000000,00000000,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedef0 L"Software\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc859e
000b:Call advapi32.RegSetValueExA(00000030,7f328efeb966 "OEMFONT.FON",00000000,00000001,7f328efec119,0000000b) ret=7f328efc85e2
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023df08,7f328efec119 "vgaoem.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec119,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023def8,7f328efeb966 "OEMFONT.FON") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023def8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(00000030,0023df08,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efc85e2
000b:Call advapi32.RegSetValueExA(00000030,7f328efeb972 "FIXEDFON.FON",00000000,00000001,7f328efec8c3,0000000b) ret=7f328efc861b
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023df08,7f328efec8c3 "vgafix.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec8c3,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023def8,7f328efeb972 "FIXEDFON.FON") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023def8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(00000030,0023df08,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efc861b
000b:Call advapi32.RegSetValueExA(00000030,7f328efeb97f "FONTS.FON",00000000,00000001,7f328efec8cf,0000000b) ret=7f328efc8654
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023df08,7f328efec8cf "vgasys.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec8cf,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023def8,7f328efeb97f "FONTS.FON") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023def8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(00000030,0023df08,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efc8654
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc8665
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8665
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e138,00000000) ret=7f328efc869f
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000066 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000030) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000030) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc869f
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea914 "Courier",00000000,00000001,7f328efec124,0000000a) ret=7f328efbcffd
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec124 "coure.fon",0000000a) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000014) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000014,00000000,7f328efec124,0000000a) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea914 "Courier") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000014) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbcffd
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea91c "MS Serif",00000000,00000001,7f328efec12f,0000000b) ret=7f328efbd02f
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec12f "serife.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec12f,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea91c "MS Serif") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbd02f
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea925 "MS Sans Serif",00000000,00000001,7f328efec12e,0000000c) ret=7f328efbd05e
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec12e "sserife.fon",0000000c) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000018) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000018,00000000,7f328efec12e,0000000c) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea925 "MS Sans Serif") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000018) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbd05e
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea933 "Small Fonts",00000000,00000001,7f328efec844,0000000b) ret=7f328efbd090
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec844 "smalle.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec844,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea933 "Small Fonts") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbd090
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc86d0
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc86d0
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328efedfa0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e138,00000000) ret=7f328efc870a
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedfa0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000060 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc870a
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea914 "Courier",00000000,00000001,7f328efec124,0000000a) ret=7f328efbcffd
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec124 "coure.fon",0000000a) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000014) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000014,00000000,7f328efec124,0000000a) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea914 "Courier") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000014) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbcffd
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea91c "MS Serif",00000000,00000001,7f328efec12f,0000000b) ret=7f328efbd02f
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec12f "serife.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec12f,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea91c "MS Serif") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbd02f
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea925 "MS Sans Serif",00000000,00000001,7f328efec12e,0000000c) ret=7f328efbd05e
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec12e "sserife.fon",0000000c) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000018) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000018,00000000,7f328efec12e,0000000c) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea925 "MS Sans Serif") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000018) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbd05e
000b:Call advapi32.RegSetValueExA(0000002c,7f328efea933 "Small Fonts",00000000,00000001,7f328efec844,0000000b) ret=7f328efbd090
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023ded8,7f328efec844 "smalle.fon",0000000b) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000016) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000016,00000000,7f328efec844,0000000b) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efea933 "Small Fonts") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023ded8,0023dec8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023ded8,00000000,00000001,0001e830,7f3200000016) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023ded8) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efbd090
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc873b
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc873b
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc8751
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc8751
000b:Call advapi32.RegSetValueExA(0000002c,7f328efeb9c6 "MS Shell Dlg",00000000,00000001,7f328efec146,00000007) ret=7f328efc8790
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023df08,7f328efec146 "Tahoma",00000007) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,0000000e,00000000,7f328efec146,00000007) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023def8,7f328efeb9c6 "MS Shell Dlg") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023def8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023df08,00000000,00000001,0001e830,7f320000000e) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efc8790
000b:Call advapi32.RegSetValueExA(0000002c,7f328efeb9d3 "Tms Rmn",00000000,00000001,7f328efec14d,00000010) ret=7f328efc87c9
000b:Call KERNEL32.GetVersion() ret=7f328fd809e1
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd809e1
000b:Call ntdll.RtlMultiByteToUnicodeSize(0023df08,7f328efec14d "Times New Roman",00000010) ret=7f328fd80a6d
000b:Ret  ntdll.RtlMultiByteToUnicodeSize() retval=00000000 ret=7f328fd80a6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000020) ret=7f328fd7d199
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328fd7d199
000b:Call ntdll.RtlMultiByteToUnicodeN(0001e830,00000020,00000000,7f328efec14d,00000010) ret=7f328fd80a9c
000b:Ret  ntdll.RtlMultiByteToUnicodeN() retval=00000000 ret=7f328fd80a9c
000b:Call ntdll.RtlInitAnsiString(0023def8,7f328efeb9d3 "Tms Rmn") ret=7f328fd80ab4
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd80ab4
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023def8,00000001) ret=7f328fd80ac5
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd80ac5
000b:Call ntdll.NtSetValueKey(0000002c,0023df08,00000000,00000001,0001e830,7f3200000020) ret=7f328fd80ae8
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd80ae8
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd80af3
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd80af3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328fd7d1b9
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328fd7d1b9
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80b00
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80b00
000b:Ret  advapi32.RegSetValueExA() retval=00000000 ret=7f328efc87c9
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeb9db "Fixedsys,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeb9db "Fixedsys,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeb9e6 "System,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeb9e6 "System,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeb9ef "Courier,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeb9ef "Courier,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeb9f9 "MS Serif,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeb9f9 "MS Serif,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeba04 "Small Fonts,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeba04 "Small Fonts,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeba12 "MS Sans Serif,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeba12 "MS Sans Serif,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeba22 "Helv,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeba22 "Helv,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efeba29 "Tms Rmn,0") ret=7f328efc495b
000b:Call ntdll.RtlInitAnsiString(0023df08,7f328efeba29 "Tms Rmn,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023def8,0023df08,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023def8) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023def8) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc495b
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec213 "Arial CE,0") ret=7f328efc890a
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec213 "Arial CE,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc890a
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec228 "Courier New CE,0") ret=7f328efc892b
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec228 "Courier New CE,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc892b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec239 "Times New Roman CE,0") ret=7f328efc894c
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec239 "Times New Roman CE,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc894c
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec30d "Arial Cyr,0") ret=7f328efc890a
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec30d "Arial Cyr,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc890a
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec323 "Courier New Cyr,0") ret=7f328efc892b
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec323 "Courier New Cyr,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc892b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec335 "Times New Roman Cyr,0") ret=7f328efc894c
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec335 "Times New Roman Cyr,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc894c
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec40a "Arial Greek,0") ret=7f328efc890a
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec40a "Arial Greek,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc890a
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec422 "Courier New Greek,0") ret=7f328efc892b
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec422 "Courier New Greek,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc892b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec436 "Times New Roman Greek,0") ret=7f328efc894c
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec436 "Times New Roman Greek,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc894c
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec50d "Arial Tur,0") ret=7f328efc890a
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec50d "Arial Tur,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc890a
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec523 "Courier New Tur,0") ret=7f328efc892b
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec523 "Courier New Tur,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc892b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec535 "Times New Roman Tur,0") ret=7f328efc894c
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec535 "Times New Roman Tur,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc894c
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec795 "Arial Baltic,0") ret=7f328efc890a
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec795 "Arial Baltic,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc890a
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec7ae "Courier New Baltic,0") ret=7f328efc892b
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec7ae "Courier New Baltic,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc892b
000b:Call advapi32.RegDeleteValueA(0000002c,7f328efec7c3 "Times New Roman Baltic,0") ret=7f328efc894c
000b:Call ntdll.RtlInitAnsiString(0023df18,7f328efec7c3 "Times New Roman Baltic,0") ret=7f328fd82a24
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd82a24
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023df08,0023df18,00000001) ret=7f328fd82a35
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd82a35
000b:Call ntdll.NtDeleteValueKey(0000002c,0023df08) ret=7f328fd82a46
000b:Ret  ntdll.NtDeleteValueKey() retval=c0000034 ret=7f328fd82a46
000b:Call ntdll.RtlFreeUnicodeString(0023df08) ret=7f328fd82a50
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd82a50
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd82a66
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd82a66
000b:Ret  advapi32.RegDeleteValueA() retval=00000002 ret=7f328efc894c
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegCreateKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e130) ret=7f328efc88e5
000b:Call KERNEL32.GetVersion() ret=7f328fd7edeb
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7edeb
000b:Call ntdll.RtlInitAnsiString(0023de88,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7ee87
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7ee87
000b:Call ntdll.RtlInitAnsiString(0023de98,00000000) ret=7f328fd7ee92
000b:Ret  ntdll.RtlInitAnsiString() retval=7bc702ca ret=7f328fd7ee92
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023de88,00000000) ret=7f328fd7eead
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eead
000b:Call ntdll.RtlAnsiStringToUnicodeString(0023de78,0023de98,00000001) ret=7f328fd7eec7
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7eec7
000b:Call ntdll.NtCreateKey(0023dde0,02000000,0023dea8,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlFreeUnicodeString(0023de78) ret=7f328fd7eef0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd7eef0
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7eefb
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7eefb
000b:Ret  advapi32.RegCreateKeyA() retval=00000000 ret=7f328efc88e5
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc8961
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8961
000b:Call advapi32.RegDeleteTreeA(ffffffff80000002,7f328efec0ee "System\\CurrentControlSet\\Control\\FontAssoc") ret=7f328efca95c
000b:Call ntdll.RtlCreateUnicodeStringFromAsciiz(0023df48,7f328efec0ee "System\\CurrentControlSet\\Control\\FontAssoc") ret=7f328fd84864
000b:Ret  ntdll.RtlCreateUnicodeStringFromAsciiz() retval=00000001 ret=7f328fd84864
000b:Call ntdll.RtlInitUnicodeString(0023dc88,0001e830 L"System\\CurrentControlSet\\Control\\FontAssoc") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000056 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023de18,00020019,0023dc98,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=c0000034 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7f3a1
000b:Call ntdll.RtlFreeUnicodeString(0023df48) ret=7f328fd84888
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7f328fd84888
000b:Ret  advapi32.RegDeleteTreeA() retval=00000002 ret=7f328efca95c
000b:Call advapi32.RegCreateKeyW(ffffffff80000002,7f328efed900 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",0023e138) ret=7f328efc8a65
000b:Call ntdll.RtlInitUnicodeString(0023de98,7f328efed900 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dea8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000030) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000030) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023de00,02000000,0023deb8,00000000,0023dea8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000002c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328efc8a65
000b:Call advapi32.RegSetValueExW(00000030,7f328efede00 L"Lucida Sans Unicode",00000000,00000007,7f328efed140,000000a4) ret=7f328efbf5e7
000b:Call ntdll.RtlInitUnicodeString(0023df08,7f328efede00 L"Lucida Sans Unicode") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df08,00000000,00000007,7f328efed140,000000a4) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbf5e7
000b:Call advapi32.RegSetValueExW(00000030,7f328efeddc0 L"Microsoft Sans Serif",00000000,00000007,7f328efed140,000000a4) ret=7f328efbf5e7
000b:Call ntdll.RtlInitUnicodeString(0023df08,7f328efeddc0 L"Microsoft Sans Serif") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df08,00000000,00000007,7f328efed140,000000a4) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbf5e7
000b:Call advapi32.RegSetValueExW(00000030,7f328efeddb0 L"Tahoma",00000000,00000007,7f328efed140,000000a4) ret=7f328efbf5e7
000b:Call ntdll.RtlInitUnicodeString(0023df08,7f328efeddb0 L"Tahoma") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df08,00000000,00000007,7f328efed140,000000a4) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbf5e7
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc8ad9
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc8ad9
000b:Call advapi32.RegOpenKeyExW(ffffffff80000001,7f328efedb80 L"Software\\Wine\\Fonts",00000000,00020019,0023e120) ret=7f328efc9689
000b:Call ntdll.RtlInitUnicodeString(0023def8,7f328efedb80 L"Software\\Wine\\Fonts") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023e120,00020019,0023df08,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyExW() retval=00000000 ret=7f328efc9689
000b:Call advapi32.RegQueryValueExW(0000002c,7f328efed560 L"AntialiasFakeBoldOrItalic",00000000,0023e130,0023e140,0023e138) ret=7f328efc96cc
000b:Call ntdll.RtlInitUnicodeString(0023dcd8,7f328efed560 L"AntialiasFakeBoldOrItalic") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000034 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(0000002c,0023dcd8,00000002,0023dce8,00000034,0023dcd4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328efc96cc
000b:Call advapi32.RegCloseKey(0000002c) ret=7f328efc971d
000b:Call ntdll.NtClose(0000002c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc971d
000b:Call KERNEL32.CreateMutexW(00000000,00000000,7f328efed9e0 L"__WINE_FONT_MUTEX__") ret=7f328efc9735
000b:Call ntdll.RtlInitUnicodeString(0023dee8,7f328efed9e0 L"__WINE_FONT_MUTEX__") ret=7b480eff
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7b480eff
000b:Call ntdll.NtCreateMutant(0023dee0,001f0001,0023def8,00000000) ret=7b480f2c
000b:Ret  ntdll.NtCreateMutant() retval=00000000 ret=7b480f2c
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7b480f41
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7b480f41
000b:Ret  KERNEL32.CreateMutexW() retval=0000002c ret=7f328efc9735
000b:Call KERNEL32.WaitForSingleObject(0000002c,ffffffff) ret=7f328efc978c
000b:Call ntdll.NtWaitForMultipleObjects(00000001,0023dcc8,00000001,00000000,00000000) ret=7b47fb17
000b:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7b47fb17
000b:Ret  KERNEL32.WaitForSingleObject() retval=00000000 ret=7f328efc978c
000b:Call advapi32.RegCreateKeyExW(ffffffff80000001,7f328efedb80 L"Software\\Wine\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e138,00000000) ret=7f328efc97c3
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedb80 L"Software\\Wine\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc97c3
000b:Call advapi32.RegCreateKeyExW(00000030,7f328efedb70 L"Cache",00000000,00000000,00000001,000f003f,00000000,7f328f225568,0023e110) ret=7f328efc9843
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedb70 L"Cache") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000001,0023e110) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc9843
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc9854
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc9854
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023da58,00000000) ret=7f328efc1349
000b:Call ntdll.RtlInitUnicodeString(0023d7e8,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000066 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d7f8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d750,000f003f,0023d808,00000000,0023d7f8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc1349
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328efedfa0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023da60,00000000) ret=7f328efc13aa
000b:Call ntdll.RtlInitUnicodeString(0023d7e8,7f328efedfa0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000060 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d7f8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d750,000f003f,0023d808,00000000,0023d7f8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc13aa
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328efede40 L"Software\\Wine\\Fonts\\External Fonts",0023da68) ret=7f328efc13ce
000b:Call ntdll.RtlInitUnicodeString(0023d7d8,7f328efede40 L"Software\\Wine\\Fonts\\External Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000046 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d7e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d740,02000000,0023d7f8,00000000,0023d7e8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328efc13ce
000b:Call advapi32.RegQueryInfoKeyW(0000003c,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0023da50,0023da4c,00000000,00000000) ret=7f328efc143a
000b:Call ntdll.NtQueryKey(0000003c,00000002,0023d6f8,00000100,0023d6f4) ret=7f328fd7fd2a
000b:Ret  ntdll.NtQueryKey() retval=00000000 ret=7f328fd7fd2a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ff18
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ff18
000b:Ret  advapi32.RegQueryInfoKeyW() retval=00000000 ret=7f328efc143a
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000002) ret=7f328efc1468
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328efc1468
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000000) ret=7f328efc1487
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e860 ret=7f328efc1487
000b:Call advapi32.RegEnumValueW(0000003c,00000000,0001e830,0023da48,00000000,0023da54,0001e860,0023da44) ret=7f328efc14d3
000b:Call ntdll.NtEnumerateValueKey(0000003c,00000000,00000001,0023d5f8,00000100,0023d5f4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=8000001a ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(8000001a) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000103 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000103 ret=7f328efc14d3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e860) ret=7f328efc152d
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc152d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328efc1544
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc1544
000b:Call advapi32.RegCloseKey(0000003c) ret=7f328efc154e
000b:Call ntdll.NtClose(0000003c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc154e
000b:Call advapi32.RegDeleteKeyW(ffffffff80000001,7f328efede40 L"Software\\Wine\\Fonts\\External Fonts") ret=7f328efc1561
000b:Call ntdll.RtlInitUnicodeString(0023d6f8,7f328efede40 L"Software\\Wine\\Fonts\\External Fonts") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000046 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023d860,00010000,0023d708,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Call ntdll.NtDeleteKey(0000003c) ret=7f328fd8052d
000b:Ret  ntdll.NtDeleteKey() retval=00000000 ret=7f328fd8052d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80534
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80534
000b:Call ntdll.NtClose(0000003c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegDeleteKeyW() retval=00000000 ret=7f328efc1561
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc1578
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc1578
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc158f
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc158f
000b:Call advapi32.RegOpenKeyW(ffffffff80000005,7f328efedef0 L"Software\\Fonts",0023da68) ret=7f328efc15af
000b:Call ntdll.RtlInitUnicodeString(0023d808,7f328efedef0 L"Software\\Fonts") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023da68,02000000,0023d818,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000000 ret=7f328efc15af
000b:Call KERNEL32.GetWindowsDirectoryW(0023dc78,00000104) ret=7f328efc15d4
000b:Ret  KERNEL32.GetWindowsDirectoryW() retval=0000000a ret=7f328efc15d4
000b:Call advapi32.RegQueryValueExW(00000030,7f328efedeb0 L"FONTS.FON",00000000,0023da60,0023da70,0023da58) ret=7f328efc162b
000b:Call ntdll.RtlInitUnicodeString(0023d618,7f328efedeb0 L"FONTS.FON") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000030,0023d618,00000002,0023d628,00000100,0023d614) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000000 ret=7f328efc162b
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\vgasys.fon") ret=7f328efc165b
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\vgasys.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0001e890 ret=7f328efc165b
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e890) ret=7f328efc16a4
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc16a4
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0023da70 L"vgasys.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e860 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0023da70 L"vgasys.fon",ffffffff,0001e87d,0000000b,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e830) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e8a0 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e830 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0001e830,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0001e860 "/usr/bin/../share/wine/fonts/vgasys.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000050) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e980 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0001e860 "/usr/bin/../share/wine/fonts/vgasys.fon",ffffffff,0001e980,00000028) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "System",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000007 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e9e0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "System",ffffffff,0001e9e0,00000007) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000007 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea10 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0001e9e0 L"System",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0001e9e0 L"System") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0001ea60 L"Regular\\832",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0001ea60 L"Regular\\832") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000003c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda30 L"File Name",00000000,00000001,0001e980,00000050) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000001,0001e980,00000050) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda50 L"Font Signature",00000000,00000003,0001e8f8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000003,0001e8f8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(00000040) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000040) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e860) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegQueryValueExW(00000030,7f328efede90 L"OEMFONT.FON",00000000,0023da60,0023da70,0023da58) ret=7f328efc162b
000b:Call ntdll.RtlInitUnicodeString(0023d618,7f328efede90 L"OEMFONT.FON") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000030,0023d618,00000002,0023d628,00000100,0023d614) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000000 ret=7f328efc162b
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\vgaoem.fon") ret=7f328efc165b
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\vgaoem.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002b8a0 ret=7f328efc165b
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002b8a0) ret=7f328efc16a4
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc16a4
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e860 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0023da70 L"vgaoem.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0023da70 L"vgaoem.fon",ffffffff,0001ea7d,0000000b,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e860) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegQueryValueExW(00000030,7f328efeded0 L"FIXEDFON.FON",00000000,0023da60,0023da70,0023da58) ret=7f328efc162b
000b:Call ntdll.RtlInitUnicodeString(0023d618,7f328efeded0 L"FIXEDFON.FON") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000030,0023d618,00000002,0023d628,00000100,0023d614) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000000 ret=7f328efc162b
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\vgafix.fon") ret=7f328efc165b
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\vgafix.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002b8a0 ret=7f328efc165b
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002b8a0) ret=7f328efc16a4
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc16a4
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e860 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0023da70 L"vgafix.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0023da70 L"vgafix.fon",ffffffff,0001ea7d,0000000b,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001e860) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0001eaa0 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0001eb80 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0001eb80,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0001ea60 "/usr/bin/../share/wine/fonts/vgafix.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000050) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002b8a0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0001ea60 "/usr/bin/../share/wine/fonts/vgafix.fon",ffffffff,0002b8a0,00000028) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "Fixedsys",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000009 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000012) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0001e860 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "Fixedsys",ffffffff,0001e860,00000009) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000009 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002b900 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0001e860 L"Fixedsys",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0001e860 L"Fixedsys") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0002b950 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0002b950 L"Regular\\768",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002b950 L"Regular\\768") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000003c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002b950) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda30 L"File Name",00000000,00000001,0002b8a0,00000050) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000001,0002b8a0,00000050) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda50 L"Font Signature",00000000,00000003,0001eaf8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000003,0001eaf8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(00000040) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000040) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc16bf
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc16bf
000b:Call KERNEL32.GetWindowsDirectoryW(0023dc78,00000104) ret=7f328efc16d4
000b:Ret  KERNEL32.GetWindowsDirectoryW() retval=0000000a ret=7f328efc16d4
000b:Call KERNEL32.wine_get_unix_file_name(0023dc78 L"C:\\windows\\fonts") ret=7f328efc16f3
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023dc78 L"C:\\windows\\fonts",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=00000000 ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002b9a0 ret=7f328efc16f3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002b9a0) ret=7f328efc1728
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc1728
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efbde6d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002b950 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ba30 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ba60 ret=7f328efbbe49
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/tahoma.ttf",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000050) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ba90 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/tahoma.ttf",ffffffff,0002ba90,00000028) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb48
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002baf0 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d584) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bb20 ret=7f328efbbe49
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002baf0) ret=7f328efbc01e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbc01e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bb50 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002bb20 L"Tahoma",00000000,00000000,00000001,000f003f,00000000,0023d738,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002bb20 L"Tahoma") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call advapi32.RegCreateKeyExW(00000030,0002ba30 L"Regular",00000000,00000000,00000001,000f003f,00000000,0023d740,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002ba30 L"Regular") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda30 L"File Name",00000000,00000001,0002ba90,00000050) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002ba90,00000050) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda10 L"Full Name",00000000,00000001,0002ba60,0000000e) ret=7f328efc0d16
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda10 L"Full Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002ba60,0000000e) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d16
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb38 L"Index",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb20 L"Ntmflags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb10 L"Version",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedaa8 L"Flags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda50 L"Font Signature",00000000,00000003,0002b9a8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000003,0002b9a8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bba0 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002baf0 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bc80 ret=7f328efbbe49
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/marlett.ttf",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000052) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bcb0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/marlett.ttf",ffffffff,0002bcb0,00000029) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb48
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bd20 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d584) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bd50 ret=7f328efbbe49
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002bd20) ret=7f328efbc01e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbc01e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bd80 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002bd50 L"Marlett",00000000,00000000,00000001,000f003f,00000000,0023d738,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002bd50 L"Marlett") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call advapi32.RegCreateKeyExW(00000030,0002baf0 L"Regular",00000000,00000000,00000001,000f003f,00000000,0023d740,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002baf0 L"Regular") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda30 L"File Name",00000000,00000001,0002bcb0,00000052) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002bcb0,00000052) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda10 L"Full Name",00000000,00000001,0002bc80,00000010) ret=7f328efc0d16
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda10 L"Full Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002bc80,00000010) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d16
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb38 L"Index",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb20 L"Ntmflags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb10 L"Version",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedaa8 L"Flags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda50 L"Font Signature",00000000,00000003,0002bbf8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000003,0002bbf8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bdd0 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000a) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bd20 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000018) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002beb0 ret=7f328efbbe49
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/tahomabd.ttf",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000002a ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000054) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bee0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/tahomabd.ttf",ffffffff,0002bee0,0000002a) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000002a ret=7f328efbbb48
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bf50 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d584) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bf80 ret=7f328efbbe49
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002bf50) ret=7f328efbc01e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbc01e
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002bf80) ret=7f328efc0afb
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0afb
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328efc0b14
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0b14
000b:Call advapi32.RegCreateKeyExW(00000034,0002bb20 L"Tahoma",00000000,00000000,00000001,000f003f,00000000,0023d738,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002bb20 L"Tahoma") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call advapi32.RegCreateKeyExW(00000030,0002bd20 L"Bold",00000000,00000000,00000001,000f003f,00000000,0023d740,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002bd20 L"Bold") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda30 L"File Name",00000000,00000001,0002bee0,00000054) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002bee0,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda10 L"Full Name",00000000,00000001,0002beb0,00000018) ret=7f328efc0d16
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda10 L"Full Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002beb0,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d16
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb38 L"Index",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb20 L"Ntmflags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb10 L"Version",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedaa8 L"Flags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda50 L"Font Signature",00000000,00000003,0002be28,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000003,0002be28,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002bf50 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c030 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c060 ret=7f328efbbe49
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/symbol.ttf",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000050) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c090 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/symbol.ttf",ffffffff,0002c090,00000028) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb48
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c0f0 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d584) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c120 ret=7f328efbbe49
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c0f0) ret=7f328efbc01e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbc01e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c150 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002c120 L"Symbol",00000000,00000000,00000001,000f003f,00000000,0023d738,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002c120 L"Symbol") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call advapi32.RegCreateKeyExW(00000030,0002c030 L"Regular",00000000,00000000,00000001,000f003f,00000000,0023d740,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002c030 L"Regular") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda30 L"File Name",00000000,00000001,0002c090,00000050) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002c090,00000050) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda10 L"Full Name",00000000,00000001,0002c060,0000000e) ret=7f328efc0d16
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda10 L"Full Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002c060,0000000e) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d16
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb38 L"Index",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb20 L"Ntmflags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb10 L"Version",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedaa8 L"Flags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda50 L"Font Signature",00000000,00000003,0002bfa8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000003,0002bfa8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c1a0 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c0f0 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d3c4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000014) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c280 ret=7f328efbbe49
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/wingding.ttf",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000002a ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000054) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c2b0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0023d8c4 "/usr/bin/../share/wine/fonts/wingding.ttf",ffffffff,0002c2b0,0000002a) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000002a ret=7f328efbbb48
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000014) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c320 ret=7f328efbbe49
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d584) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call KERNEL32.IsValidCodePage(00002710) ret=7f328efbbd6b
000b:Ret  KERNEL32.IsValidCodePage() retval=00000001 ret=7f328efbbd6b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000014) ret=7f328efbbe49
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c350 ret=7f328efbbe49
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c320) ret=7f328efbc01e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbc01e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c380 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002c350 L"Wingdings",00000000,00000000,00000001,000f003f,00000000,0023d738,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002c350 L"Wingdings") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call advapi32.RegCreateKeyExW(00000030,0002c0f0 L"Regular",00000000,00000000,00000001,000f003f,00000000,0023d740,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d4f8,0002c0f0 L"Regular") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d508,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d460,000f003f,0023d518,00000000,0023d508,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda30 L"File Name",00000000,00000001,0002c2b0,00000054) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002c2b0,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda10 L"Full Name",00000000,00000001,0002c280,00000014) ret=7f328efc0d16
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda10 L"Full Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000001,0002c280,00000014) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d16
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb38 L"Index",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb20 L"Ntmflags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedb10 L"Version",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efedaa8 L"Flags",00000000,00000004,0023d70c,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d548,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d548,00000000,00000004,0023d70c,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000038,7f328efeda50 L"Font Signature",00000000,00000003,0002c1f8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d568,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023d568,00000000,00000003,0002c1f8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efc1765
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc1765
000b:Call KERNEL32.GetVersion() ret=7f328efc1772
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328efc1772
000b:Call advapi32.RegOpenKeyW(ffffffff80000002,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts",0023da60) ret=7f328efc1797
000b:Call ntdll.RtlInitUnicodeString(0023d808,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000066 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023da60,02000000,0023d818,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000000 ret=7f328efc1797
000b:Call advapi32.RegQueryInfoKeyW(00000030,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0023da44,0023da48,00000000,00000000) ret=7f328efc17d4
000b:Call ntdll.NtQueryKey(00000030,00000002,0023d6f8,00000100,0023d6f4) ret=7f328fd7fd2a
000b:Ret  ntdll.NtQueryKey() retval=00000000 ret=7f328fd7fd2a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ff18
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ff18
000b:Ret  advapi32.RegQueryInfoKeyW() retval=00000000 ret=7f328efc17d4
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001c) ret=7f328efc1802
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c320 ret=7f328efc1802
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000030) ret=7f328efc1821
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efc1821
000b:Call advapi32.RegEnumValueW(00000030,00000000,0002c320,0023da54,00000000,0023da4c,0001ea60,0023da50) ret=7f328efc18c6
000b:Call ntdll.NtEnumerateValueKey(00000030,00000000,00000001,0023d5f8,00000100,0023d5f4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efc18c6
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\coure.fon") ret=7f328efc1984
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\coure.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002c430 ret=7f328efc1984
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c430) ret=7f328efc19cd
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc19cd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c3d0 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"coure.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000a ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000027) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c400 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"coure.fon",ffffffff,0002c41d,0000000a,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000a ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c3d0) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c440 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c3d0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0002c3d0,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c400 "/usr/bin/../share/wine/fonts/coure.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000027 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000004e) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c520 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c400 "/usr/bin/../share/wine/fonts/coure.fon",ffffffff,0002c520,00000027) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000027 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "Courier",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c580 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "Courier",ffffffff,0002c580,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c5b0 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002c580 L"Courier",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c580 L"Courier") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c600 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0002c600 L"Regular\\832",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c600 L"Regular\\832") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000003c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c600) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda30 L"File Name",00000000,00000001,0002c520,0000004e) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000001,0002c520,0000004e) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda50 L"Font Signature",00000000,00000003,0002c498,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000003,0002c498,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(00000040) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000040) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c400) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegEnumValueW(00000030,00000001,0002c320,0023da54,00000000,0023da4c,0001ea60,0023da50) ret=7f328efc18c6
000b:Call ntdll.NtEnumerateValueKey(00000030,00000001,00000001,0023d5f8,00000100,0023d5f4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efc18c6
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\sserife.fon") ret=7f328efc1984
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\sserife.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002c660 ret=7f328efc1984
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c660) ret=7f328efc19cd
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc19cd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c400 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"sserife.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000c ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000029) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c600 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"sserife.fon",ffffffff,0002c61d,0000000c,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000c ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c400) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c640 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c400 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0002c400,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c600 "/usr/bin/../share/wine/fonts/sserife.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000052) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c720 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c600 "/usr/bin/../share/wine/fonts/sserife.fon",ffffffff,0002c720,00000029) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "MS Sans Serif",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000e ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001c) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c790 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "MS Sans Serif",ffffffff,0002c790,0000000e) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000e ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c7c0 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002c790 L"MS Sans Serif",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c790 L"MS Sans Serif") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c810 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0002c810 L"Regular\\704",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c810 L"Regular\\704") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000003c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c810) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda30 L"File Name",00000000,00000001,0002c720,00000052) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000001,0002c720,00000052) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda50 L"Font Signature",00000000,00000003,0002c698,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000003,0002c698,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(00000040) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000040) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c810 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c8f0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0002c8f0,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c600 "/usr/bin/../share/wine/fonts/sserife.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000052) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c920 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c600 "/usr/bin/../share/wine/fonts/sserife.fon",ffffffff,0002c920,00000029) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "MS Sans Serif",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000e ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001c) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c990 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "MS Sans Serif",ffffffff,0002c990,0000000e) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000e ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c990) ret=7f328efc0afb
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0afb
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328efc0b14
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0b14
000b:Call advapi32.RegCreateKeyExW(00000034,0002c790 L"MS Sans Serif",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c790 L"MS Sans Serif") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c990 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0002c990 L"Regular\\832",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c990 L"Regular\\832") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c990) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(0000003c,7f328efeda30 L"File Name",00000000,00000001,0002c920,00000052) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d748,00000000,00000001,0002c920,00000052) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efeda50 L"Font Signature",00000000,00000003,0002c868,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d748,00000000,00000003,0002c868,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(0000003c) ret=7f328efc0e42
000b:Call ntdll.NtClose(0000003c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c990 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ca70 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0002ca70,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c600 "/usr/bin/../share/wine/fonts/sserife.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000052) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002caa0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002c600 "/usr/bin/../share/wine/fonts/sserife.fon",ffffffff,0002caa0,00000029) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000029 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "MS Sans Serif",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000e ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001c) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cb10 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "MS Sans Serif",ffffffff,0002cb10,0000000e) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000e ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cb10) ret=7f328efc0afb
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0afb
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328efc0b14
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0b14
000b:Call advapi32.RegCreateKeyExW(00000034,0002c790 L"MS Sans Serif",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002c790 L"MS Sans Serif") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cb10 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0002cb10 L"Regular\\1024",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002cb10 L"Regular\\1024") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cb10) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(0000003c,7f328efeda30 L"File Name",00000000,00000001,0002caa0,00000052) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d748,00000000,00000001,0002caa0,00000052) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efeda50 L"Font Signature",00000000,00000003,0002c9e8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d748,00000000,00000003,0002c9e8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(0000003c,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(0000003c) ret=7f328efc0e42
000b:Call ntdll.NtClose(0000003c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c600) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegEnumValueW(00000030,00000002,0002c320,0023da54,00000000,0023da4c,0001ea60,0023da50) ret=7f328efc18c6
000b:Call ntdll.NtEnumerateValueKey(00000030,00000002,00000001,0023d5f8,00000100,0023d5f4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efc18c6
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\serife.fon") ret=7f328efc1984
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\serife.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002cb70 ret=7f328efc1984
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cb70) ret=7f328efc19cd
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc19cd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c600 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"serife.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cb10 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"serife.fon",ffffffff,0002cb2d,0000000b,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c600) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cb10) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegEnumValueW(00000030,00000003,0002c320,0023da54,00000000,0023da4c,0001ea60,0023da50) ret=7f328efc18c6
000b:Call ntdll.NtEnumerateValueKey(00000030,00000003,00000001,0023d5f8,00000100,0023d5f4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efc18c6
000b:Call KERNEL32.wine_get_unix_file_name(0023de80 L"C:\\windows\\fonts\\smalle.fon") ret=7f328efc1984
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023de80 L"C:\\windows\\fonts\\smalle.fon",0023d878,00000000,00000000) ret=7b46cbca
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b46cbca
000b:Call ntdll.wine_nt_to_unix_file_name(0023d878,0023d888,00000003,00000000) ret=7b46cbe6
000b:Ret  ntdll.wine_nt_to_unix_file_name() retval=c000000f ret=7b46cbe6
000b:Call ntdll.RtlFreeUnicodeString(0023d878) ret=7b46cbf0
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b46cbf0
000b:Ret  KERNEL32.wine_get_unix_file_name() retval=0002cb70 ret=7f328efc1984
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cb70) ret=7f328efc19cd
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc19cd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001d) ret=7f328efbde6d
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c600 ret=7f328efbde6d
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"smalle.fon",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbdf50
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdf50
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbdf83
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cb10 ret=7f328efbdf83
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0001ea60 L"smalle.fon",ffffffff,0002cb2d,0000000b,00000000,00000000) ret=7f328efbdfd4
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000000b ret=7f328efbdfd4
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c600) ret=7f328efbdff2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efbdff2
000b:Call ntdll.RtlEnterCriticalSection(7f328f224de0) ret=7f328efc106e
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efc106e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000c8) ret=7f328efbe4df
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cb50 ret=7f328efbe4df
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe4ee
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe4ee
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c600 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7f328eb013cd "Regular",ffffffff,0002c600,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLangID() ret=7f328efbe523
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d5a4) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLangID() retval=00000409 ret=7f328efbe523
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002cb10 "/usr/bin/../share/wine/fonts/smalle.fon",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000050) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cc30 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,0002cb10 "/usr/bin/../share/wine/fonts/smalle.fon",ffffffff,0002cc30,00000028) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000028 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "Small Fonts",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000c ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000018) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cc90 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,7d516b60 "Small Fonts",ffffffff,0002cc90,0000000c) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000c ret=7f328efbbb48
000b:Call KERNEL32.GetSystemDefaultLCID() ret=7f328efbbfc7
000b:Call ntdll.NtQueryDefaultLocale(00000000,0023d764) ret=7b45b365
000b:Ret  ntdll.NtQueryDefaultLocale() retval=00000000 ret=7b45b365
000b:Ret  KERNEL32.GetSystemDefaultLCID() retval=00000409 ret=7f328efbbfc7
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efba8f6
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ccc0 ret=7f328efba8f6
000b:Call advapi32.RegCreateKeyExW(00000034,0002cc90 L"Small Fonts",00000000,00000000,00000001,000f003f,00000000,0023d918,00000000) ret=7f328efc0bb9
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002cc90 L"Small Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0bb9
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000022) ret=7f328efc0c34
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cd10 ret=7f328efc0c34
000b:Call advapi32.RegCreateKeyExW(00000038,0002cd10 L"Regular\\576",00000000,00000000,00000001,000f003f,00000000,0023d920,00000000) ret=7f328efc0c7f
000b:Call ntdll.RtlInitUnicodeString(0023d6d8,0002cd10 L"Regular\\576") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023d6e8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023d640,000f003f,0023d6f8,00000000,0023d6e8,00000001,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000003c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc0c7f
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cd10) ret=7f328efc0ca7
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc0ca7
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda30 L"File Name",00000000,00000001,0002cc30,00000050) ret=7f328efc0cdc
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda30 L"File Name") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000001,0002cc30,00000050) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0cdc
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb38 L"Index",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb38 L"Index") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb20 L"Ntmflags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb20 L"Ntmflags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000012 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedb10 L"Version",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedb10 L"Version") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaa8 L"Flags",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaa8 L"Flags") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda50 L"Font Signature",00000000,00000003,0002cba8,00000018) ret=7f328efc0d96
000b:Call ntdll.RtlInitUnicodeString(0023d748,7f328efeda50 L"Font Signature") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d748,00000000,00000003,0002cba8,00000018) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efc0d96
000b:Call advapi32.RegSetValueExW(00000040,7f328efedaf8 L"Height",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedaf8 L"Height") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedae8 L"Width",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedae8 L"Width") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedad8 L"Size",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedad8 L"Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedac8 L"Xppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedac8 L"Xppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efedab8 L"Yppem",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efedab8 L"Yppem") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegSetValueExW(00000040,7f328efeda80 L"Internal Leading",00000000,00000004,0023d8ec,00000004) ret=7f328efbbc7f
000b:Call ntdll.RtlInitUnicodeString(0023d728,7f328efeda80 L"Internal Leading") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023d728,00000000,00000004,0023d8ec,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efbbc7f
000b:Call advapi32.RegCloseKey(00000040) ret=7f328efc0e42
000b:Call ntdll.NtClose(00000040) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e42
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efc0e4c
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc0e4c
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224de0) ret=7f328efc1095
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efc1095
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002cb10) ret=7f328efc10ac
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc10ac
000b:Call advapi32.RegEnumValueW(00000030,00000004,0002c320,0023da54,00000000,0023da4c,0001ea60,0023da50) ret=7f328efc18c6
000b:Call ntdll.NtEnumerateValueKey(00000030,00000004,00000001,0023d5f8,00000100,0023d5f4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=8000001a ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(8000001a) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000103 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000103 ret=7f328efc18c6
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efc184d
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc184d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c320) ret=7f328efc1864
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc1864
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc186e
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc186e
000b:Call advapi32.RegOpenKeyA(ffffffff80000001,7f328efeb0c2 "Software\\Wine\\Fonts",0023da60) ret=7f328efc1bf3
000b:Call KERNEL32.GetVersion() ret=7f328fd7f4d3
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7f4d3
000b:Call ntdll.RtlInitAnsiString(0023d808,7f328efeb0c2 "Software\\Wine\\Fonts") ret=7f328fd7f558
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7f558
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023d808,00000000) ret=7f328fd7f566
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7f566
000b:Call ntdll.NtOpenKeyEx(0023da60,02000000,0023d818,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f584
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f584
000b:Ret  advapi32.RegOpenKeyA() retval=00000000 ret=7f328efc1bf3
000b:Call advapi32.RegQueryValueExW(00000030,7f328efecc40 L"Path",00000000,00000000,00000000,0023da68) ret=7f328efc1c22
000b:Call ntdll.RtlInitUnicodeString(0023d618,7f328efecc40 L"Path") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000030,0023d618,00000002,0023d628,7f320000000c,0023d614) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328efc1c22
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc1e75
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc1e75
000b:Call advapi32.RegOpenKeyA(ffffffff80000002,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",0023e138) ret=7f328efc99ad
000b:Call KERNEL32.GetVersion() ret=7f328fd7f4d3
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7f4d3
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efeb989 "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes") ret=7f328fd7f558
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7f558
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023dec8,00000000) ret=7f328fd7f566
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7f566
000b:Call ntdll.NtOpenKeyEx(0023e138,02000000,0023ded8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f584
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f584
000b:Ret  advapi32.RegOpenKeyA() retval=00000000 ret=7f328efc99ad
000b:Call advapi32.RegQueryInfoKeyA(00000030,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0023e114,0023e118,00000000,00000000) ret=7f328efc99ea
000b:Call ntdll.NtQueryKey(00000030,00000002,0023ddb8,00000100,0023ddb4) ret=7f328fd80172
000b:Ret  ntdll.NtQueryKey() retval=00000000 ret=7f328fd80172
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd80393
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd80393
000b:Ret  advapi32.RegQueryInfoKeyA() retval=00000000 ret=7f328efc99ea
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000d) ret=7f328efc9a15
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c320 ret=7f328efc9a15
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000020) ret=7f328efc9a31
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efc9a31
000b:Call advapi32.RegEnumValueA(00000030,00000000,0002c320,0023e130,00000000,0023e11c,0001ea60,0023e128) ret=7f328efc9a81
000b:Call ntdll.NtEnumerateValueKey(00000030,00000000,00000001,0023ddf8,7f3200000100,0023ddf0) ret=7f328fd82595
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd82595
000b:Call ntdll.RtlUnicodeToMultiByteSize(0023ddf4,0023de24,0000000e) ret=7f328fd8262c
000b:Ret  ntdll.RtlUnicodeToMultiByteSize() retval=00000000 ret=7f328fd8262c
000b:Call ntdll.RtlUnicodeToMultiByteN(0001ea60,00000007,00000000,0023de24,7f320000000e) ret=7f328fd82661
000b:Ret  ntdll.RtlUnicodeToMultiByteN() retval=00000000 ret=7f328fd82661
000b:Call ntdll.RtlUnicodeToMultiByteSize(0023ddf4,0023de0c,00000018) ret=7f328fd826ce
000b:Ret  ntdll.RtlUnicodeToMultiByteSize() retval=00000000 ret=7f328fd826ce
000b:Call ntdll.RtlUnicodeToMultiByteN(0002c320,0000000c,00000000,0023de0c,7f3200000018) ret=7f328fd82724
000b:Ret  ntdll.RtlUnicodeToMultiByteN() retval=00000000 ret=7f328fd82724
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd82773
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd82773
000b:Ret  advapi32.RegEnumValueA() retval=00000000 ret=7f328efc9a81
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000030) ret=7f328efc9af2
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cb10 ret=7f328efc9af2
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0002c320 "MS Shell Dlg",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000d ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000001a) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cd10 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0002c320 "MS Shell Dlg",ffffffff,0002cd10,0000000d) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=0000000d ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0001ea60 "Tahoma",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000007 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cd40 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0001ea60 "Tahoma",ffffffff,0002cd40,00000007) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000007 ret=7f328efbbb48
000b:Call advapi32.RegEnumValueA(00000030,00000001,0002c320,0023e130,00000000,0023e11c,0001ea60,0023e128) ret=7f328efc9a81
000b:Call ntdll.NtEnumerateValueKey(00000030,00000001,00000001,0023ddf8,7f3200000100,0023ddf0) ret=7f328fd82595
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd82595
000b:Call ntdll.RtlUnicodeToMultiByteSize(0023ddf4,0023de1a,00000020) ret=7f328fd8262c
000b:Ret  ntdll.RtlUnicodeToMultiByteSize() retval=00000000 ret=7f328fd8262c
000b:Call ntdll.RtlUnicodeToMultiByteN(0001ea60,00000010,00000000,0023de1a,7f3200000020) ret=7f328fd82661
000b:Ret  ntdll.RtlUnicodeToMultiByteN() retval=00000000 ret=7f328fd82661
000b:Call ntdll.RtlUnicodeToMultiByteSize(0023ddf4,0023de0c,0000000e) ret=7f328fd826ce
000b:Ret  ntdll.RtlUnicodeToMultiByteSize() retval=00000000 ret=7f328fd826ce
000b:Call ntdll.RtlUnicodeToMultiByteN(0002c320,00000007,00000000,0023de0c,7f320000000e) ret=7f328fd82724
000b:Ret  ntdll.RtlUnicodeToMultiByteN() retval=00000000 ret=7f328fd82724
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd82773
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd82773
000b:Ret  advapi32.RegEnumValueA() retval=00000000 ret=7f328efc9a81
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000030) ret=7f328efc9af2
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cd70 ret=7f328efc9af2
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0002c320 "Tms Rmn",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000010) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cdb0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0002c320 "Tms Rmn",ffffffff,0002cdb0,00000008) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000008 ret=7f328efbbb48
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0001ea60 "Times New Roman",ffffffff,00000000,00000000) ret=7f328efbbb0b
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000010 ret=7f328efbbb0b
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000020) ret=7f328efbbb2a
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cde0 ret=7f328efbbb2a
000b:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0001ea60 "Times New Roman",ffffffff,0002cde0,00000010) ret=7f328efbbb48
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000010 ret=7f328efbbb48
000b:Call advapi32.RegEnumValueA(00000030,00000002,0002c320,0023e130,00000000,0023e11c,0001ea60,0023e128) ret=7f328efc9a81
000b:Call ntdll.NtEnumerateValueKey(00000030,00000002,00000001,0023ddf8,7f3200000100,0023ddf0) ret=7f328fd82595
000b:Ret  ntdll.NtEnumerateValueKey() retval=8000001a ret=7f328fd82595
000b:Call ntdll.RtlNtStatusToDosError(8000001a) ret=7f328fd82773
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000103 ret=7f328fd82773
000b:Ret  advapi32.RegEnumValueA() retval=00000103 ret=7f328efc9a81
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efc9bb3
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc9bb3
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002c320) ret=7f328efc9bca
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efc9bca
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efc9bd7
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efc9bd7
000b:Call advapi32.RegOpenKeyA(ffffffff80000001,7f328efec019 "Software\\Wine\\Fonts\\Replacements",0023e138) ret=7f328efc9cd0
000b:Call KERNEL32.GetVersion() ret=7f328fd7f4d3
000b:Ret  KERNEL32.GetVersion() retval=0ece0205 ret=7f328fd7f4d3
000b:Call ntdll.RtlInitAnsiString(0023dec8,7f328efec019 "Software\\Wine\\Fonts\\Replacements") ret=7f328fd7f558
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7f328fd7f558
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023dec8,00000000) ret=7f328fd7f566
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7f328fd7f566
000b:Call ntdll.NtOpenKeyEx(0023e138,02000000,0023ded8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=c0000034 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7f584
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7f584
000b:Ret  advapi32.RegOpenKeyA() retval=00000002 ret=7f328efc9cd0
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e128,00000000) ret=7f328efc9ef2
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedf20 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000066 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc9ef2
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328efedfa0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Fonts",00000000,00000000,00000000,000f003f,00000000,0023e130,00000000) ret=7f328efc9f45
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efedfa0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000060 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc9f45
000b:Call advapi32.RegCreateKeyExW(ffffffff80000001,7f328efede40 L"Software\\Wine\\Fonts\\External Fonts",00000000,00000000,00000000,000f003f,00000000,0023e138,00000000) ret=7f328efc9f7d
000b:Call ntdll.RtlInitUnicodeString(0023dea8,7f328efede40 L"Software\\Wine\\Fonts\\External Fonts") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000046 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023deb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de10,000f003f,0023dec8,00000000,0023deb8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328efc9f7d
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000026) ret=7f328efca038
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efca038
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002ba90 L"/usr/bin/../share/wine/fonts/tahoma.ttf",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbf810
000b:Ret  KERNEL32.WideCharToMultiByte() retval=00000028 ret=7f328efbf810
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbf82e
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efbf82e
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002ba90 L"/usr/bin/../share/wine/fonts/tahoma.ttf",ffffffff,0002ce10,00000028,00000000,00000000) ret=7f328efbf853
000b:Ret  KERNEL32.WideCharToMultiByte() retval=00000028 ret=7f328efbf853
000b:Call KERNEL32.wine_get_dos_file_name(0002ce10 "/usr/bin/../share/wine/fonts/tahoma.ttf") ret=7f328efca07d
000b:Call ntdll.RtlInitAnsiString(0023df48,0002ce10 "/usr/bin/../share/wine/fonts/tahoma.ttf") ret=7b46cce3
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b46cce3
000b:Call ntdll.wine_unix_to_nt_file_name(0023df48,0023df38) ret=7b46ccf0
000b:Ret  ntdll.wine_unix_to_nt_file_name() retval=00000000 ret=7b46ccf0
000b:Ret  KERNEL32.wine_get_dos_file_name() retval=0002ce50 ret=7f328efca07d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce10) ret=7f328efca09c
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca09c
000b:Call advapi32.RegSetValueExW(00000030,0001ea60 L"Tahoma (TrueType)",00000000,00000001,0002ce50,00000054) ret=7f328efca0fb
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Tahoma (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df18,00000000,00000001,0002ce50,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca0fb
000b:Call advapi32.RegSetValueExW(00000038,0001ea60 L"Tahoma (TrueType)",00000000,00000001,0002ce50,00000054) ret=7f328efca120
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Tahoma (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023df18,00000000,00000001,0002ce50,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca120
000b:Call advapi32.RegSetValueExW(0000003c,0001ea60 L"Tahoma (TrueType)",00000000,00000001,0002ce50,00000054) ret=7f328efca145
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Tahoma (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023df18,00000000,00000001,0002ce50,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca145
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce50) ret=7f328efca15e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca15e
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efca175
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca175
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000030) ret=7f328efca038
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efca038
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002bee0 L"/usr/bin/../share/wine/fonts/tahomabd.ttf",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbf810
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000002a ret=7f328efbf810
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7f328efbf82e
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efbf82e
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002bee0 L"/usr/bin/../share/wine/fonts/tahomabd.ttf",ffffffff,0002ce10,0000002a,00000000,00000000) ret=7f328efbf853
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000002a ret=7f328efbf853
000b:Call KERNEL32.wine_get_dos_file_name(0002ce10 "/usr/bin/../share/wine/fonts/tahomabd.ttf") ret=7f328efca07d
000b:Call ntdll.RtlInitAnsiString(0023df48,0002ce10 "/usr/bin/../share/wine/fonts/tahomabd.ttf") ret=7b46cce3
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b46cce3
000b:Call ntdll.wine_unix_to_nt_file_name(0023df48,0023df38) ret=7b46ccf0
000b:Ret  ntdll.wine_unix_to_nt_file_name() retval=00000000 ret=7b46ccf0
000b:Ret  KERNEL32.wine_get_dos_file_name() retval=0002ce50 ret=7f328efca07d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce10) ret=7f328efca09c
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca09c
000b:Call advapi32.RegSetValueExW(00000030,0001ea60 L"Tahoma Bold (TrueType)",00000000,00000001,0002ce50,00000058) ret=7f328efca0fb
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Tahoma Bold (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df18,00000000,00000001,0002ce50,00000058) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca0fb
000b:Call advapi32.RegSetValueExW(00000038,0001ea60 L"Tahoma Bold (TrueType)",00000000,00000001,0002ce50,00000058) ret=7f328efca120
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Tahoma Bold (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023df18,00000000,00000001,0002ce50,00000058) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca120
000b:Call advapi32.RegSetValueExW(0000003c,0001ea60 L"Tahoma Bold (TrueType)",00000000,00000001,0002ce50,00000058) ret=7f328efca145
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Tahoma Bold (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023df18,00000000,00000001,0002ce50,00000058) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca145
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce50) ret=7f328efca15e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca15e
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efca175
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca175
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efca038
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efca038
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002bcb0 L"/usr/bin/../share/wine/fonts/marlett.ttf",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbf810
000b:Ret  KERNEL32.WideCharToMultiByte() retval=00000029 ret=7f328efbf810
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000029) ret=7f328efbf82e
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efbf82e
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002bcb0 L"/usr/bin/../share/wine/fonts/marlett.ttf",ffffffff,0002ce10,00000029,00000000,00000000) ret=7f328efbf853
000b:Ret  KERNEL32.WideCharToMultiByte() retval=00000029 ret=7f328efbf853
000b:Call KERNEL32.wine_get_dos_file_name(0002ce10 "/usr/bin/../share/wine/fonts/marlett.ttf") ret=7f328efca07d
000b:Call ntdll.RtlInitAnsiString(0023df48,0002ce10 "/usr/bin/../share/wine/fonts/marlett.ttf") ret=7b46cce3
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b46cce3
000b:Call ntdll.wine_unix_to_nt_file_name(0023df48,0023df38) ret=7b46ccf0
000b:Ret  ntdll.wine_unix_to_nt_file_name() retval=00000000 ret=7b46ccf0
000b:Ret  KERNEL32.wine_get_dos_file_name() retval=0002ce50 ret=7f328efca07d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce10) ret=7f328efca09c
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca09c
000b:Call advapi32.RegSetValueExW(00000030,0001ea60 L"Marlett (TrueType)",00000000,00000001,0002ce50,00000056) ret=7f328efca0fb
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Marlett (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df18,00000000,00000001,0002ce50,00000056) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca0fb
000b:Call advapi32.RegSetValueExW(00000038,0001ea60 L"Marlett (TrueType)",00000000,00000001,0002ce50,00000056) ret=7f328efca120
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Marlett (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023df18,00000000,00000001,0002ce50,00000056) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca120
000b:Call advapi32.RegSetValueExW(0000003c,0001ea60 L"Marlett (TrueType)",00000000,00000001,0002ce50,00000056) ret=7f328efca145
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Marlett (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023df18,00000000,00000001,0002ce50,00000056) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca145
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce50) ret=7f328efca15e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca15e
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efca175
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca175
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000026) ret=7f328efca038
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efca038
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002c090 L"/usr/bin/../share/wine/fonts/symbol.ttf",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbf810
000b:Ret  KERNEL32.WideCharToMultiByte() retval=00000028 ret=7f328efbf810
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbf82e
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efbf82e
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002c090 L"/usr/bin/../share/wine/fonts/symbol.ttf",ffffffff,0002ce10,00000028,00000000,00000000) ret=7f328efbf853
000b:Ret  KERNEL32.WideCharToMultiByte() retval=00000028 ret=7f328efbf853
000b:Call KERNEL32.wine_get_dos_file_name(0002ce10 "/usr/bin/../share/wine/fonts/symbol.ttf") ret=7f328efca07d
000b:Call ntdll.RtlInitAnsiString(0023df48,0002ce10 "/usr/bin/../share/wine/fonts/symbol.ttf") ret=7b46cce3
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b46cce3
000b:Call ntdll.wine_unix_to_nt_file_name(0023df48,0023df38) ret=7b46ccf0
000b:Ret  ntdll.wine_unix_to_nt_file_name() retval=00000000 ret=7b46ccf0
000b:Ret  KERNEL32.wine_get_dos_file_name() retval=0002ce50 ret=7f328efca07d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce10) ret=7f328efca09c
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca09c
000b:Call advapi32.RegSetValueExW(00000030,0001ea60 L"Symbol (TrueType)",00000000,00000001,0002ce50,00000054) ret=7f328efca0fb
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Symbol (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df18,00000000,00000001,0002ce50,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca0fb
000b:Call advapi32.RegSetValueExW(00000038,0001ea60 L"Symbol (TrueType)",00000000,00000001,0002ce50,00000054) ret=7f328efca120
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Symbol (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023df18,00000000,00000001,0002ce50,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca120
000b:Call advapi32.RegSetValueExW(0000003c,0001ea60 L"Symbol (TrueType)",00000000,00000001,0002ce50,00000054) ret=7f328efca145
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Symbol (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023df18,00000000,00000001,0002ce50,00000054) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca145
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce50) ret=7f328efca15e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca15e
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efca175
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca175
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002c) ret=7f328efca038
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efca038
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002c2b0 L"/usr/bin/../share/wine/fonts/wingding.ttf",ffffffff,00000000,00000000,00000000,00000000) ret=7f328efbf810
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000002a ret=7f328efbf810
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7f328efbf82e
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efbf82e
000b:Call KERNEL32.WideCharToMultiByte(0000fdf2,00000000,0002c2b0 L"/usr/bin/../share/wine/fonts/wingding.ttf",ffffffff,0002ce10,0000002a,00000000,00000000) ret=7f328efbf853
000b:Ret  KERNEL32.WideCharToMultiByte() retval=0000002a ret=7f328efbf853
000b:Call KERNEL32.wine_get_dos_file_name(0002ce10 "/usr/bin/../share/wine/fonts/wingding.ttf") ret=7f328efca07d
000b:Call ntdll.RtlInitAnsiString(0023df48,0002ce10 "/usr/bin/../share/wine/fonts/wingding.ttf") ret=7b46cce3
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b46cce3
000b:Call ntdll.wine_unix_to_nt_file_name(0023df48,0023df38) ret=7b46ccf0
000b:Ret  ntdll.wine_unix_to_nt_file_name() retval=00000000 ret=7b46ccf0
000b:Ret  KERNEL32.wine_get_dos_file_name() retval=0002ce50 ret=7f328efca07d
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce10) ret=7f328efca09c
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca09c
000b:Call advapi32.RegSetValueExW(00000030,0001ea60 L"Wingdings (TrueType)",00000000,00000001,0002ce50,00000058) ret=7f328efca0fb
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Wingdings (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000030,0023df18,00000000,00000001,0002ce50,00000058) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca0fb
000b:Call advapi32.RegSetValueExW(00000038,0001ea60 L"Wingdings (TrueType)",00000000,00000001,0002ce50,00000058) ret=7f328efca120
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Wingdings (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000038,0023df18,00000000,00000001,0002ce50,00000058) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca120
000b:Call advapi32.RegSetValueExW(0000003c,0001ea60 L"Wingdings (TrueType)",00000000,00000001,0002ce50,00000058) ret=7f328efca145
000b:Call ntdll.RtlInitUnicodeString(0023df18,0001ea60 L"Wingdings (TrueType)") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000003c,0023df18,00000000,00000001,0002ce50,00000058) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328efca145
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce50) ret=7f328efca15e
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca15e
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efca175
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca175
000b:Call advapi32.RegCloseKey(0000003c) ret=7f328efca19c
000b:Call ntdll.NtClose(0000003c) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efca19c
000b:Call advapi32.RegCloseKey(00000038) ret=7f328efca1b3
000b:Call ntdll.NtClose(00000038) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efca1b3
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efca1ca
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efca1ca
000b:Call advapi32.RegOpenKeyW(ffffffff80000002,7f328efed900 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",0023e138) ret=7f328efca1ea
000b:Call ntdll.RtlInitUnicodeString(0023dec8,7f328efed900 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023e138,02000000,0023ded8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000000 ret=7f328efca1ea
000b:Call advapi32.RegQueryInfoKeyW(00000030,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0023e118,0023e11c,00000000,00000000) ret=7f328efca227
000b:Call ntdll.NtQueryKey(00000030,00000002,0023ddb8,00000100,0023ddb4) ret=7f328fd7fd2a
000b:Ret  ntdll.NtQueryKey() retval=00000000 ret=7f328fd7fd2a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ff18
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ff18
000b:Ret  advapi32.RegQueryInfoKeyW() retval=00000000 ret=7f328efca227
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7f328efca24a
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efca24a
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,000000a4) ret=7f328efca26d
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efca26d
000b:Call advapi32.RegEnumValueW(00000030,00000000,0001ea60,0023e128,00000000,0023e114,0002ce10,0023e130) ret=7f328efca2c5
000b:Call ntdll.NtEnumerateValueKey(00000030,00000000,00000001,0023dcb8,00000100,0023dcb4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efca2c5
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efca339
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ced0 ret=7f328efca339
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000028) ret=7f328efbbc45
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cf20 ret=7f328efbbc45
000b:Call advapi32.RegEnumValueW(00000030,00000001,0001ea60,0023e128,00000000,0023e114,0002ce10,0023e130) ret=7f328efca2c5
000b:Call ntdll.NtEnumerateValueKey(00000030,00000001,00000001,0023dcb8,00000100,0023dcb4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efca2c5
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efca339
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cf60 ret=7f328efca339
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000002a) ret=7f328efbbc45
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cfb0 ret=7f328efbbc45
000b:Call advapi32.RegEnumValueW(00000030,00000002,0001ea60,0023e128,00000000,0023e114,0002ce10,0023e130) ret=7f328efca2c5
000b:Call ntdll.NtEnumerateValueKey(00000030,00000002,00000001,0023dcb8,00000100,0023dcb4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=00000000 ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000000 ret=7f328efca2c5
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efca339
000b:Ret  ntdll.RtlAllocateHeap() retval=0002cff0 ret=7f328efca339
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbc45
000b:Ret  ntdll.RtlAllocateHeap() retval=0002c320 ret=7f328efbbc45
000b:Call advapi32.RegEnumValueW(00000030,00000003,0001ea60,0023e128,00000000,0023e114,0002ce10,0023e130) ret=7f328efca2c5
000b:Call ntdll.NtEnumerateValueKey(00000030,00000003,00000001,0023dcb8,00000100,0023dcb4) ret=7f328fd7e66d
000b:Ret  ntdll.NtEnumerateValueKey() retval=8000001a ret=7f328fd7e66d
000b:Call ntdll.RtlNtStatusToDosError(8000001a) ret=7f328fd7e7b2
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000103 ret=7f328fd7e7b2
000b:Ret  advapi32.RegEnumValueW() retval=00000103 ret=7f328efca2c5
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ea60) ret=7f328efca560
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca560
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002ce10) ret=7f328efca577
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328efca577
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efca584
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efca584
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328efca6bd
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce10 ret=7f328efca6bd
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000000e) ret=7f328efbbc45
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ea60 ret=7f328efbbc45
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000020) ret=7f328efca72d
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce60 ret=7f328efca72d
000b:Call KERNEL32.ReleaseMutex(0000002c) ret=7f328efca7d6
000b:Call ntdll.NtReleaseMutant(0000002c,00000000) ret=7b481494
000b:Ret  ntdll.NtReleaseMutant() retval=00000000 ret=7b481494
000b:Ret  KERNEL32.ReleaseMutex() retval=00000001 ret=7f328efca7d6
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d040 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d090 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d0e0 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d130 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d180 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d1d0 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000050) ret=7f328efdd71b
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d220 ret=7f328efdd71b
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000050) ret=7f328efdd71b
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d280 ret=7f328efdd71b
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000050) ret=7f328efdd71b
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d2e0 ret=7f328efdd71b
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000018) ret=7f328efd7c79
000b:Ret  ntdll.RtlAllocateHeap() retval=0002ce90 ret=7f328efd7c79
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000050) ret=7f328efd7cbc
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d340 ret=7f328efd7cbc
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000078) ret=7f328ef754ae
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d3a0 ret=7f328ef754ae
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d430 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d4a0 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d510 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call KERNEL32.GetACP() ret=7f328efcb030
000b:Ret  KERNEL32.GetACP() retval=000004e4 ret=7f328efcb030
000b:Call advapi32.RegOpenKeyW(ffffffff80000005,7f328efee670 L"Software\\Fonts",0023e170) ret=7f328efcabea
000b:Call ntdll.RtlInitUnicodeString(0023df58,7f328efee670 L"Software\\Fonts") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023e170,02000000,0023df68,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=00000000 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000000 ret=7f328efcabea
000b:Call advapi32.RegQueryValueExW(00000030,7f328efee650 L"LogPixels",00000000,0023e164,0023e16c,0023e168) ret=7f328efcac23
000b:Call ntdll.RtlInitUnicodeString(0023dd68,7f328efee650 L"LogPixels") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000030,0023dd68,00000002,0023dd78,00000010,0023dd64) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328efcac23
000b:Call advapi32.RegCloseKey(00000030) ret=7f328efcac4e
000b:Call ntdll.NtClose(00000030) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328efcac4e
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d580 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d5f0 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d660 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,0000005c) ret=7f328efb24b3
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d6d0 ret=7f328efb24b3
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000040) ret=7f328ef76123
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d740 ret=7f328ef76123
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000050) ret=7f328efdd71b
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d790 ret=7f328efdd71b
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcb25b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcb25b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcb454
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcb454
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Call ntdll.RtlEnterCriticalSection(7f328f224f40) ret=7f328efcad94
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328efcad94
000b:Call ntdll.RtlLeaveCriticalSection(7f328f224f40) ret=7f328efcadba
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328efcadba
000b:Ret  PE DLL (proc=0x7f328efe1ba8,module=0x7f328ef60000 L"gdi32.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Call PE DLL (proc=0x7f328ed46bfd,module=0x7f328ed40000 L"version.dll",reason=PROCESS_ATTACH,res=0)
000b:Call KERNEL32.DisableThreadLibraryCalls(7f328ed40000) ret=7f328ed46d11
000b:Call ntdll.LdrDisableThreadCalloutsForDll(7f328ed40000) ret=7b465737
000b:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000b:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7f328ed46d11
000b:Ret  PE DLL (proc=0x7f328ed46bfd,module=0x7f328ed40000 L"version.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Call PE DLL (proc=0x7f328f364978,module=0x7f328f2d0000 L"user32.dll",reason=PROCESS_ATTACH,res=0)
000b:Call KERNEL32.GetStartupInfoW(0023e220) ret=7f328f34eb6d
000b:Ret  KERNEL32.GetStartupInfoW() retval=0023e220 ret=7f328f34eb6d
000b:Call ntdll.RtlInitUnicodeString(0023df58,0023df98 L"\\Sessions\\1\\Windows\\WindowStations") ret=7f328f3619f2
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000046 ret=7f328f3619f2
000b:Call ntdll.NtOpenDirectoryObject(0023df50,00000006,0023df68) ret=7f328f361a3c
000b:Ret  ntdll.NtOpenDirectoryObject() retval=00000000 ret=7f328f361a3c
000b:Call KERNEL32.GetModuleFileNameW(00000000,7f328f603d80,00000104) ret=7f328f34eca5
000b:Call ntdll.LdrLockLoaderLock(00000000,00000000,0023e058) ret=7b4666ec
000b:Ret  ntdll.LdrLockLoaderLock() retval=00000000 ret=7b4666ec
000b:Call ntdll.LdrFindEntryForAddress(7f328ffe0000,0023e060) ret=7b46670f
000b:Ret  ntdll.LdrFindEntryForAddress() retval=00000000 ret=7b46670f
000b:Call ntdll.LdrUnlockLoaderLock(00000000,0000000b) ret=7b466774
000b:Ret  ntdll.LdrUnlockLoaderLock() retval=00000000 ret=7b466774
000b:Ret  KERNEL32.GetModuleFileNameW() retval=00000020 ret=7f328f34eca5
000b:Call advapi32.RegOpenKeyW(ffffffff80000001,7f328f378760 L"Software\\Wine\\AppDefaults",0023e208) ret=7f328f34ed5d
000b:Call ntdll.RtlInitUnicodeString(0023dfe8,7f328f378760 L"Software\\Wine\\AppDefaults") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000034 ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023e208,02000000,0023dff8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=c0000034 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000002 ret=7f328f34ed5d
000b:Call advapi32.RegOpenKeyW(ffffffff80000001,7f328f603d80 L"Software\\Wine\\Explorer",0023e210) ret=7f328f34ed98
000b:Call ntdll.RtlInitUnicodeString(0023dfe8,7f328f603d80 L"Software\\Wine\\Explorer") ret=7f328fd7f38d
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd7f38d
000b:Call ntdll.NtOpenKeyEx(0023e210,02000000,0023dff8,00000000) ret=7f328fd7d34a
000b:Ret  ntdll.NtOpenKeyEx() retval=c0000034 ret=7f328fd7d34a
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7f3a1
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7f3a1
000b:Ret  advapi32.RegOpenKeyW() retval=00000002 ret=7f328f34ed98
000b:Call ntdll.RtlFreeHeap(00010000,00000000,00000000) ret=7f328f34eec2
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f328f34eec2
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000270) ret=7f328f2def57
000b:Ret  ntdll.RtlAllocateHeap() retval=0002d7f0 ret=7f328f2def57
000b:Call KERNEL32.GlobalGetAtomNameW(00008001,0002d85a,00000100) ret=7f328f2defb6
000b:Call ntdll.NtQueryInformationAtom(00008001,00000000,0023dcf2,00000206,00000000) ret=7b4369c4
000b:Ret  ntdll.NtQueryInformationAtom() retval=00000000 ret=7b4369c4
000b:Ret  KERNEL32.GlobalGetAtomNameW() retval=00000006 ret=7f328f2defb6
000b:Call ntdll.RtlEnterCriticalSection(7f328f5f36c0) ret=7f328f34ea5b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328f34ea5b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f5f36c0) ret=7f328f34ea70
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328f34ea70
000b:Call ntdll.RtlAllocateHeap(00010000,00000008,00000270) ret=7f328f2def57
000b:Ret  ntdll.RtlAllocateHeap() retval=0002da70 ret=7f328f2def57
000b:Call ntdll.RtlEnterCriticalSection(7f328f5f36c0) ret=7f328f34ea5b
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7f328f34ea5b
000b:Call ntdll.RtlLeaveCriticalSection(7f328f5f36c0) ret=7f328f34ea70
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7f328f34ea70
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f376b60 L"Software\\Wine",0023e1a0) ret=7f328f34437c
000b:Call ntdll.RtlInitUnicodeString(0023df58,7f328f376b60 L"Software\\Wine") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023df68,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dec0,02000000,0023df78,00000000,0023df68,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f34437c
000b:Call advapi32.RegCreateKeyExW(00000040,7f328f376b20 L"Temporary System Parameters",00000000,00000000,00000001,000f003f,00000000,7f328f603d30,0023e19c) ret=7f328f3443ed
000b:Call ntdll.RtlInitUnicodeString(0023df68,7f328f376b20 L"Temporary System Parameters") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000038 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023df78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023ded0,000f003f,0023df88,00000000,0023df78,00000001,0023e19c) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328f3443ed
000b:Call advapi32.RegCloseKey(00000040) ret=7f328f34442d
000b:Call ntdll.NtClose(00000040) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f34442d
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f377fc0 L"Control Panel\\Mouse",0023e110) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023ded8,7f328f377fc0 L"Control Panel\\Mouse") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dee8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de40,02000000,0023def8,00000000,0023dee8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(00000040,7f328f3775c2 L"ActiveWindowTracking",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f3775c2 L"ActiveWindowTracking") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f3775c2 L"ActiveWindowTracking",00000000,00000004,7f328f5f2930,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f3775c2 L"ActiveWindowTracking") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df98,00000000,00000004,7f328f5f2930,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f378040 L"Control Panel\\Desktop",0023e110) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023ded8,7f328f378040 L"Control Panel\\Desktop") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dee8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de40,02000000,0023def8,00000000,0023dee8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3774e2 L"ActiveWndTrackTimeout",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f3774e2 L"ActiveWndTrackTimeout") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3774e2 L"ActiveWndTrackTimeout",00000000,00000004,7f328f5f28f0,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f3774e2 L"ActiveWndTrackTimeout") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f28f0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f377f20 L"Control Panel\\Sound",0023e110) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023ded8,7f328f377f20 L"Control Panel\\Sound") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dee8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023de40,02000000,0023def8,00000000,0023dee8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(0000004c,7f328f377d6a L"Beep",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377d6a L"Beep") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(0000004c,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(0000004c,7f328f377d6a L"Beep",00000000,00000001,7f328f376b08,00000008) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377d6a L"Beep") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000004c,0023df98,00000000,00000001,7f328f376b08,00000008) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377562 L"BlockSendInputResets",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377562 L"BlockSendInputResets") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377562 L"BlockSendInputResets",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377562 L"BlockSendInputResets") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f377f60 L"Control Panel\\Desktop\\WindowMetrics",0023e0a0) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023de68,7f328f377f60 L"Control Panel\\Desktop\\WindowMetrics") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000048 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023de78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377cb2 L"BorderWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377cb2 L"BorderWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377cb2 L"BorderWidth",00000000,00000001,0023e138,00000008) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377cb2 L"BorderWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,00000008) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377262 L"CaptionHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377262 L"CaptionHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377262 L"CaptionHeight",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377262 L"CaptionHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377282 L"CaptionWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377282 L"CaptionWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377282 L"CaptionWidth",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377282 L"CaptionWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377472 L"CaretWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377472 L"CaretWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377472 L"CaretWidth",00000000,00000004,7f328f5f28b0,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377472 L"CaretWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f28b0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377822 L"Wallpaper",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377822 L"Wallpaper") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377822 L"Wallpaper",00000000,00000001,7f328f5f2230,00000002) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377822 L"Wallpaper") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000001,7f328f5f2230,00000002) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f3778e2 L"DoubleClickSpeed",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3778e2 L"DoubleClickSpeed") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f3778e2 L"DoubleClickSpeed",00000000,00000001,0023e138,00000008) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3778e2 L"DoubleClickSpeed") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000008) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377962 L"DoubleClickHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377962 L"DoubleClickHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377962 L"DoubleClickHeight",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377962 L"DoubleClickHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegSetValueExW(00000048,7f328f377922 L"DoubleClickHeight",00000000,00000001,0023e138,00000004) ret=7f328f342f0e
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377922 L"DoubleClickHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342f0e
000b:Call advapi32.RegQueryValueExW(00000040,7f328f3779e2 L"DoubleClickWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3779e2 L"DoubleClickWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f3779e2 L"DoubleClickWidth",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3779e2 L"DoubleClickWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegSetValueExW(00000048,7f328f3779a2 L"DoubleClickWidth",00000000,00000001,0023e138,00000004) ret=7f328f342f0e
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3779a2 L"DoubleClickWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342f0e
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377862 L"DragFullWindows",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377862 L"DragFullWindows") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377862 L"DragFullWindows",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377862 L"DragFullWindows") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3777a2 L"DragHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3777a2 L"DragHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3777a2 L"DragHeight",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3777a2 L"DragHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3777c2 L"DragWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3777c2 L"DragWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3777c2 L"DragWidth",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3777c2 L"DragWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3772e2 L"FocusBorderHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f3772e2 L"FocusBorderHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3772e2 L"FocusBorderHeight",00000000,00000004,7f328f5f2870,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f3772e2 L"FocusBorderHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f2870,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377322 L"FocusBorderWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377322 L"FocusBorderWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377322 L"FocusBorderWidth",00000000,00000004,7f328f5f2830,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377322 L"FocusBorderWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f2830,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3777e2 L"FontSmoothing",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3777e2 L"FontSmoothing") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3777e2 L"FontSmoothing",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3777e2 L"FontSmoothing") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3773a2 L"FontSmoothingGamma",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f3773a2 L"FontSmoothingGamma") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3773a2 L"FontSmoothingGamma",00000000,00000004,7f328f5f27f0,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f3773a2 L"FontSmoothingGamma") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000026 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f27f0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377362 L"FontSmoothingOrientation",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377362 L"FontSmoothingOrientation") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000032 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377362 L"FontSmoothingOrientation",00000000,00000004,7f328f5f27b0,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377362 L"FontSmoothingOrientation") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000032 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f27b0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3773e2 L"FontSmoothingType",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f3773e2 L"FontSmoothingType") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3773e2 L"FontSmoothingType",00000000,00000004,7f328f5f2770,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f3773e2 L"FontSmoothingType") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f2770,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f3774a2 L"ForegroundFlashCount",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f3774a2 L"ForegroundFlashCount") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f3774a2 L"ForegroundFlashCount",00000000,00000004,7f328f5f2730,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f3774a2 L"ForegroundFlashCount") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f2730,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377522 L"ForegroundLockTimeout",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377522 L"ForegroundLockTimeout") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377522 L"ForegroundLockTimeout",00000000,00000004,7f328f5f26f0,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377522 L"ForegroundLockTimeout") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f26f0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377c72 L"IconSpacing",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377c72 L"IconSpacing") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377c72 L"IconSpacing",00000000,00000001,0023e138,0000000c) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377c72 L"IconSpacing") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000c) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377182 L"Shell Icon Size",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377182 L"Shell Icon Size") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377182 L"Shell Icon Size",00000000,00000001,0023e138,00000006) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377182 L"Shell Icon Size") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,00000006) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377b32 L"IconTitleWrap",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377b32 L"IconTitleWrap") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377b32 L"IconTitleWrap",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377b32 L"IconTitleWrap") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegSetValueExW(00000050,7f328f377b12 L"IconTitleWrap",00000000,00000001,0023e138,00000004) ret=7f328f342f0e
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377b12 L"IconTitleWrap") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342f0e
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377b62 L"IconVerticalSpacing",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377b62 L"IconVerticalSpacing") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377b62 L"IconVerticalSpacing",00000000,00000001,0023e138,0000000c) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377b62 L"IconVerticalSpacing") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000c) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f378000 L"Control Panel\\Keyboard",0023e0a0) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023de68,7f328f378000 L"Control Panel\\Keyboard") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000002e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023de78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(00000054,7f328f377b92 L"KeyboardDelay",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377b92 L"KeyboardDelay") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000054,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000054,7f328f377b92 L"KeyboardDelay",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377b92 L"KeyboardDelay") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000054,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f377de0 L"Control Panel\\Accessibility\\Keyboard Preference",0023e0a0) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023de68,7f328f377de0 L"Control Panel\\Accessibility\\Keyboard Preference") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000060 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023de78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000058) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(0000005c) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(00000058,7f328f377842 L"On",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377842 L"On") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000006 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000058,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000058,7f328f377842 L"On",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377842 L"On") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000006 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000058,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000054,7f328f377c92 L"KeyboardSpeed",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377c92 L"KeyboardSpeed") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000054,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000054,7f328f377c92 L"KeyboardSpeed",00000000,00000001,0023e138,00000006) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377c92 L"KeyboardSpeed") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000054,0023df28,00000000,00000001,0023e138,00000006) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377782 L"LowPowerActive",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377782 L"LowPowerActive") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377782 L"LowPowerActive",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377782 L"LowPowerActive") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f3771b2 L"MenuHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3771b2 L"MenuHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f3771b2 L"MenuHeight",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3771b2 L"MenuHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377592 L"MenuShowDelay",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377592 L"MenuShowDelay") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377592 L"MenuShowDelay",00000000,00000001,0023e138,00000008) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377592 L"MenuShowDelay") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000008) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f3771d2 L"MenuWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3771d2 L"MenuWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f3771d2 L"MenuWidth",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3771d2 L"MenuWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377cd2 L"MouseSpeed",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377cd2 L"MouseSpeed") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377cd2 L"MouseSpeed",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377cd2 L"MouseSpeed") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f3778a2 L"SwapMouseButtons",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3778a2 L"SwapMouseButtons") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f3778a2 L"SwapMouseButtons",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3778a2 L"SwapMouseButtons") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377452 L"ClickLockTime",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377452 L"ClickLockTime") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377452 L"ClickLockTime",00000000,00000004,7f328f5f26b0,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377452 L"ClickLockTime") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001c ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000004,7f328f5f26b0,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f3776a2 L"MouseHoverHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3776a2 L"MouseHoverHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f3776a2 L"MouseHoverHeight",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3776a2 L"MouseHoverHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377682 L"MouseHoverTime",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377682 L"MouseHoverTime") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377682 L"MouseHoverTime",00000000,00000001,0023e138,00000008) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377682 L"MouseHoverTime") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000008) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f3776e2 L"MouseHoverWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3776e2 L"MouseHoverWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f3776e2 L"MouseHoverWidth",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3776e2 L"MouseHoverWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377422 L"MouseSensitivity",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377422 L"MouseSensitivity") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377422 L"MouseSensitivity",00000000,00000001,0023e138,00000006) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377422 L"MouseSensitivity") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000006) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377d42 L"MouseThreshold1",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377d42 L"MouseThreshold1") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377d42 L"MouseThreshold1",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377d42 L"MouseThreshold1") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377d02 L"MouseThreshold2",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377d02 L"MouseThreshold2") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377d02 L"MouseThreshold2",00000000,00000001,0023e138,00000006) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377d02 L"MouseThreshold2") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000006) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377142 L"PaddedBorderWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377142 L"PaddedBorderWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377142 L"PaddedBorderWidth",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377142 L"PaddedBorderWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f377d80 L"Control Panel\\Accessibility\\Blind Access",0023e0a0) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023de68,7f328f377d80 L"Control Panel\\Accessibility\\Blind Access") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000052 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023de78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(0000005c,7f328f37783a L"On",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f37783a L"On") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000006 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(0000005c,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(0000005c,7f328f37783a L"On",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f37783a L"On") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000006 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(0000005c,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f3772a2 L"ScrollHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3772a2 L"ScrollHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f3772a2 L"ScrollHeight",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3772a2 L"ScrollHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001a ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f3772c2 L"ScrollWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f3772c2 L"ScrollWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f3772c2 L"ScrollWidth",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f3772c2 L"ScrollWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000018 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f377e40 L"Control Panel\\Accessibility\\ShowSounds",0023e0a0) ret=7f328f342b48
000b:Call ntdll.RtlInitUnicodeString(0023de68,7f328f377e40 L"Control Panel\\Accessibility\\ShowSounds") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000004e ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023de78,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023ddd0,02000000,0023de88,00000000,0023de78,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f342b48
000b:Call advapi32.RegQueryValueExW(00000060,7f328f37784a L"On",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f37784a L"On") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000006 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000060,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000060,7f328f37784a L"On",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f37784a L"On") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000006 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000060,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377202 L"SmCaptionHeight",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377202 L"SmCaptionHeight") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377202 L"SmCaptionHeight",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377202 L"SmCaptionHeight") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000020 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000050,7f328f377242 L"SmCaptionWidth",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377242 L"SmCaptionWidth") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000050,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000050,7f328f377242 L"SmCaptionWidth",00000000,00000001,0023e138,0000000a) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377242 L"SmCaptionWidth") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000001e ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000050,0023df28,00000000,00000001,0023e138,0000000a) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000040,7f328f377a22 L"SnapToDefaultButton",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377a22 L"SnapToDefaultButton") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000040,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000040,7f328f377a22 L"SnapToDefaultButton",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377a22 L"SnapToDefaultButton") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000040,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377722 L"UserPreferencesMask",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dd58,7f328f377722 L"UserPreferencesMask") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dd58,00000002,0023dd68,0000000c,0023dd54) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377722 L"UserPreferencesMask",00000000,00000003,7f328f5f0f90,00000008) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df98,7f328f377722 L"UserPreferencesMask") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000028 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df98,00000000,00000003,7f328f5f0f90,00000008) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377642 L"WheelScrollChars",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377642 L"WheelScrollChars") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377642 L"WheelScrollChars",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377642 L"WheelScrollChars") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call advapi32.RegQueryValueExW(00000048,7f328f377602 L"WheelScrollLines",00000000,00000000,00000000,00000000) ret=7f328f342e9f
000b:Call ntdll.RtlInitUnicodeString(0023dce8,7f328f377602 L"WheelScrollLines") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000048,0023dce8,00000002,0023dcf8,0000000c,0023dce4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f342e9f
000b:Call advapi32.RegSetValueExW(00000048,7f328f377602 L"WheelScrollLines",00000000,00000001,0023e138,00000004) ret=7f328f342ecc
000b:Call ntdll.RtlInitUnicodeString(0023df28,7f328f377602 L"WheelScrollLines") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000022 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000048,0023df28,00000000,00000001,0023e138,00000004) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f342ecc
000b:Call KERNEL32.GetModuleHandleA(7f328f37852e "gdi32") ret=7f328f34eed8
000b:Call ntdll.RtlInitAnsiString(0023df28,7f328f37852e "gdi32") ret=7b44b379
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b44b379
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023df28,00000000) ret=7b44b3c3
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b44b3c3
000b:Call ntdll.RtlInitUnicodeString(0023de88,7fffff7e9268 L"gdi32") ret=7b4662b0
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000c ret=7b4662b0
000b:Call ntdll.LdrGetDllHandle(00000000,00000000,0023de88,0023de78) ret=7b4662c3
000b:Ret  ntdll.LdrGetDllHandle() retval=00000000 ret=7b4662c3
000b:Ret  KERNEL32.GetModuleHandleA() retval=7f328ef60000 ret=7f328f34eed8
000b:Call KERNEL32.GetProcAddress(7f328ef60000,7f328f37854d "pfnSelectPalette") ret=7f328f34ef08
000b:Call ntdll.RtlInitAnsiString(0023e068,7f328f37854d "pfnSelectPalette") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328ef60000,0023e068,00000000,0023e060) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328f225028 ret=7f328f34ef08
000b:Call KERNEL32.GetProcAddress(7f328ef60000,7f328f378585 "pfnRealizePalette") ret=7f328f34ef5a
000b:Call ntdll.RtlInitAnsiString(0023e068,7f328f378585 "pfnRealizePalette") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328ef60000,0023e068,00000000,0023e060) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328f225020 ret=7f328f34ef5a
000b:Call KERNEL32.LoadLibraryW(7f328f3787e0 L"imm32.dll") ret=7f328f34efa9
000b:Call ntdll.RtlInitUnicodeString(0023e038,7f328f3787e0 L"imm32.dll") ret=7b466f2a
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b466f2a
000b:Call ntdll.RtlInitUnicodeString(0023df48,7b4a1308 L"PATH") ret=7b466ac8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0023df48,0023df58) ret=7b466b02
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000b:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0002dcf0 ret=7b453b54
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0023df48,0023df58) ret=7b466c3a
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000b:Call ntdll.LdrLoadDll(0002dcf0 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;",00000000,0023e038,0023dfb8) ret=7b466ddc
000b:Call PE DLL (proc=0x7f328e228408,module=0x7f328e210000 L"imm32.dll",reason=PROCESS_ATTACH,res=0)
000b:Call user32.User32InitializeImmEntryTable(19650412) ret=7f328e2263c3
000b:Call KERNEL32.GetModuleHandleW(7f328f36f860 L"imm32.dll") ret=7f328f33186e
000b:Call ntdll.RtlInitUnicodeString(0023d648,7f328f36f860 L"imm32.dll") ret=7b4662b0
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b4662b0
000b:Call ntdll.LdrGetDllHandle(00000000,00000000,0023d648,0023d638) ret=7b4662c3
000b:Ret  ntdll.LdrGetDllHandle() retval=00000000 ret=7b4662c3
000b:Ret  KERNEL32.GetModuleHandleW() retval=7f328e210000 ret=7f328f33186e
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f475 "MSIMEService") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,00000018,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec001 ret=7f328f328eb8
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f482 "MSIMEReconvertOptions") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,0000002a,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec002 ret=7f328f328eb8
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f498 "MSIMEMouseOperation") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,00000026,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec003 ret=7f328f328eb8
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f4ac "MSIMEReconvertRequest") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,0000002a,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec004 ret=7f328f328eb8
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f4c2 "MSIMEReconvert") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,0000001c,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec005 ret=7f328f328eb8
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f4d1 "MSIMEQueryPosition") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,00000024,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec006 ret=7f328f328eb8
000b:Call KERNEL32.GlobalAddAtomA(7f328f36f4e4 "MSIMEDocumentFeed") ret=7f328f328eb8
000b:Call ntdll.NtAddAtom(0023d44a,00000022,0023d34e) ret=7b436d97
000b:Ret  ntdll.NtAddAtom() retval=00000000 ret=7b436d97
000b:Ret  KERNEL32.GlobalAddAtomA() retval=7fffff7ec007 ret=7f328f328eb8
000b:Call KERNEL32.GetProcAddress(7f328e210000,7f328f36f4f6 "__wine_get_ui_window") ret=7f328f33194f
000b:Call ntdll.RtlInitAnsiString(0023d738,7f328f36f4f6 "__wine_get_ui_window") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328e210000,0023d738,00000000,0023d730) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328e21f710 ret=7f328f33194f
000b:Call KERNEL32.GetProcAddress(7f328e210000,7f328f36f50b "__wine_register_window") ret=7f328f331965
000b:Call ntdll.RtlInitAnsiString(0023d738,7f328f36f50b "__wine_register_window") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328e210000,0023d738,00000000,0023d730) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328e21f734 ret=7f328f331965
000b:Call KERNEL32.GetProcAddress(7f328e210000,7f328f36f522 "__wine_unregister_window") ret=7f328f33197b
000b:Call ntdll.RtlInitAnsiString(0023d738,7f328f36f522 "__wine_unregister_window") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328e210000,0023d738,00000000,0023d730) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328e21f758 ret=7f328f33197b
000b:Ret  user32.User32InitializeImmEntryTable() retval=00000001 ret=7f328e2263c3
000b:Ret  PE DLL (proc=0x7f328e228408,module=0x7f328e210000 L"imm32.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Ret  ntdll.LdrLoadDll() retval=00000000 ret=7b466ddc
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0002dcf0) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Ret  KERNEL32.LoadLibraryW() retval=7f328e210000 ret=7f328f34efa9
000b:Ret  PE DLL (proc=0x7f328f364978,module=0x7f328f2d0000 L"user32.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Call PE DLL (proc=0x7f328f69b871,module=0x7f328f660000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0)
000b:Call KERNEL32.DisableThreadLibraryCalls(7f328f660000) ret=7f328f68c9a2
000b:Call ntdll.LdrDisableThreadCalloutsForDll(7f328f660000) ret=7b465737
000b:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000b:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7f328f68c9a2
000b:Call KERNEL32.TlsAlloc() ret=7f328f68c9ae
000b:Call ntdll.RtlAcquirePebLock() ret=7b46fb9d
000b:Ret  ntdll.RtlAcquirePebLock() retval=00000000 ret=7b46fb9d
000b:Call ntdll.RtlFindClearBitsAndSet(7bcfbb10,00000001,00000001) ret=7b46fbb1
000b:Ret  ntdll.RtlFindClearBitsAndSet() retval=00000001 ret=7b46fbb1
000b:Call ntdll.RtlReleasePebLock() ret=7b46fc70
000b:Ret  ntdll.RtlReleasePebLock() retval=00000000 ret=7b46fc70
000b:Ret  KERNEL32.TlsAlloc() retval=00000001 ret=7f328f68c9ae
000b:Ret  PE DLL (proc=0x7f328f69b871,module=0x7f328f660000 L"shlwapi.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Call PE DLL (proc=0x7f328f97da75,module=0x7f328f8f0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0)
000b:Call KERNEL32.DisableThreadLibraryCalls(7f328f8f0000) ret=7f328f92582a
000b:Call ntdll.LdrDisableThreadCalloutsForDll(7f328f8f0000) ret=7b465737
000b:Ret  ntdll.LdrDisableThreadCalloutsForDll() retval=00000000 ret=7b465737
000b:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=7f328f92582a
000b:Call KERNEL32.GetModuleFileNameW(7f328f8f0000,7f328fd455c0,00000104) ret=7f328f92583f
000b:Call ntdll.LdrLockLoaderLock(00000000,00000000,0023e178) ret=7b4666ec
000b:Ret  ntdll.LdrLockLoaderLock() retval=00000000 ret=7b4666ec
000b:Call ntdll.LdrFindEntryForAddress(7f328f8f0000,0023e180) ret=7b46670f
000b:Ret  ntdll.LdrFindEntryForAddress() retval=00000000 ret=7b46670f
000b:Call ntdll.LdrUnlockLoaderLock(00000000,0000000b) ret=7b466774
000b:Ret  ntdll.LdrUnlockLoaderLock() retval=00000000 ret=7b466774
000b:Ret  KERNEL32.GetModuleFileNameW() retval=0000001f ret=7f328f92583f
000b:Ret  PE DLL (proc=0x7f328f97da75,module=0x7f328f8f0000 L"shell32.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Ret  ntdll.LdrLoadDll() retval=00000000 ret=7b466ddc
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ca00) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Ret  KERNEL32.LoadLibraryA() retval=7f328f8f0000 ret=7f328ffe93c7
000b:Call KERNEL32.GetProcAddress(7f328f8f0000,7f32901f2cb2 "SHGetFolderPathW") ret=7f328ffe93f6
000b:Call ntdll.RtlInitAnsiString(0023ea48,7f32901f2cb2 "SHGetFolderPathW") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328f8f0000,0023ea48,00000000,0023ea40) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328f8faaf8 ret=7f328ffe93f6
000b:Call shell32.SHGetFolderPathW(00000000,0000001a,00000000,00000000,0023f3b0) ret=7f328ffe6ee9
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0023dee8) ret=7f328f945729
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000064) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000068) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000064) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000068) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000064) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945729
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0023dee0) ret=7f328f945789
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000008c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945789
000b:Call advapi32.RegQueryValueExW(00000064,7f328f990be0 L"AppData",00000000,0023ded8,0023e8a0,0023dedc) ret=7f328f945809
000b:Call ntdll.RtlInitUnicodeString(0023dad8,7f328f990be0 L"AppData") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000064,0023dad8,00000002,0023dae8,00000100,0023dad4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f945809
000b:Call advapi32.RegCloseKey(00000068) ret=7f328f9458b3
000b:Call ntdll.NtClose(00000068) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458b3
000b:Call advapi32.RegCloseKey(00000064) ret=7f328f9458bd
000b:Call ntdll.NtClose(00000064) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458bd
000b:Call advapi32.RegCreateKeyW(ffffffff80000002,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0023dee8) ret=7f328f945729
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=c0000034 ret=7f328fd7d5fe
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000064) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000068) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000064) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000068) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d761
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d761
000b:Call ntdll.NtClose(00000064) ret=7f328fd7d77d
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd7d77d
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945729
000b:Call advapi32.RegCreateKeyW(ffffffff80000002,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0023dee0) ret=7f328f945789
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000008c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945789
000b:Call advapi32.RegQueryValueExW(00000064,7f328f990be0 L"AppData",00000000,0023ded8,0023e8a0,0023dedc) ret=7f328f945809
000b:Call ntdll.RtlInitUnicodeString(0023dad8,7f328f990be0 L"AppData") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000064,0023dad8,00000002,0023dae8,00000100,0023dad4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f945809
000b:Call advapi32.RegCloseKey(00000068) ret=7f328f9458b3
000b:Call ntdll.NtClose(00000068) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458b3
000b:Call advapi32.RegCloseKey(00000064) ret=7f328f9458bd
000b:Call ntdll.NtClose(00000064) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458bd
000b:Call shlwapi.PathAddBackslashW(0023e8a0 L"%USERPROFILE%") ret=7f328f942bf4
000b:Ret  shlwapi.PathAddBackslashW() retval=0023e8bc ret=7f328f942bf4
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328f98ed60 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0023dfe8,0023dfe4) ret=7f328f9452dd
000b:Call ntdll.RtlInitUnicodeString(0023dda8,7f328f98ed60 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000072 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ddb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dd10,000f003f,0023ddc8,00000000,0023ddb8,00000000,0023dfe4) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328f9452dd
000b:Call KERNEL32.GetSystemDirectoryW(0023e400,00000104) ret=7f328f945307
000b:Ret  KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7f328f945307
000b:Call advapi32.RegQueryValueExW(00000064,7f328f98ed20 L"ProfilesDirectory",00000000,0023df90,0023e1f8,0023df94) ret=7f328f9450c4
000b:Call ntdll.RtlInitUnicodeString(0023db88,7f328f98ed20 L"ProfilesDirectory") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000064,0023db88,00000002,0023db98,00000100,0023db84) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f9450c4
000b:Call advapi32.RegSetValueExW(00000064,7f328f98ed20 L"ProfilesDirectory",00000000,00000002,0023e1f8,00000012) ret=7f328f945180
000b:Call ntdll.RtlInitUnicodeString(0023ddc8,7f328f98ed20 L"ProfilesDirectory") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000064,0023ddc8,00000000,00000002,0023e1f8,00000012) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328f945180
000b:Call advapi32.GetUserNameW(0023e400,0023dfe4) ret=7f328f945467
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7f3290a3c3a0 "root",ffffffff,00000000,200e400000000) ret=7f328fd6a527
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000005 ret=7f328fd6a527
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7f3290a3c3a0 "root",ffffffff,0023e400,200e400000005) ret=7f328fd6a565
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000005 ret=7f328fd6a565
000b:Ret  advapi32.GetUserNameW() retval=00000001 ret=7f328f945467
000b:Call shlwapi.PathAppendW(0023e698 L"C:\\users",0023e400 L"root") ret=7f328f945472
000b:Ret  shlwapi.PathAppendW() retval=00000001 ret=7f328f945472
000b:Call shlwapi.PathAppendW(0023e698 L"C:\\users\\root",0023e00a L"\\Application Data") ret=7f328f945497
000b:Ret  shlwapi.PathAppendW() retval=00000001 ret=7f328f945497
000b:Call advapi32.RegCloseKey(00000064) ret=7f328f9455a1
000b:Call ntdll.NtClose(00000064) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9455a1
000b:Call shlwapi.PathFileExistsW(0023e698 L"C:\\users\\root\\Application Data") ret=7f328f94805b
000b:Call KERNEL32.SetErrorMode(00000001) ret=7f328f67cf10
000b:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000000c,0023e394,00000004,00000000) ret=7b46fa30
000b:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b46fa30
000b:Call ntdll.NtSetInformationProcess(ffffffffffffffff,0000000c,0023e460,00000004) ret=7b46fa48
000b:Ret  ntdll.NtSetInformationProcess() retval=00000000 ret=7b46fa48
000b:Ret  KERNEL32.SetErrorMode() retval=00000000 ret=7f328f67cf10
000b:Call KERNEL32.GetFileAttributesW(0023e698 L"C:\\users\\root\\Application Data") ret=7f328f67cf1a
000b:Call ntdll.RtlDosPathNameToNtPathName_U(0023e698 L"C:\\users\\root\\Application Data",0023e320,00000000,00000000) ret=7b45035b
000b:Ret  ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b45035b
000b:Call ntdll.NtQueryAttributesFile(0023e358,0023e330) ret=7b4503a8
000b:Ret  ntdll.NtQueryAttributesFile() retval=00000000 ret=7b4503a8
000b:Call ntdll.RtlFreeUnicodeString(0023e320) ret=7b4503b2
000b:Ret  ntdll.RtlFreeUnicodeString() retval=00000000 ret=7b4503b2
000b:Ret  KERNEL32.GetFileAttributesW() retval=00000010 ret=7f328f67cf1a
000b:Call KERNEL32.SetErrorMode(00000000) ret=7f328f67cf23
000b:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000000c,0023e394,00000004,00000000) ret=7b46fa30
000b:Ret  ntdll.NtQueryInformationProcess() retval=00000000 ret=7b46fa30
000b:Call ntdll.NtSetInformationProcess(ffffffffffffffff,0000000c,0023e460,00000004) ret=7b46fa48
000b:Ret  ntdll.NtSetInformationProcess() retval=00000000 ret=7b46fa48
000b:Ret  KERNEL32.SetErrorMode() retval=00000001 ret=7f328f67cf23
000b:Ret  shlwapi.PathFileExistsW() retval=00000001 ret=7f328f94805b
000b:Ret  shell32.SHGetFolderPathW() retval=00000000 ret=7f328ffe6ee9
000b:Call advapi32.RegSetValueExW(00000024,7f328ffea200 L"APPDATA",00000000,00000001,0023f3b0,0000003e) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea200 L"APPDATA") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000010 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000024,0023eac8,00000000,00000001,0023f3b0,0000003e) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call advapi32.RegSetValueExW(00000024,7f328ffea1e0 L"CLIENTNAME",00000000,00000001,7f328ffea1d0,00000010) ret=7f328ffe896c
000b:Call ntdll.RtlInitUnicodeString(0023eac8,7f328ffea1e0 L"CLIENTNAME") ret=7f328fd808d8
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000016 ret=7f328fd808d8
000b:Call ntdll.NtSetValueKey(00000024,0023eac8,00000000,00000001,7f328ffea1d0,00000010) ret=7f328fd808f2
000b:Ret  ntdll.NtSetValueKey() retval=00000000 ret=7f328fd808f2
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd808f9
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd808f9
000b:Ret  advapi32.RegSetValueExW() retval=00000000 ret=7f328ffe896c
000b:Call shell32.SHGetFolderPathW(00000000,00000028,00000000,00000000,0023f3b0) ret=7f328ffe6f3e
000b:Call KERNEL32.LoadLibraryA(7f328fbe72a8 "ole32.dll") ret=7f328f97da30
000b:Call ntdll.RtlInitAnsiString(0023e298,7f328fbe72a8 "ole32.dll") ret=7b44b379
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b44b379
000b:Call ntdll.RtlAnsiStringToUnicodeString(7fffff7e9258,0023e298,00000000) ret=7b44b3c3
000b:Ret  ntdll.RtlAnsiStringToUnicodeString() retval=00000000 ret=7b44b3c3
000b:Call ntdll.RtlInitUnicodeString(0023e1f8,7fffff7e9268 L"ole32.dll") ret=7b466f2a
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000014 ret=7b466f2a
000b:Call ntdll.RtlInitUnicodeString(0023e108,7b4a1308 L"PATH") ret=7b466ac8
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000000a ret=7b466ac8
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0023e108,0023e118) ret=7b466b02
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466b02
000b:Call ntdll.RtlEnterCriticalSection(7b7fb340) ret=7b466b22
000b:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=7b466b22
000b:Call ntdll.RtlAllocateHeap(00010000,00000000,00000090) ret=7b453b54
000b:Ret  ntdll.RtlAllocateHeap() retval=0001ca00 ret=7b453b54
000b:Call ntdll.RtlLeaveCriticalSection(7b7fb340) ret=7b466bd9
000b:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=7b466bd9
000b:Call ntdll.RtlQueryEnvironmentVariable_U(00000000,0023e108,0023e118) ret=7b466c3a
000b:Ret  ntdll.RtlQueryEnvironmentVariable_U() retval=c0000100 ret=7b466c3a
000b:Call ntdll.LdrLoadDll(0001ca00 L"C:\\windows\\system32;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;",00000000,0023e1f8,0023e178) ret=7b466ddc
000b:Call PE DLL (proc=0x7f328dc6974d,module=0x7f328dc20000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0)
000b:Ret  PE DLL (proc=0x7f328dc6974d,module=0x7f328dc20000 L"rpcrt4.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Call PE DLL (proc=0x7f328df9abdd,module=0x7f328dec0000 L"ole32.dll",reason=PROCESS_ATTACH,res=0)
000b:Ret  PE DLL (proc=0x7f328df9abdd,module=0x7f328dec0000 L"ole32.dll",reason=PROCESS_ATTACH,res=0) retval=1
000b:Ret  ntdll.LdrLoadDll() retval=00000000 ret=7b466ddc
000b:Call ntdll.RtlFreeHeap(00010000,00000000,0001ca00) ret=7b453b67
000b:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7b453b67
000b:Ret  KERNEL32.LoadLibraryA() retval=7f328dec0000 ret=7f328f97da30
000b:Call KERNEL32.GetProcAddress(7f328dec0000,7f328fbe7419 "StringFromGUID2") ret=7f328f97da5f
000b:Call ntdll.RtlInitAnsiString(0023e318,7f328fbe7419 "StringFromGUID2") ret=7b467279
000b:Ret  ntdll.RtlInitAnsiString() retval=00000000 ret=7b467279
000b:Call ntdll.LdrGetProcedureAddress(7f328dec0000,0023e318,00000000,0023e310) ret=7b467294
000b:Ret  ntdll.LdrGetProcedureAddress() retval=00000000 ret=7b467294
000b:Ret  KERNEL32.GetProcAddress() retval=7f328decec94 ret=7f328f97da5f
000b:Call ole32.StringFromGUID2(7f328f99c1f0,0023e578,00000027) ret=7f328f945ba9
000b:Ret  ole32.StringFromGUID2() retval=00000027 ret=7f328f945ba9
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0023dee8) ret=7f328f945729
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945729
000b:Call advapi32.RegCreateKeyW(ffffffff80000001,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0023dee0) ret=7f328f945789
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000008c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945789
000b:Call advapi32.RegQueryValueExW(00000068,0023e578 L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}",00000000,0023ded8,0023e8a0,0023dedc) ret=7f328f945809
000b:Call ntdll.RtlInitUnicodeString(0023dad8,0023e578 L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000004e ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000068,0023dad8,00000002,0023dae8,00000100,0023dad4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f945809
000b:Call advapi32.RegCloseKey(00000064) ret=7f328f9458b3
000b:Call ntdll.NtClose(00000064) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458b3
000b:Call advapi32.RegCloseKey(00000068) ret=7f328f9458bd
000b:Call ntdll.NtClose(00000068) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458bd
000b:Call advapi32.RegCreateKeyW(ffffffff80000002,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",0023dee8) ret=7f328f945729
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ec60 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000082 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945729
000b:Call advapi32.RegCreateKeyW(ffffffff80000002,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",0023dee0) ret=7f328f945789
000b:Call ntdll.RtlInitUnicodeString(0023dc98,7f328f98ebc0 L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000008c ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023dca8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dc00,02000000,0023dcb8,00000000,0023dca8,00000000,00000000) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyW() retval=00000000 ret=7f328f945789
000b:Call advapi32.RegQueryValueExW(00000068,0023e578 L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}",00000000,0023ded8,0023e8a0,0023dedc) ret=7f328f945809
000b:Call ntdll.RtlInitUnicodeString(0023dad8,0023e578 L"{5E6C858F-0E22-4760-9AFE-EA3317B67173}") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=0000004e ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000068,0023dad8,00000002,0023dae8,00000100,0023dad4) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=c0000034 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(c0000034) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000002 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000002 ret=7f328f945809
000b:Call advapi32.RegCloseKey(00000064) ret=7f328f9458b3
000b:Call ntdll.NtClose(00000064) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458b3
000b:Call advapi32.RegCloseKey(00000068) ret=7f328f9458bd
000b:Call ntdll.NtClose(00000068) ret=7f328fd80453
000b:Ret  ntdll.NtClose() retval=00000000 ret=7f328fd80453
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd8045a
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd8045a
000b:Ret  advapi32.RegCloseKey() retval=00000000 ret=7f328f9458bd
000b:Call advapi32.RegCreateKeyExW(ffffffff80000002,7f328f98ed60 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",00000000,00000000,00000000,000f003f,00000000,0023dfe8,0023dfe4) ret=7f328f9452dd
000b:Call ntdll.RtlInitUnicodeString(0023dda8,7f328f98ed60 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") ret=7f328fd7ecc1
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000072 ret=7f328fd7ecc1
000b:Call ntdll.RtlInitUnicodeString(0023ddb8,00000000) ret=7f328fd7eccc
000b:Ret  ntdll.RtlInitUnicodeString() retval=7bc70405 ret=7f328fd7eccc
000b:Call ntdll.NtCreateKey(0023dd10,000f003f,0023ddc8,00000000,0023ddb8,00000000,0023dfe4) ret=7f328fd7d5fe
000b:Ret  ntdll.NtCreateKey() retval=00000000 ret=7f328fd7d5fe
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7ecea
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7ecea
000b:Ret  advapi32.RegCreateKeyExW() retval=00000000 ret=7f328f9452dd
000b:Call KERNEL32.GetSystemDirectoryW(0023e400,00000104) ret=7f328f945307
000b:Ret  KERNEL32.GetSystemDirectoryW() retval=00000013 ret=7f328f945307
000b:Call advapi32.RegQueryValueExW(00000064,7f328f98ed20 L"ProfilesDirectory",00000000,0023df90,0023e1f8,0023df94) ret=7f328f9450c4
000b:Call ntdll.RtlInitUnicodeString(0023db88,7f328f98ed20 L"ProfilesDirectory") ret=7f328fd7e011
000b:Ret  ntdll.RtlInitUnicodeString() retval=00000024 ret=7f328fd7e011
000b:Call ntdll.NtQueryValueKey(00000064,0023db88,00000002,0023db98,00000100,0023db84) ret=7f328fd7e075
000b:Ret  ntdll.NtQueryValueKey() retval=00000000 ret=7f328fd7e075
000b:Call ntdll.RtlNtStatusToDosError(00000000) ret=7f328fd7e186
000b:Ret  ntdll.RtlNtStatusToDosError() retval=00000000 ret=7f328fd7e186
000b:Ret  advapi32.RegQueryValueExW() retval=00000000 ret=7f328f9450c4
000b:Call advapi32.GetUserNameW(0023e400,0023dfe4) ret=7f328f945467
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7f3290a3c3a0 "root",ffffffff,00000000,200e400000000) ret=7f328fd6a527
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000005 ret=7f328fd6a527
000b:Call KERNEL32.MultiByteToWideChar(0000fdf2,00000000,7f3290a3c3a0 "root",ffffffff,0023e400,200e400000005) ret=7f328fd6a565
000b:Ret  KERNEL32.MultiByteToWideChar() retval=00000005 ret=7f328fd6a565
000b